diff --git a/src/agents/pi-embedded-runner/run/attempt.ts b/src/agents/pi-embedded-runner/run/attempt.ts
index a4962d14e6e..bfe1d589230 100644
--- a/src/agents/pi-embedded-runner/run/attempt.ts
+++ b/src/agents/pi-embedded-runner/run/attempt.ts
@@ -2855,7 +2855,7 @@ export async function runEmbeddedAttempt(
                 hookCtx,
               );
             } catch (err) {
-              log.warn(`before_agent_run hook failed: ${formatErrorMessage(err)}`);
+              log.warn("before_agent_run hook failed; blocking request");
               beforeAgentRunBlocked = true;
               beforeAgentRunBlockedBy = "before_agent_run";
               await persistBlockedBeforeAgentRun({
diff --git a/src/plugins/hook-decision-types.ts b/src/plugins/hook-decision-types.ts
index e42f48f2622..08a5fda7d4f 100644
--- a/src/plugins/hook-decision-types.ts
+++ b/src/plugins/hook-decision-types.ts
@@ -14,11 +14,12 @@ export type HookDecisionPass = {
 export const BLOCK_MESSAGE_PREFIX = "Your message could not be sent";
 
 /**
- * Content is blocked. `reason` is internal; `message` is user-facing.
+ * Content is blocked. `reason` is internal plugin-local detail; core must not log,
+ * persist, broadcast, or expose it verbatim. `message` is user-facing detail.
  */
 export type HookDecisionBlock = {
   outcome: "block";
-  /** Internal reason for logging/observability. Never shown to user. */
+  /** Internal plugin-local reason. Do not log, persist, broadcast, or expose verbatim. */
   reason: string;
   /** Optional user-facing detail included in the block response envelope. */
   message?: string;