Share One Registration-Check Skeleton Between the Installer's PreToolUse and SessionEnd Hooks #3519

registration_problems in host-setup/agent-safety/claude/install.py checks each hook's registration in settings.json with the same skeleton, written twice:

• check_pre_tool_hook, shared by gh-write-guard and model-tier-guard since Share One Registration Helper Between the Agent-Safety Installer's Hooks #3518
• the SessionEnd loop for the stray-process sweep

The skeleton walks the event's groups and picks out the entries that name the hook with names_hook. It reports an entry that does not run the deployed file with runs_hook and type command. It counts named entries apart from sound ones, and it closes with the "not registered" and "registered N times" lines.

The fixes in this function keep landing on the skeleton, and each one has had to be made in every copy:

• Harden the Unbounded-Wait Guard: Delete the Machinery Its Escapes Kept Outrunning #1632 introduced the named-vs-registered count, so a defective entry no longer adds a false "not registered" line, and wrote it into both the guard and sweep loops.
• Judge the Installer's Hook Ownership by File Name, Not Substring #1954 moved hook ownership to names_hook in both loops, and in both registration blocks in main.
• Map Model Tiers in One Config and Refuse an Unrequested Highest-Tier Dispatch #3516 added the model tier guard by copying the loop a third time, which Share One Registration Helper Between the Agent-Safety Installer's Hooks #3518 then folded back.

The parts that differ by event have needed no matching change elsewhere:

• PreToolUse requires the group's matcher to see each tool, and a blind matcher excludes the entry from the count.
• SessionEnd requires a timeout of at least SWEEP_TIMEOUT_SECONDS, which excludes the entry. Its matcher note does not exclude, since a narrowed matcher still fires on some exit reasons and so still counts toward the duplicate line.

Proposal

Pull the skeleton into one helper that takes the event's groups, the hook name, the wording for its messages, and a per-entry judgment from the caller. The judgment decides whether a sound entry counts as registered and reports its own event-specific notes. check_pre_tool_hook becomes a caller passing the matcher-sees-tools judgment. The SessionEnd loop becomes a caller passing the timeout and matcher-shape judgment.

Constraints

• Every reported message, its order, and its report (deduplicated) or out.append choice stay byte-identical, as Share One Registration Helper Between the Agent-Safety Installer's Hooks #3518 kept them.
• The SessionEnd matcher note keeps counting the entry as registered. Making it exclude would hide a real duplicate.
• The strip-then-register side in main already shares register_hook and is out of scope.