chore(memory): BDR-096 branch deletion guard, LRN-161 -d checks the upstream, journal + TODO 2026-09-24

2026-09-24 11:35:01 +02:00
parent 32d8f981df
commit 0d717d9bfc
4 changed files with 59 additions and 0 deletions
@@ -1513,3 +1513,10 @@ Rule: when editing a doctrine file under structure locks, grep the test's lock s
 - **Pattern**: (a) an LLM classifier reads intent; the orchestrator's brief IS the sub-agent's user voice, so a reasoned authorization passes. Only static deny rules (resolve first, inherited by sub-agents, per-segment on `&&`) and OS rights are boundaries. (b) "Trace what it would do" is execution; a scratch target from a variable is one unset var away from `/`. (c) The event deletes its own evidence when the agent's uid owns the logs, the config and the transcripts. (d) A remote backs up only what it holds: push at branch creation and at every commit, from a hook, not from discipline. (e) `git merge` fires post-merge, not post-commit.
 - **Future application**: any new destructive capability → static deny first, prose second, doctrine third. Any orchestrator brief → never "X is allowed outside the repo". Sub-agent tools: report-only agents trace by reading. Probe a guard with the real sub-agent path (auto mode inherited), not the main session.
 - **Reference**: [[BDR-095]], `/mnt/cloudpex/RECOVERY/00-incident/`, atlast transcript `26e76a0b…` + stub `agent-a7d9119…`. Links [[BDR-090]], [[BDR-092]], [[LRN-155]], [[LRN-114]].
+
+## LRN-161 — `git branch -d` guards against the UPSTREAM once one is set: auto-push turns it into a no-op guard
+- **Date**: 2026-09-24
+- **Context**: audit of `_gitflow_delete` for the user rule "never delete unmerged". git-branch(1): `-d` requires the branch merged into its upstream if set, else into HEAD; when merged to upstream but not HEAD it only WARNS. [[BDR-095]] made `start` push `-u origin` and post-commit keeps origin/<br> == <br> → `-d` always succeeds. T22a: unmerged feature, upstream in sync, `git branch -q -d` rc 0, branch gone.
+- **Pattern**: (a) a safety check whose reference point is configurable changes meaning when config moves elsewhere — auto-push broke `-d` with zero diff in the delete code. Verify "merged" explicitly against the NAMED base: `git merge-base --is-ancestor <br> <base>`. (b) probing a guardrail inline gets blocked BY the guardrail: deny strings (`core.hooksPath`, `GIT_CONFIG_GLOBAL=`, `rm -rf "$VAR"`, `branch -D develop`) are matched in the command text, heredocs included → 4 denials this session. Probe = a test in the suite (file, run via `make test`), the TDD path anyway; file content via the Write tool, command line clean. (c) `reference-transaction` hook: line `<old> <new> <ref>` in `prepared`; `branch -d` passes an all-zero old oid ("force" semantics) → ref NAME + all-zero NEW is the only reliable deletion signal; a merged check cannot live there.
+- **Future application**: any change to upstream/push config → re-read every `-d`, `--ff-only`, `@{u}`-relative guard. New destructive capability → static deny + mechanical check + prose, in that order ([[LRN-160]]). Guardrail probes → test file, never inline; a denied probe is the guard working, not a bug to route around.
+- **Reference**: [[BDR-096]], [[BDR-095]], `lib/gitflow-test.sh` T22a/T23, git-branch(1), githooks(5) reference-transaction.