Session Bash audit

Measures how Claude Code sessions actually use the Bash tool, against whatever Bash rules the always-loaded instructions file states, and turns the numbers into a decision about where a fix belongs. The first run (2026-08-24, 3,956 calls over four days) is written up in references/research.md — read its "Root causes" and "Mode comparison" sections before interpreting a new run; most of the reasoning transfers and doesn't need re-deriving.

Reads ~/.claude/ — the transcript store at ~/.claude/projects/*.jsonl and, for the permission replay, ~/.claude/settings.json. Both are Claude Code's own, read-only and never written, so this works on any machine running Claude Code and needs nothing installed. On any other harness there is nothing to read and the script says so rather than reporting zeros. The measured numbers and baselines shipped here are one author's machine under one set of rules — treat them as a reference point to compare against, not as your own baseline; save your own on the first run.