Class
Pre-existing under-block (tolerated direction) on the merge-guard, deferred from the #1087/#1086 cross-leg completion arc as option (ii) (the danger-floor half). Surfaced by PREPARE/ARCHITECT during that arc; not fixed there — flagged, not crept.
The gap
cd /repo && gh pr close 42 -d does NOT gate: the -d short spelling of --delete-branch in a non-first leg escapes both the literal close danger arm (which requires the spelled --delete-branch) and _flag_condition_danger_op (first-leg-anchored by design — the #1078 cross-leg-flag-leak cure). So a real branch-deleting close runs unguarded in that shape.
Threat-model triage (why deferred, not urgent)
Per the guard's honest-mistake threat model (over-block = cardinal sin; under-block = tolerated-with-defense-in-depth): this is a miss in the tolerated direction. The idiomatic --delete-branch and the first-leg -d forms already gate; defense-in-depth (operator still sees the command) backs it. It is already pinned as an accepted limitation (test_non_first_leg_cluster_flag_forms_ungated_by_design).
Fix (fully designed in the arc's architecture doc, option (ii))
Per-leg the normalized close-delete-branch danger recognition with a same-leg-tokenized check (close AND the delete flag in the SAME leg) that does NOT re-open #1078. Feasible and clean (distinct from #1079's won't-fix).
Requires its own cycle because:
- It is a danger-floor edit (NEW GROUND — no danger-floor-edit precedent), so it needs a dedicated BIDIRECTIONAL sweep — including the inviolable over-block direction (prove no benign compound with a close-ish or short-flag token in a non-close leg starts gating).
- It reverses a settled, explicitly-pinned "do NOT fix" ruling — a deliberate reversal, not a rider on a security must-fix.
Bundling it into the #1087 laundering closure would risk the cardinal-sin over-block direction and widen the certification perimeter — so it was correctly kept out per the honest-mistake principle.
Class
Pre-existing under-block (tolerated direction) on the merge-guard, deferred from the #1087/#1086 cross-leg completion arc as option (ii) (the danger-floor half). Surfaced by PREPARE/ARCHITECT during that arc; not fixed there — flagged, not crept.
The gap
cd /repo && gh pr close 42 -ddoes NOT gate: the-dshort spelling of--delete-branchin a non-first leg escapes both the literal close danger arm (which requires the spelled--delete-branch) and_flag_condition_danger_op(first-leg-anchored by design — the #1078 cross-leg-flag-leak cure). So a real branch-deleting close runs unguarded in that shape.Threat-model triage (why deferred, not urgent)
Per the guard's honest-mistake threat model (over-block = cardinal sin; under-block = tolerated-with-defense-in-depth): this is a miss in the tolerated direction. The idiomatic
--delete-branchand the first-leg-dforms already gate; defense-in-depth (operator still sees the command) backs it. It is already pinned as an accepted limitation (test_non_first_leg_cluster_flag_forms_ungated_by_design).Fix (fully designed in the arc's architecture doc, option (ii))
Per-leg the normalized close-delete-branch danger recognition with a same-leg-tokenized check (close AND the delete flag in the SAME leg) that does NOT re-open #1078. Feasible and clean (distinct from #1079's won't-fix).
Requires its own cycle because:
Bundling it into the #1087 laundering closure would risk the cardinal-sin over-block direction and widen the certification perimeter — so it was correctly kept out per the honest-mistake principle.