[servicememeai]

Why

Follow-up after Docker #48, Server #41, Hub #87/#50 merged. Two concrete contract holes remained:

1. A selected OPTIONAL repo with unavailable cf_edit_guard was reported by Hub lock-info as checkout_supported=false, indistinguishable from an OFF repo, so the UI could start optimistic editing that native Server necessarily rejects.
2. Before lock-info resolves (or if the reply is malformed), the dialog treated checkout=null as not checked out and enabled ordinary editing.

Minimal changes (Hub only)

• Keep only two library policies: OFF (default) and OPTIONAL; no REQUIRED, no new tables/API modes.
• Preserve checkout_for_repo(), add lightweight checkout_selected() / checkout_unavailable() to distinguish selected-but-broken Guard from unselected OFF.
• OPTIONAL + Guard unavailable: GET lock-info returns 503 GUARD_UNAVAILABLE, and POST edit/v1/open refuses new optimistic/exclusive tickets. Read tickets still work. OFF still returns explicit checkout_supported=false without Guard metadata/SQL.
• Dialog waits for an explicit complete lock response before enabling either edit action. Malformed response is unknown; local viewing remains available.
• Targeted Django + Jest cases; update existing Checkout policy contract.

Verification/rollout

This is source-only and remains separate from Agent2's real Windows/macOS E2E issues #10/#1. No Server, Docker, Rust protocol, or database changes. Do not conflate quick CI with live DEV acceptance.