diff --git a/test/egress-receipt-wiring.test.ts b/test/egress-receipt-wiring.test.ts
index 89a3bbe89..d9ae9782a 100644
--- a/test/egress-receipt-wiring.test.ts
+++ b/test/egress-receipt-wiring.test.ts
@@ -164,6 +164,8 @@ const SCANNER_EXEMPT: Record<string, string> = {
     'served-page JS talking to its own loopback server (same-origin relative fetch)',
   'design/src/compare.ts':
     'served-page JS talking to its own loopback server (relative ./api fetch)',
+  'scripts/gate-cost-replay.ts':
+    'developer-invoked read-only measurement (GSTA-49 T0): git fetch of gstack\'s own origin by SHA (old PR heads and tested merge commits) so past PR gates can be replayed; a download only, no gstack or user state leaves the machine',
   'scripts/ubicloud':
     'developer-invoked test infrastructure: Ubicloud API calls (VM create/show/destroy) with the developer\'s own token, the checkout streamed over SSH to that developer\'s own ephemeral VM, and toolchain downloads run on the VM; no installed-gstack user state is sent',
   // Skill prose templates: these render agent-executed instructions (the