What broke
Two independent sessions, hours apart, each closed from a detached worktree, and each was handed a push command with an invalid refspec. Both refused to improvise, and that judgement is the only reason both journals were recoverable. The tooling should not depend on the operator being careful at 23:00.
The rule it paid for
Every mission gets the branch its contract names, read-only included; the exit command prints the complete preservation procedure itself; a preservation sequence ends at the push and never carries a HEAD refspec.