Session Handoff [engineering]: #2951, #2946-#2949 and #2941 Released as 2.0.1020, Guard Allow Gaps Next #2966

Next steps, in priority order

1. Re-run the host-safety installer, maintainer only. The guard changed on main again (Read Each Refspec's Push Operation, Include Overrides, and Fused Separators in the Write Guard #2963 via Promote Per-Refspec Write-Guard Push Reading, CLI Usage Gate Follow-Ups, and the Refusal Field Wording to Main #2965), so install.py --report reads STALE until python3 host-setup/agent-safety/claude/install.py runs from a checkout of main. Done when its --report reads CURRENT.
2. Delete the three merged remote feature branches, maintainer only. feature/ledger-and-refusal-field, feature/cli-gate-followups and feature/guard-allow-gaps-2951. Each tip was verified equal to its merged PR head (Record the Attached git Option Disproof and Qualify the Refusal Field Sentence #2955, Tighten the CLI Usage Gate, Share Its Status Parser, and Fix the Windows Decode Probe #2956, Read Each Refspec's Push Operation, Include Overrides, and Fused Separators in the Write Guard #2963). Re-verify with git ls-remote --heads --exit-code -- origin refs/heads/<b> before deleting.
3. The guard's allow gaps, one lane at a time: Close the Write Guard's Remaining Push Detection Gaps Found Reviewing the #2936 Fix #2943, Read a Clustered Short Option's Force or Delete in the Write Guard's Push Check #2957, Deny an Include Override on a Commit as a Hooks-Path Bypass in the Write Guard #2958, Read Words the Shell Rewrites Before a Push in the Write Guard #2959, Deny an Include Override on a Git Command That Runs Other Git Commands in the Write Guard #2960, Fail Closed on a Comment or a Substitution in a Push or Commit's Own Words in the Write Guard #2961, Read a Local Branch Name Whole and an Exec-Path Beside an Include Override in the Write Guard #2962. They all edit gh-write-guard.py, so they serialize rather than run in parallel. Group several per PR where they share a reader (the include-override pair Deny an Include Override on a Commit as a Hooks-Path Bypass in the Write Guard #2958 and Deny an Include Override on a Git Command That Runs Other Git Commands in the Write Guard #2960, and the shell-rewrite pair Read Words the Shell Rewrites Before a Push in the Write Guard #2959 and Fail Closed on a Comment or a Substitution in a Push or Commit's Own Words in the Write Guard #2961). Safety hook, so a frontier lane with the develop-versus-branch differential before every push.
4. The guard's over-denials, after step 3: Narrow Three Write-Guard Reads That Deny More Broadly Than Git Pushes #2953 and Scope a Branch Pattern's Push Operations to the Branches It Can Match in the Write Guard #2964.
5. The rest of the backlog, re-ranked live.

External blockers

• Host-safety kit STALE on this machine until the maintainer re-runs its installer (step 1).
• The auto-mode classifier refused gh api -X DELETE on a remote branch last round, so this round did not try. Remote branch deletes go to the maintainer (step 2).

Internal dependencies

• Steps 3 and 4 each change host-setup/agent-safety/, which moves the payload again. If a guard PR is about to be promoted, run step 1 after that promotion so the installer runs once.
• Step 4 after step 3, since narrowing a deny while allow gaps are open has twice opened a new allow in the same reader.

State

• Merged to develop this round: Record the Attached git Option Disproof and Qualify the Refusal Field Sentence #2955, Tighten the CLI Usage Gate, Share Its Status Parser, and Fix the Windows Decode Probe #2956, Read Each Refspec's Push Operation, Include Overrides, and Fused Separators in the Write Guard #2963. Promotion Promote Per-Refspec Write-Guard Push Reading, CLI Usage Gate Follow-Ups, and the Refusal Field Wording to Main #2965 merged to main at ae63f7bf. Released as 2.0.1020 (run 38494934828, success), tag on ae63f7bf.
• The primary checkout is on develop, fast-forwarded and clean. Every lane worktree and local branch from this round is removed. The remote branches are listed in step 2.
• The installed Skills snapshot is current at ae63f7bf. Host-safety kit STALE (step 1).
• Other tracks' open handoffs untouched: Session Handoff [windows]: #2578 Landed for #694, Closing Through Promotion #2580, #1171 Next #2581 (windows), Session Handoff [host-instructions]: Hardening Rule and Merge Guard Released as 2.0.867 and 2.0.868, #2499 Docstring Next #2514 (host-instructions), Session Handoff [default]: Four Follow-Ups Landed and Released as 2.0.826, Downstream Adoption Next #2361 (default), Session Handoff [python-contract]: Escaped and Folded python-directories Values Refused, Released as 2.0.738 #2014 (python-contract).

The parked decision queue

There are 0 open decision issues.

What the last round did

• Three parallel lanes from one shared brief, the guard and gate lanes on Opus and the small lane on Sonnet, then one Opus promotion driver.
• Close the Write Guard's Push Gaps Found Fixing the #2950 Findings #2951 (Read Each Refspec's Push Operation, Include Overrides, and Fused Separators in the Write Guard #2963): the guard reads each refspec's push operation on its own and checks force and delete ops against pull_request. It also denies an include.path/includeIf override on an unlisted subcommand, and reads a separator fused with a redirection both ways. The differential (128k repository calls, 205k seam calls) found no allow flip under a ruleset holding pull_request.
• Decode Child Output as UTF-8 in the Test That Fails on Windows' Code Page #2946, Share One Porcelain Status Parser Between carry.py and the CLI Usage Gate #2947, Hold an Unlisted CLI That Needs an Argument to Refusing the Unknown Flag Itself #2948, State the CLI Usage Gate's Stricter Reading in CODESTYLE's Argument Rule #2949 (Tighten the CLI Usage Gate, Share Its Status Parser, and Fix the Windows Decode Probe #2956): the Windows decode probe records its reader thread's exception, porcelain parsing lives in carry.py's git_status_records(), and every CLI entry point must be declared in one of three sets. CODESTYLE.md states the gate's stricter reading.
• Ledger and README Says the Refusal Field Is Spent Like the Exit Code but It Is Not #2941 (Record the Attached git Option Disproof and Qualify the Refusal Field Sentence #2955): the attached -c/-C disproof is in the "Disproved Claims" ledger, and the README's refusal-field sentence matches the code.
• Filed: Read a Clustered Short Option's Force or Delete in the Write Guard's Push Check #2957, Deny an Include Override on a Commit as a Hooks-Path Bypass in the Write Guard #2958, Read Words the Shell Rewrites Before a Push in the Write Guard #2959, Deny an Include Override on a Git Command That Runs Other Git Commands in the Write Guard #2960, Fail Closed on a Comment or a Substitution in a Push or Commit's Own Words in the Write Guard #2961, Read a Local Branch Name Whole and an Exec-Path Beside an Include Override in the Write Guard #2962, Scope a Branch Pattern's Push Operations to the Branches It Can Match in the Write Guard #2964.

What not to repeat

• Decode Child Output as UTF-8 in the Test That Fails on Windows' Code Page #2946's stated cause was wrong. The failing call was a probe that names no encoding on purpose, and the error in its reader thread made a whole test class skip on Windows. Read an issue's suspected cause as a lead, not a fix.
• The guard lane needed nine local passes. Passes one to six each found an allow flip the previous fix had opened. A fused-separator fix only settled once it kept develop's reading and added the split one beside it. Design a guard fix that narrows a read as an added reading, not a replaced one.
• A shared brief's "never end the turn waiting" rule contradicts how local reviewer subagents report. They report only through a completion notification, and foreground sleep is blocked, so the lane has to end its turn to receive it. The lane was woken correctly.

New learnings

• None beyond the entries above, which are attempt-specific.