Session Handoff [host-instructions]: #2454 Released as 2.0.866, Hardening-Effort Rule #2501 Next #2506

Next steps

1. Land Encode Trust Boundaries So Hardening Effort Follows the Real Threat, Not the Maintainer's Own Inputs #2501: hardening effort follows real risk, not theoretical risk. The maintainer raised this directly and left the form to this session. The decision is recorded on the issue: a GOVERNANCE.md section, surfaced as a generated include in fleet-code-review "Review the Change", with the reviewer half in .github/copilot-instructions.md, and no new skill. Point 4 (likelihood times consequence) is widened to robustness hardening. Done means local-strict-review's brief stops demanding race, coercion and platform findings unconditionally.
2. Re-triage Verify on Windows That fstat and lstat Agree on File Identity in write_regular_file's Cleanup #2494, Stamp CLAUDE.md's Digest When It Is Written, Not Only When the Whole Install Completes #2498 and Fix the Stale Docstring on test_a_created_file_that_cannot_be_removed_is_named_as_incomplete #2499 against Encode Trust Boundaries So Hardening Effort Follows the Real Threat, Not the Maintainer's Own Inputs #2501 once it lands. Each is a follow-up from Recognize the Installer's Own Partial CLAUDE.md Rather Than Backing It Up as a Hand Edit #2493 for a case with little or no realistic path to occur on a single-user host installer. Close what the rule declines.
3. Settle Merge a Reported Promotion With --match-head-commit Set to the Reported Head, Not a Fresh Read #2505. merge-and-release should pass the reported head to --match-head-commit, so a promotion whose head moved after the ready report is refused by the server.
4. Then Report reply's --all-identical Batch Count When a GraphQL Call Exits the Process #2421, codify Codify: Let the Real Operation Be the Check, and Close a Defect Class Through One Primitive #2431, and Add safety hooks for opencode and codex #781, carried from the previous link.

External blockers

• Verify on Windows That fstat and lstat Agree on File Identity in write_regular_file's Cleanup #2494 needs a native Windows run, and Encode Trust Boundaries So Hardening Effort Follows the Real Threat, Not the Maintainer's Own Inputs #2501 may decline it first.

Internal dependencies

• Encode Trust Boundaries So Hardening Effort Follows the Real Threat, Not the Maintainer's Own Inputs #2501 before the re-triage in step 2, since the rule decides whether those issues are worth anything.
• Encode Trust Boundaries So Hardening Effort Follows the Real Threat, Not the Maintainer's Own Inputs #2501 and Merge a Reported Promotion With --match-head-commit Set to the Reported Head, Not a Fresh Read #2505 both edit skill text. Each regenerates .claude-plugin/ with scripts/build_dist.py, so land them one after the other, not in parallel.

State

• Branches and pull requests: none open from this round. Recognize the Installer's Own Partial CLAUDE.md Rather Than Backing It Up as a Hand Edit #2493's branch and worktree are deleted, locally and on the remote. The primary checkout is clean on develop.
• main: b9bb2a6, the merge of promotion Promote develop to main: Recognize the Installer's Own Partial CLAUDE.md #2502.
• Release: 2.0.866, published from b9bb2a6. Recognize the Installer's Own Partial CLAUDE.md Rather Than Backing It Up as a Hand Edit #2454 closed with it.
• develop: e853b3a, which main contains in full.
• This Linux host: the agent-safety kit was re-installed from main at the start of the round and reports CURRENT. Recognize the Installer's Own Partial CLAUDE.md Rather Than Backing It Up as a Hand Edit #2493 did not change its payload. The Skills snapshot was refreshed from b9bb2a6. The live Claude Code channel loads the primary checkout on develop.
• The other lanes: a peer session ran the windows lane (Session Handoff [windows]: Windows-Host Lane Opened With 21 Issues, #2473 and the POSIX-Assumption Bugs First #2477) concurrently. It merged Skip the Linux Installer Tests in test_bootstrap Off Linux #2484, Compare Worktree Paths, Not Strings, in carry.py's Registration Check #2485, Read a Non-Version winget Token as an Unread Installed Version #2486, Drive bootstrap.ps1's Kept-Tree Functions from the Test Suite, and Move a Tree Whole #2496 and Lock a Bootstrap Run's Directory, and Remove an Empty Leftover at a Tree's Name #2503 and released 2.0.864. Skip the Linux Installer Tests in test_bootstrap Where install-tools.sh Cannot Execute #2473, step 2 of the previous link, closed in that lane.

The parked decision queue

The queue holds 0 open decision issues. Six questions went to the maintainer as prompts during the round, and all were answered:

• Re-install this host's agent-safety kit from main: yes.
• Recognize the Installer's Own Partial CLAUDE.md Rather Than Backing It Up as a Hand Edit #2493 past its edit budget, twice: one more bounded round the first time, then push and file the four.
• The lstat-then-unlink race: keep best-effort removal.
• Merge Recognize the Installer's Own Partial CLAUDE.md Rather Than Backing It Up as a Hand Edit #2493 over the unparsed Copilot overview (Recognize Copilot's Collapsible "N Open Findings" Overview Block in pr_review.py #2480): yes.
• Promote develop to main: Recognize the Installer's Own Partial CLAUDE.md #2502: merge and release. Then, after Lock a Bootstrap Run's Directory, and Remove an Empty Leftover at a Tree's Name #2503 rode along, release anyway.

What the last round did

• Recognize the Installer's Own Partial CLAUDE.md Rather Than Backing It Up as a Hand Edit #2493 (merged): fixes Recognize the Installer's Own Partial CLAUDE.md Rather Than Backing It Up as a Hand Edit #2454. The write primitive removes a file it created when its write fails, where the path still holds that file. A cut-short CLAUDE.md write stamps a leftover that is a prefix of what the run wrote, with instructionsLeftover, and --report names it as a failed write.
• Promote develop to main: Recognize the Installer's Own Partial CLAUDE.md #2502: promoted Recognize the Installer's Own Partial CLAUDE.md Rather Than Backing It Up as a Hand Edit #2493 and also Lock a Bootstrap Run's Directory, and Remove an Empty Leftover at a Tree's Name #2503, merged as b9bb2a6, released as 2.0.866.
• Filed: Verify on Windows That fstat and lstat Agree on File Identity in write_regular_file's Cleanup #2494, Stamp CLAUDE.md's Digest When It Is Written, Not Only When the Whole Install Completes #2498, Fix the Stale Docstring on test_a_created_file_that_cannot_be_removed_is_named_as_incomplete #2499, Merge a Reported Promotion With --match-head-commit Set to the Reported Head, Not a Fresh Read #2505. Commented on The prose gate diffs against the base tip rather than the merge base, so another change's lines can fail this pull request #1658 and Encode Trust Boundaries So Hardening Effort Follows the Real Threat, Not the Maintainer's Own Inputs #2501.

What not to repeat

• Running local-strict-review with an unconditional "flag TOCTOU/race conditions" brief on a single-user host tool. Recognize the Installer's Own Partial CLAUDE.md Rather Than Backing It Up as a Hand Edit #2493 took seven local passes and three Copilot rounds. Nearly every finding after the second pass was a concurrent writer, an interrupt landing mid-cleanup, or the wording of a message the previous fix wrote. This is Encode Trust Boundaries So Hardening Effort Follows the Real Threat, Not the Maintainer's Own Inputs #2501's case in point. Until Encode Trust Boundaries So Hardening Effort Follows the Real Threat, Not the Maintainer's Own Inputs #2501 lands, scope the brief to cases that can occur.
• Reading a promotion's live head and merging it in one command. On Promote develop to main: Recognize the Installer's Own Partial CLAUDE.md #2502 that skipped merge-and-release step 2's comparison against the reported head, and took Lock a Bootstrap Run's Directory, and Remove an Empty Leftover at a Tree's Name #2503 to main past the go-ahead. Compare first, or pass the reported SHA to --match-head-commit (Merge a Reported Promotion With --match-head-commit Set to the Reported Head, Not a Fresh Read #2505).
• Creating a mock that writes bytes a run could never have written. The prefix guard correctly refused a leftover of b"A partial render". A test of a run's own leftover has to leave a real prefix of what that run wrote.

New learnings

• The prose gate diffs a PR's merge result against its fork point, so a comment line another PR merged to develop fails this one. Merging develop into the branch clears it, at the cost of a fresh local pass. Recorded on The prose gate diffs against the base tip rather than the merge base, so another change's lines can fail this pull request #1658.
• A failed --match-head-commit guard is only as good as the SHA it is given. Recorded on Merge a Reported Promotion With --match-head-commit Set to the Reported Head, Not a Fresh Read #2505.