chore(memory): BDR-019 + LRN-016 — feat gitconfig-autopush

.claude/memory/decisions.md

@@ -144,3 +144,14 @@ Resize mirrors it with prefix. Status: done (tmux.conf).
 copy-selection-and-cancel, `p` = paste-buffer, tmux hands the buffer to the terminal through OSC 52 (set-clipboard),
 reaches the local clipboard over ssh from iTerm2. xsel/xclip rejected: headless servers have no X display (xsel
 errors), xclip keeps STDOUT open and hangs tmux. Status: done.
+
+## BDR-019 — gitflow.autopush at install: sed read of ~/.gitconfig, exact true/false, bad preset aborts
+2026-10-07. Need: install asks push mode, renders `[gitflow] autopush` in gitconfig template. Chosen: existing
+value read with `sed` on `~/.gitconfig` (same shape as rc_export_value), reused only if exactly `true`/`false`;
+`DOTFILES_GITFLOW_AUTOPUSH` validated first, non-boolean → `return 1` → install aborts before any file touched;
+prompt re-asks until exact, Enter = true; no tty = true. `render_gitconfig` refuses non-boolean / leaked
+`@AUTOPUSH@`. Fixed `core.hooksPath = ~/.claude/githooks` in template (git expands `~`, `make link` owns dir).
+Rejected: `git config --bool` read (that command family denied to Claude session → oracle could not run; also
+XDG/system scopes not needed, installer writes ~/.gitconfig only); git boolean grammar / fr words (fail-open on
+"non", user wants strict). Deviation from BDR-012 "never abort": bad preset aborts, user's fail-closed call.
+Status: merged develop e4cf818.

.claude/memory/learnings.md

@@ -115,3 +115,12 @@ too. Dim inactive panes → active style must hardcode terminal fg/bg (iTerm2 da
 Pick inactive bg far from terminal bg (colour234 ≈ #15191f → invisible). iTerm2 colours: plist
 `New Bookmarks[].Background Color (Dark)` when "separate light/dark" on + macOS dark mode, not `Background Color`.
 Tune live: `tmux set -g window-style ...` then copy to conf. Hardcoded bg = update when iTerm2 theme changes.
+
+## LRN-016 — template passed where rendered file expected: placeholders pass every "non-empty" guard
+2026-10-07. install.sh:688 called `deploy_gitconfig "$SCRIPT_DIR/$bashrc"` (repo TEMPLATE) after identity went
+to `@USER@` placeholders; `rc_export_value` returned `@USER@`, non-empty → guard passed → every install wrote
+`name = @USER@`. Harness tested the function with hand-made rc, never the call site → green while broken. Found
+by plan-challenger reading `git log -L` on the call site. Apply: pass resolved values, not file paths, across a
+render boundary; oracle greps the call site (Case H) and asserts `! grep '@(USER|EMAIL|AUTOPUSH)@'` on output;
+reject placeholder-shaped values like empty ones. Bonus: `shopt -u patsub_replacement` before `${v//p/$r}` on
+bash ≥ 5.2 (`&` expands to match).