instar 1.3.1621 → 1.3.1622

package/scripts/safe-merge.mjs

@@ -28,11 +28,9 @@
  * Usage:  node scripts/safe-merge.mjs <PR#> [--auto|--admin] [--squash|--merge|--rebase]
  *           [--repo <owner/name>] [--delete-branch] [--deadline-ms <n>]
  *
- *   --auto  PREFERRED. Arms GitHub native auto-merge and returns immediately —
- *           GitHub merges the instant every required check passes, enforcing
- *           branch protection itself (no --admin bypass) and never timing out.
- *           Requires "Allow auto-merge" enabled on the repo. Exit 5 = armed,
- *           exit 0 = merged immediately (checks were already green).
+ *   --auto  PREFERRED. Defers while CI is pending, then synchronously merges
+ *           the verified head once the full code-pinned CI floor is green.
+ *           It never arms GitHub's weaker native auto-merge policy.
  *   --admin Legacy synchronous path: polls for green, re-imposes the required
  *           contexts that --admin would bypass, then merges. Use only when the
  *           repo has auto-merge disabled.
@@ -193,10 +191,8 @@ export function parseArgs(argv) {
     throw new UsageError(`unknown flag: ${a} (strict argv — see --capabilities for the contract)`);
   }
   if (!out.capabilities && out.pr === null) throw new UsageError('a PR number is required');
-  // --auto (native GitHub auto-merge: GitHub enforces every required check
-  // before merging) and --admin (bypass-then-re-impose) are contradictory
-  // strategies — refuse the incoherent combo rather than silently pick one.
-  if (out.auto && out.admin) throw new UsageError('--auto and --admin are mutually exclusive: --auto relies on GitHub native required-check enforcement, --admin bypasses it');
+  // These are distinct merge floors, so the caller must choose one.
+  if (out.auto && out.admin) throw new UsageError('--auto and --admin are mutually exclusive merge strategies');
   return out;
 }
 
@@ -209,12 +205,12 @@ export function capabilities() {
       'strict-argv', 'repo-param', 'json-checks', 'head-pinning',
       'required-contexts-cross-check', 'producer-binding', 'floor',
       'reviews-required-refusal', 'classified-exits', 'delete-branch', 'deadline-ms',
-      'native-auto-merge', 'auto-arm-unavailable-detection',
+      'ci-floor-sync-merge', 'pending-check-deferral',
       'approval-required-refusal', 'request-review-from', 'local-floor', 'attempt-token',
       'non-main-base-refusal',
     ],
     floorModes: [...MERGE_FLOOR_MODES],
-    exitCodes: { merged: 0, refused: 1, usageOrError: 2, alreadyMerged: 3, closed: 4, autoMergeArmed: 5 },
+    exitCodes: { merged: 0, refused: 1, usageOrError: 2, alreadyMerged: 3, closed: 4 },
   };
 }
 
@@ -665,13 +661,13 @@ function fetchChecksRows(pr, repo) {
 
 /** gh's answer for a head GitHub has not registered any check run on yet (e.g. right after a push). */
 const NO_CHECKS_REPORTED_RE = /no checks reported/i;
+export class NoChecksReportedError extends Error {}
 
 /**
  * Parse `gh pr checks --json` output. An empty stdout whose stderr says "no checks
  * reported" (seen right after a push, PRs 2296/2314) is ZERO rows — not settled,
- * so the caller keeps waiting (classifyChecks never reads zero rows as green). Any
- * other unparseable, non-array or empty answer throws (retried, then
- * contexts-unverifiable), with gh's stderr in the message so it is diagnosable.
+ * so the caller keeps waiting. Any other unparseable, non-array or empty answer
+ * throws (retried, then contexts-unverifiable).
  */
 export function parseChecksRows(stdout, stderr = '') {
   const err = String(stderr || '').trim().slice(0, 200);
@@ -684,7 +680,7 @@ export function parseChecksRows(stdout, stderr = '') {
     throw new Error(`gh pr checks returned unparseable JSON: ${String(stdout || '').slice(0, 200)}${errNote}`);
   }
   if (!Array.isArray(rows)) throw new Error(`gh pr checks returned a non-array: ${String(stdout || '').slice(0, 200)}${errNote}`);
-  if (rows.length === 0) throw new Error(`gh pr checks returned no checks${errNote}`);
+  if (rows.length === 0) throw new NoChecksReportedError(`gh pr checks returned no checks${errNote}`);
   return rows;
 }
 
@@ -1178,18 +1174,14 @@ async function main() {
     process.exit(1);
   }
 
-  // --- Native auto-merge path (--auto): arm-and-return, no polling ----------
-  // GitHub's native auto-merge merges the PR the instant every REQUIRED check
-  // passes and the branch is mergeable — and it NEVER bypasses a check (unlike
-  // --admin). So the required-context re-imposition this script does manually
-  // for the --admin path is enforced by GitHub itself here. We only run the
-  // cheap pre-flight above (open, not draft, head not moved), arm auto-merge,
-  // confirm it's armed, and exit. No deadline, so it can't time out the way a
-  // foreground/background poller does (the failure mode that wedged hot-branch
-  // merges: the watcher is killed before slow CI finishes).
+  // --- CI-floor merge path (--auto): defer until green, then merge now ------
+  // GitHub enforces only the contexts configured in branch rules. On this repo
+  // that can be just instar/local-verify, so --auto would merge while the CI
+  // matrix is still queued. Check the full code-pinned Actions floor before
+  // merging. A pending check is a deferral: the caller retries on its next tick.
   if (args.auto) {
-    // Zero Actions checks is never green: refuse before arming (GitHub would
-    // otherwise merge at once when no check is required).
+    // Zero Actions checks is never green. A queued run may not yet appear,
+    // so classify pending first and refuse only once the rows have settled.
     let headRuns;
     try {
       headRuns = fetchCheckRunsWithProducers(repo, pinnedHead);
@@ -1198,56 +1190,62 @@ async function main() {
       console.error(`safe-merge: REFUSING — could not read the head's check runs: ${e.message}`);
       process.exit(1);
     }
-    if (noActionsChecksRan(headRuns)) refuseNoChecksRan(pr, pinnedHead);
-    const autoArgs = ['pr', 'merge', pr, '--repo', repo, args.method, '--auto'];
-    if (args.matchHeadCommit) autoArgs.push('--match-head-commit', pinnedHead);
-    if (args.deleteBranch) autoArgs.push('--delete-branch');
-    console.log(`safe-merge: arming native auto-merge for PR #${pr} (${args.method}, head ${pinnedHead.slice(0, 12)}) — GitHub will merge when all required checks pass...`);
-    const a = spawnSync('gh', autoArgs, { encoding: 'utf-8' });
-    process.stdout.write(a.stdout ?? '');
-    process.stderr.write(a.stderr ?? '');
-    if (a.status !== 0 || a.signal) {
-      const cls = classifyMergeFailure(a.stderr, a.status, a.signal);
-      if (cls === 'already-merged') { result({ result: 'already-merged', pr: Number(pr) }); process.exit(3); }
-      if (cls === 'closed') { result({ result: 'closed', pr: Number(pr) }); process.exit(4); }
-      // Distinguish "auto-merge is disabled on the repo" (a PERMANENT condition →
-      // terminal-non-ladder for the orchestrator) from a generic transient gh
-      // failure. The discriminator is a REAL stderr-signature match, not the
-      // human-only console.error hint below.
-      if (isAutoMergeUnavailable(a.stderr)) {
-        result({ result: 'refused:auto-arm-unavailable', raw: cls });
-        console.error('safe-merge: could not arm auto-merge — "Allow auto-merge" appears DISABLED on the repo settings. Enable it, or run with --admin.');
+    let checksState;
+    let evaluation;
+    try {
+      checksState = classifyChecks(fetchChecksRows(pr, repo));
+      if (!checksState.settled) {
+        result({ result: 'deferred:checks-pending', pr: Number(pr), pending: checksState.pending.slice(0, 20), noChecks: checksState.noChecks });
+        console.error('safe-merge: CI checks are still pending; merge deferred.');
         process.exit(1);
       }
-      result({ result: `refused:auto-arm-${cls}`, raw: cls });
-      console.error(`safe-merge: could not arm auto-merge (${cls}). Is "Allow auto-merge" enabled on the repo settings?`);
-      process.exit(1);
-    }
-    // Independent confirmation (B10: never trust the exit code alone). If the
-    // checks were ALREADY green, GitHub merges immediately and we report merged.
-    try {
-      const after = ghJson(['pr', 'view', pr, '--repo', repo, '--json', 'state,mergedAt,autoMergeRequest']);
-      if (after.state === 'MERGED' || after.mergedAt) {
-        result({ result: 'merged', pr: Number(pr), head: pinnedHead });
-        process.exit(0);
+      if (checksState.failed.length > 0) {
+        result({ result: 'refused:red-checks', failed: checksState.failed.slice(0, 20) });
+        console.error('safe-merge: REFUSING — a check is red; merge not attempted.');
+        process.exit(1);
       }
-      if (after.autoMergeRequest) {
-        result({ result: 'auto-merge-armed', pr: Number(pr), head: pinnedHead });
-        console.log('safe-merge: auto-merge armed. GitHub will merge when required checks pass — no further action needed.');
-        process.exit(5);
+      // An external check can pass before Actions registers any rows. Treat
+      // absent Actions/E2E as pending; the executor's three-hour deadline
+      // makes a missing workflow a bounded, eventual refusal.
+      if (noActionsChecksRan(headRuns) || !checksState.sawE2e) {
+        result({ result: 'deferred:checks-pending', pr: Number(pr), pending: ['Actions or E2E not registered'] });
+        console.error('safe-merge: Actions or E2E has not registered; merge deferred.');
+        process.exit(1);
       }
-      result({ result: 'error:auto-arm-unconfirmed', state: after.state });
-      console.error('safe-merge: gh reported success but auto-merge is not armed on re-read. NOT claiming success.');
-      process.exit(2);
+      if (!checksState.e2ePassed) {
+        result({ result: 'refused:e2e-missing-or-red' });
+        console.error('safe-merge: REFUSING — E2E did not pass; merge not attempted.');
+        process.exit(1);
+      }
+      const rulesetContexts = fetchRulesetContexts(repo, view.baseRefName || 'main');
+      const commitStatuses = rulesetContexts.includes(LOCAL_VERIFY_CONTEXT) ? fetchCommitStatuses(repo, pinnedHead) : [];
+      evaluation = evaluateRequiredContexts({
+        protectionContexts: [], rulesetContexts, floor: ACTIONS_FLOOR_CONTEXTS,
+        extraFloor: args.extraFloor, checkRuns: headRuns, commitStatuses,
+      });
     } catch (e) {
-      result({ result: 'error:auto-confirm-unreadable', detail: String(e.message).slice(0, 300) });
-      console.error('safe-merge: could not independently confirm auto-merge was armed. NOT claiming success.');
-      process.exit(2);
+      if (e instanceof NoChecksReportedError) {
+        result({ result: 'deferred:checks-pending', pr: Number(pr), noChecks: true });
+        console.error('safe-merge: no CI checks have registered; merge deferred.');
+        process.exit(1);
+      }
+      result({ result: 'refused:contexts-unverifiable', detail: String(e.message).slice(0, 300) });
+      console.error(`safe-merge: REFUSING — could not verify the CI floor: ${e.message}`);
+      process.exit(1);
+    }
+    if (!evaluation.ok) {
+      const wrongProducer = evaluation.problems.some(problem => problem.includes('WRONG producer'));
+      result({ result: wrongProducer ? 'refused:contexts' : 'deferred:checks-pending', problems: evaluation.problems.slice(0, 20) });
+      console.error(`safe-merge: ${wrongProducer ? 'REFUSING' : 'deferring'} — code-pinned CI floor is not green; merge not attempted.`);
+      process.exit(1);
     }
+    // Never leave a future merge armed: GitHub's required contexts can be
+    // weaker than the floor just checked, and a rerun could turn red later.
+    mergeAndConfirm({ repo, pr, view, args, pinnedHead, admin: false });
   }
 
   // --- Floor selection (local-verify-merge-authority §3) --------------------
-  // `--auto` (above) keeps today's behaviour. On the synchronous path, the
+  // On the synchronous path without `--auto`, the
   // `local` floor replaces the three Actions waits and the contexts floor with
   // the §3 predicate; it never falls back to the Actions floor on its own.
   {

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-11-03T09:33:37.326Z",
-  "instarVersion": "1.3.1621",
+  "generatedAt": "2026-11-03T10:37:50.201Z",
+  "instarVersion": "1.3.1622",
   "entryCount": 206,
   "entries": {
     "hook:session-start": {
@@ -11,7 +11,7 @@
       "domain": "identity",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/session-start.sh",
-      "contentHash": "21e0ea6311ec708c169366ccb1ee0fc26cd5bb047f6063a68aff2edb07178ff5",
+      "contentHash": "765398e7aeb5d62739d45738bc73edb15e35308aac67b4871e401368af274de9",
       "since": "2025-01-01"
     },
     "hook:dangerous-command-guard": {
@@ -20,7 +20,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/dangerous-command-guard.sh",
-      "contentHash": "21e0ea6311ec708c169366ccb1ee0fc26cd5bb047f6063a68aff2edb07178ff5",
+      "contentHash": "765398e7aeb5d62739d45738bc73edb15e35308aac67b4871e401368af274de9",
       "since": "2025-01-01"
     },
     "hook:grounding-before-messaging": {
@@ -29,7 +29,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/grounding-before-messaging.sh",
-      "contentHash": "21e0ea6311ec708c169366ccb1ee0fc26cd5bb047f6063a68aff2edb07178ff5",
+      "contentHash": "765398e7aeb5d62739d45738bc73edb15e35308aac67b4871e401368af274de9",
       "since": "2025-01-01"
     },
     "hook:compaction-recovery": {
@@ -38,7 +38,7 @@
       "domain": "identity",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/compaction-recovery.sh",
-      "contentHash": "21e0ea6311ec708c169366ccb1ee0fc26cd5bb047f6063a68aff2edb07178ff5",
+      "contentHash": "765398e7aeb5d62739d45738bc73edb15e35308aac67b4871e401368af274de9",
       "since": "2025-01-01"
     },
     "hook:external-operation-gate": {
@@ -47,7 +47,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/external-operation-gate.js",
-      "contentHash": "21e0ea6311ec708c169366ccb1ee0fc26cd5bb047f6063a68aff2edb07178ff5",
+      "contentHash": "765398e7aeb5d62739d45738bc73edb15e35308aac67b4871e401368af274de9",
       "since": "2025-01-01"
     },
     "hook:deferral-detector": {
@@ -56,7 +56,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/deferral-detector.js",
-      "contentHash": "21e0ea6311ec708c169366ccb1ee0fc26cd5bb047f6063a68aff2edb07178ff5",
+      "contentHash": "765398e7aeb5d62739d45738bc73edb15e35308aac67b4871e401368af274de9",
       "since": "2025-01-01"
     },
     "hook:self-stop-guard": {
@@ -65,7 +65,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/self-stop-guard.js",
-      "contentHash": "21e0ea6311ec708c169366ccb1ee0fc26cd5bb047f6063a68aff2edb07178ff5",
+      "contentHash": "765398e7aeb5d62739d45738bc73edb15e35308aac67b4871e401368af274de9",
       "since": "2025-01-01"
     },
     "hook:post-action-reflection": {
@@ -74,7 +74,7 @@
       "domain": "evolution",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/post-action-reflection.js",
-      "contentHash": "21e0ea6311ec708c169366ccb1ee0fc26cd5bb047f6063a68aff2edb07178ff5",
+      "contentHash": "765398e7aeb5d62739d45738bc73edb15e35308aac67b4871e401368af274de9",
       "since": "2025-01-01"
     },
     "hook:external-communication-guard": {
@@ -83,7 +83,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/external-communication-guard.js",
-      "contentHash": "21e0ea6311ec708c169366ccb1ee0fc26cd5bb047f6063a68aff2edb07178ff5",
+      "contentHash": "765398e7aeb5d62739d45738bc73edb15e35308aac67b4871e401368af274de9",
       "since": "2025-01-01"
     },
     "hook:telegram-origin-guard": {
@@ -101,7 +101,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/scope-coherence-collector.js",
-      "contentHash": "21e0ea6311ec708c169366ccb1ee0fc26cd5bb047f6063a68aff2edb07178ff5",
+      "contentHash": "765398e7aeb5d62739d45738bc73edb15e35308aac67b4871e401368af274de9",
       "since": "2025-01-01"
     },
     "hook:scope-coherence-checkpoint": {
@@ -110,7 +110,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/scope-coherence-checkpoint.js",
-      "contentHash": "21e0ea6311ec708c169366ccb1ee0fc26cd5bb047f6063a68aff2edb07178ff5",
+      "contentHash": "765398e7aeb5d62739d45738bc73edb15e35308aac67b4871e401368af274de9",
       "since": "2025-01-01"
     },
     "hook:free-text-guard": {
@@ -119,7 +119,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/free-text-guard.sh",
-      "contentHash": "21e0ea6311ec708c169366ccb1ee0fc26cd5bb047f6063a68aff2edb07178ff5",
+      "contentHash": "765398e7aeb5d62739d45738bc73edb15e35308aac67b4871e401368af274de9",
       "since": "2025-01-01"
     },
     "hook:claim-intercept": {
@@ -128,7 +128,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/claim-intercept.js",
-      "contentHash": "21e0ea6311ec708c169366ccb1ee0fc26cd5bb047f6063a68aff2edb07178ff5",
+      "contentHash": "765398e7aeb5d62739d45738bc73edb15e35308aac67b4871e401368af274de9",
       "since": "2025-01-01"
     },
     "hook:claim-intercept-response": {
@@ -137,7 +137,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/claim-intercept-response.js",
-      "contentHash": "21e0ea6311ec708c169366ccb1ee0fc26cd5bb047f6063a68aff2edb07178ff5",
+      "contentHash": "765398e7aeb5d62739d45738bc73edb15e35308aac67b4871e401368af274de9",
       "since": "2025-01-01"
     },
     "hook:stop-gate-router": {
@@ -146,7 +146,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/stop-gate-router.js",
-      "contentHash": "21e0ea6311ec708c169366ccb1ee0fc26cd5bb047f6063a68aff2edb07178ff5",
+      "contentHash": "765398e7aeb5d62739d45738bc73edb15e35308aac67b4871e401368af274de9",
       "since": "2025-01-01"
     },
     "hook:auto-approve-permissions": {
@@ -155,7 +155,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/auto-approve-permissions.js",
-      "contentHash": "21e0ea6311ec708c169366ccb1ee0fc26cd5bb047f6063a68aff2edb07178ff5",
+      "contentHash": "765398e7aeb5d62739d45738bc73edb15e35308aac67b4871e401368af274de9",
       "since": "2025-01-01"
     },
     "job:health-check": {
@@ -1595,7 +1595,7 @@
       "type": "subsystem",
       "domain": "updates",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
-      "contentHash": "21e0ea6311ec708c169366ccb1ee0fc26cd5bb047f6063a68aff2edb07178ff5",
+      "contentHash": "765398e7aeb5d62739d45738bc73edb15e35308aac67b4871e401368af274de9",
       "since": "2025-01-01"
     },
     "subsystem:scheduler": {

package/src/data/standards-guard-index.json

@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "generatedFrom": "source-tree",
   "registrySha256": "db01d9f92c6aa26ca903702896b41be53722982ed07d27633237bb254c214290",
-  "packageVersion": "1.3.1621",
+  "packageVersion": "1.3.1622",
   "guards": [
     {
       "ref": "docs/audits/phase-b/f10-triage.md",

package/src/data/standards-guard-index.meta.json

@@ -1,5 +1,5 @@
 {
-  "sha256": "da21716275caefa7f4ca6007e41697a4ccb0429bb58765ba010f7934615f992b",
+  "sha256": "25dd2246cd8ba1e0f2bf4d157be9613a2c1d1994aed32d7e13f45b34d887bd8f",
   "registrySha256": "db01d9f92c6aa26ca903702896b41be53722982ed07d27633237bb254c214290",
-  "packageVersion": "1.3.1621"
+  "packageVersion": "1.3.1622"
 }

package/src/data/standards-registry.meta.json

@@ -2,5 +2,5 @@
   "sha256": "db01d9f92c6aa26ca903702896b41be53722982ed07d27633237bb254c214290",
   "articleCount": 93,
   "generatedFrom": "docs/STANDARDS-REGISTRY.md",
-  "packageVersion": "1.3.1621"
+  "packageVersion": "1.3.1622"
 }

package/src/scaffold/templates.ts

@@ -1170,7 +1170,7 @@ ${READINESS_STALL_NOTICE_BULLET}
 - **When to use** (PROACTIVE): "what are we working on from feedback?" → the queue; "why was this report ignored / held?" → the summary's reasons (and the item's row in the queue/summary); \`authority: awaiting-approval\` → send the operator to the dashboard Feedback Drain tab, Triage section, for the one PIN tap. Turning ignores live goes through \`POST /feedback-factory/triage/plan\` (\`{"action":"ignore-live"}\`) and the operator's PIN on the dashboard — never a chat confirmation.
 
 **Feedback executor (operated feedback factory)** — The executor takes the highest-ranked **work** items and turns each into a pull request. Each attempt runs a Claude Code build session locked in an OS sandbox (no network, no credentials, no reads outside its own copy of the code), proven by a must-fail/must-succeed canary before every attempt; the session reproduces the problem with a failing test and fixes it (or drafts a spec when the item needs a design). Trusted code then re-checks the fix in the sandbox (fails before, passes after, lint and related tests pass), refuses changes to build tooling or anything that looks like a secret, and pushes from its own clone to a FORK (\`feedbackFactory.execute.publishRepo\`, \`owner/name\`), opening a cross-repository PR with the \`hold\` label — CI on a fork PR gets no repository secrets, and without a fork (or with the canonical repository itself) nothing is published. It merges ONLY the exact version the repository owner approved on GitHub (\`safe-merge --auto --match-head-commit\`), and refuses to run while this agent could itself act as that approver unless the operator accepted that once with the dashboard PIN. A merged fix is verified only after it ships in a release and the reports stay quiet for 30 days. Dev-gated (\`feedbackFactory.execute\`), dry-run until \`feedbackFactory.execute.dryRun\` is false; 503 without a source checkout.
-- Status: \`curl -H "Authorization: Bearer $AUTH" http://localhost:${port}/feedback-factory/execute/status\` → \`{ available, reason, dryRun, counts, live, openPrs, startsToday, limits, canary, deps, attempts }\` (\`reason\`: \`approver-not-independent\` / \`auto-merge-disabled\` / \`profile-unenforceable\` / \`deps-unavailable\` / \`publish-fork-unset\` / \`dry-run\` / \`no-source-repo\`).
+- Status: \`curl -H "Authorization: Bearer $AUTH" http://localhost:${port}/feedback-factory/execute/status\` → \`{ available, reason, dryRun, counts, live, openPrs, startsToday, limits, canary, deps, attempts }\` (\`reason\`: \`approver-not-independent\` / \`profile-unenforceable\` / \`deps-unavailable\` / \`publish-fork-unset\` / \`dry-run\` / \`no-source-repo\`). Native GitHub auto-merge need not be enabled; the reviewed head merges only after the complete CI floor passes.
 - Operator instructions given in conversation: stop an item's attempts (also disarms an armed merge) \`curl -X POST -H "Authorization: Bearer $AUTH" -H 'X-Instar-Request: 1' -H 'Content-Type: application/json' http://localhost:${port}/feedback-factory/execute/stop -d '{"initiativeId":"..."}'\`; let a parked item be tried again \`.../feedback-factory/execute/release\` with the same body; withdraw the approver acceptance \`.../feedback-factory/execute/revoke-acceptance\` (no body).
 - **When to use** (PROACTIVE): "is anything being fixed from feedback?" → the status and the queue's \`executionState\`/\`prLink\`; \`reason: approver-not-independent\` → send the operator to the dashboard Feedback Drain tab, Triage section, to accept or decline with the PIN (\`POST /feedback-factory/triage/plan\` \`{"action":"accept-approver-dependence"}\` renders it); a fix held as \`needs-review-secret-shape\` is published only through the same PIN plan/commit (\`{"action":"publish-secret-shape","attemptId":"..."}\`) — never a chat confirmation. You never merge an executor PR yourself.
 

package/upgrades/1.3.1622.md

@@ -0,0 +1,21 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+Feedback fixes and the green PR watcher now wait for the complete, producer-bound GitHub CI floor before merging. The merge command targets the exact verified head immediately after that check; it no longer leaves native auto-merge armed under a weaker repository rule. Queued or not-yet-registered checks make the feedback executor retry without spending its refusal allowance. That wait has a durable three-hour limit per attempt, followed by the existing one-hour retry path. The executor no longer requires native GitHub auto-merge to be enabled.
+
+## What to Tell Your User
+
+A feedback PR stays open while CI is queued. When the full suite is green, Echo merges the reviewed commit. If checks never arrive, the executor eventually holds the work and reports the merge problem instead of calling a missing suite green.
+
+## Summary of New Capabilities
+
+- Feedback pull requests wait for all relevant GitHub checks and merge only the reviewed head after those checks pass.
+- Queued checks are retried for up to three hours per attempt; the executor allows its existing retry before reporting a merge hold.
+
+## Evidence
+
+Focused unit, integration, and E2E tests cover pending checks, a Vercel-first registration window, the full producer-bound floor, head-pinned merging, and the bounded executor retry.

package/upgrades/side-effects/feedback-ci-floor-merge.md

@@ -0,0 +1,82 @@
+# Side-Effects Review — Feedback CI floor merge
+
+**Version / slug:** `feedback-ci-floor-merge`  
+**Date:** 2026-11-03  
+**Author:** Echo  
+**Second-pass reviewer:** feedback_gate_review
+
+## Summary of the change
+
+`scripts/safe-merge.mjs` now defers its `--auto` route until the full producer-bound Actions floor is green and then calls the immediate head-pinned merge. `FeedbackExecutorService` retries pending checks under a durable deadline and removes the obsolete native auto-merge prerequisite. The CLAUDE.md template and migration both explain the revised behavior. `GreenPrAutoMerger` treats the same deferral as backpressure, not a failed ladder attempt. Tests cover all three layers. The site delivery-checks guide explains the waiting states and restores the documentation coverage floor after the repository's recent class growth.
+
+## Decision-point inventory
+
+- `safe-merge --auto` — modify — pending, red, missing, and green CI classification before a merge.
+- `FeedbackExecutorService` — modify — pending retry and three-hour timeout.
+- `FeedbackExecutorService.refreshAvailability` — modify — native auto-merge setting no longer gates an immediate CI-floor merge.
+- `GreenPrAutoMerger.recordOutcome` — modify — pending does not consume ladder attempts.
+
+## 1. Over-block
+
+A legitimate PR whose GitHub Actions workflow is delayed more than three hours spends a merge refusal and may eventually be held. It remains recoverable through the existing retry and hold path. The executor no longer refuses solely because native auto-merge is disabled; it uses the immediate CI-floor merge path. Wrong-producer checks refuse even if a legitimate run later arrives; the next retry can pass after the correct run appears.
+
+## 2. Under-block
+
+A check rerun may turn red after the final read and before the merge command. GitHub enforces its configured contexts during the command, but its configured floor can be weaker. The head pin prevents a new commit from merging; the check-state race remains a short window. No durable native auto-merge request is left armed.
+
+## 3. Level-of-abstraction fit
+
+The merger owns the final CI predicate and the act-time head pin. The executor owns its durable retry clock. The watcher owns its ladder classification. Each decision stays at the component that has its required state.
+
+## 4. Signal vs authority compliance
+
+**Required reference:** [docs/signal-vs-authority.md](../../docs/signal-vs-authority.md)
+
+- [x] No — the CI floor is a deterministic safety invariant on an irreversible merge, with producer-bound source checks; pending is a signal to the existing retry authority.
+
+## 4b. Judgment-point check (Judgment Within Floors standard)
+
+The merge floor is an enumerable safety invariant: every named CI context from the pinned producer must be successful for the exact head. The retry deadline is a bounded operational policy, not a competing-signals judgment.
+
+## 5. Interactions
+
+The green PR watcher still recognizes historical armed requests and reconciles them. The new path produces no new armed requests. Feedback hold-label removal still precedes the safe-merge call; a pending result leaves the PR open and the watcher also defers while CI is pending.
+
+## 6. External surfaces
+
+`safe-merge --capabilities` now advertises `ci-floor-sync-merge` and `pending-check-deferral`. `--auto` still parses for existing callers, but its action is a synchronous verified merge. The result line returns `deferred:checks-pending` for queued or not-yet-registered checks.
+
+## 6b. Operator-surface quality (Operator-Surface Quality standard)
+
+The feedback row says why it is waiting. No operator action is requested while CI is merely queued. A timed-out feedback executor check goes through the existing merge-unavailable hold with one listed item. The green PR watcher retries pending checks without an executor-style hold deadline.
+
+## 7. Multi-machine posture (Cross-Machine Coherence)
+
+The head SHA and CI results are read from GitHub, common to all machines. The feedback row's deadline is in the existing execution store and follows its owner lease. The watcher uses its existing fenced lease and state ledger. No machine-local-only authority is added.
+
+## 8. Rollback cost
+
+No persistent schema migration is involved. Rolling back the script to its previous `--auto` behavior would reopen the weaker-floor merge risk for both the executor and the watcher. A safe rollback must first disable both autonomous merge paths or replace them with an immediate merge path that checks the full CI floor. Pending executor rows remain readable by an old binary, but retrying them with that binary is unsafe until its merge path is disabled.
+
+## Conclusion
+
+The change prevents merges based on a weaker GitHub rule and bounds delayed CI registration. The remaining read-to-merge check-state race is documented above.
+
+## Second-pass review (if required)
+
+**Reviewer:** feedback_gate_review
+
+Concur with the review. The reviewer found and cleared the durable auto-arm, CI-registration, head-of-line, and rollback-description gaps after revisions. A later release-summary wording concern was corrected to say the three-hour window is per attempt and a retry precedes a hold; the reviewer reconfirmed concurrence. The final diff requires its exact-head tests and CI.
+
+## Evidence pointers
+
+- `tests/integration/safe-merge-no-checks-ran.test.ts`
+- `tests/unit/feedback-factory/execute-service.test.ts`
+- `tests/unit/green-pr-automerger.test.ts`
+- `tests/e2e/feedback-execute-lifecycle.test.ts`
+- `site/src/content/docs/features/feedback-delivery-checks.md`
+- `upgrades/next/feedback-ci-floor-merge.md`
+
+## Class-Closure Declaration (display-only mirror)
+
+`defectClass: claim-vs-evidence`, `closure: guard`, `guardEvidence: { enforcementType: gate, citation: scripts/safe-merge.mjs, howCaught: the complete producer-bound CI floor is read before the head-pinned merge; pending checks return without a merge command }`.