diff --git a/.claude/memory/decisions.md b/.claude/memory/decisions.md
index e5748b1..c4bc03e 100644
--- a/.claude/memory/decisions.md
+++ b/.claude/memory/decisions.md
@@ -1371,3 +1371,10 @@ Branch feature/user-writing-web-rules, UNMERGED (human gate).
 - **Alternatives rejected**: new `gitflow.mode auto|manual` (duplicates autopush); tty-only lock on `finish` (user wants local merges); `-D` after ancestor gate (statically denied form, reviewers' red flag); fail-closed in lib only (hooks would still push → inconsistent).
 - **Gates**: 3 lenses CONCERNS(1/2/2) + confirmation FATAL(4) → r2 fixes (T22j containing base, `-u` fixture, T18n before T18l); feater ×2; GATE 0 7/8 (AC6 = env red); verifier ECARTS(1) = AC6 only; security PASS ×2 (1 MEDIUM fail-open → run B).
 - **Refs**: contract `.claude/tasks/contracts/2026-10-06-manual-push-mode-1632.md`, plan `.claude/tasks/plans/2026-10-06-manual-push-mode-1632.md`, commit 2fc8830 (feature/manual-push-mode, UNMERGED). Extends [[BDR-095]] (c); [[LRN-161]], [[LRN-191]], [[LRN-192]], [[LRN-193]], [[BLK-022]].
+
+## BDR-112 — push-guard: text-only PreToolUse deny of Claude's `git push` in manual-push mode, fail closed [accepted] (2026-10-07)
+- **Decision**: run B of [[BDR-111]]. `hooks/push-guard.sh` (own PreToolUse group `Bash|Monitor`, timeout 10) reads `tool_input.command` + `cwd`; folds `\`-newline in bash (BSD sed unsafe, [[LRN-195]]); three ERE matches on `/usr/bin/grep`: STRICT (git + `-opt [arg]`* + push|send-pack, boundaries `[^[:alnum:]_.-]` / `[^[:alnum:]_-]`), LOOSE on quote-stripped text (any later ` push` word in the same simple command), ALIAS (`alias.x=…push`). Candidate dirs = cwd + literal `-C`/`cd`/`pushd` tokens (quotes stripped, never eval/expand), dedup `sort -u`, >20 distinct → deny before any fork. Mode per dir via `git config --bool gitflow.autopush` rc: 0 → value, 1 → auto, else → deny; NO work-tree gate (global key = work-machine deployment). Deny = JSON `permissionDecision=deny` exit 0, reason carries `! <cmd>`; EXIT trap emits static deny + `exit 0` once a push is detected and nothing decided; jq missing → stderr + allow (sibling policy). User gated: fail-closed cases (cap, unenterable dir, git failure) fire in auto mode too. settings.json: 18 deny entries on WRITE forms of `gitflow.*` (any `git … config` spelling, remove/rename-section, `-c`, config env overrides, Edit/Write of git config files); soft_deny "pushing in manual-push mode, any form, no per-turn clearance"; routing-around hard_deny names hook refusals; banner `🔒 push : manual (autopush=false) — ! git push` (`%-46s`, bytes).
+- **Why**: `ask` inert under auto ([[LRN-155]]); `hooks/guard-bash.sh` withheld ([[BLK-022]]) → one narrow rule instead. Trailing ` *` glob matches end-of-string ([[LRN-194]]) → no infix rule spares the bare read → Claude loses `git config … gitflow.autopush`; hooks/lib keep it; run C gets `gitflow.sh push-mode`. Text-only guard cannot see scripts/aliases → soft_deny is the declared backstop.
+- **Alternatives rejected**: no-jq fallback (greps whole payload, denies in auto, untestable without shim; jq hard dep); `-C` dir unresolvable → allow (fail-open; now skipped, cwd still checked); `rev-parse` work-tree gate (drops the global key); `--default true` read (hides git failure); narrowing deny to spare the read (impossible with end-matching globs).
+- **Gates**: 3 lenses CONCERNS(2)/CONCERNS(5)/FATAL(7) + confirmation FATAL(8) → r2 (BSD sed, oracle naming denied tokens, read loss); feater ×3 (58 → 61 → 71 checks); GATE 0 MET ×3; verifier CONFORME, then ECARTS(1) on hardening closed by gated clarification; security PASS ×2 (3 MEDIUM closed: 20k-token flood denied in 0.15 s, git absent → deny, `bash -c 'cd … && git push'` extracted; residuals → run D).
+- **Refs**: contract `.claude/tasks/contracts/2026-10-07-manual-push-guard-1003.md`, plan `.claude/tasks/plans/2026-10-07-manual-push-guard-1003.md`, commits a2ac018 + 6468eda (feature/manual-push-mode, UNMERGED). Links [[BDR-095]], [[BDR-100]], [[LRN-069]], [[LRN-196]]. Open: user probe `! git push --dry-run` under autopush=false (bang commands assumed hook-free).
diff --git a/.claude/memory/journal.md b/.claude/memory/journal.md
index a3e170d..e3460e0 100644
--- a/.claude/memory/journal.md
+++ b/.claude/memory/journal.md
@@ -569,3 +569,7 @@ rules:
 - /doc global audit 2026-10-06 (opus): 45 items, 6 docs. Applied 34 (24 AUTO + 9 HUMAN drafts + clone URL → Gitea): README components/slash/flow, Makefile help (11 profiles), USAGE /health→make doctor + GSD 3.0.0, ARCHITECTURE layout, MIGRATION retitled + "Upgrading to 2.0.0", SETTINGS package-install guard, CHANGELOG SemVer + default model + upgrade pointer → c6fb2e4. 10 deferred logged in TODO (LICENSE, Known-residual vs release, README restructure, USAGE narrative, templates/settings.json ask inert).
 - Release 2.0.0 cut (user go x3: release, tag push, MIT): bugfix merged 370f35a; develop merged into release/2.0.0 (b47bba7, CHANGELOG conflict resolved: upgrade pointer under [2.0.0]); suite 46/46 green on release; 9ef66e2 MIT LICENSE + README License + Linux residual reworded; gitflow finish by release-executor (BLK-018 did not fire) -> main 4093cca, tag v2.0.0 pushed on user go. Open after release: Linux make test (TODO), make plugin + .env on this machine (BLK-027).
 - /feat manual-push-mode run A (user: work machine, same flow, never push alone): `gitflow.autopush false` = manual-push mode end to end. Plan challenged 3 lenses + 1 confirm → 2 MAJOR (`-d` re-arms on lagging upstream LRN-161; /close STEP 5C pushes develop) + 3 BLOCKER in r2 (T22j regress, develop untracked in fixture, T18l/T18n order) all closed by named changes. feater ×2 (gaps: pipefail flake `git log | grep -q`, 9 SC2034 suppressions removed), GATE 0 7/8, verifier ECARTS(1) = AC6 env red only (design-tool-gate, 21st CLI present, same on develop fa67664), security PASS ×2. Commit 2fc8830 on feature/manual-push-mode, UNMERGED. Runs B (push-guard hook, settings deny widening, banner) + C (skills that push) queued in TODO; do NOT enable manual mode at work before B+C.
+
+## 2026-10-07
+- /feat manual-push-mode run B (user: "enchaine"): `hooks/push-guard.sh` PreToolUse denies Claude's `git push` when autopush false/unparseable/unreadable in cwd or literal -C/cd dirs (global config counts). Challenge: 3 lenses + robustness confirm FATAL(8) → BSD sed `N` fold empty on 1 line (hook dead), AC3 oracle naming denied tokens, glob trailing ` *` matches end → bare read lost, run C needs lib verb. feater ×3 (impl 58, no-jq test 61, hardening 71: cap 20 dirs, git rc → deny, quoted cd). GATE 0 MET ×3; verifier CONFORME then ECARTS(1) → user gated fail-closed also in auto for pathological commands; security PASS ×2 (3 MEDIUM closed, 2 residual → run D). Commits a2ac018 + 6468eda on feature/manual-push-mode, UNMERGED. settings.json live: 18 deny entries, soft_deny, Bash|Monitor hook group. User probe pending: `! git push --dry-run` bypasses hooks?
+
diff --git a/.claude/memory/learnings.md b/.claude/memory/learnings.md
index 535faab..ef32021 100644
--- a/.claude/memory/learnings.md
+++ b/.claude/memory/learnings.md
@@ -1712,3 +1712,15 @@ Rule: when editing a doctrine file under structure locks, grep the test's lock s
 ## LRN-193 — A revised plan gets a fresh challenger, not a re-read: r2 found 3 BLOCKERs inside r1's fixes
 - **Context**: manual-push-mode plan. r1 (3 lenses) → 2 MAJOR, I rewrote 5 checklist items. Confirmation pass (1 fresh correctness challenger on the REVISED file) → FATAL(4): my `--unset-upstream` fix broke T22j; my T18l fixture never set develop's upstream (`push` without `-u`, init creates develop untracked); my T18n/T18l order made offline silence vacuous. All three were in text I had just written and re-read.
 - **Apply**: `challenge-plan.md` "re-challenge once if materially changed" is load-bearing, never skip it to save a dispatch. Brief the confirmation challenger on the NEW mechanics explicitly (state machine of new tests, fixture preconditions, ordering). Fixes to tests need the same fixture trace as the code (`-u`, upstream, what an earlier test leaves behind).
+
+## LRN-194 — Permission globs: trailing ` *` matches end-of-string; a denied token poisons every command that names it
+- **Context**: push-guard deny widening. Planned `Bash(git *config *gitflow.* *)` to deny writes (key + value) and spare the bare read for run C. Evidence: `git config --local core.hooksPath` (no value) is denied by `Bash(git config --local core.hooksPath *)` → ` *` also matches end. Second effect: once `Bash(*GIT_CONFIG_COUNT*)` style rules landed (settings.json symlinked = live), a contract CHECK, a grep and a commit message naming the tokens would all be denied — including the oracle meant to verify the rules.
+- **Apply**: (a) an infix/suffix glob cannot carve out a read of a denied key → give consumers a sanctioned reader (lib verb) instead; (b) a leading-`*` deny on a token makes the token unspeakable in command text → assertions about it live in test FILES (`make test`), never in CHECK commands, grep one-liners or commit subjects; (c) simplify: `Bash(git *config *gitflow.*)` already covers value writes, `--unset`, `--bool` forms. Links [[BDR-112]], [[BDR-100]].
+
+## LRN-195 — BSD sed: `N` on the last line quits without printing → the `:a;N;$!ba` fold returns EMPTY on single-line input
+- **Context**: push-guard plan folded `\`-newline with `sed -e ':a' -e 'N' -e '$!ba' -e 's/\\\n[[:space:]]*/ /g'` (the [[LRN-190]] idiom, written on GNU). `/usr/bin/sed` on macOS is BSD: `printf 'git push' | sed …` prints NOTHING. Every single-line command would have read as empty → guard dead in production, while a 2-line test passed. Caught by the confirmation challenger, not by tests.
+- **Apply**: fold in bash (`one=${cmd//$'\\\n'/ }; one=${one//$'\n'/ }`) or `sed -e ':a' -e '$!N' -e '$!ba'`. Add a single-line positive control to any multi-line normaliser test. [[BDR-110]] census can't catch it (structural, not textual). Links [[LRN-190]], [[BDR-112]].
+
+## LRN-196 — A fail-closed Claude Code hook: trap must `exit 0`, cap attacker-sized loops, read git's rc not its value
+- **Context**: push-guard hardening (security gate, 3 MEDIUM). (1) EXIT trap printed the static deny but kept the non-zero rc → Claude Code parses hook JSON only on exit 0 → deny ignored = allow. (2) Each literal `cd`/`-C` token cost a subshell + 3 git execs: 600 tokens = 12 s > 10 s hook timeout → timeout = non-blocking = allow. (3) `git config --bool --default true` returns empty on git absent / old git / unreadable dir → read as "auto" → allow.
+- **Apply**: `trap '… ; exit 0' EXIT`; deny path `out=$(jq …) || out=$STATIC; printf '%s' "$out"`; dedup (`sort -u`) + hard cap on command-controlled token counts, deny above the cap BEFORE any fork; distinguish `git config` rc 0/1/other (value / unset / failure → deny); record "decided" only after ≥1 clean evaluation. Lock each with a test (shim PATH without a tool, 25-token flood, chmod 000 dir with SKIP path). Measure the flood after the fix (20 000 tokens → 0.15 s). Links [[BDR-112]], [[BDR-087]], [[LRN-160]].
diff --git a/.claude/tasks/TODO.md b/.claude/tasks/TODO.md
index 9910f02..8cb8517 100644
--- a/.claude/tasks/TODO.md
+++ b/.claude/tasks/TODO.md
@@ -2058,8 +2058,9 @@ dans un runner; capitalize reste main-loop.
 
 ## manual-push-mode (2026-10-06, /feat × 3)
 - [x] run A — `gitflow.autopush=false` honoured by `_gitflow_push_branch`, quiet unpushed-guard, doctrine line; plan `.claude/tasks/plans/2026-10-06-manual-push-mode-1632.md` → commit 2fc8830 on feature/manual-push-mode; verifier ECARTS(1) = AC6 only (design-tool-gate env red, pre-existing on develop) → human waiver; merge human-gated
-- [ ] run B — `hooks/push-guard.sh` PreToolUse (deny `git push` in manual mode) + test + settings.json (hook wiring, widen `gitflow.*` deny: `git config * gitflow.*`, `git -c gitflow.*`, `GIT_CONFIG_COUNT=*`; environment prose ~480/~499) + session-start banner push mode
-- [ ] run C — skills that push on their own, gate on `gitflow.autopush`: capitalize STEP 5C (`git push origin develop`), client-handover SKILL:48 + agents/client-handover-writer.md:586, release-candidate:96 + tour:273 "already on origin" claims
+- [x] run B — `hooks/push-guard.sh` PreToolUse (deny `git push` in manual mode) + 71-check test + settings.json (own hook group Bash|Monitor timeout 10; 18 write-form deny entries on the toggle; soft_deny on manual-mode pushes with no per-turn clearance; prose) + banner → a2ac018 + hardening commit; verifier CONFORME then ECARTS(1) closed by gated clarification (fail-closed cap/unenterable dir also in auto mode); security PASS ×2
+- [ ] run D also (push-guard residuals, security gate 2026-10-07): tokens with inner quotes/backslashes (`cd /m/'a b'`) resolve to the wrong dir → treat as unresolvable + deny or document; unparseable payload (lone surrogate) → jq fails → silent allow → grep raw payload for `push` and deny; `case "$mode"` default `*) deny`; up-front `command -v grep sed sort head jq` check; header line > 80 cols; T42 compares against HEAD (vacuous once committed) → compare against a pinned base or drop; no test sets the key to literal `true`
+- [ ] run C — skills that push on their own, gate on the mode through a NEW lib verb `bash ~/.claude/lib/gitflow.sh push-mode` (prints auto|manual|invalid; the bare `git config … gitflow.autopush` read is denied for Claude after run B — a trailing ` *` glob also matches end-of-string): capitalize STEP 5C (`git push origin develop`), client-handover SKILL:48 + agents/client-handover-writer.md:586, release-candidate:96 + tour:273 "already on origin" claims
 - [ ] run B also: fail-CLOSED on an unparseable `gitflow.autopush` value in every reader at once (lib `_gitflow_push_off`, the two emitted push hooks, unpushed-guard) — run A keeps fail-open for consistency with the untouched emitters (security gate MEDIUM, 2026-10-06); `--end-of-options`/`--` on refname args and `printf %q` in copy-paste hints (LOW); `gitflow_delete`: check `_gitflow_checkout_containing_base` rc before `--unset-upstream` (LOW, 2nd gate)
 - [ ] ORDER: do not set `gitflow.autopush false` on the work machine before B + C are merged (until then `/close` still pushes develop)
 
diff --git a/.claude/tasks/contracts/2026-10-07-manual-push-guard-1003.md b/.claude/tasks/contracts/2026-10-07-manual-push-guard-1003.md
new file mode 100644
index 0000000..cac64a6
--- /dev/null
+++ b/.claude/tasks/contracts/2026-10-07-manual-push-guard-1003.md
@@ -0,0 +1,49 @@
+# CONTRACT — manual-push-guard (run B of manual-push mode)
+- date: 2026-10-07 | flow: feat | branch: feature/manual-push-mode (run A landed as 2fc8830; run C = skills that push, separate)
+- status: active
+
+## REQUEST (verbatim — IMMUTABLE)
+User (fr): "ok enchaine sur le run B"
+Run B as scoped in `.claude/tasks/contracts/2026-10-06-manual-push-mode-1632.md` CLARIFICATIONS and `.claude/tasks/TODO.md` "manual-push-mode": `hooks/push-guard.sh` PreToolUse (deny `git push` in manual mode) + test + settings.json (hook wiring, widen `gitflow.*` deny: `git config * gitflow.*`, `git -c gitflow.*`, `GIT_CONFIG_COUNT=*`; environment prose ~480/~499) + session-start banner push mode. User decisions (2026-10-06): mechanical block of `git push` chosen; only `! git push` (the user, in the terminal) passes; hook name `hooks/push-guard.sh` + `lib/tests/push-guard.test.sh`.
+
+## CLARIFICATIONS
+Q: hook deny form / A: documented JSON on stdout, exit 0: `hookSpecificOutput.permissionDecision = "deny"` + `permissionDecisionReason` (code.claude.com/docs/en/hooks.md). Reason reaches Claude as the tool error. [orchestrator, internal]
+Q: middle wildcards in `permissions.deny` Bash patterns / A: supported (`Bash(git * main)` documented), `*` matches any text incl. spaces, literal match on the whole command string. [orchestrator, verified via docs]
+Q: fail-CLOSED on an unparseable `gitflow.autopush` value / A: user: refuse the push. In the GUARD only (deny, reason names the invalid value); lib and emitted hooks stay fail-open until run D (every reader at once, emitters included). [gated 2026-10-07]
+Q: banner wording / A: user picked `push : manual`; final line (43 chars, fits the 44-char box): `🔒 push : manual (autopush=false) — ! git push`. [gated 2026-10-07]
+Q: `git push --dry-run` / `-n` in manual mode / A: denied like any push (one rule, no carve-out; the user runs it). [orchestrator — simplest, stated]
+Q: challenge r1 — deny widening vs run C's read / A: widen WRITE forms only (`git *config *gitflow.* *`, `*unset*`, `-c`, `--config-env`, `GIT_CONFIG_PARAMETERS`, `GIT_CONFIG_COUNT`, Edit/Write of `.git/config` and `.gitconfig`); the read `git config --bool --default true gitflow.autopush` stays reachable for run C. `Bash(env GIT_CONFIG_COUNT*)` dropped (covered by the existing `env GIT_CONFIG*`). [gated 2026-10-07, orchestrator — scope]
+Q: challenge r1 — no-jq fallback / A: dropped; jq is a hard dependency (install-plugins.sh); the guard warns on stderr and allows, like every sibling hook. Fail-closed EXIT trap kept for internal errors once a push is detected. [orchestrator — internal]
+Q: challenge r1 — mode read outside a repo / A: no work-tree gate; `git config` reads global/system there (work-machine `--global` deployment). Candidate dirs = cwd + literal `-C`/`cd` tokens; unresolvable → skipped, never an allow. [orchestrator — internal, fail-closed]
+Q: challenge r1 — classifier coverage / A: one soft_deny entry added for pushes in manual mode in any form (scripts, aliases, subshells, sub-agents); env prose no longer names the hook as the whole defence. Matcher `Bash|Monitor` in its own hook group, timeout 10 s. [orchestrator]
+Q: confirmation r2 — bare read / A: a trailing ` *` in a permission glob also matches end-of-string (evidence in plan Context), so the bare read `git config … gitflow.autopush` is denied for Claude after run B; hooks and lib keep it (not tool calls). Run C reads the mode through a lib verb (`gitflow.sh push-mode`), recorded in TODO. The deny list is simplified to `Bash(git *config *gitflow.*)` + section-level and env/edit forms (18 entries). [gated 2026-10-07, orchestrator — scope, surfaced to the user]
+Q: confirmation r2 — oracles / A: settings.json assertions live in the test file (T40–T43), never in a CHECK command or a commit message: the new tokens would deny the command that names them. [orchestrator]
+Q: hardening gate — two cases where the mode cannot be read safely (more than 20 distinct `cd`/`-C` dir tokens in one command; a named dir that exists but cannot be entered) deny the push even when the cwd is in auto mode; the verifier flagged this against criterion 2's "zero noise outside manual mode" / A: user: refuse the push (fail closed). Criterion 2 is read with this exception: auto-mode silence holds for every command whose named dirs can all be evaluated and number at most 20. [gated 2026-10-07]
+Q: full-suite criterion / A: every suite except `lib/tests/design-tool-gate.test.sh`, a pre-existing environmental red on this machine (21st CLI present; reproduced on develop fa67664 without run A; TODO "test hermeticity"). Declared upfront, not loosened after a red. [orchestrator]
+
+## ACCEPTANCE CRITERIA
+1. `hooks/push-guard.sh` (PreToolUse) denies any Bash command that runs `git push` — plain, `git -C <dir> push`, `git -c k=v push`, `--no-pager`, `--dry-run`/`-n`, inside `cd x && git push`, `(…)`, `bash -c '…'`, after `;`/`&&`/`|`, absolute `/usr/bin/git`, backslash-newline split — when `gitflow.autopush` reads false (or unparseable) in the payload cwd or in any literal `-C`/`cd` dir the command names (global config counts outside a repo). JSON deny form; the reason names manual push mode and tells the user to run it with `! <command>`.
+   CHECK: out=$(make test suite=lib/tests/push-guard.test.sh 2>&1); printf '%s' "$out" | grep -q '^FAIL' && exit 1; printf '%s' "$out" | grep -qE 'PASS=(4[0-9]|[5-9][0-9]) FAIL=0' && echo PUSH-GUARD-OK
+   EXPECT: PUSH-GUARD-OK
+   EVIDENCE: MET exit=0 marker-found :: PUSH-GUARD-OK
+2. Zero noise outside manual mode: auto mode (key unset or true, no global key) → the hook prints nothing and exits 0 for every command, `git push` included, except the two fail-closed cases gated in CLARIFICATIONS (more than 20 distinct dir tokens; a named dir that exists but cannot be entered) [gated 2026-10-07]; in manual mode every non-push command (`git status`, `git commit -m "fix push guard"`, `gitflow.sh finish`, `git pushd`, `git stash`, `echo pushed`) → nothing, exit 0. An unparseable value (e.g. `flase`) → deny, reason says the value is not a boolean. No jq → stderr warning, allow (sibling-hook behaviour, jq is a hard dependency). Locked by the same test file.
+3. `settings.json`: (a) `hooks.PreToolUse` gains its own group `matcher "Bash|Monitor"` running `bash ~/.claude/hooks/push-guard.sh` with `timeout` 10; (b) `permissions.deny` gains the 18 entries listed in the plan (key writes in any `git … config` spelling, section removal/rename, `-c`/env overrides, direct edits of git config files); (c) one new soft_deny entry on pushing in manual-push mode in any form with the no-clearance clause, and the routing-around hard_deny names PreToolUse hook refusals; (d) prose: "Branch deletion by hand" stays unconditional with a manual-mode parenthetical, "**Push discipline**" gains the exception. Valid JSON; no existing entry removed, reworded or weakened. Locked by push-guard.test.sh T40–T43 (file-content assertions).
+   CHECK: jq . settings.json >/dev/null && out=$(make test suite=lib/tests/push-guard.test.sh 2>&1) && ! grep -qE '^FAIL T4[0-3]' <<<"$out" && grep -qE 'PASS=[0-9]+ FAIL=0' <<<"$out" && echo SETTINGS-OK
+   EXPECT: SETTINGS-OK
+   EVIDENCE: MET exit=0 marker-found :: SETTINGS-OK
+4. `hooks/session-start.sh` banner: when `gitflow.autopush` reads false from the session cwd (local or global), one extra line `🔒 push : manual (autopush=false) — ! git push` inside the box, right border aligned (`%-46s`: bash pads by bytes, `—` is 3); nothing otherwise. Locked by push-guard.test.sh T44–T46 (fixture in the suite, `SESSION_START_OFFLINE=1`, positive control before the absence check).
+   CHECK: grep -q 'gitflow.autopush' hooks/session-start.sh && grep -q 'push : manual (autopush=false)' hooks/session-start.sh && grep -q '%-46s' hooks/session-start.sh && out=$(make test suite=lib/tests/push-guard.test.sh 2>&1) && ! grep -qE '^FAIL T4[4-6]' <<<"$out" && echo BANNER-OK
+   EXPECT: BANNER-OK
+   EVIDENCE: MET exit=0 marker-found :: BANNER-OK
+5. shellcheck clean on `hooks/push-guard.sh`, `hooks/session-start.sh`, `lib/tests/push-guard.test.sh`; `bash -n` on all three.
+   CHECK: shellcheck hooks/push-guard.sh hooks/session-start.sh lib/tests/push-guard.test.sh && bash -n hooks/push-guard.sh hooks/session-start.sh lib/tests/push-guard.test.sh && echo SHELLCHECK-OK
+   EXPECT: SHELLCHECK-OK
+   EVIDENCE: MET exit=0 marker-found :: SHELLCHECK-OK
+6. Every hermetic suite green except the declared environmental red `lib/tests/design-tool-gate.test.sh` (CLARIFICATIONS).
+   CHECK: fail=0; for t in $(ls lib/tests/*.test.sh lib/seo-data/*.test.sh lib/gitflow-test.sh lib/tests/run-*.sh | grep -v design-tool-gate.test.sh); do make test suite="$t" >/dev/null 2>&1 || { fail=1; echo "RED $t"; }; done; [ $fail -eq 0 ] && echo SUITES-OK
+   EXPECT: SUITES-OK
+   EVIDENCE: MET exit=0 marker-found :: SUITES-OK
+7. No change to lib/gitflow.sh, hook emitters, githooks/, .githooks/, hooks/unpushed-guard.sh, skills/, CLAUDE.global.md; no new config key or env var; `hooks/rtk-rewrite.sh` untouched (integrity pin); no `eval` in the guard. Floor guard clean (no new suppression).
+
+## FILE SCOPE
+hooks/push-guard.sh (new) · lib/tests/push-guard.test.sh (new) · settings.json · hooks/session-start.sh
diff --git a/.claude/tasks/plans/2026-10-07-manual-push-guard-1003.md b/.claude/tasks/plans/2026-10-07-manual-push-guard-1003.md
new file mode 100644
index 0000000..15c8595
--- /dev/null
+++ b/.claude/tasks/plans/2026-10-07-manual-push-guard-1003.md
@@ -0,0 +1,57 @@
+# PLAN — manual-push-guard (run B) — REVISED r2 (3 lenses + robustness confirmation)
+Contract: .claude/tasks/contracts/2026-10-07-manual-push-guard-1003.md
+
+## Context
+Run A made `gitflow.autopush false` stop every lib push. Nothing yet stops Claude from typing `git push` itself: `Bash(git push *)` is on `ask`, inert under auto mode (BDR-095, LRN-155). `hooks/guard-bash.sh` does not exist (BLK-022); this guard is ONE narrow rule. The human-only toggle (`git config gitflow.*` deny) is prefix-only; run A widened its reach to the lib, so the bypass forms close now. A trailing ` *` in a permission glob also matches end-of-string (evidence: `git config --local core.hooksPath` with no value is denied by `Bash(git config --local core.hooksPath *)`), so NO infix rule can spare the bare read `git config … gitflow.autopush`: Claude loses the read, hooks and lib (not tool calls) keep it, and run C reads the mode through a lib verb (recorded in TODO). jq is a hard dependency (install-plugins.sh); sibling hooks fail open without it. `/usr/bin/sed` is BSD sed: no `N`-on-last-line idiom (an unconditional `N` on the last line quits WITHOUT printing → empty string on single-line input).
+
+## Checklist
+- [ ] hooks/push-guard.sh (new, ≤100 lines, functions ≤25 logic lines, `set -u`, `unset CDPATH`):
+    Header: purpose, BDR-111, deny form (JSON `hookSpecificOutput.permissionDecision=deny`, exit 0), what it sees (command TEXT only), candidate dirs, fail-closed policy (unparseable value = manual; once a push is detected an EXIT trap emits the static deny with exit 0 unless a decision was recorded), limits: OVER-BLOCKS in manual mode (any command whose text carries a later ` push` word after a `git` token: `git subtree push`, `git stash push`, `git log -S "git push"`, `grep -rn "git push" skills/`, `git config --get push.default`, `git add push.sh`, `git help push`, a commit message containing "git push") and MISSES (`"git" push`, `git "push"`, `git send-pack` caught, `git -c alias.p=push p` caught by the alias pattern; expansions `~`/`$VAR`/`$(…)` in `-C`/`cd` never resolved; `--git-dir`/`GIT_DIR`; a push inside a script, Makefile target or user alias it runs → soft_deny rule). jq missing → one stderr warning, allow (sibling-hook behaviour).
+    Parse: `payload=$(cat 2>/dev/null)`; jq check; `field() { printf '%s' "$payload" | jq -r "$1 // empty" 2>/dev/null; }`; `cmd=$(field '.tool_input.command')`; `cwd=$(field '.cwd')`; `[ -n "$cmd" ] || exit 0`; `[ -d "$cwd" ] || cwd=$PWD`.
+    Normalize IN BASH, no sed: `one=${cmd//$'\\\n'/ }; one=${one//$'\n'/ }` (backslash-newline, then bare newlines → spaces); `bare=$(printf '%s' "$one" | sed -E "s/\"[^\"]*\"//g; s/'[^']*'//g")` (quoted spans removed; unbalanced quotes → documented limit).
+    `is_push()` (any of three, `grep -qE` on a single-write `printf '%s'`):
+      STRICT on `one`: `(^|[^[:alnum:]_.-])git([[:space:]]+-[^[:space:]]+([[:space:]]+[^[:space:]-][^[:space:]]*)?)*[[:space:]]+(push|send-pack)([^[:alnum:]_-]|$)`
+      LOOSE on `bare`: `(^|[^[:alnum:]_.-])git[[:space:]]+([^|;&()]*[[:space:]])?(push|send-pack)([^[:alnum:]_-]|$)`
+      ALIAS on `bare`: `alias\.[^=[:space:]]+=[^[:space:]]*push`
+      Not a push → `exit 0` silently (nothing armed yet).
+    Arm: `STATIC_DENY` = compact literal JSON (reason "push-guard: internal error while checking manual push mode — push refused (fail closed). Run it yourself in the terminal with !"); `decided=0; trap '[ "$decided" = 1 ] || printf "%s" "$STATIC_DENY"; exit 0' EXIT` (the trap forces exit 0 so Claude Code parses the JSON).
+    `candidates()`: start with `cwd`; `grep -oE` on `one` for `(^|[[:space:];&|()])(cd|pushd)[[:space:]]+(--[[:space:]]+)?("[^"]*"|'[^']*'|[^[:space:];&|()]+)` and `(^|[[:space:]])-C[[:space:]]+("[^"]*"|'[^']*'|[^[:space:];&|()]+)`; take the LAST field of each match, strip one pair of surrounding quotes, skip `-` and empty; resolve `( cd -- "$cwd" && cd -- "$tok" 2>/dev/null && pwd -P )`; unresolvable → skipped (never expands `~`, `$`, backticks; no eval). Over-inclusion (`rg -C 3`, `tar -C /tmp`) only adds dirs. Empty list is impossible (cwd always present).
+    `mode_in <dir>` → prints `manual` / `invalid:<raw>` / nothing: `( cd -- "$dir" || exit 0; raw=$(git config gitflow.autopush 2>/dev/null); val=$(git config --bool --default true gitflow.autopush 2>/dev/null); [ "$val" = false ] && echo manual; [ -n "$raw" ] && ! git config --bool gitflow.autopush >/dev/null 2>&1 && echo "invalid:$raw" )`. NO work-tree gate: outside a repo `git config` reads global/system (work-machine `--global` deployment).
+    Decide: loop candidates; first `manual` → deny reason `push-guard: manual push mode (gitflow.autopush=false in <dir>) — Claude never pushes. Run it yourself in the terminal: ! <cmd>`; first `invalid:<raw>` → deny reason `push-guard: gitflow.autopush='<raw>' is not a boolean in <dir> — treated as manual push mode (fail closed). Fix the value by hand, or run it yourself: ! <cmd>`; none → `decided=1; exit 0`. Deny: `out=$(jq -cn --arg r "$reason" '{hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"deny",permissionDecisionReason:$r}}') || out=$STATIC_DENY; printf '%s' "$out"; decided=1; exit 0`. `<cmd>` = original command (jq --arg escapes it).
+- [ ] lib/tests/push-guard.test.sh (new) — top: `set -u; export GIT_CONFIG_GLOBAL=/dev/null GIT_CONFIG_SYSTEM=/dev/null` (hermetic even when run directly; file content, not a command line), `ROOT`, `H="$ROOT/hooks/push-guard.sh"`, `WORK=$(mktemp -d)`, trap cleanup. Harness like rtk-rewrite.test.sh: `run(cmd, cwd)` pipes `jq -n '{hook_event_name:"PreToolUse",tool_name:"Bash",tool_input:{command:$c},cwd:$d}'` into `bash "$H"`, records stdout AND rc; `fire()` → `deny` iff rc=0 and stdout parses with `.hookSpecificOutput.permissionDecision=="deny"`, `allow` iff rc=0 and stdout empty, else `error:<rc>`; `reason()`. Multi-line producers never piped into `grep -q` (LRN-191): use `grep -q … <<<"$out"`. Fixtures: `plain/` (dir, not a repo), `auto/` (git init, no key), `manual/` (key false; `sub/`, `my dir/` inside), `bad/` (key `flase`), `manual2/` (toggle), `gconf` (file `[gitflow]` / `autopush = false`), `shim/` (dir with a `jq` script: `[ "$1" = -cn ] && exit 1; exec /usr/bin/jq "$@"`, resolved via `command -v jq` at test time). Cases (≥40):
+    auto/none: T1 plain `git push` allow; T2 auto `git push` allow; T3 auto `git push -u origin feature/x` allow.
+    manual deny (cwd manual unless stated): T4 `git push` (also asserts stdout is ONE JSON line); T5 `git push -u origin feature/x`; T6 (cwd plain) `git -C "$WORK/manual" push`; T7 `cd sub && git push`; T8 `git push --dry-run`; T9 `git -c a=b push origin HEAD`; T10 `(cd sub && git push)`; T11 `bash -c 'git push'`; T12 `git push; echo done`; T13 `/usr/bin/git push`; T14 `git --no-pager push`; T15 (cwd plain) `cd "$WORK/manual/my dir"; git push`; T16 `git push&&echo ok`; T17 (cwd plain) `cd -- $WORK/manual && git push` (literal expanded path, written by the test); T18 two-line `git \` + newline + `  push`; T19 `git push|tee /dev/null`; T20 `git subtree push --prefix=x origin main` (documented over-block); T21 (cwd plain) `(cd $WORK/manual&&git push)`; T22 `git -c alias.p=push p`; T23 `git send-pack origin`; T24 `grep -rn "git push" skills/` (documented over-block, locked); T25 `git config --get push.default` (documented over-block, locked).
+    manual allow: T26 `git status && git commit -m "fix push guard"`; T27 `bash ~/.claude/lib/gitflow.sh finish`; T28 `git pushd`; T29 `git stash`; T30 `echo pushed`; T31 `rg -C 3 push src/`; T32 `git branch --show-current`.
+    invalid: T33 bad `git push` → deny, reason contains `not a boolean` and `flase`.
+    global: T34a cwd auto, `GIT_CONFIG_GLOBAL=$WORK/gconf` for that one `run` (set inline inside the test function), `git push` → deny; T34b cwd plain, same env, `cd "$WORK/auto" && git push` → deny; T34c cwd auto, default env → allow (control).
+    control: T35 manual2 `git push` deny, then `git config --unset gitflow.autopush` in manual2 → allow.
+    fail-closed: T36 cwd manual, `PATH="$WORK/shim:$PATH"` for that run, `git push` → deny with rc 0 and reason contains `internal error` (jq -cn fails → static deny). T37 cwd manual `git push` under default PATH → reason contains `! git push` and `manual push mode`.
+    payload: T38 `{}` → allow, empty stdout, rc 0; T39 payload with `tool_input.command` but no `cwd` → uses PWD (run from manual/) → deny.
+    wiring (file-content assertions, never typed as a command): T40 `jq -e '.hooks.PreToolUse[] | select(any(.hooks[]; .command=="bash ~/.claude/hooks/push-guard.sh")) | .matcher=="Bash|Monitor" and .hooks[0].timeout==10' "$ROOT/settings.json"`; T41 every deny entry of settings (b) below present (loop over a literal list in the test file); T42 every deny entry of `git show HEAD:settings.json` still present (nothing removed); T43 soft_deny contains `manual-push mode` and the clearance clause `! git push`.
+    banner: `out=$(cd "$WORK/manual" && SESSION_START_OFFLINE=1 bash "$ROOT/hooks/session-start.sh" </dev/null 2>/dev/null)`; T44 positive control `grep -q 'Claude Code config' <<<"$out"`; T45 `grep -q 'push : manual (autopush=false)' <<<"$out"`; T46 same from `auto/`: positive control present AND no `push : manual`.
+- [ ] settings.json (hand-formatted; text edits; `jq . settings.json >/dev/null`; `git diff settings.json` shows only these hunks; comma discipline: previous last element gains `,`, new last has none). NOTE for the executor and the orchestrator: once this lands, ~/.claude/settings.json (symlink) is live — never type the new tokens (`GIT_CONFIG_COUNT`, `GIT_CONFIG_PARAMETERS`, `--config-env`) in a Bash command or a commit message; they live in files only.
+    (a) `.hooks.PreToolUse` += NEW group `{"matcher": "Bash|Monitor", "hooks": [{"type": "command", "command": "bash ~/.claude/hooks/push-guard.sh", "timeout": 10}]}`.
+    (b) `.permissions.deny`, after `"Bash(git config --local gitflow.*)"`, 18 entries: `"Bash(git *config *gitflow.*)"`, `"Bash(git *config *remove-section*gitflow*)"`, `"Bash(git *config *rename-section*gitflow*)"`, `"Bash(git -c gitflow.*)"`, `"Bash(git * -c gitflow.*)"`, `"Bash(*--config-env*gitflow*)"`, `"Bash(*GIT_CONFIG_PARAMETERS*)"`, `"Bash(*GIT_CONFIG_COUNT*)"`, `"Bash(* GIT_CONFIG_GLOBAL=*)"`, `"Bash(* GIT_CONFIG_SYSTEM=*)"`, `"Edit(**/.git/config)"`, `"Write(**/.git/config)"`, `"Edit(**/.gitconfig)"`, `"Write(**/.gitconfig)"`, `"Edit(~/.gitconfig)"`, `"Write(~/.gitconfig)"`, `"Edit(~/.config/git/config)"`, `"Write(~/.config/git/config)"`.
+    (c) `.permissions.autoMode.soft_deny` += `"Pushing in manual-push mode (\`gitflow.autopush false\`, set by the user): any git push by Claude — direct, scripted, aliased, inside a subshell, a Makefile target, a sub-agent, or after a HOME/GIT_CONFIG override that hides the key. The push-guard hook catches the direct forms; this rule covers the rest. A request to push in this turn does not clear it: the user types \`! git push\` in the terminal."`; hard_deny "Routing around a guardrail": insert `a PreToolUse hook,` into the list of refusers (`a command the deny rules, a PreToolUse hook or this classifier refused`). Adding restrictions only.
+    (d) prose: hard_deny "Branch deletion by hand": keep `which every branch has since BDR-095` and append ` (manual-push mode: the lib unsets the upstream itself before \`-d\`; the hand form stays banned)`; environment **Push discipline**: append ` Exception, manual-push mode (\`gitflow.autopush false\`, set by the user, work machine): nothing is pushed by Claude, in any form; the user pushes by hand with \`! git push\`.`
+- [ ] hooks/session-start.sh — after the 🪝 `GF_REFRESHED` block:
+    ```
+    # ── manual-push mode (BDR-111): one lock line when this repo never auto-pushes ──
+    # %-46s, not 44: bash printf pads by BYTES and "—" is 3 bytes (2 extra).
+    if [ "$(git config --bool --default true gitflow.autopush 2>/dev/null)" = false ]; then
+      printf "│  🔒 %-46s│\n" "push : manual (autopush=false) — ! git push"
+    fi
+    ```
+
+## Edge cases
+- Global key: shows the banner and denies everywhere, repo or not (truth on a work machine).
+- Over-blocking in manual mode (loose match): listed in the header, two cases locked (T24, T25); never in auto mode.
+- `Bash(*GIT_CONFIG_COUNT*)` ends the LRN-069 token-header idiom (`git -c http.extraHeader=…` stays). `Bash(* GIT_CONFIG_GLOBAL=*)` leaves `make test` untouched (the export lives inside the Makefile).
+- Hook timeout 10 s → Claude Code treats a timeout as non-blocking (allow); the soft_deny and `ask` remain.
+- `!` bang commands run in the user's terminal, outside the Bash tool — not hook-gated (belief): final report asks the user to probe once with `! git push --dry-run` in a scratch repo under `autopush=false`.
+- Run C: the bare read is denied for Claude after (b); run C adds a lib verb (`gitflow.sh push-mode`, prints `auto|manual|invalid`) and gates skills on it — TODO updated by the orchestrator.
+
+## Disposition
+- honors BDR-111 / BDR-095 (static deny first, prose second, `ask` entrusted with nothing; restrictions only added, nothing reworded or removed).
+- honors BLK-022 (one narrow guard), LRN-069/LRN-155 (hook = gate under auto), LRN-047/LRN-091 (silent in auto and on non-push), LRN-104 (every reason, the wiring, matcher and timeout locked), LRN-191 (no multi-line producer into `grep -q`), BDR-110 (BSD sed/grep: bash folding, `/usr/bin/grep -E` semantics verified by the challengers), LRN-193 (fresh confirmation pass done: FATAL(8) → this revision).
+- honors BDR-100 / LRN-113: surface grep after the change (file-content tokens only, via `make test` assertions T41/T42); readers outside this run → run D.