diff --git a/.claude/settings.json b/.claude/settings.json
index 6b2dd48..4a2c2e5 100644
--- a/.claude/settings.json
+++ b/.claude/settings.json
@@ -36,6 +36,11 @@
       "Bash(*tofu apply*)", "Bash(*tofu destroy*)",
       "Bash(*tofu import*)", "Bash(*tofu state rm*)",
       "Bash(*--commit*)",
+      "Bash(git merge*)", "Bash(git revert*)", "Bash(git reset*)",
+      "Bash(git rebase*)", "Bash(git branch -D *)",
+      "Bash(bash scripts/* apply*)", "Bash(bash scripts/* install*)",
+      "Bash(ssh * sudo *)",
+      "Skill(*)",
       "Edit(.claude/settings.json)", "Edit(.claude/settings.local.json)"
     ],
     "deny": [
diff --git a/docs/changelog-20260719-phase5-sweep.md b/docs/changelog-20260719-phase5-sweep.md
index 3e133e1..304af28 100644
--- a/docs/changelog-20260719-phase5-sweep.md
+++ b/docs/changelog-20260719-phase5-sweep.md
@@ -67,3 +67,23 @@
 Batch 0 verification: all three touched harnesses green (42/42, 44/44, 33/33),
 full gauntlet + repo-lint results recorded in the batch completion report and the
 ledger entry for this session.
+
+## Out-of-batch: permission posture extension (operator-directed 2026-07-19)
+
+- WHAT: `.claude/settings.json` `ask` list extended -- `Bash(git merge*)`,
+  `Bash(git revert*)`, `Bash(git reset*)`, `Bash(git rebase*)`,
+  `Bash(git branch -D *)`, `Bash(bash scripts/* apply*)`,
+  `Bash(bash scripts/* install*)`, `Bash(ssh * sudo *)`, `Skill(*)`.
+  Nothing added to `allow`; `deny` + the PreToolUse guard hook unchanged.
+- WHY: operator drives sessions via Remote Control without a second terminal;
+  remaining auto-mode classifier HARD-DENIALS (walls) on mutation surfaces
+  matching no ask rule blocked the approve flow entirely (hit live: a Skill
+  invocation hard-denied 2026-07-19). Extends the 2026-07-18 "ask preempts
+  classifier" posture; targeted ask rules chosen over a catch-all `Bash(*)`
+  per doc-cited guidance (ask appears to preempt allow -- a catch-all would
+  destroy frictionless reads). `Skill(*)` syntax is undocumented; verified
+  EMPIRICALLY (post-change Skill invocation prompted + ran; pre-change
+  identical call hard-denied). Remaining walls get their own ask rule when
+  hit -- the settings edit itself now prompts instead of denying.
+- REVERT: `git revert` this commit, or `cp .claude/settings.json.bak` per the
+  operator backup if the bak is refreshed first.