Function run 

pub fn run(refs: &[PushRef], args: &[OsString]) -> Outcome

Judged on the REFS BEING PUSHED, not on the branch that happens to be checked out.

It used to ask rev-parse --abbrev-ref HEAD, exactly the mistake branch_protect documents avoiding, and it cost two things:

• git push origin local:refs/heads/other validated the wrong name entirely — the one you are standing on rather than the one being created;
• on a DETACHED HEAD, --abbrev-ref HEAD returns the literal string "HEAD", which conforms rejects. The show-branch remotes/origin/HEAD short-circuit hid that in a normal clone, but in a repository with no refs/remotes/origin/HEAD — a bare git init plus git remote add, or after git remote set-head --delete — a perfectly ordinary git push origin HEAD:refs/heads/feat/x was BLOCKED.

The show-branch probe is gone, replaced by the non-zero remote oid: git has already told us whether the branch exists on the server, and the probe depended on a remote-tracking ref that a fresh clone may not have.