diff --git a/docs/HANDOFF.md b/docs/HANDOFF.md
index b0c1f00..61a3b76 100644
--- a/docs/HANDOFF.md
+++ b/docs/HANDOFF.md
@@ -194,3 +194,39 @@ orchestrator's own shell (exit 144) because the bash -c command line contained t
 literal string. Same bug made `pgrep -f "claude -p"` report a phantom running worker.
 Use the bracket trick (`ps aux | grep "[c]laude -p"`) or match on argv shape
 (`ps -eo pid,args | grep -E "tasks/(wave-guard|run-task)" | grep -v grep`).
+
+## HAZARD #7 — never `git add -A` while workers are running
+The orchestrator committed twice (10:09, 10:22) while E1/E2 were actively writing
+files. `git add -A` swept half-finished wave-3 SOURCE into commits whose messages said
+"orchestration tooling". That silently defeats the whole reason this repo exists as git:
+per-wave `git diff --stat` verification. It also produced a fake-clean `git status`,
+which briefly looked like the workers had produced nothing at all.
+**Rules:**
+- While a wave is in flight, commit with an EXPLICIT pathspec only, e.g.
+  `git add docs/HANDOFF.md tasks/ && git commit ...` — never `-A`, never `.`.
+- Do the wave's own `git add -A` commit only AFTER the sentinel exists and the build
+  and tests have been independently verified.
+- If it happens anyway: `git reset --soft <last-good>`, `git reset`, then re-commit in
+  honest slices. Safe here — the repo has no remote and checkpoints exist. Done once
+  already (commits d947aa7/058e864 were rebuilt into dbb0726 + a022a1b).
+
+## Wave 3 — COMPLETE, verified by the orchestrator on 09-06
+E1 (nav/setup/locations/settings) and E2 (library/detail/scan) both reported SUCCESS;
+E2 took one quota wait and run-task.sh resumed it correctly.
+| Check | Result |
+|---|---|
+| `assembleDebug` | **exit 0** |
+| `testDebugUnitTest` | **exit 0 — 91 tests, 0 failures, 0 errors** (was 68) |
+| boundary check | clean: neither touched build files or the other's packages |
+Commit `a022a1b` (32 files, +3081).
+
+**Known gaps carried into wave 4 — do not lose these:**
+1. **Cover pipeline has NEVER run against a real PocketBase.** Download-on-create and
+   multipart upload-on-sync were only exercised against fakes (worker C's own report).
+   This is the single most likely place a real bug is hiding. Wave 4 must do a live
+   round-trip against 127.0.0.1:8090.
+2. Settings shows the PocketBase user id, not the email — `AuthRepository`/`SettingsStore`
+   never persist the login email (E1's report). Cosmetic, needs a data-layer change.
+3. No Room foreign keys between books/shelves/bookcases (deliberate, worker C).
+4. No emulator on this box: nothing has ever been *run*, only compiled and unit-tested.
+   Paparazzi PNGs are the only evidence of how any of it actually looks.