diff --git a/hooks/error-spike-detector.sh b/hooks/error-spike-detector.sh
new file mode 100755
index 0000000..adc2d04
--- /dev/null
+++ b/hooks/error-spike-detector.sh
@@ -0,0 +1,86 @@
+#!/bin/sh
+# error-spike-detector.sh — PostToolUse:* hook (RULE 0.14).
+#
+# Maintains a rolling 20-tool-call window of (timestamp, error_flag) pairs.
+# When ≥3 errors land in the window, append to audit-backlog.md. NEVER
+# blocks: every exit path is `exit 0`. Silent-first: stderr advisory only
+# fires after 10 sessions are in the memory store.
+
+command -v jq >/dev/null 2>&1 || exit 0
+
+set -eu
+
+input="$(cat)"
+
+is_err=$(printf '%s' "$input" | jq -r '.tool_response.is_error // empty' 2>/dev/null || true)
+msg=$(printf '%s' "$input" | jq -r '.tool_response.content // .tool_response // empty' 2>/dev/null || true)
+
+# Classify current call as errored if explicit is_error=true OR message
+# matches a common failure signature. Empty tool_response → treat as OK.
+flag=0
+case "$is_err" in
+    true|True|TRUE|1) flag=1 ;;
+esac
+if [ "$flag" -eq 0 ] && [ -n "$msg" ]; then
+    case "$(printf '%s' "$msg" | tr 'A-Z' 'a-z')" in
+        *error:*|*failed*|*panic*|*denied*) flag=1 ;;
+    esac
+fi
+
+window="${HOME}/.claude/memory/error-window.txt"
+backlog="${HOME}/.claude/memory/audit-backlog.md"
+mkdir -p "$(dirname "$window")" 2>/dev/null || exit 0
+
+# Append this tool call to the rolling window.
+ts=$(date +%s)
+printf '%s %s\n' "$ts" "$flag" >> "$window"
+
+# Trim to last 20 lines.
+tmp="${window}.tmp.$$"
+tail -n 20 "$window" > "$tmp" 2>/dev/null || true
+mv -f "$tmp" "$window" 2>/dev/null || true
+
+# Count errors in the window.
+err_ct=$(awk '$2==1' "$window" 2>/dev/null | wc -l | tr -d ' ')
+err_ct=${err_ct:-0}
+
+if [ "$err_ct" -lt 3 ]; then
+    exit 0
+fi
+
+# Classify the spike by greping the recent error messages. Best-effort.
+pattern="unclassified"
+if [ -n "$msg" ]; then
+    case "$(printf '%s' "$msg" | tr 'A-Z' 'a-z')" in
+        *permission*denied*) pattern="permission_denied" ;;
+        *worktree*)          pattern="worktree_error" ;;
+        *cargo*workspace*)   pattern="cargo_workspace" ;;
+        *panic*)             pattern="panic" ;;
+        *timeout*)           pattern="timeout" ;;
+    esac
+fi
+
+# Ensure the backlog file exists.
+if [ ! -f "$backlog" ]; then
+    {
+        printf '# Audit Backlog\n\n'
+        printf '<!-- session_count: 0 -->\n\n'
+    } > "$backlog"
+fi
+
+iso=$(date -u +%Y-%m-%dT%H:%M)
+printf -- '- [ERROR-SPIKE %s] %s errors in last 20 tool calls. Pattern: %s\n' \
+    "$iso" "$err_ct" "$pattern" >> "$backlog"
+
+# Reset window so we do not re-fire on every subsequent call.
+: > "$window"
+
+# Silent-first: advisory stderr only after 10 sessions.
+session_count=$(grep -Eo 'session_count: [0-9]+' "$backlog" 2>/dev/null | head -1 | awk '{print $2}')
+session_count=${session_count:-0}
+if [ "$session_count" -ge 10 ]; then
+    printf 'kei-memory: error spike detected (%s in 20) — see %s\n' \
+        "$err_ct" "$backlog" >&2
+fi
+
+exit 0
diff --git a/hooks/milestone-commit-hook.sh b/hooks/milestone-commit-hook.sh
new file mode 100755
index 0000000..96e57b9
--- /dev/null
+++ b/hooks/milestone-commit-hook.sh
@@ -0,0 +1,59 @@
+#!/bin/sh
+# milestone-commit-hook.sh — PostToolUse:Bash hook (RULE 0.14).
+#
+# On `git commit -m "feat..."` / `refactor:` / `git merge`: call
+# `kei-memory analyze --last 1 --summary` and append to audit-backlog.md.
+# NEVER blocks: every exit path is `exit 0`. Silent-first: prompts only
+# activate after 10 sessions are in the memory store.
+
+command -v jq >/dev/null 2>&1 || exit 0
+
+set -eu
+
+input="$(cat)"
+
+cmd=$(printf '%s' "$input" | jq -r '.tool_input.command // empty' 2>/dev/null || true)
+[ -z "$cmd" ] && exit 0
+
+# Detect milestone commits — feat: / refactor: / merge commits. Case-sensitive
+# on the conventional-commit prefix so we don't false-fire on "feature-" docs.
+case "$cmd" in
+    *"git commit"*"-m"*"\"feat"[:\ ]*|\
+    *"git commit"*"-m"*"\"refactor"[:\ ]*|\
+    *"git merge"*)
+        ;;
+    *)
+        exit 0
+        ;;
+esac
+
+backlog="${HOME}/.claude/memory/audit-backlog.md"
+mkdir -p "$(dirname "$backlog")" 2>/dev/null || exit 0
+
+# Ensure the header + session_count counter exist.
+if [ ! -f "$backlog" ]; then
+    {
+        printf '# Audit Backlog\n\n'
+        printf '<!-- session_count: 0 -->\n\n'
+    } > "$backlog"
+fi
+
+# Read current session_count (silent-first threshold).
+session_count=$(grep -Eo 'session_count: [0-9]+' "$backlog" 2>/dev/null | head -1 | awk '{print $2}')
+session_count=${session_count:-0}
+
+# Append the summary line if kei-memory is present.
+ts=$(date -u +%Y-%m-%dT%H:%M)
+if command -v kei-memory >/dev/null 2>&1; then
+    summary=$(kei-memory analyze --last 1 --summary 2>/dev/null || true)
+    if [ -n "$summary" ]; then
+        printf -- '- [MILESTONE %s] %s' "$ts" "$summary" >> "$backlog"
+    fi
+fi
+
+# Advisory stderr reminder only after silent-first threshold.
+if [ "$session_count" -ge 10 ]; then
+    printf 'kei-memory: audit backlog has unreviewed items (%s)\n' "$backlog" >&2
+fi
+
+exit 0
diff --git a/hooks/session-end-dump.sh b/hooks/session-end-dump.sh
new file mode 100755
index 0000000..7483f66
--- /dev/null
+++ b/hooks/session-end-dump.sh
@@ -0,0 +1,44 @@
+#!/bin/sh
+# session-end-dump.sh — Stop event hook (RULE 0.14).
+#
+# On session end: save the transcript JSONL to ~/.claude/memory/traces/
+# and call `kei-memory ingest` if the primitive is installed. NEVER blocks:
+# every exit path is `exit 0`. No jq → silent no-op. No kei-memory → still
+# saves the raw trace so later installs can back-fill.
+
+command -v jq >/dev/null 2>&1 || exit 0
+
+set -eu
+
+input="$(cat)"
+
+session_id=$(printf '%s' "$input" | jq -r '.session_id // empty' 2>/dev/null || true)
+transcript=$(printf '%s' "$input" | jq -r '.transcript_path // .transcript // empty' 2>/dev/null || true)
+
+# Nothing to dump without an id — silent no-op.
+if [ -z "$session_id" ]; then
+    exit 0
+fi
+
+# Destination dir for trace archives (created lazily).
+traces_dir="${HOME}/.claude/memory/traces"
+mkdir -p "$traces_dir" 2>/dev/null || exit 0
+
+dest="${traces_dir}/${session_id}.jsonl"
+
+# If Claude Code provides a transcript path, copy the JSONL to our store.
+# If transcript is missing, leave dest un-created — analyzer falls back to
+# no-op for that session and logs a zero-event row on next ingest.
+if [ -n "$transcript" ] && [ -f "$transcript" ]; then
+    cp -f "$transcript" "$dest" 2>/dev/null || true
+fi
+
+# Best-effort ingest — advisory only; never blocks the session from ending.
+if command -v kei-memory >/dev/null 2>&1 && [ -f "$dest" ]; then
+    kei-memory ingest \
+        --session-id "$session_id" \
+        --transcript "$dest" \
+        >/dev/null 2>&1 || true
+fi
+
+exit 0