diff --git a/.wolf/buglog.json b/.wolf/buglog.json
index 98fdb05b..19d4a22d 100644
--- a/.wolf/buglog.json
+++ b/.wolf/buglog.json
@@ -17974,6 +17974,26 @@
       ],
       "occurrences": 1,
       "last_seen": "2026-08-21T15:10:00Z"
+    },
+    {
+      "id": "bug-1612",
+      "timestamp": "2026-08-21T00:00:00Z",
+      "error_message": "Adversarial review REJECTED dirty-content-fingerprint task 4.3 (src/frontend/Makefile DIRTY_FINGERPRINT): when `git diff HEAD` failed but the following `git ls-files | sort | xargs cat` pipe still succeeded, the computation silently proceeded and emitted a fabricated non-empty fingerprint instead of degrading to empty.",
+      "file": "src/frontend/Makefile",
+      "root_cause": "The `$(shell ...)` block wrote both steps into the scratch file via `if { git diff HEAD 2>/dev/null; git ls-files -z ... | sort -z | xargs -0 -r cat -- 2>/dev/null; } >\"$fp_tmp\" 2>/dev/null; then`. POSIX shell only propagates the exit status of the LAST command in a `{ cmd1; cmd2; }` sequential group (and `sh` here has no `pipefail`), so a `git diff HEAD` failure was silently discarded whenever the trailing ls-files/sort/xargs pipe still exited 0 -- unlike xce-build.sh's task 2.1 reference implementation, which tracks per-step success explicitly via an `fp_ok` flag.",
+      "fix": "Restructured the DIRTY_FINGERPRINT $(shell ...) block to gate each step individually, mirroring xce-build.sh's fp_ok discipline: `git diff HEAD >\"$fp_tmp\"` is now its own `if ! ...; then fp_ok=0; fi` step, and the ls-files/sort/xargs pipe (appending via `>>`) is a separate `if [ \"$fp_ok\" = 1 ] && ! ...; then fp_ok=0; fi` step; hashing only proceeds if fp_ok stayed 1 through both. Verified via a wrapper `git` on PATH that fails only `git diff` (all other subcommands pass through to the real git): before the fix this produced a fabricated hash (e.g. f2cd51ec) instead of the reference implementation's empty result; after the fix it resolves to empty, matching xce-build.sh under the identical injected failure. Cross-checked the happy path remains byte-identical to xce-build.sh's standalone computation (e.g. 96726026), the sha256sum-missing fallback (Requirement 5.1) still degrades to empty, GIT_COMMIT's own `-dirty` suffix is unaffected in all three scenarios, and a real `nix develop`-driven `make build-cli` + `go version -m` shows the matching fingerprint (f60eb4be) embedded in the -ldflags.",
+      "tags": [
+        "makefile",
+        "shell-exit-status",
+        "posix-sh",
+        "dirty-content-fingerprint",
+        "task-4.3",
+        "code-review-rejection",
+        "fp_ok"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-08-21T00:00:00Z"
     }
   ]
 }