[audit] hook: orphaned BEGIN marker silently discards user hook content

[lugassawan]

Audit findings — hook

Scope: reliability · Severity range: Low–Low
Source: codebase audit

reliability

Severity	File:Line	Symptom	Suggested fix
Low	internal/hook/hook.go:160	When BEGIN RIMBA HOOK is present but END is missing, removeBlock trims BEGIN-to-EOF and returns only content before BEGIN — silently discarding all user lines after the marker.	On orphaned-BEGIN, return an error ("corrupt rimba hook block; resolve manually") instead of truncating.

Root cause: The corrupt-recovery branch assumes nothing of value follows an orphaned BEGIN, discarding afterBegin wholesale instead of preserving non-rimba lines or refusing to modify.

Reasoning chain: 1. First strings.Cut splits on BEGIN-marker into before/afterBegin. 2. Second strings.Cut on END-marker fails. 3. Function returns before + "\n" (line 167), dropping afterBegin entirely. 4. Custom hook lines from husky/lefthook/etc. below a broken block are lost persistently on every subsequent rimba write.

Counter-evidence considered: Corrupt block is self-inflicted/rare, but hook files commonly aggregate multiple tools' content; silent data loss on a git-adjacent file violates least-surprise. Low-frequency, not falsified.

---

Provenance

Filed by workflow-audit-emit-issues from an in-session codebase audit.
Re-running re-files — check for duplicates before confirming.