Sub-ticket of PLUTO-192 Two-layer concurrent-push guard — EVO-26 descend, decision bs-mqoxiw8ptby (2026-06-22), Pluto HIGHEST urgency. Adopt mars's proven guard. LAYER 1 (content): drop pluto/.gitpush-strict so gitpush refuses 'git add -A'; every push MUST pass --only <paths>. LAYER 2 (sequence): wrap every spawned-worker push in 'flock -w 600 ~/.cache/evolutiva/pluto-push.lock gitpush.sh --only <paths> msg' — serializes the non-atomic bump-stage-commit-rebase-push pipeline (stops dup version-bumps + rebase-onto-half-state; git index.lock does NOT cover these). WHY Pluto highest: widest push lane (coder+coderhelp+db all bump the SAME package.json) + LIVE clinical app so a sequence collision = botched deploy. PER-ROLE --only LANES: coder=feature paths; db=its 4 ratified exception paths (db/migrations/applied/*, db/schema.md, db/reference-data.sqlite, package.json). gitpush v4.0 auto-includes the bumped package.json alongside --only, so versioning still works. CUTOVER GOTCHA: the moment pluto/.gitpush-strict lands, EVERY push without --only ABORTS (fail-safe) so the marker + ALL push call-sites (coder/coderhelp/db) must cut over in ONE coordinated step. gitpush.sh stays bin-owned/UNCHANGED (guard = repo-marker + per-repo lockfile, zero fleet blast radius). flock must be BAKED INTO the spawn/push path so an ephemeral worker CANNOT omit it — coordinate wiring with nw/bin (own spawn scripts; pluto spawn = tmux-ccs.sh per EVO-26). Execute in aro:pluto. mars = reference impl (bwi#298 + .gitpush-strict). mem:evolutiva-fleet-aro-topology mem:pluto-ondemand-worker-model mem:shared-tree-push-hazard · pluto