@@ -53,6 +53,15 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
+- A dependency bump is a change: impact names the lock files a range
+  changes (`lockfile_changes`) and never answers "No changes to analyse" for
+  them (#495).
+- Before a commit or push the hook says what it did when it has no impact
+  to show: one line when the change reaches nothing outside the diff, and
+  one when it could not read the command (a git inside a subshell, a `cd`
+  it cannot resolve), with the command to run instead. Silence then means
+  the hook did not run, not a clean review; the hook log keeps tens of
+  thousands of runs so an audit reads a whole session (#464).
 - The MCP tool timed out at 300 s on a monorepo range the CLI answered in
   four seconds (#457), for two reasons. It widened a subdirectory
   `repo_path` to the whole repository; it now analyses the directory asked
 
@@ -8,9 +8,10 @@
 //!   agent already walks, with nothing new to decide. After a text search
 //!   for a name the pending change edits, that name's callers.
 //!
-//! Each reads the event on stdin and answers with `additionalContext`, or
-//! with nothing when the impact is empty, the same content was already
-//! reviewed, or anything at all goes wrong. A hook that blocks a commit
+//! Each reads the event on stdin and answers with `additionalContext`: the
+//! impact, or one line before a commit or push when it is empty or the line
+//! could not be read (#464); nothing when the same content was already
+//! reviewed or anything at all goes wrong. A hook that blocks a commit
 //! because it failed would be worse than no hook; the one deliberate block,
 //! the opt-in strict gate, denies with the impact attached so the retry
 //! passes.
@@ -1656,6 +1657,8 @@ struct Trace {
     verb: Option<&'static str>,
     root: Option<PathBuf>,
     range: Option<String>,
+    /// Why a one-line answer was given in place of a review, for the log.
+    noted: Option<Silence>,
 }
 
 /// Why the hook stayed silent, as its log line names it; `shown` otherwise.
@@ -2341,7 +2344,32 @@ fn decide(
                 .map(|c| hook_json(event, &c, false));
         }
     }
-    let prepared = prepare(event, &payload, trace)?;
+    let prepared = match prepare(event, &payload, trace) {
+        Ok(p) => p,
+        // A commit or push the hook could not read is said so, so that no
+        // block means the hook did not run, never "reviewed, nothing" (#464).
+        Err(why @ ("unsupported-syntax" | "unresolved-dir"))
+            if event == Event::PreToolUse
+                && payload["tool_input"]["command"]
+                    .as_str()
+                    .is_some_and(names_a_recording_verb) =>
+        {
+            trace.noted = Some(why);
+            let how = if why == "unresolved-dir" {
+                "it changes into a directory the hook cannot resolve"
+            } else {
+                "its git runs inside a subshell, eval or command substitution"
+            };
+            return Ok(hook_json(
+                event,
+                &format!(
+                    "diffctx did not analyse this command: {how}. Run `diffctx <repo> --diff --mode impact` in that repository before going on."
+                ),
+                false,
+            ));
+        }
+        Err(why) => return Err(why),
+    };
     if event == Event::PreToolUse && is_seen(&prepared.record_key) {
         return Err("seen");
     }
@@ -2391,11 +2419,32 @@ fn decide(
     if event == Event::PreToolUse {
         mark_seen(&record_key);
     }
-    answer.map(|a| hook_json(event, &a.context, gate && !a.partial))
+    match answer {
+        // One line, so that no block means the hook did not run (#464).
+        Err("empty") if event == Event::PreToolUse => {
+            trace.noted = Some("empty");
+            let range = trace.range.as_deref().unwrap_or("this change");
+            Ok(hook_json(
+                event,
+                &format!("diffctx: {range} reaches nothing outside the diff."),
+                false,
+            ))
+        }
+        answer => answer.map(|a| hook_json(event, &a.context, gate && !a.partial)),
+    }
 }
 
-/// The log is cut over to `hook.log.1` past this size: a few thousand runs.
-const LOG_MAX_BYTES: u64 = 256 * 1024;
+/// A line that records or publishes commits: the events whose silence would
+/// otherwise read as a clean review.
+fn names_a_recording_verb(command: &str) -> bool {
+    let words = || command.split(|c: char| !(c.is_alphanumeric() || c == '-'));
+    words().any(|w| w == "git")
+        && words().any(|w| matches!(w, "commit" | "push" | "merge" | "cherry-pick"))
+}
+
+/// The log is cut over to `hook.log.1` past this size: tens of thousands of
+/// runs, so an audit reads a whole session (#464).
+const LOG_MAX_BYTES: u64 = 4 * 1024 * 1024;
 
 /// One line per run in `<cache>/diffctx/hook.log` (#338): Claude Code keeps
 /// only hooks that print, so without it a silent hook that decided "nothing
@@ -2441,12 +2490,11 @@ pub fn respond_within_deadline(event: Event, stdin_json: String, gate: bool) ->
     let hook_run = crate::resource::RunContext::for_run(HOOK_DEADLINE_SECS);
     let _in_hook = hook_run.enter();
     let answer = decide(event, &stdin_json, gate, started, &mut trace);
-    log_outcome(
-        event,
-        &trace,
-        answer.as_ref().err().copied().unwrap_or("shown"),
-        started.elapsed(),
-    );
+    let outcome = match &answer {
+        Ok(_) => trace.noted.unwrap_or("shown"),
+        Err(why) => why,
+    };
+    log_outcome(event, &trace, outcome, started.elapsed());
     answer.ok()
 }
 
 
@@ -150,6 +150,11 @@ pub struct ImpactOutput {
     /// read "no resolved static callers" while the function had three (#498).
     #[serde(default, skip_serializing_if = "Vec::is_empty")]
     pub layout_only: Vec<String>,
+    /// Lock files the range changes: dependency versions moved, and what that
+    /// reaches is not traced. Dropped from every count, a dependency bump
+    /// answered "No changes to analyse" (#495).
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub lockfile_changes: Vec<String>,
     /// `layout_only` entries left out to fit the cap; the count is whole.
     #[serde(default, skip_serializing_if = "crate::render::is_zero")]
     pub layout_only_omitted: usize,
@@ -2569,7 +2574,8 @@ pub fn build_impact(
         && contracts.is_empty()
         && limits.is_empty()
         && stale.is_empty()
-        && unanalysed.is_empty();
+        && unanalysed.is_empty()
+        && state.lockfile_changes.is_empty();
     ImpactOutput {
         schema: IMPACT_SCHEMA,
         name: state
@@ -2597,6 +2603,7 @@ pub fn build_impact(
         untested_unlisted,
         untested_called_in_diff,
         layout_only,
+        lockfile_changes: state.lockfile_changes.clone(),
         layout_only_omitted: 0,
         traced_definitions,
         withheld_files: state.policy_excluded_count + state.run.withheld_count(),
@@ -3325,7 +3332,8 @@ fn fit_with(output: &mut ImpactOutput, cap: u32, measure: &dyn Fn(&ImpactOutput)
         && output.truncated == 0
         && output.contracts_omitted == 0
         && output.limits.is_empty()
-        && output.unanalysed_files.is_empty();
+        && output.unanalysed_files.is_empty()
+        && output.lockfile_changes.is_empty();
 }
 
 /// One step of shedding, least needed first; `false` once nothing more can
@@ -3932,6 +3940,13 @@ pub fn layout_only_names(output: &ImpactOutput) -> impl Iterator<Item = &str> {
 }
 
 fn write_tail(out: &mut String, output: &ImpactOutput) {
+    write_list(
+        out,
+        "Lock files changed (dependency versions moved; what that reaches is not traced):",
+        &output.lockfile_changes,
+        usize::MAX,
+        0,
+    );
     write_layout_only(out, output);
     write_untested_unlisted(out, output);
     let stale: Vec<String> = output
 
@@ -302,7 +302,11 @@ fn comments_subshell_cds_cd_dash_and_heredoc_messages_keep_their_commit() {
         cache.path(),
         &payload(repo, "cd - && git commit -am vat"),
     );
-    assert_eq!(h.stdout, "", "cd - names no directory");
+    assert!(
+        h.stdout.contains("did not analyse this command"),
+        "cd - names no directory, and says so: {}",
+        h.stdout
+    );
 
     let other = repo_with_pending_change();
     write(
@@ -393,16 +397,24 @@ fn a_commit_of_unparsed_code_says_it_was_not_analysed() {
     );
 }
 
+/// #464: an empty answer is one line, so that no block means the hook did
+/// not run, never "reviewed, nothing".
 #[test]
-fn a_change_nothing_depends_on_is_silence() {
+fn a_change_nothing_depends_on_says_so_in_one_line() {
     let tmp = repo_with_pending_change();
     let cache = TempDir::new().unwrap();
     let repo = tmp.path();
     git(repo, &["checkout", "-q", "--", "shop/pricing.py"]);
     write(repo, "README.md", "# shop\n\nVAT included.\n");
     let h = hook(repo, cache.path(), &payload(repo, "git commit -am docs"));
     assert_eq!(h.code, Some(0));
-    assert_eq!(h.stdout, "");
+    assert!(
+        h.stdout.contains("reaches nothing outside the diff"),
+        "{}",
+        h.stdout
+    );
+    assert!(!h.stdout.contains("permissionDecision"), "{}", h.stdout);
+    assert!(last_log_line(cache.path()).contains(" empty "));
 }
 
 #[test]
@@ -986,7 +998,12 @@ fn the_strict_gate_denies_once_with_the_impact_attached() {
         &["--gate"],
         &payload(repo, "git commit -am docs"),
     );
-    assert_eq!(docs.stdout, "");
+    assert!(
+        !docs.stdout.contains("permissionDecision"),
+        "{}",
+        docs.stdout
+    );
+    assert!(docs.stdout.contains("reaches nothing"), "{}", docs.stdout);
 }
 
 #[test]
@@ -1338,7 +1355,11 @@ fn a_git_command_hidden_in_a_subshell_is_logged_as_unsupported() {
         cache.path(),
         &payload(repo, "sh -c 'git commit -am vat'"),
     );
-    assert_eq!(h.stdout, "");
+    assert!(
+        h.stdout.contains("did not analyse this command"),
+        "{}",
+        h.stdout
+    );
     let log = std::fs::read_to_string(cache.path().join("diffctx").join("hook.log")).unwrap();
     assert!(log.contains("unsupported-syntax"), "{log}");
 }
@@ -1565,7 +1586,11 @@ fn an_empty_answer_stays_empty_after_the_commit_lands() {
     write(repo, "README.md", "# shop\n\nmore\n");
     let command = "git add README.md && git commit -qm readme";
     let pre = hook(repo, cache.path(), &payload(repo, command));
-    assert_eq!(pre.stdout, "");
+    assert!(
+        pre.stdout.contains("reaches nothing outside the diff"),
+        "{}",
+        pre.stdout
+    );
     git(repo, &["add", "README.md"]);
     git(repo, &["commit", "-qm", "readme"]);
     inspect(repo, cache.path(), command);
 
@@ -1536,6 +1536,35 @@ fn a_removed_name_too_common_to_trace_is_unresolved_not_listed() {
     );
 }
 
+/// #495: a dependency bump is a change: the lock files are named and the
+/// answer is never empty, where it read "No changes to analyse".
+#[test]
+fn a_lock_file_change_is_named_never_empty() {
+    let tmp = repo_of(
+        &[
+            ("app.py", "def f():\n    return 1\n"),
+            ("uv.lock", "x==1\n"),
+            ("Cargo.lock", "[package]\nname = \"x\"\n"),
+        ],
+        &[
+            ("uv.lock", "x==2\n"),
+            ("Cargo.lock", "[package]\nname = \"y\"\n"),
+        ],
+    );
+    let doc = impact(tmp.path(), "HEAD~1..HEAD");
+    assert_eq!(doc["empty"], false, "{doc:#}");
+    let locks: Vec<&str> = doc["lockfile_changes"]
+        .as_array()
+        .into_iter()
+        .flatten()
+        .filter_map(|v| v.as_str())
+        .collect();
+    assert_eq!(locks, ["Cargo.lock", "uv.lock"], "{doc:#}");
+    let md = impact_markdown(tmp.path(), "HEAD~1..HEAD");
+    assert!(!md.contains("No changes to analyse"), "{md}");
+    assert!(md.contains("  - uv.lock"), "{md}");
+}
+
 /// #387: callers that could not be resolved are not "0 callers".
 #[test]
 fn unresolved_callers_are_not_reported_as_none() {
 
@@ -132,6 +132,13 @@
         "type": "string"
       }
     },
+    "lockfile_changes": {
+      "description": "Lock files the range changes: dependency versions moved, and what that\nreaches is not traced. Dropped from every count, a dependency bump\nanswered \"No changes to analyse\" (#495).",
+      "type": "array",
+      "items": {
+        "type": "string"
+      }
+    },
     "layout_only_omitted": {
       "description": "`layout_only` entries left out to fit the cap; the count is whole.",
       "type": "integer",