happy paths before release: hosted drive keys, do --json refusals, no unasked merge, manual truth

[AbirAbbas]

Four small fixes from the 2026-09-29 pre-release happy-path pass over dev 461a43fb6 (seven lanes driving the real binary against the manual, on dev and then on the published staging build of the same commit). One commit per concern.

1. scripts/hosted-drive.sh drove keys the surface no longer has. The shipped run-road acceptance exited 5 on a healthy binary: it looked for ctrl+g hide, pressed ctrl+g to open the task column, and looked for a #2 id rows no longer draw. It now opens the column with alt+l, finds the second task by title, opens the folded Done group before pressing the first run, and reads the Running heading. A real run against dev 461a43fb6 (cheap model, isolated home, scheduler and browser stubs) ends ALL PASS.
2. codeaf do --json printed nothing on an early refusal. codeaf do "" --json exited 1 with zero bytes on stdout, though the manual promises one parseable object even when the run failed (fix: docs-audit bug batch (headless, reading helpers, held tasks, standing, teams, fan-out checks, media, remote) #1604 added that refusal). Every refusal after the flags parse — blank brief, --best with --cheap, a bad --slots — now prints the shared envelope (ok:false, stop:"error", the refusal as error), keeping stderr and exit 1. An unknown flag stays on the usage path.
3. senior-dev's ending: the chat merged the branch into the person's main unasked. Seen twice on a cheap model after a passed /senior-dev: the wake turn ran git merge and said "merged into main". senior-dev.md says codeaf never merges into your branch and offers the merge. program-outcome.md now says, for every outcome, that bringing the branch over is the person's call, done only when they ask in a later message. This is guidance, not an enforced guard; an enforced guard would sit at the pre-action bash seam (taskGitGuard.PreAction). The system prompt is untouched — it sits at its byte budget.
4. Two manual sections contradicted the binary. worker-harness.md said a finished run is always merged into the folder it was cut from; on main/master it says branch kept (how-tasks-run.md already said so). commands.md said /history and a bare /task open a place called tasks; they open [sessions].

Validation contract → tests

• A post-parse refusal with --json prints exactly one envelope and keeps exit 1 and the stderr line → TestDoParsedRefusalsKeepTheJSONContract (failed before, on all three empty-stdout cases)
• Without --json those refusals are unchanged → TestDoParsedRefusalsWithoutJSONKeepTheirOldReturn
• An unknown flag keeps the usage path → TestDoFlagParseRefusalKeepsUsageWithoutAJSONEnvelope
• The outcome prompt carries the never-merge-unasked rule for every outcome → TestAProgramOutcomeLeavesBringingItsBranchOverToThePerson (failed before)
• The hosted drive passes on a healthy binary → the real run above

Gates. Build, vet, gofmt, the manual gates, make test-laws, and cmd/codeaf green locally. Locally make pr-ready's internal/session run failed three times with a different set of task tests each time (task N never finished after 30–130 s while its eight shards ran the box to load 8); every one of them passes alone, twice, on this branch, and this branch changes only one prompt paragraph and its test in that package. The same suite on untouched dev failed locally too, with a third random set (TestARefutedNodesRepairRoundRunsOnTheCarefulModel, TestAuditVerifiesAChangeThatPassesItsTest, TestRefutedWorkIsRepairedInPlaceAndLandsWhenItHolds) — the laptop's load flake tracked in #1525, not this change. CI's touched packages (which runs internal/session in full) is green on this PR.

🤖 Generated with Claude Code