diff --git a/lib/hook-utils.sh b/lib/hook-utils.sh
index a426dd4e9..9818a6a73 100644
--- a/lib/hook-utils.sh
+++ b/lib/hook-utils.sh
@@ -610,6 +610,66 @@ hook::repo_root() {
   return 1
 }
 
+# Repo-relative form of <file> under <repo-root> — the shape the telemetry
+# schema requires of `data.file` ("relative to the consuming repo root").
+#
+# Both sides go through `cygpath -lm` (long name, forward-slash mixed form)
+# when it is available, so the prefix strip compares ONE representation: on
+# Windows Git Bash `git rev-parse --show-toplevel` answers with a drive-letter
+# path while file_path may arrive in POSIX mount form, and the raw strip never
+# matches. On Linux/macOS cygpath is absent and both paths are already POSIX,
+# so the strip runs directly.
+#
+# What survives the strip is not trusted to BE relative. A mount/symlink
+# mismatch, or a cygpath that answers for one side and not the other, leaves
+# the whole absolute path, which embeds the developer's username and breaks the
+# schema contract. Such a path degrades to its basename rather than leaking
+# (#1133), and the answer is DISTINGUISHABLE: return 1 and
+# HOOK_REPO_RELATIVE_DEGRADED=1. Success (return 0) means the path is genuinely
+# repo-relative. Telemetry callers that ignore the status still get the safe
+# value; a caller that feeds the result to a TOOL must branch on it, because a
+# bare basename resolved against the repo root names a different file.
+#   FILE_REL=$(hook::repo_relative_path "$FILE" "$REPO_ROOT")
+#
+# Callers under `set -e` must not take the status from a bare assignment: a
+# degraded answer returns 1, and `FILE_REL=$(hook::repo_relative_path ...)`
+# would abort the shell. Append `|| <flag>=1` (what every tool-feeding caller
+# here does) or `|| :` to keep the failure handled.
+# shellcheck disable=SC2034  # public contract: callers may read HOOK_REPO_RELATIVE_DEGRADED
+hook::repo_relative_path() {
+  local file="$1" root="$2" rel="$1"
+  HOOK_REPO_RELATIVE_DEGRADED=0
+  # An empty root anchors nothing, and the strip must not run against one:
+  # `${file#""/}` merely shaves the leading slash, handing back a path that is
+  # still the caller's absolute path but no longer LOOKS absolute to the
+  # redaction below, so it would leak with a success status. Skipping the strip
+  # leaves rel as the input, which the redaction then degrades correctly.
+  if [[ -n "$root" ]]; then
+    if command -v cygpath >/dev/null 2>&1; then
+      local file_lm root_lm
+      file_lm=$(cygpath -lm "$file" 2>/dev/null)
+      root_lm=$(cygpath -lm "$root" 2>/dev/null)
+      if [[ -n "$file_lm" && -n "$root_lm" ]]; then
+        rel="${file_lm#"$root_lm"/}"
+      fi
+    else
+      rel="${file#"$root"/}"
+    fi
+  fi
+  # POSIX-absolute, drive-letter, and UNC are the three spellings an unstripped
+  # path arrives in. Trim on either separator: a mixed-form path carries both.
+  case "$rel" in
+  /* | [A-Za-z]:* | \\\\*)
+    rel="${rel##*/}"
+    rel="${rel##*\\}"
+    HOOK_REPO_RELATIVE_DEGRADED=1
+    ;;
+  *) ;; # already repo-relative, nothing to redact
+  esac
+  printf '%s' "$rel"
+  ((HOOK_REPO_RELATIVE_DEGRADED == 0))
+}
+
 # Buffer a complete JSON payload from stdin, tolerating Windows Win32-pipe
 # late-EOF stalls via a bounded read on the inherited fd0. Returns the payload
 # on success; returns 1 on empty/incomplete stdin (caller skips), or 2 when the
diff --git a/lib/hook-utils.test.sh b/lib/hook-utils.test.sh
index 7cb201db5..66baf54a6 100755
--- a/lib/hook-utils.test.sh
+++ b/lib/hook-utils.test.sh
@@ -2732,6 +2732,117 @@ RR_NOGIT="$(mktemp -d)"
 repo_root_unresolved "$RR_NOGIT"
 rm -rf "$RR_NOGIT"
 
+# --- hook::repo_relative_path: strip, redact, and say which happened ---------
+# The helper answers on three channels like the two above: stdout, the return
+# code, and HOOK_REPO_RELATIVE_DEGRADED. The return code is the one a caller in
+# a command substitution can read, so every case asserts all three.
+#
+# BOTH arms run on EVERY host. Which arm the helper takes is decided by
+# `command -v cygpath`, so each case drives it in a child shell whose PATH holds
+# either nothing (the POSIX direct-strip arm) or ONLY a stub cygpath (the
+# Windows long-name arm). Gating on the real host's cygpath instead would leave
+# whichever arm that host lacks untested everywhere, including on the
+# windows-2025 `hook-utils-windows` lane, which exists to cover exactly this.
+RRP_DIR="$(mktemp -d)"
+mkdir -p "$RRP_DIR/nocyg" "$RRP_DIR/cyg"
+# Stand-in for Git Bash's `cygpath -lm`: POSIX mount form (/c/x) to mixed
+# Windows form (C:/x). Only the conversion the helper depends on is modeled, and
+# modeling it is the point — the arm exists because the two sides of the strip
+# arrive in different spellings and must be brought to one.
+#
+# Builtins only, and an absolute shebang taken from $BASH: the stub runs with
+# the near-empty PATH below, where `/usr/bin/env bash` could not resolve bash
+# and `cut`/`tr` could not resolve at all.
+{
+  printf '#!%s\n' "$BASH"
+  cat <<'CYGEOF'
+p=""
+for a in "$@"; do p="$a"; done
+_lower="abcdefghijklmnopqrstuvwxyz"
+_upper="ABCDEFGHIJKLMNOPQRSTUVWXYZ"
+case "$p" in
+/[A-Za-z]/* | /[A-Za-z])
+  d="${p:1:1}"
+  rest="${p:2}"
+  case "$d" in
+  [a-z])
+    _pre="${_lower%%"$d"*}"
+    d="${_upper:${#_pre}:1}"
+    ;;
+  *) ;;
+  esac
+  p="$d:$rest"
+  ;;
+*) ;;
+esac
+printf '%s\n' "$p"
+CYGEOF
+} >"$RRP_DIR/cyg/cygpath"
+chmod +x "$RRP_DIR/cyg/cygpath"
+
+# rrp_case <mode> <label> <file> <root> <expected-out> <expected-degraded>
+#   mode nocyg → no cygpath on PATH, helper takes the direct-strip arm
+#   mode cyg   → stub cygpath on PATH, helper takes the normalization arm
+# The child calls the helper twice on purpose: command substitution captures
+# stdout but runs in a subshell, so the global has to be read from a plain call.
+# Only shell builtins are used inside, because PATH is deliberately near-empty.
+rrp_case() {
+  local mode="$1" label="$2" file="$3" root="$4" want="$5" want_deg="$6" probe
+  probe=$(
+    # $BASH, not a bare `bash`: the PATH below is deliberately near-empty, so a
+    # bare name could not be resolved. shellcheck cannot see that the quoted
+    # argument is a bash script, so it reads the (correctly) unexpanded $1/$2/$3
+    # as a mistake; they are the child's own positional parameters.
+    # shellcheck disable=SC2016
+    PATH="$RRP_DIR/$mode" "$BASH" -c '
+      # shellcheck source=hook-utils.sh
+      source "$1"
+      _out=$(hook::repo_relative_path "$2" "$3")
+      _rc=$?
+      hook::repo_relative_path "$2" "$3" >/dev/null
+      printf "%s\n%s\n%s\n" "$_rc" "$HOOK_REPO_RELATIVE_DEGRADED" "$_out"
+    ' _ "$HOOK_DIR/hook-utils.sh" "$file" "$root"
+  )
+  local rc flag out
+  {
+    read -r rc
+    read -r flag
+    read -r out
+  } <<<"$probe"
+  if [[ "$out" == "$want" ]] && ((rc == want_deg)) && ((flag == want_deg)); then
+    ok "repo_relative_path[$mode]: $label"
+  else
+    fail "repo_relative_path[$mode] $label: out=$out (want $want) rc=$rc flag=$flag (want $want_deg)"
+  fi
+}
+
+# The POSIX arm.
+rrp_case nocyg "strips the repo root" /repo/a/b.md /repo a/b.md 0
+rrp_case nocyg "root mismatch redacts to basename" /elsewhere/a/b.md /repo b.md 1
+rrp_case nocyg "drive-letter path redacts" 'C:/proj/app/a/b.md' /repo b.md 1
+# portability-ok: a literal Windows UNC fixture path; the \s and \b are path
+# separators plus a filename, not GNU regex escapes.
+rrp_case nocyg "UNC path redacts on the backslash" '\\srv\share\b.md' /repo b.md 1
+rrp_case nocyg "an already-relative path passes through" a/b.md /repo a/b.md 0
+# Only the trailing-slash prefix strips, so the root passed as the file stays
+# absolute and redacts — the caller never receives an unmarked absolute path.
+rrp_case nocyg "the root as the file redacts" /repo /repo repo 1
+# An empty root anchors nothing. Without the non-empty guard the strip would
+# shave the leading slash and hand back srv/proj/repo/a.txt with status 0: still
+# the caller's absolute path, no longer matching the redaction's /* arm.
+rrp_case nocyg "an empty root redacts instead of shaving the slash" /srv/proj/repo/a.txt "" a.txt 1
+
+# The cygpath arm. The first case is the one the arm exists for: file in POSIX
+# mount form, root in drive-letter form. The nocyg control directly below shows
+# the same inputs degrading without the normalization, so the case cannot pass
+# for the wrong reason.
+rrp_case cyg "mount-form file under a drive-letter root strips" /c/repo/a/b.md 'C:/repo' a/b.md 0
+rrp_case nocyg "...and the same inputs degrade without cygpath (control)" /c/repo/a/b.md 'C:/repo' b.md 1
+rrp_case cyg "both sides already mixed form" 'C:/repo/a/b.md' 'C:/repo' a/b.md 0
+rrp_case cyg "a root mismatch still redacts through the cygpath arm" /c/elsewhere/b.md 'C:/repo' b.md 1
+rrp_case cyg "an empty root redacts through the cygpath arm" /c/repo/a/b.md "" b.md 1
+rm -rf "$RRP_DIR"
+
 # --- hook::bash_parse_segments: unquoted # comments to EOL --------------------
 bps_last=()
 bps_collect() {
diff --git a/plugins/actionlint/.claude-plugin/plugin.json b/plugins/actionlint/.claude-plugin/plugin.json
index f18d98274..268511462 100644
--- a/plugins/actionlint/.claude-plugin/plugin.json
+++ b/plugins/actionlint/.claude-plugin/plugin.json
@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "actionlint",
-  "version": "0.8.25",
+  "version": "0.8.26",
   "description": "Lint GitHub Actions workflow files on edit via actionlint, surfacing findings as advisory context.",
   "author": {
     "name": "Melodic Software",
diff --git a/plugins/actionlint/CHANGELOG.md b/plugins/actionlint/CHANGELOG.md
index b5b0db2ae..8b1c960cf 100644
--- a/plugins/actionlint/CHANGELOG.md
+++ b/plugins/actionlint/CHANGELOG.md
@@ -3,6 +3,28 @@
 All notable changes to the `actionlint` plugin are documented here. Format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning.
 
+## [0.8.26]
+
+### Fixed
+
+- **A redacted path no longer becomes the lint target.** `FILE_REL` is passed to
+  `actionlint` as the file to lint, but since the degrade landed in 0.6.0
+  (#1133) it can hold a bare basename, which resolves against the repo root to a
+  workflow that is not there. The lint then found nothing and this advisory hook
+  reported a clean pass. It now branches on the helper's degrade status and
+  lints the absolute path in that case. A symlinked-root regression case in
+  `hooks/actionlint-check.test.sh` pins it: the case fails without the branch.
+
+### Changed
+
+- **The repo-relative path block moved into the shared lib.** This hook's own
+  `FILE_REL` computation, including the absolute-path degrade added in 0.6.0
+  (#1133), is now `hook::repo_relative_path` in `hooks/hook-utils.sh`. Emitted
+  `data.file` values are unchanged; eight sibling call sites that had copied the
+  block without the degrade pick the fix up through it, and the helper
+  additionally trims a UNC path on its backslash. Copies stay byte-identical via
+  `scripts/sync-hook-utils.sh`.
+
 ## [0.8.25]
 
 ### Changed
diff --git a/plugins/actionlint/hooks/actionlint-check.sh b/plugins/actionlint/hooks/actionlint-check.sh
index 0dac41191..95ac6b029 100755
--- a/plugins/actionlint/hooks/actionlint-check.sh
+++ b/plugins/actionlint/hooks/actionlint-check.sh
@@ -86,30 +86,15 @@ fi
 # Resolve repo root early — used to compute the schema-required repo-relative
 # path in data.file.
 REPO_ROOT="$(hook::repo_root "$(dirname "$FILE")")"
-# Repo-relative path: schema requires "relative to the consuming repo root".
-# On Windows Git Bash, git rev-parse --show-toplevel returns a drive-letter path
-# while FILE may be in POSIX mount form. Normalize both through cygpath -lm
-# (long name, forward-slash mixed form) when available so the prefix strip
-# compares the same representation. On Linux/macOS, cygpath is absent and both
-# paths are already POSIX. Falls back to raw FILE on any normalization error.
-FILE_REL="$FILE"
-if command -v cygpath >/dev/null 2>&1; then
-  _file_lm=$(cygpath -lm "$FILE" 2>/dev/null)
-  _root_lm=$(cygpath -lm "$REPO_ROOT" 2>/dev/null)
-  if [[ -n "$_file_lm" && -n "$_root_lm" ]]; then
-    FILE_REL="${_file_lm#"$_root_lm"/}"
-  fi
-else
-  FILE_REL="${FILE#"$REPO_ROOT"/}"
-fi
-# The schema's data.file contract is repo-relative. When the prefix strip did
-# not match (mount/symlink mismatch, cygpath disagreement), FILE_REL is still
-# an absolute path -- degrade to the basename rather than leaking the absolute
-# path into telemetry.
-case "$FILE_REL" in
-[A-Za-z]:* | /* | \\\\*) FILE_REL="$(basename "$FILE")" ;;
-*) ;;
-esac
+# Repo-relative path, serving two consumers: the schema-required data.file, and
+# the argument actionlint runs on from the repo root. A path the prefix strip
+# could not make relative degrades to its basename, which is right for telemetry
+# but names a DIFFERENT file when resolved against the repo root, so the
+# invocation below has to know which of the two it holds. Command substitution
+# runs the helper in a subshell, so its HOOK_REPO_RELATIVE_DEGRADED global never
+# reaches this scope; the return status is the channel that survives.
+FILE_REL_DEGRADED=0
+FILE_REL="$(hook::repo_relative_path "$FILE" "$REPO_ROOT")" || FILE_REL_DEGRADED=1
 
 # Build the telemetry data object for the current TOOL/FILE_REL. $1 is the
 # findings JSON array. jq is authoritative. The fallback is a fixed empty-shape
@@ -152,7 +137,14 @@ if ! cd "$REPO_ROOT" 2>/dev/null; then
   emit_tel "error" '[]'
   exit 0
 fi
-AL_OUTPUT=$(actionlint -shellcheck= -pyflakes= -- "$FILE_REL" 2>&1)
+# The lint target is the repo-relative path so diagnostics echo it, but only
+# when it IS repo-relative. A degraded FILE_REL is a bare basename redacted for
+# telemetry; resolved against the repo root it names a different workflow or
+# none, and this advisory hook would drop real findings silently. Fall back to
+# the absolute path there.
+AL_TARGET="$FILE_REL"
+((FILE_REL_DEGRADED == 0)) || AL_TARGET="$FILE"
+AL_OUTPUT=$(actionlint -shellcheck= -pyflakes= -- "$AL_TARGET" 2>&1)
 AL_STATUS=$?
 
 # actionlint exits 0 (clean) or 1 (problems found); anything else -- 2 invalid
diff --git a/plugins/actionlint/hooks/actionlint-check.test.sh b/plugins/actionlint/hooks/actionlint-check.test.sh
index 1368ee9fa..3edd93338 100755
--- a/plugins/actionlint/hooks/actionlint-check.test.sh
+++ b/plugins/actionlint/hooks/actionlint-check.test.sh
@@ -449,6 +449,48 @@ else
   fail "actionlint-absent latch/PATH diagnostic wrong: $OUT_MIN"
 fi
 
+# --- Symlinked repo root: the lint target must stay the edited file ----------
+# The hook cd's to the repo root and passes actionlint a repo-relative path so
+# diagnostics read cleanly. That path comes from hook::repo_relative_path, which
+# REDACTS to a bare basename when the repo-root prefix strip does not match.
+# Reaching one repo through a symlink produces exactly that mismatch: file_path
+# keeps the symlinked spelling while `git rev-parse --show-toplevel` answers with
+# the physical path. Workflow files always sit under .github/workflows/, so the
+# redacted basename resolves against the repo root to a file that is not there,
+# and without the degrade branch a real violation vanishes from an advisory hook.
+if ln -s "$WORK/symlink-real" "$WORK/symlink-link" 2>/dev/null; then
+  REPO_SL="$WORK/symlink-real"
+  new_repo "$REPO_SL"
+  # shellcheck disable=SC2016  # literal workflow YAML fixture: ${{ }} must stay unexpanded
+  printf 'name: bad\non: push\njobs:\n  build:\n    runs-on: ubuntu-latest\n    steps:\n      - run: echo "${{ steps.missing.outputs.x }}"\n' \
+    >"$REPO_SL/.github/workflows/violation.yml"
+  OUT_SL=$(run_hook "$WORK/symlink-link/.github/workflows/violation.yml")
+  CTX_SL=$(printf '%s' "$OUT_SL" | jq -r '.hookSpecificOutput.additionalContext // ""' 2>/dev/null)
+  if printf '%s' "$CTX_SL" | grep -q 'missing'; then
+    ok "symlinked root: the real violation still surfaces (lint target not redacted)"
+  else
+    fail "symlinked root: violation lost, hook linted a redacted path: $OUT_SL"
+  fi
+  if ! printf '%s' "$CTX_SL" | grep -qiE 'could not read|no such file'; then
+    ok "symlinked root: no unreadable-target error from a basename-only target"
+  else
+    fail "symlinked root: actionlint got a nonexistent target: $CTX_SL"
+  fi
+  # The redaction itself must still hold on the telemetry side: data.file is
+  # the basename, never the absolute path that embeds the developer's username.
+  SL_OUT="$WORK/sl-telemetry.json"
+  SL_SINK=$(make_sink "cat >\"$SL_OUT\"")
+  run_hook_env "$WORK/symlink-link/.github/workflows/violation.yml" \
+    CLAUDE_PLUGIN_OPTION_ACTIONLINT_ENABLED=true HOOK_TELEMETRY_SINK="$SL_SINK" >/dev/null
+  if wait_for_sink "$SL_OUT" && [[ "$(jq -r '.data.file' "$SL_OUT" 2>/dev/null)" == "violation.yml" ]]; then
+    ok "symlinked root: telemetry data.file stays redacted to the basename"
+  else
+    fail "symlinked root: data.file was $(jq -r '.data.file' "$SL_OUT" 2>/dev/null)"
+  fi
+else
+  echo "SKIP: symlinks unavailable on this filesystem -- symlinked-root case skipped"
+fi
+
 echo
 echo "PASS=$PASS FAIL=$FAIL"
 [[ $FAIL -eq 0 ]]
diff --git a/plugins/actionlint/hooks/hook-utils.sh b/plugins/actionlint/hooks/hook-utils.sh
index a426dd4e9..9818a6a73 100644
--- a/plugins/actionlint/hooks/hook-utils.sh
+++ b/plugins/actionlint/hooks/hook-utils.sh
@@ -610,6 +610,66 @@ hook::repo_root() {
   return 1
 }
 
+# Repo-relative form of <file> under <repo-root> — the shape the telemetry
+# schema requires of `data.file` ("relative to the consuming repo root").
+#
+# Both sides go through `cygpath -lm` (long name, forward-slash mixed form)
+# when it is available, so the prefix strip compares ONE representation: on
+# Windows Git Bash `git rev-parse --show-toplevel` answers with a drive-letter
+# path while file_path may arrive in POSIX mount form, and the raw strip never
+# matches. On Linux/macOS cygpath is absent and both paths are already POSIX,
+# so the strip runs directly.
+#
+# What survives the strip is not trusted to BE relative. A mount/symlink
+# mismatch, or a cygpath that answers for one side and not the other, leaves
+# the whole absolute path, which embeds the developer's username and breaks the
+# schema contract. Such a path degrades to its basename rather than leaking
+# (#1133), and the answer is DISTINGUISHABLE: return 1 and
+# HOOK_REPO_RELATIVE_DEGRADED=1. Success (return 0) means the path is genuinely
+# repo-relative. Telemetry callers that ignore the status still get the safe
+# value; a caller that feeds the result to a TOOL must branch on it, because a
+# bare basename resolved against the repo root names a different file.
+#   FILE_REL=$(hook::repo_relative_path "$FILE" "$REPO_ROOT")
+#
+# Callers under `set -e` must not take the status from a bare assignment: a
+# degraded answer returns 1, and `FILE_REL=$(hook::repo_relative_path ...)`
+# would abort the shell. Append `|| <flag>=1` (what every tool-feeding caller
+# here does) or `|| :` to keep the failure handled.
+# shellcheck disable=SC2034  # public contract: callers may read HOOK_REPO_RELATIVE_DEGRADED
+hook::repo_relative_path() {
+  local file="$1" root="$2" rel="$1"
+  HOOK_REPO_RELATIVE_DEGRADED=0
+  # An empty root anchors nothing, and the strip must not run against one:
+  # `${file#""/}` merely shaves the leading slash, handing back a path that is
+  # still the caller's absolute path but no longer LOOKS absolute to the
+  # redaction below, so it would leak with a success status. Skipping the strip
+  # leaves rel as the input, which the redaction then degrades correctly.
+  if [[ -n "$root" ]]; then
+    if command -v cygpath >/dev/null 2>&1; then
+      local file_lm root_lm
+      file_lm=$(cygpath -lm "$file" 2>/dev/null)
+      root_lm=$(cygpath -lm "$root" 2>/dev/null)
+      if [[ -n "$file_lm" && -n "$root_lm" ]]; then
+        rel="${file_lm#"$root_lm"/}"
+      fi
+    else
+      rel="${file#"$root"/}"
+    fi
+  fi
+  # POSIX-absolute, drive-letter, and UNC are the three spellings an unstripped
+  # path arrives in. Trim on either separator: a mixed-form path carries both.
+  case "$rel" in
+  /* | [A-Za-z]:* | \\\\*)
+    rel="${rel##*/}"
+    rel="${rel##*\\}"
+    HOOK_REPO_RELATIVE_DEGRADED=1
+    ;;
+  *) ;; # already repo-relative, nothing to redact
+  esac
+  printf '%s' "$rel"
+  ((HOOK_REPO_RELATIVE_DEGRADED == 0))
+}
+
 # Buffer a complete JSON payload from stdin, tolerating Windows Win32-pipe
 # late-EOF stalls via a bounded read on the inherited fd0. Returns the payload
 # on success; returns 1 on empty/incomplete stdin (caller skips), or 2 when the
diff --git a/plugins/autonomy/.claude-plugin/plugin.json b/plugins/autonomy/.claude-plugin/plugin.json
index 159b50171..d170a3eb4 100644
--- a/plugins/autonomy/.claude-plugin/plugin.json
+++ b/plugins/autonomy/.claude-plugin/plugin.json
@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "autonomy",
-  "version": "0.22.17",
+  "version": "0.22.18",
   "description": "Governed autonomous agent operation: role-topology, binding-seam, wiring-vs-advisor, telemetry, return-accounting, trigger-dispatch, per-work-class guardrail-matrix, standing-routine-catalog, and design-only runner-charter contracts for climbing the AI-adoption ladder, plus a guided-setup skill that discovers an adopting org's state, writes its schema-versioned binding, wires standards-pinned OTLP emission with a zero-cost file-artifact default, wires human-attested return capture at the task boundary, wires signal adapters with one governed dispatch entrypoint, binds the five-class guardrail matrix to an org's isolation substrates with an in-boundary live-validation probe before recording each fail-closed binding, and stands up standing-routine-catalog classes as scheduled temporal signal adapters behind the one governed queue with free scheduling defaults wired as reviewable changes and each routine's work-class mapping homed on the security surface.",
   "author": {
     "name": "Melodic Software",
diff --git a/plugins/autonomy/CHANGELOG.md b/plugins/autonomy/CHANGELOG.md
index 42257c719..2ccc2cf3a 100644
--- a/plugins/autonomy/CHANGELOG.md
+++ b/plugins/autonomy/CHANGELOG.md
@@ -3,6 +3,17 @@
 All notable changes to the `autonomy` plugin are documented here. Format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning.
 
+## [0.22.18]
+
+### Changed
+
+- **Vendored `hook-utils.sh` gained `hook::repo_relative_path`.** The shared lib
+  now owns the repo-relative path computation twelve sibling hooks had each
+  hand-copied, together with the absolute-path degrade only four of those twelve
+  copies carried (#1133). This plugin's hooks do not call it; the copy is bumped
+  because `scripts/sync-hook-utils.sh` keeps every carrying plugin
+  byte-identical.
+
 ## [0.22.17]
 
 ### Changed
diff --git a/plugins/autonomy/hooks/hook-utils.sh b/plugins/autonomy/hooks/hook-utils.sh
index a426dd4e9..9818a6a73 100644
--- a/plugins/autonomy/hooks/hook-utils.sh
+++ b/plugins/autonomy/hooks/hook-utils.sh
@@ -610,6 +610,66 @@ hook::repo_root() {
   return 1
 }
 
+# Repo-relative form of <file> under <repo-root> — the shape the telemetry
+# schema requires of `data.file` ("relative to the consuming repo root").
+#
+# Both sides go through `cygpath -lm` (long name, forward-slash mixed form)
+# when it is available, so the prefix strip compares ONE representation: on
+# Windows Git Bash `git rev-parse --show-toplevel` answers with a drive-letter
+# path while file_path may arrive in POSIX mount form, and the raw strip never
+# matches. On Linux/macOS cygpath is absent and both paths are already POSIX,
+# so the strip runs directly.
+#
+# What survives the strip is not trusted to BE relative. A mount/symlink
+# mismatch, or a cygpath that answers for one side and not the other, leaves
+# the whole absolute path, which embeds the developer's username and breaks the
+# schema contract. Such a path degrades to its basename rather than leaking
+# (#1133), and the answer is DISTINGUISHABLE: return 1 and
+# HOOK_REPO_RELATIVE_DEGRADED=1. Success (return 0) means the path is genuinely
+# repo-relative. Telemetry callers that ignore the status still get the safe
+# value; a caller that feeds the result to a TOOL must branch on it, because a
+# bare basename resolved against the repo root names a different file.
+#   FILE_REL=$(hook::repo_relative_path "$FILE" "$REPO_ROOT")
+#
+# Callers under `set -e` must not take the status from a bare assignment: a
+# degraded answer returns 1, and `FILE_REL=$(hook::repo_relative_path ...)`
+# would abort the shell. Append `|| <flag>=1` (what every tool-feeding caller
+# here does) or `|| :` to keep the failure handled.
+# shellcheck disable=SC2034  # public contract: callers may read HOOK_REPO_RELATIVE_DEGRADED
+hook::repo_relative_path() {
+  local file="$1" root="$2" rel="$1"
+  HOOK_REPO_RELATIVE_DEGRADED=0
+  # An empty root anchors nothing, and the strip must not run against one:
+  # `${file#""/}` merely shaves the leading slash, handing back a path that is
+  # still the caller's absolute path but no longer LOOKS absolute to the
+  # redaction below, so it would leak with a success status. Skipping the strip
+  # leaves rel as the input, which the redaction then degrades correctly.
+  if [[ -n "$root" ]]; then
+    if command -v cygpath >/dev/null 2>&1; then
+      local file_lm root_lm
+      file_lm=$(cygpath -lm "$file" 2>/dev/null)
+      root_lm=$(cygpath -lm "$root" 2>/dev/null)
+      if [[ -n "$file_lm" && -n "$root_lm" ]]; then
+        rel="${file_lm#"$root_lm"/}"
+      fi
+    else
+      rel="${file#"$root"/}"
+    fi
+  fi
+  # POSIX-absolute, drive-letter, and UNC are the three spellings an unstripped
+  # path arrives in. Trim on either separator: a mixed-form path carries both.
+  case "$rel" in
+  /* | [A-Za-z]:* | \\\\*)
+    rel="${rel##*/}"
+    rel="${rel##*\\}"
+    HOOK_REPO_RELATIVE_DEGRADED=1
+    ;;
+  *) ;; # already repo-relative, nothing to redact
+  esac
+  printf '%s' "$rel"
+  ((HOOK_REPO_RELATIVE_DEGRADED == 0))
+}
+
 # Buffer a complete JSON payload from stdin, tolerating Windows Win32-pipe
 # late-EOF stalls via a bounded read on the inherited fd0. Returns the payload
 # on success; returns 1 on empty/incomplete stdin (caller skips), or 2 when the
diff --git a/plugins/bash-format/.claude-plugin/plugin.json b/plugins/bash-format/.claude-plugin/plugin.json
index 296655556..d1dd44bfa 100644
--- a/plugins/bash-format/.claude-plugin/plugin.json
+++ b/plugins/bash-format/.claude-plugin/plugin.json
@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "bash-format",
-  "version": "0.7.26",
+  "version": "0.7.27",
   "description": "Auto-format and lint shell scripts on edit via shfmt + ShellCheck, using the consuming repo's own .editorconfig and .shellcheckrc.",
   "author": {
     "name": "Melodic Software",
diff --git a/plugins/bash-format/CHANGELOG.md b/plugins/bash-format/CHANGELOG.md
index 39972ab64..886e22250 100644
--- a/plugins/bash-format/CHANGELOG.md
+++ b/plugins/bash-format/CHANGELOG.md
@@ -3,6 +3,20 @@
 All notable changes to the `bash-format` plugin are documented here. Format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning.
 
+## [0.7.27]
+
+### Fixed
+
+- **Telemetry `data.file` can no longer leak an absolute path (#1133).** The
+  hand-copied `FILE_REL` block is replaced by `hook::repo_relative_path` in the
+  shared `hooks/hook-utils.sh`, which carries the degrade eight of the twelve
+  copies lacked: a path the repo-root prefix strip could not make relative
+  (mount or symlink mismatch, cygpath disagreement) now comes back as its
+  basename instead of an absolute path embedding the developer's username.
+  `FILE_REL` reaches only the telemetry payload here, never the shfmt or
+  shellcheck invocation, so the formatting target is unaffected. Copies stay
+  byte-identical via `scripts/sync-hook-utils.sh`.
+
 ## [0.7.26]
 
 ### Changed
diff --git a/plugins/bash-format/hooks/bash-format.sh b/plugins/bash-format/hooks/bash-format.sh
index a31bb3948..7a6969ccb 100755
--- a/plugins/bash-format/hooks/bash-format.sh
+++ b/plugins/bash-format/hooks/bash-format.sh
@@ -73,26 +73,14 @@ REPO_ROOT="$(hook::repo_root "$(dirname "$FILE")")"
 # telemetry-only subprocesses (the tool_name jq parse, and 2× cygpath on
 # Windows).
 #
-# FILE_REL is the repo-relative path: schema requires "relative to the consuming
-# repo root". On Windows Git Bash, git rev-parse --show-toplevel returns a
-# drive-letter path while FILE may be in POSIX mount form. Normalize both
-# through cygpath -lm (long name, forward-slash mixed form) when available so
-# the prefix strip compares the same representation. On Linux/macOS, cygpath is
-# absent and both paths are already POSIX. Falls back to raw FILE on any
-# normalization error.
+# FILE_REL is the repo-relative path the schema requires ("relative to the
+# consuming repo root"), degrading to the basename when the prefix strip does
+# not match, so an absolute path never reaches telemetry.
 TOOL=""
 FILE_REL="$FILE"
 if hook::telemetry_enabled; then
   TOOL=$(printf '%s' "$INPUT" | jq -r '.tool_name // empty' 2>/dev/null)
-  if command -v cygpath >/dev/null 2>&1; then
-    _file_lm=$(cygpath -lm "$FILE" 2>/dev/null)
-    _root_lm=$(cygpath -lm "$REPO_ROOT" 2>/dev/null)
-    if [[ -n "$_file_lm" && -n "$_root_lm" ]]; then
-      FILE_REL="${_file_lm#"$_root_lm"/}"
-    fi
-  else
-    FILE_REL="${FILE#"$REPO_ROOT"/}"
-  fi
+  FILE_REL="$(hook::repo_relative_path "$FILE" "$REPO_ROOT")"
 fi
 
 # Build the telemetry data object for the current TOOL/FILE_REL. $1 is the
diff --git a/plugins/bash-format/hooks/hook-utils.sh b/plugins/bash-format/hooks/hook-utils.sh
index a426dd4e9..9818a6a73 100644
--- a/plugins/bash-format/hooks/hook-utils.sh
+++ b/plugins/bash-format/hooks/hook-utils.sh
@@ -610,6 +610,66 @@ hook::repo_root() {
   return 1
 }
 
+# Repo-relative form of <file> under <repo-root> — the shape the telemetry
+# schema requires of `data.file` ("relative to the consuming repo root").
+#
+# Both sides go through `cygpath -lm` (long name, forward-slash mixed form)
+# when it is available, so the prefix strip compares ONE representation: on
+# Windows Git Bash `git rev-parse --show-toplevel` answers with a drive-letter
+# path while file_path may arrive in POSIX mount form, and the raw strip never
+# matches. On Linux/macOS cygpath is absent and both paths are already POSIX,
+# so the strip runs directly.
+#
+# What survives the strip is not trusted to BE relative. A mount/symlink
+# mismatch, or a cygpath that answers for one side and not the other, leaves
+# the whole absolute path, which embeds the developer's username and breaks the
+# schema contract. Such a path degrades to its basename rather than leaking
+# (#1133), and the answer is DISTINGUISHABLE: return 1 and
+# HOOK_REPO_RELATIVE_DEGRADED=1. Success (return 0) means the path is genuinely
+# repo-relative. Telemetry callers that ignore the status still get the safe
+# value; a caller that feeds the result to a TOOL must branch on it, because a
+# bare basename resolved against the repo root names a different file.
+#   FILE_REL=$(hook::repo_relative_path "$FILE" "$REPO_ROOT")
+#
+# Callers under `set -e` must not take the status from a bare assignment: a
+# degraded answer returns 1, and `FILE_REL=$(hook::repo_relative_path ...)`
+# would abort the shell. Append `|| <flag>=1` (what every tool-feeding caller
+# here does) or `|| :` to keep the failure handled.
+# shellcheck disable=SC2034  # public contract: callers may read HOOK_REPO_RELATIVE_DEGRADED
+hook::repo_relative_path() {
+  local file="$1" root="$2" rel="$1"
+  HOOK_REPO_RELATIVE_DEGRADED=0
+  # An empty root anchors nothing, and the strip must not run against one:
+  # `${file#""/}` merely shaves the leading slash, handing back a path that is
+  # still the caller's absolute path but no longer LOOKS absolute to the
+  # redaction below, so it would leak with a success status. Skipping the strip
+  # leaves rel as the input, which the redaction then degrades correctly.
+  if [[ -n "$root" ]]; then
+    if command -v cygpath >/dev/null 2>&1; then
+      local file_lm root_lm
+      file_lm=$(cygpath -lm "$file" 2>/dev/null)
+      root_lm=$(cygpath -lm "$root" 2>/dev/null)
+      if [[ -n "$file_lm" && -n "$root_lm" ]]; then
+        rel="${file_lm#"$root_lm"/}"
+      fi
+    else
+      rel="${file#"$root"/}"
+    fi
+  fi
+  # POSIX-absolute, drive-letter, and UNC are the three spellings an unstripped
+  # path arrives in. Trim on either separator: a mixed-form path carries both.
+  case "$rel" in
+  /* | [A-Za-z]:* | \\\\*)
+    rel="${rel##*/}"
+    rel="${rel##*\\}"
+    HOOK_REPO_RELATIVE_DEGRADED=1
+    ;;
+  *) ;; # already repo-relative, nothing to redact
+  esac
+  printf '%s' "$rel"
+  ((HOOK_REPO_RELATIVE_DEGRADED == 0))
+}
+
 # Buffer a complete JSON payload from stdin, tolerating Windows Win32-pipe
 # late-EOF stalls via a bounded read on the inherited fd0. Returns the payload
 # on success; returns 1 on empty/incomplete stdin (caller skips), or 2 when the
diff --git a/plugins/biome-format/.claude-plugin/plugin.json b/plugins/biome-format/.claude-plugin/plugin.json
index 348499676..2b4283638 100644
--- a/plugins/biome-format/.claude-plugin/plugin.json
+++ b/plugins/biome-format/.claude-plugin/plugin.json
@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "biome-format",
-  "version": "0.6.25",
+  "version": "0.6.26",
   "description": "Auto-format and lint JS/TS/JSX/JSON on edit via Biome, only when a biome.json governs the repo — using the consuming repo's own Biome config.",
   "author": {
     "name": "Melodic Software",
diff --git a/plugins/biome-format/CHANGELOG.md b/plugins/biome-format/CHANGELOG.md
index 2bf16c814..7c67afcfa 100644
--- a/plugins/biome-format/CHANGELOG.md
+++ b/plugins/biome-format/CHANGELOG.md
@@ -3,6 +3,20 @@
 All notable changes to the `biome-format` plugin are documented here. Format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning.
 
+## [0.6.26]
+
+### Fixed
+
+- **Telemetry `data.file` can no longer leak an absolute path (#1133).** The
+  hand-copied `FILE_REL` block is replaced by `hook::repo_relative_path` in the
+  shared `hooks/hook-utils.sh`, which carries the degrade eight of the twelve
+  copies lacked: a path the repo-root prefix strip could not make relative
+  (mount or symlink mismatch, cygpath disagreement) now comes back as its
+  basename instead of an absolute path embedding the developer's username.
+  `FILE_REL` reaches only the telemetry payload here; Biome is invoked with a
+  separately computed `CONFIG_DIR`-relative path, so the formatting target is
+  unaffected. Copies stay byte-identical via `scripts/sync-hook-utils.sh`.
+
 ## [0.6.25]
 
 ### Changed
diff --git a/plugins/biome-format/hooks/biome-format.sh b/plugins/biome-format/hooks/biome-format.sh
index 64ea8b24c..9c119d205 100755
--- a/plugins/biome-format/hooks/biome-format.sh
+++ b/plugins/biome-format/hooks/biome-format.sh
@@ -77,26 +77,14 @@ REPO_ROOT="$(hook::repo_root "$(dirname "$FILE")")"
 # telemetry-only subprocesses (the tool_name jq parse, and 2× cygpath on
 # Windows).
 #
-# FILE_REL is the repo-relative path: schema requires "relative to the consuming
-# repo root". On Windows Git Bash, git rev-parse --show-toplevel returns a
-# drive-letter path while FILE may be in POSIX mount form. Normalize both
-# through cygpath -lm (long name, forward-slash mixed form) when available so
-# the prefix strip compares the same representation. On Linux/macOS, cygpath is
-# absent and both paths are already POSIX. Falls back to raw FILE on any
-# normalization error.
+# FILE_REL is the repo-relative path the schema requires ("relative to the
+# consuming repo root"), degrading to the basename when the prefix strip does
+# not match, so an absolute path never reaches telemetry.
 TOOL=""
 FILE_REL="$FILE"
 if hook::telemetry_enabled; then
   TOOL=$(printf '%s' "$INPUT" | jq -r '.tool_name // empty' 2>/dev/null)
-  if command -v cygpath >/dev/null 2>&1; then
-    _file_lm=$(cygpath -lm "$FILE" 2>/dev/null)
-    _root_lm=$(cygpath -lm "$REPO_ROOT" 2>/dev/null)
-    if [[ -n "$_file_lm" && -n "$_root_lm" ]]; then
-      FILE_REL="${_file_lm#"$_root_lm"/}"
-    fi
-  else
-    FILE_REL="${FILE#"$REPO_ROOT"/}"
-  fi
+  FILE_REL="$(hook::repo_relative_path "$FILE" "$REPO_ROOT")"
 fi
 
 # Build the telemetry data object for the current TOOL/FILE_REL. $1 is the
diff --git a/plugins/biome-format/hooks/hook-utils.sh b/plugins/biome-format/hooks/hook-utils.sh
index a426dd4e9..9818a6a73 100644
--- a/plugins/biome-format/hooks/hook-utils.sh
+++ b/plugins/biome-format/hooks/hook-utils.sh
@@ -610,6 +610,66 @@ hook::repo_root() {
   return 1
 }
 
+# Repo-relative form of <file> under <repo-root> — the shape the telemetry
+# schema requires of `data.file` ("relative to the consuming repo root").
+#
+# Both sides go through `cygpath -lm` (long name, forward-slash mixed form)
+# when it is available, so the prefix strip compares ONE representation: on
+# Windows Git Bash `git rev-parse --show-toplevel` answers with a drive-letter
+# path while file_path may arrive in POSIX mount form, and the raw strip never
+# matches. On Linux/macOS cygpath is absent and both paths are already POSIX,
+# so the strip runs directly.
+#
+# What survives the strip is not trusted to BE relative. A mount/symlink
+# mismatch, or a cygpath that answers for one side and not the other, leaves
+# the whole absolute path, which embeds the developer's username and breaks the
+# schema contract. Such a path degrades to its basename rather than leaking
+# (#1133), and the answer is DISTINGUISHABLE: return 1 and
+# HOOK_REPO_RELATIVE_DEGRADED=1. Success (return 0) means the path is genuinely
+# repo-relative. Telemetry callers that ignore the status still get the safe
+# value; a caller that feeds the result to a TOOL must branch on it, because a
+# bare basename resolved against the repo root names a different file.
+#   FILE_REL=$(hook::repo_relative_path "$FILE" "$REPO_ROOT")
+#
+# Callers under `set -e` must not take the status from a bare assignment: a
+# degraded answer returns 1, and `FILE_REL=$(hook::repo_relative_path ...)`
+# would abort the shell. Append `|| <flag>=1` (what every tool-feeding caller
+# here does) or `|| :` to keep the failure handled.
+# shellcheck disable=SC2034  # public contract: callers may read HOOK_REPO_RELATIVE_DEGRADED
+hook::repo_relative_path() {
+  local file="$1" root="$2" rel="$1"
+  HOOK_REPO_RELATIVE_DEGRADED=0
+  # An empty root anchors nothing, and the strip must not run against one:
+  # `${file#""/}` merely shaves the leading slash, handing back a path that is
+  # still the caller's absolute path but no longer LOOKS absolute to the
+  # redaction below, so it would leak with a success status. Skipping the strip
+  # leaves rel as the input, which the redaction then degrades correctly.
+  if [[ -n "$root" ]]; then
+    if command -v cygpath >/dev/null 2>&1; then
+      local file_lm root_lm
+      file_lm=$(cygpath -lm "$file" 2>/dev/null)
+      root_lm=$(cygpath -lm "$root" 2>/dev/null)
+      if [[ -n "$file_lm" && -n "$root_lm" ]]; then
+        rel="${file_lm#"$root_lm"/}"
+      fi
+    else
+      rel="${file#"$root"/}"
+    fi
+  fi
+  # POSIX-absolute, drive-letter, and UNC are the three spellings an unstripped
+  # path arrives in. Trim on either separator: a mixed-form path carries both.
+  case "$rel" in
+  /* | [A-Za-z]:* | \\\\*)
+    rel="${rel##*/}"
+    rel="${rel##*\\}"
+    HOOK_REPO_RELATIVE_DEGRADED=1
+    ;;
+  *) ;; # already repo-relative, nothing to redact
+  esac
+  printf '%s' "$rel"
+  ((HOOK_REPO_RELATIVE_DEGRADED == 0))
+}
+
 # Buffer a complete JSON payload from stdin, tolerating Windows Win32-pipe
 # late-EOF stalls via a bounded read on the inherited fd0. Returns the payload
 # on success; returns 1 on empty/incomplete stdin (caller skips), or 2 when the
diff --git a/plugins/claude-ops/.claude-plugin/plugin.json b/plugins/claude-ops/.claude-plugin/plugin.json
index 36a46fc36..e7448f97f 100644
--- a/plugins/claude-ops/.claude-plugin/plugin.json
+++ b/plugins/claude-ops/.claude-plugin/plugin.json
@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "claude-ops",
-  "version": "0.38.18",
+  "version": "0.38.19",
   "description": "Claude Code operations toolkit. Twelve skills: audit-skill-visibility (audit whether each installed skill is actually VISIBLE to the model, and diagnose why most of a fleet never gets used \u2014 a skill is invisible when its description is dropped by Claude Code's skill-listing context budget, which drops descriptions least-invoked-first so an unused skill loses the keywords that would let it be matched, from skills genuinely not wanted, from skills the run cannot observe at all; computes whether the listing overflows from documented settings, and withholds every cold verdict the data cannot support rather than reporting absence of data as absence of use), inventory (read-only enumeration of the complete invocable surface \u2014 every built-in CLI command with aliases and hidden/gated status, every bundled skill, and every component of every installed plugin across all marketplaces; reads the shipped binary because upstream publishes no built-in command list, and carries an integrity verdict so a drifted build reports counts as floors rather than silently short totals), audit-install-state (read-only audit of the machine-scope ~/.claude installation directory and ~/.claude.json \u2014 full inventory split into an authored surface and rolled-up bulk trees, product-managed retention vs genuinely unmanaged state, filename-scheme resolution before any process-liveness check, and deliberate/mid-experiment detection; reports, never deletes), audit-performance (read-only slowness-diagnostic capture run at the moment the machine or a session feels slow: CLI version, retention-sweep health including the silent unparsable-settings pause, a timed census walk of the install tree as a sweep-cost proxy, active-session and plugin-fleet counts, a process census, and the fan-out layer, which covers a load-labelled no-op spawn baseline, every hook that will fire bucketed per-tool-call versus per-turn with its invocation shape, the configured statusline, subagent concurrency and spawn-depth ceilings against documented defaults, whether running sessions predate the settings file they are judged by, and orphan attribution by parent liveness rather than age; read against a bundled known-performance-issues reference that also records the causes tested and cleared; separates the four documented suspects of accumulated state, version regression, component bloat, and per-spawn fan-out cost, and routes remediation out; reports, never mutates, and never executes a discovered hook or statusline command), audit-native-overlap (map native Claude Code surfaces \u2014 built-in CLI commands, bundled skills, plugin-backed built-ins, session-provided skills \u2014 against the current repo's plugin skills and agents, so a custom component never silently duplicates what Claude Code itself ships; bare invocation is a read-only overlap report carrying the extraction's integrity floors and a shared-listing-budget exposure section, verdicts are human-gated in a committed store rendered into a generated registry whose every row carries an observable recheck trigger, and only an explicit apply step bakes presence-gated native references into descriptions and Boundary sections), observability (read locally captured telemetry \u2014 OTEL store, collector, hook-event JSONL, ccusage \u2014 with trend reports and store pruning), known-issues (search known Claude product GitHub bugs, check service health, maintain a persistent tracked-issue registry), changelog (ingest Claude Code changelog entries and integrate them into the current repo), plugins (bring a machine's plugin fleet current on demand \u2014 marketplace refresh, effective-scope updates including in-repo project/local installs, new-plugin install per policy, scope-divergence detection and explicit convergence), morning-brief (read-only gh-based operator morning view \u2014 queue-label counts, merge-ready PRs, parked decisions with their RECOMMENDED lines, and loop-lane telemetry freshness), lanes (start/restart/stop/status loop lanes as named background Claude Code sessions seeded from canonical prompt files, with per-lane model/effort, a repo-pull + marketplace-refresh launch step, and a consume-restarts action \u2014 an OS-schedulable reader that relaunches stopped lanes whose telemetry carries a restart_request), and a re-runnable setup action that settles where the known-issues registry lives. Plus a family of eight advisory *-audit hooks (API errors, config changes, instruction loads, permission denials, pre-compaction, skill usage, tool failures, and unsurfaced hook failures \u2014 the last also warns the user via systemMessage, since a hook that fails to launch enforces nothing and Claude Code surfaces the failure to nobody) that emit the shared hook-telemetry envelope, and a reference sink that maps envelopes into the hook-events.jsonl the observability skill reads.",
   "author": {
     "name": "Melodic Software",
diff --git a/plugins/claude-ops/CHANGELOG.md b/plugins/claude-ops/CHANGELOG.md
index 7b9b8996a..32a700304 100644
--- a/plugins/claude-ops/CHANGELOG.md
+++ b/plugins/claude-ops/CHANGELOG.md
@@ -3,6 +3,17 @@
 All notable changes to the `claude-ops` plugin are documented here. Format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning.
 
+## [0.38.19]
+
+### Changed
+
+- **Vendored `hook-utils.sh` gained `hook::repo_relative_path`.** The shared lib
+  now owns the repo-relative path computation twelve sibling hooks had each
+  hand-copied, together with the absolute-path degrade only four of those twelve
+  copies carried (#1133). This plugin's hooks do not call it; the copy is bumped
+  because `scripts/sync-hook-utils.sh` keeps every carrying plugin
+  byte-identical.
+
 ## [0.38.18]
 
 ### Fixed
diff --git a/plugins/claude-ops/hooks/hook-utils.sh b/plugins/claude-ops/hooks/hook-utils.sh
index a426dd4e9..9818a6a73 100644
--- a/plugins/claude-ops/hooks/hook-utils.sh
+++ b/plugins/claude-ops/hooks/hook-utils.sh
@@ -610,6 +610,66 @@ hook::repo_root() {
   return 1
 }
 
+# Repo-relative form of <file> under <repo-root> — the shape the telemetry
+# schema requires of `data.file` ("relative to the consuming repo root").
+#
+# Both sides go through `cygpath -lm` (long name, forward-slash mixed form)
+# when it is available, so the prefix strip compares ONE representation: on
+# Windows Git Bash `git rev-parse --show-toplevel` answers with a drive-letter
+# path while file_path may arrive in POSIX mount form, and the raw strip never
+# matches. On Linux/macOS cygpath is absent and both paths are already POSIX,
+# so the strip runs directly.
+#
+# What survives the strip is not trusted to BE relative. A mount/symlink
+# mismatch, or a cygpath that answers for one side and not the other, leaves
+# the whole absolute path, which embeds the developer's username and breaks the
+# schema contract. Such a path degrades to its basename rather than leaking
+# (#1133), and the answer is DISTINGUISHABLE: return 1 and
+# HOOK_REPO_RELATIVE_DEGRADED=1. Success (return 0) means the path is genuinely
+# repo-relative. Telemetry callers that ignore the status still get the safe
+# value; a caller that feeds the result to a TOOL must branch on it, because a
+# bare basename resolved against the repo root names a different file.
+#   FILE_REL=$(hook::repo_relative_path "$FILE" "$REPO_ROOT")
+#
+# Callers under `set -e` must not take the status from a bare assignment: a
+# degraded answer returns 1, and `FILE_REL=$(hook::repo_relative_path ...)`
+# would abort the shell. Append `|| <flag>=1` (what every tool-feeding caller
+# here does) or `|| :` to keep the failure handled.
+# shellcheck disable=SC2034  # public contract: callers may read HOOK_REPO_RELATIVE_DEGRADED
+hook::repo_relative_path() {
+  local file="$1" root="$2" rel="$1"
+  HOOK_REPO_RELATIVE_DEGRADED=0
+  # An empty root anchors nothing, and the strip must not run against one:
+  # `${file#""/}` merely shaves the leading slash, handing back a path that is
+  # still the caller's absolute path but no longer LOOKS absolute to the
+  # redaction below, so it would leak with a success status. Skipping the strip
+  # leaves rel as the input, which the redaction then degrades correctly.
+  if [[ -n "$root" ]]; then
+    if command -v cygpath >/dev/null 2>&1; then
+      local file_lm root_lm
+      file_lm=$(cygpath -lm "$file" 2>/dev/null)
+      root_lm=$(cygpath -lm "$root" 2>/dev/null)
+      if [[ -n "$file_lm" && -n "$root_lm" ]]; then
+        rel="${file_lm#"$root_lm"/}"
+      fi
+    else
+      rel="${file#"$root"/}"
+    fi
+  fi
+  # POSIX-absolute, drive-letter, and UNC are the three spellings an unstripped
+  # path arrives in. Trim on either separator: a mixed-form path carries both.
+  case "$rel" in
+  /* | [A-Za-z]:* | \\\\*)
+    rel="${rel##*/}"
+    rel="${rel##*\\}"
+    HOOK_REPO_RELATIVE_DEGRADED=1
+    ;;
+  *) ;; # already repo-relative, nothing to redact
+  esac
+  printf '%s' "$rel"
+  ((HOOK_REPO_RELATIVE_DEGRADED == 0))
+}
+
 # Buffer a complete JSON payload from stdin, tolerating Windows Win32-pipe
 # late-EOF stalls via a bounded read on the inherited fd0. Returns the payload
 # on success; returns 1 on empty/incomplete stdin (caller skips), or 2 when the
diff --git a/plugins/context-guard/.claude-plugin/plugin.json b/plugins/context-guard/.claude-plugin/plugin.json
index 9520e5590..dab037a87 100644
--- a/plugins/context-guard/.claude-plugin/plugin.json
+++ b/plugins/context-guard/.claude-plugin/plugin.json
@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "context-guard",
-  "version": "0.7.26",
+  "version": "0.7.27",
   "description": "Per-session context-window observability plus the first shipped consumer: a statusline wrapper tees each session's context_window fields to a per-session snapshot file, a zone resolver classifies usage into smart/acceptable/dumb bands (percentage bands plus window-class token bands, conservative-min combination, zones.json SSOT with shipped defaults), a reader contract fixes how consuming sessions interpret the snapshots, and zone-crossing hooks report once per transition into a worse zone across two channels — the continuation menu to the operator, who owns that choice, and to the model only the zone determination plus the counter-steer that a zone word is not a decay signal (advisory by default; an optional blocking mode gates new mutating work on a fresh dumb-zone snapshot with handoff-writing exempt), with a PostCompact hook persisting an evidence-degraded marker.",
   "author": {
     "name": "Melodic Software",
diff --git a/plugins/context-guard/CHANGELOG.md b/plugins/context-guard/CHANGELOG.md
index 411023014..7fc315ba4 100644
--- a/plugins/context-guard/CHANGELOG.md
+++ b/plugins/context-guard/CHANGELOG.md
@@ -5,6 +5,17 @@ All notable changes to the `context-guard` plugin.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project
 adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.7.27]
+
+### Changed
+
+- **Vendored `hook-utils.sh` gained `hook::repo_relative_path`.** The shared lib
+  now owns the repo-relative path computation twelve sibling hooks had each
+  hand-copied, together with the absolute-path degrade only four of those twelve
+  copies carried (#1133). This plugin's hooks do not call it; the copy is bumped
+  because `scripts/sync-hook-utils.sh` keeps every carrying plugin
+  byte-identical.
+
 ## [0.7.26]
 
 ### Changed
diff --git a/plugins/context-guard/hooks/hook-utils.sh b/plugins/context-guard/hooks/hook-utils.sh
index a426dd4e9..9818a6a73 100755
--- a/plugins/context-guard/hooks/hook-utils.sh
+++ b/plugins/context-guard/hooks/hook-utils.sh
@@ -610,6 +610,66 @@ hook::repo_root() {
   return 1
 }
 
+# Repo-relative form of <file> under <repo-root> — the shape the telemetry
+# schema requires of `data.file` ("relative to the consuming repo root").
+#
+# Both sides go through `cygpath -lm` (long name, forward-slash mixed form)
+# when it is available, so the prefix strip compares ONE representation: on
+# Windows Git Bash `git rev-parse --show-toplevel` answers with a drive-letter
+# path while file_path may arrive in POSIX mount form, and the raw strip never
+# matches. On Linux/macOS cygpath is absent and both paths are already POSIX,
+# so the strip runs directly.
+#
+# What survives the strip is not trusted to BE relative. A mount/symlink
+# mismatch, or a cygpath that answers for one side and not the other, leaves
+# the whole absolute path, which embeds the developer's username and breaks the
+# schema contract. Such a path degrades to its basename rather than leaking
+# (#1133), and the answer is DISTINGUISHABLE: return 1 and
+# HOOK_REPO_RELATIVE_DEGRADED=1. Success (return 0) means the path is genuinely
+# repo-relative. Telemetry callers that ignore the status still get the safe
+# value; a caller that feeds the result to a TOOL must branch on it, because a
+# bare basename resolved against the repo root names a different file.
+#   FILE_REL=$(hook::repo_relative_path "$FILE" "$REPO_ROOT")
+#
+# Callers under `set -e` must not take the status from a bare assignment: a
+# degraded answer returns 1, and `FILE_REL=$(hook::repo_relative_path ...)`
+# would abort the shell. Append `|| <flag>=1` (what every tool-feeding caller
+# here does) or `|| :` to keep the failure handled.
+# shellcheck disable=SC2034  # public contract: callers may read HOOK_REPO_RELATIVE_DEGRADED
+hook::repo_relative_path() {
+  local file="$1" root="$2" rel="$1"
+  HOOK_REPO_RELATIVE_DEGRADED=0
+  # An empty root anchors nothing, and the strip must not run against one:
+  # `${file#""/}` merely shaves the leading slash, handing back a path that is
+  # still the caller's absolute path but no longer LOOKS absolute to the
+  # redaction below, so it would leak with a success status. Skipping the strip
+  # leaves rel as the input, which the redaction then degrades correctly.
+  if [[ -n "$root" ]]; then
+    if command -v cygpath >/dev/null 2>&1; then
+      local file_lm root_lm
+      file_lm=$(cygpath -lm "$file" 2>/dev/null)
+      root_lm=$(cygpath -lm "$root" 2>/dev/null)
+      if [[ -n "$file_lm" && -n "$root_lm" ]]; then
+        rel="${file_lm#"$root_lm"/}"
+      fi
+    else
+      rel="${file#"$root"/}"
+    fi
+  fi
+  # POSIX-absolute, drive-letter, and UNC are the three spellings an unstripped
+  # path arrives in. Trim on either separator: a mixed-form path carries both.
+  case "$rel" in
+  /* | [A-Za-z]:* | \\\\*)
+    rel="${rel##*/}"
+    rel="${rel##*\\}"
+    HOOK_REPO_RELATIVE_DEGRADED=1
+    ;;
+  *) ;; # already repo-relative, nothing to redact
+  esac
+  printf '%s' "$rel"
+  ((HOOK_REPO_RELATIVE_DEGRADED == 0))
+}
+
 # Buffer a complete JSON payload from stdin, tolerating Windows Win32-pipe
 # late-EOF stalls via a bounded read on the inherited fd0. Returns the payload
 # on success; returns 1 on empty/incomplete stdin (caller skips), or 2 when the
diff --git a/plugins/desktop-notification/.claude-plugin/plugin.json b/plugins/desktop-notification/.claude-plugin/plugin.json
index afa006ab9..b8e3d1cdf 100644
--- a/plugins/desktop-notification/.claude-plugin/plugin.json
+++ b/plugins/desktop-notification/.claude-plugin/plugin.json
@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "desktop-notification",
-  "version": "0.6.24",
+  "version": "0.6.25",
   "description": "Alert you when Claude Code needs input — an audible terminal bell, an OSC 9 terminal notification, and an OS-native toast (macOS/Linux) on permission and idle prompts.",
   "author": {
     "name": "Melodic Software",
diff --git a/plugins/desktop-notification/CHANGELOG.md b/plugins/desktop-notification/CHANGELOG.md
index 48feacc40..b2c5a57ca 100644
--- a/plugins/desktop-notification/CHANGELOG.md
+++ b/plugins/desktop-notification/CHANGELOG.md
@@ -3,6 +3,17 @@
 All notable changes to the `desktop-notification` plugin are documented here. Format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning.
 
+## [0.6.25]
+
+### Changed
+
+- **Vendored `hook-utils.sh` gained `hook::repo_relative_path`.** The shared lib
+  now owns the repo-relative path computation twelve sibling hooks had each
+  hand-copied, together with the absolute-path degrade only four of those twelve
+  copies carried (#1133). This plugin's hooks do not call it; the copy is bumped
+  because `scripts/sync-hook-utils.sh` keeps every carrying plugin
+  byte-identical.
+
 ## [0.6.24]
 
 ### Changed
diff --git a/plugins/desktop-notification/hooks/hook-utils.sh b/plugins/desktop-notification/hooks/hook-utils.sh
index a426dd4e9..9818a6a73 100644
--- a/plugins/desktop-notification/hooks/hook-utils.sh
+++ b/plugins/desktop-notification/hooks/hook-utils.sh
@@ -610,6 +610,66 @@ hook::repo_root() {
   return 1
 }
 
+# Repo-relative form of <file> under <repo-root> — the shape the telemetry
+# schema requires of `data.file` ("relative to the consuming repo root").
+#
+# Both sides go through `cygpath -lm` (long name, forward-slash mixed form)
+# when it is available, so the prefix strip compares ONE representation: on
+# Windows Git Bash `git rev-parse --show-toplevel` answers with a drive-letter
+# path while file_path may arrive in POSIX mount form, and the raw strip never
+# matches. On Linux/macOS cygpath is absent and both paths are already POSIX,
+# so the strip runs directly.
+#
+# What survives the strip is not trusted to BE relative. A mount/symlink
+# mismatch, or a cygpath that answers for one side and not the other, leaves
+# the whole absolute path, which embeds the developer's username and breaks the
+# schema contract. Such a path degrades to its basename rather than leaking
+# (#1133), and the answer is DISTINGUISHABLE: return 1 and
+# HOOK_REPO_RELATIVE_DEGRADED=1. Success (return 0) means the path is genuinely
+# repo-relative. Telemetry callers that ignore the status still get the safe
+# value; a caller that feeds the result to a TOOL must branch on it, because a
+# bare basename resolved against the repo root names a different file.
+#   FILE_REL=$(hook::repo_relative_path "$FILE" "$REPO_ROOT")
+#
+# Callers under `set -e` must not take the status from a bare assignment: a
+# degraded answer returns 1, and `FILE_REL=$(hook::repo_relative_path ...)`
+# would abort the shell. Append `|| <flag>=1` (what every tool-feeding caller
+# here does) or `|| :` to keep the failure handled.
+# shellcheck disable=SC2034  # public contract: callers may read HOOK_REPO_RELATIVE_DEGRADED
+hook::repo_relative_path() {
+  local file="$1" root="$2" rel="$1"
+  HOOK_REPO_RELATIVE_DEGRADED=0
+  # An empty root anchors nothing, and the strip must not run against one:
+  # `${file#""/}` merely shaves the leading slash, handing back a path that is
+  # still the caller's absolute path but no longer LOOKS absolute to the
+  # redaction below, so it would leak with a success status. Skipping the strip
+  # leaves rel as the input, which the redaction then degrades correctly.
+  if [[ -n "$root" ]]; then
+    if command -v cygpath >/dev/null 2>&1; then
+      local file_lm root_lm
+      file_lm=$(cygpath -lm "$file" 2>/dev/null)
+      root_lm=$(cygpath -lm "$root" 2>/dev/null)
+      if [[ -n "$file_lm" && -n "$root_lm" ]]; then
+        rel="${file_lm#"$root_lm"/}"
+      fi
+    else
+      rel="${file#"$root"/}"
+    fi
+  fi
+  # POSIX-absolute, drive-letter, and UNC are the three spellings an unstripped
+  # path arrives in. Trim on either separator: a mixed-form path carries both.
+  case "$rel" in
+  /* | [A-Za-z]:* | \\\\*)
+    rel="${rel##*/}"
+    rel="${rel##*\\}"
+    HOOK_REPO_RELATIVE_DEGRADED=1
+    ;;
+  *) ;; # already repo-relative, nothing to redact
+  esac
+  printf '%s' "$rel"
+  ((HOOK_REPO_RELATIVE_DEGRADED == 0))
+}
+
 # Buffer a complete JSON payload from stdin, tolerating Windows Win32-pipe
 # late-EOF stalls via a bounded read on the inherited fd0. Returns the payload
 # on success; returns 1 on empty/incomplete stdin (caller skips), or 2 when the
diff --git a/plugins/eol-normalizer/.claude-plugin/plugin.json b/plugins/eol-normalizer/.claude-plugin/plugin.json
index 272e77cd5..216afea8a 100644
--- a/plugins/eol-normalizer/.claude-plugin/plugin.json
+++ b/plugins/eol-normalizer/.claude-plugin/plugin.json
@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "eol-normalizer",
-  "version": "0.6.24",
+  "version": "0.6.25",
   "description": "Normalize a written file's working-tree line endings to its .gitattributes eol value on edit — symmetric CRLF/LF driven by git check-attr, advisory and never blocking.",
   "author": {
     "name": "Melodic Software",
diff --git a/plugins/eol-normalizer/CHANGELOG.md b/plugins/eol-normalizer/CHANGELOG.md
index 1c12163a2..b9003698d 100644
--- a/plugins/eol-normalizer/CHANGELOG.md
+++ b/plugins/eol-normalizer/CHANGELOG.md
@@ -3,6 +3,20 @@
 All notable changes to the `eol-normalizer` plugin are documented here. Format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning.
 
+## [0.6.25]
+
+### Fixed
+
+- **Telemetry `data.file` can no longer leak an absolute path (#1133).** The
+  hand-copied `FILE_REL` block is replaced by `hook::repo_relative_path` in the
+  shared `hooks/hook-utils.sh`, which carries the degrade eight of the twelve
+  copies lacked: a path the repo-root prefix strip could not make relative
+  (mount or symlink mismatch, cygpath disagreement) now comes back as its
+  basename instead of an absolute path embedding the developer's username.
+  `FILE_REL` reaches only the telemetry payload here, never the rewrite target,
+  so which file is normalized is unaffected. Copies stay byte-identical via
+  `scripts/sync-hook-utils.sh`.
+
 ## [0.6.24]
 
 ### Changed
diff --git a/plugins/eol-normalizer/hooks/eol-normalizer.sh b/plugins/eol-normalizer/hooks/eol-normalizer.sh
index becfa69e3..a5299df81 100755
--- a/plugins/eol-normalizer/hooks/eol-normalizer.sh
+++ b/plugins/eol-normalizer/hooks/eol-normalizer.sh
@@ -69,25 +69,14 @@ REPO_ROOT="$(hook::repo_root "$(dirname "$FILE")")"
 # telemetry-only subprocesses (the tool_name jq parse, and 2× cygpath on
 # Windows).
 #
-# FILE_REL is the repo-relative path for the telemetry data.file. On Windows Git
-# Bash, git rev-parse --show-toplevel returns a drive-letter path while FILE may
-# be in POSIX mount form; normalize both through cygpath -lm (long,
-# forward-slash mixed form) when available so the prefix strip compares the same
-# representation. On Linux/macOS cygpath is absent and both paths are already
-# POSIX. Falls back to raw FILE on any normalization error.
+# FILE_REL is the repo-relative path for the telemetry data.file, degrading to
+# the basename when the prefix strip does not match, so an absolute path never
+# reaches telemetry.
 TOOL=""
 FILE_REL="$FILE"
 if hook::telemetry_enabled; then
   TOOL=$(printf '%s' "$INPUT" | jq -r '.tool_name // empty' 2>/dev/null)
-  if command -v cygpath >/dev/null 2>&1; then
-    _file_lm=$(cygpath -lm "$FILE" 2>/dev/null)
-    _root_lm=$(cygpath -lm "$REPO_ROOT" 2>/dev/null)
-    if [[ -n "$_file_lm" && -n "$_root_lm" ]]; then
-      FILE_REL="${_file_lm#"$_root_lm"/}"
-    fi
-  else
-    FILE_REL="${FILE#"$REPO_ROOT"/}"
-  fi
+  FILE_REL="$(hook::repo_relative_path "$FILE" "$REPO_ROOT")"
 fi
 
 # Build the telemetry data object. jq is authoritative; the fallback is a fixed
diff --git a/plugins/eol-normalizer/hooks/hook-utils.sh b/plugins/eol-normalizer/hooks/hook-utils.sh
index a426dd4e9..9818a6a73 100644
--- a/plugins/eol-normalizer/hooks/hook-utils.sh
+++ b/plugins/eol-normalizer/hooks/hook-utils.sh
@@ -610,6 +610,66 @@ hook::repo_root() {
   return 1
 }
 
+# Repo-relative form of <file> under <repo-root> — the shape the telemetry
+# schema requires of `data.file` ("relative to the consuming repo root").
+#
+# Both sides go through `cygpath -lm` (long name, forward-slash mixed form)
+# when it is available, so the prefix strip compares ONE representation: on
+# Windows Git Bash `git rev-parse --show-toplevel` answers with a drive-letter
+# path while file_path may arrive in POSIX mount form, and the raw strip never
+# matches. On Linux/macOS cygpath is absent and both paths are already POSIX,
+# so the strip runs directly.
+#
+# What survives the strip is not trusted to BE relative. A mount/symlink
+# mismatch, or a cygpath that answers for one side and not the other, leaves
+# the whole absolute path, which embeds the developer's username and breaks the
+# schema contract. Such a path degrades to its basename rather than leaking
+# (#1133), and the answer is DISTINGUISHABLE: return 1 and
+# HOOK_REPO_RELATIVE_DEGRADED=1. Success (return 0) means the path is genuinely
+# repo-relative. Telemetry callers that ignore the status still get the safe
+# value; a caller that feeds the result to a TOOL must branch on it, because a
+# bare basename resolved against the repo root names a different file.
+#   FILE_REL=$(hook::repo_relative_path "$FILE" "$REPO_ROOT")
+#
+# Callers under `set -e` must not take the status from a bare assignment: a
+# degraded answer returns 1, and `FILE_REL=$(hook::repo_relative_path ...)`
+# would abort the shell. Append `|| <flag>=1` (what every tool-feeding caller
+# here does) or `|| :` to keep the failure handled.
+# shellcheck disable=SC2034  # public contract: callers may read HOOK_REPO_RELATIVE_DEGRADED
+hook::repo_relative_path() {
+  local file="$1" root="$2" rel="$1"
+  HOOK_REPO_RELATIVE_DEGRADED=0
+  # An empty root anchors nothing, and the strip must not run against one:
+  # `${file#""/}` merely shaves the leading slash, handing back a path that is
+  # still the caller's absolute path but no longer LOOKS absolute to the
+  # redaction below, so it would leak with a success status. Skipping the strip
+  # leaves rel as the input, which the redaction then degrades correctly.
+  if [[ -n "$root" ]]; then
+    if command -v cygpath >/dev/null 2>&1; then
+      local file_lm root_lm
+      file_lm=$(cygpath -lm "$file" 2>/dev/null)
+      root_lm=$(cygpath -lm "$root" 2>/dev/null)
+      if [[ -n "$file_lm" && -n "$root_lm" ]]; then
+        rel="${file_lm#"$root_lm"/}"
+      fi
+    else
+      rel="${file#"$root"/}"
+    fi
+  fi
+  # POSIX-absolute, drive-letter, and UNC are the three spellings an unstripped
+  # path arrives in. Trim on either separator: a mixed-form path carries both.
+  case "$rel" in
+  /* | [A-Za-z]:* | \\\\*)
+    rel="${rel##*/}"
+    rel="${rel##*\\}"
+    HOOK_REPO_RELATIVE_DEGRADED=1
+    ;;
+  *) ;; # already repo-relative, nothing to redact
+  esac
+  printf '%s' "$rel"
+  ((HOOK_REPO_RELATIVE_DEGRADED == 0))
+}
+
 # Buffer a complete JSON payload from stdin, tolerating Windows Win32-pipe
 # late-EOF stalls via a bounded read on the inherited fd0. Returns the payload
 # on success; returns 1 on empty/incomplete stdin (caller skips), or 2 when the
diff --git a/plugins/go-format/.claude-plugin/plugin.json b/plugins/go-format/.claude-plugin/plugin.json
index c73ae40d2..67ff3bc9f 100644
--- a/plugins/go-format/.claude-plugin/plugin.json
+++ b/plugins/go-format/.claude-plugin/plugin.json
@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "go-format",
-  "version": "0.3.28",
+  "version": "0.3.29",
   "description": "Auto-fix Go formatting and import management on edit via goimports — runs unconditionally (no consumer-config gate), skipping generated files.",
   "author": {
     "name": "Melodic Software",
diff --git a/plugins/go-format/CHANGELOG.md b/plugins/go-format/CHANGELOG.md
index 42f8b3ace..e7c9dc141 100644
--- a/plugins/go-format/CHANGELOG.md
+++ b/plugins/go-format/CHANGELOG.md
@@ -3,6 +3,20 @@
 All notable changes to the `go-format` plugin are documented here. Format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning.
 
+## [0.3.29]
+
+### Fixed
+
+- **Telemetry `data.file` can no longer leak an absolute path (#1133).** The
+  hand-copied `FILE_REL` block is replaced by `hook::repo_relative_path` in the
+  shared `hooks/hook-utils.sh`, which carries the degrade eight of the twelve
+  copies lacked: a path the repo-root prefix strip could not make relative
+  (mount or symlink mismatch, cygpath disagreement) now comes back as its
+  basename instead of an absolute path embedding the developer's username.
+  `FILE_REL` reaches only the telemetry payload here, never the goimports
+  invocation, so the lint target is unaffected. Copies stay byte-identical via
+  `scripts/sync-hook-utils.sh`.
+
 ## [0.3.28]
 
 ### Changed
diff --git a/plugins/go-format/hooks/go-format.sh b/plugins/go-format/hooks/go-format.sh
index dfad1ea5d..15663d3bf 100755
--- a/plugins/go-format/hooks/go-format.sh
+++ b/plugins/go-format/hooks/go-format.sh
@@ -91,26 +91,14 @@ REPO_ROOT="$(hook::repo_root "$(dirname "$FILE")")"
 # wired: the unwired default path spawns zero telemetry-only subprocesses (the
 # tool_name jq parse, and 2× cygpath on Windows).
 #
-# FILE_REL is the repo-relative path: schema requires "relative to the consuming
-# repo root". On Windows Git Bash, git rev-parse --show-toplevel returns a
-# drive-letter path while FILE may be in POSIX mount form. Normalize both
-# through cygpath -lm (long name, forward-slash mixed form) when available so
-# the prefix strip compares the same representation. On Linux/macOS, cygpath is
-# absent and both paths are already POSIX. Falls back to raw FILE on any
-# normalization error.
+# FILE_REL is the repo-relative path the schema requires ("relative to the
+# consuming repo root"), degrading to the basename when the prefix strip does
+# not match, so an absolute path never reaches telemetry.
 TOOL=""
 FILE_REL="$FILE"
 if hook::telemetry_enabled; then
   TOOL=$(printf '%s' "$INPUT" | jq -r '.tool_name // empty' 2>/dev/null)
-  if command -v cygpath >/dev/null 2>&1; then
-    _file_lm=$(cygpath -lm "$FILE" 2>/dev/null)
-    _root_lm=$(cygpath -lm "$REPO_ROOT" 2>/dev/null)
-    if [[ -n "$_file_lm" && -n "$_root_lm" ]]; then
-      FILE_REL="${_file_lm#"$_root_lm"/}"
-    fi
-  else
-    FILE_REL="${FILE#"$REPO_ROOT"/}"
-  fi
+  FILE_REL="$(hook::repo_relative_path "$FILE" "$REPO_ROOT")"
 fi
 
 # Build the telemetry data object for the current TOOL/FILE_REL. $1 is the
diff --git a/plugins/go-format/hooks/hook-utils.sh b/plugins/go-format/hooks/hook-utils.sh
index a426dd4e9..9818a6a73 100644
--- a/plugins/go-format/hooks/hook-utils.sh
+++ b/plugins/go-format/hooks/hook-utils.sh
@@ -610,6 +610,66 @@ hook::repo_root() {
   return 1
 }
 
+# Repo-relative form of <file> under <repo-root> — the shape the telemetry
+# schema requires of `data.file` ("relative to the consuming repo root").
+#
+# Both sides go through `cygpath -lm` (long name, forward-slash mixed form)
+# when it is available, so the prefix strip compares ONE representation: on
+# Windows Git Bash `git rev-parse --show-toplevel` answers with a drive-letter
+# path while file_path may arrive in POSIX mount form, and the raw strip never
+# matches. On Linux/macOS cygpath is absent and both paths are already POSIX,
+# so the strip runs directly.
+#
+# What survives the strip is not trusted to BE relative. A mount/symlink
+# mismatch, or a cygpath that answers for one side and not the other, leaves
+# the whole absolute path, which embeds the developer's username and breaks the
+# schema contract. Such a path degrades to its basename rather than leaking
+# (#1133), and the answer is DISTINGUISHABLE: return 1 and
+# HOOK_REPO_RELATIVE_DEGRADED=1. Success (return 0) means the path is genuinely
+# repo-relative. Telemetry callers that ignore the status still get the safe
+# value; a caller that feeds the result to a TOOL must branch on it, because a
+# bare basename resolved against the repo root names a different file.
+#   FILE_REL=$(hook::repo_relative_path "$FILE" "$REPO_ROOT")
+#
+# Callers under `set -e` must not take the status from a bare assignment: a
+# degraded answer returns 1, and `FILE_REL=$(hook::repo_relative_path ...)`
+# would abort the shell. Append `|| <flag>=1` (what every tool-feeding caller
+# here does) or `|| :` to keep the failure handled.
+# shellcheck disable=SC2034  # public contract: callers may read HOOK_REPO_RELATIVE_DEGRADED
+hook::repo_relative_path() {
+  local file="$1" root="$2" rel="$1"
+  HOOK_REPO_RELATIVE_DEGRADED=0
+  # An empty root anchors nothing, and the strip must not run against one:
+  # `${file#""/}` merely shaves the leading slash, handing back a path that is
+  # still the caller's absolute path but no longer LOOKS absolute to the
+  # redaction below, so it would leak with a success status. Skipping the strip
+  # leaves rel as the input, which the redaction then degrades correctly.
+  if [[ -n "$root" ]]; then
+    if command -v cygpath >/dev/null 2>&1; then
+      local file_lm root_lm
+      file_lm=$(cygpath -lm "$file" 2>/dev/null)
+      root_lm=$(cygpath -lm "$root" 2>/dev/null)
+      if [[ -n "$file_lm" && -n "$root_lm" ]]; then
+        rel="${file_lm#"$root_lm"/}"
+      fi
+    else
+      rel="${file#"$root"/}"
+    fi
+  fi
+  # POSIX-absolute, drive-letter, and UNC are the three spellings an unstripped
+  # path arrives in. Trim on either separator: a mixed-form path carries both.
+  case "$rel" in
+  /* | [A-Za-z]:* | \\\\*)
+    rel="${rel##*/}"
+    rel="${rel##*\\}"
+    HOOK_REPO_RELATIVE_DEGRADED=1
+    ;;
+  *) ;; # already repo-relative, nothing to redact
+  esac
+  printf '%s' "$rel"
+  ((HOOK_REPO_RELATIVE_DEGRADED == 0))
+}
+
 # Buffer a complete JSON payload from stdin, tolerating Windows Win32-pipe
 # late-EOF stalls via a bounded read on the inherited fd0. Returns the payload
 # on success; returns 1 on empty/incomplete stdin (caller skips), or 2 when the
diff --git a/plugins/guardrails/.claude-plugin/plugin.json b/plugins/guardrails/.claude-plugin/plugin.json
index d9cfc2810..1e62a2fec 100644
--- a/plugins/guardrails/.claude-plugin/plugin.json
+++ b/plugins/guardrails/.claude-plugin/plugin.json
@@ -147,5 +147,5 @@
       "min": 1
     }
   },
-  "version": "0.29.20"
+  "version": "0.29.21"
 }
diff --git a/plugins/guardrails/CHANGELOG.md b/plugins/guardrails/CHANGELOG.md
index ec7b34571..f4cd591c8 100644
--- a/plugins/guardrails/CHANGELOG.md
+++ b/plugins/guardrails/CHANGELOG.md
@@ -3,6 +3,21 @@
 All notable changes to the `guardrails` plugin are documented here. Format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning.
 
+## [0.29.21]
+
+### Changed
+
+- **Three independently written path redactions collapse into one helper.**
+  `cli-flag-verify.sh`, `skill-reference-verify.sh`, and `stale-path-verify.sh`
+  each carried their own copy of the cygpath normalization plus a
+  hand-written basename redaction; all three now call
+  `hook::repo_relative_path` in the shared `hooks/hook-utils.sh`, which owns
+  both. These three were among the four copies of the block that already
+  redacted, so their emitted `data.file` values are unchanged, and the helper
+  additionally redacts a UNC path, which the local copies did not match.
+  `file_rel` reaches only the telemetry payload in all three, never a tool
+  argument. Copies stay byte-identical via `scripts/sync-hook-utils.sh`.
+
 ## [0.29.20]
 
 ### Changed
diff --git a/plugins/guardrails/hooks/cli-flag-verify.sh b/plugins/guardrails/hooks/cli-flag-verify.sh
index 013da33cf..2829a4581 100755
--- a/plugins/guardrails/hooks/cli-flag-verify.sh
+++ b/plugins/guardrails/hooks/cli-flag-verify.sh
@@ -371,24 +371,11 @@ done
 emit_tel() {
   [[ -n "$start" ]] || return 0
   hook::telemetry_enabled || return 0
-  local file_rel="$FILE" findings_json="[]"
-  if command -v cygpath >/dev/null 2>&1; then
-    local _file_lm _root_lm
-    _file_lm=$(cygpath -lm "$FILE" 2>/dev/null)
-    _root_lm=$(cygpath -lm "$REPO_ROOT" 2>/dev/null)
-    [[ -n "$_file_lm" && -n "$_root_lm" ]] && file_rel="${_file_lm#"$_root_lm"/}"
-  else
-    file_rel="${FILE#"$REPO_ROOT"/}"
-  fi
-  # Redaction: if the path could not be made repo-relative, emit the basename
-  # only — never an absolute path (it would embed the developer's username).
-  case "$file_rel" in
-  /* | [A-Za-z]:*)
-    file_rel="${file_rel##*/}"
-    file_rel="${file_rel##*\\}"
-    ;;
-  *) ;;
-  esac
+  # The helper carries the redaction: a path it could not make repo-relative
+  # comes back as the basename, never an absolute path (which would embed the
+  # developer's username).
+  local findings_json="[]" file_rel
+  file_rel="$(hook::repo_relative_path "$FILE" "$REPO_ROOT")"
   if ((${#FAILURES[@]} > 0)); then
     local f raw="" disp
     for f in "${FAILURES[@]}"; do
diff --git a/plugins/guardrails/hooks/hook-utils.sh b/plugins/guardrails/hooks/hook-utils.sh
index a426dd4e9..9818a6a73 100644
--- a/plugins/guardrails/hooks/hook-utils.sh
+++ b/plugins/guardrails/hooks/hook-utils.sh
@@ -610,6 +610,66 @@ hook::repo_root() {
   return 1
 }
 
+# Repo-relative form of <file> under <repo-root> — the shape the telemetry
+# schema requires of `data.file` ("relative to the consuming repo root").
+#
+# Both sides go through `cygpath -lm` (long name, forward-slash mixed form)
+# when it is available, so the prefix strip compares ONE representation: on
+# Windows Git Bash `git rev-parse --show-toplevel` answers with a drive-letter
+# path while file_path may arrive in POSIX mount form, and the raw strip never
+# matches. On Linux/macOS cygpath is absent and both paths are already POSIX,
+# so the strip runs directly.
+#
+# What survives the strip is not trusted to BE relative. A mount/symlink
+# mismatch, or a cygpath that answers for one side and not the other, leaves
+# the whole absolute path, which embeds the developer's username and breaks the
+# schema contract. Such a path degrades to its basename rather than leaking
+# (#1133), and the answer is DISTINGUISHABLE: return 1 and
+# HOOK_REPO_RELATIVE_DEGRADED=1. Success (return 0) means the path is genuinely
+# repo-relative. Telemetry callers that ignore the status still get the safe
+# value; a caller that feeds the result to a TOOL must branch on it, because a
+# bare basename resolved against the repo root names a different file.
+#   FILE_REL=$(hook::repo_relative_path "$FILE" "$REPO_ROOT")
+#
+# Callers under `set -e` must not take the status from a bare assignment: a
+# degraded answer returns 1, and `FILE_REL=$(hook::repo_relative_path ...)`
+# would abort the shell. Append `|| <flag>=1` (what every tool-feeding caller
+# here does) or `|| :` to keep the failure handled.
+# shellcheck disable=SC2034  # public contract: callers may read HOOK_REPO_RELATIVE_DEGRADED
+hook::repo_relative_path() {
+  local file="$1" root="$2" rel="$1"
+  HOOK_REPO_RELATIVE_DEGRADED=0
+  # An empty root anchors nothing, and the strip must not run against one:
+  # `${file#""/}` merely shaves the leading slash, handing back a path that is
+  # still the caller's absolute path but no longer LOOKS absolute to the
+  # redaction below, so it would leak with a success status. Skipping the strip
+  # leaves rel as the input, which the redaction then degrades correctly.
+  if [[ -n "$root" ]]; then
+    if command -v cygpath >/dev/null 2>&1; then
+      local file_lm root_lm
+      file_lm=$(cygpath -lm "$file" 2>/dev/null)
+      root_lm=$(cygpath -lm "$root" 2>/dev/null)
+      if [[ -n "$file_lm" && -n "$root_lm" ]]; then
+        rel="${file_lm#"$root_lm"/}"
+      fi
+    else
+      rel="${file#"$root"/}"
+    fi
+  fi
+  # POSIX-absolute, drive-letter, and UNC are the three spellings an unstripped
+  # path arrives in. Trim on either separator: a mixed-form path carries both.
+  case "$rel" in
+  /* | [A-Za-z]:* | \\\\*)
+    rel="${rel##*/}"
+    rel="${rel##*\\}"
+    HOOK_REPO_RELATIVE_DEGRADED=1
+    ;;
+  *) ;; # already repo-relative, nothing to redact
+  esac
+  printf '%s' "$rel"
+  ((HOOK_REPO_RELATIVE_DEGRADED == 0))
+}
+
 # Buffer a complete JSON payload from stdin, tolerating Windows Win32-pipe
 # late-EOF stalls via a bounded read on the inherited fd0. Returns the payload
 # on success; returns 1 on empty/incomplete stdin (caller skips), or 2 when the
diff --git a/plugins/guardrails/hooks/skill-reference-verify.sh b/plugins/guardrails/hooks/skill-reference-verify.sh
index 9c90ca849..8174e8bd4 100755
--- a/plugins/guardrails/hooks/skill-reference-verify.sh
+++ b/plugins/guardrails/hooks/skill-reference-verify.sh
@@ -715,25 +715,11 @@ done
 emit_tel() {
   [[ -n "$start" ]] || return 0
   hook::telemetry_enabled || return 0
-  local file_rel="$FILE" findings_json="[]"
-  if command -v cygpath >/dev/null 2>&1; then
-    local _file_lm _root_lm
-    _file_lm=$(cygpath -lm "$FILE" 2>/dev/null)
-    _root_lm=$(cygpath -lm "$REPO_ROOT" 2>/dev/null)
-    [[ -n "$_file_lm" && -n "$_root_lm" ]] && file_rel="${_file_lm#"$_root_lm"/}"
-  else
-    file_rel="${FILE#"$REPO_ROOT"/}"
-  fi
-  # Redaction: a path that could not be made repo-relative degrades to its
-  # basename — never an absolute path, which would embed the developer's
-  # username.
-  case "$file_rel" in
-  /* | [A-Za-z]:*)
-    file_rel="${file_rel##*/}"
-    file_rel="${file_rel##*\\}"
-    ;;
-  *) ;;
-  esac
+  # The helper carries the redaction: a path it could not make repo-relative
+  # comes back as the basename, never an absolute path, which would embed the
+  # developer's username.
+  local findings_json="[]" file_rel
+  file_rel="$(hook::repo_relative_path "$FILE" "$REPO_ROOT")"
   if ((${#UNRESOLVED[@]} > 0)); then
     findings_json=$(printf '%s\n' "${UNRESOLVED[@]}" | jq -Rn '[inputs]' 2>/dev/null) || findings_json="[]"
   fi
diff --git a/plugins/guardrails/hooks/stale-path-verify.sh b/plugins/guardrails/hooks/stale-path-verify.sh
index 1bc2d631c..aa710d6e8 100755
--- a/plugins/guardrails/hooks/stale-path-verify.sh
+++ b/plugins/guardrails/hooks/stale-path-verify.sh
@@ -501,25 +501,11 @@ done
 emit_tel() {
   [[ -n "$start" ]] || return 0
   hook::telemetry_enabled || return 0
-  local file_rel="$FILE" findings_json="[]"
-  if command -v cygpath >/dev/null 2>&1; then
-    local _file_lm _root_lm
-    _file_lm=$(cygpath -lm "$FILE" 2>/dev/null)
-    _root_lm=$(cygpath -lm "$REPO_ROOT" 2>/dev/null)
-    [[ -n "$_file_lm" && -n "$_root_lm" ]] && file_rel="${_file_lm#"$_root_lm"/}"
-  else
-    file_rel="${FILE#"$REPO_ROOT"/}"
-  fi
-  # Redaction: a path that could not be made repo-relative degrades to its
-  # basename — never an absolute path, which would embed the developer's
-  # username.
-  case "$file_rel" in
-  /* | [A-Za-z]:*)
-    file_rel="${file_rel##*/}"
-    file_rel="${file_rel##*\\}"
-    ;;
-  *) ;;
-  esac
+  # The helper carries the redaction: a path it could not make repo-relative
+  # comes back as the basename, never an absolute path, which would embed the
+  # developer's username.
+  local findings_json="[]" file_rel
+  file_rel="$(hook::repo_relative_path "$FILE" "$REPO_ROOT")"
   if ((${#MISSING[@]} > 0)); then
     findings_json=$(printf '%s\n' "${MISSING[@]}" | jq -Rn '[inputs]' 2>/dev/null) || findings_json="[]"
   fi
diff --git a/plugins/instruction-placement/.claude-plugin/plugin.json b/plugins/instruction-placement/.claude-plugin/plugin.json
index aeac0383c..c13a34e50 100644
--- a/plugins/instruction-placement/.claude-plugin/plugin.json
+++ b/plugins/instruction-placement/.claude-plugin/plugin.json
@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "instruction-placement",
-  "version": "0.11.11",
+  "version": "0.11.12",
   "description": "Routes agent-instruction content to the surface that loads it at the right moment. The audit skill sweeps a repository's instruction layer and its ordinary markdown for content whose scope is narrower than the surface carrying it \u2014 conventions keyed to one file type or one subtree sitting in an always-loaded CLAUDE.md or AGENTS.md \u2014 and for normative conventions stranded in documentation Claude never loads at all, then classifies each against a routing rubric and proposes a destination whose `paths:` glob is machine-validated before it is ever offered. Safety-class content (irreversible actions, secrets, data integrity, external publication, compliance, agent authority) is hard-denied from demotion and reported as held back rather than proposed, because demotion trades guaranteed presence for conditional presence and deferred surfaces are invisible inside subagents and absent after compaction until re-triggered. Every accepted move regenerates an always-loaded index of deferred surfaces, which is what keeps a demoted rule reachable from a subagent that never receives its injection. The audit is read-only and emits a diffable findings artifact; realignment is a separate skill gated per item with no blanket-approve path; a deterministic check skill gates that every rule glob still resolves and the index is current; and a setup skill verifies the one thing no other gate can see \u2014 that the index target is a file Claude Code will actually read, since it reads CLAUDE.md and not AGENTS.md.",
   "author": {
     "name": "Melodic Software",
diff --git a/plugins/instruction-placement/CHANGELOG.md b/plugins/instruction-placement/CHANGELOG.md
index eaa828596..acf66874a 100644
--- a/plugins/instruction-placement/CHANGELOG.md
+++ b/plugins/instruction-placement/CHANGELOG.md
@@ -3,6 +3,17 @@
 All notable changes to the `instruction-placement` plugin are documented here. Format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning.
 
+## [0.11.12]
+
+### Changed
+
+- **Vendored `hook-utils.sh` gained `hook::repo_relative_path`.** The shared lib
+  now owns the repo-relative path computation twelve sibling hooks had each
+  hand-copied, together with the absolute-path degrade only four of those twelve
+  copies carried (#1133). This plugin's hooks do not call it; the copy is bumped
+  because `scripts/sync-hook-utils.sh` keeps every carrying plugin
+  byte-identical.
+
 ## [0.11.11]
 
 ### Fixed
diff --git a/plugins/instruction-placement/hooks/hook-utils.sh b/plugins/instruction-placement/hooks/hook-utils.sh
index a426dd4e9..9818a6a73 100644
--- a/plugins/instruction-placement/hooks/hook-utils.sh
+++ b/plugins/instruction-placement/hooks/hook-utils.sh
@@ -610,6 +610,66 @@ hook::repo_root() {
   return 1
 }
 
+# Repo-relative form of <file> under <repo-root> — the shape the telemetry
+# schema requires of `data.file` ("relative to the consuming repo root").
+#
+# Both sides go through `cygpath -lm` (long name, forward-slash mixed form)
+# when it is available, so the prefix strip compares ONE representation: on
+# Windows Git Bash `git rev-parse --show-toplevel` answers with a drive-letter
+# path while file_path may arrive in POSIX mount form, and the raw strip never
+# matches. On Linux/macOS cygpath is absent and both paths are already POSIX,
+# so the strip runs directly.
+#
+# What survives the strip is not trusted to BE relative. A mount/symlink
+# mismatch, or a cygpath that answers for one side and not the other, leaves
+# the whole absolute path, which embeds the developer's username and breaks the
+# schema contract. Such a path degrades to its basename rather than leaking
+# (#1133), and the answer is DISTINGUISHABLE: return 1 and
+# HOOK_REPO_RELATIVE_DEGRADED=1. Success (return 0) means the path is genuinely
+# repo-relative. Telemetry callers that ignore the status still get the safe
+# value; a caller that feeds the result to a TOOL must branch on it, because a
+# bare basename resolved against the repo root names a different file.
+#   FILE_REL=$(hook::repo_relative_path "$FILE" "$REPO_ROOT")
+#
+# Callers under `set -e` must not take the status from a bare assignment: a
+# degraded answer returns 1, and `FILE_REL=$(hook::repo_relative_path ...)`
+# would abort the shell. Append `|| <flag>=1` (what every tool-feeding caller
+# here does) or `|| :` to keep the failure handled.
+# shellcheck disable=SC2034  # public contract: callers may read HOOK_REPO_RELATIVE_DEGRADED
+hook::repo_relative_path() {
+  local file="$1" root="$2" rel="$1"
+  HOOK_REPO_RELATIVE_DEGRADED=0
+  # An empty root anchors nothing, and the strip must not run against one:
+  # `${file#""/}` merely shaves the leading slash, handing back a path that is
+  # still the caller's absolute path but no longer LOOKS absolute to the
+  # redaction below, so it would leak with a success status. Skipping the strip
+  # leaves rel as the input, which the redaction then degrades correctly.
+  if [[ -n "$root" ]]; then
+    if command -v cygpath >/dev/null 2>&1; then
+      local file_lm root_lm
+      file_lm=$(cygpath -lm "$file" 2>/dev/null)
+      root_lm=$(cygpath -lm "$root" 2>/dev/null)
+      if [[ -n "$file_lm" && -n "$root_lm" ]]; then
+        rel="${file_lm#"$root_lm"/}"
+      fi
+    else
+      rel="${file#"$root"/}"
+    fi
+  fi
+  # POSIX-absolute, drive-letter, and UNC are the three spellings an unstripped
+  # path arrives in. Trim on either separator: a mixed-form path carries both.
+  case "$rel" in
+  /* | [A-Za-z]:* | \\\\*)
+    rel="${rel##*/}"
+    rel="${rel##*\\}"
+    HOOK_REPO_RELATIVE_DEGRADED=1
+    ;;
+  *) ;; # already repo-relative, nothing to redact
+  esac
+  printf '%s' "$rel"
+  ((HOOK_REPO_RELATIVE_DEGRADED == 0))
+}
+
 # Buffer a complete JSON payload from stdin, tolerating Windows Win32-pipe
 # late-EOF stalls via a bounded read on the inherited fd0. Returns the payload
 # on success; returns 1 on empty/incomplete stdin (caller skips), or 2 when the
diff --git a/plugins/markdown-format/.claude-plugin/plugin.json b/plugins/markdown-format/.claude-plugin/plugin.json
index 39c7c0293..e44c8c576 100644
--- a/plugins/markdown-format/.claude-plugin/plugin.json
+++ b/plugins/markdown-format/.claude-plugin/plugin.json
@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "markdown-format",
-  "version": "0.11.33",
+  "version": "0.11.34",
   "description": "Auto-format and lint Markdown on edit via markdownlint-cli2 — only in repos that carry their own markdownlint config.",
   "author": {
     "name": "Melodic Software",
diff --git a/plugins/markdown-format/CHANGELOG.md b/plugins/markdown-format/CHANGELOG.md
index 54efa4d5b..9811a306e 100644
--- a/plugins/markdown-format/CHANGELOG.md
+++ b/plugins/markdown-format/CHANGELOG.md
@@ -3,6 +3,20 @@
 All notable changes to the `markdown-format` plugin are documented here. Format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning.
 
+## [0.11.34]
+
+### Fixed
+
+- **Telemetry `data.file` can no longer leak an absolute path (#1133).** The
+  hand-copied `FILE_REL` block is replaced by `hook::repo_relative_path` in the
+  shared `hooks/hook-utils.sh`, which carries the degrade eight of the twelve
+  copies lacked: a path the repo-root prefix strip could not make relative
+  (mount or symlink mismatch, cygpath disagreement) now comes back as its
+  basename instead of an absolute path embedding the developer's username.
+  `FILE_REL` reaches only the telemetry payload here, never the markdownlint
+  invocation, so the lint target is unaffected. Copies stay byte-identical via
+  `scripts/sync-hook-utils.sh`.
+
 ## [0.11.33]
 
 ### Changed
diff --git a/plugins/markdown-format/hooks/hook-utils.sh b/plugins/markdown-format/hooks/hook-utils.sh
index a426dd4e9..9818a6a73 100644
--- a/plugins/markdown-format/hooks/hook-utils.sh
+++ b/plugins/markdown-format/hooks/hook-utils.sh
@@ -610,6 +610,66 @@ hook::repo_root() {
   return 1
 }
 
+# Repo-relative form of <file> under <repo-root> — the shape the telemetry
+# schema requires of `data.file` ("relative to the consuming repo root").
+#
+# Both sides go through `cygpath -lm` (long name, forward-slash mixed form)
+# when it is available, so the prefix strip compares ONE representation: on
+# Windows Git Bash `git rev-parse --show-toplevel` answers with a drive-letter
+# path while file_path may arrive in POSIX mount form, and the raw strip never
+# matches. On Linux/macOS cygpath is absent and both paths are already POSIX,
+# so the strip runs directly.
+#
+# What survives the strip is not trusted to BE relative. A mount/symlink
+# mismatch, or a cygpath that answers for one side and not the other, leaves
+# the whole absolute path, which embeds the developer's username and breaks the
+# schema contract. Such a path degrades to its basename rather than leaking
+# (#1133), and the answer is DISTINGUISHABLE: return 1 and
+# HOOK_REPO_RELATIVE_DEGRADED=1. Success (return 0) means the path is genuinely
+# repo-relative. Telemetry callers that ignore the status still get the safe
+# value; a caller that feeds the result to a TOOL must branch on it, because a
+# bare basename resolved against the repo root names a different file.
+#   FILE_REL=$(hook::repo_relative_path "$FILE" "$REPO_ROOT")
+#
+# Callers under `set -e` must not take the status from a bare assignment: a
+# degraded answer returns 1, and `FILE_REL=$(hook::repo_relative_path ...)`
+# would abort the shell. Append `|| <flag>=1` (what every tool-feeding caller
+# here does) or `|| :` to keep the failure handled.
+# shellcheck disable=SC2034  # public contract: callers may read HOOK_REPO_RELATIVE_DEGRADED
+hook::repo_relative_path() {
+  local file="$1" root="$2" rel="$1"
+  HOOK_REPO_RELATIVE_DEGRADED=0
+  # An empty root anchors nothing, and the strip must not run against one:
+  # `${file#""/}` merely shaves the leading slash, handing back a path that is
+  # still the caller's absolute path but no longer LOOKS absolute to the
+  # redaction below, so it would leak with a success status. Skipping the strip
+  # leaves rel as the input, which the redaction then degrades correctly.
+  if [[ -n "$root" ]]; then
+    if command -v cygpath >/dev/null 2>&1; then
+      local file_lm root_lm
+      file_lm=$(cygpath -lm "$file" 2>/dev/null)
+      root_lm=$(cygpath -lm "$root" 2>/dev/null)
+      if [[ -n "$file_lm" && -n "$root_lm" ]]; then
+        rel="${file_lm#"$root_lm"/}"
+      fi
+    else
+      rel="${file#"$root"/}"
+    fi
+  fi
+  # POSIX-absolute, drive-letter, and UNC are the three spellings an unstripped
+  # path arrives in. Trim on either separator: a mixed-form path carries both.
+  case "$rel" in
+  /* | [A-Za-z]:* | \\\\*)
+    rel="${rel##*/}"
+    rel="${rel##*\\}"
+    HOOK_REPO_RELATIVE_DEGRADED=1
+    ;;
+  *) ;; # already repo-relative, nothing to redact
+  esac
+  printf '%s' "$rel"
+  ((HOOK_REPO_RELATIVE_DEGRADED == 0))
+}
+
 # Buffer a complete JSON payload from stdin, tolerating Windows Win32-pipe
 # late-EOF stalls via a bounded read on the inherited fd0. Returns the payload
 # on success; returns 1 on empty/incomplete stdin (caller skips), or 2 when the
diff --git a/plugins/markdown-format/hooks/markdown-format.sh b/plugins/markdown-format/hooks/markdown-format.sh
index e7835d201..985e7eb93 100755
--- a/plugins/markdown-format/hooks/markdown-format.sh
+++ b/plugins/markdown-format/hooks/markdown-format.sh
@@ -315,26 +315,14 @@ fi
 # default path spawns zero telemetry-only subprocesses (the tool_name jq
 # parse, and 2× cygpath on Windows).
 #
-# FILE_REL is the repo-relative path: schema requires "relative to the
-# consuming repo root". On Windows Git Bash, git rev-parse --show-toplevel
-# returns a drive-letter path while FILE may be in POSIX mount form. Normalize
-# both through cygpath -lm (long name, forward-slash mixed form) when
-# available so the prefix strip compares the same representation. On
-# Linux/macOS, cygpath is absent and both paths are already POSIX. Falls back
-# to raw FILE on any normalization error.
+# FILE_REL is the repo-relative path the schema requires ("relative to the
+# consuming repo root"), degrading to the basename when the prefix strip does
+# not match, so an absolute path never reaches telemetry.
 TOOL=""
 FILE_REL="$FILE"
 if hook::telemetry_enabled; then
   TOOL=$(printf '%s' "$INPUT" | jq -r '.tool_name // empty' 2>/dev/null)
-  if command -v cygpath >/dev/null 2>&1; then
-    _file_lm=$(cygpath -lm "$FILE" 2>/dev/null)
-    _root_lm=$(cygpath -lm "$REPO_ROOT" 2>/dev/null)
-    if [[ -n "$_file_lm" && -n "$_root_lm" ]]; then
-      FILE_REL="${_file_lm#"$_root_lm"/}"
-    fi
-  else
-    FILE_REL="${FILE#"$REPO_ROOT"/}"
-  fi
+  FILE_REL="$(hook::repo_relative_path "$FILE" "$REPO_ROOT")"
 fi
 
 # Build the telemetry data object for the current TOOL/FILE_REL. $1 is the
diff --git a/plugins/powershell-format/.claude-plugin/plugin.json b/plugins/powershell-format/.claude-plugin/plugin.json
index 3320b0811..e4fe9c9d0 100644
--- a/plugins/powershell-format/.claude-plugin/plugin.json
+++ b/plugins/powershell-format/.claude-plugin/plugin.json
@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "powershell-format",
-  "version": "0.7.28",
+  "version": "0.7.29",
   "description": "Auto-format and lint PowerShell on edit via PSScriptAnalyzer, only when a PSScriptAnalyzerSettings.psd1 governs the repo — using the consuming repo's own analyzer settings.",
   "author": {
     "name": "Melodic Software",
diff --git a/plugins/powershell-format/CHANGELOG.md b/plugins/powershell-format/CHANGELOG.md
index 16c8fe702..659787bc3 100644
--- a/plugins/powershell-format/CHANGELOG.md
+++ b/plugins/powershell-format/CHANGELOG.md
@@ -3,6 +3,20 @@
 All notable changes to the `powershell-format` plugin are documented here. Format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning.
 
+## [0.7.29]
+
+### Fixed
+
+- **Telemetry `data.file` can no longer leak an absolute path (#1133).** The
+  hand-copied `FILE_REL` block is replaced by `hook::repo_relative_path` in the
+  shared `hooks/hook-utils.sh`, which carries the degrade eight of the twelve
+  copies lacked: a path the repo-root prefix strip could not make relative
+  (mount or symlink mismatch, cygpath disagreement) now comes back as its
+  basename instead of an absolute path embedding the developer's username.
+  `FILE_REL` reaches only the telemetry payload here, never the pwsh
+  invocation, so the formatting target is unaffected. Copies stay
+  byte-identical via `scripts/sync-hook-utils.sh`.
+
 ## [0.7.28]
 
 ### Changed
diff --git a/plugins/powershell-format/hooks/hook-utils.sh b/plugins/powershell-format/hooks/hook-utils.sh
index a426dd4e9..9818a6a73 100644
--- a/plugins/powershell-format/hooks/hook-utils.sh
+++ b/plugins/powershell-format/hooks/hook-utils.sh
@@ -610,6 +610,66 @@ hook::repo_root() {
   return 1
 }
 
+# Repo-relative form of <file> under <repo-root> — the shape the telemetry
+# schema requires of `data.file` ("relative to the consuming repo root").
+#
+# Both sides go through `cygpath -lm` (long name, forward-slash mixed form)
+# when it is available, so the prefix strip compares ONE representation: on
+# Windows Git Bash `git rev-parse --show-toplevel` answers with a drive-letter
+# path while file_path may arrive in POSIX mount form, and the raw strip never
+# matches. On Linux/macOS cygpath is absent and both paths are already POSIX,
+# so the strip runs directly.
+#
+# What survives the strip is not trusted to BE relative. A mount/symlink
+# mismatch, or a cygpath that answers for one side and not the other, leaves
+# the whole absolute path, which embeds the developer's username and breaks the
+# schema contract. Such a path degrades to its basename rather than leaking
+# (#1133), and the answer is DISTINGUISHABLE: return 1 and
+# HOOK_REPO_RELATIVE_DEGRADED=1. Success (return 0) means the path is genuinely
+# repo-relative. Telemetry callers that ignore the status still get the safe
+# value; a caller that feeds the result to a TOOL must branch on it, because a
+# bare basename resolved against the repo root names a different file.
+#   FILE_REL=$(hook::repo_relative_path "$FILE" "$REPO_ROOT")
+#
+# Callers under `set -e` must not take the status from a bare assignment: a
+# degraded answer returns 1, and `FILE_REL=$(hook::repo_relative_path ...)`
+# would abort the shell. Append `|| <flag>=1` (what every tool-feeding caller
+# here does) or `|| :` to keep the failure handled.
+# shellcheck disable=SC2034  # public contract: callers may read HOOK_REPO_RELATIVE_DEGRADED
+hook::repo_relative_path() {
+  local file="$1" root="$2" rel="$1"
+  HOOK_REPO_RELATIVE_DEGRADED=0
+  # An empty root anchors nothing, and the strip must not run against one:
+  # `${file#""/}` merely shaves the leading slash, handing back a path that is
+  # still the caller's absolute path but no longer LOOKS absolute to the
+  # redaction below, so it would leak with a success status. Skipping the strip
+  # leaves rel as the input, which the redaction then degrades correctly.
+  if [[ -n "$root" ]]; then
+    if command -v cygpath >/dev/null 2>&1; then
+      local file_lm root_lm
+      file_lm=$(cygpath -lm "$file" 2>/dev/null)
+      root_lm=$(cygpath -lm "$root" 2>/dev/null)
+      if [[ -n "$file_lm" && -n "$root_lm" ]]; then
+        rel="${file_lm#"$root_lm"/}"
+      fi
+    else
+      rel="${file#"$root"/}"
+    fi
+  fi
+  # POSIX-absolute, drive-letter, and UNC are the three spellings an unstripped
+  # path arrives in. Trim on either separator: a mixed-form path carries both.
+  case "$rel" in
+  /* | [A-Za-z]:* | \\\\*)
+    rel="${rel##*/}"
+    rel="${rel##*\\}"
+    HOOK_REPO_RELATIVE_DEGRADED=1
+    ;;
+  *) ;; # already repo-relative, nothing to redact
+  esac
+  printf '%s' "$rel"
+  ((HOOK_REPO_RELATIVE_DEGRADED == 0))
+}
+
 # Buffer a complete JSON payload from stdin, tolerating Windows Win32-pipe
 # late-EOF stalls via a bounded read on the inherited fd0. Returns the payload
 # on success; returns 1 on empty/incomplete stdin (caller skips), or 2 when the
diff --git a/plugins/powershell-format/hooks/powershell-format.sh b/plugins/powershell-format/hooks/powershell-format.sh
index fbcea7cd6..a1675108b 100755
--- a/plugins/powershell-format/hooks/powershell-format.sh
+++ b/plugins/powershell-format/hooks/powershell-format.sh
@@ -83,26 +83,14 @@ REPO_ROOT="$(hook::repo_root "$(dirname "$FILE")")"
 # is wired: the unwired default path spawns zero telemetry-only subprocesses
 # (the tool_name jq parse, and 2× cygpath on Windows).
 #
-# FILE_REL is the repo-relative path: schema requires "relative to the consuming
-# repo root". On Windows Git Bash, git rev-parse --show-toplevel returns a
-# drive-letter path while FILE may be in POSIX mount form. Normalize both
-# through cygpath -lm (long name, forward-slash mixed form) when available so
-# the prefix strip compares the same representation. On Linux/macOS, cygpath is
-# absent and both paths are already POSIX. Falls back to raw FILE on any
-# normalization error.
+# FILE_REL is the repo-relative path the schema requires ("relative to the
+# consuming repo root"), degrading to the basename when the prefix strip does
+# not match, so an absolute path never reaches telemetry.
 TOOL=""
 FILE_REL="$FILE"
 if hook::telemetry_enabled; then
   TOOL=$(printf '%s' "$INPUT" | jq -r '.tool_name // empty' 2>/dev/null)
-  if command -v cygpath >/dev/null 2>&1; then
-    _file_lm=$(cygpath -lm "$FILE" 2>/dev/null)
-    _root_lm=$(cygpath -lm "$REPO_ROOT" 2>/dev/null)
-    if [[ -n "$_file_lm" && -n "$_root_lm" ]]; then
-      FILE_REL="${_file_lm#"$_root_lm"/}"
-    fi
-  else
-    FILE_REL="${FILE#"$REPO_ROOT"/}"
-  fi
+  FILE_REL="$(hook::repo_relative_path "$FILE" "$REPO_ROOT")"
 fi
 
 # Build the telemetry data object for the current TOOL/FILE_REL. $1 is the
diff --git a/plugins/rate-limit-guard/.claude-plugin/plugin.json b/plugins/rate-limit-guard/.claude-plugin/plugin.json
index 5910c4822..7f19c335f 100644
--- a/plugins/rate-limit-guard/.claude-plugin/plugin.json
+++ b/plugins/rate-limit-guard/.claude-plugin/plugin.json
@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "rate-limit-guard",
-  "version": "0.7.19",
+  "version": "0.7.20",
   "description": "Shared rate-limit guard for loop lanes: a statusline wrapper tees the subscription rate-limit windows to a fixed machine-scope file, a StopFailure hook records rate-limit stops reactively, and a reader contract fixes how consuming sessions pause and resume.",
   "author": {
     "name": "Melodic Software",
diff --git a/plugins/rate-limit-guard/CHANGELOG.md b/plugins/rate-limit-guard/CHANGELOG.md
index 7be8ace1b..2d0e7e3d1 100644
--- a/plugins/rate-limit-guard/CHANGELOG.md
+++ b/plugins/rate-limit-guard/CHANGELOG.md
@@ -3,6 +3,17 @@
 All notable changes to the `rate-limit-guard` plugin are documented here. Format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning.
 
+## [0.7.20]
+
+### Changed
+
+- **Vendored `hook-utils.sh` gained `hook::repo_relative_path`.** The shared lib
+  now owns the repo-relative path computation twelve sibling hooks had each
+  hand-copied, together with the absolute-path degrade only four of those twelve
+  copies carried (#1133). This plugin's hooks do not call it; the copy is bumped
+  because `scripts/sync-hook-utils.sh` keeps every carrying plugin
+  byte-identical.
+
 ## [0.7.19]
 
 ### Added
diff --git a/plugins/rate-limit-guard/hooks/hook-utils.sh b/plugins/rate-limit-guard/hooks/hook-utils.sh
index a426dd4e9..9818a6a73 100755
--- a/plugins/rate-limit-guard/hooks/hook-utils.sh
+++ b/plugins/rate-limit-guard/hooks/hook-utils.sh
@@ -610,6 +610,66 @@ hook::repo_root() {
   return 1
 }
 
+# Repo-relative form of <file> under <repo-root> — the shape the telemetry
+# schema requires of `data.file` ("relative to the consuming repo root").
+#
+# Both sides go through `cygpath -lm` (long name, forward-slash mixed form)
+# when it is available, so the prefix strip compares ONE representation: on
+# Windows Git Bash `git rev-parse --show-toplevel` answers with a drive-letter
+# path while file_path may arrive in POSIX mount form, and the raw strip never
+# matches. On Linux/macOS cygpath is absent and both paths are already POSIX,
+# so the strip runs directly.
+#
+# What survives the strip is not trusted to BE relative. A mount/symlink
+# mismatch, or a cygpath that answers for one side and not the other, leaves
+# the whole absolute path, which embeds the developer's username and breaks the
+# schema contract. Such a path degrades to its basename rather than leaking
+# (#1133), and the answer is DISTINGUISHABLE: return 1 and
+# HOOK_REPO_RELATIVE_DEGRADED=1. Success (return 0) means the path is genuinely
+# repo-relative. Telemetry callers that ignore the status still get the safe
+# value; a caller that feeds the result to a TOOL must branch on it, because a
+# bare basename resolved against the repo root names a different file.
+#   FILE_REL=$(hook::repo_relative_path "$FILE" "$REPO_ROOT")
+#
+# Callers under `set -e` must not take the status from a bare assignment: a
+# degraded answer returns 1, and `FILE_REL=$(hook::repo_relative_path ...)`
+# would abort the shell. Append `|| <flag>=1` (what every tool-feeding caller
+# here does) or `|| :` to keep the failure handled.
+# shellcheck disable=SC2034  # public contract: callers may read HOOK_REPO_RELATIVE_DEGRADED
+hook::repo_relative_path() {
+  local file="$1" root="$2" rel="$1"
+  HOOK_REPO_RELATIVE_DEGRADED=0
+  # An empty root anchors nothing, and the strip must not run against one:
+  # `${file#""/}` merely shaves the leading slash, handing back a path that is
+  # still the caller's absolute path but no longer LOOKS absolute to the
+  # redaction below, so it would leak with a success status. Skipping the strip
+  # leaves rel as the input, which the redaction then degrades correctly.
+  if [[ -n "$root" ]]; then
+    if command -v cygpath >/dev/null 2>&1; then
+      local file_lm root_lm
+      file_lm=$(cygpath -lm "$file" 2>/dev/null)
+      root_lm=$(cygpath -lm "$root" 2>/dev/null)
+      if [[ -n "$file_lm" && -n "$root_lm" ]]; then
+        rel="${file_lm#"$root_lm"/}"
+      fi
+    else
+      rel="${file#"$root"/}"
+    fi
+  fi
+  # POSIX-absolute, drive-letter, and UNC are the three spellings an unstripped
+  # path arrives in. Trim on either separator: a mixed-form path carries both.
+  case "$rel" in
+  /* | [A-Za-z]:* | \\\\*)
+    rel="${rel##*/}"
+    rel="${rel##*\\}"
+    HOOK_REPO_RELATIVE_DEGRADED=1
+    ;;
+  *) ;; # already repo-relative, nothing to redact
+  esac
+  printf '%s' "$rel"
+  ((HOOK_REPO_RELATIVE_DEGRADED == 0))
+}
+
 # Buffer a complete JSON payload from stdin, tolerating Windows Win32-pipe
 # late-EOF stalls via a bounded read on the inherited fd0. Returns the payload
 # on success; returns 1 on empty/incomplete stdin (caller skips), or 2 when the
diff --git a/plugins/ruff-format/.claude-plugin/plugin.json b/plugins/ruff-format/.claude-plugin/plugin.json
index dce2ceb9f..7b1c8ab66 100644
--- a/plugins/ruff-format/.claude-plugin/plugin.json
+++ b/plugins/ruff-format/.claude-plugin/plugin.json
@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "ruff-format",
-  "version": "0.6.26",
+  "version": "0.6.27",
   "description": "Auto-format and lint Python on edit via Ruff, only when a Ruff config governs the repo — using the consuming repo's own Ruff config.",
   "author": {
     "name": "Melodic Software",
diff --git a/plugins/ruff-format/CHANGELOG.md b/plugins/ruff-format/CHANGELOG.md
index 154b4268e..3a90c51cc 100644
--- a/plugins/ruff-format/CHANGELOG.md
+++ b/plugins/ruff-format/CHANGELOG.md
@@ -3,6 +3,29 @@
 All notable changes to the `ruff-format` plugin are documented here. Format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning.
 
+## [0.6.27]
+
+### Fixed
+
+- **Telemetry `data.file` can no longer leak an absolute path (#1133).** The
+  hand-copied `FILE_REL` block is replaced by `hook::repo_relative_path` in the
+  shared `hooks/hook-utils.sh`, which carries the degrade eight of the twelve
+  copies lacked: a path the repo-root prefix strip could not make relative
+  (mount or symlink mismatch, cygpath disagreement) now comes back as its
+  basename instead of an absolute path embedding the developer's username.
+  Copies stay byte-identical via `scripts/sync-hook-utils.sh`.
+
+### Changed
+
+- **The Ruff invocation branches on the degrade.** `FILE_REL` feeds the lint
+  target here, not only telemetry, and Ruff runs from the repo root, so a
+  redacted basename resolves to a different file or none: Ruff answered `E902 No
+  such file or directory` and the real diagnostics vanished from an advisory
+  hook. The hook now records whether the helper degraded and lints the absolute
+  path in that case, so the scan still reads the edited file while the emitted
+  `data.file` stays redacted. A symlinked-root regression case in
+  `hooks/ruff-format.test.sh` pins it: the case fails without the branch.
+
 ## [0.6.26]
 
 ### Changed
diff --git a/plugins/ruff-format/hooks/hook-utils.sh b/plugins/ruff-format/hooks/hook-utils.sh
index a426dd4e9..9818a6a73 100644
--- a/plugins/ruff-format/hooks/hook-utils.sh
+++ b/plugins/ruff-format/hooks/hook-utils.sh
@@ -610,6 +610,66 @@ hook::repo_root() {
   return 1
 }
 
+# Repo-relative form of <file> under <repo-root> — the shape the telemetry
+# schema requires of `data.file` ("relative to the consuming repo root").
+#
+# Both sides go through `cygpath -lm` (long name, forward-slash mixed form)
+# when it is available, so the prefix strip compares ONE representation: on
+# Windows Git Bash `git rev-parse --show-toplevel` answers with a drive-letter
+# path while file_path may arrive in POSIX mount form, and the raw strip never
+# matches. On Linux/macOS cygpath is absent and both paths are already POSIX,
+# so the strip runs directly.
+#
+# What survives the strip is not trusted to BE relative. A mount/symlink
+# mismatch, or a cygpath that answers for one side and not the other, leaves
+# the whole absolute path, which embeds the developer's username and breaks the
+# schema contract. Such a path degrades to its basename rather than leaking
+# (#1133), and the answer is DISTINGUISHABLE: return 1 and
+# HOOK_REPO_RELATIVE_DEGRADED=1. Success (return 0) means the path is genuinely
+# repo-relative. Telemetry callers that ignore the status still get the safe
+# value; a caller that feeds the result to a TOOL must branch on it, because a
+# bare basename resolved against the repo root names a different file.
+#   FILE_REL=$(hook::repo_relative_path "$FILE" "$REPO_ROOT")
+#
+# Callers under `set -e` must not take the status from a bare assignment: a
+# degraded answer returns 1, and `FILE_REL=$(hook::repo_relative_path ...)`
+# would abort the shell. Append `|| <flag>=1` (what every tool-feeding caller
+# here does) or `|| :` to keep the failure handled.
+# shellcheck disable=SC2034  # public contract: callers may read HOOK_REPO_RELATIVE_DEGRADED
+hook::repo_relative_path() {
+  local file="$1" root="$2" rel="$1"
+  HOOK_REPO_RELATIVE_DEGRADED=0
+  # An empty root anchors nothing, and the strip must not run against one:
+  # `${file#""/}` merely shaves the leading slash, handing back a path that is
+  # still the caller's absolute path but no longer LOOKS absolute to the
+  # redaction below, so it would leak with a success status. Skipping the strip
+  # leaves rel as the input, which the redaction then degrades correctly.
+  if [[ -n "$root" ]]; then
+    if command -v cygpath >/dev/null 2>&1; then
+      local file_lm root_lm
+      file_lm=$(cygpath -lm "$file" 2>/dev/null)
+      root_lm=$(cygpath -lm "$root" 2>/dev/null)
+      if [[ -n "$file_lm" && -n "$root_lm" ]]; then
+        rel="${file_lm#"$root_lm"/}"
+      fi
+    else
+      rel="${file#"$root"/}"
+    fi
+  fi
+  # POSIX-absolute, drive-letter, and UNC are the three spellings an unstripped
+  # path arrives in. Trim on either separator: a mixed-form path carries both.
+  case "$rel" in
+  /* | [A-Za-z]:* | \\\\*)
+    rel="${rel##*/}"
+    rel="${rel##*\\}"
+    HOOK_REPO_RELATIVE_DEGRADED=1
+    ;;
+  *) ;; # already repo-relative, nothing to redact
+  esac
+  printf '%s' "$rel"
+  ((HOOK_REPO_RELATIVE_DEGRADED == 0))
+}
+
 # Buffer a complete JSON payload from stdin, tolerating Windows Win32-pipe
 # late-EOF stalls via a bounded read on the inherited fd0. Returns the payload
 # on success; returns 1 on empty/incomplete stdin (caller skips), or 2 when the
diff --git a/plugins/ruff-format/hooks/ruff-format.sh b/plugins/ruff-format/hooks/ruff-format.sh
index b936c19cf..11e43a8ea 100755
--- a/plugins/ruff-format/hooks/ruff-format.sh
+++ b/plugins/ruff-format/hooks/ruff-format.sh
@@ -86,22 +86,15 @@ fi
 # Resolve repo root early — used to bound the config opt-in walk and to compute
 # the schema-required repo-relative path in data.file.
 REPO_ROOT="$(hook::repo_root "$(dirname "$FILE")")"
-# Repo-relative path: schema requires "relative to the consuming repo root".
-# On Windows Git Bash, git rev-parse --show-toplevel returns a drive-letter path
-# while FILE may be in POSIX mount form. Normalize both through cygpath -lm
-# (long name, forward-slash mixed form) when available so the prefix strip
-# compares the same representation. On Linux/macOS, cygpath is absent and both
-# paths are already POSIX. Falls back to raw FILE on any normalization error.
-FILE_REL="$FILE"
-if command -v cygpath >/dev/null 2>&1; then
-  _file_lm=$(cygpath -lm "$FILE" 2>/dev/null)
-  _root_lm=$(cygpath -lm "$REPO_ROOT" 2>/dev/null)
-  if [[ -n "$_file_lm" && -n "$_root_lm" ]]; then
-    FILE_REL="${_file_lm#"$_root_lm"/}"
-  fi
-else
-  FILE_REL="${FILE#"$REPO_ROOT"/}"
-fi
+# Repo-relative path, serving two consumers: the schema-required data.file, and
+# the argument Ruff runs on from the repo root. A path the prefix strip could
+# not make relative degrades to its basename, which is right for telemetry but
+# names a DIFFERENT file when resolved against the repo root, so the invocation
+# below has to know which of the two it holds. Command substitution runs the
+# helper in a subshell, so its HOOK_REPO_RELATIVE_DEGRADED global never reaches
+# this scope; the return status is the channel that survives.
+FILE_REL_DEGRADED=0
+FILE_REL="$(hook::repo_relative_path "$FILE" "$REPO_ROOT")" || FILE_REL_DEGRADED=1
 
 # Build the telemetry data object for the current TOOL/FILE_REL. $1 is the
 # findings JSON array. jq is authoritative. The fallback is a fixed empty-shape
@@ -207,10 +200,13 @@ fi
 # NOT enough on Windows Git Bash, where the same directory can surface as
 # /tmp/..., /c/..., or a short-name (KYLESE~1) form depending on how it was
 # reached. Falls back to the absolute path when the repo root did not resolve
-# (RUN_DIR would not anchor FILE_REL) or the file is outside it.
+# (RUN_DIR would not anchor FILE_REL), the file is outside it, or FILE_REL
+# degraded to a bare basename — that basename is a redaction for telemetry, and
+# resolving it against the repo root would lint a different file or none, which
+# on this advisory hook means real findings silently disappear.
 RUFF_ARG="$FILE"
 RUN_DIR="${root:-$FILE_DIR_POSIX}"
-if [[ -n "$root" && -n "$FILE_REL" && "$FILE_REL" != "$FILE" ]]; then
+if [[ -n "$root" && "$FILE_REL_DEGRADED" -eq 0 && -n "$FILE_REL" && "$FILE_REL" != "$FILE" ]]; then
   RUFF_ARG="$FILE_REL"
 fi
 
diff --git a/plugins/ruff-format/hooks/ruff-format.test.sh b/plugins/ruff-format/hooks/ruff-format.test.sh
index 999ba9cdc..9aaebc90f 100755
--- a/plugins/ruff-format/hooks/ruff-format.test.sh
+++ b/plugins/ruff-format/hooks/ruff-format.test.sh
@@ -494,6 +494,47 @@ else
   fail "jq-absent (rc=$RC_NOJQ out=$OUT_NOJQ)"
 fi
 
+# --- Symlinked repo root: the lint target must stay the edited file ----------
+# The hook passes Ruff a repo-relative path so diagnostics read cleanly, and it
+# computes that path with hook::repo_relative_path, which REDACTS to a bare
+# basename when the repo-root prefix strip does not match. Reaching one repo
+# through a symlink produces exactly that mismatch: file_path keeps the
+# symlinked spelling while `git rev-parse --show-toplevel` answers with the
+# physical path. A basename resolved against the repo root is a DIFFERENT file
+# (here: none), so without the degrade branch Ruff lints the wrong path and the
+# real finding disappears from an advisory hook. The file sits one directory
+# deep so a same-named file at the root cannot mask the bug.
+if ln -s "$WORK/symlink-real" "$WORK/symlink-link" 2>/dev/null; then
+  REPO_SL="$WORK/symlink-real"
+  new_ruff_repo "$REPO_SL"
+  mkdir -p "$REPO_SL/pkg"
+  printf 'x = undefined_name_here\n' >"$REPO_SL/pkg/mod.py"
+  OUT_SL=$(run_hook "$WORK/symlink-link/pkg/mod.py")
+  if [[ "$OUT_SL" == *F821* ]]; then
+    ok "symlinked root: the real finding still surfaces (lint target not redacted)"
+  else
+    fail "symlinked root: F821 lost, hook linted a redacted path: $OUT_SL"
+  fi
+  if [[ "$OUT_SL" != *E902* ]]; then
+    ok "symlinked root: no 'no such file' error from a basename-only target"
+  else
+    fail "symlinked root: Ruff got a nonexistent target: $OUT_SL"
+  fi
+  # The redaction itself must still hold on the telemetry side: data.file is
+  # the basename, never the absolute path that embeds the developer's username.
+  SL_OUT="$WORK/sl-telemetry.json"
+  SL_SINK=$(make_sink "cat >\"$SL_OUT\"")
+  run_hook_env "$WORK/symlink-link/pkg/mod.py" \
+    CLAUDE_PLUGIN_OPTION_RUFF_FORMAT_ENABLED=true HOOK_TELEMETRY_SINK="$SL_SINK" >/dev/null
+  if wait_for_sink "$SL_OUT" && [[ "$(jq -r '.data.file' "$SL_OUT" 2>/dev/null)" == "mod.py" ]]; then
+    ok "symlinked root: telemetry data.file stays redacted to the basename"
+  else
+    fail "symlinked root: data.file was $(jq -r '.data.file' "$SL_OUT" 2>/dev/null)"
+  fi
+else
+  echo "SKIP: symlinks unavailable on this filesystem -- symlinked-root case skipped"
+fi
+
 echo
 echo "PASS=$PASS FAIL=$FAIL"
 [[ $FAIL -eq 0 ]]
diff --git a/plugins/source-control/.claude-plugin/plugin.json b/plugins/source-control/.claude-plugin/plugin.json
index a4d167064..d1e9a8a92 100644
--- a/plugins/source-control/.claude-plugin/plugin.json
+++ b/plugins/source-control/.claude-plugin/plugin.json
@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "source-control",
-  "version": "0.55.28",
+  "version": "0.55.29",
   "description": "Git and GitHub delivery workflow: /commit (Conventional Commits + Co-authored-by trailer via safe heredoc mechanics), /pull-request (prep, create, CI monitoring, review-comment triage, merge, CI-log fetch), /babysit-prs (self-pacing fleet loop \u2014 safe by default; opt-in worker/autopilot tiers add gate-checked merge and thread resolution behind a deterministic Python engine), /babysit-loop (the loop-lane merge lane: a standing or drain loop that invokes babysit-prs per cycle, configured through repo-scoped babysit_loop_* keys on the layered source-control.md seam, with merge authority human-only until the target repo's tracked config adopts the lane, a gate-proven C2-mechanical baseline once adopted, and standing merge-rung raises binding from the team-tracked layer only \u2014 with one named exception, where an invocation line explicitly typing both the autopilot tier keyword and the dedicated raise argument --merge c3-this-run widens that single invocation's merge authority up to C3 behind a fresh independent frontier-tier resolver, while C4-structural and C5-untrusted-provenance stay unconditionally human-merge), /worktree (create, status, cleanup, audit for parallel-session isolation), /setup (check the effective commit-subject / PR-title convention merged across its config layers and the babysit-prs config, or apply \u2014 interview the repo and write the convention config to a chosen layer), and /resolve-conflicts (intent-first merge/rebase conflict resolution with a semantic-conflict sweep \u2014 never --abort). The commit-subject / PR-title convention is configurable via a source-control.md config written by a re-runnable setup skill, layered across a ~/.claude user-global file, the tracked team file, and a gitignored .claude/source-control.local.md personal overlay merged per key; Conventional Commits is the default when no convention is declared.",
   "author": {
     "name": "Melodic Software",
diff --git a/plugins/source-control/CHANGELOG.md b/plugins/source-control/CHANGELOG.md
index 1f3ad2762..b9b1cf370 100644
--- a/plugins/source-control/CHANGELOG.md
+++ b/plugins/source-control/CHANGELOG.md
@@ -3,6 +3,17 @@
 All notable changes to the `source-control` plugin are documented here. Format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning.
 
+## [0.55.29]
+
+### Changed
+
+- **Vendored `hook-utils.sh` gained `hook::repo_relative_path`.** The shared lib
+  now owns the repo-relative path computation twelve sibling hooks had each
+  hand-copied, together with the absolute-path degrade only four of those twelve
+  copies carried (#1133). This plugin's hooks do not call it; the copy is bumped
+  because `scripts/sync-hook-utils.sh` keeps every carrying plugin
+  byte-identical.
+
 ## [0.55.28]
 
 ### Changed
diff --git a/plugins/source-control/hooks/hook-utils.sh b/plugins/source-control/hooks/hook-utils.sh
index a426dd4e9..9818a6a73 100644
--- a/plugins/source-control/hooks/hook-utils.sh
+++ b/plugins/source-control/hooks/hook-utils.sh
@@ -610,6 +610,66 @@ hook::repo_root() {
   return 1
 }
 
+# Repo-relative form of <file> under <repo-root> — the shape the telemetry
+# schema requires of `data.file` ("relative to the consuming repo root").
+#
+# Both sides go through `cygpath -lm` (long name, forward-slash mixed form)
+# when it is available, so the prefix strip compares ONE representation: on
+# Windows Git Bash `git rev-parse --show-toplevel` answers with a drive-letter
+# path while file_path may arrive in POSIX mount form, and the raw strip never
+# matches. On Linux/macOS cygpath is absent and both paths are already POSIX,
+# so the strip runs directly.
+#
+# What survives the strip is not trusted to BE relative. A mount/symlink
+# mismatch, or a cygpath that answers for one side and not the other, leaves
+# the whole absolute path, which embeds the developer's username and breaks the
+# schema contract. Such a path degrades to its basename rather than leaking
+# (#1133), and the answer is DISTINGUISHABLE: return 1 and
+# HOOK_REPO_RELATIVE_DEGRADED=1. Success (return 0) means the path is genuinely
+# repo-relative. Telemetry callers that ignore the status still get the safe
+# value; a caller that feeds the result to a TOOL must branch on it, because a
+# bare basename resolved against the repo root names a different file.
+#   FILE_REL=$(hook::repo_relative_path "$FILE" "$REPO_ROOT")
+#
+# Callers under `set -e` must not take the status from a bare assignment: a
+# degraded answer returns 1, and `FILE_REL=$(hook::repo_relative_path ...)`
+# would abort the shell. Append `|| <flag>=1` (what every tool-feeding caller
+# here does) or `|| :` to keep the failure handled.
+# shellcheck disable=SC2034  # public contract: callers may read HOOK_REPO_RELATIVE_DEGRADED
+hook::repo_relative_path() {
+  local file="$1" root="$2" rel="$1"
+  HOOK_REPO_RELATIVE_DEGRADED=0
+  # An empty root anchors nothing, and the strip must not run against one:
+  # `${file#""/}` merely shaves the leading slash, handing back a path that is
+  # still the caller's absolute path but no longer LOOKS absolute to the
+  # redaction below, so it would leak with a success status. Skipping the strip
+  # leaves rel as the input, which the redaction then degrades correctly.
+  if [[ -n "$root" ]]; then
+    if command -v cygpath >/dev/null 2>&1; then
+      local file_lm root_lm
+      file_lm=$(cygpath -lm "$file" 2>/dev/null)
+      root_lm=$(cygpath -lm "$root" 2>/dev/null)
+      if [[ -n "$file_lm" && -n "$root_lm" ]]; then
+        rel="${file_lm#"$root_lm"/}"
+      fi
+    else
+      rel="${file#"$root"/}"
+    fi
+  fi
+  # POSIX-absolute, drive-letter, and UNC are the three spellings an unstripped
+  # path arrives in. Trim on either separator: a mixed-form path carries both.
+  case "$rel" in
+  /* | [A-Za-z]:* | \\\\*)
+    rel="${rel##*/}"
+    rel="${rel##*\\}"
+    HOOK_REPO_RELATIVE_DEGRADED=1
+    ;;
+  *) ;; # already repo-relative, nothing to redact
+  esac
+  printf '%s' "$rel"
+  ((HOOK_REPO_RELATIVE_DEGRADED == 0))
+}
+
 # Buffer a complete JSON payload from stdin, tolerating Windows Win32-pipe
 # late-EOF stalls via a bounded read on the inherited fd0. Returns the payload
 # on success; returns 1 on empty/incomplete stdin (caller skips), or 2 when the
diff --git a/plugins/typos-format/.claude-plugin/plugin.json b/plugins/typos-format/.claude-plugin/plugin.json
index b8b8969f7..a35a0be47 100644
--- a/plugins/typos-format/.claude-plugin/plugin.json
+++ b/plugins/typos-format/.claude-plugin/plugin.json
@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "typos-format",
-  "version": "0.6.31",
+  "version": "0.6.32",
   "description": "Spell-check on edit via typos-cli, unconditionally — report-only by default, honoring the consuming repo's own typos configuration when one is present.",
   "author": {
     "name": "Melodic Software",
diff --git a/plugins/typos-format/CHANGELOG.md b/plugins/typos-format/CHANGELOG.md
index 20220181a..5f5ec9acf 100644
--- a/plugins/typos-format/CHANGELOG.md
+++ b/plugins/typos-format/CHANGELOG.md
@@ -3,6 +3,28 @@
 All notable changes to the `typos-format` plugin are documented here. Format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning.
 
+## [0.6.32]
+
+### Fixed
+
+- **Telemetry `data.file` can no longer leak an absolute path (#1133).** The
+  hand-copied `FILE_REL` block is replaced by `hook::repo_relative_path` in the
+  shared `hooks/hook-utils.sh`, which carries the degrade eight of the twelve
+  copies lacked: a path the repo-root prefix strip could not make relative
+  (mount or symlink mismatch, cygpath disagreement) now comes back as its
+  basename instead of an absolute path embedding the developer's username.
+  Copies stay byte-identical via `scripts/sync-hook-utils.sh`.
+
+### Changed
+
+- **The typos invocation branches on the degrade.** `FILE_REL` feeds the tool
+  argument here, not only telemetry, and a redacted basename resolved against
+  the repo root names a different file. The hook now records whether the helper
+  degraded and falls back to the absolute path in that case, so the scan still
+  reads the edited file while the emitted `data.file` stays redacted. A
+  symlinked-root regression case in `hooks/typos-format.test.sh` pins it: the
+  case fails without the branch.
+
 ## [0.6.31]
 
 ### Changed
diff --git a/plugins/typos-format/hooks/hook-utils.sh b/plugins/typos-format/hooks/hook-utils.sh
index a426dd4e9..9818a6a73 100644
--- a/plugins/typos-format/hooks/hook-utils.sh
+++ b/plugins/typos-format/hooks/hook-utils.sh
@@ -610,6 +610,66 @@ hook::repo_root() {
   return 1
 }
 
+# Repo-relative form of <file> under <repo-root> — the shape the telemetry
+# schema requires of `data.file` ("relative to the consuming repo root").
+#
+# Both sides go through `cygpath -lm` (long name, forward-slash mixed form)
+# when it is available, so the prefix strip compares ONE representation: on
+# Windows Git Bash `git rev-parse --show-toplevel` answers with a drive-letter
+# path while file_path may arrive in POSIX mount form, and the raw strip never
+# matches. On Linux/macOS cygpath is absent and both paths are already POSIX,
+# so the strip runs directly.
+#
+# What survives the strip is not trusted to BE relative. A mount/symlink
+# mismatch, or a cygpath that answers for one side and not the other, leaves
+# the whole absolute path, which embeds the developer's username and breaks the
+# schema contract. Such a path degrades to its basename rather than leaking
+# (#1133), and the answer is DISTINGUISHABLE: return 1 and
+# HOOK_REPO_RELATIVE_DEGRADED=1. Success (return 0) means the path is genuinely
+# repo-relative. Telemetry callers that ignore the status still get the safe
+# value; a caller that feeds the result to a TOOL must branch on it, because a
+# bare basename resolved against the repo root names a different file.
+#   FILE_REL=$(hook::repo_relative_path "$FILE" "$REPO_ROOT")
+#
+# Callers under `set -e` must not take the status from a bare assignment: a
+# degraded answer returns 1, and `FILE_REL=$(hook::repo_relative_path ...)`
+# would abort the shell. Append `|| <flag>=1` (what every tool-feeding caller
+# here does) or `|| :` to keep the failure handled.
+# shellcheck disable=SC2034  # public contract: callers may read HOOK_REPO_RELATIVE_DEGRADED
+hook::repo_relative_path() {
+  local file="$1" root="$2" rel="$1"
+  HOOK_REPO_RELATIVE_DEGRADED=0
+  # An empty root anchors nothing, and the strip must not run against one:
+  # `${file#""/}` merely shaves the leading slash, handing back a path that is
+  # still the caller's absolute path but no longer LOOKS absolute to the
+  # redaction below, so it would leak with a success status. Skipping the strip
+  # leaves rel as the input, which the redaction then degrades correctly.
+  if [[ -n "$root" ]]; then
+    if command -v cygpath >/dev/null 2>&1; then
+      local file_lm root_lm
+      file_lm=$(cygpath -lm "$file" 2>/dev/null)
+      root_lm=$(cygpath -lm "$root" 2>/dev/null)
+      if [[ -n "$file_lm" && -n "$root_lm" ]]; then
+        rel="${file_lm#"$root_lm"/}"
+      fi
+    else
+      rel="${file#"$root"/}"
+    fi
+  fi
+  # POSIX-absolute, drive-letter, and UNC are the three spellings an unstripped
+  # path arrives in. Trim on either separator: a mixed-form path carries both.
+  case "$rel" in
+  /* | [A-Za-z]:* | \\\\*)
+    rel="${rel##*/}"
+    rel="${rel##*\\}"
+    HOOK_REPO_RELATIVE_DEGRADED=1
+    ;;
+  *) ;; # already repo-relative, nothing to redact
+  esac
+  printf '%s' "$rel"
+  ((HOOK_REPO_RELATIVE_DEGRADED == 0))
+}
+
 # Buffer a complete JSON payload from stdin, tolerating Windows Win32-pipe
 # late-EOF stalls via a bounded read on the inherited fd0. Returns the payload
 # on success; returns 1 on empty/incomplete stdin (caller skips), or 2 when the
diff --git a/plugins/typos-format/hooks/typos-format.sh b/plugins/typos-format/hooks/typos-format.sh
index 5acbdcaf9..70b439e03 100755
--- a/plugins/typos-format/hooks/typos-format.sh
+++ b/plugins/typos-format/hooks/typos-format.sh
@@ -150,22 +150,15 @@ fi
 # Resolve repo root early — used as the CWD typos runs in and to compute
 # the schema-required repo-relative path in data.file.
 REPO_ROOT="$(hook::repo_root "$(dirname "$FILE")")"
-# Repo-relative path: schema requires "relative to the consuming repo root".
-# On Windows Git Bash, git rev-parse --show-toplevel returns a drive-letter path
-# while FILE may be in POSIX mount form. Normalize both through cygpath -lm
-# (long name, forward-slash mixed form) when available so the prefix strip
-# compares the same representation. On Linux/macOS, cygpath is absent and both
-# paths are already POSIX. Falls back to raw FILE on any normalization error.
-FILE_REL="$FILE"
-if command -v cygpath >/dev/null 2>&1; then
-  _file_lm=$(cygpath -lm "$FILE" 2>/dev/null)
-  _root_lm=$(cygpath -lm "$REPO_ROOT" 2>/dev/null)
-  if [[ -n "$_file_lm" && -n "$_root_lm" ]]; then
-    FILE_REL="${_file_lm#"$_root_lm"/}"
-  fi
-else
-  FILE_REL="${FILE#"$REPO_ROOT"/}"
-fi
+# Repo-relative path, serving two consumers: the schema-required data.file, and
+# the argument typos runs on from the repo root. A path the prefix strip could
+# not make relative degrades to its basename, which is right for telemetry but
+# names a DIFFERENT file when resolved against the repo root, so the tool
+# invocation below has to know which of the two it holds. Command substitution
+# runs the helper in a subshell, so its HOOK_REPO_RELATIVE_DEGRADED global never
+# reaches this scope; the return status is the channel that survives.
+FILE_REL_DEGRADED=0
+FILE_REL="$(hook::repo_relative_path "$FILE" "$REPO_ROOT")" || FILE_REL_DEGRADED=1
 
 # Build the telemetry data object for the current TOOL/FILE_REL. $1 is the
 # residual-findings JSON array; optional $2 is the applied-corrections JSON
@@ -228,10 +221,12 @@ fi
 # subdirectory's own config) — so running from repo root here does not change
 # which config governs, regardless of nesting depth. Falls back to the
 # absolute path and the file's own directory when the repo root did not
-# resolve or the file is outside it.
+# resolve, the file is outside it, or FILE_REL degraded to a bare basename —
+# that basename is a redaction for telemetry, and resolving it against the repo
+# root would scan a different file or none at all.
 TYPOS_ARG="$FILE"
 RUN_DIR="${root:-$(dirname "$FILE")}"
-if [[ -n "$root" && -n "$FILE_REL" && "$FILE_REL" != "$FILE" ]]; then
+if [[ -n "$root" && "$FILE_REL_DEGRADED" -eq 0 && -n "$FILE_REL" && "$FILE_REL" != "$FILE" ]]; then
   TYPOS_ARG="$FILE_REL"
 fi
 
diff --git a/plugins/typos-format/hooks/typos-format.test.sh b/plugins/typos-format/hooks/typos-format.test.sh
index 7c1d1eee6..31973defb 100755
--- a/plugins/typos-format/hooks/typos-format.test.sh
+++ b/plugins/typos-format/hooks/typos-format.test.sh
@@ -1676,6 +1676,42 @@ else
   fail "jq-absent (rc=$RC_NOJQ out=$OUT_NOJQ)"
 fi
 
+# --- Symlinked repo root: the scan target must stay the edited file ----------
+# The hook passes typos a repo-relative path so diagnostics read cleanly, and it
+# computes that path with hook::repo_relative_path, which REDACTS to a bare
+# basename when the repo-root prefix strip does not match. Reaching one repo
+# through a symlink produces exactly that mismatch: file_path keeps the
+# symlinked spelling while `git rev-parse --show-toplevel` answers with the
+# physical path. A basename resolved against the repo root is a DIFFERENT file
+# (here: none), so without the degrade branch the scan reads the wrong path and
+# the real typo disappears. The file sits one directory deep so a same-named
+# file at the root cannot mask the bug.
+if ln -s "$WORK/symlink-real" "$WORK/symlink-link" 2>/dev/null; then
+  REPO_SL="$WORK/symlink-real"
+  new_typos_repo "$REPO_SL"
+  mkdir -p "$REPO_SL/docs"
+  printf 'This sentence contains a delibrate misspelling.\n' >"$REPO_SL/docs/note.md" # spellchecker:disable-line
+  OUT_SL=$(run_hook "$WORK/symlink-link/docs/note.md")
+  if [[ "$OUT_SL" == *delibrate* ]]; then # spellchecker:disable-line
+    ok "symlinked root: the real typo still surfaces (scan target not redacted)"
+  else
+    fail "symlinked root: typo lost, hook scanned a redacted path: $OUT_SL"
+  fi
+  # The redaction itself must still hold on the telemetry side: data.file is
+  # the basename, never the absolute path that embeds the developer's username.
+  SL_OUT="$WORK/sl-telemetry.json"
+  SL_SINK=$(make_sink "cat >\"$SL_OUT\"")
+  run_hook_env "$WORK/symlink-link/docs/note.md" \
+    CLAUDE_PLUGIN_OPTION_TYPOS_FORMAT_ENABLED=true HOOK_TELEMETRY_SINK="$SL_SINK" \
+    PATH="$(dirname "$REAL_TYPOS"):$PATH" >/dev/null
+  if wait_for_sink "$SL_OUT" && [[ "$(jq -r '.data.file' "$SL_OUT" 2>/dev/null)" == "note.md" ]]; then
+    ok "symlinked root: telemetry data.file stays redacted to the basename"
+  else
+    fail "symlinked root: data.file was $(jq -r '.data.file' "$SL_OUT" 2>/dev/null)"
+  fi
+else
+  echo "SKIP: symlinks unavailable on this filesystem -- symlinked-root case skipped"
+fi
 
 echo
 echo "PASS=$PASS FAIL=$FAIL"