B-DHLK-shared-git-stash-stack-29-entries
Worktrees in this repo share a single git stash stack. Bare git stash / git stash pop commands
from any worktree or session can pop another session’s work from the shared stack. This
vulnerability was realized twice during the design-language programme: one agent applied a foreign
stash entry and pulled in unrelated lockfile changes.
The shared stack currently holds 29 entries from multiple concurrent sessions. Each entry represents WIP that was stashed instead of committed. Stash entries lack clear ownership markers, making it impossible to identify which session created each one without inspection. At least two documented incidents of cross-session contamination occurred when pop operations grabbed the wrong entry.
Any use of bare git stash / git stash pop risks pulling unrelated changes into the current
worktree. This breaks isolation between concurrent work sessions and creates silent data corruption
(merged lockfiles, unrelated code changes) that is discovered late. Sessions cannot safely stash
work without coordination or inspection.