docs(architecture): N-4 + N-5 — push-options trait param, unborn-HEAD rider

- N-4: GitPackIngest's prepare binding carries push_options:
  Option<&PushOptions> (parsed (key, value) pairs, verbatim and
  un-interpreted; None until the config gate opens) — pinned in
  ADR-013 §11 and backend.md's trait description so opening the
  config gate later is value-additive, not a trait redesign
- N-5: ls-refs=unborn verification recorded as a rider in
  transport.md §ls-refs + tracker task tasks/architecture/
  n5-unborn-head-rider.md (unborn fixture, real client, both
  substrates; drop the token if it cannot be served — ADR-003)
- review 001: N-4, N-5 marked resolved

verification: cargo test, clippy -D warnings, fmt --check, doc — clean

docs/architecture/backend.md

@@ -51,7 +51,12 @@ gix types:
    `.keep` guard; missing objects → `unpack ng`. It *prepares* the
    validated ref updates; the transaction itself is applied by `GitRefs`
    (single CAS home — ingest validates, refs commits; one transaction per
-   push is what makes `atomic` correct — ADR-013 §7). Budgeted (ADR-009
+   push is what makes `atomic` correct — ADR-013 §7). The prepare binding
+   carries `push_options: Option<&PushOptions>` (ADR-013 §11, review 001
+   N-4): the parsed per-push metadata, present only when `push-options`
+   was negotiated — `None` until the config gate opens; alkgit parses and
+   forwards the option pairs verbatim, never interprets them (their
+   meaning is the caller's policy domain). Budgeted (ADR-009
    max pack size); the impl runs its blocking work off the async
    executor (concurrency model below).
 

docs/architecture/decisions/013-receive-pack-state-machine.md

@@ -186,7 +186,12 @@ verification of the ingestion composition. Captures are recorded in
 11. **Push-options**: negotiated (`push-options` advertised only when the
     assembler enables it; default off in v1), request section parsed
     (bare pkt-lines between the command flush and the pack) and surfaced
-    to the ingest/refs seam as per-push metadata. Rejection of specific
+    to the ingest/refs seam as per-push metadata: the prepared binding
+    carries `push_options: Option<&PushOptions>` — the parsed
+    `(key, value)` pair list, verbatim and un-interpreted — present only
+    when `push-options` was negotiated (`None` until the config gate
+    opens; review 001 N-4's additive-signature pin, so opening the gate
+    later is a value change, not a trait redesign). Rejection of specific
     options is `ng <ref> <reason>`; the section's absence when not
     negotiated must not be parsed as commands (the flush boundary is
     authoritative).

docs/architecture/transport.md

@@ -68,6 +68,14 @@ substrate property (per-request state), not a protocol fork.
 - Parse `command=ls-refs` (peel, symrefs, ref-prefix), stream ref lines
   from the backend's listing, flush. `ref-prefix` filtering is
   client-driven.
+- **Unborn-HEAD rider** (review 001 N-5): `ls-refs=unborn` is advertised
+  (POC-1 validated the *capability token* was accepted, but serving an
+  unborn HEAD's symref line was never exercised against real git — the
+  only advertised promise without capture evidence). Implementation-phase
+  verification: an ls-refs round against an unborn repo, real client,
+  both substrates (the unborn repo fixture in the POC set has refs —
+  a new one without any). If it cannot be served correctly, the honest
+  move per ADR-003 is dropping the token.
 
 ### fetch