diff --git a/.githooks/pre-commit b/.githooks/pre-commit
new file mode 100755
index 000000000..4cc2a51fb
--- /dev/null
+++ b/.githooks/pre-commit
@@ -0,0 +1,140 @@
+#!/bin/sh
+# The repository's pre-commit hook (api.quality.pre-commit-hook). It runs
+# make quality before git commit, and pre-merge-commit runs it before a merge
+# commits without conflicts, so the checks pull-request CI runs fail here
+# first. make install turns both on with git config core.hooksPath .githooks;
+# every worktree of the clone shares that setting and runs its own checkout's
+# copy. git commit --no-verify skips them, git's cherry-pick, revert, rebase
+# and am can make commits without them, and CI's Quality checks job still
+# runs the same checks.
+#
+# make quality checks the working tree, so the hook first requires it to hold
+# exactly what is being committed: no unstaged changes to tracked files
+# (including case-only renames), no tracked files git doesn't compare
+# (skip-worktree or assume-unchanged), no untracked files outside the ignore
+# files, no Python files or tool settings that only .git/info/exclude or a
+# global excludes file hides (virtual environments aside), and no tracked
+# Python files those excludes match, which ruff would skip. The commit stops,
+# saying why, when that isn't so, when make quality fails, when ruff's fixes
+# changed a file, or when make, uv or the worktree's dev environment is
+# missing.
+set -u
+
+fail() {
+  printf 'pre-commit: %s\n' "$1" >&2
+  exit 1
+}
+
+root=$(git rev-parse --show-toplevel) ||
+  fail "can't find the root of this working tree."
+cd "$root" || fail "can't enter $root."
+
+# make's own variables from the environment could make it ignore a failing
+# check, read another Makefile, or replace $(MAKE) and so skip quality-check.
+unset MAKEFLAGS MFLAGS GNUMAKEFLAGS MAKEFILES MAKELEVEL MAKE MAKE_COMMAND MAKEOVERRIDES
+
+command -v make >/dev/null 2>&1 ||
+  fail "make isn't installed, so make quality can't run. Install make, then commit again."
+command -v uv >/dev/null 2>&1 ||
+  fail "uv isn't installed, so make quality can't run. Install uv (https://docs.astral.sh/uv/), run make install, then commit again."
+environment=${UV_PROJECT_ENVIRONMENT:-.venv}
+[ -d "$environment" ] ||
+  fail "this worktree has no dev environment ($environment). Run make install here, then commit again."
+
+# git -c core.quotePath=false shows names outside ASCII as they are, and
+# core.ignorecase=false shows a case-only rename on a file system that ignores
+# case as an untracked file.
+names='git -c core.quotePath=false -c core.ignorecase=false'
+newline='
+'
+
+unstaged=$($names diff --name-only) ||
+  fail "git diff failed, so the hook can't tell what make quality would check."
+[ -z "$unstaged" ] ||
+  fail "make quality checks the working tree, which holds changes this commit doesn't. Stage exactly what this commit needs and run git commit without paths, or set the rest aside with git stash push --keep-index, then commit again:
+$unstaged"
+
+# git ls-files -v marks skip-worktree files S and assume-unchanged ones with a
+# lowercase letter. [[:lower:]], not [a-z]: bash 3.2, macOS's /bin/sh, matches
+# uppercase letters with [a-z] in UTF-8 locales. (A loop, not a command
+# substitution: bash 3.2 misreads a case pattern's parenthesis inside one.)
+flags=$($names ls-files -v) ||
+  fail "git ls-files failed, so the hook can't tell what make quality would check."
+uncompared=
+while IFS= read -r entry; do
+  case $entry in
+    [[:lower:]S]\ *) uncompared="$uncompared${uncompared:+$newline}${entry#??}" ;;
+  esac
+done <<EOF
+$flags
+EOF
+[ -z "$uncompared" ] ||
+  fail "git doesn't compare these files with the commit (skip-worktree or assume-unchanged), so make quality could check copies the commit doesn't hold. Run git update-index --no-skip-worktree --no-assume-unchanged on them, then commit again:
+$uncompared"
+
+untracked=$($names ls-files --others --exclude-standard) ||
+  fail "git ls-files failed, so the hook can't tell what make quality would check."
+[ -z "$untracked" ] ||
+  fail "make quality checks the working tree, which holds files git doesn't track. Add them, remove them, or list them in .git/info/exclude (Python files and tool settings aside, which the checks read even then), then commit again:
+$untracked"
+
+# Python files and tool settings that only .git/info/exclude or a global
+# excludes file hides: the checks read them all the same. --directory lists a
+# wholly untracked directory once: a virtual environment (with pyvenv.cfg) is
+# left out, and another counts if it holds Python files or tool settings.
+entries=$($names ls-files --others --directory --exclude-per-directory=.gitignore) ||
+  fail "git ls-files failed, so the hook can't tell what make quality would check."
+hidden=
+while IFS= read -r path; do
+  case $path in
+    '') continue ;;
+    */)
+      [ -f "${path}pyvenv.cfg" ] && continue
+      [ -n "$(find "$path" \( -name '*.py' -o -name '*.pyi' -o -name pyproject.toml \
+        -o -name setup.cfg -o -name mypy.ini -o -name .mypy.ini -o -name ruff.toml \
+        -o -name .ruff.toml -o -name .importlinter \) -print 2>/dev/null)" ] ||
+        continue
+      ;;
+    *.py | *.pyi | pyproject.toml | */pyproject.toml | setup.cfg | */setup.cfg | \
+      mypy.ini | */mypy.ini | .mypy.ini | */.mypy.ini | ruff.toml | */ruff.toml | \
+      .ruff.toml | */.ruff.toml | .importlinter | */.importlinter) ;;
+    *) continue ;;
+  esac
+  hidden="$hidden${hidden:+$newline}$path"
+done <<EOF
+$entries
+EOF
+[ -z "$hidden" ] ||
+  fail "these Python files or tool settings are hidden only by .git/info/exclude or a global excludes file, but ruff, mypy and Import Linter can read them, so the checks wouldn't see what the commit holds. Add them or remove them, then commit again:
+$hidden"
+
+# Tracked Python files that .git/info/exclude or a global excludes file
+# matches: ruff skips them, but CI, which has neither, checks them.
+excluded=$($names ls-files --cached --ignored --exclude-standard -- '*.py' '*.pyi') ||
+  fail "git ls-files failed, so the hook can't tell what make quality would check."
+if [ -n "$excluded" ]; then
+  ignored_by_repository=$($names ls-files --cached --ignored \
+    --exclude-per-directory=.gitignore -- '*.py' '*.pyi') ||
+    fail "git ls-files failed, so the hook can't tell what make quality would check."
+  skipped=
+  while IFS= read -r path; do
+    case "$newline$ignored_by_repository$newline" in
+      *"$newline$path$newline"*) ;;
+      *) skipped="$skipped${skipped:+$newline}$path" ;;
+    esac
+  done <<EOF
+$excluded
+EOF
+  [ -z "$skipped" ] ||
+    fail "ruff would skip these tracked files, which .git/info/exclude or a global excludes file matches, but CI checks them. Remove the pattern that matches them, then commit again:
+$skipped"
+fi
+
+make quality ||
+  fail "make quality failed. Fix what it reported above, then commit again."
+
+fixed=$($names diff --name-only) ||
+  fail "git diff failed, so the hook can't tell whether make quality changed files."
+[ -z "$fixed" ] ||
+  fail "make quality changed these files. Review the fixes, stage them, then commit again:
+$fixed"
diff --git a/.githooks/pre-merge-commit b/.githooks/pre-merge-commit
new file mode 100755
index 000000000..080eed7c2
--- /dev/null
+++ b/.githooks/pre-merge-commit
@@ -0,0 +1,5 @@
+#!/bin/sh
+# git runs this hook, not pre-commit, before a merge that commits without
+# conflicts (api.quality.pre-commit-hook). It runs the same checks. ${0%/*} is
+# this hook's directory, without needing dirname.
+exec "${0%/*}/pre-commit"
diff --git a/.githooks/turn-on.sh b/.githooks/turn-on.sh
new file mode 100755
index 000000000..6847f4fc1
--- /dev/null
+++ b/.githooks/turn-on.sh
@@ -0,0 +1,42 @@
+#!/bin/sh
+# make install runs this to turn on the hooks in .githooks for the clone, with
+# git config core.hooksPath .githooks (api.quality.pre-commit-hook). It
+# changes nothing, and says why, when this directory isn't the root of a git
+# working tree, when core.hooksPath already names another directory, when the
+# clone has hooks of its own (files or symbolic links) that core.hooksPath
+# would stop git running, or when git can't write the setting. It always
+# exits 0, so make install still installs.
+set -u
+
+# Outside a git repository, such as a source archive, there's nothing to do.
+prefix=$(git rev-parse --show-prefix 2>/dev/null) || exit 0
+if [ -n "$prefix" ]; then
+  echo "make install: $(pwd) isn't the root of a git working tree (it is $prefix inside one), so the pre-commit hook isn't turned on." >&2
+  exit 0
+fi
+
+current=$(git config --get core.hooksPath)
+if [ "$current" = ".githooks" ]; then
+  exit 0
+fi
+if [ -n "$current" ]; then
+  echo "make install: core.hooksPath is already $current, so the pre-commit hook isn't turned on. Run git config core.hooksPath .githooks to use it instead, or call .githooks/pre-commit from your own hook." >&2
+  exit 0
+fi
+
+# -L follows symbolic links, both a linked hooks directory and linked hooks.
+hooks=$(git rev-parse --git-path hooks)
+own=$(find -L "$hooks" -mindepth 1 ! -type d ! -name '*.sample' 2>/dev/null)
+if [ -n "$own" ]; then
+  echo "make install: the pre-commit hook isn't turned on, because git would then stop running these hooks of the clone's own:
+$own
+Move them into .githooks, or call .githooks/pre-commit from them, then run git config core.hooksPath .githooks." >&2
+  exit 0
+fi
+
+if git config core.hooksPath .githooks; then
+  echo "make install: turned on the pre-commit hook for every worktree of this clone (core.hooksPath = .githooks)."
+else
+  echo "make install: git couldn't set core.hooksPath (is .git/config locked by another git command?), so the pre-commit hook isn't turned on. Run make install again, or git config core.hooksPath .githooks." >&2
+fi
+exit 0
diff --git a/AGENTS.md b/AGENTS.md
index 6ab0e23ca..50694e54c 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -63,10 +63,17 @@ named `changelog.d/<name>.<type>.md`, where `<type>` is `breaking`, `added`,
 `changed`, `fixed` or `removed` (see "Changelog fragments" in that skill).
 Agents must never bypass branch rules (for example with `gh pr merge --admin`).
 
-Before committing, run `make quality`: it applies ruff's fixes, then runs
-the checks pr.yml's `quality-guards` job runs, apart from the rules
-registry tool's own tests (see "Commit Hygiene" in
-`docs/engineering/skills/github-prs.md` for how a local run can differ).
+Run `make install` once per clone: it installs the dev environment and turns
+on the git hooks in `.githooks`, which run `make quality` before each
+`git commit` and each merge commit, in every worktree of the clone. In a new
+worktree, run `make install` again to create its `.venv`; the hook stops
+commits until it exists. Stage everything the commit needs first: the hook
+stops a commit while the working tree holds unstaged changes or untracked
+files, because `make quality` would check them instead of what is
+committed. `make quality` applies ruff's fixes, then runs the checks
+pr.yml's `quality-guards` job runs, apart from the rules registry tool's
+own tests (see "Commit Hygiene" in `docs/engineering/skills/github-prs.md`).
+Don't skip the hook with `--no-verify`.
 
 Before creating or sharing a migration PR, run the focused migration guards:
 
@@ -123,7 +130,7 @@ To add or change a rule, read `docs/engineering/skills/rules-registry.md`.
 
 ### Code quality and types
 
-- Checked: `api.quality.alembic-revisions-unused-imports`, `api.quality.ci-cd-scripts-ruff-exemptions`, `api.quality.command-line-modules-ruff-exemptions`, `api.quality.command-line-scripts-ruff-exemptions`, `api.quality.coverage-measured`, `api.quality.diff-coverage`, `api.quality.environment-variables-load`, `api.quality.file-length`, `api.quality.make-quality`, `api.quality.mypy-v2`, `api.quality.ruff-format`, `api.quality.ruff-lint`, `api.quality.runtime-evaluated-models-resolve`, `api.quality.suppressions-explained`, `api.quality.tests-assert`, `api.quality.tests-pass`, `api.quality.tests-ruff-exemptions`, `api.quality.unittest-ruff-exemptions`
+- Checked: `api.quality.alembic-revisions-unused-imports`, `api.quality.ci-cd-scripts-ruff-exemptions`, `api.quality.command-line-modules-ruff-exemptions`, `api.quality.command-line-scripts-ruff-exemptions`, `api.quality.coverage-measured`, `api.quality.diff-coverage`, `api.quality.environment-variables-load`, `api.quality.file-length`, `api.quality.make-quality`, `api.quality.mypy-v2`, `api.quality.pre-commit-hook`, `api.quality.ruff-format`, `api.quality.ruff-lint`, `api.quality.runtime-evaluated-models-resolve`, `api.quality.suppressions-explained`, `api.quality.tests-assert`, `api.quality.tests-pass`, `api.quality.tests-ruff-exemptions`, `api.quality.unittest-ruff-exemptions`
 
 ### Observability
 
diff --git a/Makefile b/Makefile
index 736532b6d..7fcbde12a 100644
--- a/Makefile
+++ b/Makefile
@@ -5,7 +5,13 @@
 # 3.14 for other uv commands; set UV_PYTHON to test another version.
 export UV_PYTHON ?= 3.12
 
+# Turns on the hooks in .githooks, which run make quality before each commit
+# (api.quality.pre-commit-hook), then installs the locked dev environment.
+# core.hooksPath is shared by every worktree of the clone. .githooks/turn-on.sh
+# says why it changes nothing outside the root of a git working tree, when
+# core.hooksPath is already set, or when the clone has hooks of its own.
 install:
+	sh .githooks/turn-on.sh
 	uv sync --frozen --extra dev
 
 setup-env:
diff --git a/README.md b/README.md
index 8a03ceb52..87302927e 100644
--- a/README.md
+++ b/README.md
@@ -39,7 +39,11 @@ make install
 make setup-env
 ```
 
-`make install` runs `uv sync --frozen --extra dev`, which creates `.venv` with
+Run `make install` once per clone, and in each new worktree to create its
+`.venv`. It turns on the git hooks in `.githooks/`,
+which run `make quality` before each `git commit` and each merge commit in
+every worktree of the clone (`git config core.hooksPath .githooks`), and runs
+`uv sync --frozen --extra dev`, which creates `.venv` with
 exactly the versions in `uv.lock` on Python 3.12, the version the Cloud Run
 image runs. `make test`, `make test-env-vars`, `make debug-test`, `make debug`,
 `make debug-asgi`, `make typecheck-v2` and the towncrier step of
diff --git a/changelog.d/4206.added.md b/changelog.d/4206.added.md
new file mode 100644
index 000000000..92792433d
--- /dev/null
+++ b/changelog.d/4206.added.md
@@ -0,0 +1 @@
+Added git hooks, turned on by `make install`, that run `make quality` before each `git commit` and each merge commit in every worktree of the clone, and stop the commit when the working tree holds changes the commit doesn't, when a check fails, when ruff's fixes still need staging, or when `uv` or the dev environment is missing.
diff --git a/docs/engineering/skills/github-prs.md b/docs/engineering/skills/github-prs.md
index f1a71b6a0..e8db6dbb1 100644
--- a/docs/engineering/skills/github-prs.md
+++ b/docs/engineering/skills/github-prs.md
@@ -189,12 +189,55 @@ the reason a code change or ruff setting couldn't remove the finding
 ## Commit Hygiene
 
 AI agents must run the quality checks before committing their own code
-changes:
+changes. Run `make install` once per clone: it turns on the git hooks in
+`.githooks` (through `git config core.hooksPath .githooks`), which run them
+before each `git commit` and each merge commit
+(`api.quality.pre-commit-hook`):
 
 ```bash
-make quality
+make install   # once per clone, and once in each new worktree for its .venv
+make quality   # what the hook runs; run it yourself to check sooner
 ```
 
+`.githooks/pre-commit` runs `make quality` from the root of the working
+tree, and `.githooks/pre-merge-commit` runs it for a merge that commits
+without conflicts. `make quality` checks the working tree, not the commit,
+so the hook first requires the two to match. It stops the commit, naming
+the files and saying what to do:
+
+- when tracked files have unstaged changes: stage exactly what the commit
+  needs and run `git commit` without paths, or set the rest aside with
+  `git stash push --keep-index`. This covers fixes `make quality` made in an
+  earlier run, `git commit <paths>` while other files are changed, and a
+  rename that changes only a name's case;
+- when there are untracked files outside the ignore files: add them, remove
+  them, or list them in `.git/info/exclude`;
+- when Python files or tool settings (`pyproject.toml`, `setup.cfg`,
+  `mypy.ini`, `ruff.toml`, `.importlinter`) are hidden only by
+  `.git/info/exclude` or a global excludes file: ruff, mypy and Import
+  Linter can read them anyway, so add them or remove them. A virtual
+  environment (a directory with `pyvenv.cfg`) doesn't count;
+- when those excludes match tracked Python files, which ruff then skips
+  but CI checks: remove the pattern;
+- when tracked files are marked skip-worktree or assume-unchanged, which
+  `git diff` doesn't compare: clear the marks with
+  `git update-index --no-skip-worktree --no-assume-unchanged`;
+- when a check fails;
+- when ruff's fixes changed a file: review the fixes, stage them and
+  commit again;
+- when `make`, `uv` or the worktree's dev environment (`.venv`, or
+  `UV_PROJECT_ENVIRONMENT`) is missing.
+
+`core.hooksPath` is a setting of the clone, so every worktree runs the
+hooks, each from its own checkout; a worktree on a branch from before the
+hooks runs none. `make install` leaves `core.hooksPath` alone, and says
+why, when it would change an enclosing repository, replace another
+`core.hooksPath`, or stop the clone's own hooks in `.git/hooks`, and when
+git can't write the setting; it never stops `make install`. git's
+cherry-pick, revert, rebase and am can make commits without hooks. Don't
+skip them with `git commit --no-verify`; CI's `Quality checks` job runs the
+same checks and blocks the merge anyway.
+
 `make quality` applies ruff's fixes (`ruff check --fix`, then `ruff format`),
 then runs `make quality-check`: `uv lock --check`, `ruff check`,
 `ruff format --check`, Import Linter, mypy and the quality guards
diff --git a/docs/engineering/skills/testing.md b/docs/engineering/skills/testing.md
index 2bb1a9be0..c7f75be52 100644
--- a/docs/engineering/skills/testing.md
+++ b/docs/engineering/skills/testing.md
@@ -7,7 +7,8 @@ Use this skill whenever adding, moving, or reviewing tests.
 Tests run in the environment `uv.lock` defines, on Python 3.12, the same
 versions the Cloud Run image installs (`gcp/cloud_run/Dockerfile`):
 
-- `make install` runs `uv sync --frozen --extra dev`, and `make test` runs
+- `make install` turns on the git hooks in `.githooks` and runs
+  `uv sync --frozen --extra dev`, and `make test` runs
   pytest and coverage through `uv run --frozen --extra dev`. The Makefile sets
   `UV_PYTHON=3.12` unless it is already set, because `.python-version` selects
   3.14.
diff --git a/docs/generated/rules.md b/docs/generated/rules.md
index 3325a5a7f..add3e34ce 100644
--- a/docs/generated/rules.md
+++ b/docs/generated/rules.md
@@ -8,11 +8,11 @@ Every rule that governs `policyengine-api` is listed here with how it is enforce
 
 | Tier | enforced | ratcheted | advisory | doc-only | Total |
 | --- | ---: | ---: | ---: | ---: | ---: |
-| mechanical | 70 | 7 | 1 | 8 | 86 |
+| mechanical | 71 | 7 | 1 | 8 | 87 |
 | metric | 2 | 0 | 0 | 0 | 2 |
 | judgment | 0 | 0 | 0 | 1 | 1 |
 
-**Blocking:** 79 of 89 rules.
+**Blocking:** 80 of 90 rules.
 
 ## Gaps
 
@@ -377,6 +377,7 @@ flowchart LR
 | `api.quality.file-length` | A tracked Python file has at most 800 physical lines, or at most 1,500 if it is test code (a file under a tests or fixtures directory, or a conftest.py); a longer file is split by responsibility into modules, and keeps its public import path. | metric | enforced | yes | quality guard `file-length` | `pr.yml:quality-guards` | yes |
 | `api.quality.make-quality` | make quality is the command for the quality checks, locally and in CI: it applies ruff check --fix and ruff format, then runs make quality-check, which runs uv lock --check, ruff check, ruff format --check, Import Linter, mypy and the quality guards without changing files. Run with a stand-in uv, make quality runs each of them and fails whenever one fails, and make -n prints the same commands. pr.yml's quality-guards job runs make quality and then git diff --exit-code HEAD, with neither step skipped, allowed to fail, or run in another shell or directory, no MAKEFLAGS, GNUMAKEFLAGS or MAKEFILES set for them, and no earlier step writing to GITHUB_ENV or GITHUB_PATH; the Makefile uses no syntax the rules registry doesn't follow and nothing that hides a failing command; and no other pr.yml job's commands run ruff, mypy, lint-imports or the quality guards, directly or through a make target. | mechanical | enforced | yes | pytest `tests/unit/test_make_quality.py` | `pr.yml:test` | yes |
 | `api.quality.mypy-v2` | Shared query models, FastAPI dependencies, v2 routes and services, the gzip negotiation, the user sign-in and account-deletion libraries, the country list and its startup check pass mypy with untyped definitions disallowed. | mechanical | enforced | yes | mypy | `pr.yml:quality-guards` | — |
+| `api.quality.pre-commit-hook` | make install turns on the git hooks in .githooks through core.hooksPath, a setting of the clone that every worktree shares and resolves against its own checkout, unless that would change an enclosing repository, replace another core.hooksPath, or stop the clone's own hooks (files or symbolic links), which .githooks/turn-on.sh says, always exiting 0. pre-commit runs make quality from the root of the working tree before git commit, and pre-merge-commit runs it before a merge commits without conflicts, with make's variables from the environment cleared. Because make quality checks the working tree, the hook stops the commit, naming the files or what to install, when the working tree holds unstaged changes to tracked files (case-only renames included), skip-worktree or assume-unchanged files, untracked files outside the ignore files, Python files or tool settings that only local or global excludes hide (outside virtual environments), or tracked Python files those excludes match; when make quality fails; when ruff's fixes changed a file; or when make, uv or the dev environment is missing. | mechanical | enforced | yes | pytest `tests/unit/test_pre_commit_hook.py` | `pr.yml:test` | yes |
 | `api.quality.ruff-format` | All Python files are formatted with ruff format. | mechanical | enforced | yes | ruff format | `pr.yml:quality-guards` | — |
 | `api.quality.ruff-lint` | All Python code passes ruff check with every ruff rule selected (ALL), with no ratchet, except the ignores in pyproject.toml: COM812 and ISC001, which conflict with ruff format, and D203 and D213, which conflict with the kept D211 and D212. | mechanical | enforced | yes | ruff check (ALL) | `pr.yml:quality-guards` | — |
 | `api.quality.runtime-evaluated-models-resolve` | Every package model is one ruff treats as runtime-evaluated (a base resolves, through the import in its own module, to a name in runtime-evaluated-base-classes, or is a same-module class that does), and every Pydantic model and SQLAlchemy mapper resolves its annotations once the package is imported. | mechanical | enforced | yes | pytest `tests/unit/test_runtime_evaluated_annotations.py` | `pr.yml:test` | **unproven** |
@@ -412,6 +413,8 @@ flowchart LR
   e_pytest_tests_unit_test_make_quality_py["pytest tests/unit/test_make_quality.py"]
   r_api_quality_mypy_v2("api.quality.mypy-v2 (enforced)")
   e_mypy["mypy"]
+  r_api_quality_pre_commit_hook("api.quality.pre-commit-hook (enforced)")
+  e_pytest_tests_unit_test_pre_commit_hook_py["pytest tests/unit/test_pre_commit_hook.py"]
   r_api_quality_ruff_format("api.quality.ruff-format (enforced)")
   e_ruff_format["ruff format"]
   r_api_quality_ruff_lint("api.quality.ruff-lint (enforced)")
@@ -421,8 +424,6 @@ flowchart LR
   r_api_quality_suppressions_explained("api.quality.suppressions-explained (ratcheted)")
   e_quality_guard_suppressions["quality guard suppressions"]
   j_CI_push_yml_quality_guards["CI push.yml:quality-guards"]
-  r_api_quality_tests_assert("api.quality.tests-assert (ratcheted)")
-  e_quality_guard_asserting_tests["quality guard asserting-tests"]
   r_api_quality_alembic_revisions_unused_imports -.-> gap_unenforced
   r_api_quality_ci_cd_scripts_ruff_exemptions --> e_ruff_per_file_ignore_of_N999__S310__S603__S607__T201__TID253_for__github___
   e_ruff_per_file_ignore_of_N999__S310__S603__S607__T201__TID253_for__github___ --> j_CI_pr_yml_quality_guards
@@ -442,6 +443,8 @@ flowchart LR
   e_pytest_tests_unit_test_make_quality_py --> j_CI_pr_yml_test
   r_api_quality_mypy_v2 --> e_mypy
   e_mypy --> j_CI_pr_yml_quality_guards
+  r_api_quality_pre_commit_hook --> e_pytest_tests_unit_test_pre_commit_hook_py
+  e_pytest_tests_unit_test_pre_commit_hook_py --> j_CI_pr_yml_test
   r_api_quality_ruff_format --> e_ruff_format
   e_ruff_format --> j_CI_pr_yml_quality_guards
   r_api_quality_ruff_lint --> e_ruff_check__ALL_
@@ -451,22 +454,25 @@ flowchart LR
   r_api_quality_suppressions_explained --> e_quality_guard_suppressions
   e_quality_guard_suppressions --> j_CI_pr_yml_quality_guards
   e_quality_guard_suppressions --> j_CI_push_yml_quality_guards
-  r_api_quality_tests_assert --> e_quality_guard_asserting_tests
-  e_quality_guard_asserting_tests --> j_CI_pr_yml_quality_guards
-  e_quality_guard_asserting_tests --> j_CI_push_yml_quality_guards
 ```
 
 ```mermaid
 flowchart LR
+  r_api_quality_tests_assert("api.quality.tests-assert (ratcheted)")
+  e_quality_guard_asserting_tests["quality guard asserting-tests"]
+  j_CI_pr_yml_quality_guards["CI pr.yml:quality-guards"]
+  j_CI_push_yml_quality_guards["CI push.yml:quality-guards"]
   r_api_quality_tests_pass("api.quality.tests-pass (enforced)")
   e_CI_job_test__check_test_shards["CI job test, check-test-shards"]
   j_CI_pr_yml_test["CI pr.yml:test"]
   j_CI_pr_yml_check_test_shards["CI pr.yml:check-test-shards"]
   r_api_quality_tests_ruff_exemptions("api.quality.tests-ruff-exemptions (enforced)")
   e_ruff_per_file_ignore_of_ANN__ARG001__ARG002__ARG005__D1__DTZ001__DTZ011__INP001__N802__PLC0415__PLR2004__S101__S105__S106__S603__S607__S608__SLF001__T201__TID253_for____tests___["ruff per-file ignore of ANN, ARG001, ARG002, ARG005, D1, DTZ001, DTZ011, INP001, N802, PLC0415, PLR2004, S101, S105, S106, S603, S607, S608, SLF001, T201, TID253 for **/tests/**"]
-  j_CI_pr_yml_quality_guards["CI pr.yml:quality-guards"]
   r_api_quality_unittest_ruff_exemptions("api.quality.unittest-ruff-exemptions (enforced)")
   e_ruff_per_file_ignore_of_PT_for_scripts_rules_tests___["ruff per-file ignore of PT for scripts/rules/tests/**"]
+  r_api_quality_tests_assert --> e_quality_guard_asserting_tests
+  e_quality_guard_asserting_tests --> j_CI_pr_yml_quality_guards
+  e_quality_guard_asserting_tests --> j_CI_push_yml_quality_guards
   r_api_quality_tests_pass --> e_CI_job_test__check_test_shards
   e_CI_job_test__check_test_shards --> j_CI_pr_yml_test
   e_CI_job_test__check_test_shards --> j_CI_pr_yml_check_test_shards
diff --git a/rules/fixtures/api.quality.pre-commit-hook/accepted/pre-commit b/rules/fixtures/api.quality.pre-commit-hook/accepted/pre-commit
new file mode 100755
index 000000000..941da3a59
--- /dev/null
+++ b/rules/fixtures/api.quality.pre-commit-hook/accepted/pre-commit
@@ -0,0 +1,12 @@
+#!/bin/sh
+# Proof fixture for api.quality.pre-commit-hook (accepted): the least a hook
+# must do. It stops the commit when uv or the dev environment is missing, when
+# the working tree holds unstaged changes or untracked files (make quality
+# would check them instead of what is committed), when make quality fails,
+# and when make quality changed a file.
+command -v uv >/dev/null 2>&1 || exit 1
+[ -d .venv ] || exit 1
+git diff --quiet || exit 1
+[ -z "$(git ls-files --others --exclude-standard)" ] || exit 1
+make quality || exit 1
+git diff --quiet || exit 1
diff --git a/rules/fixtures/api.quality.pre-commit-hook/rejected/pre-commit b/rules/fixtures/api.quality.pre-commit-hook/rejected/pre-commit
new file mode 100755
index 000000000..3130f3805
--- /dev/null
+++ b/rules/fixtures/api.quality.pre-commit-hook/rejected/pre-commit
@@ -0,0 +1,7 @@
+#!/bin/sh
+# Proof fixture for api.quality.pre-commit-hook (rejected): it runs make
+# quality but lets the commit through whether uv or the dev environment is
+# missing, the working tree holds unstaged changes or untracked files, the
+# checks fail, or ruff's fixes changed a file.
+make quality
+exit 0
diff --git a/rules/registry.toml b/rules/registry.toml
index f47a1d642..eb1cebae4 100644
--- a/rules/registry.toml
+++ b/rules/registry.toml
@@ -1195,6 +1195,64 @@ test = "tests/unit/services/test_microdata_weight_boundaries.py::test_rule_proof
 
 # --- Code quality and types ------------------------------------------------
 
+[[rule]]
+id = "api.quality.pre-commit-hook"
+category = "quality"
+statement = "make install turns on the git hooks in .githooks through core.hooksPath, a setting of the clone that every worktree shares and resolves against its own checkout, unless that would change an enclosing repository, replace another core.hooksPath, or stop the clone's own hooks (files or symbolic links), which .githooks/turn-on.sh says, always exiting 0. pre-commit runs make quality from the root of the working tree before git commit, and pre-merge-commit runs it before a merge commits without conflicts, with make's variables from the environment cleared. Because make quality checks the working tree, the hook stops the commit, naming the files or what to install, when the working tree holds unstaged changes to tracked files (case-only renames included), skip-worktree or assume-unchanged files, untracked files outside the ignore files, Python files or tool settings that only local or global excludes hide (outside virtual environments), or tracked Python files those excludes match; when make quality fails; when ruff's fixes changed a file; or when make, uv or the dev environment is missing."
+rationale = "docs/engineering/skills/github-prs.md#commit-hygiene"
+scope = [".githooks/pre-commit", ".githooks/pre-merge-commit", ".githooks/turn-on.sh", "Makefile"]
+tier = "mechanical"
+status = "enforced"
+autofix = false
+[rule.enforcer]
+kind = "pytest"
+nodes = [
+  "tests/unit/test_pre_commit_hook.py::test_the_repository_s_hook_stops_what_it_should",
+  "tests/unit/test_pre_commit_hook.py::test_a_commit_runs_make_quality",
+  "tests/unit/test_pre_commit_hook.py::test_a_failing_check_stops_the_commit",
+  "tests/unit/test_pre_commit_hook.py::test_fixes_that_need_staging_stop_the_commit_and_are_named",
+  "tests/unit/test_pre_commit_hook.py::test_fixes_from_an_earlier_failed_run_stop_the_next_commit",
+  "tests/unit/test_pre_commit_hook.py::test_unstaged_changes_stop_the_commit_and_are_named",
+  "tests/unit/test_pre_commit_hook.py::test_untracked_files_stop_the_commit_and_are_named",
+  "tests/unit/test_pre_commit_hook.py::test_commit_all_runs_make_quality",
+  "tests/unit/test_pre_commit_hook.py::test_a_merge_without_conflicts_runs_the_hook",
+  "tests/unit/test_pre_commit_hook.py::test_make_flags_from_the_environment_cant_hide_a_failure",
+  "tests/unit/test_pre_commit_hook.py::test_a_missing_uv_stops_the_commit_with_a_message",
+  "tests/unit/test_pre_commit_hook.py::test_a_missing_make_stops_the_commit_with_a_message",
+  "tests/unit/test_pre_commit_hook.py::test_a_missing_dev_environment_stops_the_commit_with_a_message",
+  "tests/unit/test_pre_commit_hook.py::test_the_dev_environment_can_be_where_uv_project_environment_says",
+  "tests/unit/test_pre_commit_hook.py::test_each_worktree_runs_its_own_checkout_s_hook",
+  "tests/unit/test_pre_commit_hook.py::test_make_install_turns_the_hook_on",
+  "tests/unit/test_pre_commit_hook.py::test_make_install_in_a_linked_worktree_turns_the_hook_on",
+  "tests/unit/test_pre_commit_hook.py::test_make_install_outside_a_git_repository_still_installs",
+  "tests/unit/test_pre_commit_hook.py::test_make_install_leaves_an_enclosing_repository_alone",
+  "tests/unit/test_pre_commit_hook.py::test_make_install_keeps_another_hooks_path",
+  "tests/unit/test_pre_commit_hook.py::test_make_install_keeps_the_clone_s_own_hooks_running",
+  "tests/unit/test_pre_commit_hook.py::test_python_files_hidden_by_local_excludes_stop_the_commit",
+  "tests/unit/test_pre_commit_hook.py::test_other_files_hidden_by_local_excludes_dont_stop_the_commit",
+  "tests/unit/test_pre_commit_hook.py::test_make_from_the_environment_cant_skip_the_checks",
+  "tests/unit/test_pre_commit_hook.py::test_files_git_doesnt_compare_stop_the_commit",
+  "tests/unit/test_pre_commit_hook.py::test_make_install_keeps_a_symlinked_hook_running",
+  "tests/unit/test_pre_commit_hook.py::test_make_install_keeps_a_symlinked_hooks_directory_running",
+  "tests/unit/test_pre_commit_hook.py::test_make_install_still_installs_when_git_config_is_locked",
+  "tests/unit/test_pre_commit_hook.py::test_a_commit_passes_in_a_utf8_locale",
+  "tests/unit/test_pre_commit_hook.py::test_tool_settings_hidden_by_local_excludes_stop_the_commit",
+  "tests/unit/test_pre_commit_hook.py::test_a_hidden_directory_of_python_files_stops_the_commit",
+  "tests/unit/test_pre_commit_hook.py::test_a_hidden_virtual_environment_doesnt_stop_the_commit",
+  "tests/unit/test_pre_commit_hook.py::test_tracked_python_files_local_excludes_match_stop_the_commit",
+  "tests/unit/test_pre_commit_hook.py::test_a_case_only_rename_stops_the_commit",
+  "tests/unit/test_pre_commit_hook.py::test_a_commit_of_some_paths_says_how_to_commit_the_rest",
+  "tests/unit/test_pre_commit_hook.py::test_the_hooks_are_executable_in_git",
+]
+[[rule.ci]]
+workflow = ".github/workflows/pr.yml"
+job = "test"
+invocation = "make test"
+[rule.proof]
+bad_fixture = "rules/fixtures/api.quality.pre-commit-hook/rejected"
+good_fixture = "rules/fixtures/api.quality.pre-commit-hook/accepted"
+test = "tests/unit/test_pre_commit_hook.py::test_rule_proof_pre_commit_hook"
+
 [[rule]]
 id = "api.quality.make-quality"
 category = "quality"
diff --git a/tests/unit/test_locked_test_environments.py b/tests/unit/test_locked_test_environments.py
index caad15489..80913def3 100644
--- a/tests/unit/test_locked_test_environments.py
+++ b/tests/unit/test_locked_test_environments.py
@@ -17,7 +17,11 @@
 
 import pytest
 
-from scripts.rules.locked_installs import executed_lines, makefile_recipes
+from scripts.rules.locked_installs import (
+    classify_command,
+    executed_lines,
+    makefile_recipes,
+)
 from scripts.rules.workflows import parse_jobs
 
 REPO = Path(__file__).resolve().parents[2]
@@ -113,7 +117,15 @@ def test_detects_every_known_test_job():
 
 
 def test_make_install_syncs_the_locked_development_environment():
-    assert makefile_recipes(REPO)["install"] == [LOCKED_SYNC]
+    recipe = makefile_recipes(REPO)["install"]
+
+    assert LOCKED_SYNC in recipe
+    # Its other commands, such as turning on the git hooks, install nothing.
+    assert [
+        command
+        for command in recipe
+        if command != LOCKED_SYNC and classify_command(command) is not None
+    ] == []
 
 
 @pytest.mark.parametrize("target", ["test", "test-env-vars", "debug-test"])
diff --git a/tests/unit/test_pre_commit_hook.py b/tests/unit/test_pre_commit_hook.py
new file mode 100644
index 000000000..6ef6a71e3
--- /dev/null
+++ b/tests/unit/test_pre_commit_hook.py
@@ -0,0 +1,766 @@
+"""A git pre-commit hook runs make quality (api.quality.pre-commit-hook).
+
+make install turns on the hooks in .githooks with git config core.hooksPath
+.githooks, a setting of the clone that every worktree shares and resolves
+against its own checkout. pre-commit runs make quality from the root of the
+working tree, and pre-merge-commit runs pre-commit for a merge that commits
+without conflicts. make quality checks the working tree, so the hook first
+requires it to hold exactly what is committed: no unstaged changes to tracked
+files and no untracked files outside .gitignore. The commit stops, saying
+why, when that isn't so, when a check fails, when ruff's fixes changed a
+file, or when make, uv or the worktree's dev environment is missing.
+
+These tests run the hooks in temporary repositories whose Makefile's quality
+target stands in for the real checks, with a PATH of only the tools they
+need, a stand-in uv, and no global or system git settings.
+"""
+
+from __future__ import annotations
+
+import os
+import shutil
+import subprocess
+from pathlib import Path
+
+import pytest
+
+REPO = Path(__file__).resolve().parents[2]
+HOOKS = REPO / ".githooks"
+FIXTURES = REPO / "rules" / "fixtures" / "api.quality.pre-commit-hook"
+# The tools the hooks, make install and these tests run, found through PATH.
+TOOLS = ("git", "make", "sh", "find", "env")
+# A stand-in for uv that records each call when UV_STUB_LOG is set.
+STUB_UV = (
+    '#!/bin/sh\nif [ -n "${UV_STUB_LOG:-}" ]; then\n'
+    '  printf \'%s\\n\' "$*" >> "$UV_STUB_LOG"\nfi\nexit 0\n'
+)
+PASSING_QUALITY = 'quality:\n\t@echo checked >> "$$QUALITY_MARKER"\n'
+FAILING_QUALITY = "quality:\n\t@echo 'mypy: 1 error'\n\t@exit 1\n"
+FIXING_QUALITY = "quality:\n\t@printf 'VALUE = 1\\n' > module.py\n"
+# The real Makefile's shape: quality runs quality-check through $(MAKE).
+RECURSIVE_FAILING_QUALITY = (
+    "quality:\n\t$(MAKE) quality-check\n\nquality-check:\n\t@exit 1\n"
+)
+# Fixes module.py, as ruff check --fix does, then fails, as mypy can after it.
+FIXING_THEN_FAILING_QUALITY = (
+    "quality:\n\t@printf 'VALUE = 1\\n' > module.py\n\t@echo 'mypy: 1 error'\n"
+    "\t@exit 1\n"
+)
+
+
+def _environment(tmp_path: Path, *, missing: tuple[str, ...] = ()) -> dict[str, str]:
+    """Return an environment whose PATH has only TOOLS and a stand-in uv.
+
+    Tools named in ``missing`` are left out. No git or make settings from the
+    run that started the test reach it.
+    """
+    tools = tmp_path / "tools"
+    tools.mkdir(exist_ok=True)
+    for tool in TOOLS:
+        found = shutil.which(tool)
+        if tool not in missing and found and not (tools / tool).exists():
+            (tools / tool).symlink_to(found)
+    if "uv" not in missing:
+        (tools / "uv").write_text(STUB_UV)
+        (tools / "uv").chmod(0o755)
+    environment = {
+        name: value
+        for name, value in os.environ.items()
+        if not name.startswith(("GIT_", "UV_"))
+        and name not in {"MAKEFLAGS", "MFLAGS", "GNUMAKEFLAGS", "MAKEFILES"}
+        and name != "MAKELEVEL"
+    }
+    environment.update(
+        {
+            "PATH": str(tools),
+            "HOME": str(tmp_path),
+            # git reads $XDG_CONFIG_HOME/git/ignore even without a global config.
+            "XDG_CONFIG_HOME": str(tmp_path / "config"),
+            "GIT_CONFIG_GLOBAL": os.devnull,
+            "GIT_CONFIG_NOSYSTEM": "1",
+            "GIT_AUTHOR_NAME": "test",
+            "GIT_AUTHOR_EMAIL": "test@example.com",
+            "GIT_COMMITTER_NAME": "test",
+            "GIT_COMMITTER_EMAIL": "test@example.com",
+            "QUALITY_MARKER": str(tmp_path / "quality-ran"),
+        }
+    )
+    return environment
+
+
+def _git(
+    cwd: Path, environment: dict[str, str], *arguments: str
+) -> subprocess.CompletedProcess[str]:
+    return subprocess.run(
+        ["git", "-c", "commit.gpgsign=false", *arguments],
+        cwd=cwd,
+        env=environment,
+        capture_output=True,
+        text=True,
+        check=False,
+    )
+
+
+def _make(
+    cwd: Path, environment: dict[str, str], target: str
+) -> subprocess.CompletedProcess[str]:
+    return subprocess.run(
+        ["make", target],
+        cwd=cwd,
+        env=environment,
+        capture_output=True,
+        text=True,
+        check=False,
+    )
+
+
+def _repository(
+    tmp_path: Path,
+    environment: dict[str, str],
+    quality_recipe: str,
+    hook: Path | None = None,
+    *,
+    dev_environment: bool = True,
+) -> Path:
+    """Create a repository with one commit whose commits run the hooks.
+
+    ``hook`` replaces .githooks/pre-commit with another file, such as a proof
+    fixture.
+    """
+    repository = tmp_path / "repository"
+    repository.mkdir(parents=True)
+    shutil.copytree(HOOKS, repository / ".githooks")
+    if hook is not None:
+        shutil.copy(hook, repository / ".githooks" / "pre-commit")
+        (repository / ".githooks" / "pre-commit").chmod(0o755)
+    (repository / "Makefile").write_text(quality_recipe)
+    (repository / "module.py").write_text("VALUE = 0\n")
+    (repository / "other.py").write_text("OTHER = 0\n")
+    (repository / ".gitignore").write_text(".venv/\n")
+    if dev_environment:
+        (repository / ".venv").mkdir()
+    _git(repository, environment, "init", "--quiet", "--initial-branch=master")
+    _git(repository, environment, "add", ".")
+    _git(repository, environment, "commit", "--quiet", "-m", "start")
+    _git(repository, environment, "config", "core.hooksPath", ".githooks")
+    return repository
+
+
+def _commit_a_change(
+    repository: Path, environment: dict[str, str]
+) -> subprocess.CompletedProcess[str]:
+    (repository / "module.py").write_text("VALUE = 2\n")
+    _git(repository, environment, "add", "module.py")
+    return _git(repository, environment, "commit", "-m", "change")
+
+
+def _commits(repository: Path, environment: dict[str, str]) -> int:
+    counted = _git(repository, environment, "rev-list", "--count", "HEAD")
+    return int(counted.stdout)
+
+
+def _ran(tmp_path: Path) -> int:
+    """Return how many times the stand-in quality target ran."""
+    marker = tmp_path / "quality-ran"
+    return len(marker.read_text().splitlines()) if marker.exists() else 0
+
+
+def hook_problems(hook: Path, tmp_path: Path) -> list[str]:
+    """Return how ``hook`` fails to stop a commit api.quality.pre-commit-hook stops."""
+    problems = []
+    for name, recipe, prepare, blocks in (
+        ("a failing check", FAILING_QUALITY, None, True),
+        ("ruff's fixes to a staged file", FIXING_QUALITY, None, True),
+        (
+            "an unstaged change make quality would check",
+            PASSING_QUALITY,
+            "unstaged",
+            True,
+        ),
+        ("a missing uv", PASSING_QUALITY, "no uv", True),
+        ("an untracked file", PASSING_QUALITY, "untracked", True),
+        ("a missing dev environment", PASSING_QUALITY, "no venv", True),
+        ("passing checks", PASSING_QUALITY, None, False),
+    ):
+        scenario = tmp_path / name.replace(" ", "-").replace("'", "")
+        scenario.mkdir(parents=True)
+        environment = _environment(
+            scenario, missing=("uv",) if prepare == "no uv" else ()
+        )
+        repository = _repository(
+            scenario, environment, recipe, hook, dev_environment=prepare != "no venv"
+        )
+        if prepare == "untracked":
+            (repository / "scratch.py").write_text("SCRATCH = 0\n")
+        if prepare == "unstaged":
+            (repository / "other.py").write_text("OTHER = 1\n")
+        result = _commit_a_change(repository, environment)
+        if blocks and result.returncode == 0:
+            problems.append(f"the hook lets a commit through after {name}")
+        if not blocks and result.returncode != 0:
+            problems.append(f"the hook stops a commit after {name}")
+    return problems
+
+
+def test_rule_proof_pre_commit_hook(tmp_path: Path):
+    rejected = hook_problems(FIXTURES / "rejected" / "pre-commit", tmp_path / "bad")
+    accepted = hook_problems(FIXTURES / "accepted" / "pre-commit", tmp_path / "good")
+
+    assert rejected == [
+        "the hook lets a commit through after a failing check",
+        "the hook lets a commit through after ruff's fixes to a staged file",
+        "the hook lets a commit through after an unstaged change make quality "
+        "would check",
+        "the hook lets a commit through after a missing uv",
+        "the hook lets a commit through after an untracked file",
+        "the hook lets a commit through after a missing dev environment",
+    ]
+    assert accepted == []
+
+
+def test_the_repository_s_hook_stops_what_it_should(tmp_path: Path):
+    assert hook_problems(HOOKS / "pre-commit", tmp_path) == []
+
+
+def test_a_commit_runs_make_quality(tmp_path: Path):
+    environment = _environment(tmp_path)
+    repository = _repository(tmp_path, environment, PASSING_QUALITY)
+
+    result = _commit_a_change(repository, environment)
+
+    assert result.returncode == 0, result.stderr
+    assert _ran(tmp_path) == 1
+    assert _commits(repository, environment) == 2
+
+
+def test_a_failing_check_stops_the_commit(tmp_path: Path):
+    environment = _environment(tmp_path)
+    repository = _repository(tmp_path, environment, FAILING_QUALITY)
+
+    result = _commit_a_change(repository, environment)
+
+    assert result.returncode != 0
+    assert "make quality failed" in result.stderr
+    assert _commits(repository, environment) == 1
+
+
+def test_fixes_that_need_staging_stop_the_commit_and_are_named(tmp_path: Path):
+    environment = _environment(tmp_path)
+    repository = _repository(tmp_path, environment, FIXING_QUALITY)
+
+    result = _commit_a_change(repository, environment)
+
+    assert result.returncode != 0
+    assert "module.py" in result.stderr
+    assert "stage" in result.stderr
+    assert _commits(repository, environment) == 1
+
+
+def test_fixes_from_an_earlier_failed_run_stop_the_next_commit(tmp_path: Path):
+    # The first commit fails after ruff fixed module.py in the working tree;
+    # the fix was never staged, so the next commit must not pass without it.
+    environment = _environment(tmp_path)
+    repository = _repository(tmp_path, environment, FIXING_THEN_FAILING_QUALITY)
+    first = _commit_a_change(repository, environment)
+    (repository / "Makefile").write_text(PASSING_QUALITY)
+    _git(repository, environment, "add", "Makefile")
+
+    second = _git(repository, environment, "commit", "-m", "change")
+
+    assert first.returncode != 0
+    assert second.returncode != 0
+    assert "module.py" in second.stderr
+    assert _commits(repository, environment) == 1
+
+
+def test_unstaged_changes_stop_the_commit_and_are_named(tmp_path: Path):
+    # make quality would check them, not what is committed. The name is shown
+    # as it is, not quoted as git quotes names outside ASCII.
+    environment = _environment(tmp_path)
+    repository = _repository(tmp_path, environment, PASSING_QUALITY)
+    (repository / "données.py").write_text("DATA = 0\n")
+    _git(repository, environment, "add", "données.py")
+    (repository / "données.py").write_text("DATA = 1\n")
+
+    result = _commit_a_change(repository, environment)
+
+    assert result.returncode != 0
+    assert "données.py" in result.stderr
+    assert "git stash push --keep-index" in result.stderr
+    assert _ran(tmp_path) == 0
+    assert _commits(repository, environment) == 1
+
+
+def test_untracked_files_stop_the_commit_and_are_named(tmp_path: Path):
+    environment = _environment(tmp_path)
+    repository = _repository(tmp_path, environment, PASSING_QUALITY)
+    (repository / "scratch_notes.py").write_text("import os\n")
+
+    result = _commit_a_change(repository, environment)
+
+    assert result.returncode != 0
+    assert "scratch_notes.py" in result.stderr
+    assert _ran(tmp_path) == 0
+    assert _commits(repository, environment) == 1
+
+
+def test_commit_all_runs_make_quality(tmp_path: Path):
+    # git commit -a stages every tracked change, so nothing is left unstaged.
+    environment = _environment(tmp_path)
+    repository = _repository(tmp_path, environment, PASSING_QUALITY)
+    (repository / "module.py").write_text("VALUE = 2\n")
+    (repository / "other.py").write_text("OTHER = 1\n")
+
+    result = _git(repository, environment, "commit", "-a", "-m", "change")
+
+    assert result.returncode == 0, result.stderr
+    assert _ran(tmp_path) == 1
+
+
+def test_a_merge_without_conflicts_runs_the_hook(tmp_path: Path):
+    environment = _environment(tmp_path)
+    repository = _repository(tmp_path, environment, PASSING_QUALITY)
+    _git(repository, environment, "checkout", "--quiet", "-b", "feature")
+    (repository / "other.py").write_text("OTHER = 1\n")
+    _git(repository, environment, "commit", "--quiet", "--no-verify", "-am", "feature")
+    _git(repository, environment, "checkout", "--quiet", "master")
+    (repository / "module.py").write_text("VALUE = 2\n")
+    _git(repository, environment, "commit", "--quiet", "--no-verify", "-am", "master")
+    (repository / "Makefile").write_text(FAILING_QUALITY)
+    _git(repository, environment, "commit", "--quiet", "--no-verify", "-am", "fail")
+
+    refused = _git(repository, environment, "merge", "--no-edit", "feature")
+    _git(repository, environment, "merge", "--abort")
+    (repository / "Makefile").write_text(PASSING_QUALITY)
+    _git(repository, environment, "commit", "--quiet", "--no-verify", "-am", "pass")
+    merged = _git(repository, environment, "merge", "--no-edit", "feature")
+
+    assert refused.returncode != 0
+    assert "make quality failed" in refused.stderr
+    assert merged.returncode == 0, merged.stderr
+    assert _ran(tmp_path) == 1
+
+
+def test_make_flags_from_the_environment_cant_hide_a_failure(tmp_path: Path):
+    environment = _environment(tmp_path)
+    environment["MAKEFLAGS"] = "i"
+    repository = _repository(tmp_path, environment, FAILING_QUALITY)
+
+    result = _commit_a_change(repository, environment)
+
+    assert result.returncode != 0
+    assert _commits(repository, environment) == 1
+
+
+def test_a_missing_uv_stops_the_commit_with_a_message(tmp_path: Path):
+    environment = _environment(tmp_path, missing=("uv",))
+    repository = _repository(tmp_path, environment, PASSING_QUALITY)
+
+    result = _commit_a_change(repository, environment)
+
+    assert result.returncode != 0
+    assert "uv isn't installed" in result.stderr
+    assert "make install" in result.stderr
+    assert _ran(tmp_path) == 0
+
+
+def test_a_missing_make_stops_the_commit_with_a_message(tmp_path: Path):
+    environment = _environment(tmp_path, missing=("make",))
+    repository = _repository(tmp_path, environment, PASSING_QUALITY)
+
+    result = _commit_a_change(repository, environment)
+
+    assert result.returncode != 0
+    assert "make isn't installed" in result.stderr
+
+
+def test_a_missing_dev_environment_stops_the_commit_with_a_message(tmp_path: Path):
+    environment = _environment(tmp_path)
+    repository = _repository(
+        tmp_path, environment, PASSING_QUALITY, dev_environment=False
+    )
+
+    result = _commit_a_change(repository, environment)
+
+    assert result.returncode != 0
+    assert "no dev environment" in result.stderr
+    assert "make install" in result.stderr
+    assert _ran(tmp_path) == 0
+
+
+def test_the_dev_environment_can_be_where_uv_project_environment_says(
+    tmp_path: Path,
+):
+    environment = _environment(tmp_path)
+    repository = _repository(
+        tmp_path, environment, PASSING_QUALITY, dev_environment=False
+    )
+    (tmp_path / "environments" / "api").mkdir(parents=True)
+    environment["UV_PROJECT_ENVIRONMENT"] = str(tmp_path / "environments" / "api")
+
+    result = _commit_a_change(repository, environment)
+
+    assert result.returncode == 0, result.stderr
+    assert _ran(tmp_path) == 1
+
+
+def test_each_worktree_runs_its_own_checkout_s_hook(tmp_path: Path):
+    environment = _environment(tmp_path)
+    repository = _repository(tmp_path, environment, PASSING_QUALITY)
+    worktree = tmp_path / "worktree"
+    _git(
+        repository,
+        environment,
+        "worktree",
+        "add",
+        "--quiet",
+        "-b",
+        "other",
+        str(worktree),
+    )
+    (worktree / ".venv").mkdir()
+    # The worktree's branch has a hook that stops every commit.
+    (worktree / ".githooks" / "pre-commit").write_text(
+        '#!/bin/sh\necho "the worktree\'s own hook ran" >&2\nexit 1\n'
+    )
+    _git(worktree, environment, "commit", "--quiet", "--no-verify", "-am", "hook")
+    (worktree / "module.py").write_text("VALUE = 3\n")
+    _git(worktree, environment, "add", "module.py")
+
+    in_worktree = _git(worktree, environment, "commit", "-m", "in the worktree")
+    in_clone = _commit_a_change(repository, environment)
+
+    assert in_worktree.returncode != 0
+    assert "the worktree's own hook ran" in in_worktree.stderr
+    assert in_clone.returncode == 0, in_clone.stderr
+    assert _ran(tmp_path) == 1
+
+
+def _source_tree(directory: Path) -> Path:
+    """Copy the files make install needs into ``directory``."""
+    directory.mkdir(parents=True)
+    shutil.copy(REPO / "Makefile", directory / "Makefile")
+    shutil.copytree(HOOKS, directory / ".githooks")
+    return directory
+
+
+def test_make_install_turns_the_hook_on(tmp_path: Path):
+    environment = _environment(tmp_path)
+    repository = _source_tree(tmp_path / "repository")
+    _git(repository, environment, "init", "--quiet")
+
+    installed = _make(repository, environment, "install")
+
+    assert installed.returncode == 0, installed.stderr
+    hooks_path = _git(repository, environment, "config", "core.hooksPath")
+    assert hooks_path.stdout.strip() == ".githooks"
+
+
+def test_make_install_in_a_linked_worktree_turns_the_hook_on(tmp_path: Path):
+    environment = _environment(tmp_path)
+    repository = _source_tree(tmp_path / "repository")
+    _git(repository, environment, "init", "--quiet", "--initial-branch=master")
+    _git(repository, environment, "add", ".")
+    _git(repository, environment, "commit", "--quiet", "--no-verify", "-m", "start")
+    worktree = tmp_path / "worktree"
+    _git(
+        repository,
+        environment,
+        "worktree",
+        "add",
+        "--quiet",
+        "-b",
+        "other",
+        str(worktree),
+    )
+
+    installed = _make(worktree, environment, "install")
+
+    assert installed.returncode == 0, installed.stderr
+    hooks_path = _git(repository, environment, "config", "core.hooksPath")
+    assert hooks_path.stdout.strip() == ".githooks"
+
+
+def test_make_install_outside_a_git_repository_still_installs(tmp_path: Path):
+    # A Docker build or a source archive has no repository to configure.
+    environment = _environment(tmp_path)
+    environment["GIT_CEILING_DIRECTORIES"] = str(tmp_path)
+    environment["UV_STUB_LOG"] = str(tmp_path / "uv-calls")
+    directory = _source_tree(tmp_path / "source")
+
+    installed = _make(directory, environment, "install")
+
+    assert installed.returncode == 0, installed.stderr
+    assert (tmp_path / "uv-calls").read_text() == "sync --frozen --extra dev\n"
+
+
+def test_make_install_leaves_an_enclosing_repository_alone(tmp_path: Path):
+    # A source archive unpacked inside another repository: that repository's
+    # settings and hooks aren't make install's to change.
+    environment = _environment(tmp_path)
+    environment["UV_STUB_LOG"] = str(tmp_path / "uv-calls")
+    enclosing = tmp_path / "enclosing"
+    enclosing.mkdir()
+    _git(enclosing, environment, "init", "--quiet")
+    directory = _source_tree(enclosing / "vendor" / "policyengine-api")
+
+    installed = _make(directory, environment, "install")
+
+    assert installed.returncode == 0, installed.stderr
+    assert "isn't the root of a git working tree" in installed.stderr
+    hooks_path = _git(enclosing, environment, "config", "core.hooksPath")
+    assert hooks_path.stdout == ""
+    assert (tmp_path / "uv-calls").read_text() == "sync --frozen --extra dev\n"
+
+
+def test_make_install_keeps_another_hooks_path(tmp_path: Path):
+    environment = _environment(tmp_path)
+    repository = _source_tree(tmp_path / "repository")
+    _git(repository, environment, "init", "--quiet")
+    _git(repository, environment, "config", "core.hooksPath", "/team/hooks")
+
+    installed = _make(repository, environment, "install")
+
+    assert installed.returncode == 0, installed.stderr
+    assert "core.hooksPath is already /team/hooks" in installed.stderr
+    hooks_path = _git(repository, environment, "config", "core.hooksPath")
+    assert hooks_path.stdout.strip() == "/team/hooks"
+
+
+def test_make_install_keeps_the_clone_s_own_hooks_running(tmp_path: Path):
+    # core.hooksPath would stop git running the hooks in .git/hooks.
+    environment = _environment(tmp_path)
+    repository = _source_tree(tmp_path / "repository")
+    _git(repository, environment, "init", "--quiet")
+    own_hook = repository / ".git" / "hooks" / "pre-push"
+    own_hook.write_text("#!/bin/sh\nexit 0\n")
+    own_hook.chmod(0o755)
+
+    installed = _make(repository, environment, "install")
+
+    assert installed.returncode == 0, installed.stderr
+    assert "pre-push" in installed.stderr
+    hooks_path = _git(repository, environment, "config", "core.hooksPath")
+    assert hooks_path.stdout == ""
+
+
+def test_python_files_hidden_by_local_excludes_stop_the_commit(tmp_path: Path):
+    # mypy and Import Linter read every Python file on disk, whatever git
+    # ignores outside the repository's .gitignore files.
+    environment = _environment(tmp_path)
+    repository = _repository(tmp_path, environment, PASSING_QUALITY)
+    (repository / "helper.py").write_text("HELPER = 0\n")
+    (repository / ".git" / "info" / "exclude").write_text("helper.py\n")
+
+    result = _commit_a_change(repository, environment)
+
+    assert result.returncode != 0
+    assert "helper.py" in result.stderr
+    assert _ran(tmp_path) == 0
+
+
+def test_other_files_hidden_by_local_excludes_dont_stop_the_commit(tmp_path: Path):
+    environment = _environment(tmp_path)
+    repository = _repository(tmp_path, environment, PASSING_QUALITY)
+    (repository / "notes.txt").write_text("notes\n")
+    (repository / ".git" / "info" / "exclude").write_text("notes.txt\n")
+
+    result = _commit_a_change(repository, environment)
+
+    assert result.returncode == 0, result.stderr
+    assert _ran(tmp_path) == 1
+
+
+@pytest.mark.parametrize("variable", ["MAKE", "MAKE_COMMAND"])
+def test_make_from_the_environment_cant_skip_the_checks(variable, tmp_path: Path):
+    # make takes $(MAKE) from the environment, so `true` would skip
+    # quality-check.
+    environment = _environment(tmp_path)
+    # An absolute path: the test's PATH has no true.
+    environment[variable] = shutil.which("true") or "/usr/bin/true"
+    repository = _repository(tmp_path, environment, RECURSIVE_FAILING_QUALITY)
+
+    result = _commit_a_change(repository, environment)
+
+    assert result.returncode != 0
+    assert _commits(repository, environment) == 1
+
+
+@pytest.mark.parametrize("flag", ["--skip-worktree", "--assume-unchanged"])
+def test_files_git_doesnt_compare_stop_the_commit(flag, tmp_path: Path):
+    # git diff doesn't compare them with the commit, so make quality could
+    # check a copy the commit doesn't hold.
+    environment = _environment(tmp_path)
+    repository = _repository(tmp_path, environment, PASSING_QUALITY)
+    _git(repository, environment, "update-index", flag, "other.py")
+    (repository / "other.py").write_text("OTHER = 1\n")
+
+    result = _commit_a_change(repository, environment)
+
+    assert result.returncode != 0
+    assert "other.py" in result.stderr
+    assert _ran(tmp_path) == 0
+
+
+def test_make_install_keeps_a_symlinked_hook_running(tmp_path: Path):
+    environment = _environment(tmp_path)
+    repository = _source_tree(tmp_path / "repository")
+    _git(repository, environment, "init", "--quiet")
+    script = tmp_path / "team-pre-push"
+    script.write_text("#!/bin/sh\nexit 0\n")
+    script.chmod(0o755)
+    (repository / ".git" / "hooks" / "pre-push").symlink_to(script)
+
+    installed = _make(repository, environment, "install")
+
+    assert installed.returncode == 0, installed.stderr
+    assert "pre-push" in installed.stderr
+    hooks_path = _git(repository, environment, "config", "core.hooksPath")
+    assert hooks_path.stdout == ""
+
+
+def test_make_install_keeps_a_symlinked_hooks_directory_running(tmp_path: Path):
+    environment = _environment(tmp_path)
+    repository = _source_tree(tmp_path / "repository")
+    _git(repository, environment, "init", "--quiet")
+    team_hooks = tmp_path / "team-hooks"
+    team_hooks.mkdir()
+    (team_hooks / "pre-push").write_text("#!/bin/sh\nexit 0\n")
+    (team_hooks / "pre-push").chmod(0o755)
+    shutil.rmtree(repository / ".git" / "hooks")
+    (repository / ".git" / "hooks").symlink_to(team_hooks)
+
+    installed = _make(repository, environment, "install")
+
+    assert installed.returncode == 0, installed.stderr
+    assert "pre-push" in installed.stderr
+    hooks_path = _git(repository, environment, "config", "core.hooksPath")
+    assert hooks_path.stdout == ""
+
+
+def test_make_install_still_installs_when_git_config_is_locked(tmp_path: Path):
+    # Another git command, or make install in another worktree of the clone,
+    # can hold .git/config's lock.
+    environment = _environment(tmp_path)
+    environment["UV_STUB_LOG"] = str(tmp_path / "uv-calls")
+    repository = _source_tree(tmp_path / "repository")
+    _git(repository, environment, "init", "--quiet")
+    (repository / ".git" / "config.lock").write_text("")
+
+    installed = _make(repository, environment, "install")
+
+    assert installed.returncode == 0, installed.stderr
+    assert "core.hooksPath" in installed.stderr
+    assert (tmp_path / "uv-calls").read_text() == "sync --frozen --extra dev\n"
+
+
+def test_a_commit_passes_in_a_utf8_locale(tmp_path: Path):
+    # bash 3.2, macOS's /bin/sh, matches uppercase letters with [a-z] in
+    # UTF-8 locales, and git ls-files -v marks every ordinary file H.
+    environment = _environment(tmp_path)
+    environment["LANG"] = environment["LC_ALL"] = "en_US.UTF-8"
+    repository = _repository(tmp_path, environment, PASSING_QUALITY)
+
+    result = _commit_a_change(repository, environment)
+
+    assert result.returncode == 0, result.stderr
+    assert _ran(tmp_path) == 1
+
+
+@pytest.mark.parametrize("name", ["ruff.toml", "mypy.ini", "lib/pyproject.toml"])
+def test_tool_settings_hidden_by_local_excludes_stop_the_commit(name, tmp_path: Path):
+    # ruff and mypy read their settings from these files before
+    # pyproject.toml, whatever git ignores.
+    environment = _environment(tmp_path)
+    repository = _repository(tmp_path, environment, PASSING_QUALITY)
+    settings = repository / name
+    settings.parent.mkdir(parents=True, exist_ok=True)
+    settings.write_text("")
+    (repository / ".git" / "info" / "exclude").write_text(f"{name}\n")
+
+    result = _commit_a_change(repository, environment)
+
+    assert result.returncode != 0
+    assert name.split("/")[0] in result.stderr
+    assert _ran(tmp_path) == 0
+
+
+def test_a_hidden_directory_of_python_files_stops_the_commit(tmp_path: Path):
+    environment = _environment(tmp_path)
+    repository = _repository(tmp_path, environment, PASSING_QUALITY)
+    (repository / "lib").mkdir()
+    (repository / "lib" / "helper.py").write_text("HELPER = 0\n")
+    (repository / ".git" / "info" / "exclude").write_text("lib/\n")
+
+    result = _commit_a_change(repository, environment)
+
+    assert result.returncode != 0
+    assert "lib/" in result.stderr
+
+
+def test_a_hidden_virtual_environment_doesnt_stop_the_commit(tmp_path: Path):
+    # No check reads a virtual environment's files.
+    environment = _environment(tmp_path)
+    repository = _repository(tmp_path, environment, PASSING_QUALITY)
+    (repository / "venv" / "lib").mkdir(parents=True)
+    (repository / "venv" / "pyvenv.cfg").write_text("home = /usr/bin\n")
+    (repository / "venv" / "lib" / "site.py").write_text("SITE = 0\n")
+    (repository / ".git" / "info" / "exclude").write_text("venv/\n")
+
+    result = _commit_a_change(repository, environment)
+
+    assert result.returncode == 0, result.stderr
+    assert _ran(tmp_path) == 1
+
+
+def test_tracked_python_files_local_excludes_match_stop_the_commit(tmp_path: Path):
+    # ruff skips files .git/info/exclude matches, even tracked ones, which
+    # CI checks.
+    environment = _environment(tmp_path)
+    repository = _repository(tmp_path, environment, PASSING_QUALITY)
+    (repository / ".git" / "info" / "exclude").write_text("other.py\n")
+
+    result = _commit_a_change(repository, environment)
+
+    assert result.returncode != 0
+    assert "other.py" in result.stderr
+    assert "ruff" in result.stderr
+    assert _ran(tmp_path) == 0
+
+
+def test_a_case_only_rename_stops_the_commit(tmp_path: Path):
+    # On a file system that ignores case, git status shows nothing, but the
+    # checks would read Module.py while the commit holds module.py.
+    environment = _environment(tmp_path)
+    repository = _repository(tmp_path, environment, PASSING_QUALITY)
+    (repository / "other.py").rename(repository / "Other.py")
+
+    result = _commit_a_change(repository, environment)
+
+    assert result.returncode != 0
+    assert "Other.py" in result.stderr or "other.py" in result.stderr
+    assert _ran(tmp_path) == 0
+
+
+def test_a_commit_of_some_paths_says_how_to_commit_the_rest(tmp_path: Path):
+    environment = _environment(tmp_path)
+    repository = _repository(tmp_path, environment, PASSING_QUALITY)
+    (repository / "other.py").write_text("OTHER = 1\n")
+    _git(repository, environment, "add", "other.py")
+    (repository / "module.py").write_text("VALUE = 2\n")
+
+    result = _git(repository, environment, "commit", "-m", "module", "module.py")
+
+    assert result.returncode != 0
+    assert "without paths" in result.stderr
+
+
+def test_the_hooks_are_executable_in_git(tmp_path: Path):
+    environment = _environment(tmp_path)
+    listed = _git(
+        REPO, environment, "ls-files", "--stage", "--", ".githooks/"
+    ).stdout.splitlines()
+    modes = {entry.split("\t")[1]: entry.split()[0] for entry in listed}
+
+    assert modes[".githooks/pre-commit"] == "100755"
+    assert modes[".githooks/pre-merge-commit"] == "100755"