v2.0.1 — the blockers the gate never got to raise

v2.0.0 shipped on a NOTE because one of its two required reviewers outaged. That reviewer was re-run afterwards and found two real blockers. This closes both.

The outage was fixable and the fix was already recorded: agy's headless failure mode is a permission-denied tool call provoked by a prompt that invites shell, and the v2.0.0 review prompt was full of git vocabulary — SHAs, a PR number, a commit range. Stripped of it, the same model reviewed the same material without incident. v2.0.0 did not have to ship unreviewed.

Blocker 1 — a numeric stage reference survived

duck-run still said "Stage 1's design" after v2.0.0 added the rule against referring to its own stages by number. The grep behind the claim it was gone was case-sensitive and returned zero, so the receipt asserted the opposite of what shipped.

Blocker 2 — a rule contradicted by the example beneath it

duck-review and duck-race both stated "never inline", then demonstrated $(cat …) dispatch examples that inline.

Fixed by narrowing the rule to the evidence it cites rather than softening it. The 28-of-41 verdict-flip measurement compared a pasted corpus against one read from disk — it never tested the instruction prompt. Both files now say the prompt is the command's argument and the material it refers to is a path the reviewer opens, which is what the measurement supports and what every dispatch in this session actually did.

The gate

Two families, both APPROVE, no outage: gemini-3.1-pro-high (Google) and gpt-oss-120b-medium (OpenAI). Model pins proved by rejection before use, inputs passed by path, one scratchpad directory per reviewer — the rules v2.0.0 added, exercised on v2.0.1.

The merge still used an admin bypass of the require_last_push_approval rule, recorded in the outcome. The review gate itself was not waived this time.