diff --git a/tests/oracle/golden/hook-audit-log.json b/tests/oracle/golden/hook-audit-log.json
index eda8cce17..963285671 100644
--- a/tests/oracle/golden/hook-audit-log.json
+++ b/tests/oracle/golden/hook-audit-log.json
@@ -4,7 +4,7 @@
   "exit": 0,
   "signal": null,
   "files": {
-    ".impeccable/audit.ndjson": "{\"ts\":\"<ISO>\",\"event\":\"PostToolUse\",\"harness\":\"claude\",\"cwd\":\"<WS>\",\"session\":\"s1\",\"tool\":\"Edit\",\"file\":\"<WS>/src/components/Card.module.css\",\"ext\":\".css\",\"editCount\":1,\"findings\":2,\"freshFindings\":1,\"deferred\":1,\"emitted\":true,\"freshFiles\":1,\"chars\":1250,\"durationMs\": <MS>}\n",
+    ".impeccable/audit.ndjson": "{\"ts\":\"<ISO>\",\"event\":\"PostToolUse\",\"harness\":\"claude\",\"cwd\":\"<WS>\",\"session\":\"s1\",\"tool\":\"Edit\",\"file\":\"<WS>/src/components/Card.module.css\",\"ext\":\".css\",\"editCount\":1,\"findings\":2,\"freshFindings\":1,\"deferred\":1,\"emitted\":true,\"freshFiles\":1,\"chars\": <N>,\"durationMs\": <MS>}\n",
     ".impeccable/hook.cache.json": "{\"version\":1,\"sessions\":{\"s1\":{\"updatedAt\": <EPOCH>,\"files\":{\"<WS>/src/components/Card.module.css\":{\"editCount\":1,\"findings\":[\"gradient-text:2\"]}},\"footerShown\":true}}}"
   }
 }
diff --git a/tests/oracle/lib.mjs b/tests/oracle/lib.mjs
index 2a8b8c670..ebcfbb5ab 100644
--- a/tests/oracle/lib.mjs
+++ b/tests/oracle/lib.mjs
@@ -90,7 +90,16 @@ export function stageWorkspace(name) {
 export function normalize(text, { ws, home = os.homedir() }) {
   if (typeof text !== 'string') return text;
   let out = text;
-  // The binary's own path first: it may sit under $HOME or the repo.
+  // The hook footer embeds the admin command: JS prints "node '<scripts>/hook-admin.mjs'",
+  // the binary prints "'<bin>' hooks". Both collapse to <HOOK_ADMIN_CMD>. This must run
+  // before the generic binary-path mask below.
+  out = out.replace(/node '[^']*\/hook-admin\.mjs'/g, '<HOOK_ADMIN_CMD>');
+  out = out.replace(/node "[^"]*\/hook-admin\.mjs"/g, '<HOOK_ADMIN_CMD>');
+  out = out.replace(/'[^']*\/impeccable(?:\.exe)?' hooks/g, '<HOOK_ADMIN_CMD>');
+  out = out.replace(/"[^"]*\\impeccable(?:\.exe)?" hooks/g, '<HOOK_ADMIN_CMD>');
+  // Audit entries record the rendered message length, which includes that command's path.
+  out = out.replace(/"chars":\s*\d+/g, '"chars": <N>');
+  // The binary's own path: it may sit under $HOME or the repo.
   if (process.env.IMPECCABLE_BIN) {
     const bin = process.env.IMPECCABLE_BIN;
     for (const form of [`'${bin}'`, `"${bin}"`, bin]) out = out.split(form).join('<IMPECCABLE>');
@@ -102,10 +111,6 @@ export function normalize(text, { ws, home = os.homedir() }) {
   ]) {
     if (needle) out = out.split(needle).join(tag);
   }
-  // The hook footer embeds the admin command's own path; both runtimes name it differently.
-  out = out.replace(/node '[^']*\/hook-admin\.mjs'/g, '<HOOK_ADMIN_CMD>');
-  out = out.replace(/node "[^"]*\/hook-admin\.mjs"/g, '<HOOK_ADMIN_CMD>');
-  out = out.replace(/'[^']*\/impeccable(?:\.exe)?' hooks/g, '<HOOK_ADMIN_CMD> hooks');
   // Self-referential command lines: the JS prints "node <scripts>/<verb>.mjs", the
   // binary prints "<bin> <verb>". Both collapse to "<IMPECCABLE> <verb>".
   out = out.replace(/node ['"]?<REPO>\/skill\/scripts\/([a-z-]+)\.mjs['"]?/g, (m, v) => `<IMPECCABLE> ${v === 'context-signals' ? 'signals' : v === 'hook-admin' ? 'hooks' : v}`);