Enforcement catches · DeepSeek

One catch per distinct rule. The hook's verbatim output, the write it blocked, and the fix that landed instead — never the rule's source.