# #1234 audit + output-guard SessionStart fix

## Discovery during the M104 #1234 audit

My own #1817 work introduced `src/hooks/bin/output-guard.mjs` with an over-strict allow-list. It excluded `SessionStart` and `PostCompact` from `EVENTS_WITH_ADDITIONAL_CONTEXT`, even though CC actually consumes `additionalContext` on those events. Proof: `hq-ext`'s session-start banner reaches the model via this exact path, and the banner is visible at session start of every CC session in those plugin trees.

## Fix

Add `SessionStart` and `PostCompact` to both allow-lists. No structural change — just two more entries in two sets.

    EVENTS_WITH_HOOK_EVENT_NAME += { SessionStart, PostCompact }
    EVENTS_WITH_ADDITIONAL_CONTEXT += { SessionStart, PostCompact }

## Why this matters for M104

The audit (commented on #1234) identified 5 cacheable hooks that should move from `UserPromptSubmit` → `SessionStart` to pin their context into the cached system prompt instead of re-injecting every turn. This guard fix is the prerequisite — without it, the dispatcher guard would silently strip the migrated hooks' output.

## Tests

- Positive: `SessionStart` + `PostCompact` events preserve `additionalContext` + `hookEventName`
- SANITIZE_EVENTS table updated to remove `SessionStart`/`PostCompact` from the strip-list
- 43/44 tests pass (1 skipped — Notification, pre-existing)

## Follow-ups (deferred to separate PRs)

- PR-A: Move `ask-fallback-injector` from UserPromptSubmit → SessionStart (smallest migration, no behavioral surprise)
- PR-B: `agentation-context` migration
- PR-C: `unified-dispatcher` handler-list audit (split cacheable handlers)
- PR-D: `worktree-advisory-consumer` flag-file optimization
- PR-E: Decide on `antipattern-detector` (legacy, rules already in `.claude/rules/*.md`)

Refs #1234.