@mmnto/cli 2.2.1 → 2.4.0

package/dist/commands/init-templates.js

@@ -1347,9 +1347,12 @@ export const CLAUDE_SESSION_START_ENTRY = {
 //   subsystem IS present does the wrapper shell out; only then can a broken
 //   deterministic source (corrupt freeze.json) fail-close (exit 2).
 //
-// Tier (--strict default / --pilot) is read by the WRAPPER, not the engine
-// (the engine stays pure per ADR-109 [LOCKED]; freeze-check never emits
-// `warn`). The tier is BAKED into the installed command string at install
+// Tier (--strict default / --pilot) is read by the WRAPPER and, since
+// mmnto-ai/totem#2800 (R1), also FORWARDED to `gate check --tier` so a gate can
+// apply it to its OWN unevaluable class (merge-ready warns under pilot where a
+// read failed to derive; freeze-check ignores it and fails closed at every
+// tier). The engine stays pure — the tier is an input, not state. The tier is
+// BAKED into the installed command string at install
 // time and read ONLY from argv — there is NO env-var override, so a default
 // (`--strict`) install is enforcement-immune to a consumer's environment
 // (env-var sourcing would be a fail-open: a `TOTEM_GATE_TIER=pilot` in any
@@ -1370,7 +1373,8 @@ export const CLAUDE_GATE_WRAPPER = `// [totem] auto-generated — Claude Code ac
 //   0 = allow | warn | --pilot deny | NOT-APPLICABLE fail-soft
 //       (unparseable/non-object envelope; freeze-check with no declared
 //        subsystem; transport-shield on a tool other than Bash/PowerShell or
-//        with no non-empty string command)
+//        with no non-empty string command; merge-ready on any command that is
+//        not \`gh pr merge\` at command position)
 //   2 = deny (--strict, Claude block convention)
 //       | APPLICABLE-gate-not-evaluable fail-closed (no CLI resolvable
 //         (repo-local, then PATH), non-zero \`gate check\`, unparseable verdict,
@@ -1465,6 +1469,554 @@ for (let i = 0; i < argv.length; i++) {
   }
 }
 
+// ─── merge-ready: \`gh pr merge\` at COMMAND POSITION + its payload ──────
+//
+// One walk over the command text does BOTH jobs, so recognition and argv
+// extraction can never disagree: it tracks quoting, splits on the unquoted
+// command separators (\`;\`, \`&\`, \`|\`, a newline, \`(\`/\`)\`, \`{\`/\`}\`) and
+// tokenizes each segment. A segment whose FIRST token is \`gh\`, followed by
+// \`pr\` and \`merge\`, is a merge at command position; a quoted
+// "gh pr merge" is a single token and never matches, so
+// \`echo "gh pr merge"\` does not fire. The shell's own COMMAND-POSITION words
+// are skipped before the anchor is read — the reserved words \`do\`, \`then\`,
+// \`else\`, \`if\`, \`elif\`, \`while\`, \`until\` and \`!\`, the builtins \`exec\` and
+// \`command\` (which run their operand as the command), and any run of
+// \`NAME=value\` assignment prefixes — so \`for … ; do gh pr merge; done\`,
+// \`if gh pr merge 5; then …\` and \`GH_TOKEN=x gh pr merge 5\` all fire. Before
+// the PR's review round only \`do\`/\`then\`/\`else\`/\`!\` were skipped, so a merge
+// used AS an \`if\` condition, or behind an assignment prefix, went unjudged
+// (mmnto-ai/totem#2844 round 1, greptile). EVERY matching segment is
+// collected, not the first: \`gh pr merge 7; gh pr merge 8\` yields two argv
+// lists and the wrapper judges each PR on its own facts (same round).
+//
+// HEREDOC BODIES ARE BLANKED FIRST (mmnto-ai/totem#2800 fold F4). A heredoc
+// body is DATA, not commands: \`cat <<EOF\` … \`gh pr merge 5\` … \`EOF\` writes a
+// line of text and merges nothing, and firing there was a false deny — the one
+// direction this projection must not have. The blanker is the shape core's
+// transport-shield scanner uses, in a self-contained form because a distributed
+// hook cannot import core: quoted (\`<<'EOF'\`, \`<<"EOF"\`, \`<<\\EOF\`) and bare
+// delimiters, \`<<\` and \`<<-\` (whose terminator may be tab-indented), an
+// unterminated body read to the end of the command, and \`<<<\` left alone (a
+// here-string is not a heredoc). Round 2 added the two guards that keep the
+// blanker from EATING commands: \`$(( … ))\` / \`(( … ))\` is skipped whole, so a
+// shift (\`$((1<<2))\`) opens nothing, and a \`#\` that begins a word is a comment
+// discarded to end-of-line, so neither its text nor a \`<<note\` inside it is
+// read — before them, either one swallowed the rest of the command and a real
+// merge after it went unjudged. Every \`<<\` on the operator line is queued and
+// its body consumed in order, as bash does for \`cat <<A <<B\`.
+//
+// Disclosed misses, same posture as transport-shield's scanner — the gate does
+// NOT fire, which is the safe direction, never a false deny:
+//   - a wrapper PROGRAM that takes operands before \`gh\` (\`sudo\`, \`timeout 30\`,
+//     \`npx\`, \`env\`, \`nohup\`): the program is the segment's first token, so the
+//     position anchor does not see \`gh\` (the shell's reserved words and the
+//     \`exec\`/\`command\`/\`eval\` builtins are skipped; an arbitrary program is
+//     not, since the walk cannot know which of its operands is the command);
+//   - the executable spelled with an extension or a path (\`gh.exe pr merge 5\`,
+//     \`./gh pr merge 5\`): the anchor reads the bare token \`gh\` only (greptile
+//     on mmnto-ai/totem#2855; widening it is mmnto-ai/totem#2856, the strict
+//     tier's precondition);
+//   - two places this blanker still diverges from core's scanner, each opening
+//     a heredoc core does not so that a merge on a later line is blanked: a
+//     \`#\` right after \`(\` or after an operator \`)\` (no paren-boundary arms
+//     here — \`(true)#<<note\` then a merge line), and a bare delimiter carrying
+//     a character outside \`[A-Za-z0-9_.-/]\` (\`<<E:F\`, read as the prefix \`E\`
+//     so the real terminator never matches). Both found by the pilot-install
+//     legs; the cure is one shared scanner, mmnto-ai/totem#2857;
+//   - a skipped word carrying a FLAG (\`command -p gh pr merge 5\`,
+//     \`exec -a x gh pr merge 5\`, and the reserved word's own \`time -p\` /
+//     \`time --\`): the flag is a token before \`gh\`, and bash runs the merge
+//     all the same (round 3, F1);
+//   - a merge handed over as ONE quoted word (\`eval "gh pr merge 5"\`,
+//     \`bash -c "gh pr merge 5"\`): a quoted string is data to this walk;
+//   - a backtick command substitution (\`echo \\\`gh pr merge 5\\\`\`): the walk
+//     splits on \`$( … )\` parens but treats a backtick as an ordinary character,
+//     so the merge inside it stays part of \`echo\`'s segment;
+//   - a leading redirection (\`> out.txt gh pr merge 5\`): the redirection word
+//     is the segment's first token;
+//   - PowerShell's own quoting (backtick escapes, here-strings) is not
+//     modelled — the walk reads POSIX quoting for both tools.
+// Disclosed FALSE FIRES, the deny direction, all contrived — text the shell
+// does not execute as a merge but that sits at a segment's front here: a bash
+// array assignment whose elements spell a merge (\`A=(gh pr merge 8)\`) is judged
+// as a merge of 8, because \`(\` is a separator and the segment inside it starts
+// with \`gh\`; a \`case\` pattern \`gh pr merge)\` yields an EMPTY argv, which
+// projects to the current branch's PR (both surfaced when every segment began
+// to be collected, round 2 F6); and a function DEFINITION whose body is a
+// merge (\`f() { gh pr merge 5; }\`) fires at definition time, because \`{\` is a
+// separator and the body is its own segment (round 3, F4; it fired before this
+// PR's rounds too). \`TOTEM_MERGE_GATE_OVERRIDE=1\` is the audited way past any
+// of them.
+// Which characters END a word, so the scanner can say whether the next one
+// BEGINS one. Same set core's scanner uses (mmnto-ai/totem#2800 round 2, F1).
+function isWordBoundary(ch) {
+  return (
+    ch === ' ' ||
+    ch === '\\t' ||
+    ch === '\\r' ||
+    ch === '\\n' ||
+    ch === ';' ||
+    ch === '|' ||
+    ch === '&'
+  );
+}
+
+// The index just past the \`))\` that closes an arithmetic expansion whose
+// opening \`$((\` / \`((\` ends at \`from\`; the end of the command when it is
+// unterminated. A \`<<\` inside is a SHIFT, never a heredoc operator — without
+// this guard \`echo $((1<<2))\` opened a heredoc and swallowed every command
+// after it, so a real \`gh pr merge\` went unjudged (F1).
+function skipArithmetic(command, from) {
+  let depth = 2;
+  let i = from;
+  while (i < command.length) {
+    const ch = command[i];
+    if (ch === '(') depth += 1;
+    else if (ch === ')') {
+      depth -= 1;
+      if (depth === 0) return i + 1;
+    }
+    i += 1;
+  }
+  return command.length;
+}
+
+function blankHeredocBodies(command, powershell) {
+  let out = '';
+  let i = 0;
+  let quote = '';
+  let boundary = true;
+  let pending = [];
+
+  // Consume EVERY body queued on the operator line, in order, starting just
+  // past that line's newline — bash reads \`cat <<A <<B\` as two bodies, so a
+  // command sitting in B's body is data too (F2). Terminator lines are kept;
+  // body lines are dropped with their newlines, so the segments around them
+  // stay separated exactly as the shell separates them. An unterminated body
+  // runs to the end and is dropped whole.
+  const consumeBodies = (from) => {
+    let cursor = from;
+    for (let p = 0; p < pending.length; p++) {
+      const h = pending[p];
+      let at = cursor;
+      cursor = command.length;
+      while (at <= command.length) {
+        const nl = command.indexOf('\\n', at);
+        const stop = nl === -1 ? command.length : nl;
+        let line = command.slice(at, stop);
+        if (h.stripTabs) line = line.replace(/^\\t+/, '');
+        line = line.replace(/\\r$/, '');
+        const next = nl === -1 ? command.length : nl + 1;
+        if (line === h.delimiter) {
+          out += command.slice(at, next);
+          cursor = next;
+          break;
+        }
+        if (nl === -1) break;
+        out += '\\n';
+        at = next;
+      }
+    }
+    pending = [];
+    return cursor;
+  };
+
+  while (i < command.length) {
+    const ch = command[i];
+    if (quote !== '') {
+      out += ch;
+      if (ch === '\\\\' && quote === '"' && i + 1 < command.length) {
+        out += command[i + 1];
+        i += 2;
+        continue;
+      }
+      if (ch === quote) quote = '';
+      i++;
+      boundary = false;
+      continue;
+    }
+    if (ch === "'" || ch === '"') {
+      quote = ch;
+      out += ch;
+      i++;
+      boundary = false;
+      continue;
+    }
+    // A backslash before a NEWLINE is a line continuation: the shell removes
+    // both characters and the command carries on, so the scanner must too
+    // (mmnto-ai/totem#2800 round 3, F6). Absorbing the newline into a token is
+    // what hid \`gh \\<LF>pr merge 5\` from the position anchor.
+    if (ch === '\\\\' && (command[i + 1] === '\\n' || (command[i + 1] === '\\r' && command[i + 2] === '\\n'))) {
+      i += command[i + 1] === '\\r' ? 3 : 2;
+      continue;
+    }
+    if (ch === '\\\\' && i + 1 < command.length) {
+      out += ch + command[i + 1];
+      i += 2;
+      boundary = false;
+      continue;
+    }
+    // A \`#\` that BEGINS a word is a comment: discarded to the end of the line
+    // WITHOUT quote processing, so neither its text nor a \`<<note\` inside it
+    // reaches the tokenizer (F1). The newline stays — it may end an operator
+    // line whose bodies are still queued.
+    if (ch === '#' && boundary) {
+      const nl = command.indexOf('\\n', i);
+      i = nl === -1 ? command.length : nl;
+      continue;
+    }
+    // PowerShell's \`<# … #>\` block comment is data, not commands: blank it
+    // whole, the way a heredoc body is blanked (round 3, F8). Applied ONLY when
+    // the TOOL is PowerShell (round 4, F8): bash has no such comment, and there
+    // \`sort <#tmp\` is a redirect from a file named \`#tmp\` — blanking from it
+    // to a later \`#>\` would swallow real commands. A \`<#\` inside a quoted
+    // string never reaches here, because the quote arms run first.
+    if (powershell && ch === '<' && command[i + 1] === '#') {
+      const close = command.indexOf('#>', i + 2);
+      i = close === -1 ? command.length : close + 2;
+      boundary = true;
+      continue;
+    }
+    if (ch === '$' && command.slice(i, i + 3) === '$((') {
+      const end = skipArithmetic(command, i + 3);
+      out += command.slice(i, end);
+      i = end;
+      boundary = false;
+      continue;
+    }
+    // A command or process substitution opens a word: a \`#\` glued to \`$(\` is
+    // a comment, as core's scanner reads it. Without this arm the boundary
+    // stayed false, the \`#\` was text, and a \`<<word\` inside it opened a
+    // heredoc whose body swallowed every later line — the same fail-open class
+    // as the here-string (the pilot-install re-arm, R2, mmnto-ai/totem#2855).
+    if ((ch === '$' || ch === '<' || ch === '>') && command[i + 1] === '(') {
+      out += ch + '(';
+      i += 2;
+      boundary = true;
+      continue;
+    }
+    if (ch === '(' && command[i + 1] === '(' && boundary) {
+      const end = skipArithmetic(command, i + 2);
+      out += command.slice(i, end);
+      i = end;
+      boundary = false;
+      continue;
+    }
+    // \`<<\` opens a heredoc; \`<<<\` is a here-string and is left alone — at
+    // BOTH of its first two characters (the preceding-character guard core's
+    // scanner carries; without it the second \`<\` of \`<<<\` opened a heredoc
+    // whose body swallowed every later line, a fail-open path — CodeRabbit on
+    // mmnto-ai/totem#2855).
+    if (ch === '<' && command[i + 1] === '<' && command[i - 1] !== '<' && command[i + 2] !== '<') {
+      let j = i + 2;
+      let head = '<<';
+      let dash = false;
+      if (command[j] === '-') {
+        dash = true;
+        head += '-';
+        j++;
+      }
+      while (j < command.length && (command[j] === ' ' || command[j] === '\\t')) {
+        head += command[j];
+        j++;
+      }
+      // The delimiter word, quoted (\`<<'EOF'\`, \`<<"EOF"\`) or bare, with a
+      // backslash-quoted form (\`<<\\EOF\`) read as bash reads it.
+      let delim = '';
+      const q = command[j] === "'" || command[j] === '"' ? command[j] : '';
+      if (q !== '') {
+        head += q;
+        j++;
+      }
+      while (j < command.length) {
+        const c = command[j];
+        if (q !== '') {
+          head += c;
+          j++;
+          if (c === q) break;
+          delim += c;
+          continue;
+        }
+        if (c === '\\\\' && j + 1 < command.length) {
+          head += c + command[j + 1];
+          delim += command[j + 1];
+          j += 2;
+          continue;
+        }
+        if (/[A-Za-z0-9_.\\-\\/]/.test(c)) {
+          head += c;
+          delim += c;
+          j++;
+          continue;
+        }
+        break;
+      }
+      out += head;
+      i = j;
+      boundary = false;
+      if (delim !== '') pending.push({ delimiter: delim, stripTabs: dash });
+      continue;
+    }
+    if (ch === '\\n') {
+      out += '\\n';
+      i += 1;
+      if (pending.length > 0) i = consumeBodies(i);
+      boundary = true;
+      continue;
+    }
+    out += ch;
+    boundary = isWordBoundary(ch);
+    i++;
+  }
+  return out;
+}
+
+// The words the shell reads at command position that are NOT the command:
+// reserved words that introduce a compound command (\`time\` and \`coproc\` are
+// reserved words too — the round-2 leg found them missing), the negation, and
+// the builtins that execute their operand as the command (\`exec\`, \`command\`,
+// and \`eval\` on an UNQUOTED operand — \`eval "gh pr merge 5"\` hands the shell a
+// single quoted word, which this walk reads as data, a disclosed miss below).
+// Stripped from a segment's front, in any run, before the \`gh pr merge\`
+// anchor is read.
+const COMMAND_POSITION_WORDS = [
+  'do',
+  'then',
+  'else',
+  'if',
+  'elif',
+  'while',
+  'until',
+  'time',
+  'coproc',
+  '!',
+  'exec',
+  'command',
+  'eval',
+];
+
+// A \`NAME=value\` word at a segment's front is an assignment PREFIX to the
+// command that follows it (\`GH_TOKEN=x gh pr merge 5\`), never the command.
+function isAssignmentPrefix(token) {
+  return /^[A-Za-z_][A-Za-z0-9_]*=/.test(token);
+}
+
+/**
+ * The argv after EVERY \`gh pr merge\` at command position in the command —
+ * one array per merge, in command order — or an empty array when there is
+ * none. A compound command that merges twice yields two, and the wrapper
+ * judges each (mmnto-ai/totem#2844 round 1).
+ */
+function ghPrMergeArgvs(rawCommand, powershell) {
+  const command = blankHeredocBodies(rawCommand, powershell === true);
+  const segments = [];
+  let current = [];
+  let token = '';
+  let hasToken = false;
+  let i = 0;
+  const endToken = () => {
+    if (hasToken) {
+      current.push(token);
+      token = '';
+      hasToken = false;
+    }
+  };
+  const endSegment = () => {
+    endToken();
+    segments.push(current);
+    current = [];
+  };
+  while (i < command.length) {
+    const ch = command[i];
+    if (ch === "'") {
+      hasToken = true;
+      i++;
+      while (i < command.length && command[i] !== "'") {
+        token += command[i];
+        i++;
+      }
+      i++;
+      continue;
+    }
+    if (ch === '"') {
+      hasToken = true;
+      i++;
+      while (i < command.length && command[i] !== '"') {
+        if (command[i] === '\\\\' && i + 1 < command.length) {
+          token += command[i + 1];
+          i += 2;
+          continue;
+        }
+        token += command[i];
+        i++;
+      }
+      i++;
+      continue;
+    }
+    // A parameter expansion is ONE word: without this, \`\${PR}\` splits on its
+    // braces and the unresolved-target evidence line reads just "$"
+    // (mmnto-ai/totem#2800 round 2, F10). A \`$( … )\` is deliberately NOT
+    // swallowed the same way — a real \`gh pr merge\` inside a command
+    // substitution has to keep firing, so its parens stay separators.
+    if (ch === '$' && command[i + 1] === '{') {
+      const close = command.indexOf('}', i + 2);
+      const end = close === -1 ? command.length : close + 1;
+      token += command.slice(i, end);
+      hasToken = true;
+      i = end;
+      continue;
+    }
+    if (ch === ' ' || ch === '\\t' || ch === '\\r') {
+      endToken();
+      i++;
+      continue;
+    }
+    if (
+      ch === ';' ||
+      ch === '&' ||
+      ch === '|' ||
+      ch === '\\n' ||
+      ch === '(' ||
+      ch === ')' ||
+      ch === '{' ||
+      ch === '}'
+    ) {
+      endSegment();
+      i++;
+      continue;
+    }
+    // A line continuation joins the two halves of ONE word (\`gh \\<LF>pr\` is
+    // \`ghpr\` to the shell, and \`gh \\<LF>pr merge\` keeps \`gh\` at the front of
+    // the segment): drop both characters and keep tokenizing (round 3, F6).
+    if (ch === '\\\\' && (command[i + 1] === '\\n' || (command[i + 1] === '\\r' && command[i + 2] === '\\n'))) {
+      i += command[i + 1] === '\\r' ? 3 : 2;
+      continue;
+    }
+    if (ch === '\\\\' && i + 1 < command.length) {
+      token += command[i + 1];
+      hasToken = true;
+      i += 2;
+      continue;
+    }
+    token += ch;
+    hasToken = true;
+    i++;
+  }
+  endSegment();
+
+  const found = [];
+  for (const segment of segments) {
+    let tokens = segment;
+    while (
+      tokens.length > 0 &&
+      (COMMAND_POSITION_WORDS.indexOf(tokens[0]) !== -1 || isAssignmentPrefix(tokens[0]))
+    ) {
+      tokens = tokens.slice(1);
+    }
+    if (tokens.length >= 3 && tokens[0] === 'gh' && tokens[1] === 'pr' && tokens[2] === 'merge') {
+      found.push(tokens.slice(3));
+    }
+  }
+  return found;
+}
+
+/** Run git read-only and return trimmed stdout, or '' when it did not answer. */
+function gitRead(args) {
+  const res = spawnSync('git', args, { encoding: 'utf-8', timeout: 10000 });
+  if (res.error || typeof res.status !== 'number' || res.status !== 0) return '';
+  return (res.stdout || '').trim();
+}
+
+/** \`owner/name\` out of any git remote URL shape (ssh, https, with or without .git). */
+function repoFromRemote(url) {
+  const m = /[:/]([^/:]+)\\/([^/]+?)(?:\\.git)?$/.exec(url.trim());
+  return m ? m[1] + '/' + m[2] : '';
+}
+
+// The flags of \`gh pr merge\` that CONSUME the next argv element — without this
+// list, \`gh pr merge -b "some branch"\` would read the body as the PR target.
+const GH_MERGE_VALUE_FLAGS = [
+  '-R',
+  '--repo',
+  '-b',
+  '--body',
+  '-F',
+  '--body-file',
+  '-t',
+  '--subject',
+  '--match-head-commit',
+  '--author-email',
+];
+
+/**
+ * Project { repo, pr, branch?, headSha? } from the argv after \`gh pr merge\`:
+ * a number, a PR URL, a branch, \`-R/--repo\`. With no argument at all, gh
+ * merges the PR for the CURRENT branch — so the payload carries pr: null plus
+ * that branch, exactly as the gate's payload contract allows.
+ */
+function projectMergeReady(argv) {
+  let repo = '';
+  let pr = null;
+  let branch = '';
+  let positional = null;
+
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
+    const eq = arg.indexOf('=');
+    if (arg.slice(0, 2) === '--' && eq > 2) {
+      if (arg.slice(0, eq) === '--repo') repo = arg.slice(eq + 1);
+      continue;
+    }
+    if (GH_MERGE_VALUE_FLAGS.indexOf(arg) !== -1) {
+      if (arg === '-R' || arg === '--repo') repo = argv[i + 1] || '';
+      i++;
+      continue;
+    }
+    if (arg.charAt(0) === '-') continue;
+    if (positional === null) positional = arg;
+  }
+
+  // An UNEXPANDED shell variable (\`gh pr merge $PR\`) is not a target this
+  // projection can know (mmnto-ai/totem#2800 fold F13): the shell expands it
+  // after the hook has already decided. Reading it as a branch name would judge
+  // the wrong PR — or none — so it rides as \`unresolvedTarget\`, which the
+  // engine treats as unevaluable (strict denies, pilot warns).
+  let unresolvedTarget = '';
+  if (positional !== null && /[$\`]/.test(positional)) {
+    unresolvedTarget = positional;
+    positional = null;
+  }
+
+  if (positional !== null) {
+    const url = /^https?:\\/\\/[^/]+\\/([^/]+)\\/([^/]+)\\/pull\\/(\\d+)/.exec(positional);
+    if (url) {
+      if (repo === '') repo = url[1] + '/' + url[2];
+      pr = parseInt(url[3], 10);
+    } else if (/^\\d+$/.test(positional)) {
+      pr = parseInt(positional, 10);
+    } else {
+      branch = positional;
+    }
+  }
+
+  // gh itself honours GH_REPO before the git remote; mirror that order so the
+  // gate reads the SAME pull request the command would merge.
+  if (repo === '') repo = (process.env.GH_REPO || '').trim();
+  if (repo === '') repo = repoFromRemote(gitRead(['config', '--get', 'remote.origin.url']));
+  // The current-branch fallback is for a command that named NO target. An
+  // unresolved one named a target we could not read, so it must not fall back.
+  if (pr === null && branch === '' && unresolvedTarget === '') {
+    branch = gitRead(['rev-parse', '--abbrev-ref', 'HEAD']);
+  }
+
+  const headSha = gitRead(['rev-parse', 'HEAD']);
+  const out = { repo: repo, pr: pr };
+  if (branch !== '') out.branch = branch;
+  if (unresolvedTarget !== '') out.unresolvedTarget = unresolvedTarget;
+  if (/^[0-9a-f]{40}$/i.test(headSha)) out.headSha = headSha;
+  return out;
+}
+
 // Read the PreToolUse stdin envelope.
 let stdin = '';
 process.stdin.setEncoding('utf-8');
@@ -1507,8 +2059,15 @@ process.stdin.on('end', () => {
   //   transport-shield | tool_name is Bash or PowerShell   | { tool, command, platform }
   //                    | AND tool_input.command is a       |
   //                    | non-empty string                  |
+  //   merge-ready      | tool_name is Bash or PowerShell   | { repo, pr, branch?, headSha? }
+  //                    | AND the command runs \`gh pr merge\`|
+  //                    | at COMMAND POSITION               |
   //   (anything else)  | — no projection → fail closed     | —
-  let payload = '';
+  //
+  // A projection yields ONE payload per gate evaluation — and merge-ready can
+  // yield several for one envelope (one per \`gh pr merge\` at command
+  // position), each judged on its own below.
+  let payloads = [];
 
   if (event === 'freeze-check') {
     // THE EMPTY-SUBSYSTEM GUARDRAIL: freeze-check's predicate is on a DECLARED
@@ -1523,7 +2082,7 @@ process.stdin.on('end', () => {
     if (declaredSubsystem === '') {
       process.exit(0);
     }
-    payload = JSON.stringify({ subsystem: declaredSubsystem });
+    payloads = [JSON.stringify({ subsystem: declaredSubsystem })];
   } else if (event === 'transport-shield') {
     // transport-shield's predicate is on a SHELL COMMAND. Anything that is not
     // a Bash/PowerShell invocation carrying a command string is NOT an
@@ -1537,11 +2096,34 @@ process.stdin.on('end', () => {
     if (typeof input.command !== 'string' || input.command.trim() === '') {
       process.exit(0);
     }
-    payload = JSON.stringify({
-      tool: tool,
-      command: input.command,
-      platform: process.platform,
-    });
+    payloads = [
+      JSON.stringify({
+        tool: tool,
+        command: input.command,
+        platform: process.platform,
+      }),
+    ];
+  } else if (event === 'merge-ready') {
+    // merge-ready's predicate is on a PULL REQUEST about to be merged. The gate
+    // installs under Bash|PowerShell, so this branch sees every shell command:
+    // anything that is not \`gh pr merge\` at COMMAND POSITION is NOT an
+    // applicable gate → pass through (exit 0) WITHOUT spawning.
+    const tool = parsed.tool_name;
+    if (tool !== 'Bash' && tool !== 'PowerShell') {
+      process.exit(0);
+    }
+    if (typeof input.command !== 'string' || input.command.trim() === '') {
+      process.exit(0);
+    }
+    const merges = ghPrMergeArgvs(input.command, tool === 'PowerShell');
+    if (merges.length === 0) {
+      process.exit(0);
+    }
+    // One payload per merge: \`gh pr merge 7; gh pr merge 8\` is judged twice,
+    // each PR against its own facts (mmnto-ai/totem#2844 round 1).
+    for (let m = 0; m < merges.length; m++) {
+      payloads.push(JSON.stringify(projectMergeReady(merges[m])));
+    }
   } else {
     // A baked --event this wrapper cannot project is an APPLICABLE gate it
     // cannot evaluate → fail closed (ADR-109). Reinstalling refreshes the
@@ -1552,6 +2134,17 @@ process.stdin.on('end', () => {
     process.exit(2);
   }
 
+  // No payload past the projection is not an applicable gate that passed — it
+  // is a branch above that forgot to project, and before the loop that shape
+  // fail-closed through the child's non-zero exit. Keep the default closed
+  // (round 2, F7).
+  if (payloads.length === 0) {
+    process.stderr.write(
+      '[totem gate-wrapper] event "' + event + '" projected no payload; failing closed.\\n',
+    );
+    process.exit(2);
+  }
+
   // Resolve the Totem CLI: the repo-local pinned dist FIRST (a global \`totem\`
   // may be stale and missing deps — the known repo gotcha; the
   // pinned-beats-ambient ordering of ADR-072 § 2, Tenet 14), then a \`totem\` on
@@ -1612,11 +2205,24 @@ process.stdin.on('end', () => {
   // 32,767 characters — an argv payload past it fails the spawn with
   // ENAMETOOLONG and would land in the fail-closed arm below with nothing
   // broken (mmnto-ai/totem#2799, pass 3).
-  const result = spawnSync(
-    process.execPath,
-    [cliPath, 'gate', 'check', '--event', event, '--payload', '-'],
-    { encoding: 'utf-8', timeout: 30000, input: payload },
-  );
+  // The baked tier rides along (mmnto-ai/totem#2800 R1): the ENGINE owns the
+  // strict/pilot split for a gate's UNEVALUABLE class (a read that could not
+  // derive), while the disposition → exit map below stays the wrapper's. A gate
+  // that ignores the tier — freeze-check — still fails closed at both.
+  //
+  // \`--tier\` is forwarded ONLY when it is NOT the default (fold F3): a CLI at
+  // or below 2.2.1 has no such option and would exit non-zero with
+  // "unknown option", which is the fail-closed arm — and on a
+  // \`Bash|PowerShell\` gate that re-creates the mmnto-ai/totem#2822 bootstrap
+  // self-block through the PATH arm. \`strict\` IS the engine's default, so a
+  // strict wrapper stays runnable against a 2.2.x CLI; a \`--pilot\` install
+  // passes the flag and needs a CLI at 2.3.0 or newer (the install-time
+  // disclosure says so).
+  const checkArgs = [cliPath, 'gate', 'check', '--event', event];
+  if (tier !== 'strict') {
+    checkArgs.push('--tier', tier);
+  }
+  checkArgs.push('--payload', '-');
 
   // Provenance for the PATH fallback arm (mmnto-ai/totem#2822): a CLI older
   // than 2.2.0 has no \`gate check --payload -\` and lands in the fail-closed
@@ -1624,75 +2230,128 @@ process.stdin.on('end', () => {
   // BEHAVIOUR is unchanged — exit 2 either way — the line only names WHICH CLI
   // evaluated and how to update it. Empty on the repo-local arm. It prints the
   // basename rendering, never the absolute entry: this is transcript-bound text.
+  // The floor NAMED here is the floor this wrapper actually needs: a strict
+  // wrapper sends no \`--tier\`, so 2.2.0 (the \`--payload -\` cut) still answers
+  // it; a pilot wrapper sends \`--tier pilot\`, which only 2.3.0 and newer parse
+  // (mmnto-ai/totem#2800 fold F3).
   const armNote =
     arm === 'PATH'
       ? 'evaluated by the PATH CLI at ' +
         cliDisplay +
-        "; a CLI older than 2.2.0 lacks 'gate check --payload -' — " +
+        (tier === 'strict'
+          ? "; a CLI older than 2.2.0 lacks 'gate check --payload -' — "
+          : "; a CLI older than 2.3.0 lacks 'gate check --tier' (this entry is baked --pilot) — ") +
         'update it: npm i -g @mmnto/cli@latest\\n'
       : '';
 
-  // ─── FAIL-CLOSED ──────────────────────────────────────────────────────
-  // A gate genuinely applies (the per-event projection above found its input:
-  // a declared subsystem, or a Bash/PowerShell command) and the evaluation
-  // itself failed (non-zero exit: corrupt freeze.json, an invalid payload,
-  // spawn error, etc.). Never silently allow when an applicable gate's source
-  // is broken → exit 2. (Not-applicable envelopes already returned exit 0
-  // above, so this only blocks when the gate's input was actually present.)
-  if (result.error || typeof result.status !== 'number' || result.status !== 0) {
-    process.stderr.write(
-      '[totem gate-wrapper] gate "' +
-        event +
-        '" evaluation failed (source broken or unavailable) — blocking (fail-closed).\\n' +
-        (result.stderr || (result.error ? String(result.error.message || result.error) : '')) +
-        '\\n' +
-        armNote,
-    );
-    process.exit(2);
-  }
+  // ─── One evaluation per projected payload ─────────────────────────────
+  // freeze-check and transport-shield project exactly one. merge-ready projects
+  // one per \`gh pr merge\` at command position, so \`gh pr merge 7; gh pr merge 8\`
+  // is judged TWICE, each PR on its own facts — judging only the first let the
+  // shell run the second unjudged (mmnto-ai/totem#2844 round 1). The first
+  // strict deny, and every fail-closed arm, EXITS at once; a warn, and a deny
+  // under --pilot, print their line and let the NEXT payload be judged, so every
+  // merge in the envelope gets its stderr line; exit 0 only once every payload
+  // has allowed or warned.
+  //
+  // ONE 30-second budget across every payload, not 30 seconds each (round 2,
+  // F5): the hook host kills a PreToolUse hook at its own default budget (60 s
+  // on both Claude Code and Gemini, the same figure the session-hook templates
+  // above cut their legs against) and a killed hook's exit code is never
+  // applied — a fail-OPEN on a gate whose posture is fail-closed. With the
+  // budget shared, the loop's wall time is bounded at 30 s plus the one-second
+  // floor each payload past the budget still gets (round 3, F2), and a merge
+  // that cannot be judged inside it lands in the fail-closed arm below (the
+  // spawn times out → \`result.error\`) rather than in the host's kill. What the
+  // budget does NOT cover, disclosed (round 3, F3): the projection above runs
+  // up to three \`gitRead\`s per merge, each on its own 10 s timeout, before this
+  // deadline exists — a hung git on a multi-merge envelope can still reach the
+  // host's budget through them.
+  const deadline = Date.now() + 30000;
+  for (let p = 0; p < payloads.length; p++) {
+    const result = spawnSync(process.execPath, checkArgs, {
+      encoding: 'utf-8',
+      timeout: Math.max(1000, deadline - Date.now()),
+      input: payloads[p],
+    });
 
-  let verdict;
-  try {
-    verdict = JSON.parse(result.stdout || '');
-  } catch (err) {
-    // The command emitted unparseable stdout despite a 0 exit — an applicable
-    // gate whose verdict we cannot read is a broken source → fail-closed.
+    // ─── The child's stderr IS a gate surface (fold F1) ──────────────────
+    // merge-ready's audited-override line, its zero-checks fact and every
+    // "could not derive" line are written by the ENGINE to stderr. Passing them
+    // through verbatim in EVERY arm — allow included — is what puts them in the
+    // transcript; printing them only on failure hid the override's audit trail,
+    // the one line that must never be silent.
+    if (typeof result.stderr === 'string' && result.stderr !== '') {
+      process.stderr.write(result.stderr);
+    }
+
+    // ─── FAIL-CLOSED ────────────────────────────────────────────────────
+    // A gate genuinely applies (the per-event projection above found its input:
+    // a declared subsystem, or a Bash/PowerShell command) and the evaluation
+    // itself failed (non-zero exit: corrupt freeze.json, an invalid payload,
+    // spawn error, etc.). Never silently allow when an applicable gate's source
+    // is broken → exit 2. (Not-applicable envelopes already returned exit 0
+    // above, so this only blocks when the gate's input was actually present.)
+    if (result.error || typeof result.status !== 'number' || result.status !== 0) {
+      process.stderr.write(
+        '[totem gate-wrapper] gate "' +
+          event +
+          '" evaluation failed (source broken or unavailable) — blocking (fail-closed).\\n' +
+          // The child's stderr already went through verbatim above (fold F1);
+          // only a spawn-level error (no child, so no stderr) is added here.
+          (result.error ? String(result.error.message || result.error) + '\\n' : '') +
+          armNote,
+      );
+      process.exit(2);
+    }
+
+    let verdict;
+    try {
+      verdict = JSON.parse(result.stdout || '');
+    } catch (err) {
+      // The command emitted unparseable stdout despite a 0 exit — an applicable
+      // gate whose verdict we cannot read is a broken source → fail-closed.
+      process.stderr.write(
+        '[totem gate-wrapper] gate "' + event + '" emitted unparseable verdict — blocking (fail-closed).\\n' + armNote,
+      );
+      process.exit(2);
+    }
+
+    // ─── Disposition → host exit code (branch ONLY on disposition) ───────
+    const disposition = verdict && typeof verdict.disposition === 'string' ? verdict.disposition : '';
+    // reason/provenance are OPAQUE stderr passthrough — never parsed for control flow.
+    const detail =
+      (verdict && verdict.reason ? verdict.reason : '') +
+      (verdict && verdict.provenance ? ' [' + JSON.stringify(verdict.provenance) + ']' : '');
+
+    if (disposition === 'allow') {
+      // Deliberately SILENT on the PATH arm too: a provenance line on every
+      // allowed Bash command would be transcript noise on the common path, and
+      // the operator already learned the property at install time (the
+      // \`gate install\` disclosure) — stderr here is reserved for what blocks.
+      continue;
+    }
+    if (disposition === 'warn') {
+      process.stderr.write('[totem gate-wrapper] ' + event + ' (warn): ' + detail + '\\n');
+      continue;
+    }
+    if (disposition === 'deny') {
+      process.stderr.write('[totem gate-wrapper] ' + event + ' (deny): ' + detail + '\\n');
+      if (tier !== 'pilot') {
+        process.exit(2);
+      }
+      continue;
+    }
+
+    // Unknown disposition from an applicable gate — fail-closed. The provenance
+    // note rides here too, so all four not-evaluable causes in the exit-code
+    // contract above disclose which arm evaluated.
     process.stderr.write(
-      '[totem gate-wrapper] gate "' + event + '" emitted unparseable verdict — blocking (fail-closed).\\n' + armNote,
+      '[totem gate-wrapper] gate "' + event + '" returned unknown disposition "' + disposition + '" — blocking (fail-closed).\\n' + armNote,
     );
     process.exit(2);
   }
-
-  // ─── Disposition → host exit code (branch ONLY on disposition) ─────────
-  const disposition = verdict && typeof verdict.disposition === 'string' ? verdict.disposition : '';
-  // reason/provenance are OPAQUE stderr passthrough — never parsed for control flow.
-  const detail =
-    (verdict && verdict.reason ? verdict.reason : '') +
-    (verdict && verdict.provenance ? ' [' + JSON.stringify(verdict.provenance) + ']' : '');
-
-  if (disposition === 'allow') {
-    // Deliberately SILENT on the PATH arm too: a provenance line on every
-    // allowed Bash command would be transcript noise on the common path, and
-    // the operator already learned the property at install time (the
-    // \`gate install\` disclosure) — stderr here is reserved for what blocks.
-    process.exit(0);
-  }
-  if (disposition === 'warn') {
-    process.stderr.write('[totem gate-wrapper] ' + event + ' (warn): ' + detail + '\\n');
-    process.exit(0);
-  }
-  if (disposition === 'deny') {
-    process.stderr.write('[totem gate-wrapper] ' + event + ' (deny): ' + detail + '\\n');
-    process.exit(tier === 'pilot' ? 0 : 2);
-  }
-
-  // Unknown disposition from an applicable gate — fail-closed. The provenance
-  // note rides here too, so all four not-evaluable causes in the exit-code
-  // contract above disclose which arm evaluated.
-  process.stderr.write(
-    '[totem gate-wrapper] gate "' + event + '" returned unknown disposition "' + disposition + '" — blocking (fail-closed).\\n' + armNote,
-  );
-  process.exit(2);
+  process.exit(0);
 });
 ${TOTEM_FILE_END}
 `;
@@ -2022,15 +2681,19 @@ ${SKILL_MARKER_START}
 
 Session-start bring-up. **Read-only** — no mutations, no dispatches, no board edits until the operator rules on next steps (Proposal 295 d2: read-only orient + grounded next-work). Solo — no agent fleet (\`feedback_session_start_derive_cheaply\`: cheap derivation IS the validation dogfood).
 
-1. **Consume the injected orientation.** On Claude Code seats a SessionStart hook may inject a journal + carryforward, inbound mail, branch/ticket-matched context, and a bounded session-orientation slice (parked/freeze state, open PRs, board↔issue coherence drift, and an open-issue-count pointer) — the hook serves the seat it is CONFIGURED for, not a derived identity, so confirm the injected journal is YOURS: a visiting session receives the HOST seat's, and your carryforward derives from \`.totem/orchestration/<your-seat>/journal/\` (step 3), never from a foreign journal. On a hook-seat MISMATCH (the injected journal or mail banner names another seat), consume NONE of the injected material — treat the session as hook-less: derive it all via \`totem orient\` plus your own seat-anchored poll (step 2). Do not re-run what the hook injected. Everything else the bring-up needs (the full board in-flight set, corpus freshness, doctrine currency) is derived on demand via \`totem orient\`. On a hook-less seat (other vendors, cold starts), derive it all: \`totem orient\`.
+0. **Derive the seat FIRST — before orient, before any journal read, before any knowledge search** (mmnto-ai/totem#2801). Read the INHERITED \`TOTEM_SELF_AGENT\` this session was launched with; \`totem mail --derive-seat\` is the probe — one stdout line \`seat=<id> source=env\` and exit 0 when the inherited env names exactly one seat this repo hosts, otherwise a stderr refusal (exit 2) naming the supplied value (or \`unset\`) and every seat this repo hosts. **Hosts** means one thing everywhere: config.json \`host_agents\`, else the seat dirs, else the cohort map keyed on the origin repository — never the env you supplied, which is the thing being checked. **Set → that is your seat: use it, and never write a different one.** An inline \`TOTEM_SELF_AGENT=<seat>\` on any later command may only RESTATE the inherited value; writing a different seat over it silently re-points every step below at a seat that is not yours, and once overridden the tool can no longer see what you inherited — the operator's account is the only witness left. **Set but REFUSED** (the probe exits 2 while the env names a seat): your declaration and this repo disagree, so act as if you have no seat — put the refusal line itself in front of the operator, verbatim, and change nothing to make it pass; signon is read-only, so \`totem seat add\` is never run here. On a repo with no seat registration at all the refusal says the repo cannot CORROBORATE you, not that your seat is wrong: \`totem mail --as <your-seat>\` and a per-shell poll still serve your declaration, because a declaration on the command line is yours to make and this probe only checks one. **Empty → STOP and ask the operator.** Do not guess, do not fall back to the crown, do not derive a seat from the repo basename, the branch, or the only seat in sight; a bring-up on an unknown identity is worse than no bring-up. Report exactly one line and wait: \`Failure Mode: Hook-less session launched without TOTEM_SELF_AGENT set.\`
+
+1. **Assignment mail before orient — poll since last signoff, seat-anchored.** On a hook-less seat the order is fixed: assignment mail before orient, before any journal read, and before any knowledge search — an assignment can turn every one of those into a disclosure (step 2), and the managed hook derives neither the poll nor the journal for you (step 3). Poll AS YOUR SEAT: per-shell \`TOTEM_SELF_AGENT=<your-seat>\` (the mmnto-ai/totem#2629 scope ruling — never user/machine scope; prefer the inline form \`TOTEM_SELF_AGENT=<seat> totem mail\` where shell state does not persist between tool calls, and on a session whose step-0 env is already set that inline form RESTATES that seat and never another) or \`totem mail --as <your-seat>\`. **S0 identity check:** the banner's \`Self agents:\` line must name exactly your seat. Since @mmnto/cli 1.117.0 an identity-less multi-seat poll gates itself (broadcast-only serve, directed mail withheld as a count, exit 2 — the mmnto-ai/totem#2204 deterministic floor), so the residual S0 catches is the WRONG-single-identity class: a mis-scoped or inherited env naming a foreign seat resolves single-seat, ungated, and serves that seat's directed mail. A banner naming a FOREIGN seat = STOP: act on nothing served, propagate nothing from it, fix the identity, re-poll. A GATED poll's LISTING is broadcast-only by construction — but warning lines can still name an unclassifiable or unresolvable file (an ECL basename is recipient + compressed subject — the CLI's named limit), so propagate nothing from a gated poll's warnings either: fix the identity and re-poll for your directed mail. An \`Error:\` line is the same surface: since the mmnto-ai/totem#2685 fix a poll whose OWN outbox (one this repo hosts for a resolved seat) carries a dispatch with an unresolvable \`to:\` exits 4 (SENDER FAULT) — the verdict IS derived, read it, but the \`to:\` is yours to fix first (one recipient per dispatch, or broadcast; a comma list is never a recipient), and propagate nothing from the fault line; exit 2 stays NOT-DERIVED and wins when both hold. Unread = inbound − handled: consumption is tracked by \`processed/\` marks (\`feedback_check_outbox_before_replying\`), so the CLI path needs no cutoff stamp. Read every hit before proceeding — new mail can reprioritize everything below. (Fallback — a seat that must stamp-poll instead derives the cutoff from the newest journal's CONTENT date, the filename stamp or frontmatter, **never file mtime**, which git resets on clone/worktree and silently reports "inbox clean" over waiting mail; mmnto-ai/totem-strategy#813.)
 
-2. **Poll mail since last signoff — seat-anchored.** Poll AS YOUR SEAT: per-shell \`TOTEM_SELF_AGENT=<your-seat>\` (the mmnto-ai/totem#2629 scope ruling — never user/machine scope; prefer the inline form \`TOTEM_SELF_AGENT=<seat> totem mail\` where shell state does not persist between tool calls) or \`totem mail --as <your-seat>\`. **S0 identity check:** the banner's \`Self agents:\` line must name exactly your seat. Since @mmnto/cli 1.117.0 an identity-less multi-seat poll gates itself (broadcast-only serve, directed mail withheld as a count, exit 2 — the mmnto-ai/totem#2204 deterministic floor), so the residual S0 catches is the WRONG-single-identity class: a mis-scoped or inherited env naming a foreign seat resolves single-seat, ungated, and serves that seat's directed mail. A banner naming a FOREIGN seat = STOP: act on nothing served, propagate nothing from it, fix the identity, re-poll. A GATED poll's LISTING is broadcast-only by construction — but warning lines can still name an unclassifiable or unresolvable file (an ECL basename is recipient + compressed subject — the CLI's named limit), so propagate nothing from a gated poll's warnings either: fix the identity and re-poll for your directed mail. An \`Error:\` line is the same surface: since the mmnto-ai/totem#2685 fix a poll whose OWN outbox (one this repo hosts for a resolved seat) carries a dispatch with an unresolvable \`to:\` exits 4 (SENDER FAULT) — the verdict IS derived, read it, but the \`to:\` is yours to fix first (one recipient per dispatch, or broadcast; a comma list is never a recipient), and propagate nothing from the fault line; exit 2 stays NOT-DERIVED and wins when both hold. Unread = inbound − handled: consumption is tracked by \`processed/\` marks (\`feedback_check_outbox_before_replying\`), so the CLI path needs no cutoff stamp. Read every hit before proceeding — new mail can reprioritize everything below. (Fallback — a seat that must stamp-poll instead derives the cutoff from the newest journal's CONTENT date, the filename stamp or frontmatter, **never file mtime**, which git resets on clone/worktree and silently reports "inbox clean" over waiting mail; mmnto-ai/totem-strategy#813.)
+2. **Kit-first — while a BLIND round is in flight, read the kit and nothing else.** The BLIND-kit marker is the dispatch SUBJECT's literal prefix \`BLIND round: \`, followed by the round's name and, in the same subject, the deposit clause \`— deposit to <orchestrator-seat> by <ISO-8601 deadline>\`; no frontmatter key carries it, so the subject line is what you read. **A round is in flight while such a dispatch has an unpassed deadline and no deposit received.** In flight, signon ENDS here: read the kit and the artifact the kit names, and nothing else — no \`totem orient\`, no journal, no knowledge search, no board or PR read — because live repository detail is precisely what a blind classification must not carry. The kit-first rule has no partial arm: if any step ran before you reached the kit, report the exposure to the round's orchestrator seat by directed mail and do not classify; a disclosed round is re-armed in a fresh session, never repaired in place.
 
-3. **Re-derive the carryforward gates — don't trust the journal's framing** (Tenet 20 read-side twin). For each carryforward item in YOUR SEAT's latest journal (\`.totem/orchestration/<your-seat>/journal/\` — on a multi-seat repo another seat's newer journal is not your carryforward), freshly derive its gate state (the PR it waits on, the issue, the date, the release train) via \`gh\` / \`git\` reads. Cross-repo gates resolve through the frozen cohort roster — \`totem\` / \`strategy\` / \`status\` / \`lc\` → \`mmnto-ai/{totem, totem-strategy, totem-status, liquid-city}\` (mmnto-ai/totem-strategy#611 gates any change). An item whose gate fired leads the next-steps list; an item still gated is reported as waiting, not worked.
+3. **Consume the injected orientation — the managed hook injects exactly two blocks.** The managed SessionStart hook injects exactly two briefing blocks — \`totem describe\` and \`totem orient --session\` — and injects nothing else: no journal and no mail (it does other work at boot, none of which reaches your context), so your latest journal (step 4) and your seat-anchored mail (step 1) are derived BY HAND on every seat, hook or not — never assumed present. Do not re-run the two blocks it did inject. A repo may also run its own session hook; whatever such a hook injects serves the seat it is CONFIGURED for, not a derived identity, so confirm the injected material is YOURS: a visiting session receives the HOST seat's, and your carryforward derives from \`.totem/orchestration/<your-seat>/journal/\` (step 4), never from a foreign journal. On a hook-seat MISMATCH (an injected journal or mail banner naming another seat), consume NONE of the injected material — treat the session as hook-less and derive it all: \`totem orient\` plus your own seat-anchored poll (step 1). Everything else the bring-up needs (the full board in-flight set, corpus freshness, doctrine currency) is derived on demand via \`totem orient\`. On a hook-less seat (other vendors, cold starts), derive it all: \`totem orient\`.
 
-4. **Surface owed-now sensors.** Anything the injected/derived orientation flags as owed (corpus \`⚠ stale\`, strategy-doctrine \`⚠ publish owed\`, board drift) goes on the list as a candidate — sensors report, they don't gate (Tenet 13).
+4. **Re-derive the carryforward gates — don't trust the journal's framing** (Tenet 20 read-side twin). For each carryforward item in YOUR SEAT's latest journal (\`.totem/orchestration/<your-seat>/journal/\` — on a multi-seat repo another seat's newer journal is not your carryforward), freshly derive its gate state (the PR it waits on, the issue, the date, the release train) via \`gh\` / \`git\` reads. Cross-repo gates resolve through the frozen cohort roster — \`totem\` / \`strategy\` / \`status\` / \`lc\` → \`mmnto-ai/{totem, totem-strategy, totem-status, liquid-city}\` (mmnto-ai/totem-strategy#611 gates any change). An item whose gate fired leads the next-steps list; an item still gated is reported as waiting, not worked.
 
-5. **Present and stop.** One message: state summary (inbox, gate states, owed-now items) + ranked next-steps with a recommendation. Then wait for the operator's ruling — signon ends at the judgment handoff; mutations belong to the ruled work, not the bring-up.
+5. **Surface owed-now sensors.** Anything the injected/derived orientation flags as owed (corpus \`⚠ stale\`, strategy-doctrine \`⚠ publish owed\`, board drift) goes on the list as a candidate — sensors report, they don't gate (Tenet 13).
+
+6. **Present and stop.** One message: state summary (seat, inbox, gate states, owed-now items) + ranked next-steps with a recommendation. Then wait for the operator's ruling — signon ends at the judgment handoff; mutations belong to the ruled work, not the bring-up.
 
 ${SKILL_MARKER_END}
 `;
@@ -2090,7 +2753,7 @@ For each selected finding, generate a lesson and call \`mcp__totem-dev__add_less
 
 ### \`done\`
 
-Print a summary of actions taken, then — when the round is being dispositioned — assemble and post the single consolidated round-disposition comment (see the section below), which EXECUTES \`totem review --covariate\` to carry the \`local-lane:\` line, on the operator's explicit go. Then exit.
+Print a summary of actions taken, then — when the round is being dispositioned — assemble and post the single consolidated round-disposition comment (see the section below), which EXECUTES \`totem review --covariate\` to carry the \`local-lane:\` line, on the operator's explicit go. Then, as the LAST action of the round, run \`totem resolve-threads\` (step 4 of that section) — dry first, \`--apply\` only on the operator's explicit go. Then exit.
 
 ## CRITICAL: GCA Reply Protocol
 
@@ -2112,6 +2775,22 @@ It resolves the current branch lineage exactly as the review fan does and prints
 
 3. **Post on an explicit go.** Show the assembled body and wait for the operator; on their go, post the ONE comment with \`gh pr comment $ARGUMENTS --body-file -\` (pipe the body via stdin). Never mutate the PR autonomously.
 
+4. **Resolve the threads this round dispositioned — dry first, \`--apply\` on the operator's explicit go.** The comment you just posted IS the evidence the verb reads, so this step runs AFTER it, and it is the LAST action of the round. Print the plan (this never mutates):
+
+\`\`\`bash
+totem resolve-threads $ARGUMENTS
+\`\`\`
+
+Every bot-rooted thread prints one row carrying its REST root comment id and a verdict: \`resolve\`, \`skip:already-resolved\`, \`skip:outdated\`, \`skip:no-evidence\`, \`skip:not-selected\`. A \`skip:no-evidence\` row is a thread this round has not answered — neither an in-thread reply from a human nor a PR-level comment created after that thread's root — and the verb will NEVER resolve it under any flag; give it evidence and re-run rather than working around it. Show the plan and wait. Only on the operator's explicit go, run the mutating half (add \`--ids <comma-separated REST root comment ids>\` to narrow it to named rows; an unmatched id aborts before anything is resolved):
+
+\`\`\`bash
+totem resolve-threads $ARGUMENTS --apply
+\`\`\`
+
+The verb never posts a comment, a reply or a review — the only mutation it can issue is \`resolveReviewThread\`, which is what the merge-ready gate's unresolved-bot-threads predicate reads. Exit \`2\` means it did not do everything asked (an unmatched id, a failed mutation, or a selected thread with no evidence); exit \`1\` means the read did not complete and NOTHING was resolved. Report what it printed, verbatim.
+
+A clean \`--apply\` run is NOT an allow verdict, and it clears the unresolved-bot-threads predicate only when no unresolved, non-outdated thread rooted by a known review bot remains: a \`skip:no-evidence\` row stays unresolved and, under \`--apply\`, makes the run exit 2; a run narrowed with \`--ids\` leaves its unnamed rows as \`skip:not-selected\` and exits 0. The gate re-reads the PR when \`gh pr merge\` runs, and a bot HIGH inline whose commit cannot be read makes the evaluation UNEVALUABLE once every earlier predicate passes — a deny the resolve run does not predict (under the pilot tier it warns; strict denies). After the apply, read the floor itself — \`totem gate check --event merge-ready --payload '{"repo":"<owner/repo>","pr":$ARGUMENTS}'\`, with \`--tier pilot\` where the installed gate is the pilot — and report that verdict beside the resolve rows, before the merge word is asked for.
+
 ${SKILL_MARKER_END}
 `;
 export const REVIEW_LOOP_SKILL_CONTENT = `---