diff --git a/changelog.d/gsta-217-fixturegit-status.md b/changelog.d/gsta-217-fixturegit-status.md
new file mode 100644
index 000000000..bb1bc02d1
--- /dev/null
+++ b/changelog.d/gsta-217-fixturegit-status.md
@@ -0,0 +1,4 @@
+**A CSO hardening test now fails at the Git step that broke instead of passing without testing anything.** `fixtureGit` in `test/cso-git-hardening.test.ts` threw only on a non-zero exit status. When Git was killed by its 30-second timeout or could not start, `spawnSync` returned a `null` status, and the helper treated that as success. If that happened to the `git replace` step, the test that checks a security snapshot ignores replaced history would pass without a replacement in place. The helper now throws on a spawn error or any status other than 0, and the message names the Git arguments, the status and the signal.
+
+### Tests
+- `test/cso-git-hardening.test.ts`: `fixtureGit` throws on `result.error` or `status !== 0` (#3476).
diff --git a/test/cso-git-hardening.test.ts b/test/cso-git-hardening.test.ts
index 7c6d3eb96..5bf3f1657 100644
--- a/test/cso-git-hardening.test.ts
+++ b/test/cso-git-hardening.test.ts
@@ -9,7 +9,7 @@ import { childEnvironment, executable, git as readGitMetadata, runProcess } from
 const roots:string[]=[];
 afterEach(()=>{for(const root of roots.splice(0))fs.rmSync(root,{recursive:true,force:true});});
 
-const fixtureGit=(repo:string,home:string)=>(...args:string[])=>{const result=spawnSync('/usr/bin/git',['-C',repo,...args],{encoding:'utf8',env:{HOME:home,PATH:'/usr/bin:/bin'},timeout:30_000});if(result.status)throw new Error(result.stderr);return result.stdout;};
+const fixtureGit=(repo:string,home:string)=>(...args:string[])=>{const result=spawnSync('/usr/bin/git',['-C',repo,...args],{encoding:'utf8',env:{HOME:home,PATH:'/usr/bin:/bin'},timeout:30_000});if(result.error||result.status!==0)throw new Error(`fixture git ${args.join(' ')} failed (status ${result.status}, signal ${result.signal}): ${result.error?.message??result.stderr}`);return result.stdout;};
 // Each fixture builds its own repository from Git; nothing is copied from a shared
 // template (Free Tests 40288142343 shard 17: fs.cpSync of the template threw inside
 // its directory walk once and passed on the serial retry). Auto-maintenance is off