fix(hooks): strict empty-stdout assert; qualify updatedInput in spike

Round-3 fixer pass on fix/auq-hook-neutral-passthrough.

M1 — empty-stdin crash-safety case now asserts res.stdout directly
(no ?? '' / || '' mask). Matches expectNoDecision, garrytan#1924 original, and
every other empty-stdout assertion in-repo.

Sh1 — spike Answer + updatedInput semantics keep the platform fact but
qualify that plan-tune lives on deny+reason (Implementation examples),
so the headline no longer contradicts the live-hook section.

Co-authored-by: dpnascimento <dpnascimento@users.noreply.github.com>
Co-authored-by: jacksondc <jacksondc@users.noreply.github.com>

Author: 3 people

docs/spikes/claude-code-hook-mutation.md

@@ -13,8 +13,9 @@ answer via `updatedInput`? If yes, what's the exact protocol?
 
 ## Answer
 
-**Yes.** `updatedInput` is the supported mechanism. Source:
-https://code.claude.com/docs/en/hooks (confirmed 2026-04 reference).
+**Yes.** `updatedInput` is the supported mechanism (platform capability;
+this plan-tune hook does not take that path — see Implementation examples).
+Source: https://code.claude.com/docs/en/hooks (confirmed 2026-04 reference).
 
 ## Hook stdin schema (PreToolUse + PostToolUse)
 
@@ -60,8 +61,9 @@ the pass-through path that lets the permission flow continue unchanged.
 
 **`updatedInput` semantics:** shallow merge of fields present in the returned
 object onto the original `tool_input`. Only valid with
-`permissionDecision: "allow"`. This is what lets us substitute an
-auto-decided answer for `never-ask` preferences.
+`permissionDecision: "allow"`. This is what would let a hook substitute an
+auto-decided answer for `never-ask` preferences; the live plan-tune hook
+instead uses `deny` + reason (see Implementation examples).
 
 ## Matcher schema
 

test/question-preference-hook.test.ts

@@ -174,7 +174,7 @@ describe('passes through (no enforcement)', () => {
     const res = spawnSync(HOOK, [], { env, input: '', encoding: 'utf-8' });
     expect(res.status).toBe(0);
     // Crash-safety pass-through: empty stdout only (no permissionDecision).
-    expect(res.stdout ?? '').toBe('');
+    expect(res.stdout).toBe('');
   });
 
   test('non-AUQ tool_name → no decision (defensive)', () => {