Session Handoff [host-instructions]: Hardening Rule and Merge Guard Released as 2.0.867 and 2.0.868, #2499 Docstring Next #2514

Next steps

1. Fix the Stale Docstring on test_a_created_file_that_cannot_be_removed_is_named_as_incomplete #2499: fix the one stale test docstring. The issue now tracks only that line. Items 2 to 4 were declined under the new rule. Done means the docstring of test_a_created_file_that_cannot_be_removed_is_named_as_incomplete describes the error naming the removal failure too.
2. Report reply's --all-identical Batch Count When a GraphQL Call Exits the Process #2421, codify Codify: Let the Real Operation Be the Check, and Close a Defect Class Through One Primitive #2431, and Add safety hooks for opencode and codex #781, carried from the previous link and still open. Judge each against GOVERNANCE.md "Trust Boundaries and Hardening Effort" before starting, since Report reply's --all-identical Batch Count When a GraphQL Call Exits the Process #2421 is an error-path report case.
3. Recognize Copilot's Collapsible "N Open Findings" Overview Block in pr_review.py #2480, Copilot's collapsible "N open findings" overview, still blocks pr_review.py on some rounds as UNRECOGNIZED_REVIEWER_OUTPUT. Each PR it hits needs its own maintainer answer to merge over it.

External blockers

• None. Verify on Windows That fstat and lstat Agree on File Identity in write_regular_file's Cleanup #2494's native Windows run is gone, since Verify on Windows That fstat and lstat Agree on File Identity in write_regular_file's Cleanup #2494 was declined.

Internal dependencies

• None among the steps above. Each edits different files.

State

• Branches and pull requests: none open from this round. Both feature branches and worktrees are deleted, locally and on the remote. The primary checkout is clean on develop.
• main: d78e614, the merge of promotion Promote develop to main: Guard a Promotion Merge with the Head the Go-Ahead Covers #2512.
• Releases: 2.0.867 from Promote develop to main: Spend Hardening Effort Where a Failure Can Actually Occur #2509 (the hardening rule) and 2.0.868 from Promote develop to main: Guard a Promotion Merge with the Head the Go-Ahead Covers #2512 (the merge guard). Encode Trust Boundaries So Hardening Effort Follows the Real Threat, Not the Maintainer's Own Inputs #2501 and Merge a Reported Promotion With --match-head-commit Set to the Reported Head, Not a Fresh Read #2505 closed with them.
• develop: e3d43de, which main contains in full.
• This Linux host: the Skills snapshot was refreshed from d78e614. The live Claude Code channel loads the primary checkout on develop. The agent-safety kit reports CURRENT.
• The other lanes: the windows lane runs on the Windows 11 box, and its Skip a Symlink Test Where Windows Withholds the Privilege, and Run bash From PATH #2508 is open against develop. It was not touched.

The parked decision queue

The queue holds 0 open decision issues. The maintainer answered five prompts during the round:

• Keep .github/copilot-instructions.md unchanged for Encode Trust Boundaries So Hardening Effort Follows the Real Threat, Not the Maintainer's Own Inputs #2501, since Copilot loads fleet-code-review, which carries the rule. Recorded on Encode Trust Boundaries So Hardening Effort Follows the Real Threat, Not the Maintainer's Own Inputs #2501.
• Merge Spend Hardening Effort Where a Failure Can Actually Occur #2507 over the unparsed Copilot overview (Recognize Copilot's Collapsible "N Open Findings" Overview Block in pr_review.py #2480): yes.
• Promote develop to main: Spend Hardening Effort Where a Failure Can Actually Occur #2509 and Promote develop to main: Guard a Promotion Merge with the Head the Go-Ahead Covers #2512: merge and release.
• Close Verify on Windows That fstat and lstat Agree on File Identity in write_regular_file's Cleanup #2494, and narrow Fix the Stale Docstring on test_a_created_file_that_cannot_be_removed_is_named_as_incomplete #2499 to its docstring: yes.
• Decline Stamp CLAUDE.md's Digest When It Is Written, Not Only When the Whole Install Completes #2498: yes.

What the last round did

• Spend Hardening Effort Where a Failure Can Actually Occur #2507 (merged), Promote develop to main: Spend Hardening Effort Where a Failure Can Actually Occur #2509 (promoted, 2.0.867): fixes Encode Trust Boundaries So Hardening Effort Follows the Real Threat, Not the Maintainer's Own Inputs #2501. A carried verbatim GOVERNANCE.md section, "Trust Boundaries and Hardening Effort", carried as a generated include in fleet-code-review "Review the Change". local-strict-review's race, coercion, and platform traps are now conditional on the deployment, and pr-review-conduct outcome 2 and its triage list decline ruled-out hardening.
• Re-triage under the new rule: Verify on Windows That fstat and lstat Agree on File Identity in write_regular_file's Cleanup #2494 and Stamp CLAUDE.md's Digest When It Is Written, Not Only When the Whole Install Completes #2498 closed as not planned, and Fix the Stale Docstring on test_a_created_file_that_cannot_be_removed_is_named_as_incomplete #2499 narrowed.
• Guard a Promotion Merge with the Head the Go-Ahead Covers #2511 (merged), Promote develop to main: Guard a Promotion Merge with the Head the Go-Ahead Covers #2512 (promoted, 2.0.868): fixes Merge a Reported Promotion With --match-head-commit Set to the Reported Head, Not a Fresh Read #2505. merge-and-release step 3 passes --match-head-commit the head the go-ahead covers.

What not to repeat

• Illustrating "cannot occur" with concurrency on a fleet host. The first draft of the rule declined "a concurrent writer" on a single-user host tool. Concurrent agent sessions are this fleet's normal deployment, and Lock a Bootstrap Run's Directory, and Remove an Empty Leftover at a Tree's Name #2503 had just added a lock for exactly that. The local review caught it.
• Keying a merge guard to whether a report exists. The first Merge a Reported Promotion With --match-head-commit Set to the Reported Head, Not a Fresh Read #2505 draft passed the reported head whenever one existed. An unattended worker also holds drive-pr's report, and an attended re-ask approval makes it stale, so both paths were refused forever. It took two review passes. Key the guard to the head the go-ahead covers.
• A new rule section took four local passes (9, 3, 3, then 0 findings) plus one Copilot finding. Every finding was substantive rather than wording. Budget for it rather than reading pass 2's findings as non-convergence.
• git commit ... >/dev/null in a compound command. gh-write-guard refuses the whole command as a discarded write, so nothing in it runs.

New learnings

• pr_review.py reads "fleet-review" in a Copilot file-table summary as a coverage-marker mention, so a PR touching fleet-code-review reports COVERAGE_IS_UNSTATED despite a full table. That failure is loud and costs one prompt, so under the new rule it was declined and not filed.