@@ -1103,6 +1103,46 @@ do not demonstrate a native Gix mismatch or eliminate any CLI calls.
 | Config-backed remote/submodule maintenance | Missing config enumeration/multivar/removal operations (GIX-12), plus filesystem and worktree lifecycle requirements. |
 | Hook execution | Every explicit hook request, including an absent hook, retains Git-managed lookup, execution and diagnostics until GIX-23 is addressed. Native operations retain GitPython's default hook/fsmonitor/maintenance restrictions. |
 
+### Downstream mirror-fetch result gap
+
+Airflow Git provider 1.0.1's bare-cache refspecs
+`+refs/heads/*:refs/heads/*` and `+refs/tags/*:refs/tags/*` expose an existing
+GitPython result-decoding problem when a branch and tag share a name. With Git
+2.53.0, both refs update successfully, but verbose output abbreviates their
+names. The local CLI and Gix selections omit the ambiguous branch result;
+released GitPython 3.2.1 instead returns a nonexistent `refs/remotes/main`
+reference whose commit cannot be read. The same problem occurs with
+`+refs/*:refs/*`. Two preserved real-repository supplemental tests fail with
+all three selections; Airflow's 175 unchanged upstream tests pass.
+
+This is a demonstrated GitPython adapter gap, not a demonstrated Gitoxide
+mismatch. Git's `fetch --porcelain` reports full destination refnames and old/new
+IDs, providing native evidence for a future adapter correction. Fetch remains
+a CLI fallback: GixPython 0.2.0 must expose per-ref identities, status and notes
+before its fetch outcome can satisfy `FetchInfo`. Do not infer namespaces or
+reimplement fetch semantics in Python. Reproduction and baseline evidence are
+retained in the [third downstream audit](../test/downstream/audit-2026-10-22-batch-3.md).
+
+### Downstream empty configuration sections
+
+Kas 5.5's three unchanged SSH key validation tests call
+`GitConfigParser.add_section('gpg "ssh"')` before assigning
+`allowedSignersFile` through a section proxy. They pass with released GitPython
+3.2.1 and fail with both local backends because empty sections and the inherited
+ConfigParser section API were removed. Git 2.53.0's config mutation interface
+and GixPython 0.2.0 do not expose creating an empty section. This is a missing
+capability and an intentional, demonstrated GitPython API break; it is not a
+demonstrated Gitoxide mismatch. No successful empty-section result is invented
+or serialized in Python. GixPython needs a supported native configuration edit
+that creates sections before this contract can be restored.
+
+Kas's separate identity cleanup uses nonempty section assignment, which is
+restored through existing Git config remove/set operations under GIX-12. Values
+are validated before mutation; individual Git operations lock independently,
+so replacement does not claim transaction-wide atomicity. Downstream can avoid
+the empty-section API by calling `set_value('gpg "ssh"', 'allowedSignersFile',
+path)` directly. The three upstream failures remain in the audit.
+
 ## Maintaining the adapters
 
 `git/_backend.py` contains the capability checks. Managed command adapters return
 
@@ -51,6 +51,10 @@ Git executable and safety
 API changes
 -----------
 
+* ``GitConfigParser[section] = values`` again replaces a nonempty section,
+  restoring Kas's Git identity cleanup. Git performs each mutation and locks
+  it independently; replacement is not one atomic transaction. Empty sections
+  and ``add_section()`` remain unsupported, including Kas's SSH key setup.
 * Explicit ``from git import Union`` imports remain available for Demisto SDK's
   validator registration, retaining the historical ``typing.Union`` alias.
 * Editable/source imports expose the release version in ``git.__version__``,
 
@@ -14,6 +14,7 @@
 import sys
 import tempfile
 from contextlib import contextmanager
+from collections.abc import Mapping
 from typing import Any, Dict, Generic, Iterator, List, OrderedDict, Sequence, Tuple, TypeVar, Union, TYPE_CHECKING
 
 from git.compat import defenc, force_text
@@ -491,6 +492,22 @@ def set_value(self, section: str, option: str, value: Any) -> "GitConfigParser":
         self._mutate("set", "--all", "--", key, self._value(value))
         return self
 
+    def __setitem__(self, section: str, values: Mapping[str, Any]) -> None:
+        """Replace a nonempty section through Git's existing config mutations.
+
+        Each value is validated before modifying the file. Git locks individual
+        mutations; section replacement does not reserve a transaction-wide lock.
+        """
+        self._assure_writable("section assignment")
+        if not isinstance(values, Mapping):
+            raise TypeError("Git configuration section values must be a mapping")
+        if not values:
+            raise ValueError("Empty Git configuration sections are unsupported")
+        validated = [(self._key(section, option), self._value(value)) for option, value in values.items()]
+        self.remove_section(section)
+        for key, value in validated:
+            self._mutate("set", "--all", "--", key, value)
+
     def add_value(self, section: str, option: str, value: Any) -> "GitConfigParser":
         key = self._key(section, option)
         self._mutate("set", "--append", "--", key, self._value(value))
 
@@ -22,6 +22,30 @@ def test_legacy_typing_union_import_supports_downstream_registration():
     assert GitUnion is Union
 
 
+@pytest.mark.parametrize("object_format", ["sha1", "sha256"])
+@pytest.mark.parametrize("ref_format", ["files", "reftable"])
+def test_config_section_assignment_restores_downstream_git_identity(object_format, ref_format):
+    with fixture_repo("downstream-index.sh", object_format, ref_format, write=True) as repo:
+        with repo.config_writer() as config:
+            config.set_value("user", "name", "Temporary identity")
+            config.set_value("user", "email", "temporary@example.invalid")
+            config.add_value("user", "email", "duplicate@example.invalid")
+            config.set_value("user", "signingkey", "temporary-key")
+            config.set_value("core", "editor", "retained")
+            config["user"] = {"name": "Original Person", "email": "original@example.invalid"}
+            assert config.get("user", "name") == "Original Person"
+            assert config.get_values("user", "email") == ["original@example.invalid"]
+            assert not config.has_option("user", "signingkey")
+            assert config.get("core", "editor") == "retained"
+            with pytest.raises(ValueError, match="valueless"):
+                config["user"] = {"name": "Discarded", "email": None}
+            assert config.get("user", "name") == "Original Person"
+            with pytest.raises(ValueError, match="Empty"):
+                config["user"] = {}
+        assert repo.git.config("get", "user.name") == "Original Person"
+        assert repo.git.config("get", "user.email") == "original@example.invalid"
+
+
 @pytest.mark.parametrize("object_format", ["sha1", "sha256"])
 @pytest.mark.parametrize("ref_format", ["files", "reftable"])
 def test_repo_accepts_explicit_literal_path_selection(object_format, ref_format, monkeypatch):