Pin the Roots or Don't Merge: A Fail-Closed Agent Egress Checklist

· Dev.to