@@ -2068,7 +2068,7 @@ pub async fn git_receive_pack(
     }
 
     // Parse ref updates from pkt-line body before handing to git
-    let ref_updates = parse_ref_updates(&body);
+    let ref_updates = parse_ref_updates(&body)?;
     tracing::debug!(
         ref_count = ref_updates.len(),
         "parsed ref updates from pack"
@@ -2130,10 +2130,14 @@ pub async fn git_receive_pack(
     // or tree is skipped by `rev-list --all` yet still served, bypassing
     // the fail-closed under-withhold check. Refuse before intent is
     // written so a denied push leaves no rows behind.
+    //
+    // Also match the bare `refs/gitlawb` name (no trailing slash): a push
+    // of that exact ref would not be caught by `starts_with("refs/gitlawb/")`
+    // and could land on a repo with no internal refs yet, bypassing the gate.
     if let Some(bad) = ref_updates
         .iter()
         .map(|u| u.ref_name.as_str())
-        .find(|r| r.starts_with("refs/gitlawb/"))
+        .find(|r| *r == "refs/gitlawb" || r.starts_with("refs/gitlawb/"))
     {
         tracing::warn!(
             repo = %name,
@@ -2296,6 +2300,12 @@ pub async fn git_receive_pack(
     // `received` + `prepared` aggregate strands (never purged, never
     // promotable without git evidence, and poisoning its tuple via
     // `has_competing_claimant`).
+    //
+    // Drop-guard: if the handler exits (early return, cancellation, panic)
+    // between here and the `receive_pack_raw_with_reflog` call below, the
+    // guard terminalizes the intent on drop so it never strands in
+    // `received` state.
+    let _intent_guard = IntentDropGuard::new(state.db.clone(), request_id.clone());
     let lease = match state
         .repo_write_leases
         .acquire(&repo_key, lease_steal_after)
@@ -2528,6 +2538,10 @@ pub async fn git_receive_pack(
     // still relies on marker + tuple/timestamp + history guards. Marker
     // namespace hiding was verified above by `verify_recovery_prereqs`.
     let reflog_action = format!("gitlawb-request:{request_id}");
+    // Disarm the drop-guard: git is about to start, so a dropped future
+    // from here forward is a mid-git disconnect (not a pre-git shed), and
+    // the mark_uncertain path below handles that case.
+    _intent_guard.disarm();
     let (receive_raw, exit_ok) = match smart_http::receive_pack_raw_with_reflog(
         &state.git_bin,
         &disk_path,
@@ -3818,6 +3832,60 @@ pub async fn get_icaptcha_proof(
     })))
 }
 
+// ── Drop guard for stranded intents ──────────────────────────────────────
+
+/// Drop-guard that terminalizes a durable intent if the handler exits (via
+/// early return, cancellation, or panic) after the intent insert but before
+/// `receive_pack` runs. A dropped future between the insert and git leaves a
+/// `received` parent + `prepared` children that nothing retires: purge
+/// excludes `received` even at 8 days, the drain skips it, and reconcile
+/// cannot prove a landing git never ran. The stranded children also poison
+/// `has_competing_claimant` checks. Disarm this guard once git starts.
+struct IntentDropGuard {
+    db: std::sync::Arc<crate::db::Db>,
+    request_id: String,
+    armed: std::sync::Arc<std::sync::atomic::AtomicBool>,
+}
+
+impl IntentDropGuard {
+    fn new(db: std::sync::Arc<crate::db::Db>, request_id: String) -> Self {
+        Self {
+            db,
+            request_id,
+            armed: std::sync::Arc::new(std::sync::atomic::AtomicBool::new(true)),
+        }
+    }
+
+    fn disarm(&self) {
+        self.armed
+            .store(false, std::sync::atomic::Ordering::Release);
+    }
+}
+
+impl Drop for IntentDropGuard {
+    fn drop(&mut self) {
+        if self.armed.load(std::sync::atomic::Ordering::Acquire) {
+            let db = self.db.clone();
+            let request_id = self.request_id.clone();
+            tokio::spawn(async move {
+                if let Err(e) = db
+                    .refuse_receive_pack_before_git(
+                        &request_id,
+                        "handler dropped before git started",
+                    )
+                    .await
+                {
+                    tracing::warn!(
+                        err = %e,
+                        request_id = %request_id,
+                        "drop-guard cleanup failed"
+                    );
+                }
+            });
+        }
+    }
+}
+
 // ── Pkt-line parsing ──────────────────────────────────────────────────────
 
 /// `Clone` so `git_receive_pack` can hand the parsed updates to the detached
@@ -3832,7 +3900,13 @@ pub(crate) struct RefUpdate {
 
 /// Parse git receive-pack pkt-line ref updates from the request body.
 /// Format per line: `<40-hex-old> <40-hex-new> <refname>[NUL capabilities]\n`
-fn parse_ref_updates(body: &[u8]) -> Vec<RefUpdate> {
+///
+/// Returns `Err` if any command line in the ref-update section is not valid
+/// UTF-8. Silently skipping non-UTF-8 lines would allow a pusher to plant
+/// refs/gitlawb/* refs (bytes ≥ 0x80 are accepted by git but invisible to
+/// the namespace gate and visibility_pack exemption), so the whole push must
+/// be refused instead.
+fn parse_ref_updates(body: &[u8]) -> Result<Vec<RefUpdate>> {
     let mut updates = Vec::new();
     let mut pos = 0;
 
@@ -3858,9 +3932,18 @@ fn parse_ref_updates(body: &[u8]) -> Vec<RefUpdate> {
         let data = &body[pos + 4..pos + len];
         pos += len;
 
+        // Non-UTF-8 ref-update lines must be refused, not skipped. Git accepts
+        // refnames with bytes ≥ 0x80 (e.g. \xff-prefixed), so a skipped line
+        // bypasses the refs/gitlawb namespace gate below and lands a blob ref
+        // that is invisible to parse_ref_updates yet still served by
+        // visibility_pack. Reject the entire push so no such ref reaches git.
         let line = match std::str::from_utf8(data) {
             Ok(s) => s,
-            Err(_) => continue,
+            Err(_) => {
+                return Err(AppError::BadRequest(
+                    "ref-update line is not valid UTF-8; push refused".into(),
+                ))
+            }
         };
 
         // Strip capabilities (after NUL) and trailing newline
@@ -3880,7 +3963,7 @@ fn parse_ref_updates(body: &[u8]) -> Vec<RefUpdate> {
         }
     }
 
-    updates
+    Ok(updates)
 }
 
 // ── Helpers ───────────────────────────────────────────────────────────────
 
@@ -3417,46 +3417,61 @@ impl Db {
     /// return between intent insert and `receive_pack` must call this so a
     /// shed push never strands `received` + `prepared` rows the purge path
     /// never touches and reconcile can never promote (no git evidence).
+    ///
+    /// Bounded to 10s: the transaction is `pool.begin()` + three UPDATEs +
+    /// commit with no statement_timeout configured on the pool, so a
+    /// lock-blocked cleanup can pin a global write slot (and on four of the
+    /// five call sites, the lease and per-source permit too) indefinitely.
+    /// The 10s convention matches the other bounded git calls on the
+    /// receive-pack path.
     pub async fn refuse_receive_pack_before_git(
         &self,
         request_id: &str,
         reason: &str,
     ) -> Result<()> {
-        let mut tx = self.pool.begin().await?;
-        let now = Utc::now().to_rfc3339();
-        sqlx::query(
-            r#"UPDATE receive_pack_requests
-               SET state = $2, git_exit_ok = FALSE, last_error = $3,
-                   completed_at = $4
-               WHERE id = $1 AND state = $5"#,
-        )
-        .bind(request_id)
-        .bind(request_state::REJECTED_AT_GIT)
-        .bind(reason)
-        .bind(&now)
-        .bind(request_state::RECEIVED)
-        .execute(&mut *tx)
-        .await?;
-        sqlx::query(
-            r#"UPDATE pending_ref_transitions
-               SET state = $2, cancelled_at = $3
-               WHERE request_id = $1 AND state = $4"#,
-        )
-        .bind(request_id)
-        .bind(pending_state::CANCELLED)
-        .bind(&now)
-        .bind(pending_state::PREPARED)
-        .execute(&mut *tx)
-        .await?;
-        sqlx::query(
-            r#"UPDATE request_proofs SET acked_at = $2 WHERE request_id = $1 AND acked_at IS NULL"#,
-        )
-        .bind(request_id)
-        .bind(&now)
-        .execute(&mut *tx)
-        .await?;
-        tx.commit().await?;
-        Ok(())
+        let cleanup = async {
+            let mut tx = self.pool.begin().await?;
+            let now = Utc::now().to_rfc3339();
+            sqlx::query(
+                r#"UPDATE receive_pack_requests
+                   SET state = $2, git_exit_ok = FALSE, last_error = $3,
+                       completed_at = $4
+                   WHERE id = $1 AND state = $5"#,
+            )
+            .bind(request_id)
+            .bind(request_state::REJECTED_AT_GIT)
+            .bind(reason)
+            .bind(&now)
+            .bind(request_state::RECEIVED)
+            .execute(&mut *tx)
+            .await?;
+            sqlx::query(
+                r#"UPDATE pending_ref_transitions
+                   SET state = $2, cancelled_at = $3
+                   WHERE request_id = $1 AND state = $4"#,
+            )
+            .bind(request_id)
+            .bind(pending_state::CANCELLED)
+            .bind(&now)
+            .bind(pending_state::PREPARED)
+            .execute(&mut *tx)
+            .await?;
+            sqlx::query(
+                r#"UPDATE request_proofs SET acked_at = $2 WHERE request_id = $1 AND acked_at IS NULL"#,
+            )
+            .bind(request_id)
+            .bind(&now)
+            .execute(&mut *tx)
+            .await?;
+            tx.commit().await?;
+            Ok(())
+        };
+        match tokio::time::timeout(std::time::Duration::from_secs(10), cleanup).await {
+            Ok(result) => result,
+            Err(_) => Err(anyhow::anyhow!(
+                "refuse_receive_pack_before_git timed out after 10s"
+            )),
+        }
     }
 
     /// #26 Split PR 1 step 5 — flip any non-terminal state to
@@ -3840,14 +3855,22 @@ impl Db {
         // as `applied` outside it. State is never moved here — only the
         // report widens.
         if res.rows_affected() == 0 {
+            // Take the row under FOR UPDATE in a transaction so the merge
+            // is atomic with the state it read: if the due worker flips
+            // `outcomes_committed` → `effects_pending` between the SELECT and
+            // the UPDATE, the UPDATE would match zero rows, `Ok(0)` would
+            // return, and the newly applied child would be left out of the
+            // report with no later scan revisiting it.
+            let mut tx = self.pool.begin().await?;
             let existing: Option<(serde_json::Value, Option<i32>, String)> = sqlx::query_as(
                 r#"SELECT parsed_report, accepted_ordinal, state FROM receive_pack_requests
-                   WHERE id = $1 AND state IN ($2, $3)"#,
+                   WHERE id = $1 AND state IN ($2, $3)
+                   FOR UPDATE"#,
             )
             .bind(request_id)
             .bind(request_state::OUTCOMES_COMMITTED)
             .bind(request_state::EFFECTS_PENDING)
-            .fetch_optional(&self.pool)
+            .fetch_optional(&mut *tx)
             .await?;
             let Some((stored_report, stored_ordinal, stored_state)) = existing else {
                 return Ok(0);
@@ -3865,8 +3888,9 @@ impl Db {
             .bind(request_id)
             .bind(&stored_state)
             .bind(&merged)
-            .execute(&self.pool)
+            .execute(&mut *tx)
             .await?;
+            tx.commit().await?;
             // accepted_ordinal intentionally untouched: the stored value
             // (captured above as stored_ordinal) remains the event key.
             let _ = stored_ordinal;
 
@@ -731,6 +731,48 @@ async fn fetch_repo(local_path: &Path, remote_url: &str, mode: MirrorMode) -> an
 
     git_run(&["-C", local_str, "remote", "set-url", "origin", remote_url]).await?;
 
+    // Guard against importing non-exempt refs/gitlawb/* refs from the origin.
+    // The push gate (repos.rs) prevents creating them locally, but mirrors
+    // `clone --mirror` then `fetch +refs/*:refs/*` via the stored refspec.
+    // Pre-gate nodes or the non-UTF-8 hole (fixed this PR) could have planted
+    // a `refs/gitlawb/<other>` ref pointing at a blob. That ref was exempt
+    // before the narrowing (visibility_pack.rs) but now fails
+    // `assert_all_refs_are_commits` closed. Prevent the fetch from importing
+    // these refs so one origin ref doesn't wedge serving on every mirror.
+    //
+    // The two exempt subtrees (requests/, issues/) are excluded from hideRefs
+    // so they still import; any other `refs/gitlawb/*` ref is hidden and won't
+    // be fetched. This is cumulative config (git merges multiple hideRefs
+    // entries), and `--prune` still applies to visible refs, so the mirror
+    // prunes deleted exempt refs but never imports non-exempt ones.
+    git_run(&[
+        "-C",
+        local_str,
+        "config",
+        "--add",
+        "transfer.hideRefs",
+        "refs/gitlawb/",
+    ])
+    .await?;
+    git_run(&[
+        "-C",
+        local_str,
+        "config",
+        "--add",
+        "transfer.hideRefs",
+        "!refs/gitlawb/requests/",
+    ])
+    .await?;
+    git_run(&[
+        "-C",
+        local_str,
+        "config",
+        "--add",
+        "transfer.hideRefs",
+        "!refs/gitlawb/issues/",
+    ])
+    .await?;
+
     match mode {
         MirrorMode::Promisor => {
             git_run(&["-C", local_str, "config", "remote.origin.promisor", "true"]).await?;