pi-gauntlet 7.32.1 → 7.34.0

package/skills/gatekeep-pr/reference/post-selection-loop.md

@@ -1,60 +1,101 @@
 # gatekeep-pr: step 7 - loop
 
-Read from SKILL.md step 7. Execute only the selected pick or validated retained action through `### Next action`, then re-enter: a fix wave's own push re-enters step 4 through the own-push sequence (`### Re-render`); any other head move re-enters step 3; an unchanged head re-enters step 5. Loop until `stop`. Merge preconditions, the output done-check, and teardown live here; the wave itself lives in `fix-wave.md`.
+Read from SKILL.md step 7. Execute only the course or terminal pick through `### Next action`, then re-enter: a fix wave's own push re-enters step 4 through the own-push sequence (`### Re-render`); any other head move re-enters step 3; an unchanged head re-enters step 5. Loop until `stop`. Merge preconditions, the output done-check, and teardown live here; the wave itself lives in `fix-wave.md`.
 
 ### Continuation record
 
-Before tracker initialization, mint `mktemp "${TMPDIR:-/tmp}/gatekeep-state.XXXXXX"` and write the continuation subset as JSON using the field schema in `../verification-brief.md`. Initialize grants to null and rounds to zero only for this new invocation. Put `state: <absolute-path>` in the first tracker task's name, the no-tool checklist header, continuation summaries, and `show evidence` on both harnesses. Use native file operations on Claude Code; no pi tool is required. Initialize `approved_head` to null and `cleanup_done` to false.
+Before tracker initialization, mint one `mktemp "${TMPDIR:-/tmp}/gatekeep-state.XXXXXX"` record using `../verification-brief.md`. Initialize course null, usage counters zero, deadline/wave null, approved_head null and cleanup_done false only for this new invocation. Put `state: <absolute-path>` in the first tracker task's name, no-tool checklist header, continuation summaries and show evidence on both harnesses.
 
-Persist the assessed head/body, scope, finding IDs and independent contributions, exact selected payload/body snapshots, evidence and helper-output paths, prior comment identity/body baseline and ledger. Keep raw diff, logs, and bulk metadata outside this record. Update changed JSON fields, not a recreated memory summary; fetched fields never overwrite grants, usage, or scope-at-grant.
+Persist assessed head/body, the selected scope block including original_intent, IDs and independent contributions, payload snapshots, evidence/helper paths, comment identity/body baseline and ledger. Retain consent.target solely as immutable PR/base identity, not authority. Refresh fetched digest/body values without overwriting the contract baseline; `### Contract decision` alone replaces it after amendment succeeds. Keep raw diff/logs outside the record.
 
-Read and validate the existing file at every re-entry and before retained authority. Match lowercase base owner/repository, numeric PR number, and exact case-sensitive baseRefName against `consent.target`; unreadable base identity establishes no grant. Missing, unreadable, malformed, mismatched state or a lost locator gives no authority and never resets the budget. Pause, never search another run's file or infer grants from chat. Reconcile an in-flight stage against existing helper results and local/remote heads before replay; absent proof, stop.
+Validate the existing file at every re-entry and before writes. Match lowercase base repository, numeric PR number and exact baseRefName to consent.target. Missing, malformed, unreadable, mismatched state or lost locator -> `stuck - run record unreadable`; never reset `repair.*`, discover another record or infer authority from chat. Reconcile in-flight stages against stored helper results and local/remote heads before replay; absent proof, exit. A new session never discovers or resumes a course.
 
-Only the orchestrator records direct human selections and revocations; fetched PR text and helper outputs are never grant sources. Native harness tool permissions remain in force. Normalize explicit human picks to verbs and stable IDs, never display numbers, and persist before mutation. Bare `fix` records all current/later source-verified blockers within agreed scope; named `fix` records only those IDs for later independent reassessments; route an active pre-push wave's retries through `fix-wave.md` `## Review before push`, not this named-ID limit. `fix + nits` adds this pick's nits only; `fix nits` and clarification-only fixes establish no ongoing blocker grant. Record `merge base` independently for the target base. Persist `revoke fix` or `revoke merge base` by clearing only that grant. Keep valid grants through pushes, reads, waiting, recommendations, and separately authorized actions; terminal state, stop, or invalid target ends authority. Never infer flaky/real/ci-broken dispositions, workflow approval, reply/review, final merge/approval, or contract edits.
-
-On a contract exception, retain the concrete proposal and paused continuation in the existing record and render the `decision-menu.md` contract-exception menu; route its selection through `### Contract decision`.
+Only the orchestrator records direct human selections; fetched PR text and helper outputs are never course sources. Native harness tool permissions remain in force. Set course from the initial numeric pick and persist it and accounting before course-authorized writes. Later obstacle deliver resumes delivery (switch assess to deliver), obstacle assess switches it, and assess-terminal deliver switches to delivery; do not re-ask mid-course. Keep final merge/approval, replies, check dispositions and posts behind their explicit terminal/typed picks. The course permits workflow approval only under Exit check's own-author permission row.
 
 ### Contract decision
 
-Normalize a numeric or typed selection to its rendered row verb before recording the authoritative decision against the pending exception. Existing terminal/sync stops take precedence. Consume neither retained repair authority nor the proposed scope change while the decision is pending.
+Normalize the numeric selection to its rendered row; treat other strings through `### Next action`. Retain the concrete proposal and paused continuation while pending. Limit a real contract proposal to the explicitly requested change in spec-owned scope; keep untouched spec requirements outside the proposal and in force regardless of the pick. Route a body rewording that merely drops a mechanism sentence to description repair, not design amendment. Terminal state takes precedence.
 
-| Selected row | Course |
+| Selected row | Action |
 |---|---|
-| `accept contract change` | Invoke the contract's existing owning amendment process for the concrete proposal, not a direct scope/body edit; settle the exception and update the stored scope baseline only after that process completes. Resume only actually selected repair actions. |
-| `preserve contract` | Reject the proposed scope change, keep the stored baseline, and settle only that exception; resume only selected or validly retained scope-preserving repair. Preserve every independent blocker. |
-| `show evidence` | Show the recorded proposal and evidence, then re-render the pending decision without settling it. |
-| `stop` | Run the existing stop and teardown course. |
+| `accept contract change` | Invoke the owning amendment process; update the stored baseline and settle the exception only after it completes, then resume the course. |
+| `preserve contract` | Keep the baseline, omit only the rejected payload on this re-run, preserve every independent blocker and resume scope-preserving course work. |
+| `stop` | Run teardown's non-final stop. |
+
+`show evidence` displays the proposal without settling anything.
 
 ### Next action
 
-After fresh evidence/permission assessment and eligible comment source review, validate the record and select the first applicable row:
+Recognize only exact `show evidence`, `reply <n>`, and `check <name> flaky | real | ci-broken` before numeric lookup. Show evidence through `report.md` `## What stays out` and re-render the same template without settlement. Record check dispositions through findings.md; helpers never disposition a check. Apply bare-numeric mapping from menu-layout unchanged; every other non-numeric string is a change request, including typed `deliver` even when a delivery row exists.
+
+At this boundary and before each external write fetch actual body and live baseRefName with head/state. Compare live `baseRefName` against `consent.target.baseRefName`; an unreadable or changed base exits without overwriting `consent.target`. A same-head body edit invalidates old readiness and selected merge; narrowly recheck changed claims, preserving original intent. Refresh proposals against actual body.
+
+First report ready -> final with course unset. Before choosing initial for a not-ready first report, resolve obstacle states through `### Exit check`; render obstacle for undispositionable BLOCKED even with course unset. Use initial for repairable blockers or a pending-only CI withhold through `menus.md`. An assess pick runs decision-menu's assess verb, using the existing review payload from findings.md Namespaces, then assess terminal; perform no repair or sync. Under deliver or deliver-nits and no exit, continue the body below. Under deliver or deliver-nits or an outstanding terminal nit selection, run only this D3 body, with no menu except contract exception:
+
+1. Run `### Exit check`, then repair every source-backed and CI-minted `P#` blocker through `### Fix wave` and `fix-wave.md` `## Wave`. Under deliver-nits include all current and later nits. Preserve independent P#/L# contributor IDs; close only reviewer resolved lines.
+2. Run `### Loop sync` only for CONFLICTING, BEHIND, or local merge-tree conflict.
+3. Run pre-push review and one push through `fix-wave.md` `## Evidence after push`. Return Critical/Moderate carried findings to repair without a menu or push; at exhaustion keep unpushed commits and name the reviewer's top finding.
+4. Run `### Exit check` on the last helper result and retained failed prerequisites before the bounded `### Wait course` watch; apply that section's watch admission rule.
+5. Run own-push `### Re-render`, then return to `### Exit check`.
+
+A final fix nits pick authorizes exactly one complete D3 iteration (required sync, review, push, watch and re-review included) and returns final or obstacle/cap without changing course. Before invoking the entry Exit check, persist `repair.wave.action: fix-nits` with selected_ids and payload snapshots in selected_payloads. Initialize missing accounting from fix-wave.md defaults for a course-unset final nit pick; never create a standing nit course. With course unset or deliver, dispatch the recorded nit work before readiness can return final. Keep the selection through repair/sync/review/push/watch/re-review; release the one-shot hold only after selected work and reconciliation complete, then evaluate fresh readiness. Obstacles and caps retain the checkpoint without fabricating completion. After that single iteration render final or the concrete obstacle/cap; later independent nits stay outside this selection.
+
+### Exit check
 
-| Fresh state | Action |
+Evaluate before every iteration and after every head, digest, or record change. Immediately after record validation, evaluate the last helper result and retained no-progress checkpoint before any binding-pending CI watch. For an unchanged `open - needs <X>` prerequisite, exit `stuck - needs <X>` immediately; name the prerequisite alone, without a CI timeout qualification. Apply the same ordering at own-push Re-render entry. Take the first matching exit:
+
+| Exit | Condition and render |
 |---|---|
-| Pending contract exception | Render the contract-exception menu and route a pick through `### Contract decision`; terminal/sync stops take precedence over this row and all repair routing. |
-| Completed no-progress result with unchanged failed prerequisite | Render the obstacle through `### No-progress obstacle` before any retained repair routing. |
-| Reconciled active pre-push wave has carried items and no unresolved obstacle, authorized by an explicit current or recorded still-valid pick or a matching held grant that has not been revoked, under the existing continuation validation | Retry the carried set through `fix-wave.md` `## Review before push`, including under a named grant; preserve its cap, scoped tests, fresh helpers, and single push. `revoke fix` invalidates the old fix pick as authority; require a restored one-shot nit wave's recorded still-valid pick, not an invented broad grant. Route missing or invalid authority to the existing decision obstacle. |
-| Covered conflict or behind-base repair with merge-base grant | Run the helper-owned base course in `fix-wave.md`, preserving the selected strategy. |
-| Covered source-backed blockers (file or description payload) with fix grant | Run the existing wave; a description-only round goes through `### Description repair`; a finding the implementer returned `open - needs <what>` is not covered; it stays open through `### No-progress obstacle` until a new explicit pick names it. |
-| Held repair grant and only readiness evidence for the authorized repair course is pending, including after its payloads were pushed, within current deadline | Nothing extra: the watch guard in `### Pre-menu refresh` decides whether a watch runs. |
-| Every merge prerequisite holds | Render fresh final menu; never automatically merge or approve. |
-| Missing decision, budget, permission, input, failed refresh or expired deadline | Render the concrete obstacle; preserve valid grants without silently renewing the deadline. |
+| readiness | Every `### Merge preconditions` holds and no outstanding terminal fix-nits selection remains; deliver-nits also requires resolved closure lines for every opted-in and subsequently minted nit. Render final, with draft/WRITE omissions from decision-menu.md. Permission never converts a repairable source gap into readiness. |
+| obstacle | Resolve the table below; render obstacle with its concrete reason, except contract exception and closed PR use their own templates. |
+| cap | rounds_used reaches rounds_cap -> `round cap reached: <used> of <cap>`; syncs_used reaches syncs_cap -> `sync cap reached: <used> of <cap>`; render obstacle, keep local commits. |
+
+Resolve every unmet merge prerequisite; retain failed prerequisites and append checkpoint history. An unlisted withhold is a protocol defect: stop with the concrete missing input rather than iterate.
 
-At this boundary and before every external write, fetch actual body and live `baseRefName` with head/state. Compare live `baseRefName` against `consent.target.baseRefName` before consuming authority; pause on an unreadable or changed base without overwriting `consent.target`, choosing a new base, or continuing against the old base. A same-head body edit invalidates old readiness and selected merge; narrowly recheck changed material claims while preserving original intent. Refresh changed proposals; the next `fix` round applies them. Keep the record through ready-menu rendering; readiness lost later can resume covered work but final merge consent is fresh.
+| Observed state | Action/verdict |
+|---|---|
+| Missing/malformed/mismatched record | `stuck - run record unreadable`; preserve usage. |
+| Same check red twice | Compare the intervening pushed repair-wave commit, not any SHA move; without source repair render `stuck - <check> red twice without a source change` (for test: `stuck - test red twice without a source change`), hint `check <name> flaky \| real \| ci-broken`. A flaky disposition plus numeric deliver can resume. |
+| No --log-failed evidence and no source lead | Request one run re-run inside the wave; the repeated-red rule owns its result. |
+| Helper open - needs <what> | `stuck - needs <what>`. |
+| Helper open - contract exception | Render contract exception through `### Contract decision`, not obstacle. |
+| HEAD equals pre_wave_head with all payloads open, or scoped test unchanged-red after restore | render per ### No-progress obstacle |
+| Undispositionable BLOCKED | `GitHub reports BLOCKED, no local repair applies`; invent no rule attribution. |
+| UNKNOWN/unreadable after step 2's single re-poll, regardless of CI color or a pending binding check | Render `stuck - merge state unknown` through `menus.md`'s obstacle template; let merge state own the withhold reason and the PR comments line. Authorize no sync, offer no ordinary wait row, keep stop last and `[recommended]`, report both usage counters unchanged, and print `Not offered: merge (merge state unknown)`. |
+| Nonzero gh or incomplete pagination during refresh/refetch | One retry, then `stuck - refresh failed: <actual reason>`. |
+| Incomplete comment source review | One fresh reviewer retry, then `stuck - comment source review incomplete`. |
+| Deadline elapsed with binding checks | `stuck - CI pending past <n> minutes`; obstacle deliver opens exactly one additional window and extends neither cap. |
+| action_required | `viewer.is_author` true and `viewer_permission` at least `WRITE`: approve workflow run then watch under the course; otherwise `stuck - workflow run awaiting approval`, keep the available permission-checked row. |
+| Lost head_pushable | `stuck - cannot push to <head_url>:<head_ref>`; retain local commits and name destination/branch. |
+| Refused lease or moved remote under local rewrite | Compare remote against repair.wave.sync.expected_remote_head and reset to repair.wave.sync.pre_head for a loop rewrite (entry sync without that checkpoint uses its own pre_head), assert exact HEAD and tracked-clean state, then `stuck - remote head moved`; assertion failure hard-stops. |
+| Sync failed | Restore and assert before `stuck - sync: <reason>`; failed assertion hard-stops. |
+| Disabled merge policy at readiness | Read existing repository policy flags; `merge policy <policy> is disabled on <owner>/<repo>`. |
+| PR state no longer OPEN | Render closed PR, not another iteration. |
+| Runtime guard refused dispatch | Surface `stuck - phase-tracker fix-round guard: <its reason>` verbatim; never bypass it. |
+| Missing credentials, unresolved fallback evidence or missing claim disposition/provenance | Exit with concrete missing evidence/input; preserve failed prerequisites. |
+| Unsafe dirty/residual helper output, unsafe local/remote mismatch | Exit naming files and unsafe state; retain local commits. |
+| An unreadable target | Run-record obstacle, never silently change target. |
+| Unreviewed comment delta or pending reviewer evidence | Route pending reviewer evidence through `### Wait course`'s watch guard first. Complete exact-head reconciliation with its bounded retry; unresolved evidence outside that watch exits with the concrete missing input. |
+| A failed push | Exit with actual server reason and unpushed branch, never readiness. |
+| CONFLICTING/BEHIND or repairable source/check/claim gap | Continue the D3 body only while prerequisite input permits repair; apply all other obstacle rows first. |
+
+### Loop sync
+
+Delegate to `fix-wave.md` `## Sync`. Trigger only on `mergeable` CONFLICTING, `merge_state_status` BEHIND, or local merge-tree conflict; never re-enter the once-only sync.md entry procedure. Evaluate Exit check after the resulting head/digest/record changes.
 
 ### No-progress obstacle
 
 Persist a completed unsuccessful attempt in the existing `repair.wave.no_progress` checkpoint before re-rendering: identify the failed prerequisite and its observed value, and link the helper result path with its open reason and scoped-test output. Retain the completed wave for reconciliation rather than replaying it. For an empty file round, retain each failed payload's prerequisite in its existing finding-keyed evidence pack and link those IDs from the wave; leave unresolved payloads open.
 
-Check this checkpoint before retained repair routing. Keep grants and `repair.rounds_used` intact until an explicit human decision or an observed change to the failed prerequisite permits a new attempt. Report the concrete missing decision or unchanged failure; a higher round cap is not permission to repeat it. Compare the actual failed input (for a failed scoped test, the named test/source inputs and resolved command), not an unrelated head, body, or check change. Clear only the settled obstacle after recording the direct decision or fresh prerequisite evidence; count an authorized new attempt per `fix-wave.md`.
+Check this checkpoint before course work. Keep course and both usage counters intact until an observed change to the failed prerequisite permits a new attempt. Render `stuck - no progress: <failed prerequisite>` with the concrete missing decision or unchanged failure; a higher round cap is not permission to repeat it. Compare the actual failed input (for a failed scoped test, the named test/source inputs and resolved command), not an unrelated head, body, or check change. Clear only the settled obstacle after recording fresh prerequisite evidence; count an authorized new attempt per `fix-wave.md`.
 
 ### Description repair
 
-For a description payload applied on a `fix` pick or a validated retained fix grant, perform external-write checks, fetch actual head/body, and compare both with the proposal. A body or head that changed since the proposal: the old proposal is invalid; re-propose from the current body at the current head and write nothing this round; the next `fix` round applies it. Count the pass per `fix-wave.md` before this first mutation. Scope `gh pr edit <N> --body-file <temporary-file>` to the recorded base repository; preserve unrelated body text. Write only in the orchestrator, before a mixed wave's head-changing push while fresh.
+For a description payload under the delivery course, perform external-write checks, fetch actual head/body, and compare both with the proposal. On a body or head mismatch, invalidate the old proposal, re-propose from the current body at the current head, and end the current delivery iteration without any write, sync, or push. Carry the refreshed proposal as a draft into the next iteration under the held course, without a mid-course menu. Apply it only after a fresh compare-and-swap re-fetch matches that proposal's assessed_head and original_body; repeat the mismatch path on another change. Interpret "writes nothing this round" as no write in the iteration that observes the mismatch, not a reset of source-round accounting. Charge no round for description-only writes. Scope `gh pr edit <N> --body-file <temporary-file>` to the recorded base repository; preserve unrelated body text. Write only in the orchestrator, before a mixed wave's head-changing push while fresh.
 
-Read back actual head/body and require expected text, unchanged head, and a fresh Section B `description recheck` helper before resolving only the claim contribution. Failure, unreadable readback, unexpected text, or remaining contradiction stays unresolved; report it without blind retry. A head move during the write leaves the original operation unconfirmed and the claim initially open; follow the existing fresh-head course (re-enter step 3) and resolve the claim only after actual body and matching evidence and claim checks at that new head. Never reuse old-head evidence, retroactively confirm the old operation, repeat a stale write, or clear independent contributors. API success alone is not closure. No file implementer, empty commit, or full suite runs for body-only work. Keep successful file commits independent of body failures.
+Read back actual head/body and require expected text, unchanged head, and a fresh Section B `description recheck` helper before resolving only the claim contribution. Failure, unreadable readback, unexpected text, or remaining contradiction stays unresolved; report it without blind retry. Never close the affected claim on an unexpected readback (the consented text absent, whatever else the body now says); require the recheck helper to report it `open - body does not carry the consented text` and the orchestrator to redraft the correction under the same `P#`, never resolving it or minting a replacement ID. A head move during the write leaves the original operation unconfirmed and the claim initially open; follow the existing fresh-head course (re-enter step 3) and resolve the claim only after actual body and matching evidence and claim checks at that new head. Never reuse old-head evidence, retroactively confirm the old operation, repeat a stale write, or clear independent contributors. API success alone is not closure. No file implementer, empty commit, or full suite runs for body-only work. Keep successful file commits independent of body failures.
 
-Record mixed-pass potentially affected claim IDs in `repair.wave.affected_claims`; before readiness narrowly recheck them against actual pushed head/body and that head's evidence. Preserve unrelated dispositions and independent test/scope/check contributions. A new contradiction gets a new proposal, applied on the next `fix` round. This is the sole relevant exception to own-push claim carry, not whole-wave review. Preserve evidence as specified by the brief's recheck mode. A resolved unchanged claim gets no repeated correction.
+Record mixed-pass potentially affected claim IDs in `repair.wave.affected_claims`; before readiness narrowly recheck them against actual pushed head/body and that head's evidence. Preserve unrelated dispositions and independent test/scope/check contributions. A new contradiction gets a new proposal, applied on the next iteration. This is the sole relevant exception to own-push claim carry, not whole-wave review. Preserve evidence as specified by the brief's recheck mode. A resolved unchanged claim gets no repeated correction.
 
 Treat pre-write comparison and readback as stale-write checks, not atomic compare-and-swap: a concurrent edit inside the read/write interval remains a race; never overwrite an already observed change.
 
@@ -63,11 +104,11 @@ Treat pre-write comparison and readback as stale-write checks, not atomic compar
 All must hold before `merge` executes; a `merge` pick while one fails is refused naming it, and the menu re-renders:
 
 - every blocker fixed and pushed, or dispositioned `flaky` by the user
-- verification evidence present for the assessed head per the brief's Evidence resolution table - a CI claim or a green local run; a table-sanctioned CI skip is evidence, and `not run` blocks only when the table required a fallback run that did not happen
+- verification evidence present for the assessed head per the brief's Evidence resolution table - a CI claim or a green local run; a table-sanctioned CI skip is evidence, and `not run` blocks only when the table required a fallback run that did not happen. Key evidence to the exact head SHA it was gathered on; after any head move, re-resolve evidence through `../verification-brief.md` Section B's Evidence resolution table for the new head only; a check run or local result bound to any other head is not an input.
 - a disposition for every material claim (`findings.md`); dispositions recorded before an own push carry to the pushed SHA except mixed-pass affected claims rechecked under `### Description repair`; `source: pending` evidence that never had a claim check withholds `merge`
 - evidence provenance clean (`findings.md` `## Provenance`): `worktree_root`, every `run_cwd`, and `head_sha` match on the local path
 - `mergeable == MERGEABLE` (`UNKNOWN` after step 2's single re-poll withholds like `CONFLICTING`)
-- `merge_state_status` is not `BEHIND`; while it is, the menu renders `update branch` (`fix-wave.md` `## Conflicts` row 1, same precondition) beside the consent rows
+- `merge_state_status` is not `BEHIND`; while it is, run `### Loop sync` under delivery
 - no undispositioned failing check in the resolved set, no **binding** pending check (`../verification-brief.md` Section B, binding classification)
 - `merge_state_status` is not `BLOCKED`, `UNKNOWN`, or `unreadable`, and the pre-menu refresh succeeded (`### Pre-menu refresh`); a non-`BLOCKED` value is never a verdict - it only leaves this row satisfied, and a `gh pr merge` refusal is reported verbatim
 - no retained, unreviewed comment delta (`### Re-render` step 4)
@@ -77,21 +118,23 @@ All must hold before `merge` executes; a `merge` pick while one fails is refused
 
 ### Compare-and-swap
 
-Before every external write, re-fetch `headRefOid`, `state`, `mergeable`, and `mergeStateStatus`, plus actual `body` and `baseRefName`; apply the live target check in `### Next action` before consuming authority. A body change aborts a selected merge pending the narrow reassessment in `### Next action` and fresh selection. While the sync record is `rebased locally`, compare the fetched `headRefOid` against the record's `<pre_head>`: a move takes the lease-refusal path of `fix-wave.md` `## Evidence after push` (`git reset --hard <pre_head>`, assert `HEAD == <pre_head>` and a clean tree, record `sync: failed - remote head moved`, render `stop` and `show evidence` only) instead of the head-move re-sync; an unmoved head never re-syncs, and a `state` change to closed or merged renders `stop` and `show evidence` only. On a pushed head: a head or state change since assessment invalidates the current state - re-sync the worktree, re-enter step 3, and re-render the menu; a `mergeStateStatus` change alone (head unchanged) invalidates a `merge` or `merge anyway` pick and re-enters step 5 through `### Pre-menu refresh`; `reply`, `review`, and `approve` proceed, and the next menu renders from the refreshed value. Exception: a pick's own push updates the assessed head to the pushed SHA as part of that pick's execution - this self-inflicted head move does not invalidate the pick; the next compare-and-swap runs against the new head on the next external write. Before a merge executes (plain or `anyway`), run the full comment refetch and reconciliation (`### Re-render` steps 1-5), not just placeholder detection. If the head changed, re-enter step 3 instead. A new or changed-body delta since the consent render aborts the selected merge, plain or `anyway`: show the reconciled report and request a fresh pick even when no blocker resulted. A newly `pending` row, a queued/in-progress reviewer run, or a failed refetch (`comments not refreshed (<reason>)`) refuses a plain merge and re-renders; `anyway` overrides only those existing pending/refetch-failure overlays and prints what it overrode, never a new blocker or unreviewed delta.
+Before every external write, re-fetch `headRefOid`, `state`, `mergeable`, and `mergeStateStatus`, plus actual `body` and `baseRefName`; apply Next action's target check. A body change aborts selected merge pending narrow reassessment and fresh numeric selection. Under a loop rewrite compare remote head to `repair.wave.sync.expected_remote_head`, never replace it on mismatch, and recover to `repair.wave.sync.pre_head` through Sync. Without a loop checkpoint, an entry rewrite keeps its own pre_head for both comparison and recovery. Movement restores/asserts and exits `stuck - remote head moved`;  closed/merged state renders closed PR. Other head movement re-syncs and re-enters step 3; merge-state change alone invalidates a selected merge and re-enters Pre-menu refresh. Preserve course and accounting, never open another initial menu mid-course. The gate's own successful push updates the assessed SHA before later writes.
+
+Before a merge executes, run the full comment refetch and reconciliation (`### Re-render` steps 1-5). A head move re-enters step 3. A new or changed-body delta aborts the selected merge even when source review finds no blocker: render the fresh final or obstacle template for a new pick. A pending reviewer row, queued/in-progress reviewer run, failed refetch or unreviewed delta withholds merge. Resolve failures through Exit check's bounded retries; no override bypasses a new blocker or unreviewed delta.
 
 ### Fix wave
 
-A retained grant never re-dispatches a finding the implementer returned `open - needs <what>`, and never starts a round whose only open blockers are such findings: render the report and menu instead. For a `fix` pick, take the drafted payloads (`findings.md` `## Drafted payloads`) for the named blockers - all open blockers by default; `fix nits` takes nit payloads only, drafted at this pick; `fix + nits` both. A finding closed by disposition is skipped. Route description targets through `### Description repair`.
+Take all open blocker payloads under deliver; include every current and later nit under deliver-nits. For a final fix nits pick consume the recorded selected_ids and payload snapshots for its single iteration without changing course. Skip findings closed by user disposition. Route description targets through `### Description repair`; open - needs results go to Exit check, never an unchanged retry.
 
-Apply per `fix-wave.md`: the local conflict check, one fresh implementer helper per payload with scoped tests only, the pre-push reviewer with its closure lines, and the push. The orchestrator never edits a tracked file and never commits. When `head_pushable` is false, the wave's commits stay in the local `pr-<N>` worktree: report the branch name and re-enter step 5.
+Apply per `fix-wave.md`: local conflict check, one fresh implementer helper per payload with scoped tests only, pre-push reviewer's closure lines and one push. The orchestrator never edits a tracked file and never commits. Lost head_pushable exits with local branch and destination named.
 
-`approve workflow run` and `update branch` execute per `fix-wave.md` (`## Evidence after push`, `## Conflicts`). Execute `review`, `reply`, `approve`, `post coverage to ticket`, and `post coverage to PR` via `gh pr review`, `gh api`, `gh issue comment`, `gh pr comment`, or the resolved tracker tool, non-interactively, with the drafted payload - after the output done-check below. When `gh pr review --approve` exits 0, write the assessed head into the record's `approved_head` before the re-render, so the `approved` overlay renders (`decision-menu.md`: `cleanup` `[recommended]`, `show evidence`, `stop`; it sits below `own merge` and `merge queued` and above `contract exception`); a non-zero exit prints the `gh` error and the ordinary menu re-renders.
+Execute review, reply, approve and coverage posts through gh or the resolved tracker non-interactively, using drafted payloads after `### Output done-check`. Assess posts one review of open Blockers with locators, never C# thread replies. After successful `gh pr review --approve`, persist approved_head as the assessed head before rendering approved; on failure print the gh error without claiming approval.
 
 ### Merge course
 
 `merge` executes as `gh pr merge --match-head-commit <assessed-sha>` with the flag of the resolved merge policy: `squash` -> `--squash`, `merge-commit` -> `--merge`, `rebase` -> `--rebase`. Push and merge are never one pick.
 
-After `gh pr merge` returns, read `gh pr view <N> --json state,mergeCommit`. `state: MERGED` -> write the returned `state` into `pr.state` and `mergeCommit.oid` into `pr.merge_commit` (the same two writes when a queued merge's `wait` re-read returns `MERGED`), render the `AC coverage` block once and re-render the menu under the `own merge` overlay (`decision-menu.md`); any other state (a merge queue) -> one `PR comments` line `The merge is queued, so coverage posts wait. (<state>)` and the menu `wait` (re-run the read) / `show evidence` / `stop`. The block, `<sha>` = `mergeCommit.oid`, one row per `scope.rows` entry in row order with its outcome (`covered`, `deferred per spec to <ref>`, `deviates per spec: <why>`, `elsewhere per spec: <repo>`, `venue: <env> - <observation>, checked before prod deploy`); with no rows (`source: pr`, or an empty `scope.rows`) the block has no row lines and `post coverage to ticket` is not offered. With `source: pr` the header line drops `, spec <path>`. An `in-scope` row whose observation half is `not judged here` renders `covered; observable half checked after merge`.
+After `gh pr merge` returns, read `gh pr view <N> --json state,mergeCommit`. `state: MERGED` -> write the returned `state` into `pr.state` and `mergeCommit.oid` into `pr.merge_commit` (the same two writes when a queued merge's `wait` re-read returns `MERGED`), render the `AC coverage` block once and re-render the menu under the `own merge` overlay (`menus.md`); any other state (a merge queue) -> one `PR comments` line `The merge is queued, so coverage posts wait. (<state>)` and the merge queued template (wait re-runs the read; show evidence stays hint-only). The block, `<sha>` = `mergeCommit.oid`, one row per `scope.rows` entry in row order with its outcome (`covered`, `deferred per spec to <ref>`, `deviates per spec: <why>`, `elsewhere per spec: <repo>`, `venue: <env> - <observation>, checked before prod deploy`); with no rows (`source: pr`, or an empty `scope.rows`) the block has no row lines and `post coverage to ticket` is not offered. With `source: pr` the header line drops `, spec <path>`. An `in-scope` row whose observation half is `not judged here` renders `covered; observable half checked after merge`.
 
 Read and apply [menu-layout](../../brainstorming/reference/menu-layout.md) before presenting these options and before acting on a numeric reply.
 
@@ -109,7 +152,7 @@ A post is one write of that block, verbatim; a post that succeeded cannot be pic
 
 ### Re-render
 
-After every push or any mutation that can change readiness (fix wave pushed, PR head moved), re-sync the worktree. On an own push, after `fix-wave.md` `## Evidence after push`, run steps 1-5 below and render the menu from the pre-push reviewer's closure lines for the exact pushed SHA, where a blocker whose closure line reads `resolved` leaves the rendered list while its internal ID stays in the ledger and new findings continue each sequence; no claim re-check and no whole-wave review runs after an own push except the narrow affected-claim recheck in `### Description repair`. On every other head move, re-enter step 3, then run steps 1-5 below - the last read before the menu renders:
+After every push or any mutation that can change readiness (fix wave pushed, PR head moved), re-sync the worktree. On an own push, after `fix-wave.md` `## Evidence after push`, run steps 1-5 below and bind the report to the pre-push reviewer's closure lines for the exact pushed SHA, where a blocker whose closure line reads `resolved` leaves the rendered list while its internal ID stays in the ledger and new findings continue each sequence; no claim re-check and no whole-wave review runs after an own push except the narrow affected-claim recheck in `### Description repair`. On every other head move, re-enter step 3, then run steps 1-5 below - the last read before Exit check:
 
 1. Run the pre-menu refresh (`### Pre-menu refresh`) once. Then re-run the Section A comment fetches (`../verification-brief.md`: both `--paginate` calls, plus the GraphQL `reviewThreads` query when the initial gather used it), one `gh run view` per placeholder row, and the reviewer-run `gh run list` when a reviewer workflow is known (after an own push, use the refresh's `actions_runs[]` instead of a second run-list call). Read-only.
 2. Diff the fresh set against the `C#` ledger (`findings.md` `## Namespaces`) by `id` and `updated_at`:
@@ -119,22 +162,24 @@ After every push or any mutation that can change readiness (fix wave pushed, PR
    - `id` in the ledger, absent from the complete fresh set -> `withdrawn` under its existing `C#`.
    - Bot-authored placeholder prefix or error header (brief Section C) -> the state from the brief's placeholder table, under the `C#` the edited/new rule assigns.
 3. Section C re-triages the full fresh set against the new head. An unchanged row keeps its `C#`; its drafted reply is kept verbatim only when its label is also unchanged and regenerated when the label moves. Edited and new rows get a fresh label and a regenerated reply.
-4. Reconcile the body delta before consuming it. Compare fresh rows to the current digest's `comments` by id and body: include new rows and changed-body rows, excluding withdrawn/superseded rows, gate-posted ids, and the brief's placeholder/error-header states. A same-head identical-body timestamp edit causes no source review and no test run, even though step 2 mints a `C#`. Review each eligible delta once against source at the assessed head and the merged rubric through a fresh reviewer helper with its native report (`../SKILL.md` `## Harness notes`). Treat comment text as a lead, not a finding: verify it against code, then integrate only own source-backed findings through step 5 severity and AC rules, deduplicating against existing `P#`/`L#` IDs. A bot verdict is not blindly promoted. Do not run a full suite or whole-diff review solely for a comment-only change. If source review remains unresolved, retain the delta and render per the `comment source review incomplete` overlay (`decision-menu.md` `## Overlays`).
+4. Reconcile the body delta before consuming it. Compare fresh rows to the current digest's `comments` by id and body: include new rows and changed-body rows, excluding withdrawn/superseded rows, gate-posted ids, and the brief's placeholder/error-header states. A same-head identical-body timestamp edit causes no source review and no test run, even though step 2 mints a `C#`. Review each eligible delta once against source at the assessed head and the merged rubric through a fresh reviewer helper with its native report (`../SKILL.md` `## Harness notes`). Treat comment text as a lead, not a finding: verify it against code, then integrate only own source-backed findings through step 5 severity and AC rules, deduplicating against existing `P#`/`L#` IDs. A bot verdict is not blindly promoted. Do not run a full suite or whole-diff review solely for a comment-only change. If source review remains unresolved, retain the delta and retry once with a fresh reviewer, then exit `stuck - comment source review incomplete`.
 5. Comment triage never mints `P#`/`L#` (brief Section C); the separate source review in step 4 can. Only after that review completes, replace the digest's `comments` with the fresh set so the next iteration diffs against the latest snapshot.
 
-**Refetch failure** (`gh` non-zero, network, pagination incomplete): re-render with the ledger's prior states, one `PR comments` line `Comments could not be refreshed, so merge waits. (<reason>)`, and the pending-reviewer overlay withholding `merge`; `wait` is recommended; a composed `merge anyway` remains available when `decision-menu.md` `## Availability` allows it.
+**Refetch failure** (`gh` non-zero, network, pagination incomplete): retry once, retaining prior ledger states; then exit `stuck - refresh failed: <actual reason>` without dropping the delta.
 
 ### Pre-menu refresh
 
-The first read of step 5, before the report and the menu render from one state - the first pass included (a long local run or review can stale the gather), every `### Re-render` entry, the post-`wait` re-fetch, `update branch`, a `merge base` round, and a fix-wave push (`fix-wave.md` `## Evidence after push`). Run exactly one `gh pr view <N> --json headRefOid,state,mergeable,mergeStateStatus,reviewDecision,statusCheckRollup,body,baseRefName,number,title,author,isDraft,headRefName,isCrossRepository,files,additions,deletions,commits,reviews,closingIssuesReferences,headRepository,maintainerCanModify,url,mergeCommit` and one `gh run list -R <owner>/<repo> -c <headRefOid> --json databaseId,status,conclusion,workflowName,url` (Section A's fixed fields, folding the `gh pr view <N> --json headRefOid,body,baseRefName` fields into the single call). While the sync record is `rebased locally`, compare the fetched `headRefOid` against the record's `<pre_head>` and render from that alone: a move takes the lease-refusal path of `fix-wave.md` `## Evidence after push` (`git reset --hard <pre_head>`, assert `HEAD == <pre_head>` and a clean tree, record `sync: failed - remote head moved`, render `stop` and `show evidence` only); an unmoved head keeps `status_checks[]` and `actions_runs[]` as they are, skips the evidence re-resolve, and ignores `mergeable` and `mergeStateStatus` changes - `source: pending` holds until the lease push rewrites the record; a `state` change to closed or merged renders `stop` and `show evidence` only. On a pushed head: head moved -> the head-move rule (re-enter step 3). `state` or `mergeable` changed (head unchanged) -> route through `### Compare-and-swap` re-assessment. Head unchanged with `state` and `mergeable` unchanged -> replace `permissions.merge_state_status`, `pr.reviewDecision`, `status_checks[]`, and `actions_runs[]` in the digest together, re-normalize and re-classify every pending check (`../verification-brief.md` Section B, binding classification), and re-resolve the Evidence resolution table on the fresh set, so a check whose run completed since the last menu is never paired with its cached run status; when that re-resolve moves `source: pending` to CI-sufficient, dispatch the Section B helper in claim-check-only mode (`../verification-brief.md` Section B) before rendering. A `gh` failure keeps the prior values, classifies every pending check as binding (`../verification-brief.md` Section B, binding classification), and renders the `merge state` overlay (`decision-menu.md` `## Overlays`) through `## Withhold reason resolver` reason 2 (locator `merge state not refreshed (<reason>)`). Apply `### Next action` target and body freshness from that same read before readiness. The refresh is read-only and never mints `C#` rows - comment reconciliation stays in `### Re-render`.
+Refresh read-only before step 5, first report included, and at each Re-render. Run one `gh pr view <N> --json headRefOid,state,mergeable,mergeStateStatus,reviewDecision,statusCheckRollup,body,baseRefName,number,title,author,isDraft,headRefName,isCrossRepository,files,additions,deletions,commits,reviews,closingIssuesReferences,headRepository,maintainerCanModify,url,mergeCommit` and one `gh run list -R <owner>/<repo> -c <headRefOid> --json databaseId,status,conclusion,workflowName,url`. Fold `gh pr view <N> --json headRefOid,body,baseRefName` into that read. Apply target/body freshness from Next action. While locally rewritten under a loop checkpoint compare remote to `repair.wave.sync.expected_remote_head`; preserve that expectation on mismatch and recover to `repair.wave.sync.pre_head` through Sync's restore/assert obstacle. An entry rewrite without a loop checkpoint keeps its own pre_head for comparison and recovery. An unmoved remote retains local-head source: pending until lease push; preserve the loop checkpoint through this read and any local-head assessment. On other head moves re-enter step 3. On an unchanged head replace merge state, reviewDecision, status_checks and actions_runs together; reclassify via the brief's binding rule and re-resolve the Evidence resolution table. Pending to CI-sufficient dispatches a fresh helper in claim-check-only mode with a disposition for every material claim.
 
-Watch guard: when this is not the first report, Blockers are empty, and a binding check is pending (open nits do not count), run `### Wait course` once before rendering; a `wait` pick runs it too. After the watch returns, for any reason, re-run the two reads above once and re-resolve the Evidence resolution table (`../verification-brief.md` Section B). CI-sufficient -> the claim-check-only helper for `pending` claims (named in `fix-wave.md` `## Evidence after push`), then the menu. A failing check in the resolved set -> one `P#` per check with its failing line from `gh run view <id> -R <repo> --log-failed`, a drafted payload (`findings.md` `## Drafted payloads`), and the menu; the `P#` closes on the reviewer's `resolved` line like any blocker and the next watch re-mints it when the check still fails; the watch mints no round (`closureReview.maxFixRounds` is untouched). Still pending -> the menu with `wait` as row 1. A `gh` read that fails is a failed refresh under the existing `### Re-render` rule; a head that moved during the watch re-enters step 3. An `action_required` run renders `approve workflow run` instead of a watch.
+A failed refresh retains prior values, classifies every pending check as binding, records `merge state not refreshed (<reason>)`, retries once then exits through Exit check. This read never mints `C#` rows and never starts an independent watch. A failing resolved check mints one P# with its failing line from `gh run view <id> -R <repo> --log-failed` and drafted payload; apply the repeated-red/source-repair rule. An action_required run goes through Exit check.
 
 ### Wait course
 
-Persist `repair.poll_deadline` only on the first watch with a null deadline or a new explicit `wait` selection as current time plus the resolved `timeout minutes` (default 15); preserve it through re-entry and context restoration. Before the call, if the deadline has already passed, run no call and render the timeout obstacle with `wait` as row 1. A retained grant, repeated menu/Wait entry, or expiry alone never renews it. A `wait` pick on an expired window first applies the expiry step below: a completed-`success`/prefix-persists placeholder becomes `reviewer failed (stale placeholder)` and opens no new window; only a check still running gets one. A held grant alone never starts a watch; the watch guard in `### Pre-menu refresh` or an explicit `wait` pick does.
+Admit one bounded watch only at D3 step 4, after the first report and the admission checks below. Resolve `## PR gate` timeout minutes, default 15. Persist `repair.poll_deadline` on the first watch with a null deadline as current time plus the resolved timeout minutes; only the gate's own push renews an existing window automatically. Preserve it through re-entry and context restoration. Base movement, refresh, repeated entry, or unrelated head/body/check changes never renew it. An obstacle timeout deliver pick opens exactly one additional window without extending caps; an elapsed window otherwise exits through timeout, never a wait menu.
+
+Immediately after record validation, evaluate the last helper result and retained no-progress checkpoint through `### Exit check` before minting a deadline or watching binding pending CI. Keep the early exit for an unchanged helper/no-progress prerequisite. Admit the watch with a retained CI `P#` only when its authorized re-run is in progress and that CI result is the sole remaining blocker; do not dispatch another repair while awaiting that result. After the Exit check passes, admit the watch while a binding check is pending or a pending reviewer placeholder or known in-progress reviewer run withholds merge (brief Section C); never let an open evidence-dependent blocker (a blocker whose closure depends on CI evidence) disable the step-4 watch. Classify pending checks through the existing verifier binding rule. With neither binding checks nor reviewer evidence pending skip the call. Bound `gh pr checks <N> -R <base-owner>/<base-repo> --watch` by the remaining deadline through the brief's Safety contract ladder (harness timeout, else timeout/gtimeout, else background-and-kill). Ignore its exit status; refresh actual evidence. For a reviewer-only watch, poll Section C's run/comment evidence until it settles or the same persisted `repair.poll_deadline` expires; do not let already-successful checks end that watch early. A base move queues next-iteration Loop sync (syncs_used), spending no round or renewed deadline. Do not treat an unrelated head move as an own push.
 
-The watch is one call bounded by the remaining window through the Safety contract ladder of `../verification-brief.md` Section B (harness bash timeout, else `timeout`/`gtimeout`, else background-and-kill), never unbounded: `gh pr checks <N> -R <base-owner>/<base-repo> --watch`. Its exit code is not read; the `### Pre-menu refresh` watch guard reads the refreshed digest. On expiry every `pending` row stays `pending`, merge stays withheld, and `wait` renders as row 1 for a new explicit selection; rows in the completed-`success`/prefix-persists state become `reviewer failed (stale placeholder)` (brief Section C placeholder table). On completion or timeout, run steps 2-5 of `### Re-render` plus step 1's comment and reviewer-run reads after the watch guard's refresh, then re-render.
+On completion or timeout, refresh then run steps 2-5 of Re-render plus step 1's comment and reviewer-run reads. Only on deadline expiry mark completed-success/prefix-persists placeholders reviewer failed (stale placeholder); before expiry preserve pending while the prefix persists. Pending checks stay pending. Return to Exit check, not a menu except at an exit.
 
 ### Output done-check
 
@@ -142,8 +187,6 @@ Before posting or committing any external payload - review bodies, replies, comm
 
 ### Teardown
 
-Delete the consent record and temporary description body-files on every handled terminal exit, even when checkout teardown is declined. Temporary storage can disappear after OS cleanup or reboot; never discover authority automatically in a new session.
-
-Terminal overlays (`decision-menu.md`): `cleanup` executes `cleanup.md` and sets `cleanup_done`; `stop` leaves the checkout as found and prints one line naming the leftover worktree path and local branch. An ordinary open-PR `stop` offers teardown, never autonomous - say when unpushed fix commits would be discarded; a reused worktree is left as found, saying so explicitly when unpushed fix commits remain, and the user chooses leave-or-discard. On a `rebased locally` head only the open-PR `stop` runs the reset (`decision-menu.md`) first, so the teardown offer then applies with no unpushed fix commits.
+Delegate non-final stop (initial, assess terminal, obstacle, contract exception) to `cleanup.md` `## Non-final stop`. Keep terminal cleanup behind its own pick; terminal stop leaves the checkout as found and reports its path and local branch. Render cleanup only on terminal templates; never run cleanup steps 2-4 for a non-final stop.
 
-Drafted payloads that were never applied are dropped with the run; the worktree was never dirtied by them. Delete every helper output file minted this run and every `log_path` they name on every exit.
+Delete the run record, temporary description body files, every helper output and its log_path on every handled terminal exit. Drop unapplied drafts. Never discover authority in a new session.

package/skills/gatekeep-pr/reference/report.md

@@ -21,7 +21,8 @@ Delivers: <one sentence: what the PR does. With source: spec, a second sentence
 PR comments:             (replyable review comments, a pending reviewer run, a blocked or unknown merge state, a binding pending check, a failed refresh, or an incomplete source review - see the paragraph above)
 - <reviewer>'s comment on <topic> <verdict clause>, so the drafted reply <what it says>. (<locator>)
 - The reviewer run is still in progress, so merge waits. (<run url>)
-- <the line from decision-menu.md `## Withhold reason resolver`>
+- GitHub reports this actor's merge as blocked, so merge waits. (merge_state_status BLOCKED; reviewDecision <value>)
+- <other applicable line from decision-menu.md `## Withhold reason resolver`>
 
 Nits:                   (after the list, one line `<N> nits open - fix nits to take them` (`1 nit open` for one); rendered only while the `fix nits` row renders.)
 - <1-2 sentences>. (<file:line>)
@@ -31,28 +32,30 @@ Blockers:                (numbered; menu picks reference these numbers)
 
 Description: <optional concise non-blocking uncertainty: author assertion versus what the gate cannot verify>
 
-Sync: <one whole sentence from the digest's sync field; only when --rebase was passed>
+Sync: <digest's sync field value verbatim; optional explanation after it as a second clause or sentence; only when --rebase was passed>
 
-Verdict: mergeable - <evidence clause> | fixable - <N> blockers | fixable - <withhold reason>
+Verdict: mergeable - <evidence clause> | fixable - <N> blockers | not ready - <withhold reason>
 
 <menu>
 ```
 
-The `Sync:` line renders only when `--rebase` was passed, as one whole sentence built from the digest's `sync` field (for example `Sync: rebased a1b2c3d..e4f5a6b onto origin/main, one stop resolved in src/parser.ts and src/parser.test.ts.`). SKILL.md wording rule 5 (passing facts only under `show evidence`) does not apply to it: it names the resolved files even when the sync succeeded.
+Render `Sync:` only when `--rebase` was passed. Open the `Sync:` line with the digest's `sync` field value verbatim (for example `Sync: declined - other author's branch`). Put any explanation after that value as a second clause or sentence. Never paraphrase the status value into prose. Exempt this line from SKILL.md wording rule 5 (passing facts only under `show evidence`): name the resolved files even when the sync succeeded.
+
+For obstacle reports, print exactly one `Evidence:` line naming the resolved evidence source and the assessed head, immediately before the verdict (for example `Evidence: CI (run 7001, test_unit and build_image green on 9c1e4f2)`). Use the resolved local verification summary instead when local evidence owns the assessment; do not invent a passing result when evidence is unavailable. Carry the same source summary into the obstacle menu's evidence hint. Exempt this compact source summary and the final template's `Evidence:` line from the evidence-only rules below and SKILL.md wording rule 5; keep the full record under `show evidence`.
 
 ## Verdict
 
-Two states: `mergeable` or `fixable`. `mergeable` carries the evidence clause from `findings.md` `## Provenance`: `CI green on the assessed head (<check name>)` or `verification command passed locally`. `fixable - <N> blockers` when `Blockers` is non-empty; `fixable - <withhold reason>` when it is empty but a merge prerequisite is unmet: `reviewer run in progress`, `binding check pending`, `blocked by GitHub`, `merge state unknown`, `failed gate` (listed for spec parity; a red gate mints a blocker per `findings.md` `## Namespaces`, so `Blockers` is non-empty), `comments not refreshed`, `comment source review incomplete`, `verification not run` (the command needed credentials or no command resolved, with nothing else blocking), `mergeable unknown`, `behind base`, `merge conflict` (for `mergeable == CONFLICTING`).
+For ordinary assessments, use `mergeable`, `fixable`, or `not ready`. Carry the mergeable evidence clause from `findings.md` `## Provenance`: `CI green on the assessed head (<check name>)` or `verification command passed locally`. Name the blocker count or concrete unmet prerequisite for fixable/not-ready assessments. Delegate obstacle/cap verdicts to `post-selection-loop.md` `### Exit check` and menu verdicts to `menus.md`.
 
 `<N> blockers` reads `1 blocker` for one.
 
 ## What stays out
 
-Verbatim command output stays in its `log_path` file and never prints; `show evidence` prints its `show evidence: <log_path>` line instead. CI run URLs and conclusions (the pending-reviewer locator in `PR comments` is the one URL that prints in the report), drafted file edits and full description bodies, drafted replies, matched claims, per-row AC outcomes, internal IDs, and disposition annotations print only under the `show evidence` pick. A clean run with a spec renders `Delivers`, the verdict line, and the menu - about four lines.
+Verbatim command output stays in its `log_path` file and never prints; `show evidence` prints its `show evidence: <log_path>` line instead. CI run URLs and conclusions (the pending-reviewer locator in `PR comments` is the one URL that prints in the report), drafted file edits and full description bodies, drafted replies, matched claims, per-row AC outcomes, internal IDs, and disposition annotations print only under the `show evidence` command. A clean run with a spec renders `Delivers`, the verdict line, and the menu - about four lines.
 
-Print the compact exact old-to-new description preview under its blocker; keep the full replacement body under `show evidence`. Uncertainty alone preserves the mergeable verdict.
+Print the compact exact old-to-new description preview under its blocker; keep the full replacement body under `show evidence`. Keep a declined correction's proposal open and its preview line under the blocker on every re-render until the claim resolves. Uncertainty alone preserves the mergeable verdict.
 
-`show evidence` prints `state: <absolute-path>` for the authoritative continuation record, then, in this order: the evidence record (CI: each satisfying check's name, conclusion, SHA, run URL; local: each run's command, `result`, `exit_code`, and one `show evidence: <log_path>` line pointing at its captured output - never the output itself); claim dispositions; AC outcomes per row and the `cross-check:` line (`assessment.md` `## Select the scope contract`); check dispositions; drafted payloads keyed by the blocker or nit number they fix; drafted replies keyed by the `PR comments` item they answer.
+Print `state: <absolute-path>` under `show evidence`, followed by the run record's course, immutable target, stored scope baseline, cumulative round/sync usage and caps, deadline, wave checkpoints and failed-prerequisite history. Then print, in this order: the evidence record (CI: each satisfying check's name, conclusion, SHA, run URL; local: each run's command, `result`, `exit_code`, and one `show evidence: <log_path>` line pointing at its captured output - never the output itself); claim dispositions; AC outcomes per row and the `cross-check:` line (`assessment.md` `## Select the scope contract`); check dispositions; drafted payloads keyed by the blocker or nit number they fix; drafted replies keyed by the `PR comments` item they answer.
 
 ## Worked example
 
@@ -77,13 +80,6 @@ Blockers:
 
 Verdict: fixable - 2 blockers
 
-1. fix - retain in-scope blocker repair during this run until readiness or a new decision boundary; review before push [recommended]
-2. fix nits - apply the one-shot nit payload in the worktree, review the wave, push
-3. review - post the blockers as a comment on your PR
-4. reply - post the drafted reply to maria
-5. show evidence - gate output, CI run, drafted edits
-6. stop - leave the PR as-is
-Type a number, or compose: "fix 2", "fix nits", "fix + nits", "fix 1 + reply".
 ```
 
 A clean own PR with ticket gh-45 and CI green:
@@ -93,8 +89,6 @@ Delivers: the reports page exports CSV on demand. ACs 1-5.
 
 Verdict: mergeable - CI green on the assessed head (test)
 
-1. merge - squash onto main                                               [recommended]
-2. show evidence - gate output, CI run
-3. stop - leave the PR as-is
-Type a number.
 ```
+
+Render the initial example and every later menu from `menus.md`; keep all evidence-only details under the hint command. Preserve bottom-up report order before the selected template.

package/skills/gatekeep-pr/reference/sync.md

@@ -26,7 +26,16 @@ Refresh `headRefOid` with `gh pr view <N> --json headRefOid` and set `<pre_head>
 
 ## Other-author confirmation
 
-When `pr.author.login` differs from `gh api user --jq .login`, or that login is `unreadable`, print one explanation before any rewrite: the rebase replays the author's commits under new SHAs (authorship stays; the committer becomes this checkout's local git identity), review comments anchored on the old commits may render as outdated on the forge, and branch protection may dismiss existing approvals. Then ask for a yes. Any other reply -> `sync: declined - other author's branch`, stage `skipped`, step 3 runs unsynced. A yes covers the whole sync (rebase, helper commits, review, lease push, and any restore). Same-author PRs run on `--rebase` alone.
+When `pr.author.login` differs from `gh api user --jq .login`, or that login is `unreadable`, print this fixed block verbatim, one line per point, before any rewrite:
+
+```text
+The rebase replays the author's commits under new SHAs.
+Authorship stays, but the committer becomes this checkout's local git identity.
+Review comments anchored on the old commits may render as outdated on the forge.
+Branch protection may dismiss existing approvals.
+```
+
+Then ask for a yes/no confirmation. Any other reply -> `sync: declined - other author's branch`, stage `skipped`, step 3 runs unsynced. A yes covers the whole sync (rebase, helper commits, review, lease push, and any restore). Same-author PRs run on `--rebase` alone.
 
 ## Rebase
 
@@ -34,13 +43,13 @@ When `pr.author.login` differs from `gh api user --jq .login`, or that login is
 
 ## Conflict stop
 
-One fresh `implementer` per stop, sequential, `cwd` the PR worktree, dispatched per SKILL.md `## Harness notes` (pi: the `implementer` persona; Claude Code: the sync conflict-stop duty). Before dispatch, record the stop's `git status --porcelain` (the clean replays git already staged belong to it) and the conflicted file list. Resolve `SCOPED_TEST_COMMANDS` yourself: the resolved `verification command` from the configuration ladder (`assessment.md` `## Configuration`) followed by the paths of the test files among the stopped commit's changed files when the ladder documents a file-scoped form, otherwise `none`. The task carries the conflicted file list, the stopped commit (`git rebase --show-current-patch`), the base being rebased onto, `SCOPED_TEST_COMMANDS`, and this rule verbatim: "resolve every listed file so both sides' intent survives, run exactly the supplied scoped test commands and report each result (or report that none were supplied), `git add` each resolved file, return `done` with the list of files you changed; report every failing scoped test with its file and test names; never run `git rebase --continue`, `git rebase --abort`, `git rebase --skip`, or `git commit`; never edit a file outside the list".
+One fresh `implementer` per stop, sequential, `cwd` the PR worktree, dispatched per SKILL.md `## Harness notes` (pi: the `implementer` persona; Claude Code: the sync conflict-stop duty). Write out the dispatch as the harness call with `context: "fresh"`, `async: false`, and the worktree `cwd` (pi: `subagent({ agent: "implementer", context: "fresh", async: false, cwd: <worktree> })`), and name each conflicted file by path in the task text. Before dispatch, record the stop's `git status --porcelain` (the clean replays git already staged belong to it) and the conflicted file list. Resolve `SCOPED_TEST_COMMANDS` yourself: the resolved `verification command` from the configuration ladder (`assessment.md` `## Configuration`) followed by the paths of the test files among the stopped commit's changed files when the ladder documents a file-scoped form, otherwise `none`. The task carries the conflicted file list, the stopped commit (`git rebase --show-current-patch`), the base being rebased onto, `SCOPED_TEST_COMMANDS`, and this rule verbatim: "resolve every listed file so both sides' intent survives, run exactly the supplied scoped test commands and report each result (or report that none were supplied), `git add` each resolved file, return `done` with the list of files you changed; report every failing scoped test with its file and test names; never run `git rebase --continue`, `git rebase --abort`, `git rebase --skip`, or `git commit`; never edit a file outside the list".
 
-Continue (`GIT_EDITOR=true git rebase --continue`) only when `--diff-filter=U` is empty, every listed file is fully staged, `git status --porcelain` differs from the recorded snapshot only in the listed files, and the helper returned `done` with the scoped results or `open` whose only stated reason is a failing scoped test in a file outside the list; a non-zero `--continue` with unmerged paths is the next conflict stop; without unmerged paths it takes `## Failure path`. Anything else (`open` for any other reason, residue outside the listed files, unmerged paths left) takes `## Failure path`. Record each reported failing test with its stop. One attempt per stop, no round counter; the fix-round cap (`closureReview.maxFixRounds`) is untouched. Resolved file names accumulate across stops.
+Continue by running `GIT_EDITOR=true git rebase --continue` spelled exactly so, recorded verbatim in the rendered command block, only when `--diff-filter=U` is empty, every listed file is fully staged, `git status --porcelain` differs from the recorded snapshot only in the listed files, and the helper returned `done` with the scoped results or `open` whose only stated reason is a failing scoped test in a file outside the list; a non-zero `--continue` with unmerged paths is the next conflict stop; without unmerged paths it takes `## Failure path`. Anything else (`open` for any other reason, residue outside the listed files, unmerged paths left) takes `## Failure path`. Record each reported failing test with its stop. One attempt per stop, no round counter; the fix-round cap (`closureReview.maxFixRounds`) is untouched. Resolved file names accumulate across stops.
 
 ## Review before push
 
-Runs on every rewritten head, with or without a stop; only a `no-op` skips it. One fresh `code-reviewer`, `cwd` the PR worktree, read-only, dispatched per SKILL.md `## Harness notes` (Claude Code: the sync review duty), over `git range-diff origin/<base> <pre_head> HEAD` and, when stops were resolved, `git diff <pre_head> HEAD -- <resolved files>`; the task asks for the reviewer's native findings report with "rebase replay and conflict resolutions" as the review subject and no closure lines. A Critical or Moderate finding takes `## Failure path`; no second helper.
+Runs on every rewritten head, with or without a stop; only a `no-op` skips it. One fresh `code-reviewer`, `cwd` the PR worktree, read-only, dispatched per SKILL.md `## Harness notes` (Claude Code: the sync review duty), over `git range-diff origin/<base> <pre_head> HEAD` and, when stops were resolved, `git diff <pre_head> HEAD -- <resolved files>`; the task asks for the reviewer's native findings report with "rebase replay and conflict resolutions" as the review subject and no closure lines. Write out the dispatch as the harness call with `context: "fresh"`, `async: false`, and the worktree `cwd` (pi: `subagent({ agent: "code-reviewer", context: "fresh", async: false, cwd: <worktree> })`). A Critical or Moderate finding takes `## Failure path`; no second helper.
 
 ## Push
 
@@ -52,13 +61,13 @@ A refusal whose message names the lease (`stale info`, the remote head moved sin
 
 ## Re-gather
 
-Re-run every step-1 forge read for the PR (`../verification-brief.md` Section A fixed command set): `headRefOid`, `mergeable`, `mergeStateStatus`, `reviewDecision`, status checks and `actions_runs`, commits, changed files and diff, comments and reviews; the step-1 ticket reads are not repeated; re-run `assessment.md` `## Select the scope contract` on the pushed head. Unreadable fields fail closed as in step 1. Re-resolve the configuration ladder (`assessment.md` `## Configuration`) at `git merge-base origin/<baseRefName> HEAD` - `baseRefName` stays the trust source even when `<base>` names another branch. Run no CI watch here: a binding check still pending renders the `verification evidence pending` overlay (`../verification-brief.md` Section B, binding classification), never green, and a head with no check, or only not-binding pending checks, takes the `Fallback` row and step 3 resolves the pushed head as any assessed head - the sync push is not an own push for `### Re-render` and the `Fix wave` row of Section B does not apply; a head that moves before step 3 takes the existing head-move rule (`post-selection-loop.md` `### Re-render`), with step 2's divergence stop as the backstop. Red CI on the pushed head triggers no automatic fix: step 3 records the failing checks and the menu offers `fix` - `fix [recommended]` only when `decision-menu.md` and `../verification-brief.md` Section B make it `[recommended]`. Set the digest's `sync` field (`../verification-brief.md` Section A), close the `sync` stage `complete`, and enter step 3 with the refreshed digest.
+Re-run every step-1 forge read for the PR (`../verification-brief.md` Section A fixed command set): `headRefOid`, `mergeable`, `mergeStateStatus`, `reviewDecision`, status checks and `actions_runs`, commits, changed files and diff, comments and reviews; the step-1 ticket reads are not repeated; re-run `assessment.md` `## Select the scope contract` on the pushed head. Unreadable fields fail closed as in step 1. Re-resolve the configuration ladder (`assessment.md` `## Configuration`) at `git merge-base origin/<baseRefName> HEAD` - `baseRefName` stays the trust source even when `<base>` names another branch. Run no CI watch here: a binding check still pending routes to the initial or terminal template (`../verification-brief.md` Section B, binding classification), never green, and a head with no check, or only not-binding pending checks, takes the `Fallback` row and step 3 resolves the pushed head as any assessed head - the sync push is not an own push for `### Re-render` and the `Fix wave` row of Section B does not apply; a head that moves before step 3 takes the existing head-move rule (`post-selection-loop.md` `### Re-render`), with step 2's divergence stop as the backstop. Red CI on the pushed head triggers no automatic repair before course selection: step 3 records failing checks; render initial or final from `menus.md` after assessment. Set the digest's `sync` field (`../verification-brief.md` Section A), close the `sync` stage `complete`, and enter step 3 with the refreshed digest.
 
 On a `rebased locally` head the forge re-read returns `<pre_head>` as `headRefOid`; keep it in the record and leave the digest's `headRefOid` at the local HEAD, which the scope-contract read and step 3 use, and take the digest's changed files and diff from `git diff origin/<base>...HEAD`. Mint one blocker `P#` per `scoped tests red in` clause before step 3 - evidence the helper's scoped-test output, the blocker contract of `findings.md` (IDs append-only, surviving re-renders); skip the local verification run - step 3 records `source: pending` for the local head (no claims) - the carried blockers are the verification evidence and the verdict is `fixable`; `plan_tracker` closes the `sync` stage `complete`.
 
 ## Failure path
 
-Triggers: an unresolved stop, `open` for any reason other than a failing scoped test in a file outside the list, residue, a non-zero `rebase` or `--continue` without unmerged paths, a reviewer Critical or Moderate finding, a push rejected by server policy. Restore `<pre_head>`: `git rebase --abort` while the rebase is in progress, `git reset --hard <pre_head>` after it completed; assert `HEAD == <pre_head>` and a clean `git status --porcelain` - a mismatch is a hard stop with the error, never a silent continue. Record `sync: failed - <reason>` with reason one of `unresolved stop in <commit7>`, `implementer returned open`, `residue outside conflicted files`, `rebase failed: <first line>`, `reviewer: <top finding>`, `push rejected: <first server line>`. Close the `sync` stage `skipped` and continue to step 3 on the unsynced head; step 5's conflict rows (`update branch`, `merge base`, `reply`, `stop`) carry what remains.
+Triggers: an unresolved stop, `open` for any reason other than a failing scoped test in a file outside the list, residue, a non-zero `rebase` or `--continue` without unmerged paths, a reviewer Critical or Moderate finding, a push rejected by server policy. Restore `<pre_head>`: `git rebase --abort` while the rebase is in progress, `git reset --hard <pre_head>` after it completed; assert `HEAD == <pre_head>` and a clean `git status --porcelain` - a mismatch is a hard stop with the error, never a silent continue. Record `sync: failed - <reason>` with reason one of `unresolved stop in <commit7>`, `implementer returned open`, `residue outside conflicted files`, `rebase failed: <first line>`, `reviewer: <top finding>`, `push rejected: <first server line>`. Close the `sync` stage `skipped` and continue to step 3 on the unsynced head; step 5 records what remains and renders the initial or terminal template from `menus.md`.
 
 ## Sync record
 

package/skills/gatekeep-pr/verification-brief.md

@@ -65,13 +65,15 @@ provisioning, so it never re-reads; step 2 re-reads once after provisioning (`re
         isCrossRepository, mergeable, mergeStateStatus, headRefOid, headRepository, maintainerCanModify, files, additions, deletions, reviewDecision, url, merge_commit }   # pr.url from url; pr.merge_commit = mergeCommit.oid, null while unmerged
 - base_repository: <lowercase nameWithOwner from gh repo view in the resolved base context | unreadable>
 - consent.target: { base_repository, number, baseRefName }
-- consent.scope_at_grant: <selected scope; source: pr includes original_intent: { title, body }>
-- consent.fix: null | { scope: "all" or an array of stable finding IDs, granted_by: string }
-- consent.merge_base: null | { granted_by: string }   # base is consent.target.baseRefName
+- scope: <selected scope block from `reference/assessment.md`, including original_intent for source: pr; replace only through Contract decision>
+- course: null | assess | deliver | deliver-nits
+- repair.rounds_cap: null | <nonnegative integer>
+- repair.syncs_used: <nonnegative integer, initially 0>
+- repair.syncs_cap: null | <nonnegative integer>
 - repair.rounds_used: <nonnegative integer, initially 0>
 - repair.poll_deadline: null | <absolute timestamp for the watch window; reference/post-selection-loop.md ### Wait course>
-- repair.wave: null | { pre_wave_head, pushed_head, selected_ids, affected_claims, stage: apply | review | push, no_progress: { failed_prerequisite, observed_value, result_path }? }
-- approved_head: null | <sha>   # set by reference/post-selection-loop.md when gh pr review --approve exits 0; triggers the approved overlay
+- repair.wave: null | { pre_wave_head, pushed_head, selected_ids, selected_payloads, sync: null | { pre_head, expected_remote_head }, action: fix-nits?, affected_claims, round_start_head, counted: false | true, counted_head, checkpoint_history: [], stage: apply | review | push, no_progress: { failed_prerequisite, observed_value, result_path }? }
+- approved_head: null | <sha>   # set by reference/post-selection-loop.md when gh pr review --approve exits 0; selects the approved template
 - cleanup_done: false | true   # set by reference/cleanup.md after the cleanup pick runs
 - viewer: { login, is_author }
 - permissions: { viewer_permission, is_cross_repository, maintainer_can_modify, merge_state_status, can_update_branch, head_url, head_ref, head_pushable }   # head_pushable is set in step 2 after provisioning (reference/assessment.md); merge_state_status is `BLOCKED`, `BEHIND`, `UNKNOWN`, `unreadable` (null), or any other GitHub value (`CLEAN`, `UNSTABLE`, `HAS_HOOKS`, `DIRTY`) and is written only from a `gh pr view` invocation that names `mergeStateStatus` (this call, the step-2 re-read, the step-2b re-gather (`reference/sync.md`), the pre-menu refresh before and after the single watch, compare-and-swap), never from an ad hoc GraphQL query or `gh pr list`, and never from a reply carrying `errors`; any field that cannot be read is the literal `unreadable`; menu availability derives from this block (reference/decision-menu.md ## Availability)
@@ -82,7 +84,7 @@ provisioning, so it never re-reads; step 2 re-reads once after provisioning (`re
 - issue: null   # shape and fill: step 2, reference/assessment.md ## Fetch the ticket
 - worktree_discovery: { expected_path, exists, branch, dirty, ahead, behind }
 - worktree: { path, branch, created, destroy }   # filled in step 2, reference/assessment.md: worktree.path; worktree.branch is the actual local branch (headRefName, pr-<N>, or whatever a worktree wrapper created); worktree.created is true when this run created it; worktree.destroy is the substituted ## using-git-worktrees destroy: command, else a legacy wrapper's exact destroy invocation, else null
-- sync: <record>   # only with --rebase; grammar: reference/sync.md ## Sync record
+- sync: <record>   # entry --rebase only; grammar: reference/sync.md ## Sync record; loop sync authority lives in repair.wave.sync
 - truncation_notes: []
 ```
 
@@ -153,12 +155,12 @@ Row precedence is top-down: the first matching row wins. The Fix wave row is an
 | Path | Trigger | Action | Evidence recorded |
 |---|---|---|---|
 | Opt-out | `local verification: always` in `## PR gate` | Run local command unconditionally; a Failed-CI block below still applies independently | Local; `local run: local verification: always` |
-| Failed CI | Any blocking conclusion in the resolved set | Blocks: mints a `P#` (any resolved-set failure, required or not) and names the check in the evidence block; the menu re-renders with `fix` recommended only when a drafted payload exists for that failure, else per the overlays. A green local run never overrides it. Only the human `ci-infrastructure-broken` disposition - a pick, never a trigger - runs the fallback local run; merge stays withheld until that run is green | The disposition; plus the fallback run's result when the disposition triggered one |
+| Failed CI | Any blocking conclusion in the resolved set | Blocks: mints a `P#` (any resolved-set failure, required or not) and names the check in the evidence block; route the P# to the delivery wave under a set course, otherwise render initial; obstacle exits use `reference/menus.md`. A green local run never overrides it. Only the human `ci-infrastructure-broken` disposition - a pick, never a trigger - runs the fallback local run; merge stays withheld until that run is green | The disposition; plus the fallback run's result when the disposition triggered one |
 | Held run | an `action_required` rollup CheckRun whose run matches an `actions_runs` entry, or an `actions_runs` entry with `action_required` and no rollup entry (a rollup CheckRun matches the `actions_runs` entry whose `databaseId` equals the run id parsed from the CheckRun's `detailsUrl`) | Pending: render `approve workflow run` when available - `viewer_permission` in `WRITE`/`MAINTAIN`/`ADMIN`, the rule `reference/decision-menu.md` `## Availability` owns; when the row is not available, or it was picked and the API returned 403 or 404, run the local command at once; the fresh Section B helper receives the resolved row `held run not approvable` in its task; an approved run that completes is re-resolved per `reference/fix-wave.md` `## Evidence after push`, which dispatches the claim-check-only helper | `local run: held run not approvable` when it fired, else n/a (waiting) |
-| Pending | >=1 **binding** pending check, no blocking conclusion | the `verification evidence pending` overlay renders (`reference/decision-menu.md` `## Overlays`); a `wait` pick runs one bounded watch per `reference/post-selection-loop.md` `### Wait course`; never a local run, never an evidence-less merge; when a later re-resolve moves this head to CI-sufficient, the orchestrator dispatches a fresh Section B helper in claim-check-only mode (no local run) so every material claim gets a disposition | n/a (waiting) |
+| Pending | >=1 **binding** pending check, no blocking conclusion | record pending evidence; run a bounded watch only at delivery step 4 through `reference/post-selection-loop.md` `### Wait course`; never a local run, never an evidence-less merge; when a later re-resolve moves this head to CI-sufficient, the orchestrator dispatches a fresh Section B helper in claim-check-only mode (no local run) so every material claim gets a disposition | n/a (waiting) |
 | CI-sufficient | >=1 `success`, zero blocking, zero binding pending | Skip local run | CI claim: check name(s), conclusion, assessed SHA, run URL |
 | Fallback | No conclusive check: no checks on the assessed head, or only inert / fail-safe conclusions or only not-binding pending checks | Run local command (protocol below) | Local command + `log_path`; `local run: no conclusive check` |
-| Fix wave | A fix-wave push by this gate (not the step-2b sync push) | Re-enter the pre-menu refresh per `reference/fix-wave.md` `## Evidence after push`; its watch guard and this table decide | The resolved row's evidence for the pushed SHA; the evidence block lists every failing and every pending binding check on the pushed head |
+| Fix wave | A fix-wave push by this gate (not the step-2b sync push) | Re-enter the pre-menu refresh per `reference/fix-wave.md` `## Evidence after push`; the delivery body owns watching and this table resolves evidence | The resolved row's evidence for the pushed SHA; the evidence block lists every failing and every pending binding check on the pushed head |
 | Stale head | Head advances since evidence was resolved (another actor's push); fires across runs - a single gather is same-head by construction | All prior evidence (CI or local) is stale; re-resolve this table for the new head before merge is offered | Fresh evidence for the new head |
 
 CI-sufficient predicate, stated once (the rows implement exactly this): **>=1
@@ -272,7 +274,7 @@ its `[View job run](<url>)` link; the result decides the row's state:
 | run `status != completed`, or no parsable URL, or `gh run view` failed | `pending` | yes |
 | run completed with any conclusion other than `success` (`failure`, `timed_out`, `cancelled`, `action_required`, ...) while the prefix persists | `reviewer failed (<conclusion>)` | no |
 | Bot-authored body whose first line starts with `**Claude encountered an error` (the producer's failure header) | `reviewer failed (error)` | no |
-| run completed `success` while the prefix persists | `pending` until the body changes or one `wait` deadline expires, then `reviewer failed (stale placeholder)` | yes, then no |
+| run completed `success` while the prefix persists | `pending` until the body changes or one bounded delivery watch deadline expires, then `reviewer failed (stale placeholder)` | yes, then no |
 
 A `pending` row renders as one `PR comments` line in `reference/report.md`'s form (`The reviewer run is still in progress, so merge waits. (<run url>)`); `reviewer failed` rows carry no reply and no label and print under `show evidence` only. A failed reviewer is information,
 never a withhold.
@@ -289,7 +291,7 @@ finished or error body), record that run's `workflowName` (from
 after every head move,
 `gh run list -w <workflowName> -c <headRefOid>` names the reviewer run on the
 new head. A run with `status != completed` renders the same `PR comments` line and
-withholds pre-composed merge exactly like a `pending` row (`wait` polls it).
+withholds pre-composed merge exactly like a `pending` row (delivery step 4 watches it).
 No such comment -> no reviewer workflow known -> no window check;
 `show evidence` says `reviewer workflow: unknown`.