The private-banlist guard in .githooks/pre-commit reads every staged blob raw under LC_ALL=C, so a private name written with JSON string escapes passes it: a \uXXXX spelling of any letter, non-ASCII or plain ASCII, or a \/ inside a pattern, puts bytes in the blob that no ERE written for the plain spelling matches, and a JSON transcript, export or fixture is the natural carrier. The store-before-commit redactors and the lint rules read the scanner's decoded views (lineViews: the percent view and the JSON escape layers); the hook, the one enforcement point of the private layer, reads only the text as written. Detector: a keyed banlist entry for a fake name refuses a staged JSON file that spells the name with \u escapes or percent-encoding, exactly as it refuses the plain spelling.

The private-banlist guard in .githooks/pre-commit reads every staged blob raw under LC_ALL=C, so a private name written with JSON string escapes passes it: a \uXXXX spelling of any letter, non-ASCII or plain ASCII, or a \/ inside a pattern, puts bytes in the blob that no ERE written for the plain spelling matches, and a JSON transcript, export or fixture is the natural carrier. The store-before-commit redactors and the lint rules read the scanner's decoded views (lineViews: the percent view and the JSON escape layers); the hook, the one enforcement point of the private layer, reads only the text as written. Detector: a keyed banlist entry for a fake name refuses a staged JSON file that spells the name with \u escapes or percent-encoding, exactly as it refuses the plain spelling.

Grounds

• pursued: a keyed entry for a fake name refuses a staged file spelling it with unicode escapes, a nested escape layer, an escaped solidus or percent-encoding, exactly as it refuses the plain spelling, while escapes that spell no banned name pass; a staged escaped spelling of a banned name that commits cleanly would show it wrong