merge-guard: lease-to-default under-blocks on non-idiomatic spellings (--force-with-lease origin HEAD:main; quoted target) — pre-existing

[michael-wojcik]

Class

Pre-existing tolerated UNDER-BLOCK in the lease-to-default coverage family, surfaced by two independent reviewers during the #1064/#1077/#1078 over-block batch review. NOT batch-caused — identical behavior at the batch merge-base (80cb08f) and at HEAD; filing so the coverage gap is tracked rather than lost.

Members (both verified pre-existing)

1. Refspec spelling: git push --force-with-lease origin HEAD:main runs UNGATED. The push-to-main detect arm's push \S+ HEAD:main shape needs exactly one token between push and HEAD:main; the --force-with-lease flag occupies that slot and breaks the match. The idiomatic git push --force-with-lease origin main form IS gated (and, post-merge-guard: force-with-lease push to default branch is over-blocked (gated-but-unmintable) #1064, gates AND mints correctly).
2. Quoted-target spelling: git push --force-with-lease origin 'main' is a parity-negative under-block (the known quote-unaware recognition class).

Severity framing (why non-blocking)

• Under-block direction (tolerated by the honest-mistake charter): the idiomatic origin main lease-to-default form is covered; these are less-idiomatic spellings.
• Defense-in-depth: GitHub server-side branch protection + human review back the residual.
• Pre-existing — the merge-guard: force-with-lease push to default branch is over-blocked (gated-but-unmintable) #1064 batch neither introduced nor was chartered to close these; it fixed the origin main over-block (the cardinal-sin direction).

Fix sketch (if lease-to-default coverage is meant to include these spellings)

Extend the push-to-default recognition to tolerate a flag token between push and the HEAD:main refspec, and address the quoted-target member via the broader quote-unaware recognition work. CAUTION: any change here is a SACROSANCT read-floor edit — full parity + no-new-over-block matrix required; the quoted-target member likely belongs with the existing quote-unaware under-block cluster rather than a point fix.

Provenance

Independently surfaced by the TEST-phase enumeration (quoted-target member) and the blind adversarial security review (HEAD:main refspec member) of the #1064/#1077/#1078 batch.