diff --git a/.env.example b/.env.example
index 4777fac..3f82618 100644
--- a/.env.example
+++ b/.env.example
@@ -55,3 +55,12 @@ GITEA_MCP_PROFILE=prgs
 # GITEA_MERGER_WORKTREE=/path/to/repo/branches/merge-pr456
 # GITEA_RECONCILER_WORKTREE=/path/to/repo/branches/reconcile-pr456
 # GITEA_ACTIVE_WORKTREE=/path/to/repo/branches/session-override
+
+# Durable HMAC key for irrecoverable decision-lock provenance artifacts (#709 F4).
+# REQUIRED in production native MCP processes that mint or verify recovery
+# authorization (reconciler + merger must share the same key). Hex (preferred),
+# base64, or utf-8 literal (>=16 bytes). Never generate an ephemeral per-process
+# key — cross-process / post-restart verification would fail closed.
+# GITEA_IRRECOVERABLE_AUTH_HMAC_KEY=0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef
+# Optional key version string bound into the signature (for rotation).
+# GITEA_IRRECOVERABLE_AUTH_HMAC_KEY_VERSION=v1
diff --git a/branch_cleanup_guard.py b/branch_cleanup_guard.py
index 66d2708..64db84a 100644
--- a/branch_cleanup_guard.py
+++ b/branch_cleanup_guard.py
@@ -7,6 +7,19 @@ from typing import Any
 
 PROTECTED_BRANCHES = frozenset({"master", "main", "dev"})
 
+# Evidence / preservation branches must never be removed by cleanup tools
+# (e.g. chore/issue-681-preserve-review-session-wip).
+_PRESERVATION_MARKERS = ("preserve", "preservation", "evidence")
+
+
+def is_preservation_or_evidence_branch(branch: str | None) -> bool:
+    """Return True when *branch* is a preservation/evidence ref that must stay."""
+    if not branch:
+        return False
+    name = str(branch).lower()
+    return any(marker in name for marker in _PRESERVATION_MARKERS)
+
+
 _RAW_BRANCH_DELETE_PATTERNS = (
     re.compile(r"\bgit(?:\s+-C\s+\S+)?\s+branch\s+-[dD]\b[^\n\r]*", re.I),
     re.compile(r"\bgit(?:\s+-C\s+\S+)?\s+push\b[^\n\r]*\s--delete\b[^\n\r]*", re.I),
@@ -72,6 +85,11 @@ def assess_merged_pr_branch_cleanup(
         reasons.append("PR head branch is missing")
     if head_branch in protected:
         reasons.append(f"branch '{head_branch}' is protected")
+    if is_preservation_or_evidence_branch(head_branch):
+        reasons.append(
+            f"branch '{head_branch}' is a preservation/evidence branch and "
+            "cannot be deleted through merged-PR cleanup"
+        )
     if head_branch in open_pr_heads:
         reasons.append("an open PR still references this head branch")
     if head_on_target is False:
@@ -96,3 +114,490 @@ def assess_merged_pr_branch_cleanup(
         "block_reasons": reasons,
         "recommended_action": "delete_remote_branch" if safe else "keep_remote_branch",
     }
+
+
+# ---------------------------------------------------------------------------
+# #687 remediation: post-delete readback + active ownership protection
+# ---------------------------------------------------------------------------
+
+READBACK_NOT_FOUND = "not_found"
+READBACK_EXISTS = "exists"
+READBACK_AUTHENTICATION = "authentication_error"
+READBACK_AUTHORIZATION = "authorization_error"
+READBACK_TRANSPORT = "transport_error"
+READBACK_UNEXPECTED = "unexpected_response"
+READBACK_AMBIGUOUS_404 = "ambiguous_not_found"
+
+# Scope of a 404: only branch-scoped absence may set verified_absent.
+NOT_FOUND_SCOPE_BRANCH = "branch"
+NOT_FOUND_SCOPE_REPOSITORY = "repository"
+NOT_FOUND_SCOPE_HOST = "host"
+NOT_FOUND_SCOPE_UNKNOWN = "unknown"
+
+ERROR_CLASS_AUTHENTICATION = "authentication"
+ERROR_CLASS_AUTHORIZATION = "authorization"
+ERROR_CLASS_TRANSPORT = "transport"
+ERROR_CLASS_UNEXPECTED = "unexpected"
+
+OWNERSHIP_CATEGORY_AUTHOR_SESSION = "author_session"
+OWNERSHIP_CATEGORY_AUTHOR_LEASE = "author_lease"
+OWNERSHIP_CATEGORY_REVIEWER_LEASE = "reviewer_lease"
+OWNERSHIP_CATEGORY_MERGER_LEASE = "merger_lease"
+OWNERSHIP_CATEGORY_CONTROLLER_LEASE = "controller_lease"
+OWNERSHIP_CATEGORY_RECONCILER_LEASE = "reconciler_lease"
+OWNERSHIP_CATEGORY_WORKTREE_BINDING = "worktree_binding"
+OWNERSHIP_CATEGORY_INVENTORY_ERROR = "ownership_inventory_error"
+
+_ROLE_TO_OWNERSHIP_CATEGORY = {
+    "author": OWNERSHIP_CATEGORY_AUTHOR_LEASE,
+    "reviewer": OWNERSHIP_CATEGORY_REVIEWER_LEASE,
+    "merger": OWNERSHIP_CATEGORY_MERGER_LEASE,
+    "controller": OWNERSHIP_CATEGORY_CONTROLLER_LEASE,
+    "reconciler": OWNERSHIP_CATEGORY_RECONCILER_LEASE,
+}
+
+_ACTIVE_OWNERSHIP_STATUSES = frozenset(
+    {"active", "live", "claimed", "in_progress", "working", "pushing", "pushed"}
+)
+_TERMINAL_OWNERSHIP_STATUSES = frozenset(
+    {"released", "abandoned", "done", "blocked", "terminal", "closed"}
+)
+_EXPIRED_STATUSES = frozenset({"expired"})
+_STALE_STATUSES = frozenset({"stale", "stale_dead_process", "stale_missing_worktree"})
+
+
+def _norm_str(value: Any) -> str:
+    return str(value or "").strip()
+
+
+def normalize_host(host: str | None) -> str:
+    """Normalize a host identity for ownership matching (no credentials)."""
+    text = _norm_str(host).lower()
+    for prefix in ("https://", "http://"):
+        if text.startswith(prefix):
+            text = text[len(prefix) :]
+    # Drop path/query if a full URL slipped through.
+    text = text.split("/", 1)[0]
+    text = text.split("?", 1)[0]
+    return text.rstrip(".")
+
+
+def ownership_category_for_role(role: str | None) -> str:
+    """Map a role kind to a non-secret ownership category label."""
+    key = _norm_str(role).lower()
+    return _ROLE_TO_OWNERSHIP_CATEGORY.get(key, f"{key or 'unknown'}_lease")
+
+
+def classify_branch_readback_http_status(
+    status_code: int | None,
+    *,
+    not_found_scope: str | None = None,
+) -> dict[str, Any]:
+    """Classify a GET-branch HTTP status into a secret-free readback result.
+
+    R1: A bare/generic/repository/wrong-host 404 never yields
+    ``verified_absent=True``. Only an authoritative *branch-scoped* not-found
+    (``not_found_scope='branch'``) may verify deletion.
+    """
+    if status_code == 404:
+        scope = _norm_str(not_found_scope).lower() or NOT_FOUND_SCOPE_UNKNOWN
+        if scope == NOT_FOUND_SCOPE_BRANCH:
+            return {
+                "status": READBACK_NOT_FOUND,
+                "error_class": None,
+                "verified_absent": True,
+                "branch_present": False,
+                "not_found_scope": NOT_FOUND_SCOPE_BRANCH,
+                "reasons": [],
+            }
+        # repository / host / unknown / generic 404 — not verified absence
+        reason = {
+            NOT_FOUND_SCOPE_REPOSITORY: (
+                "post-delete readback 404 is repository-scoped, not branch absence"
+            ),
+            NOT_FOUND_SCOPE_HOST: (
+                "post-delete readback 404 is host-scoped, not branch absence"
+            ),
+        }.get(
+            scope,
+            "post-delete readback 404 is ambiguous (not branch-scoped); "
+            "cannot verify absence",
+        )
+        return {
+            "status": READBACK_AMBIGUOUS_404,
+            "error_class": ERROR_CLASS_UNEXPECTED,
+            "verified_absent": False,
+            "branch_present": None,
+            "not_found_scope": scope,
+            "reasons": [reason],
+        }
+    if status_code in (401, 407):
+        return {
+            "status": READBACK_AUTHENTICATION,
+            "error_class": ERROR_CLASS_AUTHENTICATION,
+            "verified_absent": False,
+            "branch_present": None,
+            "reasons": ["post-delete branch readback authentication failed"],
+        }
+    if status_code == 403:
+        return {
+            "status": READBACK_AUTHORIZATION,
+            "error_class": ERROR_CLASS_AUTHORIZATION,
+            "verified_absent": False,
+            "branch_present": None,
+            "reasons": ["post-delete branch readback authorization failed"],
+        }
+    if status_code is not None and 200 <= int(status_code) < 300:
+        return {
+            "status": READBACK_EXISTS,
+            "error_class": None,
+            "verified_absent": False,
+            "branch_present": True,
+            "reasons": ["post-delete readback found branch still present"],
+        }
+    if status_code is not None and int(status_code) >= 500:
+        return {
+            "status": READBACK_TRANSPORT,
+            "error_class": ERROR_CLASS_TRANSPORT,
+            "verified_absent": False,
+            "branch_present": None,
+            "reasons": ["post-delete branch readback transport/upstream failure"],
+        }
+    return {
+        "status": READBACK_UNEXPECTED,
+        "error_class": ERROR_CLASS_UNEXPECTED,
+        "verified_absent": False,
+        "branch_present": None,
+        "reasons": ["post-delete branch readback returned an unexpected response"],
+        "http_status": status_code,
+    }
+
+
+def _extract_http_status(exc: BaseException) -> int | None:
+    """Extract an HTTP status code from an exception chain (secret-free)."""
+    seen: set[int] = set()
+    current: BaseException | None = exc
+    while current is not None and id(current) not in seen:
+        seen.add(id(current))
+        for attr in ("code", "status", "status_code"):
+            value = getattr(current, attr, None)
+            if isinstance(value, int) and 100 <= value <= 599:
+                return value
+        text = str(current) if current is not None else ""
+        match = re.match(r"HTTP\s+(\d{3})\b", text)
+        if match:
+            return int(match.group(1))
+        current = current.__cause__ or current.__context__
+    return None
+
+
+def classify_branch_readback_exception(
+    exc: BaseException,
+    *,
+    not_found_scope: str | None = None,
+) -> dict[str, Any]:
+    """Classify a GET-branch exception without leaking credentials or bodies.
+
+    R1: substring ``404`` / ``not found`` alone never becomes verified_absent.
+    Callers must pass ``not_found_scope='branch'`` only after authoritative
+    proof that the repository/host is still reachable and the 404 is branch-level.
+    """
+    status_code = _extract_http_status(exc)
+    if status_code is None:
+        lower = str(exc).lower() if exc is not None else ""
+        if any(
+            token in lower
+            for token in (
+                "timed out",
+                "timeout",
+                "connection",
+                "network",
+                "temporarily unavailable",
+                "name or service not known",
+                "nodename nor servname",
+            )
+        ):
+            return {
+                "status": READBACK_TRANSPORT,
+                "error_class": ERROR_CLASS_TRANSPORT,
+                "verified_absent": False,
+                "branch_present": None,
+                "reasons": [
+                    "post-delete branch readback transport/upstream failure"
+                ],
+            }
+        if "unauthorized" in lower:
+            status_code = 401
+        elif "forbidden" in lower:
+            status_code = 403
+        elif "404" in lower or "not found" in lower:
+            # Ambiguous: do NOT treat as branch absence without scope proof.
+            status_code = 404
+            if not_found_scope is None:
+                not_found_scope = NOT_FOUND_SCOPE_UNKNOWN
+
+    if status_code is not None:
+        return classify_branch_readback_http_status(
+            status_code, not_found_scope=not_found_scope
+        )
+
+    return {
+        "status": READBACK_UNEXPECTED,
+        "error_class": ERROR_CLASS_UNEXPECTED,
+        "verified_absent": False,
+        "branch_present": None,
+        "reasons": ["post-delete branch readback returned an unexpected response"],
+    }
+
+
+def assess_post_delete_readback(readback: dict[str, Any] | None) -> dict[str, Any]:
+    """Decide whether DELETE success may be reported after branch readback.
+
+    Success requires authoritative branch-scoped not-found
+    (``verified_absent=True``). DELETE HTTP success alone is never enough.
+    Generic/repository/host 404 cannot verify absence (R1).
+    """
+    payload = dict(readback or {})
+    status = _norm_str(payload.get("status")) or READBACK_UNEXPECTED
+    # Only explicit verified_absent flag counts — never infer from status alone
+    # when status is a bare not_found without branch scope proof.
+    verified = bool(payload.get("verified_absent")) is True
+    if verified and status == READBACK_NOT_FOUND:
+        return {
+            "ok": True,
+            "success": True,
+            "verified_absent": True,
+            "readback": {
+                "status": READBACK_NOT_FOUND,
+                "verified_absent": True,
+                "branch_present": False,
+                "error_class": None,
+                "not_found_scope": NOT_FOUND_SCOPE_BRANCH,
+            },
+            "reasons": [],
+        }
+
+    reasons = list(payload.get("reasons") or [])
+    if not reasons:
+        if status == READBACK_EXISTS:
+            reasons = ["post-delete readback found branch still present"]
+        elif status == READBACK_AUTHENTICATION:
+            reasons = ["post-delete branch readback authentication failed"]
+        elif status == READBACK_AUTHORIZATION:
+            reasons = ["post-delete branch readback authorization failed"]
+        elif status == READBACK_TRANSPORT:
+            reasons = ["post-delete branch readback transport/upstream failure"]
+        elif status == READBACK_AMBIGUOUS_404:
+            reasons = [
+                "post-delete readback 404 is not branch-scoped; "
+                "cannot verify absence"
+            ]
+        else:
+            reasons = ["post-delete branch readback could not verify deletion"]
+
+    return {
+        "ok": False,
+        "success": False,
+        "verified_absent": False,
+        "readback": {
+            "status": status,
+            "verified_absent": False,
+            "branch_present": payload.get("branch_present"),
+            "error_class": payload.get("error_class"),
+            "not_found_scope": payload.get("not_found_scope"),
+        },
+        "reasons": reasons,
+        "blocker_kind": "post_delete_readback_failed",
+    }
+
+
+def cleanup_result_envelope(
+    *,
+    success: bool,
+    performed: bool,
+    delete_acknowledged: bool,
+    verified_absent: bool,
+    **extra: Any,
+) -> dict[str, Any]:
+    """R2: consistent top-level cleanup result fields on every return path."""
+    out: dict[str, Any] = {
+        "success": bool(success),
+        "performed": bool(performed),
+        "delete_acknowledged": bool(delete_acknowledged),
+        "verified_absent": bool(verified_absent),
+    }
+    out.update(extra)
+    return out
+
+
+def _repo_matches(
+    record: dict[str, Any],
+    *,
+    remote: str,
+    org: str,
+    repo: str,
+    host: str | None = None,
+) -> bool:
+    """Match ownership record to target remote/org/repo and normalized host."""
+    if (
+        _norm_str(record.get("remote")).lower() != _norm_str(remote).lower()
+        or _norm_str(record.get("org")).lower() != _norm_str(org).lower()
+        or _norm_str(record.get("repo")).lower() != _norm_str(repo).lower()
+    ):
+        return False
+    expected_host = normalize_host(host)
+    record_host = normalize_host(record.get("host") or record.get("host_name"))
+    # When both sides declare a host, they must agree after normalization.
+    # A record host that disagrees with the expected host is out of scope.
+    # Legacy records without host still match when remote/org/repo agree.
+    if expected_host and record_host and expected_host != record_host:
+        return False
+    return True
+
+
+def _branch_matches(record: dict[str, Any], branch: str) -> bool:
+    return _norm_str(record.get("branch")) == _norm_str(branch)
+
+
+def assess_ownership_record_activity(record: dict[str, Any]) -> dict[str, Any]:
+    """Classify one ownership record as blocking or non-blocking.
+
+    Distinguishes active ownership from expired/released/terminal/stale records.
+    Expired/stale records block unless reclaim_allowed is *explicitly* True
+    (O2: never treat missing/unknown reclaim as auto-allowed).
+    """
+    status = _norm_str(record.get("status")).lower()
+    category = _norm_str(record.get("category")) or "unknown"
+    reclaim_allowed = record.get("reclaim_allowed")
+
+    if category == OWNERSHIP_CATEGORY_INVENTORY_ERROR:
+        return {
+            "blocks": True,
+            "status": status or "unknown",
+            "category": category,
+            "reason": "ownership inventory failed closed",
+        }
+
+    if status in _TERMINAL_OWNERSHIP_STATUSES:
+        return {
+            "blocks": False,
+            "status": status,
+            "category": category,
+            "reason": f"{category} ownership is terminal/released ({status})",
+        }
+    if status in _ACTIVE_OWNERSHIP_STATUSES:
+        return {
+            "blocks": True,
+            "status": status,
+            "category": category,
+            "reason": f"active {category} ownership still uses the target branch",
+        }
+    if status in _EXPIRED_STATUSES or status in _STALE_STATUSES:
+        # O2: only explicit reclaim_allowed=True skips the block.
+        if reclaim_allowed is True:
+            return {
+                "blocks": False,
+                "status": status,
+                "category": category,
+                "reason": (
+                    f"{category} ownership is {status} and reclaimable; "
+                    "does not block deletion"
+                ),
+            }
+        return {
+            "blocks": True,
+            "status": status,
+            "category": category,
+            "reason": (
+                f"{status} {category} ownership still protects the target "
+                "branch (reclaim not proven; fail closed)"
+            ),
+        }
+    # Unknown status → fail closed
+    return {
+        "blocks": True,
+        "status": status or "unknown",
+        "category": category,
+        "reason": (
+            f"unclassified {category} ownership status "
+            f"'{status or 'unknown'}'; fail closed"
+        ),
+    }
+
+
+def assess_active_branch_ownership(
+    *,
+    remote: str,
+    org: str,
+    repo: str,
+    branch: str,
+    host: str | None = None,
+    records: list[dict[str, Any]] | None = None,
+) -> dict[str, Any]:
+    """Assess whether any active ownership still uses *branch* in *repo*.
+
+    Matching requires remote/org/repo/branch and, when provided, normalized
+    host identity. Other repositories, hosts, or branches never false-block.
+    """
+    target_branch = _norm_str(branch)
+    expected_host = normalize_host(host)
+    considered: list[dict[str, Any]] = []
+    blocking: list[dict[str, Any]] = []
+    ignored: list[dict[str, Any]] = []
+
+    for raw in records or []:
+        if not isinstance(raw, dict):
+            continue
+        if not _repo_matches(
+            raw, remote=remote, org=org, repo=repo, host=expected_host or None
+        ):
+            ignored.append(
+                {
+                    "category": _norm_str(raw.get("category")) or "unknown",
+                    "reason": "different repository or host scope",
+                }
+            )
+            continue
+        if not _branch_matches(raw, target_branch):
+            ignored.append(
+                {
+                    "category": _norm_str(raw.get("category")) or "unknown",
+                    "reason": "different branch",
+                }
+            )
+            continue
+        activity = assess_ownership_record_activity(raw)
+        entry = {
+            "category": activity["category"],
+            "status": activity["status"],
+            "blocks": activity["blocks"],
+            "reason": activity["reason"],
+        }
+        considered.append(entry)
+        if activity["blocks"]:
+            blocking.append(entry)
+
+    block = bool(blocking)
+    categories = sorted({b["category"] for b in blocking})
+    reasons = [
+        (
+            "active ownership protects branch "
+            f"'{target_branch}': " + "; ".join(b["reason"] for b in blocking)
+        )
+    ] if block else []
+    return {
+        "block": block,
+        "safe_to_delete": not block,
+        "remote": remote,
+        "org": org,
+        "repo": repo,
+        "host": expected_host or None,
+        "branch": target_branch,
+        "blocking_categories": categories,
+        "blocking": blocking,
+        "considered": considered,
+        "ignored_out_of_scope": ignored,
+        "reasons": reasons,
+        "blocker_kind": "active_branch_ownership" if block else None,
+        "recommended_action": "keep_remote_branch" if block else "delete_remote_branch",
+    }
diff --git a/canonical_comment_validator.py b/canonical_comment_validator.py
index a2d05a0..b0563fd 100644
--- a/canonical_comment_validator.py
+++ b/canonical_comment_validator.py
@@ -386,6 +386,27 @@ def assess_canonical_comment(
         if not related or related.lower() in {"none", "n/a", "-"}:
             missing.append("RELATED_PRS")
 
+    # #695 AC7: untrusted / offline approval claims cannot certify merger handoff.
+    try:
+        import review_quarantine as _rq
+
+        for claim_reason in _rq.assess_untrusted_canonical_approval_claim(text):
+            extra.append(claim_reason)
+    except Exception:
+        # Fail closed on import/runtime errors for approval-shaped claims only.
+        lower = text.lower()
+        if (
+            "state:\napproved" in lower
+            or "who_is_next:\nmerger" in lower
+            or "merge_ready: true" in lower
+            or "merge_ready:\ntrue" in lower
+            or "ready-to-merge" in lower
+        ):
+            extra.append(
+                "canonical approval/merge-ready claim could not be verified "
+                "for native review proof (#695 AC7; fail closed)"
+            )
+
     allowed = not missing and not vague and not extra
     correction = ""
     if not allowed:
diff --git a/docs/architecture/mcp-stable-control-runtime-policy-adr.md b/docs/architecture/mcp-stable-control-runtime-policy-adr.md
new file mode 100644
index 0000000..00608eb
--- /dev/null
+++ b/docs/architecture/mcp-stable-control-runtime-policy-adr.md
@@ -0,0 +1,198 @@
+# ADR: Stable control runtime vs dev runtime (Gitea MCP)
+
+- **Status:** Accepted (policy effective immediately for LLM sessions; tooling may lag)
+- **Date:** 2026-07-09
+- **Tracking issue:** [#615](https://gitea.prgs.cc/Scaled-Tech-Consulting/Gitea-Tools/issues/615)
+- **Related:**
+  - [#543](https://gitea.prgs.cc/Scaled-Tech-Consulting/Gitea-Tools/issues/543) / `docs/mcp-namespace-health.md` — client-namespace health
+  - `docs/mcp-namespace-eof-recovery.md` — reconnect-only EOF recovery (no PID kill)
+  - [#558](https://gitea.prgs.cc/Scaled-Tech-Consulting/Gitea-Tools/issues/558) / `docs/mcp-daemon-import-guard.md` — sanctioned daemon
+  - [#557](https://gitea.prgs.cc/Scaled-Tech-Consulting/Gitea-Tools/issues/557) / `docs/bootstrap-review-path.md` — controller bootstrap for self-hosted fixes
+  - Allocator / control-plane ADR: `docs/architecture/mcp-allocator-control-plane-observability-adr.md` (#613 / PR #614)
+
+## 1. Context
+
+The Gitea MCP server is the **control plane** for real issue/PR mutations (create, comment, lock, review, merge, etc.). When author/reviewer/merger/reconciler sessions kill or restart that process, relaunch it from a feature worktree, or edit the checkout that process loads, operators observe:
+
+- Mid-session identity/preflight resets
+- Stale-runtime vs master parity failures
+- IDE transport EOF / “tool not found” while code on disk has changed
+- Accidental production mutations from experimental code
+
+This ADR separates **stable control runtime** from **dev/test runtime** and defines promotion proof.
+
+## 2. Decision
+
+### 2.1 Stable control runtime
+
+The Gitea MCP server used for **real workflow mutations** is the **stable control runtime**.
+
+Characteristics:
+
+- Loads a known, promoted revision of Gitea-Tools (or the packaged release layout operators designate)
+- Registered in the IDE/client as the production namespaces (`gitea-tools`, `gitea-reviewer`, `gitea-merger`, `gitea-reconciler`, etc.)
+- Holds production profile credentials via sanctioned keychain/env paths only
+
+### 2.2 Dev / test runtime
+
+MCP **server code** development and testing:
+
+- Happens in isolated **`branches/`** worktrees (or other non-stable checkouts)
+- May use a **separate** dev/test MCP runtime/process when process-level testing is required
+- **Must not** be used for real Gitea mutations on production issues/PRs
+
+### 2.3 Forbidden actions (normal sessions)
+
+Normal **author, reviewer, merger, and reconciler** LLM sessions **must not**:
+
+| Forbidden | Why |
+|-----------|-----|
+| Kill the running MCP server process | Drops all concurrent sessions; loses preflight state |
+| Restart / relaunch the MCP server process | Same as kill; causes stale/identity churn mid-workflow |
+| Relaunch MCP from a development worktree | Runs unpromoted code against production mutations |
+| Edit files in the stable runtime checkout | Hot-mutates control plane under concurrent users |
+| Use experimental/dev MCP for real Gitea mutations | Bypasses promotion proof and audit expectations |
+| Bypass or self-reset a stale master-parity gate | The gate is fail-closed; only an operator reload restores parity |
+
+**LLM-allowed vs operator-owned (authoritative split):**
+
+| Actor | May do | Must not do |
+|-------|--------|-------------|
+| **LLM session** | Call tools on the already-running stable namespaces; **client reconnect** after transport EOF (no process kill); pass `worktree_path` / role worktree args; report blockers and stop mutations when unhealthy/stale | Kill, restart, or relaunch any MCP process; bump config mtimes to force reload; edit the stable checkout; switch to a dev MCP for production mutations |
+| **Operator / release-manager** | Supervised restart/reload of the **stable** control runtime; dual-namespace client configuration; §2.4 promotions; incident recovery | — |
+
+EOF / transport recovery for LLM sessions: **client reconnect only** (see `docs/mcp-namespace-eof-recovery.md`). Do not “fix” health by killing PIDs or bumping MCP config mtimes as a normal session procedure.
+
+This ADR **supersedes** any older runbook wording that told the LLM to relaunch or restart the client/MCP as a self-service step. Where `docs/llm-workflow-runbooks.md` (or wiki runbooks) discuss dual-namespace setup or workspace rebind, **process restart/relaunch is operator-owned**; the LLM stops, reports, and waits.
+
+### 2.4 Promotion (operator / release-manager only)
+
+Promotion of a new revision into the stable control runtime is an **explicit operator/release-manager action**, not an LLM self-service step.
+
+A promotion **must record** (issue comment, release note, or promotion ledger):
+
+| Field | Description |
+|-------|-------------|
+| **previous runtime SHA** | Commit previously loaded by stable runtime |
+| **promoted runtime SHA** | Commit after promotion |
+| **source branch/PR** | Where the change was reviewed |
+| **restart/reload method** | How the process was cycled (e.g. supervised restart, client reload) |
+| **health check proof** | Client-namespace probe success (`gitea_whoami` / namespace health) |
+| **identity/profile proof** | Expected profile(s) and username(s) after reload |
+| **workspace/root proof** | Stable checkout path / root matches intended layout |
+| **mutation capability proof** | Required permissions for the target role present; forbidden ops still forbidden |
+| **rollback instructions** | How to restore previous SHA and re-verify health |
+
+Suggested durable marker:
+
+```text
+## MCP STABLE RUNTIME PROMOTION (#615)
+
+Status: COMPLETED | ROLLED_BACK | ABORTED
+Previous-SHA: <full sha>
+Promoted-SHA: <full sha>
+Source-PR: <number>
+Source-Branch: <name>
+Reload-Method: <text>
+Health-Proof: client_namespace whoami OK / assess_mcp_namespace_health OK
+Identity-Proof: profile=<name> user=<name>
+Workspace-Proof: root=<path>
+Mutation-Proof: allowed_ops include <…>; forbidden include <…>
+Rollback: checkout <previous sha>; reload method <…>; re-run health/identity proofs
+Operator: <username>
+Timestamp: <ISO-8601>
+```
+
+### 2.5 Unhealthy stable runtime → stop work
+
+If the stable MCP runtime is **unhealthy**, including any of:
+
+- client-namespace probes fail
+- wrong identity / wrong profile
+- wrong workspace root
+- missing mutation capability for the intended role
+- persistent EOF after **client reconnect**
+- **master parity is stale** (`startup_head` behind on-disk `master` / `restart_required` from the parity gate)
+
+then:
+
+1. **Normal PR / review / merge / issue-mutation work must stop immediately.**
+2. The session **reports** the unhealthy/stale state (tool error, CTH, or operator handoff) with startup vs current head when known.
+3. Do **not** improvise: no LLM process kill/restart, no dev-worktree MCP for production mutations, no env escape hatches, no manual gate bypass.
+4. Resume only after:
+   - an **operator** restores the runtime (see §2.6 for routine post-merge parity reload), **or**
+   - a **controlled** promotion/rollback completes with the §2.4 promotion record, **or**
+   - a controller invokes the narrow **bootstrap review path** (#557) when the defect is self-hosted and documented,
+   - **and** the session re-verifies health (and master parity when applicable) before the next mutation.
+
+### 2.6 Routine post-merge master-parity staleness (operator reload, not promotion)
+
+**Symptom:** After merges land on `master`, a long-lived stable MCP process still runs the pre-merge `startup_head`. The master-parity gate marks the server **stale** / `restart_required` and **blocks mutations**.
+
+**Sanctioned response (authoritative):**
+
+| Step | Actor | Action |
+|------|-------|--------|
+| 1 | LLM session | Mutations stop immediately when the gate reports stale. |
+| 2 | LLM session | Report the stale state (startup head, current master head, that operator reload is required). Do not retry mutations. |
+| 3 | **Operator** | Reload/restart the **stable** control MCP so it loads current `master` (supervised client/daemon reload). |
+| 4 | LLM session | Resume only after startup/current-head parity is verified (e.g. `gitea_get_runtime_context` / parity assessment shows in parity). |
+
+**Not a §2.4 promotion:** Catching the already-designated stable control checkout up to a newly advanced `master` is a **routine operator reload** of the stable runtime. It does **not** require the nine-field promotion ledger. Use §2.4 only when **changing which unpromoted/dev revision** becomes the stable control runtime (new source branch/PR into the stable designation).
+
+**Code note:** `master_parity_gate.py` may still say “restart the server” in machine-facing reason strings. That string names the **operator recovery action**, not an LLM self-service instruction. This ADR and the runbooks define the actor split.
+
+## 3. Relationship to other controls
+
+| Doc / mechanism | Interaction |
+|-----------------|-------------|
+| Namespace health (#543) | Proves IDE client can call tools; does not authorize restart |
+| EOF recovery | Reconnect only; no process kill |
+| Daemon import guard (#558) | Mutations require sanctioned daemon; not a bare shell import |
+| Bootstrap path (#557) | Only controller-authorized exception when live runtime cannot review its own fix |
+| Allocator / control-plane ADR | Coordination DB is separate; still depends on a healthy MCP surface for Gitea writes |
+
+## 4. Consequences
+
+### Positive
+
+- Predictable control plane for concurrent LLMs
+- Clear operator-only promotion gate with rollback
+- Aligns session behavior with health/EOF docs already landed
+
+### Costs
+
+- LLM sessions must wait when runtime is sick (no DIY restart)
+- Operators must maintain promotion discipline and dual-runtime config if they use a dev MCP
+
+### Non-goals
+
+- Does not ban operator-supervised restarts during incidents
+- Does not replace CI or code review for MCP changes
+- Does not authorize editing stable checkout “because tests need a quick fix”
+
+## 5. Implementation follow-ups (optional tooling)
+
+These may land in later issues; the **policy binds sessions now**:
+
+1. Session preflight that refuses mutations if workspace root equals a `branches/` feature worktree configured as “dev only.”
+2. Explicit `runtime_kind=stable|dev` in MCP config and `gitea_whoami` profile metadata.
+3. Promotion checklist script that emits the durable promotion marker fields.
+
+**Not optional (issue #615 acceptance criterion 2):** operator guide and runbooks **must** cross-link this ADR (see §6). Cross-links are documentation acceptance, not deferred tooling.
+
+## 6. Acceptance for this ADR
+
+1. Document merged under `docs/architecture/mcp-stable-control-runtime-policy-adr.md`.
+2. **Operator guide / runbooks cross-link this ADR** (`docs/wiki/Operator-Guide.md`, `docs/wiki/Runbooks.md`, `docs/llm-workflow-runbooks.md`).
+3. Issue #615 references this path.
+4. LLM/operator runbooks treat kill/restart/relaunch-from-worktree as **LLM violations**; process restart is **operator-owned**.
+5. Unhealthy runtime (including **stale master parity**) stops normal mutation work until operator restore/reload, promotion/rollback, or #557 bootstrap — then re-verify parity before mutating.
+6. Routine post-merge parity reload is documented as operator reload (§2.6), not an LLM self-restart and not a full §2.4 promotion.
+
+## 7. Document history
+
+| Date | Change |
+|------|--------|
+| 2026-07-09 | Initial ADR: stable vs dev runtime, forbidden session actions, promotion proof fields, stop-work rule |
+| 2026-07-16 | Review 443 remediation (#615 / PR #616): mandatory cross-links; LLM vs operator restart split; routine post-merge parity staleness (§2.6); stale parity in §2.5 unhealthy triggers |
diff --git a/docs/gitea-execution-profiles.md b/docs/gitea-execution-profiles.md
index 970f5d4..877d201 100644
--- a/docs/gitea-execution-profiles.md
+++ b/docs/gitea-execution-profiles.md
@@ -238,11 +238,43 @@ narrow operation set:
 - `gitea.issue.comment`
 - `gitea.issue.close`
 - `gitea.pr.close`
+- `gitea.branch.delete` (merged-branch cleanup only — see below)
 
 Forbidden on reconciler profiles: `gitea.pr.approve`, `gitea.pr.merge`,
 `gitea.pr.review`, `gitea.pr.create`, `gitea.branch.push`, and
 `gitea.repo.commit`.
 
+### Merged-branch cleanup ownership (`gitea.branch.delete`)
+
+The reconciler is the repository-supported owner of merged-PR source-branch
+cleanup: `task_capability_map` maps `cleanup_merged_pr_branch` (and
+`reconciliation_cleanup`) to role `reconciler` with permission
+`gitea.branch.delete`. Post-merge branch lifecycle is reconciliation work —
+it happens after the author, reviewer, and merger roles have completed, and
+it must not be reachable from those roles.
+
+Least-privilege constraints:
+
+- `gitea.branch.delete` is granted **only** to reconciler profiles. Author,
+  reviewer, and merger profiles must never hold it; `gitea_delete_branch`
+  and `gitea_cleanup_merged_pr_branch` fail closed on any profile without
+  the permission.
+- Even with the permission, reconciler deletion is only supported through the
+  guarded `gitea_cleanup_merged_pr_branch` path (#514 / #687): the PR must be
+  merged, the head an ancestor of the target, the branch not protected
+  (`master`/`main`/`dev`), the branch not a preservation/evidence ref (e.g.
+  `chore/issue-681-preserve-review-session-wip`), no open PR may still use the
+  head, and an explicit `CLEANUP MERGED PR <n> BRANCH <branch>` confirmation is
+  required. Raw `gitea_delete_branch` is **denied** to reconciler even when
+  `gitea.branch.delete` is present.
+- Raw `git branch -d` / `git push --delete` cleanup remains blocked by
+  `branch_cleanup_guard` and the final-report validator regardless of
+  profile permissions.
+- `gitea.branch.delete` has no short alias in `GITEA_OPERATION_ALIASES`;
+  write it fully qualified in `allowed_operations`. Migration must emit
+  canonical names such as `gitea.pr.close` (never bare `pr.close` /
+  `issue.close`, which the production normalizer rejects or drops).
+
 Launch a static `gitea-reconciler` MCP namespace with
 `GITEA_MCP_PROFILE=prgs-reconciler`. Profile shape is validated by
 `reconciler_profile.assess_reconciler_profile` (#304). Use the
@@ -251,6 +283,159 @@ Launch a static `gitea-reconciler` MCP namespace with
 fresh target-branch fetch, recorded target SHA, and ancestor proof. PRs whose
 heads are not already landed cannot be closed through this path.
 
+### Operational runbook: grant reconciler `gitea.branch.delete` (#687)
+
+Merging a code PR that updates `migrate_profiles.py` / `reconciler_profile.py`
+**does not** change the live operator profile on disk. Apply the profile
+change deliberately, then reconnect the client-managed namespace.
+
+1. **Approved migration / profile-update command** (from the repo root, using
+   the project venv if present):
+
+   ```bash
+   # Dry-run first (default): validates v2 output, writes nothing
+   python3 migrate_profiles.py -i ~/.config/gitea-tools/profiles.json
+
+   # Apply: creates backup then writes migrated v2 config
+   python3 migrate_profiles.py -i ~/.config/gitea-tools/profiles.json -w
+   # Optional explicit paths:
+   # python3 migrate_profiles.py -i ~/.config/gitea-tools/profiles.json \
+   #   -o ~/.config/gitea-tools/profiles.json \
+   #   --backup ~/.config/gitea-tools/profiles.json.bak -w
+   ```
+
+   If the live file is already v2, edit the reconciler identity’s
+   `allowed_operations` / `forbidden_operations` under
+   `environments.<env>.services.gitea.identities.reconciler` (or the
+   `prgs-reconciler` alias target) so allowed includes the canonical set
+   below — then re-validate with a load of the config (see step 3).
+
+2. **Inspect the generated (or edited) profile** — confirm the reconciler
+   identity, for example:
+
+   ```bash
+   python3 - <<'PY'
+   import json
+   from pathlib import Path
+   cfg = json.loads(Path.home().joinpath(".config/gitea-tools/profiles.json").read_text())
+   # v2 environments shape:
+   ident = cfg["environments"]["prgs"]["services"]["gitea"]["identities"]["reconciler"]
+   print("role:", ident.get("role"))
+   print("allowed:", ident.get("allowed_operations"))
+   print("forbidden:", ident.get("forbidden_operations"))
+   PY
+   ```
+
+3. **Validate canonical operation names and least privilege**
+
+   Expected canonical **allowed** (defaults after migration):
+
+   - `gitea.read`
+   - `gitea.pr.close` (required)
+   - `gitea.pr.comment`
+   - `gitea.issue.comment`
+   - `gitea.issue.close`
+   - `gitea.branch.delete` (recommended; cleanup only)
+
+   Expected **forbidden** includes at least: `gitea.pr.approve`,
+   `gitea.pr.merge`, `gitea.pr.review`, `gitea.pr.create`,
+   `gitea.branch.push`, `gitea.repo.commit`.
+
+   No shorthand (`pr.close`, `issue.close`, `pr.comment`) may remain.
+   Validate with the production loader:
+
+   ```bash
+   python3 - <<'PY'
+   import gitea_config, reconciler_profile
+   from pathlib import Path
+   path = str(Path.home() / ".config/gitea-tools/profiles.json")
+   gitea_config.load_config(path)  # fails closed on invalid config
+   # Or assess the reconciler lists directly after extracting them:
+   # print(reconciler_profile.assess_reconciler_profile(allowed, forbidden))
+   PY
+   ```
+
+4. **Merging PR #688 (or any code PR) does not update the live profile.**
+   Code changes only the migration helper, schema, docs, and tests. The
+   operator must still run `migrate_profiles.py -w` or an equivalent
+   authorized edit of `~/.config/gitea-tools/profiles.json`.
+
+5. **Supported apply method:** `python3 migrate_profiles.py … -w` (backup
+   created automatically) **or** operator-authorized edit of the live
+   profiles file after backup. Unsupported: silent mtime tricks, manual
+   process kill to “reload”, or undocumented env overrides.
+
+6. **Backup and validation:** `-w` copies the input to
+   `<input_path>.bak` (or `--backup PATH`) before writing. Re-run
+   `load_config` / `assess_reconciler_profile` after write. Keep the
+   `.bak` until live whoami/capability checks pass.
+
+7. **Client-managed namespace reconnect/reload:** reconnect or reload the
+   IDE MCP client so `gitea-reconciler` restarts from current `master` and
+   the updated `GITEA_MCP_PROFILE=prgs-reconciler` config. Do not hand-launch
+   `mcp_server.py` / `gitea_mcp_server.py` with ad hoc `GITEA_*` env
+   (see #686 / #630).
+
+8. **Live reverification** (through the client-managed `gitea-reconciler`
+   namespace only):
+
+   - `gitea_whoami` → identity + profile `prgs-reconciler`
+   - `gitea_assess_master_parity` → `stale=false`, `restart_required=false`
+   - `gitea_resolve_task_capability(task="cleanup_merged_pr_branch")` →
+     `allowed_in_current_session=true` only when permission and role match
+   - `gitea_resolve_task_capability(task="delete_branch")` →
+     **not** allowed for reconciler (role denial must be enforced)
+
+9. **Guarded cleanup usage** (example for a merged PR whose source branch
+   remains on the remote):
+
+   ```text
+   gitea_cleanup_merged_pr_branch(
+     pr_number=<N>,
+     branch=<exact PR head branch>,
+     confirmation="CLEANUP MERGED PR <N> BRANCH <exact PR head branch>",
+     remote="prgs",
+     org="Scaled-Tech-Consulting",
+     repo="Gitea-Tools",
+     worktree_path="<path under branches/>",
+   )
+   ```
+
+   The tool refuses unmerged PRs, protected branches, preservation/evidence
+   branches, open-PR heads, mismatched branch names, and wrong confirmation.
+
+10. **Prohibitions**
+
+    - No raw `git push --delete`, `git branch -d` / `-D`, or delete refspecs
+    - No arbitrary `gitea_delete_branch` from reconciler
+    - No unsupported profile switching mid-run without full re-preflight
+    - No ad hoc hand-edits of live profiles **unless** operator-authorized,
+      backed up, and revalidated as above
+
+Canonical migrated reconciler example:
+
+```json
+{
+  "role": "reconciler",
+  "allowed_operations": [
+    "gitea.read",
+    "gitea.pr.close",
+    "gitea.pr.comment",
+    "gitea.issue.comment",
+    "gitea.issue.close",
+    "gitea.branch.delete"
+  ],
+  "forbidden_operations": [
+    "gitea.pr.approve",
+    "gitea.pr.merge",
+    "gitea.pr.review",
+    "gitea.pr.create",
+    "gitea.branch.push",
+    "gitea.repo.commit"
+  ]
+}
+```
+
 ## Identity and fail-closed rules
 
 Before **any** mutating action, a workflow must know both:
diff --git a/docs/llm-workflow-runbooks.md b/docs/llm-workflow-runbooks.md
index 5fc591b..213b661 100644
--- a/docs/llm-workflow-runbooks.md
+++ b/docs/llm-workflow-runbooks.md
@@ -195,7 +195,7 @@ To avoid the bottleneck of relaunching/restarting the MCP server to switch betwe
   `gitea_reconcile_already_landed_pr` after ancestry proof — not for normal
   review or author workflows.
 
-* **Fallback:** If the dual-profile MCP launcher pattern is not supported or configured in the client, the LLM must relaunch or restart the client/MCP with the correct profile environment variable before claiming or working on any tasks.
+* **Fallback (operator-owned):** If the dual-profile MCP launcher pattern is not supported or configured in the client, **do not** have the LLM relaunch or restart the client/MCP. The LLM **stops** role-switching work, reports that the correct static namespace is missing, and waits for an **operator** to configure dual namespaces or reload the client with the correct `GITEA_MCP_PROFILE` for that role. Process restart/relaunch is operator-owned under the [stable control runtime ADR](architecture/mcp-stable-control-runtime-policy-adr.md) (#615).
 
 ## Setup runbook — interactive menu
 
@@ -1200,10 +1200,13 @@ When a mutation blocks on workspace binding:
 
 1. Read the error — it names the **resolved workspace path**, **role
    namespace**, and **binding source** (tool arg, env var, or process root).
-2. Reconnect or relaunch the correct namespace MCP server from the intended
-   workspace (or set the role-specific env var before launch).
-3. Pass `worktree_path` on reviewer/merger mutation tools when the active
-   branches/ worktree differs from the MCP process root.
+2. **LLM-allowed:** pass `worktree_path` on reviewer/merger mutation tools when
+   the active `branches/` worktree differs from the MCP process root; **client
+   reconnect** after transport EOF only (no process kill).
+3. **Operator-owned:** if the wrong namespace process was launched, or a role-
+   specific `GITEA_*_WORKTREE` must be set at process start, an **operator**
+   reloads/relaunches the correct static namespace MCP. LLM sessions must not
+   kill or restart MCP processes (see [stable control runtime ADR](architecture/mcp-stable-control-runtime-policy-adr.md)).
 4. **Do not** clean, reset, or discard foreign role worktrees to unblock your
    own namespace — that destroys another agent's WIP.
 
@@ -1213,9 +1216,10 @@ When posting a Canonical Thread Handoff after a binding blocker:
 
 - State which namespace was active (author / reviewer / merger / reconciler).
 - Quote the resolved workspace path and binding source from the error.
-- Name the safe reconnect action (relaunch MCP from `branches/...`, set
-  `GITEA_*_WORKTREE`, or pass `worktree_path`).
-- Explicitly note that foreign worktrees must not be cleaned to unblock.
+- Name the safe next action: pass `worktree_path` if that unblocks the tool, or
+  request an **operator** reload of the correct namespace MCP / env binding.
+- Explicitly note that foreign worktrees must not be cleaned to unblock, and
+  that the LLM must not self-restart the MCP process.
 
 ## Safety notes
 
@@ -1226,6 +1230,7 @@ When posting a Canonical Thread Handoff after a binding blocker:
 
 ## Related documents
 
+- [`architecture/mcp-stable-control-runtime-policy-adr.md`](architecture/mcp-stable-control-runtime-policy-adr.md) — stable control runtime vs dev runtime; LLM must not kill/restart MCP; operator-owned reload and promotions; routine post-merge parity staleness (#615).
 - [`reviewer-handoff-consistency.md`](reviewer-handoff-consistency.md) — reject contradictory reviewer handoffs (#501).
 - [`issue-acceptance-gate.md`](issue-acceptance-gate.md) — controller issue-acceptance audit after PR merge (#500).
 - [`../skills/llm-project-workflow/SKILL.md`](../skills/llm-project-workflow/SKILL.md) — portable cross-project LLM workflow skill.
diff --git a/docs/mcp-daemon-import-guard.md b/docs/mcp-daemon-import-guard.md
index 8378dbd..88e3c2f 100644
--- a/docs/mcp-daemon-import-guard.md
+++ b/docs/mcp-daemon-import-guard.md
@@ -1,23 +1,92 @@
-# MCP daemon import and keychain guard (#558)
+# MCP daemon import and native-transport guard (#558 / #695)
 
 ## Problem
 
-During deadlock debugging, agents imported `gitea_mcp_server` / ran credential
-helpers from a raw shell, bypassing preflight purity and role gates.
+During deadlock debugging and the PR #694 incident (#695), agents imported
+`gitea_mcp_server` or ran credential helpers from a raw shell / offline helper,
+bypassing native MCP transport, preflight purity, and role gates. Contaminated
+formal reviews then looked identical to native approvals.
 
 ## Rule
 
-Mutation auth and keychain fill require a **sanctioned MCP daemon** process.
+Mutation auth, keychain fill, and controller quarantine require a **production
+native MCP transport runtime** established only by:
+
+1. the **resolved absolute path** of the canonical entrypoint
+   (`mcp_server.py` / `gitea_mcp_server.py` next to `mcp_daemon_guard.py`), and
+2. a live **transport bind** (`bind_native_mcp_transport(transport="stdio")`)
+   immediately before `mcp.run`.
+
+Basename-only trust (a renamed file called `mcp_server.py`), caller-controlled
+flags (there is **no** `allow_test_bootstrap`), environment variables, stack
+frame spoofing, or import-only launch are insufficient.
 
 | Context | Allowed |
 |---------|---------|
-| Official MCP entrypoint (`mcp_server.py` / `gitea_mcp_server` `__main__`) sets `GITEA_MCP_SANCTIONED_DAEMON=1` | yes |
-| pytest | yes |
-| `GITEA_ALLOW_DIRECT_MCP_IMPORT=1` (operator/tests only) | yes |
-| bare `python -c 'import gitea_auth; get_auth_header(...)'` | **no** |
-| keychain fill without daemon | **no** unless `GITEA_ALLOW_KEYCHAIN_CLI=1` |
+| Official IDE-native MCP: resolved canonical entrypoint marks + binds stdio, holds process-local runtime token | yes |
+| pytest (hermetic unit tests) via `is_pytest_runtime()` | yes for unit gates |
+| `install_test_native_runtime()` under pytest (test-mode record) | unit-test transport gates only — **never** production Gitea mutations |
+| `allow_test_bootstrap=True` (removed; must not exist) | **no** |
+| Renamed runner basename `mcp_server.py` outside package root | **no** |
+| Import/launch of real entrypoint without transport bind | **no** |
+| `GITEA_MCP_SANCTIONED_DAEMON=1` alone (no process-local native runtime) | **no** (#695) |
+| `GITEA_ALLOW_DIRECT_MCP_IMPORT=1` in LLM sessions | **no** — never set; never authorizes mutations (#695 AC1 / PR #701) |
+| Override `GITEA_MCP_SESSION_STATE_DIR` mid-session | **no** — production bind pins state root; redirect cannot forge independent decision locks (#695 AC2 / PR #701) |
+| `GITEA_ALLOW_KEYCHAIN_CLI=1` in LLM sessions | **no** — human operator only |
+| bare `python -c 'import gitea_mcp_server; …'` or offline runners | **no** |
+| keychain fill outside native/pytest | **no** |
+
+Native runtime is **process-local**: a random token bound to the daemon PID and
+transport phase. It is never reconstructed from environment variables,
+session-state files, caller-controlled flags, or importing internals in a
+fresh Python process.
+
+## Contaminated review quarantine (#695 AC8)
+
+Controller/reconciler/merger profiles may call
+`gitea_quarantine_contaminated_review` with explicit confirmation:
+
+```text
+QUARANTINE CONTAMINATED REVIEW <review_id> PR <pr_number>
+```
+
+Quarantine records are durable under the MCP session-state root and are
+**honored** by:
+
+- `gitea_get_pr_review_feedback` (quarantined approvals do not authorize merge)
+- `gitea_check_pr_eligibility` action=`merge`
+- `gitea_merge_pr` (mutation)
+- merger lease adoption paths that read `approval_at_current_head`
+
+Forensic Gitea reviews and historical comments are **never deleted**.
+
+## STOP after native MCP failure (AC10)
+
+If the native MCP namespace dies (EOF, capability disconnect, session death):
+
+1. **STOP.** State BLOCKED + DIAGNOSE.
+2. Do **not** import `gitea_mcp_server` from a standalone process.
+3. Do **not** run `offline_mcp_helper.py`, `offline_mcp_runner.py`,
+   `run_quarantine.py`, or any offline mutation helper.
+4. Do **not** set direct-import, keychain-bypass, or raw-token environment
+   variables.
+5. Reconnect / restart the official MCP daemon; resume only via native tools.
+
+Any further native MCP failure is a hard stop. Do not construct another fallback.
+
+## Canonical approval claims (AC7)
+
+Comments that claim `approved` / `ready-to-merge` / `WHO_IS_NEXT: merger` /
+`MERGE_READY: true` must include:
+
+```text
+NATIVE_REVIEW_PROOF: transport=native_mcp; …
+```
+
+Claims that cite offline/import helpers are rejected even if a proof line is
+present.
 
 ## Operator note
 
-LLM sessions must never set the allow-direct-import or allow-keychain-cli
-overrides. Those are human-only escape hatches.
+LLM sessions must never set allow-direct-import, allow-keychain-cli, or raw
+token overrides. Those are human-only escape hatches outside agent workflows.
diff --git a/docs/wiki/Operator-Guide.md b/docs/wiki/Operator-Guide.md
index 9052c47..80c2356 100644
--- a/docs/wiki/Operator-Guide.md
+++ b/docs/wiki/Operator-Guide.md
@@ -14,6 +14,7 @@ Handbook for LLM operators and human developers using the Gitea-Tools MCP server
 4. **No self-review / no self-merge** — The authenticated Gitea user must not approve or merge a PR they authored.
 5. **Follow the gates** — Prompts express intent; MCP tools enforce safety. Never bypass gates via prompt instructions.
 6. **Global LLM Worktree Rule** — Main checkout stays on `master`/`main`/`dev`; all mutations happen under `branches/`. Prove project root, `cwd`, branch, stable main-checkout branch, and session worktree path before editing. No exceptions.
+7. **Stable control runtime** — Real Gitea mutations use only the **stable** MCP control runtime. LLM sessions must not kill, restart, or relaunch MCP processes, edit the stable checkout, or use a dev MCP for production mutations. See the policy ADR: [mcp-stable-control-runtime-policy-adr.md](../architecture/mcp-stable-control-runtime-policy-adr.md) (#615).
 
 ## Supported Gitea instances
 
@@ -29,4 +30,5 @@ Always pass `remote` explicitly on tool calls. The server default is `dadeschool
 1. `gitea_whoami` — confirm authenticated user and profile.
 2. `gitea_get_runtime_context` — allowed/forbidden operations for this session.
 3. `gitea_resolve_task_capability` — prove the session may perform the planned task.
-4. For reviewer work: dry-run validation (`gitea_dry_run_pr_review`) before live review mutations.
\ No newline at end of file
+4. For reviewer work: dry-run validation (`gitea_dry_run_pr_review`) before live review mutations.
+5. Confirm master parity / runtime health when tools report stale or unhealthy control runtime — stop mutations and request an **operator** reload of the stable MCP (see [stable control runtime ADR](../architecture/mcp-stable-control-runtime-policy-adr.md)).
\ No newline at end of file
diff --git a/docs/wiki/Runbooks.md b/docs/wiki/Runbooks.md
index d42fe19..2dcb4b2 100644
--- a/docs/wiki/Runbooks.md
+++ b/docs/wiki/Runbooks.md
@@ -12,6 +12,17 @@
 4. `gitea_mark_final_review_decision` → approve via `gitea_review_pr`.
 5. `gitea_merge_pr` with pinned head SHA and `confirmation="MERGE PR <n>"`.
 
+## Stable MCP control runtime (#615)
+
+Policy ADR: [mcp-stable-control-runtime-policy-adr.md](../architecture/mcp-stable-control-runtime-policy-adr.md).
+
+| Situation | Who acts | What to do |
+|-----------|----------|------------|
+| Transport EOF / missing tools | LLM | **Client reconnect only** — do not kill PIDs |
+| Wrong profile / dual-namespace missing | Operator | Configure or reload the correct static namespace(s) |
+| Master parity stale after merge | LLM stops + reports; **operator** reloads stable MCP | Resume only after parity re-verified |
+| Promote unpromoted MCP code to stable | Operator / release-manager only | Full §2.4 promotion record |
+
 ## Gitea Wiki sync
 
 The Gitea Wiki mirrors `docs/wiki/` (source of truth). After merging wiki changes:
diff --git a/final_report_validator.py b/final_report_validator.py
index fac6a78..a487cf6 100644
--- a/final_report_validator.py
+++ b/final_report_validator.py
@@ -134,16 +134,22 @@ _TARGET_BRANCH_SHA_RE = re.compile(
     r"target branch sha\s*:\s*[0-9a-f]{40}",
     re.IGNORECASE,
 )
+# #698: structured proof is rendered in several equivalent shapes —
+# `workflow_hash: abc...`, `workflow_hash=abc...`, or JSON
+# `"workflow_hash": "abc..."`. Recognize all of them; demanding one exact
+# punctuation style rejects legitimate structured workflow-load proof.
 _WORKFLOW_LOAD_HELPER_RE = re.compile(
-    r"workflow[- ]load helper result\s*:",
+    r"workflow[-_ ]load[-_ ]helper[-_ ]result\s*[:=]",
     re.IGNORECASE,
 )
 _WORKFLOW_LOAD_HASH_RE = re.compile(
-    r"workflow[- ]load helper result[\s\S]{0,400}?workflow[_ ]hash\s*:\s*[0-9a-f]{12}",
+    r"workflow[-_ ]load[-_ ]helper[-_ ]result[\s\S]{0,400}?"
+    r"workflow[_ ]hash\"?\s*[:=]\s*\"?[0-9a-f]{12}",
     re.IGNORECASE,
 )
 _WORKFLOW_LOAD_BOUNDARY_RE = re.compile(
-    r"workflow[- ]load helper result[\s\S]{0,400}?boundary[_ ]status\s*:\s*(?:clean|violation)",
+    r"workflow[-_ ]load[-_ ]helper[-_ ]result[\s\S]{0,400}?"
+    r"boundary[_ ]status\"?\s*[:=]\s*\"?(?:clean|violation)",
     re.IGNORECASE,
 )
 _WORKFLOW_FILE_VIEW_NARRATIVE_RE = re.compile(
@@ -244,6 +250,59 @@ def _normalize_task_kind(task_kind: str | None) -> str:
     return _TASK_KIND_ALIASES.get(raw, raw)
 
 
+def _iter_action_entries(action_log: list | None) -> list[dict]:
+    """Yield only structured (dict) action-log entries (#698).
+
+    Callers must never crash on malformed entries (strings, numbers, null)
+    that reach the validator from LLM-composed or partially parsed logs;
+    :func:`sanitize_action_log` reports them separately.
+    """
+    return [e for e in (action_log or []) if isinstance(e, dict)]
+
+
+def sanitize_action_log(
+    action_log: list | None,
+) -> tuple[list[dict], list[dict[str, str]]]:
+    """Split an action log into structured entries and sanitized findings (#698).
+
+    Malformed entries become clear, sanitized ``warning`` findings — the
+    offending value's content is never echoed back (only its position and
+    type), so secrets or garbage in a broken log cannot leak into validation
+    errors, and validation itself proceeds without secondary exceptions.
+    """
+    if action_log is None:
+        return [], []
+    if not isinstance(action_log, (list, tuple)):
+        return [], [
+            validator_finding(
+                "shared.action_log_malformed",
+                "downgrade",
+                "Action log",
+                "action_log is not a list of structured entries "
+                f"(got {type(action_log).__name__}); it was ignored",
+                "pass action_log as a list of dict entries",
+            )
+        ]
+    entries: list[dict] = []
+    findings: list[dict[str, str]] = []
+    for index, entry in enumerate(action_log):
+        if isinstance(entry, dict):
+            entries.append(entry)
+            continue
+        findings.append(
+            validator_finding(
+                "shared.action_log_malformed",
+                "downgrade",
+                "Action log",
+                f"action_log entry {index} is not a structured mapping "
+                f"(got {type(entry).__name__}); the entry was ignored",
+                "repair the malformed action_log entry or drop it before "
+                "revalidating",
+            )
+        )
+    return entries, findings
+
+
 def validator_finding(
     rule_id: str,
     severity: str,
@@ -421,7 +480,7 @@ def _rule_shared_canonical_comment_post_claim(
     rejected_in_report = bool(_CANONICAL_VALIDATION_REJECTED_RE.search(text))
     rejected_in_log = False
     if action_log:
-        for entry in action_log:
+        for entry in _iter_action_entries(action_log):
             validation = entry.get("canonical_comment_validation") or {}
             if validation.get("allowed") is False:
                 rejected_in_log = True
@@ -475,9 +534,13 @@ def _rule_reviewer_vague_mutations_none(
     action_log: list[dict] | None = None,
     mutations_observed: bool = False,
 ) -> list[dict[str, str]]:
+    # #698: infer review mutations only from authoritative evidence — an
+    # entry proves a mutation only when it affirmatively records
+    # performed=true and was not gated. Read-only diagnostics and pre-API
+    # rejections (entries without a performed flag) are not mutations.
     performed = any(
-        e.get("performed") is not False and not e.get("gated_rejected")
-        for e in (action_log or [])
+        e.get("performed") is True and not e.get("gated_rejected")
+        for e in _iter_action_entries(action_log)
     )
     if not (mutations_observed or performed):
         return []
@@ -536,7 +599,7 @@ def _rule_reviewer_git_fetch_readonly(
     text = report_text or ""
     fetch_observed = any(
         _GIT_FETCH_RE.search(str(e.get("command") or e.get("action") or ""))
-        for e in (action_log or [])
+        for e in _iter_action_entries(action_log)
     ) or _GIT_FETCH_RE.search(text)
     if not fetch_observed:
         return []
@@ -977,7 +1040,7 @@ def _rule_reviewer_target_branch_freshness(
     fields = _handoff_fields(text)
     fetch_reported = bool(_GIT_FETCH_RE.search(text)) or any(
         _GIT_FETCH_RE.search(str(e.get("command") or e.get("action") or ""))
-        for e in (action_log or [])
+        for e in _iter_action_entries(action_log)
     )
     target_sha_reported = bool(_TARGET_BRANCH_SHA_RE.search(text)) or any(
         "target branch" in key and "sha" in key and _FULL_SHA_RE.search(value)
@@ -1735,6 +1798,12 @@ def assess_final_report_validator(
     checks: dict[str, Any] = {}
     findings: list[dict[str, str]] = []
 
+    # #698: malformed action_log data must never crash validation with a
+    # secondary exception; malformed entries surface as sanitized findings.
+    sanitized_action_log, action_log_findings = sanitize_action_log(action_log)
+    action_log = sanitized_action_log
+    findings.extend(action_log_findings)
+
     if normalized_kind == "issue_filing" and issue_filing_lock is not None:
         checks["issue_filing"] = assess_issue_filing_final_report(
             report_text,
@@ -1763,7 +1832,23 @@ def assess_final_report_validator(
     }
 
     for rule in _RULES_BY_TASK.get(normalized_kind, ()):
-        findings.extend(_call_rule(rule, report_text, normalized_kind, rule_kwargs))
+        try:
+            findings.extend(
+                _call_rule(rule, report_text, normalized_kind, rule_kwargs)
+            )
+        except Exception as exc:  # #698: fail closed with a sanitized error
+            findings.append(
+                validator_finding(
+                    "shared.validator_rule_error",
+                    "block",
+                    "Validator",
+                    f"validator rule '{getattr(rule, '__name__', 'unknown')}' "
+                    f"failed with {type(exc).__name__} (details withheld; "
+                    "sanitized)",
+                    "file a validator defect with the rule name; do not "
+                    "bypass final-report validation",
+                )
+            )
 
     grade, blocked, downgraded = _aggregate_grade(findings)
     reasons = [f"{f['rule_id']}: {f['reason']}" for f in findings]
diff --git a/gitea_auth.py b/gitea_auth.py
index a02d92a..fe2b769 100644
--- a/gitea_auth.py
+++ b/gitea_auth.py
@@ -243,6 +243,192 @@ def _redact(text):
         return str(text)
 
 
+# ── Classified client failures (#699) ─────────────────────────────────────────
+# Subclasses of RuntimeError preserve existing ``except RuntimeError`` call
+# sites. Exception *messages* are fixed constants only — HTTP response bodies,
+# Keychain material, and arbitrary exception text are never stored on the
+# exception or re-emitted to tool results / daemon logs.
+
+
+# Fixed messages (must match mcp_tool_error_boundary.FIXED_MESSAGES keys used here).
+_MSG_AUTH_INVALID = "Gitea authentication failed: invalid or revoked credentials"
+_MSG_AUTH_FAILED = "Gitea authentication failed"
+_MSG_AUTHZ_SCOPE = "Gitea authorization failed: insufficient token scope"
+_MSG_AUTHZ_DENIED = "Gitea authorization failed: access denied"
+_MSG_NETWORK = "Network error contacting Gitea"
+_MSG_CONFIG = "Gitea configuration or credential resolution failed"
+_MSG_UPSTREAM = "Gitea upstream unavailable"
+_MSG_HTTP = "Gitea HTTP request failed"
+
+
+class GiteaClientError(RuntimeError):
+    """Base for known Gitea client failures with stable reason_code metadata."""
+
+    reason_code = "client_error"
+    error_class = "client"
+    http_status = None
+
+    def __init__(self, message=None, *, reason_code=None, http_status=None):
+        if reason_code is not None:
+            self.reason_code = reason_code
+        if http_status is not None:
+            self.http_status = http_status
+        # Message is always a fixed constant; callers cannot inject bodies.
+        fixed = message if message is not None else _MSG_HTTP
+        super().__init__(fixed)
+
+
+class GiteaAuthError(GiteaClientError):
+    """Authentication failure (invalid/revoked credentials → typically HTTP 401)."""
+
+    reason_code = "auth_invalid_token"
+    error_class = "authentication"
+    http_status = 401
+
+    def __init__(self, message=None, *, reason_code=None, http_status=None):
+        super().__init__(
+            message if message is not None else _MSG_AUTH_INVALID,
+            reason_code=reason_code or "auth_invalid_token",
+            http_status=http_status if http_status is not None else 401,
+        )
+
+
+class GiteaAuthzError(GiteaClientError):
+    """Authorization failure (HTTP 403 — scope deficiency or access denied)."""
+
+    reason_code = "authz_denied"
+    error_class = "authorization"
+    http_status = 403
+
+    def __init__(self, message=None, *, reason_code=None, http_status=None):
+        code = reason_code or "authz_denied"
+        if code == "authz_insufficient_scope":
+            fixed = _MSG_AUTHZ_SCOPE
+        else:
+            fixed = _MSG_AUTHZ_DENIED
+            code = "authz_denied"
+        super().__init__(
+            message if message is not None else fixed,
+            reason_code=code,
+            http_status=http_status if http_status is not None else 403,
+        )
+
+
+class GiteaNetworkError(GiteaClientError):
+    """Transport / DNS / timeout failure contacting Gitea."""
+
+    reason_code = "network_error"
+    error_class = "network"
+    http_status = None
+
+    def __init__(self, message=None, *, reason_code=None, http_status=None):
+        super().__init__(
+            message if message is not None else _MSG_NETWORK,
+            reason_code=reason_code or "network_error",
+            http_status=http_status,
+        )
+
+
+class GiteaConfigError(GiteaClientError):
+    """Local configuration / credential resolution failure (not HTTP auth)."""
+
+    reason_code = "config_error"
+    error_class = "configuration"
+    http_status = None
+
+    def __init__(self, message=None, *, reason_code=None, http_status=None):
+        super().__init__(
+            message if message is not None else _MSG_CONFIG,
+            reason_code=reason_code or "config_error",
+            http_status=http_status,
+        )
+
+
+class GiteaHttpError(GiteaClientError):
+    """Non-auth HTTP failure with fixed message (no response body)."""
+
+    reason_code = "http_error"
+    error_class = "client"
+    http_status = None
+
+    def __init__(self, message=None, *, reason_code=None, http_status=None):
+        code = reason_code or "http_error"
+        if code == "upstream_unavailable":
+            fixed = _MSG_UPSTREAM
+        else:
+            fixed = _MSG_HTTP
+            code = "http_error"
+        super().__init__(
+            message if message is not None else fixed,
+            reason_code=code,
+            http_status=http_status,
+        )
+
+
+def _looks_like_insufficient_scope(detail: str) -> bool:
+    """Internal: inspect redacted body *only* to refine 403 reason_code.
+
+    The body is never stored on the exception or returned to callers.
+    """
+    lower = (detail or "").lower()
+    markers = (
+        "insufficient scope",
+        "required scope",
+        "does not have at least one of required scope",
+        "token does not have",
+        "missing scope",
+        "scope(s)",
+    )
+    return any(m in lower for m in markers)
+
+
+def classify_http_status(code: int, *, body_hint: str = "") -> tuple[type, str, int]:
+    """Central HTTP status → (exception_class, reason_code, http_status).
+
+    Every HTTP 403 becomes authorization-class. Body text is used only as a
+    local hint for scope vs denied reason_code and is never returned.
+    """
+    if code == 401:
+        return (GiteaAuthError, "auth_invalid_token", 401)
+    if code == 403:
+        if _looks_like_insufficient_scope(body_hint or ""):
+            return (GiteaAuthzError, "authz_insufficient_scope", 403)
+        return (GiteaAuthzError, "authz_denied", 403)
+    if code in (502, 503, 504):
+        return (GiteaHttpError, "upstream_unavailable", code)
+    return (GiteaHttpError, "http_error", code)
+
+
+def raise_for_http_status(code: int, body: str = "") -> None:
+    """Raise a typed client error for *code* without embedding *body*.
+
+    *body* may be inspected only to choose scope vs denied for 403; it is
+    never placed on the exception message.
+    """
+    # Redact before any inspection; discard after classification.
+    try:
+        hint = _redact(body or "").strip()
+    except Exception:
+        hint = ""
+    exc_cls, reason, status = classify_http_status(code, body_hint=hint)
+    # Explicitly construct without passing body/hint into message.
+    if exc_cls is GiteaAuthError:
+        raise GiteaAuthError(reason_code=reason, http_status=status)
+    if exc_cls is GiteaAuthzError:
+        raise GiteaAuthzError(reason_code=reason, http_status=status)
+    if reason == "upstream_unavailable":
+        raise GiteaHttpError(
+            reason_code="upstream_unavailable",
+            http_status=status,
+        )
+    raise GiteaHttpError(reason_code="http_error", http_status=status)
+
+
+def _raise_http_error(code: int, detail: str = "") -> None:
+    """Backward-compatible alias — *detail* is never embedded in the error."""
+    raise_for_http_status(code, detail)
+
+
 def _add_query(url, **params):
     """Return *url* with the given query parameters added or overridden.
 
@@ -315,23 +501,24 @@ def api_request(method, url, auth_header, payload=None, *,
     """Make an authenticated JSON request to the Gitea API.
 
     Returns parsed JSON on success (or ``None`` for an empty body), and raises
-    ``RuntimeError`` on failure.
+    a classified client error on failure.
 
     On HTTP 429 the request is retried up to *max_retries* times: honoring a
     valid ``Retry-After`` header (seconds or HTTP-date) when present, otherwise
     using capped jittered exponential backoff. Successful responses are
     unchanged.
 
-    All failures are converted to a ``RuntimeError`` with a clear, secret
-    -redacted message (no raw stack traces or credential material):
+    Failures raise typed exceptions with **fixed messages only** (#699). HTTP
+    response bodies are read solely for local 403 reason refinement and are
+    never stored on exceptions or returned to callers:
 
-    - Non-429 HTTP errors surface the status code and a redacted response body.
-      502/503/504 upstream errors get an explicit "Gitea upstream unavailable"
-      message.
-    - Timeouts and network/DNS failures (``URLError`` / ``TimeoutError``) surface
-      a generic "network error contacting Gitea" message.
-    - A malformed (non-JSON) success body surfaces a "malformed JSON response"
-      message rather than a raw decode error.
+    - HTTP 401 → :class:`GiteaAuthError` (``auth_invalid_token``)
+    - HTTP 403 → :class:`GiteaAuthzError` (scope or denied)
+    - 502/503/504 → :class:`GiteaHttpError` (``upstream_unavailable``)
+    - Other non-429 HTTP → :class:`GiteaHttpError` (``http_error``)
+    - Timeouts / DNS / ``URLError`` → :class:`GiteaNetworkError`
+    - Malformed success JSON → plain ``RuntimeError`` (programming/protocol;
+      not reclassified as authentication)
 
     The ``*_func`` parameters and ``timeout`` are injection points for
     deterministic testing.
@@ -369,22 +556,23 @@ def api_request(method, url, auth_header, payload=None, *,
                 error_body = e.read().decode("utf-8", errors="replace")
             except Exception:
                 error_body = ""
-            detail = _redact(error_body).strip()
-            if e.code in (502, 503, 504):
-                msg = f"HTTP {e.code}: Gitea upstream unavailable"
-                raise RuntimeError(f"{msg}: {detail}" if detail else msg) from e
-            raise RuntimeError(f"HTTP {e.code}: {detail}") from e
+            # Classify from status (+ local body hint). Body is not embedded.
+            try:
+                raise_for_http_status(e.code, error_body)
+            except GiteaClientError:
+                raise
+            # Defensive: raise_for_http_status always raises.
+            raise GiteaHttpError(http_status=e.code) from e  # pragma: no cover
         except (urllib.error.URLError, TimeoutError) as e:
-            reason = getattr(e, "reason", e)
-            raise RuntimeError(
-                f"network error contacting Gitea: {_redact(reason)}"
-            ) from e
+            # Fixed message only — do not embed URLError reason (may leak paths).
+            raise GiteaNetworkError(reason_code="network_error") from e
 
         if not body:
             return None
         try:
             return json.loads(body)
         except ValueError as e:
+            # Programming/protocol failure — not authentication.
             raise RuntimeError("malformed JSON response from Gitea") from e
 
 
diff --git a/gitea_mcp_server.py b/gitea_mcp_server.py
index 236900e..5139b2b 100644
--- a/gitea_mcp_server.py
+++ b/gitea_mcp_server.py
@@ -1220,7 +1220,9 @@ from gitea_auth import (  # noqa: E402
     repo_api_url,
     get_profile,
     gitea_url,
+    GiteaConfigError,
 )
+import mcp_tool_error_boundary  # noqa: E402
 import gitea_audit  # noqa: E402
 import gitea_config  # noqa: E402
 import capability_stop_terminal  # noqa: E402
@@ -1245,6 +1247,8 @@ import issue_lock_store  # noqa: E402
 import issue_lock_adoption  # noqa: E402
 import stacked_pr_support  # noqa: E402
 import merge_approval_gate  # noqa: E402
+import review_quarantine  # noqa: E402  # #695 contaminated formal-review quarantine
+import mcp_daemon_guard  # noqa: E402  # #695 native transport provenance
 import already_landed_reconcile  # noqa: E402
 import author_mutation_worktree  # noqa: E402
 import root_checkout_guard  # noqa: E402
@@ -1600,6 +1604,12 @@ def _with_optional_url(result: dict, url: str | None) -> dict:
         result["url"] = url
     return result
 
+# #699: known auth/authz/network/config failures → structured CallToolResult
+# isError; stdio transport must survive (no unhandled raise / process exit).
+from mcp.server.fastmcp.tools.base import Tool as _FastMCPTool  # noqa: E402
+
+mcp_tool_error_boundary.install_tool_run_boundary(_FastMCPTool)
+
 mcp = FastMCP("gitea-tools", instructions=(
     "Gitea issue tracker and PR management for dadeschools and prgs instances. "
     "Use the gitea_ prefixed tools to create issues, PRs, list issues, etc."
@@ -1937,13 +1947,16 @@ def _enforce_remote_repo_guard(
 
 
 def _auth(host: str) -> str:
-    """Get auth header, raise if unavailable."""
+    """Get auth header, raise if unavailable.
+
+    Missing credentials are a configuration failure, not a silent internal
+    crash. Typed as :class:`gitea_auth.GiteaConfigError` so the tool-error
+    boundary (#699) maps them to a structured isError result without EOF.
+    The exception message is a fixed constant (no host/token material).
+    """
     header = get_auth_header(host)
     if header is None:
-        raise RuntimeError(
-            f"No credentials for {host}. "
-            "Ensure you've logged in via HTTPS at least once."
-        )
+        raise GiteaConfigError(reason_code="config_error")
     return header
 
 
@@ -1958,6 +1971,8 @@ _UNSET = object()
 # Best-effort identity cache keyed by host, so an enabled audit trail resolves
 # the authenticated username at most once per host per process.
 _IDENTITY_CACHE: dict = {}
+# Stable actor identity (id + login) for recovery evidence binding (#709 F7).
+_ACTOR_IDENTITY_CACHE: dict = {}
 
 
 def _authenticated_username(host: str):
@@ -1980,6 +1995,33 @@ def _authenticated_username(host: str):
     return user
 
 
+def _authenticated_actor(host: str) -> dict:
+    """Resolve the authenticated actor's stable identity (#709 F7 review 438).
+
+    Display names are mutable, so recovery evidence is bound to the immutable
+    numeric user id with the login carried alongside for consistency checks.
+    Read-only and fail-soft; never surfaces credential material.
+    """
+    cached = _ACTOR_IDENTITY_CACHE.get(host)
+    if cached is not None:
+        return dict(cached)
+    actor: dict = {"user_id": None, "login": None}
+    try:
+        header = get_auth_header(host)
+        if header:
+            who = api_request("GET", gitea_url(host, "/api/v1/user"), header)
+            if isinstance(who, dict):
+                raw_id = who.get("id")
+                actor = {
+                    "user_id": int(raw_id) if isinstance(raw_id, int) else None,
+                    "login": (who.get("login") or None),
+                }
+    except Exception:
+        actor = {"user_id": None, "login": None}
+    _ACTOR_IDENTITY_CACHE[host] = dict(actor)
+    return dict(actor)
+
+
 def _ensure_matching_profile(required_permission: str, required_role: str, remote: str | None, host: str | None = None) -> str | None:
     """Check if the active profile is allowed to perform *required_permission*.
     If not, automatically switch to the first matching usable configured profile.
@@ -2025,6 +2067,7 @@ def _ensure_matching_profile(required_permission: str, required_role: str, remot
                             h = host or (REMOTES.get(remote, {}).get("host") if remote in REMOTES else None)
                             if h:
                                 _IDENTITY_CACHE.pop(h, None)
+                                _ACTOR_IDENTITY_CACHE.pop(h, None)
                             username = _authenticated_username(h) if h else None
                             # Update mutation authority
                             global _MUTATION_AUTHORITY
@@ -3191,6 +3234,51 @@ def gitea_check_pr_eligibility(
         elif result["mergeable"] is None:
             reasons.append("PR mergeability unknown")
 
+    # #695: merge eligibility must honor quarantine-aware formal review feedback.
+    # Contaminated approvals (e.g. review 427 on PR #694) must not make merge
+    # eligible even when Gitea still shows APPROVED / mergeable=true.
+    if action == "merge" and not reasons:
+        try:
+            feedback = gitea_get_pr_review_feedback(
+                pr_number=pr_number, remote=remote, host=host, org=org, repo=repo,
+            )
+        except Exception as exc:  # noqa: BLE001 — fail closed, never leak secrets
+            feedback = {
+                "success": False,
+                "reasons": [
+                    "PR review feedback unavailable for merge eligibility "
+                    f"(fail closed, #695): {_redact(str(exc))}"
+                ],
+            }
+        result["approval_visible"] = feedback.get("approval_visible")
+        result["approval_at_current_head"] = feedback.get("approval_at_current_head")
+        result["quarantined_approvals_at_current_head"] = feedback.get(
+            "quarantined_approvals_at_current_head"
+        )
+        result["stale_approval_block_reason"] = feedback.get(
+            "stale_approval_block_reason"
+        )
+        result["has_blocking_change_requests"] = feedback.get(
+            "has_blocking_change_requests"
+        )
+        if not feedback.get("success"):
+            reasons.append(
+                "PR review feedback unavailable for merge eligibility (fail closed, #695)"
+            )
+            reasons.extend(feedback.get("reasons") or [])
+        elif feedback.get("has_blocking_change_requests"):
+            reasons.append(
+                "undismissed REQUEST_CHANGES review blocks merge eligibility (fail closed)"
+            )
+        elif not feedback.get("approval_at_current_head"):
+            reasons.append(
+                feedback.get("stale_approval_block_reason")
+                or (
+                    "no non-quarantined APPROVED review at current head; "
+                    "merge eligibility denied (#695)"
+                )
+            )
+
     result["eligible"] = len(reasons) == 0
     if result["eligible"]:
         reasons.append("all eligibility checks passed")
@@ -3392,8 +3480,25 @@ def _save_review_decision_lock(data):
     )
     payload["session_profile_lock"] = binding["session_profile_lock"]
     payload["profile_identity"] = binding["profile_identity"]
+    # #720: durable decision locks are recovery-critical terminal provenance,
+    # not generic TTL session cache. Stamp kind + recovery_critical for
+    # pre-existing readers and identity_match_reasons flag-based exempt.
+    payload["kind"] = mcp_session_state.KIND_DECISION_LOCK
+    payload["recovery_critical"] = True
     if binding.get("remote") and not payload.get("remote"):
         payload["remote"] = binding["remote"]
+    # #695 AC6: stamp native transport provenance on durable decision locks.
+    try:
+        payload.update(
+            {
+                k: v
+                for k, v in mcp_daemon_guard.mutation_provenance_fields().items()
+                if v is not None
+            }
+        )
+    except Exception:
+        payload.setdefault("transport", "untrusted")
+        payload.setdefault("native_mcp_transport", False)
     persisted = mcp_session_state.save_state(
         kind=mcp_session_state.KIND_DECISION_LOCK,
         payload=payload,
@@ -3434,17 +3539,28 @@ def _review_decision_session_reasons(lock: dict | None) -> list[str]:
 
 
 def init_review_decision_lock(remote: str | None, task: str | None, force: bool = True):
-    """Seed read-only-until-ready state for reviewer PR review tasks."""
+    """Seed read-only-until-ready state for reviewer PR review tasks.
+
+    #709 AC2: never overwrite unresolved terminal decision-lock evidence with
+    an empty initialized lock — even when *force* is True. Terminal ledgers
+    are cleared only via moot cleanup or sanctioned recovery/archive paths.
+    """
     if task != "review_pr":
         return
-    if not force:
-        lock = _load_review_decision_lock()
-        if lock is not None:
+    existing = _load_review_decision_lock()
+    if existing is not None:
+        overwrite = stale_review_decision_lock.assess_init_overwrite(
+            existing, force=force
+        )
+        if not overwrite.get("overwrite_allowed"):
+            # Preserve terminal evidence; keep existing durable lock.
+            return
+        if not force:
             env_lock = (os.environ.get(SESSION_PROFILE_LOCK_ENV) or "").strip()
-            stored_lock = (lock.get("session_profile_lock") or "").strip()
-            same_remote = lock.get("remote") == remote
+            stored_lock = (lock_get_session_profile_lock(existing)).strip()
+            same_remote = existing.get("remote") == remote
             same_profile = (not env_lock or not stored_lock or env_lock == stored_lock)
-            if same_remote and same_profile and not _review_decision_session_reasons(lock):
+            if same_remote and same_profile and not _review_decision_session_reasons(existing):
                 return
     review_workflow_load.clear_review_workflow_load()
     profile = get_profile()
@@ -3477,6 +3593,17 @@ def init_review_decision_lock(remote: str | None, task: str | None, force: bool
     })
 
 
+def lock_get_session_profile_lock(lock: dict | None) -> str:
+    if not isinstance(lock, dict):
+        return ""
+    return (
+        lock.get("session_profile_lock")
+        or lock.get("profile_identity")
+        or lock.get("session_profile")
+        or ""
+    )
+
+
 def _review_workflow_load_gate_reasons() -> list[str]:
     """Fail closed when canonical review workflow was not loaded (#389)."""
     return review_workflow_load.review_workflow_load_blockers(PROJECT_ROOT)
@@ -3589,6 +3716,10 @@ def record_live_review_mutation(pr_number: int, action: str, review_id: int | No
         "action": action,
         "review_id": review_id,
         "review_state": action,
+        # #695 AC6: audit records expose native session/transport provenance.
+        **mcp_daemon_guard.mutation_provenance_fields(),
+        "writer_pid": os.getpid(),
+        "session_pid": lock.get("session_pid") or os.getpid(),
     }
     if head_sha:
         entry["head_sha"] = head_sha
@@ -3814,30 +3945,68 @@ def gitea_get_pr_review_feedback(
     base = f"{repo_api_url(h, o, r)}/pulls/{pr_number}"
     pr = api_request("GET", base, auth) or {}
     raw_reviews = api_request("GET", f"{base}/reviews", auth) or []
+    if not isinstance(pr, dict):
+        return {
+            "success": False,
+            "pr_number": pr_number,
+            "feedback_not_attempted": True,
+            "reasons": ["PR payload unavailable for review feedback (fail closed)"],
+        }
+    if not isinstance(raw_reviews, list):
+        raw_reviews = []
     current_head = (pr.get("head") or {}).get("sha")
     reveal = _reveal_endpoints()
 
     ordered = sorted(
-        raw_reviews,
+        (rv for rv in raw_reviews if isinstance(rv, dict)),
         key=lambda rv: ((rv.get("submitted_at") or ""), rv.get("id") or 0),
     )
     reviews = []
     latest_by_reviewer = {}
     latest_reviewed_head = None
+    quarantined_review_ids: set[int] = set()
+    quarantined_at_head = 0
     for rv in ordered:
         state = (rv.get("state") or "").upper()
         reviewer = (rv.get("user") or {}).get("login", "")
         commit_id = rv.get("commit_id")
+        rid = rv.get("id")
+        try:
+            rid_int = int(rid) if rid is not None else None
+        except (TypeError, ValueError):
+            rid_int = None
+        q = review_quarantine.is_review_quarantined(
+            remote=remote,
+            org=o,
+            repo=r,
+            pr_number=pr_number,
+            review_id=rid_int,
+            reviewed_head_sha=commit_id or current_head,
+        )
         entry = {
             "reviewer": reviewer,
             "verdict": state,
             "body": _redact(rv.get("body") or ""),
             "submitted_at": rv.get("submitted_at"),
             "reviewed_head_sha": commit_id,
+            "review_id": rid_int,
             "dismissed": bool(rv.get("dismissed")),
             "stale": bool(rv.get("stale")) or bool(
                 commit_id and current_head and commit_id != current_head),
+            "quarantined": bool(q.get("quarantined")),
         }
+        if q.get("quarantined"):
+            entry["quarantine_reasons"] = q.get("reasons") or []
+            if rid_int is not None:
+                quarantined_review_ids.add(rid_int)
+            if (
+                state == "APPROVED"
+                and not entry["dismissed"]
+                and current_head
+                and commit_id
+                and commit_id == current_head
+            ):
+                quarantined_at_head += 1
         if reveal:
             entry["url"] = rv.get("html_url")
         reviews.append(entry)
@@ -3845,7 +4014,11 @@ def gitea_get_pr_review_feedback(
         # per-reviewer verdict — otherwise a drive-by comment on the
         # current head would mask the staleness of an older undismissed
         # REQUEST_CHANGES.
+        # #695: quarantined formal reviews never authorize merge and must not
+        # become the reviewer's latest active verdict for eligibility/merge.
         if state in _VERDICT_STATES and state != "COMMENT":
+            if entry.get("quarantined"):
+                continue
             latest_reviewed_head = commit_id or latest_reviewed_head
             if reviewer:
                 latest_by_reviewer[reviewer] = entry
@@ -3861,7 +4034,21 @@ def gitea_get_pr_review_feedback(
     approval_head = merge_approval_gate.assess_merge_approval_head(
         current_head_sha=current_head,
         latest_by_reviewer=latest_by_reviewer,
+        quarantined_review_ids=quarantined_review_ids,
     )
+    stale_reason = approval_head["stale_approval_block_reason"]
+    # When the only approvals at head are quarantined, they were excluded from
+    # latest_by_reviewer; surface an explicit #695 void reason for eligibility/merge.
+    if (
+        not approval_head["approval_at_current_head"]
+        and quarantined_at_head
+        and not stale_reason
+    ):
+        stale_reason = (
+            "contaminated/quarantined approval at current head is void for "
+            "merge authorization (#695); required next action: fresh native "
+            "MCP re-review after controller quarantine evidence is recorded"
+        )
     return {
         "success": True,
         "pr_number": pr_number,
@@ -3874,7 +4061,14 @@ def gitea_get_pr_review_feedback(
         "approval_visible": bool(approvals),
         "approval_at_current_head": approval_head["approval_at_current_head"],
         "latest_approved_head_sha": approval_head["latest_approved_head_sha"],
-        "stale_approval_block_reason": approval_head["stale_approval_block_reason"],
+        "stale_approval_block_reason": stale_reason,
+        "quarantined_review_ids": sorted(quarantined_review_ids),
+        "quarantined_approvals_at_current_head": (
+            max(
+                approval_head.get("quarantined_approvals_at_current_head") or 0,
+                quarantined_at_head,
+            )
+        ),
         "latest_reviewed_head_sha": latest_reviewed_head,
         "review_feedback_stale": bool(
             latest_reviewed_head and current_head
@@ -3883,6 +4077,7 @@ def gitea_get_pr_review_feedback(
             e["reviewed_head_sha"] and current_head
             and e["reviewed_head_sha"] != current_head
             for e in blocking),
+        "native_runtime": mcp_daemon_guard.native_runtime_status(),
     }
 
 
@@ -4062,6 +4257,15 @@ def _evaluate_pr_review_submission(
         reasons.extend(review_workflow_load.recovery_handoff_without_replay())
         return result
     if live:
+        # #695 AC1/AC2: offline direct-import submit (PR #701 run_submit.py) fails closed.
+        try:
+            mcp_daemon_guard.assert_sanctioned_mutation_runtime(
+                "gitea_submit_pr_review"
+            )
+            mcp_daemon_guard.assert_no_direct_import_bypass("gitea_submit_pr_review")
+        except mcp_daemon_guard.UnsanctionedRuntimeError as exc:
+            reasons.append(str(exc))
+            return result
         ns_gate = _live_namespace_health_gate("review_pr")
         if ns_gate:
             reasons.extend(ns_gate)
@@ -4249,6 +4453,16 @@ def gitea_mark_final_review_decision(
     repo: str | None = None,
 ) -> dict:
     """Mark validation complete; the final review decision is ready to submit."""
+    # #695 AC1/AC2: direct import / redirected session state cannot mark final.
+    try:
+        mcp_daemon_guard.assert_sanctioned_mutation_runtime(
+            "gitea_mark_final_review_decision"
+        )
+        mcp_daemon_guard.assert_no_direct_import_bypass(
+            "gitea_mark_final_review_decision"
+        )
+    except mcp_daemon_guard.UnsanctionedRuntimeError as exc:
+        return {"marked_ready": False, "reasons": [str(exc)]}
     action = (action or "").strip().lower()
     lock = _load_review_decision_lock()
     if lock is None:
@@ -4460,6 +4674,456 @@ def gitea_authorize_review_correction(
     return {"authorized": True, "correction_reason": reason, "reasons": []}
 
 
+
+def _record_post_merge_decision_recovery(
+    *,
+    pr_number: int,
+    head_sha: str | None,
+    merge_commit_sha: str | None,
+    target_profile_identity: str | None,
+    failed_step: str,
+    error: str | None,
+    remote: str | None,
+    org: str | None,
+    repo: str | None,
+) -> dict:
+    """Persist durable post-merge recovery-required state (#709 AC3)."""
+    try:
+        actor = None
+        try:
+            if remote in REMOTES:
+                h, _, _ = _resolve(remote, None, org, repo)
+                actor = _authenticated_username(h)
+        except Exception:
+            actor = None
+        profile = get_profile()
+        profile_name = (profile.get("profile_name") or "").strip() or None
+        payload = stale_review_decision_lock.build_post_merge_recovery_record(
+            pr_number=pr_number,
+            head_sha=head_sha,
+            merge_commit_sha=merge_commit_sha,
+            target_profile_identity=target_profile_identity,
+            failed_step=failed_step,
+            error=error,
+            remote=remote,
+            org=org,
+            repo=repo,
+            actor_username=actor,
+            profile_name=profile_name,
+        )
+        # Key by merger/active profile so the merging session owns the recovery row.
+        binding = _decision_lock_binding()
+        saved = mcp_session_state.save_state(
+            kind=mcp_session_state.KIND_POST_MERGE_DECISION_RECOVERY,
+            payload=payload,
+            remote=remote,
+            org=org,
+            repo=repo,
+            profile_identity=binding.get("profile_identity"),
+        )
+        return dict(saved or payload)
+    except Exception as exc:  # noqa: BLE001
+        return {"status": "recovery_record_failed", "error": _redact(str(exc))}
+
+
+def _clear_decision_lock_for_profile(
+    *,
+    profile_identity: str,
+    pr_number: int,
+    expected_head_sha: str | None,
+    remote: str | None,
+    org: str | None,
+    repo: str | None,
+) -> dict:
+    """Clear one profile's durable decision lock when it targets *pr_number* approve.
+
+    #709 F3: require remote/org/repo scope match on load and exact head identity
+    for any terminal match. PR-number-only fallback is forbidden — malformed,
+    legacy incomplete, cross-repository, or wrong-head locks are never cleared.
+    """
+    try:
+        import irrecoverable_provenance as _irp
+
+        path_gate = _irp.assess_profile_path_identity(profile_identity)
+        if not path_gate.get("valid"):
+            return {
+                "profile_identity": profile_identity,
+                "cleared": False,
+                "reason": "; ".join(path_gate.get("reasons") or ["invalid profile"]),
+                "recovery_required": True,
+            }
+    except Exception:
+        raw = str(profile_identity or "")
+        if ".." in raw or "/" in raw or "\\" in raw:
+            return {
+                "profile_identity": profile_identity,
+                "cleared": False,
+                "reason": "profile identity path traversal rejected (fail closed, #709 F3)",
+                "recovery_required": True,
+            }
+
+    # expected_head_sha is mandatory for destructive clear (#709 F3).
+    want_head = stale_review_decision_lock.normalize_head_sha(expected_head_sha)
+    if not want_head:
+        return {
+            "profile_identity": profile_identity,
+            "cleared": False,
+            "reason": (
+                "expected_head_sha required for decision-lock clear "
+                "(no PR-number-only fallback; fail closed, #709 F3)"
+            ),
+            "recovery_required": False,
+        }
+    if not (remote and org and repo):
+        return {
+            "profile_identity": profile_identity,
+            "cleared": False,
+            "reason": (
+                "remote/org/repo required for decision-lock clear "
+                "(no incomplete-identity clear; fail closed, #709 F3)"
+            ),
+            "recovery_required": False,
+        }
+
+    lock = mcp_session_state.load_state_for_profile(
+        kind=mcp_session_state.KIND_DECISION_LOCK,
+        profile_identity=profile_identity,
+        remote=remote,
+        org=org,
+        repo=repo,
+        skip_identity_match=True,
+        enforce_repo_scope=True,
+    )
+    if lock is None:
+        return {
+            "profile_identity": profile_identity,
+            "cleared": False,
+            "reason": (
+                "no durable lock for profile at exact remote/org/repo scope "
+                "(or identity/expiry mismatch; fail closed)"
+            ),
+        }
+
+    # Primary: approve of this PR at exact head.
+    targets_approve = stale_review_decision_lock.lock_targets_merged_pr_approval(
+        lock, pr_number=pr_number, expected_head_sha=want_head
+    )
+    if not targets_approve:
+        # Secondary: any terminal for this PR **only** when head also matches.
+        # Never fall back to PR-number alone (#709 F3 / review 434).
+        last = stale_review_decision_lock.last_terminal_mutation(lock)
+        if not last or last.get("pr_number") != pr_number:
+            return {
+                "profile_identity": profile_identity,
+                "cleared": False,
+                "reason": "lock terminal does not target this PR approval",
+            }
+        locked_head = stale_review_decision_lock.mutation_head_sha(last, lock)
+        if not locked_head:
+            return {
+                "profile_identity": profile_identity,
+                "cleared": False,
+                "reason": (
+                    "legacy/incomplete terminal head identity; refuse destructive "
+                    "clear (inspect/report recovery-required only, #709 F3)"
+                ),
+                "recovery_required": True,
+                "prior_summary": stale_review_decision_lock.lock_summary(lock),
+            }
+        if not stale_review_decision_lock.heads_equal(locked_head, want_head):
+            return {
+                "profile_identity": profile_identity,
+                "cleared": False,
+                "reason": (
+                    "lock terminal head does not match expected_head_sha "
+                    "(fail closed, #709 F3)"
+                ),
+            }
+
+    # Archive then clear — archival is a hard prerequisite (#709 F8 review 438).
+    # A failed, empty, or unconfirmed archive must never be followed by a clear:
+    # that is exactly the terminal-evidence destruction #709 exists to prevent.
+    archive_identity = f"{profile_identity}-archive-pr{pr_number}"
+    archive_payload = {
+        **dict(lock),
+        "archived_reason": "post_merge_cross_profile_cleanup",
+        "archived_for_pr": pr_number,
+        "archived_for_head": want_head,
+        "archived_remote": remote,
+        "archived_org": org,
+        "archived_repo": repo,
+        "recovery_critical": True,
+        "kind": mcp_session_state.KIND_DECISION_LOCK_ARCHIVE,
+        # The copied lock carries the *source* profile's identity. Leaving it in
+        # place makes save_state key the archive under that profile instead of
+        # the archive identity, so the archive would silently overwrite/land
+        # elsewhere and never read back (#709 F8 review 438).
+        "profile_identity": archive_identity,
+        "session_profile_lock": archive_identity,
+        "archived_from_profile_identity": profile_identity,
+    }
+
+    def _archive_failure(step: str, detail: str) -> dict:
+        """Retain the terminal lock and report an actionable, retryable failure."""
+        try:
+            _record_post_merge_decision_recovery(
+                pr_number=int(pr_number),
+                head_sha=want_head,
+                merge_commit_sha=None,
+                target_profile_identity=profile_identity,
+                failed_step=step,
+                error=detail,
+                remote=remote,
+                org=org,
+                repo=repo,
+            )
+        except Exception as exc:  # noqa: BLE001
+            detail = f"{detail}; recovery record write also failed: {_redact(str(exc))}"
+        return {
+            "profile_identity": profile_identity,
+            "cleared": False,
+            "archive_ok": False,
+            "archive_failed_step": step,
+            "archive_identity": archive_identity,
+            "terminal_lock_retained": True,
+            "recovery_required": True,
+            "retry_safe": True,
+            "reason": (
+                f"decision-lock archival failed at {step}: {detail}. Terminal "
+                "evidence retained and NOT cleared; resolve the archive failure "
+                "and retry this cleanup (fail closed, #709 F8 review 438)"
+            ),
+            "prior_summary": stale_review_decision_lock.lock_summary(lock),
+        }
+
+    try:
+        archived = mcp_session_state.save_state(
+            kind=mcp_session_state.KIND_DECISION_LOCK_ARCHIVE,
+            payload=archive_payload,
+            remote=remote,
+            org=org,
+            repo=repo,
+            profile_identity=archive_identity,
+        )
+    except Exception as exc:  # noqa: BLE001
+        return _archive_failure("archive_save_state", _redact(str(exc)))
+    if not archived:
+        return _archive_failure(
+            "archive_save_state",
+            "save_state returned no durable archive record (false/empty result)",
+        )
+
+    # Durable read-back: a write that cannot be re-read is not an archive.
+    try:
+        confirmed = mcp_session_state.load_state_for_profile(
+            kind=mcp_session_state.KIND_DECISION_LOCK_ARCHIVE,
+            profile_identity=archive_identity,
+            remote=remote,
+            org=org,
+            repo=repo,
+            skip_identity_match=True,
+            enforce_repo_scope=True,
+        )
+    except Exception as exc:  # noqa: BLE001
+        return _archive_failure("archive_readback", _redact(str(exc)))
+    if not confirmed:
+        return _archive_failure(
+            "archive_readback",
+            "archive record could not be read back from durable session state",
+        )
+    if int(confirmed.get("archived_for_pr") or -1) != int(
+        pr_number
+    ) or not stale_review_decision_lock.heads_equal(
+        confirmed.get("archived_for_head"), want_head
+    ):
+        return _archive_failure(
+            "archive_readback",
+            "archive read-back does not match the PR/head being cleaned "
+            "(partial or stale archive)",
+        )
+
+    mcp_session_state.clear_state(
+        kind=mcp_session_state.KIND_DECISION_LOCK,
+        profile_identity=profile_identity,
+        remote=remote,
+        org=org,
+        repo=repo,
+    )
+    # If this is the in-memory active profile lock, clear memory too.
+    active = _decision_lock_binding().get("profile_identity")
+    if active and active == profile_identity:
+        global _REVIEW_DECISION_LOCK
+        _REVIEW_DECISION_LOCK = None
+    return {
+        "profile_identity": profile_identity,
+        "cleared": True,
+        "archive_ok": True,
+        "archive_identity": archive_identity,
+        "reason": (
+            f"cleared terminal lock for merged PR #{pr_number} "
+            f"at head {want_head[:12]}… (exact-scope; durable archive confirmed)"
+        ),
+        "prior_summary": stale_review_decision_lock.lock_summary(lock),
+    }
+
+
+def _reconcile_decision_locks_after_merge(
+    *,
+    pr_number: int,
+    head_sha: str | None,
+    merge_commit_sha: str | None,
+    remote: str,
+    host: str,
+    org: str,
+    repo: str,
+    auth,
+) -> dict:
+    """Cross-profile decision-lock reconcile after a successful merge (#709)."""
+    report: dict = {
+        "cleared_any": False,
+        "profiles_scanned": [],
+        "cleared_profiles": [],
+        "audit_comment_ids": [],
+        "recovery_required": False,
+        "reason_lines": [],
+        "applied": False,  # overall "historical applied cleanup" never claimed blindly
+    }
+    try:
+        actor = _authenticated_username(host)
+    except Exception:
+        actor = None
+    profile = get_profile()
+    profile_name = (profile.get("profile_name") or "").strip() or None
+
+    identities = list(mcp_session_state.list_decision_lock_profile_identities())
+    active = _decision_lock_binding().get("profile_identity")
+    if active and active not in identities:
+        identities.append(active)
+    # Always consider common role profiles so empty local merger lock cannot
+    # hide a reviewer terminal ledger (#709 AC1).
+    for candidate in ("prgs-reviewer", "prgs-merger", "prgs-author", "prgs-reconciler"):
+        if candidate not in identities:
+            identities.append(candidate)
+    report["profiles_scanned"] = list(identities)
+
+    for identity in identities:
+        try:
+            outcome = _clear_decision_lock_for_profile(
+                profile_identity=identity,
+                pr_number=pr_number,
+                expected_head_sha=head_sha,
+                remote=remote,
+                org=org,
+                repo=repo,
+            )
+        except Exception as exc:  # noqa: BLE001
+            report["recovery_required"] = True
+            report["reason_lines"].append(
+                f"failed clearing decision lock for {identity}: {_redact(str(exc))}"
+            )
+            _record_post_merge_decision_recovery(
+                pr_number=pr_number,
+                head_sha=head_sha,
+                merge_commit_sha=merge_commit_sha,
+                target_profile_identity=identity,
+                failed_step="clear_profile_lock",
+                error=_redact(str(exc)),
+                remote=remote,
+                org=org,
+                repo=repo,
+            )
+            continue
+        if outcome.get("cleared"):
+            report["cleared_any"] = True
+            report["cleared_profiles"].append(identity)
+            report["reason_lines"].append(
+                f"cleared decision lock profile={identity} after merge of "
+                f"PR #{pr_number} (#709)"
+            )
+            # Audit publication (AC4): post and require comment id for full reconcile.
+            audit = stale_review_decision_lock.build_cleanup_audit_record(
+                assessment={
+                    "last_terminal_pr": pr_number,
+                    "last_terminal_action": "approve",
+                    "pr_state": "closed",
+                    "pr_merged": True,
+                    "pr_merged_or_closed": True,
+                    "merge_commit_sha": merge_commit_sha,
+                    "cleanup_allowed": True,
+                    "is_moot": True,
+                    "lock_summary": outcome.get("prior_summary"),
+                    "reasons": [outcome.get("reason") or "cleared"],
+                },
+                actor_username=actor,
+                profile_name=profile_name,
+                applied=True,
+            )
+            audit["cleanup_target_profile"] = identity
+            audit["issue_ref"] = "#709"
+            comment_block = _profile_operation_gate("gitea.pr.comment")
+            if comment_block:
+                report["recovery_required"] = True
+                report["reason_lines"].append(
+                    f"audit comment blocked for {identity}: {comment_block}"
+                )
+                _record_post_merge_decision_recovery(
+                    pr_number=pr_number,
+                    head_sha=head_sha,
+                    merge_commit_sha=merge_commit_sha,
+                    target_profile_identity=identity,
+                    failed_step="audit_comment_permission",
+                    error=str(comment_block),
+                    remote=remote,
+                    org=org,
+                    repo=repo,
+                )
+                continue
+            try:
+                body = stale_review_decision_lock.format_cleanup_audit_comment(audit)
+                comment_url = f"{repo_api_url(host, org, repo)}/issues/{pr_number}/comments"
+                with _audited(
+                    "comment_pr",
+                    host=host,
+                    remote=remote,
+                    org=org,
+                    repo=repo,
+                    pr_number=pr_number,
+                    request_metadata={"source": "post_merge_decision_lock_reconcile"},
+                ):
+                    posted = api_request("POST", comment_url, auth, {"body": body})
+                cid = (posted or {}).get("id")
+                if not cid:
+                    raise RuntimeError("audit comment missing id on readback")
+                report["audit_comment_ids"].append(cid)
+                report["reason_lines"].append(
+                    f"audit comment published id={cid} for profile={identity}"
+                )
+            except Exception as exc:  # noqa: BLE001
+                report["recovery_required"] = True
+                report["reason_lines"].append(
+                    f"audit comment failed for {identity}: {_redact(str(exc))}"
+                )
+                _record_post_merge_decision_recovery(
+                    pr_number=pr_number,
+                    head_sha=head_sha,
+                    merge_commit_sha=merge_commit_sha,
+                    target_profile_identity=identity,
+                    failed_step="audit_comment_publish",
+                    error=_redact(str(exc)),
+                    remote=remote,
+                    org=org,
+                    repo=repo,
+                )
+
+    if report["cleared_any"] and not report["recovery_required"]:
+        report["applied"] = True  # this-session successful cleanup only
+    elif not report["cleared_any"]:
+        report["reason_lines"].append(
+            f"no cross-profile decision lock targeted PR #{pr_number} for cleanup"
+        )
+    return report
+
+
 @mcp.tool()
 def gitea_cleanup_stale_review_decision_lock(
     apply: bool = False,
@@ -4504,6 +5168,12 @@ def gitea_cleanup_stale_review_decision_lock(
     binding = _decision_lock_binding()
     active_identity = binding.get("profile_identity")
     lock = _load_review_decision_lock()
+    # #720: when normal load yields no lock, inspect disk so assessment does not
+    # silently report "absent" while an expired/non-critical envelope remains.
+    disk_inspect = mcp_session_state.inspect_state_envelope(
+        kind=mcp_session_state.KIND_DECISION_LOCK,
+        profile_identity=active_identity,
+    )
     last = stale_review_decision_lock.last_terminal_mutation(lock)
     pr_live = None
     pr_lookup_error = None
@@ -4525,6 +5195,26 @@ def gitea_cleanup_stale_review_decision_lock(
         pr_lookup_error=pr_lookup_error,
         active_profile_identity=active_identity,
     )
+    if lock is None and disk_inspect.get("on_disk"):
+        assessment = dict(assessment)
+        assessment["reasons"] = list(assessment.get("reasons") or []) + [
+            "decision-lock file is present on disk but not loadable via normal "
+            f"TTL/identity gates: {disk_inspect.get('summary')} "
+            "(do not rm session-state files; #720)"
+        ]
+        assessment["disk_inspect"] = {
+            k: disk_inspect.get(k)
+            for k in (
+                "on_disk",
+                "has_payload",
+                "age_hours",
+                "age_exceeds_default_ttl",
+                "recovery_critical",
+                "ttl_exempt",
+                "would_ttl_reject",
+                "summary",
+            )
+        }
 
     # Optional pin: refuse apply against a different terminal PR than expected.
     if (
@@ -4579,6 +5269,19 @@ def gitea_cleanup_stale_review_decision_lock(
         "pr_merged_or_closed": assessment.get("pr_merged_or_closed"),
         "merge_commit_sha": assessment.get("merge_commit_sha"),
         "lock_summary": assessment.get("lock_summary"),
+        "disk_inspect": assessment.get("disk_inspect") or {
+            k: disk_inspect.get(k)
+            for k in (
+                "on_disk",
+                "has_payload",
+                "age_hours",
+                "age_exceeds_default_ttl",
+                "recovery_critical",
+                "ttl_exempt",
+                "would_ttl_reject",
+                "summary",
+            )
+        },
         "audit": audit,
         "audit_comment_id": None,
         "reasons": list(assessment.get("reasons") or []),
@@ -4659,12 +5362,838 @@ def gitea_cleanup_stale_review_decision_lock(
                         "POST", comment_url, auth, {"body": body}
                     )
                 report["audit_comment_id"] = (posted or {}).get("id")
+                if not report["audit_comment_id"]:
+                    report["reconciled"] = False
+                    report["recovery_required"] = True
+                    report["reasons"] = list(report.get("reasons") or []) + [
+                        "cleanup applied but audit comment id missing on readback "
+                        "(#709 AC4 fail-closed for full reconcile)"
+                    ]
+                    _record_post_merge_decision_recovery(
+                        pr_number=int(assessment["last_terminal_pr"]),
+                        head_sha=assessment.get("locked_head_sha"),
+                        merge_commit_sha=assessment.get("merge_commit_sha"),
+                        target_profile_identity=active_identity,
+                        failed_step="audit_comment_missing_id",
+                        error="comment response missing id",
+                        remote=remote,
+                        org=o,
+                        repo=r,
+                    )
+                else:
+                    report["reconciled"] = True
             except Exception as exc:  # noqa: BLE001
                 report["audit_comment_error"] = _redact(str(exc))
+                report["reconciled"] = False
+                report["recovery_required"] = True
+                report["reasons"] = list(report.get("reasons") or []) + [
+                    "cleanup applied but audit comment failed; recovery-required "
+                    "recorded (#709 AC4)"
+                ]
+                try:
+                    _record_post_merge_decision_recovery(
+                        pr_number=int(assessment["last_terminal_pr"]),
+                        head_sha=assessment.get("locked_head_sha"),
+                        merge_commit_sha=assessment.get("merge_commit_sha"),
+                        target_profile_identity=active_identity,
+                        failed_step="audit_comment_publish",
+                        error=_redact(str(exc)),
+                        remote=remote,
+                        org=o,
+                        repo=r,
+                    )
+                except Exception:
+                    pass
+        if post_audit_comment is False:
+            report["reconciled"] = False
+            report["reasons"] = list(report.get("reasons") or []) + [
+                "cleanup applied without audit comment (post_audit_comment=false); "
+                "not fully reconciled (#709 AC4)"
+            ]
 
     return report
 
 
+def _irrecoverable_capability_gate() -> list[str] | None:
+    """Dedicated recovery capability (gitea.read alone is insufficient)."""
+    import irrecoverable_provenance as irp
+
+    profile = get_profile()
+    assessment = irp.assess_capability_for_irrecoverable_recovery(
+        allowed_operations=profile.get("allowed_operations") or [],
+        forbidden_operations=profile.get("forbidden_operations") or [],
+        role_kind=profile.get("role") or profile.get("role_kind"),
+        profile_name=profile.get("profile_name"),
+    )
+    if assessment.get("allowed"):
+        return None
+    return list(assessment.get("reasons") or ["capability denied"])
+
+
+@mcp.tool()
+def gitea_issue_irrecoverable_provenance_authorization(
+    pr_number: int,
+    expected_head_sha: str,
+    incident_issue: int,
+    incident_comment_id: int,
+    decision_lock_id: str = "",
+    confirmation: str = "",
+    destroyed_subject: str | None = None,
+    recorded_head_sha: str | None = None,
+    remote: str = "dadeschools",
+    host: str | None = None,
+    org: str | None = None,
+    repo: str | None = None,
+) -> dict:
+    """Mint a server-side authorization artifact for irrecoverable recovery (#709 F1/F5).
+
+    Non-forgeable: requires production native MCP transport (or pytest), the
+    dedicated ``gitea.decision_lock.irrecoverable_recovery`` capability (no
+    reconciler equivalence), live head equality, durable HMAC key, and
+    authoritative incident evidence (author + canonical content_digest).
+    Confirmation is human intent only — never authorization. Caller Booleans
+    are not accepted.
+    """
+    import irrecoverable_provenance as irp
+
+    h, o, r = _resolve(remote, host, org, repo)
+    report: dict = {
+        "success": False,
+        "performed": False,
+        "authorization": None,
+        "authorization_id": None,
+        "pr_number": pr_number,
+        "expected_head_sha": expected_head_sha,
+        "incident_issue": incident_issue,
+        "incident_comment_id": incident_comment_id,
+        "reasons": [],
+    }
+
+    cap_block = _irrecoverable_capability_gate()
+    if cap_block:
+        report["reasons"].extend(cap_block)
+        report["permission_report"] = {
+            "required_operation": irp.CAPABILITY_IRRECOVERABLE_RECOVERY,
+            "reasons": cap_block,
+        }
+        return report
+
+    transport = irp.assess_transport_for_auth_mint()
+    if not transport.get("allowed"):
+        report["reasons"].extend(transport.get("reasons") or [])
+        return report
+
+    expected_confirm = irp.expected_confirmation(pr_number)
+    if (confirmation or "").strip() != expected_confirm:
+        report["reasons"].append(
+            f"confirmation must equal exactly {expected_confirm!r} "
+            "(human intent only; not an authorization credential; fail closed)"
+        )
+        return report
+
+    if not (decision_lock_id or "").strip():
+        report["reasons"].append(
+            "decision_lock_id is required so evidence is bound to the exact "
+            "decision lock being recovered (fail closed, #709 F7 review 438)"
+        )
+        return report
+
+    try:
+        actor = _authenticated_username(h)
+    except Exception:
+        actor = None
+    if not actor:
+        report["reasons"].append(
+            "authenticated identity could not be verified (fail closed)"
+        )
+        return report
+    actor_identity = _authenticated_actor(h)
+    if actor_identity.get("user_id") is None:
+        report["reasons"].append(
+            "authenticated actor id could not be verified; display-name-only "
+            "identity is not accepted (fail closed, #709 F7 review 438)"
+        )
+        return report
+    profile = get_profile()
+    profile_name = (profile.get("profile_name") or "").strip() or None
+
+    # Live PR head (authoritative).
+    live_head = None
+    pr_state = None
+    pr_err = None
+    try:
+        pr_live = api_request(
+            "GET", f"{repo_api_url(h, o, r)}/pulls/{int(pr_number)}", _auth(h)
+        )
+        live_head = (pr_live or {}).get("head", {})
+        if isinstance(live_head, dict):
+            live_head = live_head.get("sha")
+        else:
+            live_head = (pr_live or {}).get("head_sha") or (pr_live or {}).get(
+                "head_commit_sha"
+            )
+        pr_state = (pr_live or {}).get("state")
+    except Exception as exc:  # noqa: BLE001
+        pr_err = _redact(str(exc))
+    head_gate = irp.assess_live_head_binding(
+        expected_head_sha=expected_head_sha,
+        live_head_sha=live_head,
+        pr_lookup_error=pr_err,
+        pr_state=pr_state,
+    )
+    if not head_gate.get("valid"):
+        report["reasons"].extend(head_gate.get("reasons") or [])
+        return report
+
+    # Incident evidence live validation (author + canonical digest, #709 F5).
+    comment_payload = None
+    comment_err = None
+    try:
+        comment_payload = api_request(
+            "GET",
+            f"{repo_api_url(h, o, r)}/issues/comments/{int(incident_comment_id)}",
+            _auth(h),
+        )
+    except Exception as exc:  # noqa: BLE001
+        comment_err = _redact(str(exc))
+    try:
+        active_key_version = irp.auth_key_version()
+    except irp.AuthSecretError as exc:
+        report["reasons"].append(str(exc))
+        return report
+    incident_gate = irp.assess_incident_evidence(
+        incident_issue=incident_issue,
+        incident_comment_id=incident_comment_id,
+        comment_payload=comment_payload if isinstance(comment_payload, dict) else None,
+        comment_lookup_error=comment_err,
+        expected_remote=remote,
+        expected_org=o,
+        expected_repo=r,
+        expected_pr_number=pr_number,
+        expected_head_sha=str(expected_head_sha),
+        expected_recorded_head_sha=recorded_head_sha,
+        expected_decision_lock_id=decision_lock_id.strip(),
+        expected_recovery_action=irp.RECOVERY_ACTION_IRRECOVERABLE_PROVENANCE,
+        expected_key_version=active_key_version,
+        mint_actor_id=actor_identity.get("user_id"),
+        mint_actor_username=actor,
+        reject_self_authored=True,
+    )
+    if not incident_gate.get("valid"):
+        report["reasons"].extend(incident_gate.get("reasons") or [])
+        return report
+
+    auth_profile = irp.auth_state_profile_identity(
+        remote=remote,
+        org=o,
+        repo=r,
+        pr_number=pr_number,
+        expected_head_sha=str(expected_head_sha),
+    )
+    # Idempotent: return unconsumed matching auth.
+    existing = mcp_session_state.load_state(
+        kind=mcp_session_state.KIND_IRRECOVERABLE_PROVENANCE_AUTH,
+        remote=remote,
+        org=o,
+        repo=r,
+        profile_identity=auth_profile,
+    )
+    if isinstance(existing, dict):
+        v = irp.verify_authorization_artifact(
+            existing,
+            remote=remote,
+            org=o,
+            repo=r,
+            pr_number=pr_number,
+            expected_head_sha=str(expected_head_sha),
+            incident_issue=incident_issue,
+            incident_comment_id=incident_comment_id,
+            require_unconsumed=True,
+        )
+        if v.get("valid"):
+            report["success"] = True
+            report["performed"] = False
+            report["authorization"] = existing
+            report["authorization_id"] = existing.get("authorization_id")
+            report["reasons"].append(
+                "idempotent: unconsumed matching authorization already present"
+            )
+            return report
+
+    try:
+        artifact = irp.build_authorization_artifact(
+            remote=remote,
+            org=o,
+            repo=r,
+            pr_number=pr_number,
+            expected_head_sha=str(expected_head_sha),
+            incident_issue=int(incident_issue),
+            incident_comment_id=int(incident_comment_id),
+            destroyed_subject=destroyed_subject,
+            issuer_username=actor,
+            issuer_profile=profile_name or "unknown",
+            native_provenance=mcp_daemon_guard.mutation_provenance_fields(),
+        )
+    except irp.AuthSecretError as exc:
+        report["reasons"].append(str(exc))
+        return report
+    artifact["kind"] = mcp_session_state.KIND_IRRECOVERABLE_PROVENANCE_AUTH
+    saved = mcp_session_state.save_state(
+        kind=mcp_session_state.KIND_IRRECOVERABLE_PROVENANCE_AUTH,
+        payload=artifact,
+        remote=remote,
+        org=o,
+        repo=r,
+        profile_identity=auth_profile,
+    )
+    report["authorization"] = dict(saved or artifact)
+    report["authorization_id"] = report["authorization"].get("authorization_id")
+    report["performed"] = True
+    report["success"] = True
+    report["reasons"].append(
+        "issued server-side irrecoverable provenance authorization "
+        "(non-forgeable; bound to remote/org/repo/PR/head/incident; "
+        f"key_version={artifact.get('key_version')})"
+    )
+    return report
+
+
+@mcp.tool()
+def gitea_record_irrecoverable_decision_lock_provenance(
+    pr_number: int,
+    reason: str,
+    confirmation: str = "",
+    expected_head_sha: str | None = None,
+    incident_issue: int | None = None,
+    incident_comment_id: int | None = None,
+    authorization_id: str | None = None,
+    decision_lock_id: str = "",
+    destroyed_subject: str | None = None,
+    incident_ref: str | None = None,
+    # Deprecated: retained so callers that still pass it get an explicit deny.
+    operator_authorized: bool = False,
+    remote: str = "dadeschools",
+    host: str | None = None,
+    org: str | None = None,
+    repo: str | None = None,
+    post_audit_comment: bool = True,
+) -> dict:
+    """Record truthful absence of decision-lock cleanup proof (#709 AC5).
+
+    Never emits applied=true or claims historical cleanup was proven.
+
+    Authorization is a **server-side artifact** (see
+    ``gitea_issue_irrecoverable_provenance_authorization``). Caller-supplied
+    ``operator_authorized`` is **never** authorization evidence (review 434 F1).
+    Confirmation is human intent only. ``expected_head_sha``,
+    ``incident_issue``, and ``incident_comment_id`` are mandatory.
+    """
+    import irrecoverable_provenance as irp
+
+    h, o, r = _resolve(remote, host, org, repo)
+    expected_confirm = irp.expected_confirmation(pr_number)
+    report = {
+        "success": False,
+        "performed": False,
+        "applied": False,
+        "historical_cleanup_proven": False,
+        "status": "provenance_irrecoverable",
+        "pr_number": pr_number,
+        "expected_head_sha": expected_head_sha,
+        "reasons": [],
+        "record": None,
+        "audit_comment_id": None,
+        "authorization_id": authorization_id,
+        "merger_may_accept": False,
+    }
+
+    # Explicitly reject self-assertable Boolean as sole/any authorization.
+    if operator_authorized:
+        report["reasons"].append(
+            "operator_authorized is not accepted as authorization evidence "
+            "(#709 F1 / review 434); mint a server-side authorization via "
+            "gitea_issue_irrecoverable_provenance_authorization"
+        )
+        # Do not return yet — still report other failures — but never authorize.
+        # Actually fail immediately so success cannot be claimed.
+        return report
+
+    cap_block = _irrecoverable_capability_gate()
+    if cap_block:
+        report["reasons"].extend(cap_block)
+        report["permission_report"] = {
+            "required_operation": irp.CAPABILITY_IRRECOVERABLE_RECOVERY,
+            "reasons": cap_block,
+        }
+        return report
+
+    transport = irp.assess_transport_for_auth_mint()
+    if not transport.get("allowed"):
+        report["reasons"].extend(transport.get("reasons") or [])
+        return report
+
+    if (confirmation or "").strip() != expected_confirm:
+        report["reasons"].append(
+            f"confirmation must equal exactly {expected_confirm!r} "
+            "(human intent only; not authorization; fail closed)"
+        )
+        return report
+    if not (reason or "").strip():
+        report["reasons"].append("reason is required (fail closed)")
+        return report
+    if not expected_head_sha or not str(expected_head_sha).strip():
+        report["reasons"].append(
+            "expected_head_sha is mandatory (fail closed, #709 F1)"
+        )
+        return report
+    if incident_issue is None or int(incident_issue) <= 0:
+        report["reasons"].append(
+            "incident_issue is mandatory (canonical incident evidence, #709 F1)"
+        )
+        return report
+    if incident_comment_id is None or int(incident_comment_id) <= 0:
+        report["reasons"].append(
+            "incident_comment_id is mandatory (canonical incident evidence, #709 F1)"
+        )
+        return report
+    # incident_ref alone is never sufficient (legacy arg ignored as authority).
+    _ = incident_ref
+
+    try:
+        actor = _authenticated_username(h)
+    except Exception:
+        actor = None
+    if not actor:
+        report["reasons"].append(
+            "authenticated identity could not be verified (fail closed)"
+        )
+        return report
+    profile = get_profile()
+    profile_name = (profile.get("profile_name") or "").strip() or None
+
+    # Live head must match.
+    live_head = None
+    pr_err = None
+    try:
+        pr_live = api_request(
+            "GET", f"{repo_api_url(h, o, r)}/pulls/{int(pr_number)}", _auth(h)
+        )
+        live_head = (pr_live or {}).get("head", {})
+        if isinstance(live_head, dict):
+            live_head = live_head.get("sha")
+        else:
+            live_head = (pr_live or {}).get("head_sha") or (pr_live or {}).get(
+                "head_commit_sha"
+            )
+    except Exception as exc:  # noqa: BLE001
+        pr_err = _redact(str(exc))
+    head_gate = irp.assess_live_head_binding(
+        expected_head_sha=expected_head_sha,
+        live_head_sha=live_head,
+        pr_lookup_error=pr_err,
+    )
+    if not head_gate.get("valid"):
+        report["reasons"].extend(head_gate.get("reasons") or [])
+        return report
+
+    # Re-validate incident evidence at record time.
+    comment_payload = None
+    comment_err = None
+    try:
+        comment_payload = api_request(
+            "GET",
+            f"{repo_api_url(h, o, r)}/issues/comments/{int(incident_comment_id)}",
+            _auth(h),
+        )
+    except Exception as exc:  # noqa: BLE001
+        comment_err = _redact(str(exc))
+    try:
+        active_key_version = irp.auth_key_version()
+    except irp.AuthSecretError as exc:
+        report["reasons"].append(str(exc))
+        return report
+    incident_gate = irp.assess_incident_evidence(
+        incident_issue=incident_issue,
+        incident_comment_id=incident_comment_id,
+        comment_payload=comment_payload if isinstance(comment_payload, dict) else None,
+        comment_lookup_error=comment_err,
+        expected_remote=remote,
+        expected_org=o,
+        expected_repo=r,
+        expected_pr_number=pr_number,
+        expected_head_sha=str(expected_head_sha),
+        expected_decision_lock_id=(decision_lock_id or "").strip() or None,
+        expected_recovery_action=irp.RECOVERY_ACTION_IRRECOVERABLE_PROVENANCE,
+        expected_key_version=active_key_version,
+        mint_actor_id=_authenticated_actor(h).get("user_id"),
+        mint_actor_username=actor,
+        reject_self_authored=True,
+    )
+    if not incident_gate.get("valid"):
+        report["reasons"].extend(incident_gate.get("reasons") or [])
+        return report
+
+    # Load server-side authorization artifact (by scope; optional id check).
+    auth_profile = irp.auth_state_profile_identity(
+        remote=remote,
+        org=o,
+        repo=r,
+        pr_number=pr_number,
+        expected_head_sha=str(expected_head_sha),
+    )
+    authorization = mcp_session_state.load_state(
+        kind=mcp_session_state.KIND_IRRECOVERABLE_PROVENANCE_AUTH,
+        remote=remote,
+        org=o,
+        repo=r,
+        profile_identity=auth_profile,
+    )
+    if not isinstance(authorization, dict):
+        report["reasons"].append(
+            "no server-side authorization artifact for this exact scope; call "
+            "gitea_issue_irrecoverable_provenance_authorization first (fail closed)"
+        )
+        return report
+    if authorization_id and authorization.get("authorization_id") != authorization_id:
+        report["reasons"].append(
+            "authorization_id does not match durable artifact for this scope "
+            "(fail closed)"
+        )
+        return report
+    auth_check = irp.verify_authorization_artifact(
+        authorization,
+        remote=remote,
+        org=o,
+        repo=r,
+        pr_number=pr_number,
+        expected_head_sha=str(expected_head_sha),
+        incident_issue=int(incident_issue),
+        incident_comment_id=int(incident_comment_id),
+        require_unconsumed=True,
+    )
+    if not auth_check.get("valid"):
+        report["reasons"].extend(auth_check.get("reasons") or [])
+        return report
+
+    recovery_profile = irp.recovery_state_profile_identity(
+        remote=remote,
+        org=o,
+        repo=r,
+        pr_number=pr_number,
+        expected_head_sha=str(expected_head_sha),
+    )
+    existing = mcp_session_state.load_state(
+        kind=mcp_session_state.KIND_IRRECOVERABLE_DECISION_PROVENANCE,
+        remote=remote,
+        org=o,
+        repo=r,
+        profile_identity=recovery_profile,
+    )
+    if (
+        isinstance(existing, dict)
+        and existing.get("pr_number") == pr_number
+        and stale_review_decision_lock.heads_equal(
+            existing.get("head_sha"), expected_head_sha
+        )
+        and existing.get("status") == "provenance_irrecoverable"
+        and existing.get("authorization_id") == authorization.get("authorization_id")
+    ):
+        report["success"] = True
+        report["performed"] = False
+        report["record"] = existing
+        report["merger_may_accept"] = bool(existing.get("merger_may_accept"))
+        report["authorization_id"] = existing.get("authorization_id")
+        report["reasons"].append(
+            "idempotent: matching irrecoverable record already present"
+        )
+        return report
+
+    record = irp.build_irrecoverable_provenance_record(
+        pr_number=pr_number,
+        head_sha=str(expected_head_sha),
+        remote=remote,
+        org=o,
+        repo=r,
+        actor_username=actor,
+        profile_name=profile_name,
+        reason=reason.strip(),
+        incident_issue=int(incident_issue),
+        incident_comment_id=int(incident_comment_id),
+        authorization=authorization,
+        destroyed_subject=destroyed_subject,
+    )
+    if not record.get("merger_may_accept"):
+        report["reasons"].append(
+            "built record is not merger-acceptable (authorization verify failed)"
+        )
+        report["record"] = record
+        return report
+
+    record["kind"] = mcp_session_state.KIND_IRRECOVERABLE_DECISION_PROVENANCE
+    saved = mcp_session_state.save_state(
+        kind=mcp_session_state.KIND_IRRECOVERABLE_DECISION_PROVENANCE,
+        payload=record,
+        remote=remote,
+        org=o,
+        repo=r,
+        profile_identity=recovery_profile,
+    )
+    report["record"] = dict(saved or record)
+    report["performed"] = True
+    report["success"] = True
+    report["merger_may_accept"] = True
+    report["authorization_id"] = record.get("authorization_id")
+    report["reasons"].append(
+        "recorded provenance_irrecoverable (applied=false; historical cleanup "
+        "not proven; server authorization bound)"
+    )
+
+    if post_audit_comment:
+        issue_block = _profile_operation_gate("gitea.issue.comment")
+        if issue_block:
+            report["reasons"].append(f"audit comment skipped: {issue_block}")
+        else:
+            try:
+                body = irp.format_irrecoverable_audit_comment(report["record"])
+                comment_url = f"{repo_api_url(h, o, r)}/issues/{pr_number}/comments"
+                with _audited(
+                    "comment_issue",
+                    host=h,
+                    remote=remote,
+                    org=o,
+                    repo=r,
+                    issue_number=pr_number,
+                    request_metadata={
+                        "source": "record_irrecoverable_decision_lock_provenance"
+                    },
+                ):
+                    posted = api_request(
+                        "POST",
+                        comment_url,
+                        _auth(h),
+                        {"body": body},
+                    )
+                report["audit_comment_id"] = (posted or {}).get("id")
+                if report["audit_comment_id"]:
+                    report["record"]["audit_comment_id"] = report["audit_comment_id"]
+                    mcp_session_state.save_state(
+                        kind=mcp_session_state.KIND_IRRECOVERABLE_DECISION_PROVENANCE,
+                        payload=report["record"],
+                        remote=remote,
+                        org=o,
+                        repo=r,
+                        profile_identity=recovery_profile,
+                    )
+            except Exception as exc:  # noqa: BLE001
+                report["reasons"].append(
+                    f"audit comment failed: {_redact(str(exc))} (record still durable)"
+                )
+    return report
+
+
+@mcp.tool()
+def gitea_consume_irrecoverable_decision_lock_provenance(
+    pr_number: int,
+    expected_head_sha: str,
+    confirmation: str = "",
+    remote: str = "dadeschools",
+    host: str | None = None,
+    org: str | None = None,
+    repo: str | None = None,
+) -> dict:
+    """Merger-side fail-closed consumption of an irrecoverable recovery record (#709 F2).
+
+    Resolves **only** the historical prior-provenance blocker for the exact
+    remote/org/repo/PR/head. Never bypasses approval, change-requests, lease,
+    mergeability, anti-stomp, runtime, or workspace gates. Consumption is
+    durable, auditable, and idempotent.
+    """
+    import irrecoverable_provenance as irp
+
+    h, o, r = _resolve(remote, host, org, repo)
+    expected_confirm = f"CONSUME IRRECOVERABLE PROVENANCE PR {int(pr_number)}"
+    report: dict = {
+        "success": False,
+        "performed": False,
+        "pr_number": pr_number,
+        "expected_head_sha": expected_head_sha,
+        "historical_cleanup_proven": False,
+        "historical_cleanup_not_proven": True,
+        "irrecoverable_recovery_authorized": False,
+        "recovery_record_consumed": False,
+        "resolves_prior_provenance_blocker": False,
+        "normal_approval_and_merge_gates": "not_substituted",
+        "reasons": [],
+        "assessment": None,
+    }
+
+    # Merger or reconciler may consume; gitea.read alone insufficient.
+    merge_block = _profile_operation_gate("gitea.pr.merge")
+    cap_block = _irrecoverable_capability_gate()
+    if merge_block and cap_block:
+        report["reasons"].append(
+            "consume requires gitea.pr.merge (merger) or irrecoverable-recovery "
+            "capability (reconciler); gitea.read alone is insufficient (#709 F2)"
+        )
+        if merge_block:
+            report["reasons"].extend(
+                merge_block if isinstance(merge_block, list) else [str(merge_block)]
+            )
+        report["reasons"].extend(cap_block)
+        return report
+
+    if (confirmation or "").strip() != expected_confirm:
+        report["reasons"].append(
+            f"confirmation must equal exactly {expected_confirm!r} "
+            "(human intent; fail closed)"
+        )
+        return report
+
+    try:
+        actor = _authenticated_username(h)
+    except Exception:
+        actor = None
+    if not actor:
+        report["reasons"].append("authenticated identity unverified (fail closed)")
+        return report
+    profile = get_profile()
+    profile_name = (profile.get("profile_name") or "").strip() or None
+
+    # Live head.
+    live_head = None
+    pr_err = None
+    try:
+        pr_live = api_request(
+            "GET", f"{repo_api_url(h, o, r)}/pulls/{int(pr_number)}", _auth(h)
+        )
+        live_head = (pr_live or {}).get("head", {})
+        if isinstance(live_head, dict):
+            live_head = live_head.get("sha")
+        else:
+            live_head = (pr_live or {}).get("head_sha")
+    except Exception as exc:  # noqa: BLE001
+        pr_err = _redact(str(exc))
+    head_gate = irp.assess_live_head_binding(
+        expected_head_sha=expected_head_sha,
+        live_head_sha=live_head,
+        pr_lookup_error=pr_err,
+    )
+    if not head_gate.get("valid"):
+        report["reasons"].extend(head_gate.get("reasons") or [])
+        return report
+
+    recovery_profile = irp.recovery_state_profile_identity(
+        remote=remote,
+        org=o,
+        repo=r,
+        pr_number=pr_number,
+        expected_head_sha=str(expected_head_sha),
+    )
+    recovery = mcp_session_state.load_state(
+        kind=mcp_session_state.KIND_IRRECOVERABLE_DECISION_PROVENANCE,
+        remote=remote,
+        org=o,
+        repo=r,
+        profile_identity=recovery_profile,
+    )
+    auth_profile = irp.auth_state_profile_identity(
+        remote=remote,
+        org=o,
+        repo=r,
+        pr_number=pr_number,
+        expected_head_sha=str(expected_head_sha),
+    )
+    authorization = mcp_session_state.load_state(
+        kind=mcp_session_state.KIND_IRRECOVERABLE_PROVENANCE_AUTH,
+        remote=remote,
+        org=o,
+        repo=r,
+        profile_identity=auth_profile,
+    )
+
+    # Pull formal review state so consumption cannot be claimed when normal
+    # gates would fail (assessment only — does not merge).
+    feedback = gitea_get_pr_review_feedback(
+        pr_number=pr_number, remote=remote, host=host, org=org, repo=repo
+    )
+    assessment = irp.assess_merger_consumption(
+        recovery if isinstance(recovery, dict) else None,
+        authorization if isinstance(authorization, dict) else None,
+        remote=remote,
+        org=o,
+        repo=r,
+        pr_number=pr_number,
+        live_head_sha=live_head,
+        approval_at_current_head=feedback.get("approval_at_current_head")
+        if feedback.get("success")
+        else None,
+        has_blocking_change_requests=feedback.get("has_blocking_change_requests")
+        if feedback.get("success")
+        else None,
+    )
+    report["assessment"] = assessment
+    report["reasons"].extend(assessment.get("reasons") or [])
+    report["irrecoverable_recovery_authorized"] = bool(
+        assessment.get("irrecoverable_recovery_authorized")
+    )
+    report["resolves_prior_provenance_blocker"] = bool(
+        assessment.get("resolves_prior_provenance_blocker")
+    )
+    report["historical_cleanup_proven"] = False
+    report["historical_cleanup_not_proven"] = True
+
+    if not assessment.get("allowed") and not assessment.get(
+        "recovery_record_consumed"
+    ):
+        return report
+
+    # Atomic-ish durable consumption (auth then recovery under exclusive locks
+    # via save_state).
+    if isinstance(authorization, dict) and not authorization.get("consumed_at"):
+        consumed_auth = irp.mark_consumed(
+            authorization,
+            consumer_username=actor,
+            consumer_profile=profile_name,
+        )
+        mcp_session_state.save_state(
+            kind=mcp_session_state.KIND_IRRECOVERABLE_PROVENANCE_AUTH,
+            payload=consumed_auth,
+            remote=remote,
+            org=o,
+            repo=r,
+            profile_identity=auth_profile,
+        )
+    if isinstance(recovery, dict) and not recovery.get("consumed_at"):
+        consumed_rec = irp.mark_consumed(
+            recovery,
+            consumer_username=actor,
+            consumer_profile=profile_name,
+        )
+        consumed_rec["prior_provenance_blocker_resolved"] = True
+        saved = mcp_session_state.save_state(
+            kind=mcp_session_state.KIND_IRRECOVERABLE_DECISION_PROVENANCE,
+            payload=consumed_rec,
+            remote=remote,
+            org=o,
+            repo=r,
+            profile_identity=recovery_profile,
+        )
+        report["record"] = dict(saved or consumed_rec)
+        report["performed"] = True
+    else:
+        report["record"] = recovery
+        report["performed"] = False
+
+    report["recovery_record_consumed"] = True
+    report["success"] = True
+    report["resolves_prior_provenance_blocker"] = True
+    report["reasons"].append(
+        "prior-provenance blocker resolved for exact scope; historical cleanup "
+        "remains unproven; normal merge gates still required"
+    )
+    return report
+
+
 @mcp.tool()
 def gitea_dry_run_pr_review(
     pr_number: int,
@@ -5550,6 +7079,16 @@ def gitea_merge_pr(
     result["pr_author"] = elig.get("pr_author")
     result["head_sha"] = elig.get("head_sha")
     result["mergeable"] = elig.get("mergeable")
+    # Surface #695 approval/quarantine fields from eligibility even on deny.
+    for _k in (
+        "approval_visible",
+        "approval_at_current_head",
+        "quarantined_approvals_at_current_head",
+        "stale_approval_block_reason",
+        "has_blocking_change_requests",
+    ):
+        if _k in elig:
+            result[_k] = elig.get(_k)
     if not elig.get("eligible"):
         reasons.append("eligibility check for 'merge' failed (fail closed)")
         reasons.extend(elig.get("reasons", []))
@@ -5657,16 +7196,31 @@ def gitea_merge_pr(
     result["review_feedback_stale"] = feedback.get("review_feedback_stale")
     result["has_blocking_change_requests"] = feedback.get(
         "has_blocking_change_requests")
+    result["quarantined_review_ids"] = feedback.get("quarantined_review_ids") or []
+    result["quarantined_approvals_at_current_head"] = feedback.get(
+        "quarantined_approvals_at_current_head"
+    )
     if feedback.get("has_blocking_change_requests"):
         reasons.append(
             "undismissed REQUEST_CHANGES review blocks merge (fail closed)"
         )
         return result
     if not feedback.get("approval_visible"):
-        reasons.append(
-            "no visible APPROVED review on PR; verify review submission "
-            "completed before merge (fail closed)"
-        )
+        # #695: quarantined APPROVED reviews are not "visible" for merge auth.
+        if feedback.get("quarantined_approvals_at_current_head"):
+            reasons.append(
+                feedback.get("stale_approval_block_reason")
+                or (
+                    "only contaminated/quarantined approval(s) at current head "
+                    "(#695); merge authorization is void — fresh native MCP "
+                    "re-review required after controller quarantine evidence"
+                )
+            )
+        else:
+            reasons.append(
+                "no visible APPROVED review on PR; verify review submission "
+                "completed before merge (fail closed)"
+            )
         return result
     if not feedback.get("approval_at_current_head"):
         reasons.append(
@@ -5690,6 +7244,137 @@ def gitea_merge_pr(
         reasons.append(str(e))
         return result
 
+    # Gate 8b — optional irrecoverable prior-provenance recovery report (#709 F2).
+    # Never substitutes for approval/lease/mergeability gates above. Surfaces
+    # truthful distinctions for controllers/mergers.
+    try:
+        import irrecoverable_provenance as _irp_merge
+
+        _rec_prof = _irp_merge.recovery_state_profile_identity(
+            remote=remote,
+            org=o,
+            repo=r,
+            pr_number=pr_number,
+            expected_head_sha=str(expected_head_sha or actual_sha or ""),
+        )
+        _auth_prof = _irp_merge.auth_state_profile_identity(
+            remote=remote,
+            org=o,
+            repo=r,
+            pr_number=pr_number,
+            expected_head_sha=str(expected_head_sha or actual_sha or ""),
+        )
+        _recovery = mcp_session_state.load_state(
+            kind=mcp_session_state.KIND_IRRECOVERABLE_DECISION_PROVENANCE,
+            remote=remote,
+            org=o,
+            repo=r,
+            profile_identity=_rec_prof,
+        )
+        _auth_art = mcp_session_state.load_state(
+            kind=mcp_session_state.KIND_IRRECOVERABLE_PROVENANCE_AUTH,
+            remote=remote,
+            org=o,
+            repo=r,
+            profile_identity=_auth_prof,
+        )
+        if isinstance(_recovery, dict) or isinstance(_auth_art, dict):
+            _assess = _irp_merge.assess_merger_consumption(
+                _recovery if isinstance(_recovery, dict) else None,
+                _auth_art if isinstance(_auth_art, dict) else None,
+                remote=remote,
+                org=o,
+                repo=r,
+                pr_number=pr_number,
+                live_head_sha=actual_sha,
+                approval_at_current_head=bool(
+                    feedback.get("approval_at_current_head")
+                ),
+                has_blocking_change_requests=bool(
+                    feedback.get("has_blocking_change_requests")
+                ),
+                mergeable=result.get("mergeable"),
+                lease_ok=True,
+                runtime_ok=True,
+                workspace_ok=True,
+                anti_stomp_ok=True,
+            )
+            result["irrecoverable_provenance"] = {
+                "historical_cleanup_proven": False,
+                "historical_cleanup_not_proven": True,
+                "irrecoverable_recovery_authorized": bool(
+                    _assess.get("irrecoverable_recovery_authorized")
+                ),
+                "recovery_record_consumed": bool(
+                    _assess.get("recovery_record_consumed")
+                    or (
+                        isinstance(_recovery, dict) and _recovery.get("consumed_at")
+                    )
+                ),
+                "resolves_prior_provenance_blocker": bool(
+                    _assess.get("resolves_prior_provenance_blocker")
+                ),
+                "assessment_reasons": list(_assess.get("reasons") or []),
+            }
+            # Consume on successful merge path when allowed and not yet consumed.
+            if _assess.get("allowed") and isinstance(_recovery, dict) and not _recovery.get(
+                "consumed_at"
+            ):
+                try:
+                    if isinstance(_auth_art, dict) and not _auth_art.get("consumed_at"):
+                        mcp_session_state.save_state(
+                            kind=mcp_session_state.KIND_IRRECOVERABLE_PROVENANCE_AUTH,
+                            payload=_irp_merge.mark_consumed(
+                                _auth_art,
+                                consumer_username=auth_user,
+                                consumer_profile=result.get("profile_name"),
+                            ),
+                            remote=remote,
+                            org=o,
+                            repo=r,
+                            profile_identity=_auth_prof,
+                        )
+                    mcp_session_state.save_state(
+                        kind=mcp_session_state.KIND_IRRECOVERABLE_DECISION_PROVENANCE,
+                        payload={
+                            **_irp_merge.mark_consumed(
+                                _recovery,
+                                consumer_username=auth_user,
+                                consumer_profile=result.get("profile_name"),
+                            ),
+                            "prior_provenance_blocker_resolved": True,
+                        },
+                        remote=remote,
+                        org=o,
+                        repo=r,
+                        profile_identity=_rec_prof,
+                    )
+                    result["irrecoverable_provenance"][
+                        "recovery_record_consumed"
+                    ] = True
+                    result["irrecoverable_provenance"][
+                        "consumed_at_merge_preflight"
+                    ] = True
+                except Exception as _cons_exc:  # noqa: BLE001
+                    result["irrecoverable_provenance"]["consume_error"] = _redact(
+                        str(_cons_exc)
+                    )
+        else:
+            result["irrecoverable_provenance"] = {
+                "historical_cleanup_proven": False,
+                "historical_cleanup_not_proven": True,
+                "irrecoverable_recovery_authorized": False,
+                "recovery_record_consumed": False,
+                "resolves_prior_provenance_blocker": False,
+                "note": "no irrecoverable recovery record for this exact scope",
+            }
+    except Exception as _irp_exc:  # noqa: BLE001 — never block merge path
+        result["irrecoverable_provenance"] = {
+            "error": _redact(str(_irp_exc)),
+            "historical_cleanup_proven": False,
+            "historical_cleanup_not_proven": True,
+        }
+
     # All gates passed — perform the single merge mutation.
     try:
         auth = _auth(h)
@@ -5737,29 +7422,49 @@ def gitea_merge_pr(
             reviewer_pr_lease.get_session_lease()
         )
     )
-    # Same-profile auto-expire (#594): if *this* profile's decision lock ends
-    # with an approve of the PR just merged, clear it so durable state cannot
-    # block later unrelated reviews. Cross-profile locks (e.g. reviewer vs
-    # merger) still require gitea_cleanup_stale_review_decision_lock.
+    # #709 AC1/AC3/AC4: reconcile decision locks after irreversible merge.
+    # Clears the same-profile lock when it holds the approve, and also scans
+    # other durable profile locks (e.g. prgs-reviewer) so merger-local empty
+    # init cannot leave the reviewer terminal ledger behind. Failures write a
+    # recovery-required record (applied=false) — merge is never undone.
     try:
-        lock_after = _load_review_decision_lock()
-        last_term = stale_review_decision_lock.last_terminal_mutation(lock_after)
-        if (
-            last_term
-            and last_term.get("action") == "approve"
-            and last_term.get("pr_number") == pr_number
-        ):
-            _save_review_decision_lock(None)
-            result["review_decision_lock_cleared_after_merge"] = True
-            reasons.append(
-                f"cleared same-profile review decision lock after merge of "
-                f"approved PR #{pr_number} (#594)"
-            )
-        else:
-            result["review_decision_lock_cleared_after_merge"] = False
+        reconcile = _reconcile_decision_locks_after_merge(
+            pr_number=pr_number,
+            head_sha=expected_head_sha,
+            merge_commit_sha=(
+                (merged or {}).get("merge_commit_sha")
+                if isinstance(merged, dict)
+                else None
+            ),
+            remote=remote,
+            host=h,
+            org=o,
+            repo=r,
+            auth=auth,
+        )
+        result["review_decision_lock_reconcile"] = reconcile
+        result["review_decision_lock_cleared_after_merge"] = bool(
+            reconcile.get("cleared_any")
+        )
+        for line in reconcile.get("reason_lines") or []:
+            reasons.append(line)
     except Exception as clear_exc:  # noqa: BLE001 — never fail the merge
         result["review_decision_lock_cleared_after_merge"] = False
         result["review_decision_lock_clear_error"] = _redact(str(clear_exc))
+        try:
+            _record_post_merge_decision_recovery(
+                pr_number=pr_number,
+                head_sha=expected_head_sha,
+                merge_commit_sha=None,
+                target_profile_identity=None,
+                failed_step="reconcile_exception",
+                error=_redact(str(clear_exc)),
+                remote=remote,
+                org=o,
+                repo=r,
+            )
+        except Exception:
+            pass
     reasons.append(f"all gates passed; merged PR #{pr_number} via '{do}'")
     return result
 
@@ -6061,6 +7766,65 @@ def gitea_delete_branch(
             "permission_report": _permission_block_report("gitea.branch.delete"),
         }
 
+    # Possessing gitea.branch.delete alone is not enough for arbitrary deletion.
+    # task_capability_map maps delete_branch → author; reconciler must use the
+    # guarded cleanup_merged_pr_branch path only (#687 / #514).
+    profile = get_profile()
+    active_role = _profile_role_kind(profile)
+    required_role = task_capability_map.required_role("delete_branch")
+    if active_role == "reconciler":
+        return {
+            "success": False,
+            "performed": False,
+            "required_permission": "gitea.branch.delete",
+            "required_role_kind": required_role,
+            "active_role_kind": active_role,
+            "reasons": [
+                "reconciler profile cannot use raw gitea_delete_branch; "
+                "use gitea_cleanup_merged_pr_branch for a fully merged PR "
+                "source branch only (fail closed)"
+            ],
+            "exact_next_action": (
+                "Call gitea_cleanup_merged_pr_branch with pr_number, the "
+                "exact PR head branch, and confirmation "
+                "'CLEANUP MERGED PR <n> BRANCH <branch>' after capability "
+                "resolve for cleanup_merged_pr_branch."
+            ),
+            "permission_report": _permission_block_report("gitea.branch.delete"),
+        }
+    if active_role != required_role:
+        return {
+            "success": False,
+            "performed": False,
+            "required_permission": "gitea.branch.delete",
+            "required_role_kind": required_role,
+            "active_role_kind": active_role,
+            "reasons": [
+                f"Active profile role '{active_role}' cannot perform "
+                f"{required_role} task 'delete_branch' even when "
+                "gitea.branch.delete is present (fail closed)"
+            ],
+            "permission_report": _permission_block_report("gitea.branch.delete"),
+        }
+
+    if branch_cleanup_guard.is_preservation_or_evidence_branch(branch):
+        return {
+            "success": False,
+            "performed": False,
+            "required_permission": "gitea.branch.delete",
+            "reasons": [
+                f"branch '{branch}' is a preservation/evidence branch and "
+                "cannot be deleted (fail closed)"
+            ],
+        }
+    if branch in branch_cleanup_guard.PROTECTED_BRANCHES:
+        return {
+            "success": False,
+            "performed": False,
+            "required_permission": "gitea.branch.delete",
+            "reasons": [f"branch '{branch}' is protected (fail closed)"],
+        }
+
     audit_allowed, audit_reasons = (
         audit_reconciliation_mode.check_audit_mutation_allowed("delete_branch")
     )
@@ -6103,41 +7867,49 @@ def gitea_cleanup_merged_pr_branch(
     """Delete a merged PR source branch through the guarded MCP path (#514)."""
     gate_reasons = _profile_operation_gate("gitea.branch.delete")
     if gate_reasons:
-        return {
-            "success": False,
-            "performed": False,
-            "required_permission": "gitea.branch.delete",
-            "reasons": gate_reasons,
-            "permission_report": _permission_block_report("gitea.branch.delete"),
-        }
+        return branch_cleanup_guard.cleanup_result_envelope(
+            success=False,
+            performed=False,
+            delete_acknowledged=False,
+            verified_absent=False,
+            required_permission="gitea.branch.delete",
+            reasons=gate_reasons,
+            permission_report=_permission_block_report("gitea.branch.delete"),
+        )
 
     profile = get_profile()
-    active_role = _role_kind(
-        profile.get("allowed_operations", []),
-        profile.get("forbidden_operations", []),
-    )
-    if active_role == "reviewer":
-        return {
-            "success": False,
-            "performed": False,
-            "required_permission": "gitea.branch.delete",
-            "reasons": [
-                "reviewer profile is not authorized for merged branch cleanup "
-                "(fail closed)"
+    active_role = _profile_role_kind(profile)
+    # cleanup_merged_pr_branch is reconciler-owned (task_capability_map).
+    # Author/reviewer/merger must not reach this path even if they somehow
+    # hold gitea.branch.delete.
+    if active_role != "reconciler":
+        return branch_cleanup_guard.cleanup_result_envelope(
+            success=False,
+            performed=False,
+            delete_acknowledged=False,
+            verified_absent=False,
+            required_permission="gitea.branch.delete",
+            required_role_kind="reconciler",
+            active_role_kind=active_role,
+            reasons=[
+                f"profile role '{active_role}' is not authorized for merged "
+                "branch cleanup; required role is reconciler (fail closed)"
             ],
-            "permission_report": _permission_block_report("gitea.branch.delete"),
-        }
+            permission_report=_permission_block_report("gitea.branch.delete"),
+        )
 
     if worktree_path is None or "/branches/" not in os.path.realpath(worktree_path):
-        return {
-            "success": False,
-            "performed": False,
-            "required_permission": "gitea.branch.delete",
-            "reasons": [
+        return branch_cleanup_guard.cleanup_result_envelope(
+            success=False,
+            performed=False,
+            delete_acknowledged=False,
+            verified_absent=False,
+            required_permission="gitea.branch.delete",
+            reasons=[
                 "merged branch cleanup requires an explicit branches/ worktree "
                 "path; root checkout branch ref mutation is blocked (fail closed)"
             ],
-        }
+        )
 
     verify_preflight_purity(
         remote,
@@ -6155,16 +7927,18 @@ def gitea_cleanup_merged_pr_branch(
     target_branch = (pr.get("base") or {}).get("ref") or "master"
 
     if branch and branch != pr_head.get("ref"):
-        return {
-            "success": False,
-            "performed": False,
-            "pr_number": pr_number,
-            "branch": branch,
-            "reasons": [
+        return branch_cleanup_guard.cleanup_result_envelope(
+            success=False,
+            performed=False,
+            delete_acknowledged=False,
+            verified_absent=False,
+            pr_number=pr_number,
+            branch=branch,
+            reasons=[
                 f"requested branch '{branch}' does not match PR head "
                 f"'{pr_head.get('ref')}'"
             ],
-        }
+        )
 
     open_prs = api_get_all(f"{base}/pulls?state=open", auth)
     open_heads = {
@@ -6194,19 +7968,86 @@ def gitea_cleanup_merged_pr_branch(
         confirmation=confirmation,
     )
     if not assessment["safe_to_delete"]:
-        return {
-            "success": False,
-            "performed": False,
-            "pr_number": pr_number,
-            "branch": head_branch,
-            "assessment": assessment,
-            "reasons": assessment["block_reasons"],
-        }
+        return branch_cleanup_guard.cleanup_result_envelope(
+            success=False,
+            performed=False,
+            delete_acknowledged=False,
+            verified_absent=False,
+            pr_number=pr_number,
+            branch=head_branch,
+            assessment=assessment,
+            reasons=assessment["block_reasons"],
+        )
+
+    # #687: active ownership protection (sessions/leases/worktree bindings).
+    # Do not rely only on the caller worktree living under branches/.
+    ownership_bundle = _collect_branch_ownership_records(
+        remote=remote,
+        host=h,
+        org=o,
+        repo=r,
+        branch=head_branch,
+        pr_number=pr_number,
+        project_root=PROJECT_ROOT,
+        auth=auth,
+        base_api=base,
+    )
+    ownership_records = ownership_bundle.get("records") or []
+    if ownership_bundle.get("inventory_error"):
+        # O1: control-plane / ownership inventory failure fails closed.
+        ownership_records = list(ownership_records) + [
+            {
+                "category": branch_cleanup_guard.OWNERSHIP_CATEGORY_INVENTORY_ERROR,
+                "status": "unknown",
+                "remote": remote,
+                "host": h,
+                "org": o,
+                "repo": r,
+                "branch": head_branch,
+                "reclaim_allowed": False,
+                "role": "inventory",
+            }
+        ]
+    ownership = branch_cleanup_guard.assess_active_branch_ownership(
+        remote=remote,
+        org=o,
+        repo=r,
+        branch=head_branch,
+        host=h,
+        records=ownership_records,
+    )
+    if ownership.get("block"):
+        return branch_cleanup_guard.cleanup_result_envelope(
+            success=False,
+            performed=False,
+            delete_acknowledged=False,
+            verified_absent=False,
+            pr_number=pr_number,
+            branch=head_branch,
+            assessment=assessment,
+            ownership={
+                "block": True,
+                "blocking_categories": ownership.get("blocking_categories") or [],
+                "reasons": ownership.get("reasons") or [],
+                "blocker_kind": ownership.get("blocker_kind"),
+                "checked": True,
+            },
+            reasons=ownership.get("reasons")
+            or ["active ownership protects the target branch"],
+            blocker_kind="active_branch_ownership",
+        )
 
     import urllib.parse
 
     encoded_branch = urllib.parse.quote(head_branch, safe="")
     url = f"{base}/branches/{encoded_branch}"
+    request_metadata = {
+        "branch": head_branch,
+        "required_permission": "gitea.branch.delete",
+        "cleanup_path": "gitea_cleanup_merged_pr_branch",
+        "ownership_checked": True,
+        "ownership_blocking_categories": [],
+    }
     with _audited(
         "cleanup_merged_pr_branch",
         host=h,
@@ -6215,36 +8056,416 @@ def gitea_cleanup_merged_pr_branch(
         repo=r,
         pr_number=pr_number,
         target_branch=head_branch,
-        request_metadata={
-            "branch": head_branch,
-            "required_permission": "gitea.branch.delete",
-            "cleanup_path": "gitea_cleanup_merged_pr_branch",
-        },
+        request_metadata=request_metadata,
     ):
         api_request("DELETE", url, auth)
-    return {
-        "success": True,
-        "performed": True,
-        "pr_number": pr_number,
-        "branch": head_branch,
-        "message": f"Merged PR #{pr_number} source branch '{head_branch}' deleted.",
-        "assessment": assessment,
+
+    # #687: authoritative post-delete readback. DELETE success alone is not
+    # enough — only branch-scoped not-found proves deletion (R1).
+    readback = _probe_remote_branch(h, o, r, auth, head_branch)
+    readback_assessment = branch_cleanup_guard.assess_post_delete_readback(readback)
+    verified_absent = bool(readback_assessment.get("verified_absent"))
+    request_metadata["post_delete_readback"] = {
+        "status": (readback_assessment.get("readback") or {}).get("status"),
+        "verified_absent": verified_absent,
+        "error_class": (readback_assessment.get("readback") or {}).get(
+            "error_class"
+        ),
+        "not_found_scope": (readback_assessment.get("readback") or {}).get(
+            "not_found_scope"
+        ),
     }
+    if gitea_audit.audit_enabled():
+        _audit(
+            "cleanup_merged_pr_branch_readback",
+            host=h,
+            remote=remote,
+            org=o,
+            repo=r,
+            result=(
+                gitea_audit.SUCCEEDED
+                if readback_assessment.get("ok")
+                else gitea_audit.FAILED
+            ),
+            reason="; ".join(readback_assessment.get("reasons") or []) or None,
+            request_metadata=request_metadata,
+            pr_number=pr_number,
+            target_branch=head_branch,
+        )
+
+    if not readback_assessment.get("ok"):
+        return branch_cleanup_guard.cleanup_result_envelope(
+            success=False,
+            performed=True,
+            delete_acknowledged=True,
+            verified_absent=False,
+            pr_number=pr_number,
+            branch=head_branch,
+            assessment=assessment,
+            ownership={
+                "block": False,
+                "blocking_categories": [],
+                "checked": True,
+            },
+            readback=readback_assessment.get("readback"),
+            reasons=readback_assessment.get("reasons")
+            or ["post-delete branch readback could not verify deletion"],
+            blocker_kind=readback_assessment.get("blocker_kind")
+            or "post_delete_readback_failed",
+            message=(
+                f"DELETE accepted for '{head_branch}' but post-delete readback "
+                "did not verify absence"
+            ),
+        )
+
+    return branch_cleanup_guard.cleanup_result_envelope(
+        success=True,
+        performed=True,
+        delete_acknowledged=True,
+        verified_absent=True,
+        pr_number=pr_number,
+        branch=head_branch,
+        message=(
+            f"Merged PR #{pr_number} source branch '{head_branch}' deleted "
+            "and verified absent via branch-scoped post-delete readback."
+        ),
+        assessment=assessment,
+        ownership={
+            "block": False,
+            "blocking_categories": [],
+            "checked": True,
+        },
+        readback=readback_assessment.get("readback"),
+    )
 
 
-def _remote_branch_exists(h: str, o: str, r: str, auth: str, branch: str) -> bool:
+def _probe_remote_branch(
+    h: str, o: str, r: str, auth: str, branch: str
+) -> dict:
+    """GET a remote branch and return a secret-free structured readback.
+
+    R1: On HTTP 404, re-probe the repository endpoint. Only when the repo is
+    still reachable is the 404 treated as branch-scoped absence. Generic,
+    repository-scoped, or host-level 404 never sets verified_absent.
+    """
     import urllib.parse
 
     encoded = urllib.parse.quote(branch, safe="")
     url = f"{repo_api_url(h, o, r)}/branches/{encoded}"
     try:
         api_request("GET", url, auth)
-        return True
+        return branch_cleanup_guard.classify_branch_readback_http_status(200)
     except Exception as exc:
-        message = str(exc).lower()
-        if "404" in message or "not found" in message:
-            return False
-        raise
+        status = branch_cleanup_guard._extract_http_status(exc)
+        if status != 404:
+            return branch_cleanup_guard.classify_branch_readback_exception(exc)
+
+        # Distinguish branch vs repository/host 404 via repo reachability.
+        repo_url = repo_api_url(h, o, r)
+        try:
+            api_request("GET", repo_url, auth)
+            # Repo reachable → branch-scoped not-found.
+            return branch_cleanup_guard.classify_branch_readback_http_status(
+                404,
+                not_found_scope=branch_cleanup_guard.NOT_FOUND_SCOPE_BRANCH,
+            )
+        except Exception as repo_exc:
+            repo_status = branch_cleanup_guard._extract_http_status(repo_exc)
+            if repo_status == 404:
+                return branch_cleanup_guard.classify_branch_readback_http_status(
+                    404,
+                    not_found_scope=branch_cleanup_guard.NOT_FOUND_SCOPE_REPOSITORY,
+                )
+            if repo_status in (401, 407):
+                return branch_cleanup_guard.classify_branch_readback_http_status(
+                    401
+                )
+            if repo_status == 403:
+                return branch_cleanup_guard.classify_branch_readback_http_status(
+                    403
+                )
+            # Host/transport/unknown: not branch-verified.
+            return branch_cleanup_guard.classify_branch_readback_http_status(
+                404,
+                not_found_scope=branch_cleanup_guard.NOT_FOUND_SCOPE_UNKNOWN,
+            )
+
+
+def _remote_branch_exists(h: str, o: str, r: str, auth: str, branch: str) -> bool:
+    """True when the remote branch exists; False on authoritative branch 404.
+
+    Authentication, authorization, transport, and ambiguous 404 failures are
+    raised rather than treated as absence.
+    """
+    probe = _probe_remote_branch(h, o, r, auth, branch)
+    status = probe.get("status")
+    if (
+        status == branch_cleanup_guard.READBACK_NOT_FOUND
+        and probe.get("verified_absent")
+    ):
+        return False
+    if status == branch_cleanup_guard.READBACK_EXISTS:
+        return True
+    error_class = probe.get("error_class") or "unexpected"
+    raise RuntimeError(
+        f"remote branch probe failed ({error_class}/{status})"
+    )
+
+
+def _collect_branch_ownership_records(
+    *,
+    remote: str,
+    host: str,
+    org: str,
+    repo: str,
+    branch: str,
+    pr_number: int | None,
+    project_root: str,
+    auth: str | None = None,
+    base_api: str | None = None,
+) -> dict:
+    """Gather canonical ownership records for *branch* (secret-free).
+
+    Sources:
+    - author issue locks (task-session / lease files)
+    - control-plane leases (author/reviewer/merger/controller/reconciler)
+    - comment-backed active reviewer leases (O3)
+    - local worktree bindings checked out to the branch
+
+    Returns ``{"records": [...], "inventory_error": bool}``. Control-plane
+    inventory errors set inventory_error=True so callers fail closed (O1).
+    """
+    records: list[dict] = []
+    inventory_error = False
+    target_branch = (branch or "").strip()
+    if not target_branch:
+        return {"records": records, "inventory_error": False}
+
+    host_n = branch_cleanup_guard.normalize_host(host)
+
+    def _base_rec(**kwargs):
+        rec = {
+            "remote": remote,
+            "host": host_n or host,
+            "org": org,
+            "repo": repo,
+            "branch": target_branch,
+        }
+        rec.update(kwargs)
+        return rec
+
+    # --- Author issue locks (session + lease) ---
+    try:
+        for path in issue_lock_store.iter_lock_files():
+            lock = issue_lock_store.read_lock_file(path)
+            if not isinstance(lock, dict):
+                continue
+            if (
+                str(lock.get("remote") or "") != str(remote)
+                or str(lock.get("org") or "") != str(org)
+                or str(lock.get("repo") or "") != str(repo)
+            ):
+                continue
+            # Host identity when present on the lock
+            lock_host = branch_cleanup_guard.normalize_host(
+                lock.get("host") or lock.get("host_name")
+            )
+            if host_n and lock_host and host_n != lock_host:
+                continue
+            if str(lock.get("branch_name") or "").strip() != target_branch:
+                continue
+            freshness = issue_lock_store.assess_lock_freshness(lock)
+            reclaim = issue_lock_store.assess_expired_lock_reclaim(lock)
+            status = str(freshness.get("status") or "unknown")
+            if freshness.get("live"):
+                status = "active"
+            records.append(
+                _base_rec(
+                    category=branch_cleanup_guard.OWNERSHIP_CATEGORY_AUTHOR_LEASE,
+                    status=status,
+                    reclaim_allowed=bool(reclaim.get("reclaim_allowed")),
+                    role="author",
+                )
+            )
+            if freshness.get("live"):
+                records.append(
+                    _base_rec(
+                        category=(
+                            branch_cleanup_guard.OWNERSHIP_CATEGORY_AUTHOR_SESSION
+                        ),
+                        status="active",
+                        reclaim_allowed=False,
+                        role="author",
+                    )
+                )
+    except Exception:
+        inventory_error = True
+        records.append(
+            _base_rec(
+                category=branch_cleanup_guard.OWNERSHIP_CATEGORY_AUTHOR_LEASE,
+                status="unknown",
+                reclaim_allowed=False,
+                role="author",
+            )
+        )
+
+    # --- Control-plane leases (role-tagged) ---
+    try:
+        db = None
+        if hasattr(control_plane_db, "get_db"):
+            try:
+                db = control_plane_db.get_db()
+            except Exception:
+                db = None
+        if db is None and hasattr(control_plane_db, "ControlPlaneDB"):
+            try:
+                db = control_plane_db.ControlPlaneDB()
+            except Exception:
+                db = None
+                inventory_error = True
+        if db is None:
+            # O1: unavailable control-plane inventory fails closed.
+            inventory_error = True
+        else:
+            listed = lease_lifecycle.list_active_leases(
+                db,
+                remote=remote,
+                org=org,
+                repo=repo,
+                include_non_active=True,
+                limit=200,
+            )
+            for lease in listed.get("leases") or []:
+                work_kind = str(lease.get("work_kind") or "")
+                work_number = lease.get("work_number")
+                lease_branch = str(
+                    lease.get("branch")
+                    or lease.get("branch_name")
+                    or ""
+                ).strip()
+                matches_branch = lease_branch == target_branch
+                matches_pr = (
+                    work_kind == "pr"
+                    and pr_number is not None
+                    and int(work_number or 0) == int(pr_number)
+                )
+                if not (matches_branch or matches_pr):
+                    continue
+                if matches_pr and not lease_branch:
+                    lease_branch = target_branch
+                if lease_branch != target_branch:
+                    continue
+                lease_host = branch_cleanup_guard.normalize_host(
+                    lease.get("host") or lease.get("host_name")
+                )
+                if host_n and lease_host and host_n != lease_host:
+                    continue
+                fr = lease.get("freshness") or lease_lifecycle.classify_lease_freshness(
+                    lease
+                )
+                freshness_status = str(
+                    (fr.get("freshness") if isinstance(fr, dict) else None)
+                    or lease.get("status")
+                    or "unknown"
+                )
+                role = str(lease.get("role") or "unknown")
+                category = branch_cleanup_guard.ownership_category_for_role(role)
+                # O2: expired never auto-receives reclaim_allowed=True.
+                if freshness_status == "active":
+                    status = "active"
+                    reclaim_allowed = False
+                elif freshness_status in {"released", "abandoned"}:
+                    status = freshness_status
+                    reclaim_allowed = True
+                elif freshness_status == "expired" or (
+                    isinstance(fr, dict) and fr.get("expired_by_time")
+                ):
+                    status = "expired"
+                    reclaim_allowed = False  # O2 fail closed
+                else:
+                    status = freshness_status
+                    reclaim_allowed = False
+                records.append(
+                    _base_rec(
+                        category=category,
+                        status=status,
+                        reclaim_allowed=reclaim_allowed,
+                        role=role,
+                        host=lease_host or host_n or host,
+                    )
+                )
+    except Exception:
+        # O1: fail closed on control-plane inventory errors.
+        inventory_error = True
+        records.append(
+            _base_rec(
+                category=branch_cleanup_guard.OWNERSHIP_CATEGORY_INVENTORY_ERROR,
+                status="unknown",
+                reclaim_allowed=False,
+                role="control_plane",
+            )
+        )
+
+    # --- O3: comment-backed active reviewer leases ---
+    if pr_number is not None and auth and base_api:
+        try:
+            comments = api_get_all(
+                f"{base_api}/issues/{int(pr_number)}/comments", auth
+            )
+            active = reviewer_pr_lease.find_active_reviewer_lease(
+                comments, pr_number=int(pr_number)
+            )
+            if active:
+                records.append(
+                    _base_rec(
+                        category=(
+                            branch_cleanup_guard.OWNERSHIP_CATEGORY_REVIEWER_LEASE
+                        ),
+                        status="active",
+                        reclaim_allowed=False,
+                        role="reviewer",
+                    )
+                )
+        except Exception:
+            inventory_error = True
+            records.append(
+                _base_rec(
+                    category=branch_cleanup_guard.OWNERSHIP_CATEGORY_INVENTORY_ERROR,
+                    status="unknown",
+                    reclaim_allowed=False,
+                    role="reviewer_comment_lease",
+                )
+            )
+
+    # --- Worktree bindings checked out to the target branch ---
+    try:
+        for entry in worktree_cleanup_audit.list_worktrees(project_root):
+            wt_branch = str(entry.get("branch") or "").strip()
+            if wt_branch != target_branch:
+                continue
+            records.append(
+                _base_rec(
+                    category=(
+                        branch_cleanup_guard.OWNERSHIP_CATEGORY_WORKTREE_BINDING
+                    ),
+                    status="active",
+                    reclaim_allowed=False,
+                    role="worktree",
+                )
+            )
+    except Exception:
+        inventory_error = True
+        records.append(
+            _base_rec(
+                category=branch_cleanup_guard.OWNERSHIP_CATEGORY_WORKTREE_BINDING,
+                status="unknown",
+                reclaim_allowed=False,
+                role="worktree",
+            )
+        )
+
+    return {"records": records, "inventory_error": inventory_error}
+
 
 
 @mcp.tool()
@@ -6431,6 +8652,66 @@ def gitea_reconcile_merged_cleanups(
         if remote_assessment.get("safe_to_delete_remote"):
             import urllib.parse
 
+            pr_num = entry.get("pr_number")
+            try:
+                pr_num_int = int(pr_num) if pr_num is not None else None
+            except (TypeError, ValueError):
+                pr_num_int = None
+            ownership_bundle = _collect_branch_ownership_records(
+                remote=remote,
+                host=h,
+                org=o,
+                repo=r,
+                branch=head_branch,
+                pr_number=pr_num_int,
+                project_root=PROJECT_ROOT,
+                auth=auth,
+                base_api=base,
+            )
+            ownership_records = list(ownership_bundle.get("records") or [])
+            if ownership_bundle.get("inventory_error"):
+                ownership_records.append(
+                    {
+                        "category": (
+                            branch_cleanup_guard.OWNERSHIP_CATEGORY_INVENTORY_ERROR
+                        ),
+                        "status": "unknown",
+                        "remote": remote,
+                        "host": h,
+                        "org": o,
+                        "repo": r,
+                        "branch": head_branch,
+                        "reclaim_allowed": False,
+                        "role": "inventory",
+                    }
+                )
+            ownership = branch_cleanup_guard.assess_active_branch_ownership(
+                remote=remote,
+                org=o,
+                repo=r,
+                branch=head_branch,
+                host=h,
+                records=ownership_records,
+            )
+            if ownership.get("block"):
+                actions.append(
+                    {
+                        "action": "delete_remote_branch",
+                        "branch": head_branch,
+                        "success": False,
+                        "performed": False,
+                        "delete_acknowledged": False,
+                        "verified_absent": False,
+                        "blocker_kind": "active_branch_ownership",
+                        "reasons": ownership.get("reasons") or [],
+                        "blocking_categories": ownership.get(
+                            "blocking_categories"
+                        )
+                        or [],
+                    }
+                )
+                continue
+
             encoded = urllib.parse.quote(head_branch, safe="")
             url = f"{base}/branches/{encoded}"
             with _audited(
@@ -6440,14 +8721,28 @@ def gitea_reconcile_merged_cleanups(
                 org=o,
                 repo=r,
                 target_branch=head_branch,
-                request_metadata={"branch": head_branch, "source": "reconcile_merged_cleanups"},
+                request_metadata={
+                    "branch": head_branch,
+                    "source": "reconcile_merged_cleanups",
+                    "ownership_checked": True,
+                },
             ):
                 api_request("DELETE", url, auth)
+            readback = _probe_remote_branch(h, o, r, auth, head_branch)
+            readback_assessment = branch_cleanup_guard.assess_post_delete_readback(
+                readback
+            )
+            verified = bool(readback_assessment.get("verified_absent"))
             actions.append(
                 {
                     "action": "delete_remote_branch",
                     "branch": head_branch,
-                    "success": True,
+                    "success": bool(readback_assessment.get("ok")),
+                    "performed": True,
+                    "delete_acknowledged": True,
+                    "verified_absent": verified,
+                    "readback": readback_assessment.get("readback"),
+                    "reasons": readback_assessment.get("reasons") or [],
                 }
             )
 
@@ -7503,6 +9798,7 @@ def _try_auto_switch_for_operation(op: str, host: str | None = None) -> bool:
                 if tok:
                     gitea_config._active_profile_override = p_name
                     _IDENTITY_CACHE.clear()
+                    _ACTOR_IDENTITY_CACHE.clear()
                     return True
             except Exception:
                 pass
@@ -10654,6 +12950,7 @@ def gitea_activate_profile(
     # 3. Clear identity cache to force a fresh verification
     if h:
         _IDENTITY_CACHE.pop(h, None)
+        _ACTOR_IDENTITY_CACHE.pop(h, None)
 
     # 4. Resolve fresh identity
     after_profile = get_profile()["profile_name"]
@@ -11706,6 +14003,8 @@ def gitea_resolve_task_capability(
         "gitea_commit_files",
         "address_pr_change_requests",
         "delete_branch",
+        "cleanup_merged_pr_branch",
+        "reconciliation_cleanup",
         "work_issue",
         "work-issue",
     }
@@ -12861,14 +15160,251 @@ def gitea_reclaim_expired_workflow_lease(
         }
 
 
+@mcp.tool()
+def gitea_quarantine_contaminated_review(
+    pr_number: int,
+    review_id: int,
+    confirmation: str,
+    reason: str,
+    reviewed_head_sha: str,
+    incident_issue: int = 695,
+    forensic_comment_ids: list[int] | None = None,
+    remote: str = "dadeschools",
+    host: str | None = None,
+    org: str | None = None,
+    repo: str | None = None,
+    post_audit_comment: bool = True,
+) -> dict:
+    """Controller quarantine of a contaminated formal review (#695 AC8).
+
+    Writes a durable quarantine record that live feedback / eligibility /
+    merge gates honor by ``review_id``. Forensic Gitea review objects and
+    historical comments are retained (never deleted).
+
+    **Native transport only.** Untrusted local imports / offline scripts
+    cannot create quarantine records. Confirmation must equal exactly
+    ``QUARANTINE CONTAMINATED REVIEW <review_id> PR <pr_number>``.
+
+    Restricted to reconciler / merger / controller profiles (not author or
+    the contaminated reviewer acting alone). Does not auto-apply to review
+    427 until an independent adversarial reviewer and controller deployment
+    of this tooling have completed.
+    """
+    # Fail closed outside production native MCP before any mutation assessment.
+    # Test-mode bootstrap must never reach this production mutation endpoint (#695).
+    try:
+        mcp_daemon_guard.assert_production_mutation_runtime(
+            "gitea_quarantine_contaminated_review"
+        )
+    except mcp_daemon_guard.UnsanctionedRuntimeError as exc:
+        return {
+            "success": False,
+            "quarantined": False,
+            "reasons": [str(exc)],
+            "native_runtime": mcp_daemon_guard.native_runtime_status(),
+        }
+
+    assessment = review_quarantine.assess_quarantine_write(
+        confirmation=confirmation,
+        pr_number=pr_number,
+        review_id=review_id,
+        reason=reason,
+        native_required=True,
+    )
+    if not assessment.get("allowed"):
+        return {
+            "success": False,
+            "quarantined": False,
+            "reasons": assessment.get("reasons") or [],
+            "expected_confirmation": assessment.get("expected_confirmation"),
+            "native_runtime": mcp_daemon_guard.native_runtime_status(),
+        }
+
+    profile = get_profile()
+    profile_name = (profile.get("profile_name") or "").strip()
+    role = _actual_profile_role()
+    allowed_roles = {"reconciler", "merger"}
+    controller_named = "controller" in profile_name.lower()
+    if role not in allowed_roles and not controller_named:
+        return {
+            "success": False,
+            "quarantined": False,
+            "reasons": [
+                f"quarantine requires reconciler/merger/controller profile "
+                f"(active role={role!r}, profile={profile_name!r}); "
+                "author/reviewer-only sessions cannot quarantine (#695)"
+            ],
+            "native_runtime": mcp_daemon_guard.native_runtime_status(),
+        }
+
+    comment_block = _profile_operation_gate("gitea.pr.comment")
+    if comment_block and post_audit_comment:
+        return {
+            "success": False,
+            "quarantined": False,
+            "reasons": comment_block,
+            "permission_report": _permission_block_report("gitea.pr.comment"),
+        }
+    read_block = _profile_operation_gate("gitea.read")
+    if read_block:
+        return {
+            "success": False,
+            "quarantined": False,
+            "reasons": read_block,
+            "permission_report": _permission_block_report("gitea.read"),
+        }
+
+    h, o, r = _resolve(remote, host, org, repo)
+    auth = _auth(h)
+    try:
+        identity = _authenticated_username(h) or profile.get("username") or ""
+    except Exception:
+        identity = profile.get("username") or ""
+
+    # Verify review exists (forensic retention — do not dismiss via Gitea API).
+    try:
+        reviews = (
+            api_request(
+                "GET",
+                f"{repo_api_url(h, o, r)}/pulls/{pr_number}/reviews",
+                auth,
+            )
+            or []
+        )
+    except Exception as exc:  # noqa: BLE001
+        return {
+            "success": False,
+            "quarantined": False,
+            "reasons": [
+                f"could not list PR reviews before quarantine (fail closed): "
+                f"{_redact(str(exc))}"
+            ],
+        }
+    match = None
+    for rv in reviews:
+        if int(rv.get("id") or 0) == int(review_id):
+            match = rv
+            break
+    if match is None:
+        return {
+            "success": False,
+            "quarantined": False,
+            "reasons": [
+                f"review_id {review_id} not found on PR #{pr_number} "
+                f"(fail closed; refuse quarantine of missing review)"
+            ],
+        }
+    live_head = (match.get("commit_id") or "").strip().lower()
+    want_head = (reviewed_head_sha or "").strip().lower()
+    if want_head and live_head and want_head != live_head:
+        return {
+            "success": False,
+            "quarantined": False,
+            "reasons": [
+                f"reviewed_head_sha {want_head[:12]}… does not match review "
+                f"commit_id {live_head[:12]}… (fail closed, #695)"
+            ],
+        }
+
+    record = review_quarantine.build_quarantine_record(
+        remote=remote,
+        org=o,
+        repo=r,
+        pr_number=pr_number,
+        review_id=review_id,
+        reviewed_head_sha=want_head or live_head,
+        reason=reason,
+        actor_username=identity,
+        profile_name=profile_name,
+        incident_issue=incident_issue,
+        forensic_comment_ids=forensic_comment_ids,
+    )
+    try:
+        written = review_quarantine.write_quarantine_record(record)
+    except mcp_daemon_guard.UnsanctionedRuntimeError as exc:
+        return {
+            "success": False,
+            "quarantined": False,
+            "reasons": [str(exc)],
+            "native_runtime": mcp_daemon_guard.native_runtime_status(),
+        }
+    except OSError as exc:
+        return {
+            "success": False,
+            "quarantined": False,
+            "reasons": [f"quarantine persist failed: {_redact(str(exc))}"],
+        }
+
+    audit_comment_id = None
+    if post_audit_comment:
+        body = review_quarantine.format_quarantine_audit_comment(record)
+        try:
+            with _audited(
+                "comment_pr",
+                host=h,
+                remote=remote,
+                org=o,
+                repo=r,
+                pr_number=pr_number,
+                request_metadata={"source": "quarantine_contaminated_review"},
+            ):
+                posted = api_request(
+                    "POST",
+                    f"{repo_api_url(h, o, r)}/issues/{pr_number}/comments",
+                    auth,
+                    {"body": body},
+                )
+            if isinstance(posted, dict):
+                audit_comment_id = posted.get("id")
+        except Exception as exc:  # noqa: BLE001
+            return {
+                "success": True,
+                "quarantined": True,
+                "review_id": review_id,
+                "pr_number": pr_number,
+                "path": written.get("path"),
+                "audit_comment_id": None,
+                "warnings": [
+                    f"quarantine written but audit comment failed: "
+                    f"{_redact(str(exc))}"
+                ],
+                "record": {
+                    k: v
+                    for k, v in record.items()
+                    if k != "native_provenance"
+                } | {
+                    "native_provenance": record.get("native_provenance"),
+                },
+                "native_runtime": mcp_daemon_guard.native_runtime_status(),
+            }
+
+    return {
+        "success": True,
+        "quarantined": True,
+        "review_id": review_id,
+        "pr_number": pr_number,
+        "path": written.get("path"),
+        "audit_comment_id": audit_comment_id,
+        "retain_forensic_evidence": True,
+        "merge_authorization": "void",
+        "record": record,
+        "native_runtime": mcp_daemon_guard.native_runtime_status(),
+        "reasons": [
+            f"review_id {review_id} quarantined for PR #{pr_number}; "
+            "merge authorization void; forensic evidence retained (#695)"
+        ],
+    }
+
+
 # ── Entry point ───────────────────────────────────────────────────────────────
 
 if __name__ == "__main__":
-    # #558: mark this process as the official MCP daemon before any tool
-    # dispatch so direct shell imports cannot reuse mutation/auth paths.
-    import mcp_daemon_guard
-
+    # #558 / #695: claim the resolved canonical entrypoint, then bind the live
+    # native MCP transport lifecycle before any tool dispatch. Env vars,
+    # basename-only stack frames, and import-only launch cannot reconstruct
+    # native transport; offline imports / standalone scripts fail closed.
     mcp_daemon_guard.mark_sanctioned_daemon()
+    mcp_daemon_guard.bind_native_mcp_transport(transport="stdio")
     # Lock this session's launch profile into the environment so child CLI
     # processes (e.g. review_pr.py) can detect and refuse profile
     # side-channel overrides (#199).
diff --git a/irrecoverable_provenance.py b/irrecoverable_provenance.py
new file mode 100644
index 0000000..7d5ca76
--- /dev/null
+++ b/irrecoverable_provenance.py
@@ -0,0 +1,1722 @@
+"""Server-side irrecoverable decision-lock provenance authorization (#709 AC5).
+
+Authorization is **not** a caller-supplied Boolean. A durable, non-forgeable
+authorization artifact must be minted under production native MCP transport
+(or pytest) with a dedicated mutation capability, live head binding, and
+validated incident evidence. Merger consumption is fail-closed and resolves
+only the historical-provenance blocker — never normal approval, lease,
+mergeability, anti-stomp, or workspace gates.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import hmac
+import json
+import os
+import re
+import uuid
+from datetime import datetime, timedelta, timezone
+from typing import Any
+
+import mcp_daemon_guard
+import mcp_session_state
+from stale_review_decision_lock import heads_equal, normalize_head_sha
+
+# Dedicated mutation capability (#709 review 434 F1).
+CAPABILITY_IRRECOVERABLE_RECOVERY = "gitea.decision_lock.irrecoverable_recovery"
+
+KIND_AUTH = "irrecoverable_provenance_authorization"
+KIND_RECOVERY = mcp_session_state.KIND_IRRECOVERABLE_DECISION_PROVENANCE
+
+CONFIRMATION_PREFIX = "IRRECOVERABLE DECISION PROVENANCE PR"
+# Canonical incident-comment marker (#709 review 435 F5).
+INCIDENT_MARKER = "IRRECOVERABLE DECISION PROVENANCE INCIDENT"
+
+# #709 F7 (review 438): strictly canonical incident evidence. The digest binds
+# every security-relevant field, so evidence cannot be replayed or substituted
+# across repositories, PRs, decision locks, heads, actors, or recovery actions.
+INCIDENT_SCHEMA_VERSION = "2"
+RECOVERY_ACTION_IRRECOVERABLE_PROVENANCE = "irrecoverable_decision_lock_provenance"
+SUPPORTED_RECOVERY_ACTIONS = frozenset({RECOVERY_ACTION_IRRECOVERABLE_PROVENANCE})
+INCIDENT_FIELD_ORDER = (
+    "schema_version",
+    "remote",
+    "org",
+    "repo",
+    "pr_number",
+    "decision_lock_id",
+    "destroyed_subject",
+    "recovery_action",
+    "recorded_head_sha",
+    "expected_head_sha",
+    "incident_issue",
+    "evidence_author_id",
+    "evidence_author_login",
+    "mint_actor_id",
+    "mint_actor_login",
+    "key_version",
+    "nonce",
+    "issued_at",
+)
+INCIDENT_DIGEST_FIELD = "content_digest"
+AUTH_TTL_HOURS = 24.0
+RECORD_TYPE = "irrecoverable_decision_provenance"
+AUTH_TYPE = "irrecoverable_provenance_authorization"
+
+# Durable HMAC key origin (#709 review 435 F4). Never generate an ephemeral
+# production key — mint/verify across reconciler/merger processes and restarts
+# requires a shared secret from env (or pytest constant / explicit env override).
+ENV_AUTH_HMAC_KEY = "GITEA_IRRECOVERABLE_AUTH_HMAC_KEY"
+ENV_AUTH_HMAC_KEY_VERSION = "GITEA_IRRECOVERABLE_AUTH_HMAC_KEY_VERSION"
+DEFAULT_KEY_VERSION = "v1"
+_PYTEST_AUTH_SECRET = b"pytest-irrecoverable-auth-v1"
+_PYTEST_KEY_VERSION = "pytest-v1"
+
+# #709 F6 (review 438): key version is part of the authenticated data and must
+# be present exactly once, well-formed, and equal to the configured active
+# version. There is deliberately no legacy fallback for versionless artifacts.
+KEY_VERSION_RE = re.compile(r"^[A-Za-z0-9._-]{1,64}$")
+KEY_VERSION_FIELD = "key_version"
+# Any of these aliases anywhere in the artifact counts as a key-version field;
+# more than one occurrence is a duplicate and fails closed even when the values
+# are identical.
+_KEY_VERSION_ALIASES = (
+    "key_version",
+    "keyVersion",
+    "key-version",
+    "auth_key_version",
+)
+
+_PROCESS_AUTH_SECRET: bytes | None = None
+_PROCESS_AUTH_KEY_VERSION: str | None = None
+_PROCESS_AUTH_SECRET_SOURCE: str | None = None
+
+
+class AuthSecretError(RuntimeError):
+    """Raised when the durable HMAC signing key cannot be resolved (fail closed)."""
+
+
+def _now() -> datetime:
+    return datetime.now(timezone.utc)
+
+
+def _now_iso() -> str:
+    return _now().isoformat()
+
+
+def _decode_key_material(raw: str) -> bytes:
+    """Decode operator-supplied key material (hex, base64, or utf-8 literal)."""
+    text = (raw or "").strip()
+    if not text:
+        raise AuthSecretError("empty HMAC key material (fail closed, #709 F4)")
+    # Prefer hex (64 chars = 32 bytes).
+    if len(text) >= 32 and all(c in "0123456789abcdefABCDEF" for c in text):
+        try:
+            if len(text) % 2 == 0:
+                decoded = bytes.fromhex(text)
+                if len(decoded) >= 16:
+                    return decoded
+        except ValueError:
+            pass
+    # base64
+    try:
+        import base64
+
+        decoded = base64.b64decode(text, validate=True)
+        if len(decoded) >= 16:
+            return decoded
+    except Exception:
+        pass
+    # utf-8 literal (min 16 chars after strip)
+    encoded = text.encode("utf-8")
+    if len(encoded) < 16:
+        raise AuthSecretError(
+            "HMAC key material too short (need >=16 bytes; fail closed, #709 F4)"
+        )
+    return encoded
+
+
+def reset_process_auth_secret_for_tests() -> None:
+    """Clear cached HMAC key (tests only)."""
+    global _PROCESS_AUTH_SECRET, _PROCESS_AUTH_KEY_VERSION, _PROCESS_AUTH_SECRET_SOURCE
+    _PROCESS_AUTH_SECRET = None
+    _PROCESS_AUTH_KEY_VERSION = None
+    _PROCESS_AUTH_SECRET_SOURCE = None
+
+
+def _validate_key_version_text(value: Any, *, source: str) -> tuple[str, list[str]]:
+    """Validate a key-version string. Never echoes key material — versions only."""
+    if isinstance(value, bool) or not isinstance(value, str):
+        return "", [
+            f"{source} key version is malformed (must be a string; fail closed, #709 F6)"
+        ]
+    text = value.strip()
+    if not text:
+        return "", [f"{source} key version is empty (fail closed, #709 F6)"]
+    if value != text:
+        return "", [
+            f"{source} key version has surrounding whitespace (fail closed, #709 F6)"
+        ]
+    if not KEY_VERSION_RE.match(text):
+        return "", [
+            f"{source} key version is malformed (allowed charset A-Za-z0-9._-, "
+            "1-64 chars; fail closed, #709 F6)"
+        ]
+    return text, []
+
+
+def auth_key_version() -> str:
+    """Return the active configured signing-key version (never secret material)."""
+    _process_secret()  # ensure version is resolved with the secret
+    version = _PROCESS_AUTH_KEY_VERSION or ""
+    if not version:
+        raise AuthSecretError(
+            "active HMAC key version is unresolved (fail closed, #709 F6 review 438)"
+        )
+    return version
+
+
+def supported_key_versions() -> tuple[str, ...]:
+    """Versions accepted for verification.
+
+    Exactly one version — the configured active one — is honored. Rotation is
+    performed by changing ``GITEA_IRRECOVERABLE_AUTH_HMAC_KEY_VERSION`` (and the
+    key); artifacts minted under a superseded version stop verifying, which is
+    the intended fail-closed rotation behavior (#709 F6 review 438).
+    """
+    return (auth_key_version(),)
+
+
+def extract_artifact_key_version(auth: dict[str, Any] | None) -> dict[str, Any]:
+    """Require exactly one nonempty, well-formed key-version field (#709 F6).
+
+    Missing, empty, malformed, or duplicated (even identical-valued) key-version
+    fields fail closed. Versionless artifacts are never accepted — there is no
+    legacy fallback.
+    """
+    if not isinstance(auth, dict):
+        return {
+            "valid": False,
+            "key_version": None,
+            "reasons": ["authorization artifact missing (fail closed)"],
+        }
+
+    containers: list[tuple[str, dict[str, Any]]] = [("artifact", auth)]
+    for nested in ("native_provenance", "scope"):
+        value = auth.get(nested)
+        if isinstance(value, dict):
+            containers.append((nested, value))
+
+    seen: list[tuple[str, Any]] = []
+    for container_name, container in containers:
+        for alias in _KEY_VERSION_ALIASES:
+            if alias in container:
+                seen.append((f"{container_name}.{alias}", container[alias]))
+
+    if not seen:
+        return {
+            "valid": False,
+            "key_version": None,
+            "reasons": [
+                "authorization is missing key_version; versionless artifacts are "
+                "never accepted (no legacy fallback; fail closed, #709 F6 review 438)"
+            ],
+        }
+    if len(seen) > 1:
+        names = ", ".join(sorted(name for name, _ in seen))
+        return {
+            "valid": False,
+            "key_version": None,
+            "reasons": [
+                f"authorization carries duplicate key-version fields ({names}); "
+                "exactly one is required, even when the values are identical "
+                "(fail closed, #709 F6 review 438)"
+            ],
+        }
+
+    name, raw = seen[0]
+    text, reasons = _validate_key_version_text(raw, source=f"authorization {name}")
+    if reasons:
+        return {"valid": False, "key_version": None, "reasons": reasons}
+    return {"valid": True, "key_version": text, "reasons": []}
+
+
+def assess_artifact_key_version(
+    auth: dict[str, Any] | None,
+    *,
+    expected_version: str | None = None,
+) -> dict[str, Any]:
+    """Artifact key version must exactly equal the configured active version."""
+    extracted = extract_artifact_key_version(auth)
+    if not extracted.get("valid"):
+        return extracted
+    have = str(extracted.get("key_version") or "")
+    try:
+        want = (expected_version or "").strip() or auth_key_version()
+    except AuthSecretError as exc:
+        return {
+            "valid": False,
+            "key_version": None,
+            "reasons": [
+                f"configured HMAC key version unavailable: {exc} "
+                "(fail closed, #709 F6)"
+            ],
+        }
+    if have != want:
+        return {
+            "valid": False,
+            "key_version": None,
+            "reasons": [
+                f"authorization key_version {have!r} is unknown or does not match "
+                f"the configured expected version {want!r} (fail closed, #709 F6 "
+                "review 438)"
+            ],
+        }
+    return {"valid": True, "key_version": have, "reasons": []}
+
+
+def _process_secret() -> bytes:
+    """Resolve durable HMAC key for irrecoverable auth artifacts (#709 F4).
+
+    Production (non-pytest): **requires** ``GITEA_IRRECOVERABLE_AUTH_HMAC_KEY``.
+    Silently generating an ephemeral per-process key is forbidden — that made
+    mint+verify fail across merger/reconciler processes and restarts.
+
+    Pytest: uses a fixed constant unless the env key is set (so cross-process
+    regression tests can inject a shared durable key).
+    """
+    global _PROCESS_AUTH_SECRET, _PROCESS_AUTH_KEY_VERSION, _PROCESS_AUTH_SECRET_SOURCE
+    if _PROCESS_AUTH_SECRET is not None:
+        return _PROCESS_AUTH_SECRET
+
+    env_raw = (os.environ.get(ENV_AUTH_HMAC_KEY) or "").strip()
+    env_ver = (os.environ.get(ENV_AUTH_HMAC_KEY_VERSION) or "").strip()
+    pytest = mcp_daemon_guard.is_pytest_runtime()
+
+    if env_raw:
+        secret = _decode_key_material(env_raw)
+        if not env_ver and not pytest:
+            # #709 F6 (review 438): production must configure the key version
+            # explicitly; silently defaulting it makes rotation ambiguous.
+            raise AuthSecretError(
+                f"{ENV_AUTH_HMAC_KEY_VERSION} is required for production "
+                "irrecoverable auth HMAC; an implicit default key version is "
+                "forbidden (fail closed, #709 F6 review 438)"
+            )
+        version, version_reasons = _validate_key_version_text(
+            env_ver or (_PYTEST_KEY_VERSION if pytest else ""),
+            source="configured",
+        )
+        if version_reasons:
+            raise AuthSecretError("; ".join(version_reasons))
+        _PROCESS_AUTH_SECRET = secret
+        _PROCESS_AUTH_KEY_VERSION = version
+        _PROCESS_AUTH_SECRET_SOURCE = "env"
+        return _PROCESS_AUTH_SECRET
+
+    if pytest:
+        version, version_reasons = _validate_key_version_text(
+            env_ver or _PYTEST_KEY_VERSION, source="configured"
+        )
+        if version_reasons:
+            raise AuthSecretError("; ".join(version_reasons))
+        _PROCESS_AUTH_SECRET = _PYTEST_AUTH_SECRET
+        _PROCESS_AUTH_KEY_VERSION = version
+        _PROCESS_AUTH_SECRET_SOURCE = "pytest_constant"
+        return _PROCESS_AUTH_SECRET
+
+    # Production fail-closed: do NOT call secrets.token_bytes.
+    raise AuthSecretError(
+        f"{ENV_AUTH_HMAC_KEY} is required for production irrecoverable auth HMAC; "
+        "ephemeral per-process key generation is forbidden (fail closed, #709 F4 "
+        "review 435). Configure a durable shared secret for mint+verify across "
+        "processes and restarts."
+    )
+
+
+def expected_confirmation(pr_number: int) -> str:
+    """Human intent confirmation text (not an authorization credential)."""
+    return f"{CONFIRMATION_PREFIX} {int(pr_number)}"
+
+
+def auth_state_profile_identity(
+    *,
+    remote: str,
+    org: str,
+    repo: str,
+    pr_number: int,
+    expected_head_sha: str,
+) -> str:
+    """Stable durable key segment for one exact-scope authorization."""
+    head = normalize_head_sha(expected_head_sha) or "nohead"
+    segs = [
+        KIND_AUTH,
+        mcp_session_state._sanitize_segment(remote),
+        mcp_session_state._sanitize_segment(org),
+        mcp_session_state._sanitize_segment(repo),
+        f"pr{int(pr_number)}",
+        head[:16],
+    ]
+    return "-".join(segs)
+
+
+def recovery_state_profile_identity(
+    *,
+    remote: str,
+    org: str,
+    repo: str,
+    pr_number: int,
+    expected_head_sha: str,
+) -> str:
+    head = normalize_head_sha(expected_head_sha) or "nohead"
+    segs = [
+        KIND_RECOVERY,
+        mcp_session_state._sanitize_segment(remote),
+        mcp_session_state._sanitize_segment(org),
+        mcp_session_state._sanitize_segment(repo),
+        f"pr{int(pr_number)}",
+        head[:16],
+    ]
+    return "-".join(segs)
+
+
+def _scope_payload(
+    *,
+    remote: str,
+    org: str,
+    repo: str,
+    pr_number: int,
+    expected_head_sha: str,
+    incident_issue: int,
+    incident_comment_id: int,
+    destroyed_subject: str | None,
+    issuer_username: str,
+    issuer_profile: str,
+    created_at: str,
+    expires_at: str,
+    authorization_id: str,
+) -> dict[str, Any]:
+    return {
+        "authorization_id": authorization_id,
+        "remote": remote,
+        "org": org,
+        "repo": repo,
+        "blocked_pr_number": int(pr_number),
+        "expected_head_sha": normalize_head_sha(expected_head_sha),
+        "incident_issue": int(incident_issue),
+        "incident_comment_id": int(incident_comment_id),
+        "destroyed_subject": (destroyed_subject or "").strip() or None,
+        "issuer_username": issuer_username,
+        "issuer_profile": issuer_profile,
+        "created_at": created_at,
+        "expires_at": expires_at,
+    }
+
+
+def _sign_scope(
+    scope: dict[str, Any],
+    native_provenance: dict[str, Any],
+    *,
+    key_version: str | None = None,
+) -> str:
+    """HMAC over key_version + canonical scope + native transport fingerprint.
+
+    The signing key itself is never serialized. Key *version* is bound into the
+    MAC so operators can rotate durable keys without ambiguous verification.
+    """
+    material = {
+        "key_version": (key_version or auth_key_version()),
+        "scope": scope,
+        "native": {
+            "native_mcp_transport": bool(
+                native_provenance.get("native_mcp_transport")
+            ),
+            "production_native_mcp_transport": bool(
+                native_provenance.get("production_native_mcp_transport")
+            ),
+            "token_fingerprint": native_provenance.get("token_fingerprint"),
+            "entrypoint": native_provenance.get("entrypoint"),
+            "pid": native_provenance.get("pid"),
+        },
+    }
+    blob = json.dumps(material, sort_keys=True, separators=(",", ":")).encode(
+        "utf-8"
+    )
+    return hmac.new(_process_secret(), blob, hashlib.sha256).hexdigest()
+
+
+def assess_capability_for_irrecoverable_recovery(
+    *,
+    allowed_operations: list[str] | None,
+    forbidden_operations: list[str] | None = None,
+    role_kind: str | None = None,
+    profile_name: str | None = None,
+) -> dict[str, Any]:
+    """Whether the active profile may mint/use irrecoverable recovery (#709 F5).
+
+    **Dedicated capability only.** Reconciler role / ``gitea.issue.comment``
+    equivalence is intentionally rejected so a reconciler cannot self-mint
+    recovery authority by authoring its own incident comment (#709 review 435
+    F5). Bare ``gitea.read`` is never sufficient.
+    """
+    import gitea_config
+
+    allowed = list(allowed_operations or [])
+    forbidden = list(forbidden_operations or [])
+    reasons: list[str] = []
+
+    dedicated_ok, _ = gitea_config.check_operation(
+        CAPABILITY_IRRECOVERABLE_RECOVERY, allowed, forbidden
+    )
+    if dedicated_ok:
+        return {
+            "allowed": True,
+            "capability": CAPABILITY_IRRECOVERABLE_RECOVERY,
+            "via": "dedicated_capability",
+            "reasons": [],
+        }
+
+    role = (role_kind or "").strip().lower()
+    name = (profile_name or "").strip().lower()
+    role_hint = role or name or "unknown"
+    reasons.append(
+        f"missing dedicated capability {CAPABILITY_IRRECOVERABLE_RECOVERY} "
+        f"(profile={role_hint!r}; reconciler/issue.comment equivalence is "
+        "not accepted — dedicated grant required, #709 F5 review 435; "
+        "gitea.read alone is insufficient)"
+    )
+    return {
+        "allowed": False,
+        "capability": CAPABILITY_IRRECOVERABLE_RECOVERY,
+        "via": None,
+        "reasons": reasons,
+    }
+
+
+def assess_transport_for_auth_mint() -> dict[str, Any]:
+    """Native transport required for minting non-forgeable auth artifacts."""
+    reasons: list[str] = []
+    native = mcp_daemon_guard.is_native_mcp_transport()
+    pytest = mcp_daemon_guard.is_pytest_runtime()
+    production = mcp_daemon_guard.is_production_native_mcp_transport()
+    if not native and not pytest:
+        reasons.append(
+            "irrecoverable provenance authorization requires production native "
+            "MCP transport; ordinary Python processes cannot mint acceptable "
+            "recovery authorization (#709 F1)"
+        )
+    return {
+        "allowed": not reasons,
+        "native_mcp_transport": native,
+        "production_native_mcp_transport": production,
+        "pytest": pytest,
+        "reasons": reasons,
+    }
+
+
+def incident_actor_identity(payload: dict[str, Any] | None) -> dict[str, Any]:
+    """Resolve one stable actor identity from a comment payload (#709 F7).
+
+    Uses the immutable numeric user id as the primary identity and requires the
+    login to be internally consistent. Multiple or conflicting ids/logins (e.g.
+    ``user.login`` disagreeing with ``user.username``) fail closed rather than
+    silently preferring one string (review 438 F7).
+    """
+    reasons: list[str] = []
+    if not isinstance(payload, dict):
+        return {
+            "valid": False,
+            "user_id": None,
+            "login": None,
+            "reasons": ["actor payload missing (fail closed, #709 F7)"],
+        }
+
+    ids: set[int] = set()
+    logins: set[str] = set()
+
+    def _add_id(value: Any) -> None:
+        if isinstance(value, bool) or value is None:
+            return
+        if isinstance(value, int):
+            ids.add(int(value))
+        elif isinstance(value, str) and value.strip().lstrip("-").isdigit():
+            ids.add(int(value.strip()))
+
+    def _add_login(value: Any) -> None:
+        if isinstance(value, str) and value.strip():
+            logins.add(value.strip())
+
+    user = payload.get("user")
+    if isinstance(user, dict):
+        _add_id(user.get("id"))
+        _add_id(user.get("user_id"))
+        _add_login(user.get("login"))
+        _add_login(user.get("username"))
+    elif isinstance(user, str):
+        _add_login(user)
+    for key in ("login", "author", "username"):
+        _add_login(payload.get(key))
+    _add_id(payload.get("user_id"))
+
+    if len(logins) > 1:
+        reasons.append(
+            "incident comment author has conflicting logins "
+            f"({sorted(logins)!r}); a single stable identity is required "
+            "(fail closed, #709 F7 review 438)"
+        )
+    if len(ids) > 1:
+        reasons.append(
+            "incident comment author has conflicting user ids "
+            f"({sorted(ids)!r}); a single stable identity is required "
+            "(fail closed, #709 F7 review 438)"
+        )
+    if not ids:
+        reasons.append(
+            "incident comment author is missing a stable user id; "
+            "display-name-only identity is not accepted "
+            "(fail closed, #709 F7 review 438)"
+        )
+    if not logins:
+        reasons.append(
+            "incident comment author login is missing (fail closed, #709 F7)"
+        )
+
+    return {
+        "valid": not reasons,
+        "user_id": next(iter(ids)) if len(ids) == 1 else None,
+        "login": next(iter(logins)) if len(logins) == 1 else None,
+        "reasons": reasons,
+    }
+
+
+def canonical_incident_fields(
+    *,
+    remote: str,
+    org: str,
+    repo: str,
+    pr_number: int,
+    decision_lock_id: str,
+    destroyed_subject: str,
+    recovery_action: str,
+    recorded_head_sha: str,
+    expected_head_sha: str,
+    incident_issue: int,
+    evidence_author_id: int,
+    evidence_author_login: str,
+    mint_actor_id: int,
+    mint_actor_login: str,
+    key_version: str,
+    nonce: str,
+    issued_at: str,
+) -> dict[str, str]:
+    """Ordered fields that form the authoritative incident content digest.
+
+    Every security-relevant element of the recovery scope is bound here so the
+    digest cannot be replayed across repositories, PRs, decision locks, heads,
+    actors, or recovery actions (#709 F7 review 438).
+    """
+    action = str(recovery_action or "").strip()
+    if action not in SUPPORTED_RECOVERY_ACTIONS:
+        raise ValueError(
+            f"unsupported recovery_action {action!r}; supported="
+            f"{sorted(SUPPORTED_RECOVERY_ACTIONS)!r} (fail closed, #709 F7)"
+        )
+    fields = {
+        "schema_version": INCIDENT_SCHEMA_VERSION,
+        "remote": str(remote or ""),
+        "org": str(org or ""),
+        "repo": str(repo or ""),
+        "pr_number": str(int(pr_number)),
+        "decision_lock_id": str(decision_lock_id or ""),
+        "destroyed_subject": str(destroyed_subject or ""),
+        "recovery_action": action,
+        "recorded_head_sha": normalize_head_sha(recorded_head_sha) or "",
+        "expected_head_sha": normalize_head_sha(expected_head_sha) or "",
+        "incident_issue": str(int(incident_issue)),
+        "evidence_author_id": str(int(evidence_author_id)),
+        "evidence_author_login": str(evidence_author_login or ""),
+        "mint_actor_id": str(int(mint_actor_id)),
+        "mint_actor_login": str(mint_actor_login or ""),
+        "key_version": str(key_version or ""),
+        "nonce": str(nonce or ""),
+        "issued_at": str(issued_at or ""),
+    }
+    for name in INCIDENT_FIELD_ORDER:
+        value = fields[name]
+        if not value.strip():
+            raise ValueError(
+                f"canonical incident field {name!r} is empty (fail closed, #709 F7)"
+            )
+        if value != value.strip():
+            raise ValueError(
+                f"canonical incident field {name!r} has surrounding whitespace "
+                "(fail closed, #709 F7)"
+            )
+        if "\n" in value or "\r" in value:
+            raise ValueError(
+                f"canonical incident field {name!r} contains a newline; ambiguous "
+                "evidence cannot be built (fail closed, #709 F7)"
+            )
+    return fields
+
+
+def incident_content_digest(fields: dict[str, str]) -> str:
+    """SHA-256 hex digest over the canonical field lines (fixed order, no sort)."""
+    lines = [INCIDENT_MARKER]
+    for name in INCIDENT_FIELD_ORDER:
+        if name not in fields:
+            raise ValueError(
+                f"canonical incident field {name!r} missing for digest "
+                "(fail closed, #709 F7)"
+            )
+        lines.append(f"{name}={fields[name]}")
+    blob = "\n".join(lines).encode("utf-8")
+    return hashlib.sha256(blob).hexdigest()
+
+
+def render_canonical_incident_block(fields: dict[str, str]) -> str:
+    """Render the one accepted canonical representation of *fields*."""
+    lines = [INCIDENT_MARKER]
+    lines.extend(f"{name}: {fields[name]}" for name in INCIDENT_FIELD_ORDER)
+    lines.append(f"{INCIDENT_DIGEST_FIELD}: {incident_content_digest(fields)}")
+    return "\n".join(lines)
+
+
+def _narrative_is_ambiguous(narrative: str) -> list[str]:
+    """Reject narrative text that could be mistaken for canonical evidence."""
+    reasons: list[str] = []
+    known = set(INCIDENT_FIELD_ORDER) | {INCIDENT_DIGEST_FIELD}
+    for line in narrative.split("\n"):
+        text = line.strip()
+        if text == INCIDENT_MARKER:
+            reasons.append(
+                "narrative repeats the canonical marker (ambiguous evidence)"
+            )
+            continue
+        if ":" in text and text.split(":", 1)[0].strip() in known:
+            reasons.append(
+                f"narrative contains canonical field line {text.split(':', 1)[0]!r} "
+                "(ambiguous evidence)"
+            )
+    return reasons
+
+
+def build_canonical_incident_body(
+    *,
+    remote: str,
+    org: str,
+    repo: str,
+    pr_number: int,
+    decision_lock_id: str,
+    destroyed_subject: str,
+    recovery_action: str,
+    recorded_head_sha: str,
+    expected_head_sha: str,
+    incident_issue: int,
+    evidence_author_id: int,
+    evidence_author_login: str,
+    mint_actor_id: int,
+    mint_actor_login: str,
+    key_version: str,
+    nonce: str,
+    issued_at: str,
+    narrative: str | None = None,
+) -> str:
+    """Build the one accepted canonical incident comment body (#709 F7).
+
+    The builder is the single source of the accepted format and refuses to emit
+    anything ambiguous: empty/multiline fields, unsupported recovery actions, and
+    narrative text that mimics canonical evidence all raise ``ValueError``. Its
+    own output is re-parsed before return, so a body this function produces
+    always validates as canonical.
+    """
+    fields = canonical_incident_fields(
+        remote=remote,
+        org=org,
+        repo=repo,
+        pr_number=pr_number,
+        decision_lock_id=decision_lock_id,
+        destroyed_subject=destroyed_subject,
+        recovery_action=recovery_action,
+        recorded_head_sha=recorded_head_sha,
+        expected_head_sha=expected_head_sha,
+        incident_issue=incident_issue,
+        evidence_author_id=evidence_author_id,
+        evidence_author_login=evidence_author_login,
+        mint_actor_id=mint_actor_id,
+        mint_actor_login=mint_actor_login,
+        key_version=key_version,
+        nonce=nonce,
+        issued_at=issued_at,
+    )
+    body = render_canonical_incident_block(fields)
+    if narrative and narrative.strip():
+        text = narrative.strip()
+        ambiguous = _narrative_is_ambiguous(text)
+        if ambiguous:
+            raise ValueError(
+                "; ".join(ambiguous) + " (fail closed, #709 F7 review 438)"
+            )
+        body = f"{body}\n\n{text}"
+    check = parse_canonical_incident_body(body)
+    if not check.get("valid"):
+        raise ValueError(
+            "builder produced a non-canonical body: "
+            + "; ".join(check.get("reasons") or ["unknown"])
+        )
+    return body
+
+
+def parse_canonical_incident_body(body: str | None) -> dict[str, Any]:
+    """Strictly parse the canonical incident block (#709 F7 review 438).
+
+    Enforces the exact schema: marker on the first line, every field present
+    exactly once, in fixed canonical order, with no unknown, duplicate,
+    conflicting, or empty fields anywhere in the body.
+    """
+    reasons: list[str] = []
+    text = (body or "").replace("\r\n", "\n").replace("\r", "\n").strip("\n")
+    if not text.strip():
+        return {
+            "valid": False,
+            "reasons": ["incident comment body is empty (fail closed)"],
+            "fields": {},
+        }
+
+    lines = text.split("\n")
+    if lines[0] != INCIDENT_MARKER:
+        return {
+            "valid": False,
+            "reasons": [
+                f"incident body line 1 must be exactly {INCIDENT_MARKER!r} "
+                "(canonical marker position; fail closed, #709 F7 review 438)"
+            ],
+            "fields": {},
+        }
+
+    order = list(INCIDENT_FIELD_ORDER) + [INCIDENT_DIGEST_FIELD]
+    block_len = 1 + len(order)
+    if len(lines) < block_len:
+        return {
+            "valid": False,
+            "reasons": [
+                "incident body canonical block is incomplete; every field is "
+                "required exactly once in canonical order (fail closed, #709 F7)"
+            ],
+            "fields": {},
+        }
+
+    fields: dict[str, str] = {}
+    for index, name in enumerate(order, start=1):
+        line = lines[index]
+        prefix = f"{name}: "
+        if not line.startswith(prefix):
+            return {
+                "valid": False,
+                "reasons": [
+                    f"incident body line {index + 1} must be field {name!r} in "
+                    "canonical order (reordered, duplicated, missing, or unknown "
+                    "field; fail closed, #709 F7 review 438)"
+                ],
+                "fields": {},
+            }
+        value = line[len(prefix) :]
+        if not value.strip():
+            reasons.append(
+                f"incident field {name!r} is empty (fail closed, #709 F7)"
+            )
+        elif value != value.strip():
+            reasons.append(
+                f"incident field {name!r} has surrounding whitespace "
+                "(fail closed, #709 F7)"
+            )
+        fields[name] = value
+
+    # Nothing outside the canonical block may restate the marker or any field.
+    known = set(order)
+    tail = lines[block_len:]
+    if tail and tail[0].strip():
+        reasons.append(
+            "narrative must be separated from the canonical block by a blank "
+            "line (fail closed, #709 F7)"
+        )
+    for line in tail:
+        stripped = line.strip()
+        if stripped == INCIDENT_MARKER:
+            reasons.append(
+                "incident body repeats the canonical marker outside the signed "
+                "block (ambiguous evidence; fail closed, #709 F7 review 438)"
+            )
+            continue
+        if ":" in stripped and stripped.split(":", 1)[0].strip() in known:
+            duplicated = stripped.split(":", 1)[0].strip()
+            reasons.append(
+                f"incident body restates canonical field {duplicated!r} outside "
+                "the signed block (duplicate/conflicting; fail closed, #709 F7)"
+            )
+
+    return {
+        "valid": not reasons,
+        "reasons": reasons,
+        "fields": fields,
+        "canonical_block": "\n".join(lines[:block_len]),
+    }
+
+
+def assess_incident_evidence(
+    *,
+    incident_issue: int | None,
+    incident_comment_id: int | None,
+    comment_payload: dict[str, Any] | None,
+    comment_lookup_error: str | None = None,
+    expected_remote: str | None = None,
+    expected_org: str | None = None,
+    expected_repo: str | None = None,
+    expected_pr_number: int | None = None,
+    expected_head_sha: str | None = None,
+    expected_recorded_head_sha: str | None = None,
+    expected_decision_lock_id: str | None = None,
+    expected_recovery_action: str | None = None,
+    expected_key_version: str | None = None,
+    mint_actor_id: int | None = None,
+    mint_actor_username: str | None = None,
+    reject_self_authored: bool = True,
+) -> dict[str, Any]:
+    """Validate strictly canonical, fully scoped incident evidence (#709 F7).
+
+    The body must be exactly the one canonical representation produced by
+    :func:`build_canonical_incident_body`: marker first, every field present
+    once in fixed order, no duplicates/unknowns/conflicts, digest binding the
+    complete recovery scope, and a single stable actor identity independent of
+    the minting actor. Reordered, duplicated, conflicting, replayed, or
+    substituted evidence fails closed (review 438 F7).
+    """
+    reasons: list[str] = []
+    if incident_issue is None or int(incident_issue) <= 0:
+        reasons.append("incident_issue is required and must be a positive integer")
+    if incident_comment_id is None or int(incident_comment_id) <= 0:
+        reasons.append(
+            "incident_comment_id is required and must be a positive integer"
+        )
+    if comment_lookup_error:
+        reasons.append(
+            f"incident evidence lookup failed: {comment_lookup_error} (fail closed)"
+        )
+    if not isinstance(comment_payload, dict):
+        if not comment_lookup_error:
+            reasons.append(
+                "incident evidence not found or not a comment object (fail closed)"
+            )
+        return {"valid": False, "reasons": reasons, "comment": None}
+
+    cid = comment_payload.get("id")
+    try:
+        if int(cid) != int(incident_comment_id):  # type: ignore[arg-type]
+            reasons.append(
+                "incident comment id mismatch against live payload (fail closed)"
+            )
+    except (TypeError, ValueError):
+        reasons.append("incident comment payload missing valid id (fail closed)")
+
+    # Edited evidence is not authoritative (#709 F5 review 435).
+    created_at = str(comment_payload.get("created_at") or "").strip()
+    updated_at = str(comment_payload.get("updated_at") or "").strip()
+    if updated_at and created_at and updated_at != created_at:
+        reasons.append(
+            "incident comment has been edited after creation; edited evidence is "
+            "not authoritative (fail closed, #709 F5 review 435)"
+        )
+
+    actor = incident_actor_identity(comment_payload)
+    if not actor.get("valid"):
+        reasons.extend(actor.get("reasons") or [])
+
+    parsed = parse_canonical_incident_body(comment_payload.get("body"))
+    fields = parsed.get("fields") or {}
+    if not parsed.get("valid"):
+        reasons.extend(parsed.get("reasons") or [])
+    else:
+        # Every field is bound to the exact live recovery scope.
+        def _match(name: str, expected: Any, *, label: str | None = None) -> None:
+            if expected is None or str(expected).strip() == "":
+                return
+            have = fields.get(name, "")
+            if have != str(expected).strip():
+                reasons.append(
+                    f"incident body {label or name} does not match the live "
+                    f"recovery scope (fail closed, #709 F7 review 438)"
+                )
+
+        if fields.get("schema_version") != INCIDENT_SCHEMA_VERSION:
+            reasons.append(
+                f"incident schema_version must be {INCIDENT_SCHEMA_VERSION!r} "
+                "(fail closed, #709 F7)"
+            )
+        _match("remote", expected_remote)
+        _match("org", expected_org)
+        _match("repo", expected_repo)
+        _match("decision_lock_id", expected_decision_lock_id)
+        _match("recovery_action", expected_recovery_action)
+        _match("key_version", expected_key_version)
+
+        if fields.get("recovery_action") not in SUPPORTED_RECOVERY_ACTIONS:
+            reasons.append(
+                f"incident recovery_action {fields.get('recovery_action')!r} is "
+                "not a supported recovery action (fail closed, #709 F7)"
+            )
+
+        if expected_pr_number is not None:
+            try:
+                if int(fields.get("pr_number", "")) != int(expected_pr_number):
+                    reasons.append(
+                        "incident body pr_number does not match mint PR "
+                        "(fail closed, #709 F7)"
+                    )
+            except (TypeError, ValueError):
+                reasons.append("incident body pr_number invalid (fail closed)")
+
+        try:
+            if int(fields.get("incident_issue", "")) != int(incident_issue):  # type: ignore[arg-type]
+                reasons.append(
+                    "incident body incident_issue does not match provided "
+                    "incident_issue (fail closed, #709 F7)"
+                )
+        except (TypeError, ValueError):
+            reasons.append("incident body incident_issue invalid (fail closed)")
+
+        if expected_head_sha and not heads_equal(
+            fields.get("expected_head_sha"), expected_head_sha
+        ):
+            reasons.append(
+                "incident body expected_head_sha does not match the live mint "
+                "head (fail closed, #709 F7)"
+            )
+        if expected_recorded_head_sha and not heads_equal(
+            fields.get("recorded_head_sha"), expected_recorded_head_sha
+        ):
+            reasons.append(
+                "incident body recorded_head_sha does not match the recorded "
+                "decision-lock head (fail closed, #709 F7 review 438)"
+            )
+
+        # Evidence author must be the actual live comment author.
+        if actor.get("valid"):
+            try:
+                if int(fields.get("evidence_author_id", "")) != int(
+                    actor.get("user_id")
+                ):
+                    reasons.append(
+                        "incident body evidence_author_id does not match the live "
+                        "comment author (fail closed, #709 F7 review 438)"
+                    )
+            except (TypeError, ValueError):
+                reasons.append(
+                    "incident body evidence_author_id invalid (fail closed)"
+                )
+            if fields.get("evidence_author_login") != str(actor.get("login") or ""):
+                reasons.append(
+                    "incident body evidence_author_login does not match the live "
+                    "comment author (fail closed, #709 F7 review 438)"
+                )
+
+        # Minting actor must be the live caller, and must not be the author.
+        if mint_actor_id is not None:
+            try:
+                if int(fields.get("mint_actor_id", "")) != int(mint_actor_id):
+                    reasons.append(
+                        "incident body mint_actor_id does not match the minting "
+                        "actor (fail closed, #709 F7 review 438)"
+                    )
+            except (TypeError, ValueError):
+                reasons.append("incident body mint_actor_id invalid (fail closed)")
+        if mint_actor_username and fields.get("mint_actor_login") != str(
+            mint_actor_username
+        ).strip():
+            reasons.append(
+                "incident body mint_actor_login does not match the minting actor "
+                "(fail closed, #709 F7 review 438)"
+            )
+
+        # Digest binds the complete canonical content.
+        try:
+            expected_digest = incident_content_digest(fields)
+            if not hmac.compare_digest(
+                expected_digest.lower(),
+                str(fields.get(INCIDENT_DIGEST_FIELD, "")).strip().lower(),
+            ):
+                reasons.append(
+                    "incident content_digest mismatch (forged, substituted, or "
+                    "incomplete canonical body; fail closed, #709 F7)"
+                )
+        except (TypeError, ValueError) as exc:
+            reasons.append(
+                f"incident content_digest recompute failed: {exc} (fail closed)"
+            )
+
+        # Reconstruct the exact canonical representation and require equality.
+        try:
+            rebuilt = render_canonical_incident_block(fields)
+            if rebuilt != parsed.get("canonical_block"):
+                reasons.append(
+                    "incident body is not the exact canonical representation "
+                    "(fail closed, #709 F7 review 438)"
+                )
+        except (TypeError, ValueError) as exc:
+            reasons.append(
+                f"incident canonical reconstruction failed: {exc} (fail closed)"
+            )
+
+    # Independent-author requirement (#709 F5 review 435), by stable identity.
+    if reject_self_authored and actor.get("valid"):
+        if mint_actor_id is not None and int(actor.get("user_id") or -1) == int(
+            mint_actor_id
+        ):
+            reasons.append(
+                "incident comment author is the minting actor; self-authored "
+                "incident evidence is not accepted (fail closed, #709 F5 review 435)"
+            )
+        elif (
+            mint_actor_username
+            and str(actor.get("login") or "").strip().lower()
+            == str(mint_actor_username).strip().lower()
+        ):
+            reasons.append(
+                "incident comment author is the minting actor; self-authored "
+                "incident evidence is not accepted (fail closed, #709 F5 review 435)"
+            )
+
+    # Hard scope check when URLs are present.
+    issue_url = str(
+        comment_payload.get("issue_url")
+        or comment_payload.get("html_url")
+        or ""
+    )
+    if expected_org and issue_url and f"/{expected_org}/" not in issue_url:
+        if expected_repo and f"/{expected_repo}/" not in issue_url:
+            reasons.append(
+                "incident evidence URL does not match expected repository "
+                "(fail closed)"
+            )
+
+    return {
+        "valid": not reasons,
+        "reasons": reasons,
+        "fields": fields,
+        "comment": {
+            "id": comment_payload.get("id"),
+            "author": actor.get("login"),
+            "author_id": actor.get("user_id"),
+            "created_at": comment_payload.get("created_at"),
+            "canonical": bool(parsed.get("valid")),
+        },
+    }
+
+
+def assess_live_head_binding(
+    *,
+    expected_head_sha: str | None,
+    live_head_sha: str | None,
+    pr_lookup_error: str | None = None,
+    pr_state: str | None = None,
+) -> dict[str, Any]:
+    """expected_head_sha mandatory and must equal live PR head."""
+    reasons: list[str] = []
+    want = normalize_head_sha(expected_head_sha)
+    have = normalize_head_sha(live_head_sha)
+    if not want:
+        reasons.append(
+            "expected_head_sha is mandatory and must be a non-empty SHA "
+            "(fail closed, #709 F1)"
+        )
+    if pr_lookup_error:
+        reasons.append(f"live PR head lookup failed: {pr_lookup_error} (fail closed)")
+    if want and not have:
+        reasons.append("live PR head SHA unavailable (fail closed)")
+    if want and have and not heads_equal(want, have):
+        reasons.append(
+            "expected_head_sha does not equal live PR head "
+            f"(expected={want[:12]}… live={have[:12]}…; fail closed, #709 F1)"
+        )
+    return {
+        "valid": not reasons,
+        "expected_head_sha": want,
+        "live_head_sha": have,
+        "pr_state": pr_state,
+        "reasons": reasons,
+    }
+
+
+def build_authorization_artifact(
+    *,
+    remote: str,
+    org: str,
+    repo: str,
+    pr_number: int,
+    expected_head_sha: str,
+    incident_issue: int,
+    incident_comment_id: int,
+    destroyed_subject: str | None,
+    issuer_username: str,
+    issuer_profile: str,
+    native_provenance: dict[str, Any] | None = None,
+    ttl_hours: float = AUTH_TTL_HOURS,
+) -> dict[str, Any]:
+    """Build a server-side authorization artifact (caller cannot forge signature)."""
+    provenance = dict(
+        native_provenance or mcp_daemon_guard.mutation_provenance_fields()
+    )
+    created = _now()
+    expires = created + timedelta(hours=float(ttl_hours))
+    authorization_id = str(uuid.uuid4())
+    scope = _scope_payload(
+        remote=remote,
+        org=org,
+        repo=repo,
+        pr_number=pr_number,
+        expected_head_sha=expected_head_sha,
+        incident_issue=incident_issue,
+        incident_comment_id=incident_comment_id,
+        destroyed_subject=destroyed_subject,
+        issuer_username=issuer_username,
+        issuer_profile=issuer_profile,
+        created_at=created.isoformat(),
+        expires_at=expires.isoformat(),
+        authorization_id=authorization_id,
+    )
+    try:
+        kv = auth_key_version()
+        signature = _sign_scope(scope, provenance, key_version=kv)
+    except AuthSecretError as exc:
+        # Surface fail-closed mint: caller must not get a forgeable blank sig.
+        raise AuthSecretError(str(exc)) from exc
+    return {
+        "kind": KIND_AUTH,
+        "auth_type": AUTH_TYPE,
+        "record_type": AUTH_TYPE,
+        "status": "issued",
+        "consumption_state": "issued",
+        "consumed_at": None,
+        "recovery_critical": True,
+        "issue_ref": "#709",
+        "server_signature": signature,
+        "key_version": kv,
+        # Never serialize the secret; only the version id.
+        "native_provenance": provenance,
+        **scope,
+        "timestamp": created.isoformat(),
+        "recorded_at": created.isoformat(),
+        "updated_at": created.isoformat(),
+    }
+
+
+def verify_authorization_artifact(
+    auth: dict[str, Any] | None,
+    *,
+    remote: str,
+    org: str,
+    repo: str,
+    pr_number: int,
+    expected_head_sha: str,
+    incident_issue: int | None = None,
+    incident_comment_id: int | None = None,
+    require_unconsumed: bool = True,
+    now: datetime | None = None,
+) -> dict[str, Any]:
+    """Fail-closed verification of a server-side authorization artifact."""
+    reasons: list[str] = []
+    if not isinstance(auth, dict):
+        return {
+            "valid": False,
+            "reasons": ["authorization artifact missing (fail closed)"],
+        }
+    if (auth.get("kind") or auth.get("auth_type") or "") not in (
+        KIND_AUTH,
+        AUTH_TYPE,
+    ) and auth.get("record_type") != AUTH_TYPE:
+        if (auth.get("kind") or "") != KIND_AUTH:
+            reasons.append(
+                f"authorization kind mismatch (expected {KIND_AUTH!r}; fail closed)"
+            )
+
+    for field, want in (
+        ("remote", remote),
+        ("org", org),
+        ("repo", repo),
+    ):
+        have = (str(auth.get(field) or "")).strip()
+        if not have or have != (want or "").strip():
+            reasons.append(
+                f"authorization {field} mismatch "
+                f"(stored={have!r}, expected={want!r}; fail closed)"
+            )
+
+    try:
+        if int(auth.get("blocked_pr_number")) != int(pr_number):
+            reasons.append("authorization PR number mismatch (fail closed)")
+    except (TypeError, ValueError):
+        reasons.append("authorization missing blocked_pr_number (fail closed)")
+
+    if not heads_equal(auth.get("expected_head_sha"), expected_head_sha):
+        reasons.append("authorization head SHA mismatch (fail closed)")
+
+    if incident_issue is not None:
+        try:
+            if int(auth.get("incident_issue")) != int(incident_issue):
+                reasons.append("authorization incident_issue mismatch (fail closed)")
+        except (TypeError, ValueError):
+            reasons.append("authorization missing incident_issue (fail closed)")
+    if incident_comment_id is not None:
+        try:
+            if int(auth.get("incident_comment_id")) != int(incident_comment_id):
+                reasons.append(
+                    "authorization incident_comment_id mismatch (fail closed)"
+                )
+        except (TypeError, ValueError):
+            reasons.append("authorization missing incident_comment_id (fail closed)")
+
+    if not (auth.get("issuer_username") or "").strip():
+        reasons.append("authorization missing issuer_username (fail closed)")
+    if not (auth.get("issuer_profile") or "").strip():
+        reasons.append("authorization missing issuer_profile (fail closed)")
+    if not (auth.get("server_signature") or "").strip():
+        reasons.append("authorization missing server_signature (fail closed)")
+
+    # #709 F6 (review 438): validate key version *before* any MAC work so an
+    # attacker-chosen version can never select the signing key. Missing, empty,
+    # malformed, duplicated, unknown, and mismatched versions all fail closed.
+    key_version_gate = assess_artifact_key_version(auth)
+    verified_key_version = (
+        key_version_gate.get("key_version") if key_version_gate.get("valid") else None
+    )
+    if not key_version_gate.get("valid"):
+        reasons.extend(
+            key_version_gate.get("reasons")
+            or ["authorization key_version invalid (fail closed, #709 F6)"]
+        )
+
+    # Recompute signature over stored scope fields + verified key_version.
+    if verified_key_version is None:
+        reasons.append(
+            "authorization server_signature not verified: key version failed "
+            "validation (fail closed, #709 F6 review 438)"
+        )
+    else:
+        try:
+            scope = _scope_payload(
+                remote=str(auth.get("remote") or ""),
+                org=str(auth.get("org") or ""),
+                repo=str(auth.get("repo") or ""),
+                pr_number=int(auth.get("blocked_pr_number")),
+                expected_head_sha=str(auth.get("expected_head_sha") or ""),
+                incident_issue=int(auth.get("incident_issue")),
+                incident_comment_id=int(auth.get("incident_comment_id")),
+                destroyed_subject=auth.get("destroyed_subject"),
+                issuer_username=str(auth.get("issuer_username") or ""),
+                issuer_profile=str(auth.get("issuer_profile") or ""),
+                created_at=str(auth.get("created_at") or ""),
+                expires_at=str(auth.get("expires_at") or ""),
+                authorization_id=str(auth.get("authorization_id") or ""),
+            )
+            native = auth.get("native_provenance") or {}
+            if not isinstance(native, dict):
+                native = {}
+            expected_sig = _sign_scope(
+                scope, native, key_version=verified_key_version
+            )
+            if not hmac.compare_digest(
+                expected_sig, str(auth.get("server_signature") or "")
+            ):
+                reasons.append(
+                    "authorization server_signature invalid (forged, corrupt, or "
+                    "HMAC key mismatch across process/restart; fail closed, "
+                    "#709 F4/F1)"
+                )
+        except AuthSecretError as exc:
+            reasons.append(f"authorization HMAC key unavailable: {exc} (fail closed)")
+        except (TypeError, ValueError) as exc:
+            reasons.append(f"authorization scope incomplete: {exc} (fail closed)")
+
+    # Native provenance required on the artifact itself.
+    native = auth.get("native_provenance") or {}
+    if not isinstance(native, dict) or not (
+        native.get("native_mcp_transport") or native.get("pytest")
+    ):
+        # Pytest artifacts stamp pytest=True via mutation_provenance_fields.
+        if not mcp_daemon_guard.is_pytest_runtime():
+            if not (isinstance(native, dict) and native.get("native_mcp_transport")):
+                reasons.append(
+                    "authorization lacks native transport provenance (fail closed)"
+                )
+
+    # Expiry / consumption.
+    now_dt = now or _now()
+    expires_raw = auth.get("expires_at")
+    expires_dt = None
+    if expires_raw:
+        text = str(expires_raw).strip()
+        if text.endswith("Z"):
+            text = text[:-1] + "+00:00"
+        try:
+            expires_dt = datetime.fromisoformat(text)
+            if expires_dt.tzinfo is None:
+                expires_dt = expires_dt.replace(tzinfo=timezone.utc)
+        except ValueError:
+            reasons.append("authorization expires_at unparseable (fail closed)")
+    else:
+        reasons.append("authorization missing expires_at (fail closed)")
+    if expires_dt is not None and now_dt > expires_dt:
+        reasons.append("authorization expired (fail closed)")
+
+    state = (auth.get("consumption_state") or auth.get("status") or "").strip()
+    if require_unconsumed and state in ("consumed", "expired"):
+        reasons.append(
+            f"authorization already {state}; cannot be replayed (fail closed)"
+        )
+    if require_unconsumed and auth.get("consumed_at"):
+        reasons.append("authorization already consumed (fail closed)")
+
+    return {
+        "valid": not reasons,
+        "reasons": reasons,
+        "authorization_id": auth.get("authorization_id"),
+        "consumption_state": state or None,
+        "key_version": verified_key_version,
+    }
+
+
+def build_irrecoverable_provenance_record(
+    *,
+    pr_number: int,
+    head_sha: str,
+    remote: str,
+    org: str,
+    repo: str,
+    actor_username: str | None,
+    profile_name: str | None,
+    reason: str,
+    incident_issue: int,
+    incident_comment_id: int,
+    authorization: dict[str, Any],
+    destroyed_subject: str | None = None,
+    historical_provenance_subject: str | None = None,
+) -> dict[str, Any]:
+    """Truthful absence-of-proof record. Never sets applied=True.
+
+    ``merger_may_accept`` is True only when *authorization* verifies for the
+    exact scope. Caller-supplied Booleans are never consulted.
+    """
+    head = normalize_head_sha(head_sha)
+    auth_check = verify_authorization_artifact(
+        authorization,
+        remote=remote,
+        org=org,
+        repo=repo,
+        pr_number=pr_number,
+        expected_head_sha=head or "",
+        incident_issue=incident_issue,
+        incident_comment_id=incident_comment_id,
+        require_unconsumed=True,
+    )
+    may_accept = bool(auth_check.get("valid"))
+    return {
+        "event": "irrecoverable_decision_lock_provenance",
+        "status": "provenance_irrecoverable",
+        "record_type": RECORD_TYPE,
+        "kind": KIND_RECOVERY,
+        "operator_recovery_required": True,
+        "issue_ref": "#709",
+        "recovery_critical": True,
+        "applied": False,
+        "historical_cleanup_proven": False,
+        "timestamp": _now_iso(),
+        "pr_number": int(pr_number),
+        "blocked_pr_number": int(pr_number),
+        "head_sha": head,
+        "remote": remote,
+        "org": org,
+        "repo": repo,
+        "actor_username": actor_username,
+        "profile_name": profile_name,
+        "reason": reason,
+        "incident_issue": int(incident_issue),
+        "incident_comment_id": int(incident_comment_id),
+        # Legacy field for audit readability; not a caller Boolean gate.
+        "incident_ref": f"issue:{int(incident_issue)}/comment:{int(incident_comment_id)}",
+        "authorization_id": authorization.get("authorization_id"),
+        "authorization_issuer": authorization.get("issuer_username"),
+        "authorization_issuer_profile": authorization.get("issuer_profile"),
+        "authorization_verified": may_accept,
+        "authorization_verify_reasons": list(auth_check.get("reasons") or []),
+        "destroyed_subject": (destroyed_subject or "").strip() or None,
+        "historical_provenance_subject": (
+            (historical_provenance_subject or destroyed_subject or "").strip()
+            or None
+        ),
+        "consumption_state": "issued",
+        "consumed_at": None,
+        "merger_may_accept": may_accept,
+        "acceptance_rule": (
+            "Merger may accept this record only when a server-side authorization "
+            "artifact verifies for remote/org/repo/PR/exact-head/incident, the "
+            "record is durable and read back, the auth is unexpired and unconsumed, "
+            "and normal merge gates still pass. Resolves only the historical "
+            "prior-provenance blocker; never proves historical cleanup "
+            "(applied=false, historical_cleanup_proven=false)."
+        ),
+        "native_provenance": mcp_daemon_guard.mutation_provenance_fields(),
+    }
+
+
+def format_irrecoverable_audit_comment(record: dict[str, Any]) -> str:
+    """Markdown body for irrecoverable provenance audit (no applied=true claim)."""
+    lines = [
+        "## Irrecoverable decision-lock provenance (#709)",
+        "",
+        "Status: **PROVENANCE_IRRECOVERABLE** (not applied cleanup)",
+        "",
+        f"- actor: `{record.get('actor_username')}`",
+        f"- profile: `{record.get('profile_name')}`",
+        f"- timestamp: `{record.get('timestamp')}`",
+        f"- PR: `#{record.get('pr_number')}`",
+        f"- head_sha: `{record.get('head_sha')}`",
+        f"- incident_issue: `{record.get('incident_issue')}`",
+        f"- incident_comment_id: `{record.get('incident_comment_id')}`",
+        f"- authorization_id: `{record.get('authorization_id')}`",
+        f"- authorization_issuer: `{record.get('authorization_issuer')}`",
+        f"- authorization_verified: `{record.get('authorization_verified')}`",
+        f"- historical_cleanup_proven: `{record.get('historical_cleanup_proven')}`",
+        f"- applied: `{record.get('applied')}` (must remain false)",
+        f"- merger_may_accept: `{record.get('merger_may_accept')}`",
+        f"- destroyed_subject: `{record.get('destroyed_subject')}`",
+        "",
+        f"Reason: {record.get('reason')}",
+        "",
+        "This record documents **absence of proof**, not successful cleanup.",
+        "It must not be reused for a different PR or head (#709 AC6).",
+        "Authorization is a server-side artifact — not a caller Boolean.",
+    ]
+    return "\n".join(lines)
+
+
+def assess_merger_consumption(
+    recovery: dict[str, Any] | None,
+    authorization: dict[str, Any] | None,
+    *,
+    remote: str,
+    org: str,
+    repo: str,
+    pr_number: int,
+    live_head_sha: str | None,
+    # Normal merge gate outcomes (must still pass independently).
+    approval_at_current_head: bool | None = None,
+    has_blocking_change_requests: bool | None = None,
+    mergeable: bool | None = None,
+    lease_ok: bool | None = None,
+    runtime_ok: bool | None = None,
+    workspace_ok: bool | None = None,
+    anti_stomp_ok: bool | None = None,
+    now: datetime | None = None,
+) -> dict[str, Any]:
+    """Fail-closed merger assessment for consuming an irrecoverable recovery.
+
+    Resolves **only** the historical prior-provenance blocker when all
+    recovery checks pass. Never grants a pass when normal merge gates fail.
+    """
+    reasons: list[str] = []
+    result: dict[str, Any] = {
+        "allowed": False,
+        "resolves_prior_provenance_blocker": False,
+        "historical_cleanup_proven": False,
+        "irrecoverable_recovery_authorized": False,
+        "recovery_record_consumed": False,
+        "reasons": reasons,
+        "normal_gates": {
+            "approval_at_current_head": approval_at_current_head,
+            "has_blocking_change_requests": has_blocking_change_requests,
+            "mergeable": mergeable,
+            "lease_ok": lease_ok,
+            "runtime_ok": runtime_ok,
+            "workspace_ok": workspace_ok,
+            "anti_stomp_ok": anti_stomp_ok,
+        },
+    }
+
+    if not isinstance(recovery, dict):
+        reasons.append("recovery record missing (fail closed)")
+        return result
+    if (recovery.get("record_type") or recovery.get("kind")) not in (
+        RECORD_TYPE,
+        KIND_RECOVERY,
+        "irrecoverable_decision_provenance",
+    ):
+        if recovery.get("status") != "provenance_irrecoverable":
+            reasons.append("recovery record type/status invalid (fail closed)")
+
+    if recovery.get("applied") is True:
+        reasons.append(
+            "recovery record claims applied=true; refuse (fabrication, fail closed)"
+        )
+    if recovery.get("historical_cleanup_proven") is True:
+        reasons.append(
+            "recovery record claims historical_cleanup_proven=true; refuse "
+            "(fail closed)"
+        )
+
+    for field, want in (("remote", remote), ("org", org), ("repo", repo)):
+        have = (str(recovery.get(field) or "")).strip()
+        if have != (want or "").strip():
+            reasons.append(
+                f"recovery {field} mismatch (stored={have!r}, expected={want!r})"
+            )
+
+    try:
+        if int(recovery.get("pr_number") or recovery.get("blocked_pr_number")) != int(
+            pr_number
+        ):
+            reasons.append("recovery PR number mismatch (fail closed)")
+    except (TypeError, ValueError):
+        reasons.append("recovery missing pr_number (fail closed)")
+
+    if not heads_equal(recovery.get("head_sha"), live_head_sha):
+        reasons.append(
+            "recovery head SHA does not match live PR head (fail closed)"
+        )
+
+    if recovery.get("consumption_state") == "consumed" or recovery.get("consumed_at"):
+        # Idempotent: already consumed for this exact scope is OK if head matches.
+        result["recovery_record_consumed"] = True
+        reasons.append("recovery record already consumed (idempotent check)")
+
+    auth_check = verify_authorization_artifact(
+        authorization,
+        remote=remote,
+        org=org,
+        repo=repo,
+        pr_number=pr_number,
+        expected_head_sha=str(live_head_sha or ""),
+        incident_issue=recovery.get("incident_issue"),
+        incident_comment_id=recovery.get("incident_comment_id"),
+        # When recovery already consumed, allow already-consumed auth for
+        # idempotent re-report; otherwise require unconsumed.
+        require_unconsumed=not result["recovery_record_consumed"],
+        now=now,
+    )
+    if not auth_check.get("valid"):
+        reasons.extend(auth_check.get("reasons") or ["authorization invalid"])
+    else:
+        result["irrecoverable_recovery_authorized"] = True
+
+    if not recovery.get("merger_may_accept") and not result["recovery_record_consumed"]:
+        reasons.append(
+            "recovery record merger_may_accept is false (fail closed)"
+        )
+
+    # Auth id binding.
+    if (
+        authorization
+        and recovery.get("authorization_id")
+        and authorization.get("authorization_id")
+        and recovery.get("authorization_id") != authorization.get("authorization_id")
+    ):
+        reasons.append("recovery authorization_id does not match artifact (fail closed)")
+
+    # Normal gates: if explicitly False, refuse consumption as merge-authorizing.
+    normal_blockers: list[str] = []
+    if approval_at_current_head is False:
+        normal_blockers.append("missing/stale approval at current head")
+    if has_blocking_change_requests is True:
+        normal_blockers.append("blocking change requests present")
+    if mergeable is False:
+        normal_blockers.append("PR not mergeable")
+    if lease_ok is False:
+        normal_blockers.append("lease gate failed")
+    if runtime_ok is False:
+        normal_blockers.append("runtime gate failed")
+    if workspace_ok is False:
+        normal_blockers.append("workspace gate failed")
+    if anti_stomp_ok is False:
+        normal_blockers.append("anti-stomp gate failed")
+    if normal_blockers:
+        reasons.append(
+            "recovery cannot bypass normal merge gates: "
+            + "; ".join(normal_blockers)
+            + " (#709 F2)"
+        )
+        result["resolves_prior_provenance_blocker"] = False
+        result["allowed"] = False
+        result["reasons"] = reasons
+        return result
+
+    # Filter pure informational "already consumed" when everything else matches
+    # for idempotent success.
+    hard = [
+        r
+        for r in reasons
+        if "already consumed" not in r
+    ]
+    if not hard and result["irrecoverable_recovery_authorized"]:
+        result["allowed"] = True
+        result["resolves_prior_provenance_blocker"] = True
+        result["historical_cleanup_proven"] = False
+        if result["recovery_record_consumed"]:
+            reasons.append(
+                "idempotent: prior-provenance blocker already resolved for this scope"
+            )
+        else:
+            reasons.append(
+                "prior-provenance blocker may be resolved by consuming this record "
+                "(historical cleanup remains unproven)"
+            )
+    result["reasons"] = reasons
+    return result
+
+
+def mark_consumed(
+    record: dict[str, Any],
+    *,
+    consumer_username: str | None,
+    consumer_profile: str | None,
+) -> dict[str, Any]:
+    """Return a copy of *record* marked consumed (crash-safe write is caller's job)."""
+    out = dict(record)
+    out["consumption_state"] = "consumed"
+    out["status"] = out.get("status") or "issued"
+    if out.get("kind") == KIND_AUTH or out.get("auth_type") == AUTH_TYPE:
+        out["status"] = "consumed"
+    out["consumed_at"] = _now_iso()
+    out["consumed_by"] = consumer_username
+    out["consumed_by_profile"] = consumer_profile
+    out["updated_at"] = out["consumed_at"]
+    return out
+
+
+def assess_profile_path_identity(profile_identity: str | None) -> dict[str, Any]:
+    """Reject traversal / malformed profile identity segments (#709 F3)."""
+    reasons: list[str] = []
+    raw = profile_identity if profile_identity is not None else ""
+    text = str(raw)
+    if not text.strip():
+        reasons.append("profile identity empty (fail closed)")
+        return {"valid": False, "reasons": reasons, "sanitized": None}
+    if text != text.strip():
+        reasons.append("profile identity has surrounding whitespace (fail closed)")
+    if ".." in text or "/" in text or "\\" in text or "\x00" in text:
+        reasons.append(
+            "profile identity contains path traversal or separator characters "
+            "(fail closed, #709 F3)"
+        )
+    if text.startswith("-") or text.startswith("."):
+        reasons.append("profile identity has unsafe leading character (fail closed)")
+    # After sanitize, must not collapse to something that collides emptily.
+    sanitized = mcp_session_state._sanitize_segment(text)
+    if sanitized in ("_", ""):
+        reasons.append("profile identity sanitizes to empty (fail closed)")
+    if sanitized != text and any(c in text for c in ("..", "/", "\\")):
+        # Already covered; keep fail closed.
+        pass
+    return {
+        "valid": not reasons,
+        "reasons": reasons,
+        "sanitized": sanitized if not reasons else None,
+    }
diff --git a/mcp_daemon_guard.py b/mcp_daemon_guard.py
index 71b4492..b3d0ee8 100644
--- a/mcp_daemon_guard.py
+++ b/mcp_daemon_guard.py
@@ -1,67 +1,439 @@
-"""Sanctioned MCP daemon guards for imports and credential access (#558).
+"""Sanctioned MCP daemon guards for imports and credential access (#558 / #695).
 
-Direct ``import gitea_mcp_server`` / ``import gitea_auth`` from a shell, plus
-raw keychain dumps, bypass preflight purity and role gates. Mutation helpers
-and keychain fallbacks therefore require an explicit sanctioned runtime.
+Direct ``import gitea_mcp_server`` from a shell bypasses native MCP transport.
+#558 introduced a daemon marker; #695 hardens it so:
 
-Sanctioned contexts (any one):
-- ``GITEA_MCP_SANCTIONED_DAEMON=1`` (set by the official MCP entrypoint)
-- pytest (``PYTEST_CURRENT_TEST`` present)
-- explicit operator opt-in ``GITEA_ALLOW_DIRECT_MCP_IMPORT=1`` (tests/tools only)
+- Environment variables alone cannot reconstruct a native session
+  (``GITEA_MCP_SANCTIONED_DAEMON=1`` / ``GITEA_ALLOW_DIRECT_MCP_IMPORT=1`` are
+  insufficient for mutation gates).
+- A process-local runtime record is established only by the resolved canonical
+  entrypoint path (not basename) **and** the actual native MCP transport
+  lifecycle (``bind_native_mcp_transport`` before ``mcp.run``). Merely
+  importing or launching the entrypoint offline does not grant mutation
+  authority.
+- Public caller-controlled flags (including any former
+  ``allow_test_bootstrap``) never establish trusted mutation provenance.
+- Offline scripts that import internals fail closed on mutations.
+- Pytest remains allowed for hermetic unit tests via ``is_pytest_runtime()``.
+  A separate test-only seam may establish a **test-mode** native record for
+  unit tests of transport gates; that record cannot authorize production
+  Gitea mutation endpoints.
 
-Credential keychain fill additionally allows:
-- ``GITEA_ALLOW_KEYCHAIN_CLI=1`` for operator-only non-MCP scripts that must
-  use git-credential (never the default for LLM shells).
+Manual deletion of session-state files is never a recovery path.
 """
 
 from __future__ import annotations
 
+import hashlib
+import inspect
 import os
+import secrets
+import time
+from pathlib import Path
 from typing import Any
 
 SANCTIONED_DAEMON_ENV = "GITEA_MCP_SANCTIONED_DAEMON"
 ALLOW_DIRECT_IMPORT_ENV = "GITEA_ALLOW_DIRECT_MCP_IMPORT"
 ALLOW_KEYCHAIN_CLI_ENV = "GITEA_ALLOW_KEYCHAIN_CLI"
+# Test-only: force provenance failure even under pytest (#695 regressions).
+FORCE_PROVENANCE_FAIL_ENV = "GITEA_TEST_FORCE_UNSANCTIONED"
+
+# Process-local native runtime (never persisted, never read from env alone).
+_NATIVE_RUNTIME: dict[str, Any] | None = None
+
+# Production transport identifiers accepted by bind_native_mcp_transport.
+_PRODUCTION_TRANSPORTS = frozenset({"stdio"})
+_RUNTIME_MODE_PRODUCTION = "production"
+_RUNTIME_MODE_TEST = "test"
+_PHASE_ENTRYPOINT_CLAIMED = "entrypoint_claimed"
+_PHASE_TRANSPORT_BOUND = "transport_bound"
+
+# Default session-state root (mirrors mcp_session_state; kept local to avoid
+# import cycles). Used only to pin authority at transport bind (#695 AC2).
+_DEFAULT_SESSION_STATE_DIR = os.path.expanduser("~/.cache/gitea-tools/session-state")
+SESSION_STATE_DIR_ENV = "GITEA_MCP_SESSION_STATE_DIR"
 
 
 class UnsanctionedRuntimeError(RuntimeError):
-    """Raised when mutation/credential code runs outside a sanctioned MCP daemon."""
+    """Raised when mutation/credential code runs outside a native MCP daemon."""
 
 
 def is_pytest_runtime() -> bool:
-    if os.environ.get("GITEA_TEST_FORCE_UNSANCTIONED") == "1":
+    if (os.environ.get(FORCE_PROVENANCE_FAIL_ENV) or "").strip() in {
+        "1",
+        "true",
+        "yes",
+    }:
         return False
     import sys
+
     if "pytest" in sys.modules:
         return True
     return bool((os.environ.get("PYTEST_CURRENT_TEST") or "").strip())
 
 
+def _package_root() -> Path:
+    """Directory that contains the canonical MCP entrypoint modules."""
+    return Path(__file__).resolve().parent
+
+
+def canonical_entrypoint_paths() -> frozenset[str]:
+    """Resolved absolute paths of official entrypoints (not basenames)."""
+    root = _package_root()
+    return frozenset(
+        {
+            str((root / "mcp_server.py").resolve()),
+            str((root / "gitea_mcp_server.py").resolve()),
+        }
+    )
+
+
+def _resolve_path(path: str | None) -> str | None:
+    if not path:
+        return None
+    try:
+        return str(Path(path).resolve())
+    except (OSError, RuntimeError, ValueError):
+        return None
+
+
+def _caller_official_entrypoint_path() -> str | None:
+    """Return the resolved canonical entrypoint path in the call stack, or None.
+
+    Basename-only matches (e.g. an attacker file named ``mcp_server.py``
+    elsewhere) are rejected. The path must equal one of
+    :func:`canonical_entrypoint_paths`.
+    """
+    canonical = canonical_entrypoint_paths()
+    for frame in inspect.stack()[1:20]:
+        resolved = _resolve_path(frame.filename)
+        if resolved and resolved in canonical:
+            return resolved
+    return None
+
+
+def _caller_is_official_entrypoint() -> bool:
+    """True when invoked from a resolved canonical entrypoint path (#695)."""
+    return _caller_official_entrypoint_path() is not None
+
+
+def _new_runtime_token() -> tuple[str, str]:
+    token = secrets.token_hex(32)
+    fingerprint = hashlib.sha256(token.encode()).hexdigest()[:16]
+    return token, fingerprint
+
+
+def mark_sanctioned_daemon() -> dict[str, Any]:
+    """Claim the official entrypoint for this process (#695).
+
+    This alone does **not** authorize mutations. Callers must subsequently
+    bind the native MCP transport via :func:`bind_native_mcp_transport`.
+
+    Only a stack frame whose **resolved absolute path** is the canonical
+    ``mcp_server.py`` or ``gitea_mcp_server.py`` next to this module may
+    claim the entrypoint. Basename spoofing is rejected.
+
+    There is no public ``allow_test_bootstrap`` argument: caller-controlled
+    flags must never establish trusted mutation provenance. Hermetic tests
+    use :func:`install_test_native_runtime` (pytest-only, test mode).
+    """
+    global _NATIVE_RUNTIME
+    if is_pytest_runtime():
+        # Under pytest, production mark is a no-op for transport authority.
+        # Tests that need a native-transport record use install_test_native_runtime.
+        return native_runtime_status()
+
+    entrypoint_path = _caller_official_entrypoint_path()
+    if entrypoint_path is None:
+        raise UnsanctionedRuntimeError(
+            "mark_sanctioned_daemon rejected: not called from the resolved "
+            "canonical MCP entrypoint path (#695). Basename-only names "
+            "(e.g. a renamed runner called mcp_server.py) are insufficient. "
+            "Offline import / standalone scripts cannot reconstruct native "
+            "transport. Stop after native MCP failure; do not run offline "
+            "mutation helpers."
+        )
+
+    token, fingerprint = _new_runtime_token()
+    _NATIVE_RUNTIME = {
+        "token": token,
+        "token_fingerprint": fingerprint,
+        "pid": os.getpid(),
+        "started_at": time.time(),
+        "entrypoint": "mcp_server",
+        "entrypoint_path": entrypoint_path,
+        "phase": _PHASE_ENTRYPOINT_CLAIMED,
+        "transport": None,
+        "mode": _RUNTIME_MODE_PRODUCTION,
+    }
+    # Legacy signal for older probes; alone does not authorize mutations.
+    os.environ[SANCTIONED_DAEMON_ENV] = "1"
+    return native_runtime_status()
+
+
+def bind_native_mcp_transport(*, transport: str) -> dict[str, Any]:
+    """Bind the live native MCP transport lifecycle (#695).
+
+    Must be called from the resolved canonical entrypoint immediately before
+    the real MCP server transport loop (e.g. ``mcp.run(transport=\"stdio\")``).
+    Requires a prior successful :func:`mark_sanctioned_daemon` claim in this
+    process. Import-only or offline launch without this bind leaves
+    :func:`is_native_mcp_transport` false.
+    """
+    global _NATIVE_RUNTIME
+    transport_name = (transport or "").strip().lower()
+    if transport_name not in _PRODUCTION_TRANSPORTS:
+        raise UnsanctionedRuntimeError(
+            f"bind_native_mcp_transport rejected: transport {transport!r} is "
+            f"not a production MCP transport (#695). Allowed: "
+            f"{sorted(_PRODUCTION_TRANSPORTS)}."
+        )
+
+    entrypoint_path = _caller_official_entrypoint_path()
+    if entrypoint_path is None:
+        raise UnsanctionedRuntimeError(
+            "bind_native_mcp_transport rejected: not called from the resolved "
+            "canonical MCP entrypoint path (#695)."
+        )
+
+    if _NATIVE_RUNTIME is None or int(_NATIVE_RUNTIME.get("pid") or -1) != os.getpid():
+        raise UnsanctionedRuntimeError(
+            "bind_native_mcp_transport rejected: no entrypoint claim in this "
+            "process (#695). Call mark_sanctioned_daemon() from the official "
+            "entrypoint first."
+        )
+
+    if _NATIVE_RUNTIME.get("mode") != _RUNTIME_MODE_PRODUCTION:
+        raise UnsanctionedRuntimeError(
+            "bind_native_mcp_transport rejected: runtime mode is not "
+            "production (#695)."
+        )
+
+    claimed = (_NATIVE_RUNTIME.get("entrypoint_path") or "").strip()
+    if claimed and claimed != entrypoint_path:
+        raise UnsanctionedRuntimeError(
+            "bind_native_mcp_transport rejected: entrypoint path mismatch "
+            "between mark and bind (#695)."
+        )
+
+    # Pin session-state root for this server lifetime (#695 AC2 / PR #701).
+    # Changing GITEA_MCP_SESSION_STATE_DIR after bind must not manufacture a
+    # second authority domain for decision locks / workflow proofs.
+    raw_state = (os.environ.get(SESSION_STATE_DIR_ENV) or "").strip()
+    if not raw_state:
+        raw_state = _DEFAULT_SESSION_STATE_DIR
+    try:
+        pinned_state = str(Path(raw_state).resolve())
+    except (OSError, RuntimeError, ValueError):
+        pinned_state = raw_state
+
+    _NATIVE_RUNTIME["phase"] = _PHASE_TRANSPORT_BOUND
+    _NATIVE_RUNTIME["transport"] = transport_name
+    _NATIVE_RUNTIME["entrypoint_path"] = entrypoint_path
+    _NATIVE_RUNTIME["bound_at"] = time.time()
+    _NATIVE_RUNTIME["session_state_dir"] = pinned_state
+    os.environ[SANCTIONED_DAEMON_ENV] = "1"
+    return native_runtime_status()
+
+
+def install_test_native_runtime() -> dict[str, Any]:
+    """Pytest-only seam for hermetic native-transport unit tests (#695).
+
+    Establishes a **test-mode** process-local record so unit tests can exercise
+    gates that require ``is_native_mcp_transport()``. This record:
+
+    - is rejected outside pytest (including a fresh offline interpreter);
+    - never uses production mode;
+    - cannot authorize production Gitea mutation endpoints
+      (:func:`assert_production_mutation_runtime` / production path of
+      :func:`assert_sanctioned_mutation_runtime` when not under pytest).
+
+    There is no public caller-controlled flag that forges production native
+    transport.
+    """
+    global _NATIVE_RUNTIME
+    if not is_pytest_runtime():
+        raise UnsanctionedRuntimeError(
+            "install_test_native_runtime rejected: test-mode native runtime "
+            "is only available under pytest (#695). allow_test_bootstrap and "
+            "similar caller-controlled flags do not exist and cannot authorize "
+            "a fresh offline interpreter."
+        )
+    token, fingerprint = _new_runtime_token()
+    _NATIVE_RUNTIME = {
+        "token": token,
+        "token_fingerprint": fingerprint,
+        "pid": os.getpid(),
+        "started_at": time.time(),
+        "entrypoint": "test_bootstrap",
+        "entrypoint_path": None,
+        "phase": _PHASE_TRANSPORT_BOUND,
+        "transport": "test",
+        "mode": _RUNTIME_MODE_TEST,
+        "bound_at": time.time(),
+    }
+    return native_runtime_status()
+
+
+def clear_native_runtime_for_tests() -> None:
+    """Test helper: drop native runtime (does not clear env)."""
+    global _NATIVE_RUNTIME
+    _NATIVE_RUNTIME = None
+
+
+def pinned_session_state_dir() -> str | None:
+    """Session-state root pinned for this production transport lifetime (#695 AC2).
+
+    When production native transport is bound, durable session proofs must use
+    this directory only. Env overrides of ``GITEA_MCP_SESSION_STATE_DIR`` after
+    bind are ignored so redirected dirs (e.g. ``.mcp_session_701``) cannot
+    manufacture independent decision-lock authority (PR #701 recurrence).
+    """
+    if not is_production_native_mcp_transport():
+        return None
+    pinned = (_NATIVE_RUNTIME or {}).get("session_state_dir")
+    text = (str(pinned) if pinned is not None else "").strip()
+    return text or None
+
+
+def direct_import_env_enabled() -> bool:
+    """True when the legacy direct-import opt-in env is set (never authorizes)."""
+    return (os.environ.get(ALLOW_DIRECT_IMPORT_ENV) or "").strip().lower() in {
+        "1",
+        "true",
+        "yes",
+    }
+
+
+def assert_no_direct_import_bypass(context: str = "mutation") -> None:
+    """Fail closed when GITEA_ALLOW_DIRECT_MCP_IMPORT is used for mutations (#695 AC1).
+
+    The env flag is never a sanctioned recovery path for LLM/agent sessions.
+    Under pytest hermetic tests this is a no-op so unit tests can set the flag
+    to prove it does not grant authority.
+    """
+    if is_pytest_runtime():
+        return
+    if not direct_import_env_enabled():
+        return
+    raise UnsanctionedRuntimeError(
+        f"{ALLOW_DIRECT_IMPORT_ENV} does not authorize {context} (#695 AC1). "
+        "Direct import of gitea_mcp_server mutation tools is forbidden. "
+        "Stop after native MCP failure; reconnect the official MCP daemon. "
+        "Do not set direct-import flags, offline runners, or redirected "
+        f"{SESSION_STATE_DIR_ENV} directories to reconstruct gates."
+    )
+
+
+def is_native_mcp_transport() -> bool:
+    """True when this process holds a transport-bound native runtime (#695)."""
+    if (os.environ.get(FORCE_PROVENANCE_FAIL_ENV) or "").strip() in {
+        "1",
+        "true",
+        "yes",
+    }:
+        return False
+    if _NATIVE_RUNTIME is None:
+        return False
+    if int(_NATIVE_RUNTIME.get("pid") or -1) != os.getpid():
+        return False
+    if not (_NATIVE_RUNTIME.get("token") or "").strip():
+        return False
+    if _NATIVE_RUNTIME.get("phase") != _PHASE_TRANSPORT_BOUND:
+        return False
+    if not (_NATIVE_RUNTIME.get("transport") or "").strip():
+        return False
+    return True
+
+
+def is_production_native_mcp_transport() -> bool:
+    """True only for production-mode, transport-bound native runtime."""
+    if not is_native_mcp_transport():
+        return False
+    return (_NATIVE_RUNTIME or {}).get("mode") == _RUNTIME_MODE_PRODUCTION
+
+
 def is_sanctioned_mcp_daemon() -> bool:
-    if (os.environ.get(SANCTIONED_DAEMON_ENV) or "").strip() in {"1", "true", "yes"}:
-        return True
-    if (os.environ.get(ALLOW_DIRECT_IMPORT_ENV) or "").strip() in {"1", "true", "yes"}:
+    """Backward-compatible name; #695 requires native transport, not env alone."""
+    if is_production_native_mcp_transport():
         return True
     if is_pytest_runtime():
         return True
+    # Explicit direct-import override is for non-LLM operator/test tools only.
+    # It is deliberately ignored when a native runtime is expected for mutations
+    # under LLM sessions (tests use pytest path). Env alone never grants native.
     return False
 
 
-def mark_sanctioned_daemon() -> None:
-    """Call from the official MCP server entrypoint before serving tools."""
-    os.environ[SANCTIONED_DAEMON_ENV] = "1"
+def assert_production_mutation_runtime(context: str = "mutation") -> None:
+    """Fail closed unless production native MCP transport is bound (#695).
+
+    Test-mode bootstrap records and pytest-only hermetic allowances do **not**
+    satisfy this gate. Use for production Gitea mutation endpoints that must
+    never be reachable via test bootstrap.
+    """
+    if is_production_native_mcp_transport():
+        return
+    mode = (_NATIVE_RUNTIME or {}).get("mode")
+    if mode == _RUNTIME_MODE_TEST:
+        raise UnsanctionedRuntimeError(
+            f"Test-mode native runtime cannot authorize production {context} "
+            "(#695). install_test_native_runtime / former allow_test_bootstrap "
+            "must never reach real Gitea mutation endpoints."
+        )
+    assert_sanctioned_mutation_runtime(context)
 
 
 def assert_sanctioned_mutation_runtime(context: str = "mutation") -> None:
-    """Fail closed when server mutation code is used outside the MCP daemon."""
-    if is_sanctioned_mcp_daemon():
+    """Fail closed when mutation code runs outside native MCP transport (#695).
+
+    Under pytest, hermetic unit tests are allowed (profile/permission tests).
+    Outside pytest, requires production-mode transport-bound native runtime.
+    Test-mode records do not authorize non-pytest production mutations.
+    ``GITEA_ALLOW_DIRECT_MCP_IMPORT`` never authorizes mutations (#695 AC1).
+    """
+    if is_pytest_runtime():
         return
+    # AC1: direct-import env is never a mutation recovery path (PR #701).
+    assert_no_direct_import_bypass(context)
+    if is_production_native_mcp_transport():
+        return
+    mode = (_NATIVE_RUNTIME or {}).get("mode")
+    if mode == _RUNTIME_MODE_TEST:
+        raise UnsanctionedRuntimeError(
+            f"Test-mode native runtime cannot authorize production {context} "
+            "(#695). Test bootstrap cannot reach production mutation endpoints."
+        )
+    env_spoof = (os.environ.get(SANCTIONED_DAEMON_ENV) or "").strip() in {
+        "1",
+        "true",
+        "yes",
+    }
+    extra = ""
+    if env_spoof:
+        extra = (
+            f" Note: {SANCTIONED_DAEMON_ENV} alone is not sufficient (#695); "
+            "native transport requires the official MCP entrypoint and a live "
+            "transport bind."
+        )
+    phase = (_NATIVE_RUNTIME or {}).get("phase")
+    if phase == _PHASE_ENTRYPOINT_CLAIMED:
+        extra = (
+            (extra + " ") if extra else " "
+        ) + (
+            "Entrypoint was claimed but native MCP transport was never bound "
+            "(#695); offline launch/import of the real entrypoint does not "
+            "grant mutation authority."
+        )
     raise UnsanctionedRuntimeError(
-        f"Unsanctioned runtime blocked {context} (#558). "
-        "Do not import gitea_mcp_server / call mutation helpers from a raw "
-        "shell or ad-hoc script. Use the official MCP daemon entrypoint "
-        f"(sets {SANCTIONED_DAEMON_ENV}=1), or run under pytest. "
-        f"Operator-only override: {ALLOW_DIRECT_IMPORT_ENV}=1 (not for LLM sessions)."
+        f"Unsanctioned / non-native runtime blocked {context} (#695). "
+        "Do not import gitea_mcp_server or call mutation helpers from a raw "
+        "shell, offline runner, or ad-hoc script after native MCP failure. "
+        "Stop and reconnect the official MCP daemon (mcp_server.py) over "
+        "native transport. "
+        f"Do not set {ALLOW_DIRECT_IMPORT_ENV}, override "
+        f"{SESSION_STATE_DIR_ENV}, or use raw token env vars in LLM "
+        f"sessions.{extra}"
     )
 
 
@@ -69,21 +441,77 @@ def assert_keychain_access_allowed() -> None:
     """Fail closed for git-credential keychain fill outside sanctioned contexts."""
     if is_sanctioned_mcp_daemon():
         return
+    # Operator-only keychain CLI remains available outside LLM mutation path.
     if (os.environ.get(ALLOW_KEYCHAIN_CLI_ENV) or "").strip() in {"1", "true", "yes"}:
-        return
+        if not is_pytest_runtime():
+            # Still block pure env spoof of SANCTIONED_DAEMON for keychain when
+            # FORCE is set for tests.
+            if (os.environ.get(FORCE_PROVENANCE_FAIL_ENV) or "").strip() in {
+                "1",
+                "true",
+                "yes",
+            }:
+                pass
+            else:
+                return
     raise UnsanctionedRuntimeError(
-        "Unsanctioned keychain/credential fill blocked (#558). "
+        "Unsanctioned keychain/credential fill blocked (#558/#695). "
         "Token extraction via git-credential is only allowed inside the "
-        f"official MCP daemon ({SANCTIONED_DAEMON_ENV}=1), pytest, or with "
-        f"explicit operator opt-in {ALLOW_KEYCHAIN_CLI_ENV}=1."
+        f"official native MCP daemon or with explicit operator opt-in "
+        f"{ALLOW_KEYCHAIN_CLI_ENV}=1 (never for offline mutation runners)."
     )
 
 
-def runtime_status() -> dict[str, Any]:
+def native_runtime_status() -> dict[str, Any]:
+    """LLM-safe native runtime status (no raw token)."""
+    rt = _NATIVE_RUNTIME or {}
     return {
-        "sanctioned_daemon": is_sanctioned_mcp_daemon(),
+        "native_mcp_transport": is_native_mcp_transport(),
+        "production_native_mcp_transport": is_production_native_mcp_transport(),
         "pytest": is_pytest_runtime(),
+        "pid": rt.get("pid"),
+        "token_fingerprint": rt.get("token_fingerprint"),
+        "started_at": rt.get("started_at"),
+        "entrypoint": rt.get("entrypoint"),
+        "entrypoint_path": rt.get("entrypoint_path"),
+        "phase": rt.get("phase"),
+        "transport": rt.get("transport"),
+        "mode": rt.get("mode"),
+        "session_state_dir": pinned_session_state_dir() or rt.get("session_state_dir"),
+        "session_state_dir_pinned": pinned_session_state_dir() is not None,
+        "direct_import_env_set": direct_import_env_enabled(),
+        "env_sanctioned_alone_insufficient": True,
         "sanctioned_env": SANCTIONED_DAEMON_ENV,
         "allow_direct_import_env": ALLOW_DIRECT_IMPORT_ENV,
+        "session_state_dir_env": SESSION_STATE_DIR_ENV,
         "allow_keychain_cli_env": ALLOW_KEYCHAIN_CLI_ENV,
     }
+
+
+def runtime_status() -> dict[str, Any]:
+    """Backward-compatible status payload."""
+    status = native_runtime_status()
+    status["sanctioned_daemon"] = is_sanctioned_mcp_daemon()
+    return status
+
+
+def mutation_provenance_fields() -> dict[str, Any]:
+    """Fields to attach to live mutation / review audit records (#695 AC6)."""
+    st = native_runtime_status()
+    transport = "native_mcp" if st["native_mcp_transport"] else "untrusted"
+    if st.get("mode") == _RUNTIME_MODE_TEST and st["native_mcp_transport"]:
+        transport = "test_native_mcp"
+    return {
+        "transport": transport,
+        "native_mcp_transport": bool(st["native_mcp_transport"]),
+        "production_native_mcp_transport": bool(
+            st.get("production_native_mcp_transport")
+        ),
+        "native_runtime_pid": st.get("pid"),
+        "native_token_fingerprint": st.get("token_fingerprint"),
+        "entrypoint": st.get("entrypoint"),
+        "phase": st.get("phase"),
+        "mode": st.get("mode"),
+        "session_state_dir": st.get("session_state_dir"),
+        "session_state_dir_pinned": bool(st.get("session_state_dir_pinned")),
+    }
diff --git a/mcp_server.py b/mcp_server.py
index f4ba642..02606dd 100644
--- a/mcp_server.py
+++ b/mcp_server.py
@@ -41,15 +41,17 @@ def check_conflict_markers():
 
 check_conflict_markers()
 
-# #558: official entrypoint marks the process as the sanctioned MCP daemon
-# before loading mutation modules (blocks raw shell import bypasses).
+# #558 / #695: claim the official entrypoint before loading mutation modules.
+# This alone does NOT authorize mutations — gitea_mcp_server binds the live
+# native MCP transport (stdio) immediately before mcp.run. Import-only or
+# offline launch without that bind fails closed on mutations.
 try:
     import mcp_daemon_guard
 
     mcp_daemon_guard.mark_sanctioned_daemon()
 except Exception:
     # Guard import failures must not hide conflict-marker infra_stop above;
-    # gitea_mcp_server main also marks sanctioned when run as __main__.
+    # gitea_mcp_server main also marks + binds when run as __main__.
     pass
 
 # Execute the actual server logic via exec in this namespace.
diff --git a/mcp_session_state.py b/mcp_session_state.py
index 330cf42..1f1a28d 100644
--- a/mcp_session_state.py
+++ b/mcp_session_state.py
@@ -45,17 +45,34 @@ KIND_REVIEWER_SESSION_LEASE = "reviewer_session_lease"
 # Durable audit record written whenever the daemon's sanctioned stale-binding
 # recovery clears an inherited GITEA_ACTIVE_WORKTREE binding (#702).
 KIND_STALE_BINDING_RECOVERY = "stale_binding_recovery"
+# #709: archive prior terminal decision ledgers instead of silent overwrite.
+KIND_DECISION_LOCK_ARCHIVE = "review_decision_lock_archive"
+# #709: post-merge cleanup/audit reconciliation-required durable record.
+KIND_POST_MERGE_DECISION_RECOVERY = "post_merge_decision_recovery"
+# #709: truthful record when historical terminal evidence is irrecoverably gone.
+KIND_IRRECOVERABLE_DECISION_PROVENANCE = "irrecoverable_decision_provenance"
+# #709 F1: server-side non-forgeable authorization artifact for recovery.
+KIND_IRRECOVERABLE_PROVENANCE_AUTH = "irrecoverable_provenance_authorization"
 
-# Kinds that carry recovery-critical crash-orphan evidence (#702). They are
-# exempt from TTL expiry: a crashed daemon can never refresh its own record,
-# so a wall-clock TTL would silently destroy the only owner-exit proof the
-# guarded cleanup path accepts. These records live until a sanctioned clear
-# terminally reconciles them (durable lifecycle), never until a timer fires.
-RECOVERY_CRITICAL_KINDS = frozenset({
-    KIND_REVIEWER_SESSION_LEASE,
-    KIND_STALE_BINDING_RECOVERY,
-})
-
+# Kinds that must survive the default session-state TTL (forensic / recovery).
+#
+# KIND_DECISION_LOCK is recovery-critical (#720): terminal review provenance is
+# not disposable cache. A generic four-hour TTL must not drop old-head evidence
+# or make ``fresh_review_on_current_head_allowed`` unreachable. Same-head / same-
+# run #332 protections still apply once the ledger is loadable. Other session
+# kinds (workflow load, drafts, etc.) remain TTL-bound.
+RECOVERY_CRITICAL_KINDS = frozenset(
+    {
+        KIND_DECISION_LOCK,
+        KIND_DECISION_LOCK_ARCHIVE,
+        KIND_POST_MERGE_DECISION_RECOVERY,
+        KIND_IRRECOVERABLE_DECISION_PROVENANCE,
+        KIND_IRRECOVERABLE_PROVENANCE_AUTH,
+        # #702 crash-orphan evidence (must outlive TTL; F4)
+        KIND_REVIEWER_SESSION_LEASE,
+        KIND_STALE_BINDING_RECOVERY,
+    }
+)
 
 
 _SAFE_SEGMENT_RE = re.compile(r"[^A-Za-z0-9._+-]+")
@@ -63,6 +80,34 @@ SESSION_PROFILE_LOCK_ENV = "GITEA_SESSION_PROFILE_LOCK"
 
 
 def default_state_dir() -> str:
+    """Resolve the durable session-state root.
+
+    When production native MCP transport is bound (#695 AC2), the directory
+    pinned at transport bind is authoritative: later overrides of
+    ``GITEA_MCP_SESSION_STATE_DIR`` cannot manufacture a second authority
+    domain (PR #701 recurrence: ``.mcp_session_701`` evasion of cross-PR
+    decision locks).
+    """
+    try:
+        import mcp_daemon_guard
+
+        pinned = mcp_daemon_guard.pinned_session_state_dir()
+        if pinned:
+            return pinned
+    except Exception:
+        # Fail open to env/default only when guard is unavailable (e.g. partial
+        # import during bootstrap). Mutation gates still fail closed separately.
+        pass
+    raw = (os.environ.get(STATE_DIR_ENV) or DEFAULT_STATE_DIR).strip()
+    return raw or DEFAULT_STATE_DIR
+
+
+def env_session_state_dir_unpinned() -> str:
+    """Raw env/default session-state dir ignoring production transport pin.
+
+    Intended for diagnostics and tests that assert pin behavior — not for
+    mutation-sensitive durable proofs under a bound native daemon.
+    """
     raw = (os.environ.get(STATE_DIR_ENV) or DEFAULT_STATE_DIR).strip()
     return raw or DEFAULT_STATE_DIR
 
@@ -225,6 +270,16 @@ def _write_json(path: str, data: dict[str, Any]) -> None:
                 pass
 
 
+def is_recovery_critical_record(record: dict[str, Any] | None, kind: str | None = None) -> bool:
+    """True when a durable record must outlive the generic session-state TTL."""
+    if not record and not kind:
+        return False
+    record_kind = ((record or {}).get("kind") or kind or "").strip()
+    if record_kind in RECOVERY_CRITICAL_KINDS:
+        return True
+    return bool((record or {}).get("recovery_critical"))
+
+
 def identity_match_reasons(
     record: dict[str, Any] | None,
     *,
@@ -267,17 +322,124 @@ def identity_match_reasons(
         reasons.append("session state missing recorded_at timestamp (fail closed)")
     else:
         age = _now_utc() - recorded_at
-        record_kind = (str(record.get("kind") or "")).strip()
-        if age > timedelta(hours=ttl_hours()):
-            if record_kind not in RECOVERY_CRITICAL_KINDS:
-                reasons.append(
-                    f"session state expired after {ttl_hours():g}h (fail closed)"
-                )
+        kind = (record.get("kind") or "").strip()
+        ttl_exempt = is_recovery_critical_record(record, kind=kind)
+        if age > timedelta(hours=ttl_hours()) and not ttl_exempt:
+            reasons.append(
+                f"session state expired after {ttl_hours():g}h (fail closed)"
+            )
         if age < timedelta(0):
             reasons.append("session state recorded_at is in the future (fail closed)")
     return reasons
 
 
+def inspect_state_envelope(
+    *,
+    kind: str,
+    remote: str | None = None,
+    org: str | None = None,
+    repo: str | None = None,
+    profile_identity: str | None = None,
+    state_dir: str | None = None,
+) -> dict[str, Any]:
+    """Read-only disk inspection for assessment when TTL would otherwise hide state (#720).
+
+    Does **not** apply identity/TTL rejection to the returned presence flags.
+    Callers use this to distinguish:
+      * no file on disk
+      * file present but TTL would reject a non-critical kind
+      * recovery-critical ledger (e.g. KIND_DECISION_LOCK) still loadable
+    Never mutates files. Never returns secrets.
+    """
+    profile = current_profile_identity(profile_identity=profile_identity)
+    path = state_file_path(
+        kind=kind,
+        remote=remote,
+        org=org,
+        repo=repo,
+        profile_identity=profile,
+        state_dir=state_dir,
+    )
+    result: dict[str, Any] = {
+        "kind": kind,
+        "profile_identity": profile,
+        "path_basename": os.path.basename(path),
+        "on_disk": False,
+        "has_payload": False,
+        "recorded_at": None,
+        "updated_at": None,
+        "age_hours": None,
+        "ttl_hours": ttl_hours(),
+        "age_exceeds_default_ttl": False,
+        "recovery_critical": kind in RECOVERY_CRITICAL_KINDS,
+        "ttl_exempt": kind in RECOVERY_CRITICAL_KINDS,
+        "would_ttl_reject": False,
+        "identity_reasons": [],
+        "summary": "no session-state file on disk",
+    }
+    if not path or not os.path.exists(path):
+        return result
+    result["on_disk"] = True
+    envelope = _read_json(path)
+    if not envelope:
+        result["summary"] = "session-state file present but unreadable or empty"
+        return result
+    payload = envelope.get("payload")
+    merged: dict[str, Any] = dict(payload) if isinstance(payload, dict) else {}
+    result["has_payload"] = isinstance(payload, dict)
+    for key in (
+        "kind",
+        "remote",
+        "org",
+        "repo",
+        "profile_identity",
+        "session_profile_lock",
+        "recorded_at",
+        "updated_at",
+        "writer_pid",
+        "recovery_critical",
+    ):
+        if key in envelope and key not in merged:
+            merged[key] = envelope[key]
+    if not merged.get("kind"):
+        merged["kind"] = kind
+    recorded_at = _parse_iso(merged.get("recorded_at") or merged.get("updated_at"))
+    result["recorded_at"] = merged.get("recorded_at") or merged.get("updated_at")
+    result["updated_at"] = merged.get("updated_at") or merged.get("recorded_at")
+    if recorded_at is not None:
+        age = _now_utc() - recorded_at
+        age_hours = age.total_seconds() / 3600.0
+        result["age_hours"] = age_hours
+        result["age_exceeds_default_ttl"] = age > timedelta(hours=ttl_hours())
+    ttl_exempt = is_recovery_critical_record(merged, kind=kind)
+    result["recovery_critical"] = ttl_exempt
+    result["ttl_exempt"] = ttl_exempt
+    identity_reasons = identity_match_reasons(
+        merged,
+        remote=remote,
+        org=org,
+        repo=repo,
+        profile_identity=profile,
+    )
+    result["identity_reasons"] = list(identity_reasons)
+    result["would_ttl_reject"] = any("expired" in r for r in identity_reasons)
+    if result["has_payload"] and ttl_exempt:
+        result["summary"] = (
+            "recovery-critical session-state present on disk and TTL-exempt; "
+            "load via load_state for full payload"
+        )
+    elif result["has_payload"] and result["would_ttl_reject"]:
+        result["summary"] = (
+            "session-state file present on disk but generic TTL would reject load "
+            f"(age_hours={result.get('age_hours')!r}, ttl={ttl_hours():g}h)"
+        )
+    elif result["has_payload"]:
+        result["summary"] = "session-state file present and within TTL / identity gates"
+    else:
+        result["summary"] = "session-state file present without a dict payload"
+    return result
+
+
 def load_state(
     *,
     kind: str,
@@ -356,6 +518,11 @@ def save_state(
     key_remote = remote if remote is not None else (payload or {}).get("remote")
     key_org = org if org is not None else (payload or {}).get("org")
     key_repo = repo if repo is not None else (payload or {}).get("repo")
+    key_instance = (
+        (instance_id or "").strip()
+        or str((payload or {}).get("instance_id") or "").strip()
+        or None
+    )
 
     root = _ensure_state_dir(state_dir)
     path = state_file_path(
@@ -365,7 +532,7 @@ def save_state(
         repo=key_repo,
         profile_identity=profile,
         state_dir=root,
-        instance_id=instance_id,
+        instance_id=key_instance,
     )
     lock_path = f"{path}.lock"
     with _exclusive_file_lock(lock_path):
@@ -387,14 +554,34 @@ def save_state(
             body["session_profile_lock"] = profile
         body["recorded_at"] = body.get("recorded_at") or now
         body["updated_at"] = now
-        if (instance_id or "").strip():
-            body["instance_id"] = instance_id.strip()
         if key_remote is not None:
             body["remote"] = key_remote
         if key_org is not None:
             body["org"] = key_org
         if key_repo is not None:
             body["repo"] = key_repo
+        # Stamp session-state authority used for this write (#695 AC2 / AC6).
+        body.setdefault("session_state_dir", root)
+        if key_instance:
+            body["instance_id"] = key_instance
+        try:
+            import mcp_daemon_guard
+
+            prov = mcp_daemon_guard.mutation_provenance_fields()
+            body.setdefault(
+                "native_token_fingerprint", prov.get("native_token_fingerprint")
+            )
+            body.setdefault(
+                "native_mcp_transport", bool(prov.get("native_mcp_transport"))
+            )
+            body.setdefault(
+                "production_native_mcp_transport",
+                bool(prov.get("production_native_mcp_transport")),
+            )
+            body.setdefault("transport", prov.get("transport"))
+        except Exception:
+            body.setdefault("native_mcp_transport", False)
+            body.setdefault("transport", "untrusted")
 
         envelope = {
             "kind": kind,
@@ -406,8 +593,12 @@ def save_state(
             "recorded_at": body["recorded_at"],
             "updated_at": body["updated_at"],
             "writer_pid": body["writer_pid"],
+            "session_state_dir": body.get("session_state_dir"),
+            "transport": body.get("transport"),
             "payload": body,
         }
+        if key_instance:
+            envelope["instance_id"] = key_instance
         _write_json(path, envelope)
         return dict(body)
 
@@ -433,7 +624,6 @@ def clear_state(
         instance_id=instance_id,
     )
 
-
 def list_states(
     *,
     kind: str,
@@ -483,3 +673,177 @@ def list_states(
             continue
         results.append(merged)
     return results
+
+def list_decision_lock_profile_identities(
+    state_dir: str | None = None,
+) -> list[str]:
+    """Return profile identities that have a durable review_decision_lock file (#709).
+
+    Filename form: ``review_decision_lock-<profile>.json`` (see ``state_key``).
+    Does not validate TTL or identity — callers must load via ``load_state``.
+    """
+    root = (state_dir or default_state_dir()).strip()
+    if not root or not os.path.isdir(root):
+        return []
+    prefix = f"{_sanitize_segment(KIND_DECISION_LOCK)}-"
+    suffix = ".json"
+    found: list[str] = []
+    try:
+        names = os.listdir(root)
+    except OSError:
+        return []
+    for name in names:
+        if not name.startswith(prefix) or not name.endswith(suffix):
+            continue
+        if name.endswith(".lock"):
+            continue
+        mid = name[len(prefix) : -len(suffix)]
+        if mid:
+            found.append(mid)
+    return sorted(set(found))
+
+
+def load_state_for_profile(
+    *,
+    kind: str,
+    profile_identity: str,
+    remote: str | None = None,
+    org: str | None = None,
+    repo: str | None = None,
+    state_dir: str | None = None,
+    skip_identity_match: bool = False,
+    enforce_repo_scope: bool = True,
+) -> dict[str, Any] | None:
+    """Load durable state for an explicit profile identity (#709 cross-profile).
+
+    When *skip_identity_match* is True, still requires the file's recorded
+    profile_identity to equal the requested profile (anti-stomp), but does not
+    require the *active* session identity to match — needed so a merger can
+    inspect a reviewer lock after merge.
+
+    #709 F3: remote/org/repo filter reasons are **enforced** (not merely
+    computed). When *enforce_repo_scope* is True (default) and the caller
+    supplies remote/org/repo, mismatches fail closed with ``None``.
+    """
+    # #709 F3: refuse traversal / malformed profile identities.
+    try:
+        from irrecoverable_provenance import assess_profile_path_identity
+
+        path_gate = assess_profile_path_identity(profile_identity)
+        if not path_gate.get("valid"):
+            return None
+    except Exception:
+        # Module may be mid-import in edge bootstraps; fall through to
+        # conservative checks below.
+        raw = str(profile_identity or "")
+        if ".." in raw or "/" in raw or "\\" in raw or "\x00" in raw:
+            return None
+
+    profile = current_profile_identity(profile_identity=profile_identity)
+    root = _ensure_state_dir(state_dir)
+    # Refuse symlink escape of the state root (#709 F3).
+    try:
+        real_root = os.path.realpath(root)
+        path = state_file_path(
+            kind=kind,
+            remote=remote,
+            org=org,
+            repo=repo,
+            profile_identity=profile,
+            state_dir=root,
+        )
+        real_path = os.path.realpath(path) if os.path.exists(path) else path
+        if os.path.exists(path) and not str(real_path).startswith(
+            str(real_root) + os.sep
+        ) and str(real_path) != str(real_root):
+            return None
+    except OSError:
+        return None
+
+    path = state_file_path(
+        kind=kind,
+        remote=remote,
+        org=org,
+        repo=repo,
+        profile_identity=profile,
+        state_dir=root,
+    )
+    lock_path = f"{path}.lock"
+    with _exclusive_file_lock(lock_path):
+        envelope = _read_json(path)
+    if not envelope:
+        return None
+    payload = envelope.get("payload")
+    if not isinstance(payload, dict):
+        return None
+    merged = dict(payload)
+    for key in (
+        "kind",
+        "remote",
+        "org",
+        "repo",
+        "profile_identity",
+        "session_profile_lock",
+        "recorded_at",
+        "updated_at",
+        "writer_pid",
+    ):
+        if key in envelope and key not in merged:
+            merged[key] = envelope[key]
+    stored = (merged.get("profile_identity") or "").strip()
+    if stored and stored != profile:
+        return None
+    if skip_identity_match:
+        # Enforce remote/org/repo when caller provides them (#709 F3).
+        # Drop only *active session* profile-identity mismatches; keep
+        # expiry, spoof, and repository-scope reasons.
+        scope_remote = remote if enforce_repo_scope else None
+        scope_org = org if enforce_repo_scope else None
+        scope_repo = repo if enforce_repo_scope else None
+        reasons = identity_match_reasons(
+            merged,
+            remote=scope_remote,
+            org=scope_org,
+            repo=scope_repo,
+            profile_identity=stored or profile,
+        )
+        filtered = [
+            r
+            for r in reasons
+            if "profile identity mismatch" not in r
+            or (stored and stored != profile)
+        ]
+        # When caller requested a specific remote/org/repo, also fail if the
+        # stored record lacks those identity fields entirely (legacy incomplete).
+        if enforce_repo_scope:
+            for field, want in (
+                ("remote", remote),
+                ("org", org),
+                ("repo", repo),
+            ):
+                want_s = (want or "").strip()
+                if not want_s:
+                    continue
+                have = (str(merged.get(field) or "")).strip()
+                if not have:
+                    filtered.append(
+                        f"session state {field} missing on durable record "
+                        f"(expected={want_s!r}; fail closed, #709 F3)"
+                    )
+                elif have != want_s:
+                    # identity_match_reasons already adds mismatch; ensure kept
+                    pass
+        if filtered:
+            return None
+        return merged
+    reasons = identity_match_reasons(
+        merged,
+        remote=remote,
+        org=org,
+        repo=repo,
+        profile_identity=profile,
+    )
+    if reasons:
+        return None
+    return merged
+
diff --git a/mcp_tool_error_boundary.py b/mcp_tool_error_boundary.py
new file mode 100644
index 0000000..81f6828
--- /dev/null
+++ b/mcp_tool_error_boundary.py
@@ -0,0 +1,451 @@
+"""MCP tool-boundary error mapping for known Gitea client failures (#699).
+
+Known authentication / authorization / network / configuration failures leave
+the tool boundary as a sanitized structured ``CallToolResult`` with
+``isError=True``. Stdio transport remains connected.
+
+Design constraints (reviewer-ratified, #699 / PR #701):
+
+1. **No secret material** in tool results or daemon logs. Messages are fixed
+   constants keyed by ``reason_code``; HTTP bodies / exception text never
+   surface. Sanitization failure fails closed to ``internal_error``.
+2. **Narrow boundary** wraps the original FastMCP ``Tool.run`` success path;
+   re-raises framework control-flow exceptions (``UrlElicitationRequiredError``);
+   maps only typed client failures. Installation is idempotent.
+3. **No RuntimeError substring heuristics.** Only explicit typed
+   authentication / authorization / network / configuration exceptions
+   receive those labels.
+4. **HTTP classification** lives in ``gitea_auth.classify_http_status``;
+   every 403 is authorization-class.
+"""
+
+from __future__ import annotations
+
+import json
+import logging
+import sys
+from typing import Any
+
+logger = logging.getLogger("gitea_mcp.tool_error_boundary")
+
+# Stable reason codes (#699).
+REASON_AUTH_FAILED = "auth_failed"
+REASON_AUTH_INVALID_TOKEN = "auth_invalid_token"
+REASON_AUTHZ_INSUFFICIENT_SCOPE = "authz_insufficient_scope"
+REASON_AUTHZ_DENIED = "authz_denied"
+REASON_NETWORK_ERROR = "network_error"
+REASON_CONFIG_ERROR = "config_error"
+REASON_INTERNAL_ERROR = "internal_error"
+REASON_UPSTREAM_UNAVAILABLE = "upstream_unavailable"
+REASON_HTTP_ERROR = "http_error"
+
+ERROR_CLASS_AUTHENTICATION = "authentication"
+ERROR_CLASS_AUTHORIZATION = "authorization"
+ERROR_CLASS_NETWORK = "network"
+ERROR_CLASS_CONFIGURATION = "configuration"
+ERROR_CLASS_INTERNAL = "internal"
+ERROR_CLASS_UPSTREAM = "upstream"
+
+# Fixed, secret-free operator messages. Never interpolate HTTP bodies,
+# Keychain contents, tokens, or arbitrary exception text.
+FIXED_MESSAGES: dict[str, str] = {
+    REASON_AUTH_FAILED: "Gitea authentication failed",
+    REASON_AUTH_INVALID_TOKEN: (
+        "Gitea authentication failed: invalid or revoked credentials"
+    ),
+    REASON_AUTHZ_INSUFFICIENT_SCOPE: (
+        "Gitea authorization failed: insufficient token scope"
+    ),
+    REASON_AUTHZ_DENIED: "Gitea authorization failed: access denied",
+    REASON_NETWORK_ERROR: "Network error contacting Gitea",
+    REASON_CONFIG_ERROR: "Gitea configuration or credential resolution failed",
+    REASON_INTERNAL_ERROR: "Internal tool error",
+    REASON_UPSTREAM_UNAVAILABLE: "Gitea upstream unavailable",
+    REASON_HTTP_ERROR: "Gitea HTTP request failed",
+}
+
+_INSTALL_FLAG = "_gitea_auth_boundary_installed"
+_ORIGINAL_ATTR = "_gitea_auth_boundary_original"
+
+
+def fixed_message(reason_code: str) -> str:
+    """Return the fixed sanitized message for *reason_code* (fail closed)."""
+    return FIXED_MESSAGES.get(reason_code, FIXED_MESSAGES[REASON_INTERNAL_ERROR])
+
+
+def _safe_profile_name() -> str | None:
+    try:
+        from gitea_auth import get_profile
+
+        name = (get_profile() or {}).get("profile_name")
+        if name is None:
+            return None
+        text = str(name).strip()
+        # Profile names are non-secret identifiers; still bound length.
+        return text[:80] if text else None
+    except Exception:
+        return None
+
+
+def _is_framework_control_flow(exc: BaseException) -> bool:
+    """True for exceptions the MCP framework must re-raise unchanged."""
+    try:
+        from mcp.shared.exceptions import UrlElicitationRequiredError
+
+        if isinstance(exc, UrlElicitationRequiredError):
+            return True
+    except Exception:
+        pass
+    # BaseException subclasses that must never become tool isError payloads.
+    if isinstance(exc, (KeyboardInterrupt, SystemExit, GeneratorExit)):
+        return True
+    return False
+
+
+def is_known_client_failure(exc: BaseException) -> bool:
+    """True only for explicit typed Gitea client / config failures.
+
+    Never true for arbitrary ``RuntimeError`` (reviewer finding #3).
+    """
+    try:
+        import gitea_auth
+
+        if isinstance(
+            exc,
+            (
+                gitea_auth.GiteaAuthError,
+                gitea_auth.GiteaAuthzError,
+                gitea_auth.GiteaNetworkError,
+                gitea_auth.GiteaConfigError,
+                gitea_auth.GiteaHttpError,
+            ),
+        ):
+            return True
+    except Exception:
+        return False
+    try:
+        import gitea_config
+
+        if isinstance(exc, gitea_config.ConfigError):
+            return True
+    except Exception:
+        pass
+    return False
+
+
+def classify_exception(exc: BaseException) -> dict[str, Any]:
+    """Return structured classification with **fixed** messages only.
+
+    Only typed authentication / authorization / network / configuration
+    failures receive those labels. Unexpected programming failures are
+    ``internal_error``. HTTP bodies and exception text are never copied
+    into ``message``.
+    """
+    try:
+        return _classify_exception_impl(exc)
+    except Exception:
+        # Fail closed: sanitization / classification failure must not leak.
+        return {
+            "reason_code": REASON_INTERNAL_ERROR,
+            "error_class": ERROR_CLASS_INTERNAL,
+            "http_status": None,
+            "message": fixed_message(REASON_INTERNAL_ERROR),
+            "transport_survives": True,
+        }
+
+
+def _classify_exception_impl(exc: BaseException) -> dict[str, Any]:
+    import gitea_auth
+
+    if isinstance(exc, gitea_auth.GiteaAuthError):
+        code = getattr(exc, "reason_code", None) or REASON_AUTH_INVALID_TOKEN
+        if code not in (
+            REASON_AUTH_FAILED,
+            REASON_AUTH_INVALID_TOKEN,
+        ):
+            code = REASON_AUTH_INVALID_TOKEN
+        return {
+            "reason_code": code,
+            "error_class": ERROR_CLASS_AUTHENTICATION,
+            "http_status": getattr(exc, "http_status", None) or 401,
+            "message": fixed_message(code),
+            "transport_survives": True,
+        }
+    if isinstance(exc, gitea_auth.GiteaAuthzError):
+        code = getattr(exc, "reason_code", None) or REASON_AUTHZ_DENIED
+        if code not in (REASON_AUTHZ_DENIED, REASON_AUTHZ_INSUFFICIENT_SCOPE):
+            code = REASON_AUTHZ_DENIED
+        return {
+            "reason_code": code,
+            "error_class": ERROR_CLASS_AUTHORIZATION,
+            "http_status": getattr(exc, "http_status", None) or 403,
+            "message": fixed_message(code),
+            "transport_survives": True,
+        }
+    if isinstance(exc, gitea_auth.GiteaNetworkError):
+        return {
+            "reason_code": REASON_NETWORK_ERROR,
+            "error_class": ERROR_CLASS_NETWORK,
+            "http_status": getattr(exc, "http_status", None),
+            "message": fixed_message(REASON_NETWORK_ERROR),
+            "transport_survives": True,
+        }
+    if isinstance(exc, gitea_auth.GiteaConfigError):
+        return {
+            "reason_code": REASON_CONFIG_ERROR,
+            "error_class": ERROR_CLASS_CONFIGURATION,
+            "http_status": getattr(exc, "http_status", None),
+            "message": fixed_message(REASON_CONFIG_ERROR),
+            "transport_survives": True,
+        }
+    if isinstance(exc, gitea_auth.GiteaHttpError):
+        code = getattr(exc, "reason_code", None) or REASON_HTTP_ERROR
+        if code == REASON_UPSTREAM_UNAVAILABLE:
+            error_class = ERROR_CLASS_UPSTREAM
+        else:
+            error_class = ERROR_CLASS_INTERNAL
+            code = REASON_HTTP_ERROR
+        return {
+            "reason_code": code,
+            "error_class": error_class,
+            "http_status": getattr(exc, "http_status", None),
+            "message": fixed_message(code),
+            "transport_survives": True,
+        }
+
+    try:
+        import gitea_config
+
+        if isinstance(exc, gitea_config.ConfigError):
+            return {
+                "reason_code": REASON_CONFIG_ERROR,
+                "error_class": ERROR_CLASS_CONFIGURATION,
+                "http_status": None,
+                "message": fixed_message(REASON_CONFIG_ERROR),
+                "transport_survives": True,
+            }
+    except Exception:
+        pass
+
+    # Unwrap FastMCP ToolError cause when the original was a typed failure.
+    cause = getattr(exc, "__cause__", None)
+    if cause is not None and cause is not exc and is_known_client_failure(cause):
+        return _classify_exception_impl(cause)
+
+    # No message-substring authentication heuristics (reviewer finding #3).
+    return {
+        "reason_code": REASON_INTERNAL_ERROR,
+        "error_class": ERROR_CLASS_INTERNAL,
+        "http_status": None,
+        "message": fixed_message(REASON_INTERNAL_ERROR),
+        "transport_survives": True,
+    }
+
+
+def build_structured_error_payload(
+    classification: dict[str, Any],
+    *,
+    tool_name: str | None = None,
+    profile_name: str | None = None,
+) -> dict[str, Any]:
+    """LLM-safe structured payload — fixed message + typed metadata only."""
+    try:
+        reason = str(classification.get("reason_code") or REASON_INTERNAL_ERROR)
+        message = fixed_message(reason)
+        # Refuse to emit any classification message that is not the fixed constant.
+        if classification.get("message") != message:
+            message = fixed_message(reason)
+        payload: dict[str, Any] = {
+            "success": False,
+            "isError": True,
+            "reason_code": reason if reason in FIXED_MESSAGES else REASON_INTERNAL_ERROR,
+            "error_class": classification.get("error_class") or ERROR_CLASS_INTERNAL,
+            "message": message,
+            "transport_survives": True,
+            "retryable": classification.get("error_class")
+            in {
+                ERROR_CLASS_AUTHENTICATION,
+                ERROR_CLASS_NETWORK,
+                ERROR_CLASS_CONFIGURATION,
+            },
+        }
+        status = classification.get("http_status")
+        if isinstance(status, int):
+            payload["http_status"] = status
+        if tool_name and isinstance(tool_name, str):
+            # Tool names are identifiers, not secrets; bound length.
+            payload["tool"] = tool_name[:120]
+        if profile_name and isinstance(profile_name, str):
+            payload["profile"] = profile_name[:80]
+        return payload
+    except Exception:
+        return {
+            "success": False,
+            "isError": True,
+            "reason_code": REASON_INTERNAL_ERROR,
+            "error_class": ERROR_CLASS_INTERNAL,
+            "message": fixed_message(REASON_INTERNAL_ERROR),
+            "transport_survives": True,
+            "retryable": False,
+        }
+
+
+def log_sanitized_daemon_reason(
+    classification: dict[str, Any],
+    *,
+    tool_name: str | None = None,
+    stream=None,
+) -> None:
+    """Daemon log: reason codes only — never exception text or response bodies."""
+    stream = stream if stream is not None else sys.stderr
+    try:
+        reason = classification.get("reason_code") or REASON_INTERNAL_ERROR
+        error_class = classification.get("error_class") or ERROR_CLASS_INTERNAL
+        # Only emit known tokens; never classification['message'] from callers
+        # that might have been poisoned.
+        if reason not in FIXED_MESSAGES:
+            reason = REASON_INTERNAL_ERROR
+            error_class = ERROR_CLASS_INTERNAL
+        parts = [
+            "mcp_tool_error",
+            f"reason_code={reason}",
+            f"error_class={error_class}",
+        ]
+        if tool_name and isinstance(tool_name, str):
+            parts.append(f"tool={tool_name[:120]}")
+        status = classification.get("http_status")
+        if isinstance(status, int):
+            parts.append(f"http_status={status}")
+        # Intentionally no detail= / message= field — secrets lived there.
+        line = " ".join(parts)
+        stream.write(line + "\n")
+        if hasattr(stream, "flush"):
+            stream.flush()
+        logger.warning(line)
+    except Exception:
+        # Fail closed: never fall back to logging the exception.
+        try:
+            stream.write(
+                "mcp_tool_error reason_code=internal_error "
+                "error_class=internal\n"
+            )
+            if hasattr(stream, "flush"):
+                stream.flush()
+        except Exception:
+            pass
+
+
+def to_call_tool_result(
+    exc: BaseException,
+    *,
+    tool_name: str | None = None,
+    profile_name: str | None = None,
+    log: bool = True,
+) -> Any:
+    """Build a FastMCP ``CallToolResult`` with ``isError=True`` for *exc*."""
+    from mcp.types import CallToolResult, TextContent
+
+    try:
+        classification = classify_exception(exc)
+        if log:
+            log_sanitized_daemon_reason(classification, tool_name=tool_name)
+        payload = build_structured_error_payload(
+            classification, tool_name=tool_name, profile_name=profile_name
+        )
+        text = json.dumps(payload, indent=2, sort_keys=True)
+        return CallToolResult(
+            content=[TextContent(type="text", text=text)],
+            structuredContent=payload,
+            isError=True,
+        )
+    except Exception:
+        # Absolute fail-closed path — no exception text.
+        fallback = {
+            "success": False,
+            "isError": True,
+            "reason_code": REASON_INTERNAL_ERROR,
+            "error_class": ERROR_CLASS_INTERNAL,
+            "message": fixed_message(REASON_INTERNAL_ERROR),
+            "transport_survives": True,
+            "retryable": False,
+        }
+        return CallToolResult(
+            content=[
+                TextContent(
+                    type="text",
+                    text=json.dumps(fallback, indent=2, sort_keys=True),
+                )
+            ],
+            structuredContent=fallback,
+            isError=True,
+        )
+
+
+def install_tool_run_boundary(Tool) -> bool:
+    """Install a **narrow** error boundary around FastMCP ``Tool.run``.
+
+    Strategy (preserves framework semantics):
+
+    * Call the **original** ``Tool.run`` for the success path (async, return
+      types, convert_result, protocol behavior unchanged).
+    * Re-raise ``UrlElicitationRequiredError`` and other control-flow
+      exceptions without mapping to ``internal_error``.
+    * Map typed Gitea client failures (and ToolError whose ``__cause__`` is
+      typed) to structured ``CallToolResult(isError=True)``.
+    * Map remaining unexpected tool failures to fixed ``internal_error``
+      isError results (transport survival) without secret-bearing text.
+    * Idempotent: second install is a no-op and returns ``False``.
+    """
+    if getattr(Tool.run, _INSTALL_FLAG, False):
+        return False
+
+    from mcp.server.fastmcp.exceptions import ToolError
+    from mcp.shared.exceptions import UrlElicitationRequiredError
+
+    original_run = Tool.run
+
+    async def run_boundary(
+        self,
+        arguments: dict[str, Any],
+        context=None,
+        convert_result: bool = False,
+    ) -> Any:
+        try:
+            return await original_run(
+                self,
+                arguments,
+                context=context,
+                convert_result=convert_result,
+            )
+        except UrlElicitationRequiredError:
+            # Framework control-flow — must not become internal_error.
+            raise
+        except BaseException as exc:
+            if _is_framework_control_flow(exc):
+                raise
+            if not isinstance(exc, Exception):
+                raise
+
+            # Prefer typed cause under FastMCP ToolError wrappers.
+            target: BaseException = exc
+            if isinstance(exc, ToolError) and exc.__cause__ is not None:
+                target = exc.__cause__
+
+            # Known client failures → structured isError with reason codes.
+            # Unexpected failures → fixed internal_error isError (no secrets).
+            profile_name = _safe_profile_name()
+            return to_call_tool_result(
+                target,
+                tool_name=getattr(self, "name", None),
+                profile_name=profile_name,
+            )
+
+    setattr(run_boundary, _INSTALL_FLAG, True)
+    setattr(run_boundary, _ORIGINAL_ATTR, original_run)
+    Tool.run = run_boundary  # type: ignore[method-assign]
+    return True
+
+
+def boundary_is_installed(Tool) -> bool:
+    """True when the #699 boundary is active on *Tool.run*."""
+    return bool(getattr(Tool.run, _INSTALL_FLAG, False))
diff --git a/merge_approval_gate.py b/merge_approval_gate.py
index 08fc8ad..429ca59 100644
--- a/merge_approval_gate.py
+++ b/merge_approval_gate.py
@@ -1,7 +1,8 @@
-"""Merge approval must pin the current PR head SHA (#471).
+"""Merge approval must pin the current PR head SHA (#471 / #695).
 
 Formal APPROVED reviews that predate the live PR head must not satisfy
-``gitea_merge_pr`` eligibility. Pure assessment helpers are isolated here
+``gitea_merge_pr`` eligibility. Contaminated / quarantined approvals (#695)
+must not authorize merge either. Pure assessment helpers are isolated here
 for hermetic unit tests apart from MCP HTTP calls.
 """
 
@@ -12,6 +13,7 @@ def assess_merge_approval_head(
     *,
     current_head_sha: str | None,
     latest_by_reviewer: dict,
+    quarantined_review_ids: set | None = None,
 ) -> dict:
     """Return whether a visible approval applies to the live PR head.
 
@@ -19,18 +21,43 @@ def assess_merge_approval_head(
         current_head_sha: Current PR head commit SHA.
         latest_by_reviewer: Map of reviewer login → review entry dicts with
             ``verdict``, ``dismissed``, and ``reviewed_head_sha`` keys.
+            Optional ``review_id`` / ``id`` used for quarantine checks (#695).
+        quarantined_review_ids: Optional set of review IDs that must not count
+            toward merge authorization (#695).
 
     Returns:
         dict with ``approval_at_current_head``, ``latest_approved_head_sha``,
         and ``stale_approval_block_reason`` (set when merge must fail closed).
     """
     current = (current_head_sha or "").strip()
-    approved_entries = [
-        entry
-        for entry in (latest_by_reviewer or {}).values()
-        if (entry.get("verdict") or "").upper() == "APPROVED"
-        and not entry.get("dismissed")
-    ]
+    blocked_ids = {int(x) for x in (quarantined_review_ids or set()) if x is not None}
+
+    def _rid(entry: dict):
+        raw = entry.get("review_id", entry.get("id"))
+        try:
+            return int(raw) if raw is not None else None
+        except (TypeError, ValueError):
+            return None
+
+    approved_entries = []
+    quarantined_at_head = []
+    for entry in (latest_by_reviewer or {}).values():
+        if (entry.get("verdict") or "").upper() != "APPROVED":
+            continue
+        if entry.get("dismissed"):
+            continue
+        rid = _rid(entry)
+        head = (entry.get("reviewed_head_sha") or "").strip()
+        if rid is not None and rid in blocked_ids:
+            if current and head == current:
+                quarantined_at_head.append(entry)
+            continue
+        if entry.get("quarantined"):
+            if current and head == current:
+                quarantined_at_head.append(entry)
+            continue
+        approved_entries.append(entry)
+
     at_current = any(
         (entry.get("reviewed_head_sha") or "").strip() == current
         for entry in approved_entries
@@ -47,7 +74,13 @@ def assess_merge_approval_head(
         )[-1]
         latest_approved = (latest_entry.get("reviewed_head_sha") or "").strip() or None
     reason = None
-    if approved_entries and not at_current:
+    if quarantined_at_head and not at_current:
+        reason = (
+            "contaminated/quarantined approval at current head is void for "
+            "merge authorization (#695); required next action: fresh native "
+            "MCP re-review after controller quarantine evidence is recorded"
+        )
+    elif approved_entries and not at_current:
         reason = (
             f"stale approval: approved SHA '{latest_approved}' does not match "
             f"current live PR head SHA '{current or '(unknown)'}' (fail closed); "
@@ -58,4 +91,5 @@ def assess_merge_approval_head(
         "approval_at_current_head": at_current,
         "latest_approved_head_sha": latest_approved,
         "stale_approval_block_reason": reason,
+        "quarantined_approvals_at_current_head": len(quarantined_at_head),
     }
\ No newline at end of file
diff --git a/migrate_profiles.py b/migrate_profiles.py
index 6bf150c..4cefd85 100755
--- a/migrate_profiles.py
+++ b/migrate_profiles.py
@@ -20,12 +20,114 @@ if PROJECT_ROOT not in sys.path:
 import gitea_config
 
 
-AUTHOR_DEFAULT_ALLOWED = ["read", "branch", "commit", "push", "open_pr", "comment"]
-AUTHOR_DEFAULT_FORBIDDEN = ["approve", "request_changes", "merge"]
-REVIEWER_DEFAULT_ALLOWED = [
-    "read", "review", "comment", "approve", "request_changes", "merge"
+# Defaults emit *canonical* operation names only. Shorthand that is not in
+# gitea_config.GITEA_OPERATION_ALIASES (e.g. ``pr.close``, ``issue.close``)
+# is silently dropped by the production loader and must never appear here.
+AUTHOR_DEFAULT_ALLOWED = [
+    "gitea.read",
+    "gitea.branch.create",
+    "gitea.repo.commit",
+    "gitea.branch.push",
+    "gitea.pr.create",
+    "gitea.pr.comment",
 ]
-REVIEWER_DEFAULT_FORBIDDEN = ["branch", "commit", "push", "open_pr"]
+AUTHOR_DEFAULT_FORBIDDEN = [
+    "gitea.pr.approve",
+    "gitea.pr.request_changes",
+    "gitea.pr.merge",
+]
+REVIEWER_DEFAULT_ALLOWED = [
+    "gitea.read",
+    "gitea.pr.review",
+    "gitea.pr.comment",
+    "gitea.pr.approve",
+    "gitea.pr.request_changes",
+    "gitea.pr.merge",
+]
+REVIEWER_DEFAULT_FORBIDDEN = [
+    "gitea.branch.create",
+    "gitea.repo.commit",
+    "gitea.branch.push",
+    "gitea.pr.create",
+]
+# Required reconciler ops (read + pr.close) plus recommended comment/close and
+# branch.delete for guarded merged-PR cleanup. All names must normalize via
+# gitea_config.normalize_operation without being dropped.
+RECONCILER_DEFAULT_ALLOWED = [
+    "gitea.read",
+    "gitea.pr.close",
+    "gitea.pr.comment",
+    "gitea.issue.comment",
+    "gitea.issue.close",
+    "gitea.branch.delete",
+]
+RECONCILER_DEFAULT_FORBIDDEN = [
+    "gitea.pr.approve",
+    "gitea.pr.merge",
+    "gitea.pr.review",
+    "gitea.pr.create",
+    "gitea.branch.push",
+    "gitea.repo.commit",
+]
+
+# Migration-only expansions for common shorthands that are *not* in
+# GITEA_OPERATION_ALIASES. Emitted output is always the canonical form so a
+# second canonicalize pass is a no-op (idempotent).
+_MIGRATION_ONLY_ALIASES = {
+    "pr.close": "gitea.pr.close",
+    "pr.comment": "gitea.pr.comment",
+    "issue.close": "gitea.issue.close",
+    "branch.delete": "gitea.branch.delete",
+}
+
+# Reconciler required ops that must survive migration (from reconciler_profile).
+RECONCILER_REQUIRED_CANONICAL = ("gitea.read", "gitea.pr.close")
+
+
+def canonicalize_operation(op: str) -> str:
+    """Return a canonical operation name accepted by the production loader.
+
+    Fail closed on unknown/ambiguous spellings so required permissions cannot
+    be silently dropped by ``check_operation`` later.
+    """
+    if not isinstance(op, str) or not op.strip():
+        raise ValueError("operation must be a non-empty string (fail closed)")
+    op = op.strip()
+    try:
+        return gitea_config.normalize_operation(op)
+    except gitea_config.ConfigError:
+        pass
+    if op in _MIGRATION_ONLY_ALIASES:
+        return _MIGRATION_ONLY_ALIASES[op]
+    raise ValueError(
+        f"operation {op!r} cannot be canonicalized for migration "
+        "(unknown/ambiguous; fail closed — production loader would drop it)"
+    )
+
+
+def canonicalize_operations(ops, *, context: str = "operations") -> list[str]:
+    """Canonicalize a list of operations; preserve order, drop duplicates."""
+    if not isinstance(ops, list):
+        raise ValueError(f"{context} must be a list (fail closed)")
+    out: list[str] = []
+    seen: set[str] = set()
+    for entry in ops:
+        canon = canonicalize_operation(entry)
+        if canon not in seen:
+            seen.add(canon)
+            out.append(canon)
+    return out
+
+
+def _assert_reconciler_required_survive(allowed: list[str], profile_name: str) -> None:
+    """Fail visibly when migration would leave a reconciler without required ops."""
+    missing = [op for op in RECONCILER_REQUIRED_CANONICAL if op not in set(allowed)]
+    if missing:
+        raise ValueError(
+            f"Profile '{profile_name}' (reconciler) is missing required "
+            f"operation(s) after migration: {missing}. Refusing to emit a "
+            "profile that would silently fail pr.close / read (fail closed)."
+        )
 
 
 def infer_role(name, execution_profile):
@@ -90,9 +192,11 @@ def migrate_v1_to_v2(v1_data):
             ident_name = "reviewer"
         elif role == "author":
             ident_name = "author"
+        elif role == "reconciler":
+            ident_name = "reconciler"
         else:
             role = prof.get("role")
-            if role not in (None, "author", "reviewer"):
+            if role not in (None, "author", "reviewer", "reconciler"):
                 raise ValueError(
                     f"Profile '{name}' has unsupported role {role!r}"
                 )
@@ -124,20 +228,35 @@ def migrate_v1_to_v2(v1_data):
                 raise ValueError(
                     f"Profile '{name}' operation fields must be lists"
                 )
-            identity_data["allowed_operations"] = list(allowed)
-            identity_data["forbidden_operations"] = list(forbidden)
+            try:
+                identity_data["allowed_operations"] = canonicalize_operations(
+                    allowed, context=f"profile '{name}' allowed_operations"
+                )
+                identity_data["forbidden_operations"] = canonicalize_operations(
+                    forbidden, context=f"profile '{name}' forbidden_operations"
+                )
+            except ValueError as exc:
+                raise ValueError(f"Profile '{name}': {exc}") from exc
         elif role == "author":
             identity_data["allowed_operations"] = list(AUTHOR_DEFAULT_ALLOWED)
             identity_data["forbidden_operations"] = list(AUTHOR_DEFAULT_FORBIDDEN)
         elif role == "reviewer":
             identity_data["allowed_operations"] = list(REVIEWER_DEFAULT_ALLOWED)
             identity_data["forbidden_operations"] = list(REVIEWER_DEFAULT_FORBIDDEN)
+        elif role == "reconciler":
+            identity_data["allowed_operations"] = list(RECONCILER_DEFAULT_ALLOWED)
+            identity_data["forbidden_operations"] = list(RECONCILER_DEFAULT_FORBIDDEN)
         else:
             raise ValueError(
                 f"Profile '{name}' has no explicit operation lists and no "
                 "unambiguous author/reviewer role marker (fail closed)"
             )
 
+        if role == "reconciler":
+            _assert_reconciler_required_survive(
+                identity_data["allowed_operations"], name
+            )
+
         # Nest inside environments/services structure
         env = environments.setdefault(env_name, {})
         services = env.setdefault("services", {})
diff --git a/post_merge_cleanup_proof.py b/post_merge_cleanup_proof.py
index 6562a04..e439dca 100644
--- a/post_merge_cleanup_proof.py
+++ b/post_merge_cleanup_proof.py
@@ -86,6 +86,22 @@ _WRONG_BRANCH_RE = re.compile(
     r"deleted branch (?:does not match|!=|differs from) (?:merged )?pr head",
     re.IGNORECASE,
 )
+# #698: canonical reviewer lease lifecycle operations are NOT post-merge
+# cleanup. Releasing a reviewer PR lease (or posting its terminal
+# phase=released marker) happens after every review — merged or not — and
+# must never trigger the post-merge branch/worktree cleanup checklist.
+_LEASE_LIFECYCLE_RE = re.compile(
+    r"(?:gitea_release_reviewer_pr_lease|gitea_abandon_workflow_lease|"
+    r"release[d]? (?:the )?(?:reviewer|workflow) (?:pr )?lease|"
+    r"reviewer (?:pr )?lease release[d]?|"
+    r"lease (?:marker|comment).{0,40}phase\s*[:=]\s*released|"
+    r"phase\s*[:=]\s*released)",
+    re.IGNORECASE,
+)
+_CLEANUP_MUTATIONS_VALUE_RE = re.compile(
+    r"cleanup mutations\s*:\s*([^\n]+)",
+    re.IGNORECASE,
+)
 
 
 def _claims_remote_delete(text: str) -> bool:
@@ -204,16 +220,19 @@ def assess_post_merge_cleanup_proof(
             for field in _worktree_cleanup_fields_present(text)
         )
 
-    if (remote_delete or worktree_remove) and not (remote_delete or worktree_remove):
-        pass
-
     if not remote_delete and not worktree_remove:
-        cleanup_mutations = re.search(
-            r"cleanup mutations\s*:\s*(?!none\b)\S",
-            text,
-            re.IGNORECASE,
+        value_match = _CLEANUP_MUTATIONS_VALUE_RE.search(text)
+        value = (value_match.group(1).strip() if value_match else "")
+        value_lower = value.lower()
+        substantive = bool(value) and value_lower not in {
+            "none", "n/a", "not applicable",
+        }
+        # #698: reviewer lease release / terminal lease markers are lease
+        # lifecycle, not post-merge cleanup — no checklist owed.
+        lease_lifecycle_only = substantive and bool(
+            _LEASE_LIFECYCLE_RE.search(value)
         )
-        if cleanup_mutations:
+        if substantive and not lease_lifecycle_only:
             reasons.append(
                 "cleanup mutations reported without post-merge cleanup proof checklist"
             )
diff --git a/pr_work_lease.py b/pr_work_lease.py
index e2b3f21..2997462 100644
--- a/pr_work_lease.py
+++ b/pr_work_lease.py
@@ -403,10 +403,37 @@ _REVIEWER_ACTIVE_RE = re.compile(
     r"whether any reviewer was active\s*:\s*(yes|no|true|false)",
     re.IGNORECASE,
 )
+# #698 phase detection for phase-specific head proofs.
+_NO_REVIEWED_HEAD_RE = re.compile(
+    r"(?:reviewed head sha|candidate head sha)\s*:\s*none\b",
+    re.IGNORECASE,
+)
+_VERDICT_RECORDED_RE = re.compile(
+    r"review decision\s*:\s*(?:approve[d]?|request[_ ]changes)\b"
+    r"|review_status\s*:\s*(?:approved|request_changes)\b"
+    r"|terminal review mutation\s*:\s*(?!none\b)\S",
+    re.IGNORECASE,
+)
+_MERGE_ATTEMPTED_RE = re.compile(
+    r"merge result\s*:\s*(?:merged|success|performed|failed|attempted)\b"
+    r"|merge mutations\s*:\s*(?!none\b|not applicable\b)\S",
+    re.IGNORECASE,
+)
+_VALIDATION_STARTED_RE = re.compile(
+    r"validation\s*:\s*(?!none\b|not run\b|not applicable\b|not started\b)"
+    r"[^\n]*(?:pass|fail|ran|executed|\d+\s+passed)",
+    re.IGNORECASE,
+)
 
 
 def assess_reviewer_stale_head_final_report(report_text: str) -> dict[str, Any]:
-    """Final-report proof for reviewed vs live head SHAs (#399 AC 6)."""
+    """Final-report proof for reviewed vs live head SHAs (#399 AC 6).
+
+    #698: head proofs are phase-specific. A legitimately blocked run that
+    never began validation (no reviewed head, no formal verdict, no merge)
+    owes none of them; approval-time and merge-time live-head proofs are
+    owed only once the corresponding phase actually begins.
+    """
     text = report_text or ""
     reasons: list[str] = []
     reviewed = _normalize_sha(_REVIEWED_HEAD_RE.search(text).group(1) if _REVIEWED_HEAD_RE.search(text) else None)
@@ -422,15 +449,49 @@ def assess_reviewer_stale_head_final_report(report_text: str) -> dict[str, Any]:
     )
     push_during = _PUSH_DURING_VALIDATION_RE.search(text)
 
-    if not reviewed:
+    # Phase detection from the report's own claims.
+    no_head_stated = bool(_NO_REVIEWED_HEAD_RE.search(text))
+    verdict_recorded = bool(_VERDICT_RECORDED_RE.search(text))
+    merge_attempted = bool(_MERGE_ATTEMPTED_RE.search(text))
+    validation_started = bool(reviewed) or bool(_VALIDATION_STARTED_RE.search(text))
+    blocked_before_validation = (
+        no_head_stated
+        and not reviewed
+        and not verdict_recorded
+        and not merge_attempted
+        and not validation_started
+    )
+
+    if blocked_before_validation:
+        return {
+            "proven": True,
+            "block": False,
+            "reasons": [],
+            "reviewed_head_sha": None,
+            "live_head_sha_before_approval": None,
+            "live_head_sha_before_merge": None,
+            "push_during_validation": (
+                push_during.group(1).lower() if push_during else None
+            ),
+            "phase": "blocked_before_validation",
+        }
+
+    if not reviewed and not no_head_stated:
+        # The head must always be STATED — either a SHA or an explicit
+        # 'none'. Silence is not a phase claim and fails closed.
+        reasons.append(
+            "reviewed head SHA not stated in final report "
+            "(state the SHA or an explicit 'none')"
+        )
+    elif not reviewed and (validation_started or verdict_recorded or merge_attempted):
         reasons.append("reviewed head SHA not stated in final report")
-    if not live_approval:
+    if verdict_recorded and not live_approval:
         reasons.append("final live head SHA before approval not stated")
-    if not live_merge:
+    if merge_attempted and not live_merge:
         reasons.append("final live head SHA before merge not stated")
-    if not push_during:
+    if validation_started and not push_during:
         reasons.append("whether push occurred during validation not stated")
-    elif reviewed and live_approval and reviewed != live_approval:
+    if reviewed and live_approval and reviewed != live_approval:
         reasons.append("live head before approval differs from reviewed head SHA")
     elif reviewed and live_merge and reviewed != live_merge:
         reasons.append("live head before merge differs from reviewed head SHA")
diff --git a/reconciler_profile.py b/reconciler_profile.py
index 4d9d589..b300ec2 100644
--- a/reconciler_profile.py
+++ b/reconciler_profile.py
@@ -18,6 +18,11 @@ RECONCILER_RECOMMENDED_OPERATIONS = (
     "gitea.pr.comment",
     "gitea.issue.comment",
     "gitea.issue.close",
+    # Merged-branch cleanup is reconciler-owned (task_capability_map maps
+    # cleanup_merged_pr_branch -> reconciler). The permission is only
+    # exercisable through the guarded gitea_cleanup_merged_pr_branch path
+    # (#514): merged proof, protected-branch refusal, explicit confirmation.
+    "gitea.branch.delete",
 )
 
 RECONCILER_FORBIDDEN_OPERATIONS = (
diff --git a/review_final_report_schema.py b/review_final_report_schema.py
index e428015..10cb5ad 100644
--- a/review_final_report_schema.py
+++ b/review_final_report_schema.py
@@ -25,8 +25,13 @@ _REVIEWED_HEAD_RE = re.compile(
     r"(?:pinned reviewed head|reviewed head sha)\s*:\s*([0-9a-f]{7,40})",
     re.IGNORECASE,
 )
+# #698: validation pass proof appears in several legitimate shapes —
+# "Validation: pass", "Validation: focused 50 passed; full 2665 passed",
+# or structured "validation_status: pass". Accept pass evidence anywhere in
+# the Validation field's value, not only as its first token.
 _VALIDATION_PASS_RE = re.compile(
-    r"validation\s*:\s*(?:pass|passed|strong|ok|green)",
+    r"validation(?:_status)?\s*:[^\n]{0,300}?"
+    r"(?:\bpass(?:ed)?\b|\bstrong\b|\bok\b|\bgreen\b|\d+\s+passed)",
     re.IGNORECASE,
 )
 _MERGED_CLAIM_RE = re.compile(
diff --git a/review_proofs.py b/review_proofs.py
index b4b0ea2..146f039 100644
--- a/review_proofs.py
+++ b/review_proofs.py
@@ -858,9 +858,16 @@ _WALKTHROUGH_ARTIFACT_RE = re.compile(r"walkthrough\.md", re.I)
 
 
 def _performed_file_mutations(action_log: list[dict] | None) -> list[dict]:
-    """Return performed local file mutations, excluding gated rejections."""
+    """Return performed local file mutations, excluding gated rejections.
+
+    Non-dict entries (malformed JSON, LLM mistakes) are ignored instead of
+    raising ``AttributeError`` (#698): a malformed ledger entry can never be
+    authoritative mutation evidence.
+    """
     performed: list[dict] = []
     for entry in action_log or []:
+        if not isinstance(entry, dict):
+            continue
         if entry.get("gated_rejected") or entry.get("performed") is False:
             continue
         action = (entry.get("action") or "").strip().lower()
@@ -2228,24 +2235,31 @@ HANDOFF_REVIEW_MUTATION_FIELDS = (
 )
 
 HANDOFF_ROLE_FIELDS = {
+    # #698: the review/merger required-field sets must stay aligned with the
+    # canonical schema (skills/llm-project-workflow/schemas/
+    # review-merge-final-report.md). The schema explicitly FORBIDS the legacy
+    # fields 'Pinned reviewed head', 'Scratch worktree used', and 'Workspace
+    # mutations' — a validator must never demand a field the schema bans.
     "review": (
         ("Selected PR", ("selected pr",)),
         ("Reviewer eligibility", ("reviewer eligibility", "eligibility")),
-        ("Pinned reviewed head", ("pinned reviewed head", "pinned head")),
-        ("Worktree path", ("worktree path", "starting worktree path")),
-        ("Worktree dirty", ("worktree dirty", "whether worktree was dirty")),
-        ("Scratch worktree used", ("scratch worktree used", "scratch clone used",
-                                   "scratch worktree")),
+        ("Reviewed head SHA", ("reviewed head sha", "candidate head sha")),
+        ("Review worktree path", ("review worktree path", "worktree path",
+                                  "starting worktree path")),
+        ("Review worktree dirty", ("review worktree dirty", "worktree dirty",
+                                   "whether worktree was dirty")),
         ("Unrelated local mutations", ("unrelated local mutations",
-                                       "unrelated files modified")),
+                                       "unrelated files modified",
+                                       "file edits by reviewer")),
         ("Review decision", ("review decision", "decision")),
         ("Merge result", ("merge result",)),
         ("Linked issue status", ("linked issue status", "linked issue")),
         ("Cleanup status", ("cleanup status", "cleanup")),
+        ("Safe next action", ("safe next action", "next")),
     ) + HANDOFF_REVIEW_MUTATION_FIELDS,
     "merger": (
         ("Selected PR", ("selected pr",)),
-        ("Pinned reviewed head", ("pinned reviewed head", "pinned head")),
+        ("Reviewed head SHA", ("reviewed head sha", "candidate head sha")),
         ("Active profile", ("active profile",)),
         ("Role kind", ("role kind",)),
         ("Merge capability source", ("merge capability source",)),
@@ -2433,9 +2447,22 @@ def assess_controller_handoff(report_text, role=None, local_edits=False):
         # Issue #320: reviewer and merger handoffs use the precise mutation categories
         # in HANDOFF_REVIEW_MUTATION_FIELDS instead of the legacy ambiguous
         # "Workspace mutations" field, which is rejected below.
+        # Issue #698: the canonical review-merge schema has no 'Mutations',
+        # 'Next', 'Issue/PR', 'Branch/SHA', or 'Files changed' fields — their
+        # content lives in the precise mutation categories, 'Safe next
+        # action', 'Selected PR'/'Linked issue', head-SHA fields, and 'Files
+        # reviewed'. Requiring the legacy names rejects canonical reports.
+        _non_canonical_for_review = {
+            "Workspace mutations",
+            "Mutations",
+            "Next",
+            "Issue/PR",
+            "Branch/SHA",
+            "Files changed",
+        }
         required = [
             field for field in required
-            if field[0] != "Workspace mutations"
+            if field[0] not in _non_canonical_for_review
         ]
         if any(label.startswith("workspace mutations") for label in labels):
             return {
diff --git a/review_quarantine.py b/review_quarantine.py
new file mode 100644
index 0000000..62a105b
--- /dev/null
+++ b/review_quarantine.py
@@ -0,0 +1,351 @@
+"""Controller quarantine of contaminated formal reviews (#695).
+
+Quarantine records are durable under the MCP session-state root and are only
+writable when the caller holds a **native** MCP transport runtime. Untrusted
+local scripts that import this module cannot establish a valid quarantine
+(writes fail closed). Live server-side gates (eligibility, merge, feedback)
+honor quarantine by review_id + PR + head.
+
+Forensic evidence (Gitea review objects, lease comments) is never deleted.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+from datetime import datetime, timezone
+from typing import Any
+
+import mcp_daemon_guard
+import mcp_session_state
+
+KIND_QUARANTINE = "review_quarantine"
+CONFIRMATION_PREFIX = "QUARANTINE CONTAMINATED REVIEW"
+
+
+def _now() -> str:
+    return datetime.now(timezone.utc).isoformat()
+
+
+def quarantine_state_path(
+    *,
+    remote: str,
+    org: str,
+    repo: str,
+    pr_number: int,
+    review_id: int,
+) -> str:
+    # Dedicated subdir under session state root (mode 0o700).
+    root = os.path.join(mcp_session_state.default_state_dir(), "quarantine")
+    os.makedirs(root, mode=0o700, exist_ok=True)
+    # Explicit multi-segment key so remote/org/repo/pr/review cannot collide.
+    segs = [
+        KIND_QUARANTINE,
+        mcp_session_state._sanitize_segment(remote),
+        mcp_session_state._sanitize_segment(org),
+        mcp_session_state._sanitize_segment(repo),
+        f"pr{int(pr_number)}",
+        f"rev{int(review_id)}",
+    ]
+    return os.path.join(root, "-".join(segs) + ".json")
+
+
+def build_quarantine_record(
+    *,
+    remote: str,
+    org: str,
+    repo: str,
+    pr_number: int,
+    review_id: int,
+    reviewed_head_sha: str,
+    reason: str,
+    actor_username: str | None,
+    profile_name: str | None,
+    incident_issue: int | None = None,
+    forensic_comment_ids: list[int] | None = None,
+) -> dict[str, Any]:
+    provenance = mcp_daemon_guard.mutation_provenance_fields()
+    return {
+        "kind": KIND_QUARANTINE,
+        "issue_ref": "#695",
+        "remote": remote,
+        "org": org,
+        "repo": repo,
+        "pr_number": int(pr_number),
+        "review_id": int(review_id),
+        "reviewed_head_sha": (reviewed_head_sha or "").strip().lower(),
+        "reason": (reason or "").strip(),
+        "actor_username": actor_username,
+        "profile_name": profile_name,
+        "incident_issue": incident_issue,
+        "forensic_comment_ids": list(forensic_comment_ids or []),
+        "created_at": _now(),
+        "native_provenance": provenance,
+        "merge_authorization": "void",
+        "retain_forensic_evidence": True,
+    }
+
+
+def assess_quarantine_write(
+    *,
+    confirmation: str,
+    pr_number: int,
+    review_id: int,
+    reason: str,
+    native_required: bool = True,
+) -> dict[str, Any]:
+    """Pure assessment of whether a quarantine write may proceed."""
+    reasons: list[str] = []
+    expected = f"{CONFIRMATION_PREFIX} {int(review_id)} PR {int(pr_number)}"
+    if (confirmation or "").strip() != expected:
+        reasons.append(
+            f"confirmation must equal exactly '{expected}' (fail closed, #695)"
+        )
+    if not (reason or "").strip():
+        reasons.append("quarantine reason is required (fail closed, #695)")
+    if native_required and not mcp_daemon_guard.is_native_mcp_transport():
+        if not mcp_daemon_guard.is_pytest_runtime():
+            reasons.append(
+                "quarantine write requires native MCP transport; untrusted "
+                "local code cannot create quarantine records (#695)"
+            )
+    return {
+        "allowed": not reasons,
+        "expected_confirmation": expected,
+        "reasons": reasons,
+    }
+
+
+def write_quarantine_record(record: dict[str, Any]) -> dict[str, Any]:
+    """Persist quarantine record; fail closed outside native/pytest runtime."""
+    if not mcp_daemon_guard.is_native_mcp_transport():
+        if not mcp_daemon_guard.is_pytest_runtime():
+            raise mcp_daemon_guard.UnsanctionedRuntimeError(
+                "quarantine write blocked: non-native runtime (#695)"
+            )
+    path = quarantine_state_path(
+        remote=str(record["remote"]),
+        org=str(record["org"]),
+        repo=str(record["repo"]),
+        pr_number=int(record["pr_number"]),
+        review_id=int(record["review_id"]),
+    )
+    # Refuse overwriting with weaker provenance from untrusted caller by
+    # requiring native fields present.
+    if not (record.get("native_provenance") or {}).get("native_mcp_transport"):
+        if not mcp_daemon_guard.is_pytest_runtime():
+            raise mcp_daemon_guard.UnsanctionedRuntimeError(
+                "quarantine record missing native provenance (#695)"
+            )
+    tmp = path + ".tmp"
+    data = json.dumps(record, indent=2, sort_keys=True)
+    with open(tmp, "w", encoding="utf-8") as fh:
+        fh.write(data)
+        fh.flush()
+        os.fsync(fh.fileno())
+    os.replace(tmp, path)
+    os.chmod(path, 0o600)
+    return {"path": path, "written": True, "record": record}
+
+
+def load_quarantine_record(
+    *,
+    remote: str,
+    org: str,
+    repo: str,
+    pr_number: int,
+    review_id: int,
+) -> dict[str, Any] | None:
+    path = quarantine_state_path(
+        remote=remote,
+        org=org,
+        repo=repo,
+        pr_number=pr_number,
+        review_id=review_id,
+    )
+    if not os.path.isfile(path):
+        return None
+    try:
+        with open(path, encoding="utf-8") as fh:
+            data = json.load(fh)
+    except (OSError, json.JSONDecodeError):
+        return None
+    if not isinstance(data, dict):
+        return None
+    return data
+
+
+def is_review_quarantined(
+    *,
+    remote: str,
+    org: str,
+    repo: str,
+    pr_number: int,
+    review_id: int | None,
+    reviewed_head_sha: str | None = None,
+) -> dict[str, Any]:
+    """Whether a formal review is quarantined for merge authorization (#695)."""
+    if review_id is None:
+        return {"quarantined": False, "record": None, "reasons": []}
+    rec = load_quarantine_record(
+        remote=remote,
+        org=org,
+        repo=repo,
+        pr_number=pr_number,
+        review_id=int(review_id),
+    )
+    if not rec:
+        return {"quarantined": False, "record": None, "reasons": []}
+    reasons = [
+        f"formal review_id {review_id} on PR #{pr_number} is quarantined "
+        f"(#695; incident issue {rec.get('incident_issue')}); "
+        "merge authorization is void; forensic evidence retained"
+    ]
+    want_head = (reviewed_head_sha or "").strip().lower()
+    rec_head = (rec.get("reviewed_head_sha") or "").strip().lower()
+    if want_head and rec_head and want_head != rec_head:
+        # Still quarantined by review_id; note head mismatch for operators.
+        reasons.append(
+            f"quarantine head {rec_head[:12]}… differs from assessed head "
+            f"{want_head[:12]}… (still void by review_id)"
+        )
+    return {"quarantined": True, "record": rec, "reasons": reasons}
+
+
+def filter_approvals_for_merge(
+    *,
+    remote: str,
+    org: str,
+    repo: str,
+    pr_number: int,
+    current_head_sha: str | None,
+    reviews: list[dict],
+) -> dict[str, Any]:
+    """Split reviews into merge-usable vs quarantined contaminated approvals."""
+    current = (current_head_sha or "").strip().lower()
+    usable: list[dict] = []
+    quarantined: list[dict] = []
+    for rev in reviews or []:
+        if not isinstance(rev, dict):
+            continue
+        verdict = (rev.get("verdict") or rev.get("state") or "").upper()
+        if verdict not in {"APPROVED", "APPROVE"}:
+            continue
+        if rev.get("dismissed"):
+            continue
+        rid = rev.get("review_id") or rev.get("id")
+        head = (
+            rev.get("reviewed_head_sha")
+            or rev.get("commit_id")
+            or rev.get("head_sha")
+            or ""
+        ).strip().lower()
+        q = is_review_quarantined(
+            remote=remote,
+            org=org,
+            repo=repo,
+            pr_number=pr_number,
+            review_id=int(rid) if rid is not None else None,
+            reviewed_head_sha=head or current,
+        )
+        entry = {**rev, "review_id": rid, "reviewed_head_sha": head}
+        if q["quarantined"]:
+            entry["quarantined"] = True
+            entry["quarantine_reasons"] = q["reasons"]
+            quarantined.append(entry)
+        else:
+            entry["quarantined"] = False
+            usable.append(entry)
+    usable_at_head = [
+        e
+        for e in usable
+        if current and (e.get("reviewed_head_sha") or "") == current
+    ]
+    return {
+        "usable_approvals": usable,
+        "usable_approvals_at_current_head": usable_at_head,
+        "quarantined_approvals": quarantined,
+        "approval_visible_for_merge": bool(usable_at_head),
+        "has_quarantined_approval_at_head": any(
+            current
+            and (e.get("reviewed_head_sha") or "") == current
+            for e in quarantined
+        ),
+    }
+
+
+def format_quarantine_audit_comment(record: dict[str, Any]) -> str:
+    """Append-only forensic audit comment body (does not delete evidence)."""
+    lines = [
+        "## Contaminated formal review quarantine (#695)",
+        "",
+        "Status: **QUARANTINED — merge authorization VOID**",
+        "",
+        f"- review_id: `{record.get('review_id')}`",
+        f"- pr: `#{record.get('pr_number')}`",
+        f"- reviewed_head_sha: `{record.get('reviewed_head_sha')}`",
+        f"- actor: `{record.get('actor_username')}`",
+        f"- profile: `{record.get('profile_name')}`",
+        f"- incident_issue: `#{record.get('incident_issue')}`",
+        f"- reason: {record.get('reason')}",
+        f"- created_at: `{record.get('created_at')}`",
+        f"- native_transport: "
+        f"`{(record.get('native_provenance') or {}).get('native_mcp_transport')}`",
+        f"- native_token_fingerprint: "
+        f"`{(record.get('native_provenance') or {}).get('native_token_fingerprint')}`",
+        f"- forensic_comment_ids retained: "
+        f"`{record.get('forensic_comment_ids')}`",
+        "",
+        "This record does **not** delete Gitea reviews or historical comments. "
+        "Fresh native-MCP re-review is required before merge.",
+    ]
+    return "\n".join(lines)
+
+
+def assess_untrusted_canonical_approval_claim(body: str) -> list[str]:
+    """Reasons to reject canonical comments that claim approved/merge-ready.
+
+    Used when the comment asserts approval without native review proof (#695 AC7).
+    False "official workflow" claims that cite offline/import paths are always
+    rejected even when a NATIVE_REVIEW_PROOF line is present.
+    """
+    text = body or ""
+    lower = text.lower()
+    claims_approved = (
+        "state:\napproved" in lower
+        or "state: approved" in lower
+        or "who_is_next:\nmerger" in lower
+        or "who_is_next: merger" in lower
+        or "merge_ready: true" in lower
+        or "merge_ready:\ntrue" in lower
+        or "ready-to-merge" in lower
+    )
+    if not claims_approved:
+        return []
+    # Reject explicit offline/import "official workflow" spoofing (#695 AC9).
+    offline_spoof = (
+        "offline_mcp" in lower
+        or "offline import" in lower
+        or "direct import" in lower
+        or "import gitea_mcp_server" in lower
+        or "run_quarantine.py" in lower
+        or "offline_mcp_helper" in lower
+        or "offline_mcp_runner" in lower
+    )
+    has_proof = (
+        "NATIVE_REVIEW_PROOF:" in text
+        or "native_review_proof:" in lower
+    )
+    if offline_spoof:
+        return [
+            "canonical approval claim cites offline/import/helper path; "
+            "NATIVE_REVIEW_PROOF rejected (#695 AC7/AC9); stop after native "
+            "MCP failure — do not construct offline mutation fallbacks"
+        ]
+    if has_proof:
+        return []
+    return [
+        "canonical comment claims approved/merge-ready state without "
+        "NATIVE_REVIEW_PROOF from a native MCP review mutation (#695 AC7); "
+        "contaminated or untrusted approvals cannot certify merger handoff"
+    ]
diff --git a/skills/llm-project-workflow/workflows/review-merge-pr.md b/skills/llm-project-workflow/workflows/review-merge-pr.md
index e0b3996..95d0bc4 100644
--- a/skills/llm-project-workflow/workflows/review-merge-pr.md
+++ b/skills/llm-project-workflow/workflows/review-merge-pr.md
@@ -14,6 +14,8 @@ before any PR mutation. Final report schema:
 
 **BLOCKED + DIAGNOSE (universal default):** If at any point you cannot perform a required step (skill not available, terminal broken, capability missing, wrong profile, guard blocks, worktree misbound, instructions unavailable, preflight fails, etc.), STOP. Clearly state BLOCKED. Use the standard [`../templates/blocked-diagnose-report.md`](../templates/blocked-diagnose-report.md) template. Only safe non-mutating recovery. Report using the template. Do not continue or use any fallback (temp scripts, direct API, etc.) unless controller authorizes. All blocker classes listed in llm-project-workflow/SKILL.md must trigger this.
 
+**Native MCP failure is a hard stop (#695):** If the native MCP namespace dies (EOF, capability disconnect, session death), STOP. Do **not** import `gitea_mcp_server` from a standalone process, do **not** run offline helpers (`offline_mcp_helper.py`, `offline_mcp_runner.py`, `run_quarantine.py`), and do **not** set direct-import / keychain-bypass / raw-token environment variables. Reconnect the official MCP daemon only. Contaminated approvals must be controller-quarantined; they never authorize merge.
+
 **Default task prompt:**
 
 > Review the next eligible open PR in this project. Merge it only if every
diff --git a/skills/llm-project-workflow/workflows/work-issue.md b/skills/llm-project-workflow/workflows/work-issue.md
index a6ce0e0..d947c13 100644
--- a/skills/llm-project-workflow/workflows/work-issue.md
+++ b/skills/llm-project-workflow/workflows/work-issue.md
@@ -14,6 +14,8 @@ before any issue implementation mutation. Final report schema:
 
 **BLOCKED + DIAGNOSE (universal default):** If at any point you cannot perform a required step (skill not available, terminal broken, capability missing, wrong profile, guard blocks, worktree misbound, instructions unavailable, preflight fails, etc.), STOP. Clearly state BLOCKED. Use the standard [`../templates/blocked-diagnose-report.md`](../templates/blocked-diagnose-report.md) template. Only safe non-mutating recovery. Report using the template. Do not continue or use any fallback (temp scripts, direct API, etc.) unless controller authorizes. All blocker classes listed in llm-project-workflow/SKILL.md must trigger this.
 
+**Native MCP failure is a hard stop (#695):** Do not import MCP server internals, run offline mutation helpers, or set credential-bypass env vars after a native transport failure. Reconnect the official daemon only.
+
 **Default task prompt:**
 
 > Find the next eligible issue in this project, work on it only if all gates
diff --git a/stale_review_decision_lock.py b/stale_review_decision_lock.py
index 5f47486..3d5d1df 100644
--- a/stale_review_decision_lock.py
+++ b/stale_review_decision_lock.py
@@ -438,3 +438,252 @@ def format_cleanup_audit_comment(audit: dict[str, Any]) -> str:
         "This path only clears a lock when the referenced PR is merged/closed.",
     ]
     return "\n".join(lines)
+
+
+# ---------------------------------------------------------------------------
+# #709 cross-profile cleanup, overwrite protection, recovery provenance
+# ---------------------------------------------------------------------------
+
+
+def has_unresolved_terminal_evidence(lock: dict | None) -> bool:
+    """True when *lock* still carries a terminal live mutation ledger."""
+    return last_terminal_mutation(lock) is not None
+
+
+def assess_init_overwrite(
+    existing_lock: dict | None,
+    *,
+    force: bool = False,
+) -> dict[str, Any]:
+    """Whether init_review_decision_lock may replace an existing durable lock (#709 AC2).
+
+    Unresolved terminal evidence must never be silently replaced by an empty
+    initialized lock. *force* does not authorize destruction of terminal
+    ledgers — only explicit cleanup / archive transitions may remove them.
+    """
+    result: dict[str, Any] = {
+        "overwrite_allowed": True,
+        "has_existing": existing_lock is not None,
+        "has_unresolved_terminal": False,
+        "reasons": [],
+        "last_terminal_pr": None,
+        "last_terminal_action": None,
+        "existing_profile_identity": None,
+    }
+    if existing_lock is None:
+        result["reasons"].append("no existing lock; empty init allowed")
+        return result
+    result["existing_profile_identity"] = (
+        existing_lock.get("profile_identity")
+        or existing_lock.get("session_profile_lock")
+        or existing_lock.get("session_profile")
+    )
+    last = last_terminal_mutation(existing_lock)
+    if last is None:
+        result["reasons"].append(
+            "existing lock has no terminal mutations; re-init allowed"
+        )
+        return result
+    result["has_unresolved_terminal"] = True
+    result["overwrite_allowed"] = False
+    result["last_terminal_pr"] = last.get("pr_number")
+    result["last_terminal_action"] = last.get("action")
+    result["reasons"].append(
+        "refuse empty re-init: unresolved terminal decision-lock evidence "
+        f"present ({last.get('action')} on PR #{last.get('pr_number')}); "
+        "use gitea_cleanup_stale_review_decision_lock when moot, or archive "
+        f"via sanctioned recovery — force={force!r} does not authorize overwrite "
+        "(#709 AC2)"
+    )
+    return result
+
+
+def lock_targets_merged_pr_approval(
+    lock: dict | None,
+    *,
+    pr_number: int,
+    expected_head_sha: str | None = None,
+) -> bool:
+    """True when *lock*'s last terminal mutation is approve of *pr_number*.
+
+    When *expected_head_sha* is provided, a **recorded** terminal head must
+    match. Legacy same-repo approve locks with no recorded head do **not**
+    match (fail closed, #709 F3 residual / review 435) — callers must use the
+    strict secondary path that refuses no-head clears.
+    """
+    last = last_terminal_mutation(lock)
+    if last is None:
+        return False
+    if last.get("action") != "approve":
+        return False
+    if last.get("pr_number") != pr_number:
+        return False
+    if expected_head_sha:
+        want = normalize_head_sha(expected_head_sha)
+        if not want:
+            return False
+        locked = mutation_head_sha(last, lock)
+        # Require recorded-head match; unrecorded head is not a match (#709 F3).
+        if not locked or not heads_equal(locked, want):
+            return False
+    return True
+
+
+def build_post_merge_recovery_record(
+    *,
+    pr_number: int,
+    head_sha: str | None,
+    merge_commit_sha: str | None,
+    target_profile_identity: str | None,
+    failed_step: str,
+    error: str | None,
+    remote: str | None,
+    org: str | None,
+    repo: str | None,
+    actor_username: str | None,
+    profile_name: str | None,
+) -> dict[str, Any]:
+    """Durable recovery-required payload after irreversible merge (#709 AC3)."""
+    return {
+        "event": "post_merge_decision_lock_recovery_required",
+        "status": "recovery_required",
+        "issue_ref": "#709",
+        "recovery_critical": True,
+        "applied": False,  # never claim historical cleanup succeeded
+        "timestamp": datetime.now(timezone.utc).isoformat(),
+        "pr_number": pr_number,
+        "head_sha": normalize_head_sha(head_sha),
+        "merge_commit_sha": merge_commit_sha,
+        "target_profile_identity": target_profile_identity,
+        "failed_step": failed_step,
+        "error": error,
+        "remote": remote,
+        "org": org,
+        "repo": repo,
+        "actor_username": actor_username,
+        "profile_name": profile_name,
+        "required_recovery_action": (
+            "retry cross-profile decision-lock cleanup and audit publication "
+            "for the merged PR; if terminal evidence is gone, use "
+            "gitea_record_irrecoverable_decision_lock_provenance"
+        ),
+    }
+
+
+def build_irrecoverable_provenance_record(
+    *,
+    pr_number: int,
+    head_sha: str | None,
+    remote: str | None,
+    org: str | None,
+    repo: str | None,
+    actor_username: str | None,
+    profile_name: str | None,
+    reason: str,
+    incident_ref: str | None = None,
+    # Deprecated kwargs retained only so stale call sites fail closed:
+    operator_authorized: bool | None = None,
+    # Required for merger-acceptable records (#709 F1):
+    authorization: dict[str, Any] | None = None,
+    incident_issue: int | None = None,
+    incident_comment_id: int | None = None,
+    destroyed_subject: str | None = None,
+    historical_provenance_subject: str | None = None,
+) -> dict[str, Any]:
+    """Truthful absence-of-proof record (#709 AC5). Never sets applied=True.
+
+    Caller-supplied ``operator_authorized`` is **ignored** as authorization
+    evidence (review 434 F1). Prefer
+    :func:`irrecoverable_provenance.build_irrecoverable_provenance_record`
+    with a verified server-side authorization artifact.
+    """
+    # Explicitly ignore deprecated self-assertable Boolean.
+    _ = operator_authorized
+    if authorization is not None and incident_issue is not None and incident_comment_id is not None:
+        from irrecoverable_provenance import (
+            build_irrecoverable_provenance_record as _build,
+        )
+
+        return _build(
+            pr_number=int(pr_number),
+            head_sha=str(head_sha or ""),
+            remote=str(remote or ""),
+            org=str(org or ""),
+            repo=str(repo or ""),
+            actor_username=actor_username,
+            profile_name=profile_name,
+            reason=reason,
+            incident_issue=int(incident_issue),
+            incident_comment_id=int(incident_comment_id),
+            authorization=authorization,
+            destroyed_subject=destroyed_subject,
+            historical_provenance_subject=historical_provenance_subject
+            or destroyed_subject,
+        )
+    # Fail-closed skeleton when no server authorization is supplied: never
+    # sets merger_may_accept True (even if operator_authorized was True).
+    return {
+        "event": "irrecoverable_decision_lock_provenance",
+        "status": "provenance_irrecoverable",
+        "record_type": "irrecoverable_decision_provenance",
+        "operator_recovery_required": True,
+        "issue_ref": "#709",
+        "recovery_critical": True,
+        "applied": False,
+        "historical_cleanup_proven": False,
+        "timestamp": datetime.now(timezone.utc).isoformat(),
+        "pr_number": pr_number,
+        "head_sha": normalize_head_sha(head_sha),
+        "remote": remote,
+        "org": org,
+        "repo": repo,
+        "actor_username": actor_username,
+        "profile_name": profile_name,
+        "reason": reason,
+        "incident_ref": incident_ref,
+        "incident_issue": incident_issue,
+        "incident_comment_id": incident_comment_id,
+        "authorization_verified": False,
+        "merger_may_accept": False,
+        "acceptance_rule": (
+            "Merger may accept this record only when a server-side "
+            "authorization artifact verifies for remote/org/repo/PR/exact "
+            "head/incident, the record is durable and read back, and normal "
+            "merge gates still pass. Caller Booleans never authorize. This "
+            "does not prove historical cleanup."
+        ),
+    }
+
+
+def format_irrecoverable_audit_comment(record: dict[str, Any]) -> str:
+    """Markdown body for irrecoverable provenance audit (no applied=true claim)."""
+    from irrecoverable_provenance import (
+        format_irrecoverable_audit_comment as _fmt,
+    )
+
+    return _fmt(record)
+
+
+def format_post_merge_recovery_comment(record: dict[str, Any]) -> str:
+    """Markdown body for post-merge recovery-required audit."""
+    lines = [
+        "## Post-merge decision-lock recovery required (#709)",
+        "",
+        "Status: **RECOVERY_REQUIRED** (merge is irreversible; cleanup/audit incomplete)",
+        "",
+        f"- actor: `{record.get('actor_username')}`",
+        f"- profile: `{record.get('profile_name')}`",
+        f"- timestamp: `{record.get('timestamp')}`",
+        f"- PR: `#{record.get('pr_number')}`",
+        f"- head_sha: `{record.get('head_sha')}`",
+        f"- merge_commit_sha: `{record.get('merge_commit_sha')}`",
+        f"- target_profile_identity: `{record.get('target_profile_identity')}`",
+        f"- failed_step: `{record.get('failed_step')}`",
+        f"- error: `{record.get('error')}`",
+        "",
+        f"Required action: {record.get('required_recovery_action')}",
+        "",
+        "applied=false — do not treat this as successful cleanup evidence.",
+    ]
+    return "\n".join(lines)
+
diff --git a/task_capability_map.py b/task_capability_map.py
index b577052..02826af 100644
--- a/task_capability_map.py
+++ b/task_capability_map.py
@@ -72,9 +72,19 @@ TASK_CAPABILITY_MAP: dict[str, dict[str, str]] = {
         "permission": "gitea.pr.merge",
         "role": "merger",
     },
+    # #695 AC8: controller quarantine of contaminated formal reviews.
+    # Apply path posts an append-only forensic audit comment (pr.comment).
+    "quarantine_contaminated_review": {
+        "permission": "gitea.pr.comment",
+        "role": "reconciler",
+    },
+    "gitea_quarantine_contaminated_review": {
+        "permission": "gitea.pr.comment",
+        "role": "reconciler",
+    },
     "adopt_merger_pr_lease": {
         "permission": "gitea.pr.comment",
-        "role": "reviewer",
+        "role": "merger",
     },
     # #691: guarded non-owner cleanup of obsolete comment-backed reviewer leases.
     # Apply path posts lease release + audit comments (gitea.pr.comment).
@@ -117,6 +127,32 @@ TASK_CAPABILITY_MAP: dict[str, dict[str, str]] = {
         "permission": "gitea.pr.review",
         "role": "reviewer",
     },
+    # #709: truthful absence-of-proof recovery (server-side auth + record + consume).
+    # Dedicated mutation capability — gitea.read is insufficient (review 434 F1).
+    "issue_irrecoverable_provenance_authorization": {
+        "permission": "gitea.decision_lock.irrecoverable_recovery",
+        "role": "reconciler",
+    },
+    "gitea_issue_irrecoverable_provenance_authorization": {
+        "permission": "gitea.decision_lock.irrecoverable_recovery",
+        "role": "reconciler",
+    },
+    "record_irrecoverable_decision_lock_provenance": {
+        "permission": "gitea.decision_lock.irrecoverable_recovery",
+        "role": "reconciler",
+    },
+    "gitea_record_irrecoverable_decision_lock_provenance": {
+        "permission": "gitea.decision_lock.irrecoverable_recovery",
+        "role": "reconciler",
+    },
+    "consume_irrecoverable_decision_lock_provenance": {
+        "permission": "gitea.pr.merge",
+        "role": "merger",
+    },
+    "gitea_consume_irrecoverable_decision_lock_provenance": {
+        "permission": "gitea.pr.merge",
+        "role": "merger",
+    },
     "delete_branch": {
         "permission": "gitea.branch.delete",
         "role": "author",
diff --git a/tests/conftest.py b/tests/conftest.py
index 40ece4d..447f74a 100644
--- a/tests/conftest.py
+++ b/tests/conftest.py
@@ -58,6 +58,17 @@ def _reset_mutation_authority(monkeypatch):
             _fallback: str = state_dir,
             _env_key: str = mcp_session_state.STATE_DIR_ENV,
         ) -> str:
+            # #695 AC2: when production native transport has pinned a session
+            # state root, that pin is authoritative even under test isolation
+            # (PR #701 redirected-state regression).
+            try:
+                import mcp_daemon_guard
+
+                pinned = mcp_daemon_guard.pinned_session_state_dir()
+                if pinned:
+                    return pinned
+            except Exception:
+                pass
             raw = (os.environ.get(_env_key) or "").strip()
             return raw or _fallback
 
diff --git a/tests/test_api_reliability.py b/tests/test_api_reliability.py
index e159b23..88ed798 100644
--- a/tests/test_api_reliability.py
+++ b/tests/test_api_reliability.py
@@ -79,41 +79,46 @@ class TestApiRequestFailures(unittest.TestCase):
     @patch("gitea_auth.urllib.request.urlopen")
     def test_timeout_converted_to_runtimeerror(self, mock_open):
         mock_open.side_effect = TimeoutError("timed out")
-        with self.assertRaises(RuntimeError) as ctx:
+        with self.assertRaises(gitea_auth.GiteaNetworkError) as ctx:
             gitea_auth.api_request("GET", URL, FAKE_AUTH)
-        self.assertIn("network error contacting Gitea", str(ctx.exception))
+        # Fixed message only (#699) — still a RuntimeError subclass.
+        self.assertIsInstance(ctx.exception, RuntimeError)
+        self.assertEqual(str(ctx.exception), "Network error contacting Gitea")
 
     @patch("gitea_auth.urllib.request.urlopen")
     def test_dns_network_failure_converted(self, mock_open):
         mock_open.side_effect = urllib.error.URLError("Name or service not known")
-        with self.assertRaises(RuntimeError) as ctx:
+        with self.assertRaises(gitea_auth.GiteaNetworkError) as ctx:
             gitea_auth.api_request("GET", URL, FAKE_AUTH)
-        self.assertIn("network error contacting Gitea", str(ctx.exception))
+        self.assertEqual(str(ctx.exception), "Network error contacting Gitea")
 
     @patch("gitea_auth.urllib.request.urlopen")
     def test_502_upstream_message(self, mock_open):
         mock_open.side_effect = http_error(502, "bad gateway")
-        with self.assertRaises(RuntimeError) as ctx:
+        with self.assertRaises(gitea_auth.GiteaHttpError) as ctx:
             gitea_auth.api_request("GET", URL, FAKE_AUTH)
         msg = str(ctx.exception)
-        self.assertIn("HTTP 502", msg)
-        self.assertIn("upstream unavailable", msg)
+        self.assertEqual(msg, "Gitea upstream unavailable")
+        self.assertEqual(ctx.exception.reason_code, "upstream_unavailable")
+        self.assertEqual(ctx.exception.http_status, 502)
 
     @patch("gitea_auth.urllib.request.urlopen")
     def test_503_upstream_message(self, mock_open):
         mock_open.side_effect = http_error(503, "")
-        with self.assertRaises(RuntimeError) as ctx:
+        with self.assertRaises(gitea_auth.GiteaHttpError) as ctx:
             gitea_auth.api_request("GET", URL, FAKE_AUTH)
-        self.assertIn("HTTP 503", str(ctx.exception))
-        self.assertIn("upstream unavailable", str(ctx.exception))
+        self.assertEqual(str(ctx.exception), "Gitea upstream unavailable")
+        self.assertEqual(ctx.exception.http_status, 503)
 
     @patch("gitea_auth.urllib.request.urlopen")
     def test_malformed_error_payload_does_not_crash(self, mock_open):
-        # Non-JSON garbage error body must still yield a clean RuntimeError.
+        # Non-JSON garbage error body must still yield a clean typed error
+        # with a fixed message (no body echo — #699).
         mock_open.side_effect = http_error(500, "<html>garbage</html>")
-        with self.assertRaises(RuntimeError) as ctx:
+        with self.assertRaises(gitea_auth.GiteaHttpError) as ctx:
             gitea_auth.api_request("GET", URL, FAKE_AUTH)
-        self.assertIn("HTTP 500", str(ctx.exception))
+        self.assertEqual(str(ctx.exception), "Gitea HTTP request failed")
+        self.assertNotIn("<html>", str(ctx.exception))
 
     @patch("gitea_auth.urllib.request.urlopen")
     def test_malformed_success_json_raises_clean_error(self, mock_open):
@@ -126,16 +131,17 @@ class TestApiRequestFailures(unittest.TestCase):
     def test_no_secret_leak_in_error_body(self, mock_open):
         mock_open.side_effect = http_error(
             400, "failed: token supersecret123 rejected")
-        with self.assertRaises(RuntimeError) as ctx:
+        with self.assertRaises(gitea_auth.GiteaHttpError) as ctx:
             gitea_auth.api_request("GET", URL, FAKE_AUTH)
         msg = str(ctx.exception)
         self.assertNotIn("supersecret123", msg)
-        self.assertIn(gitea_audit.REDACTED, msg)
+        # Fixed message — body never appears (stronger than redaction).
+        self.assertEqual(msg, "Gitea HTTP request failed")
 
     @patch("gitea_auth.urllib.request.urlopen")
     def test_auth_header_never_in_error(self, mock_open):
         mock_open.side_effect = http_error(400, "bad request")
-        with self.assertRaises(RuntimeError) as ctx:
+        with self.assertRaises(gitea_auth.GiteaHttpError) as ctx:
             gitea_auth.api_request("GET", URL, FAKE_AUTH)
         self.assertNotIn(FAKE_AUTH, str(ctx.exception))
 
diff --git a/tests/test_audit.py b/tests/test_audit.py
index a44885a..06a7c41 100644
--- a/tests/test_audit.py
+++ b/tests/test_audit.py
@@ -329,13 +329,17 @@ class TestGatedToolAudit(_AuditWiringBase):
     @patch("mcp_server.api_request")
     @patch("mcp_server.get_auth_header", return_value=FAKE_AUTH)
     def test_merge_success_audited(self, _auth, mock_api):
-        # user, pr, feedback pr+reviews, merge POST, readback.
+        # user, pr, eligibility feedback pr+reviews (#695), gate-7 feedback
+        # pr+reviews, merge POST, readback.
+        approval = [{
+            "id": 1, "user": {"login": "reviewer-bot"}, "state": "APPROVED",
+            "commit_id": "abc123", "submitted_at": "2026-07-06T10:00:00Z",
+            "dismissed": False,
+        }]
         mock_api.side_effect = [
             {"login": "merger-bot"}, self._pr("author-bot"),
-            self._pr("author-bot"),
-            [{"id": 1, "user": {"login": "reviewer-bot"}, "state": "APPROVED",
-              "commit_id": "abc123", "submitted_at": "2026-07-06T10:00:00Z",
-              "dismissed": False}],
+            self._pr("author-bot"), approval,  # eligibility merge feedback
+            self._pr("author-bot"), approval,  # gate 7 feedback
             {}, {"merged_commit_sha": "c1"},
         ]
         env = self._env(GITEA_PROFILE_NAME="gitea-merger",
diff --git a/tests/test_audit_reconciliation_mode.py b/tests/test_audit_reconciliation_mode.py
index e429ddf..a80da41 100644
--- a/tests/test_audit_reconciliation_mode.py
+++ b/tests/test_audit_reconciliation_mode.py
@@ -27,7 +27,13 @@ from task_capability_map import required_permission, required_role
 
 DELETE_PROFILE = {
     "profile_name": "prgs-author-delete",
-    "allowed_operations": ["gitea.read", "gitea.branch.delete"],
+    "role": "author",
+    "allowed_operations": [
+        "gitea.read",
+        "gitea.pr.create",
+        "gitea.branch.push",
+        "gitea.branch.delete",
+    ],
     "forbidden_operations": [],
     "audit_label": "prgs-author-delete",
 }
diff --git a/tests/test_branch_cleanup_guard.py b/tests/test_branch_cleanup_guard.py
index dd4053f..ec62ca3 100644
--- a/tests/test_branch_cleanup_guard.py
+++ b/tests/test_branch_cleanup_guard.py
@@ -8,10 +8,33 @@ import branch_cleanup_guard as guard  # noqa: E402
 import mcp_server  # noqa: E402
 import task_capability_map  # noqa: E402
 from final_report_validator import assess_final_report_validator  # noqa: E402
-from mcp_server import gitea_cleanup_merged_pr_branch  # noqa: E402
+from mcp_server import gitea_cleanup_merged_pr_branch, gitea_delete_branch  # noqa: E402
 
 FAKE_AUTH = "token fake"
 
+# Reconciler-shaped profile that holds branch.delete (recommended) plus
+# required pr.close/read so _role_kind classifies as reconciler.
+RECONCILER_WITH_DELETE = {
+    "profile_name": "prgs-reconciler",
+    "role": "reconciler",
+    "allowed_operations": [
+        "gitea.read",
+        "gitea.pr.close",
+        "gitea.pr.comment",
+        "gitea.issue.comment",
+        "gitea.issue.close",
+        "gitea.branch.delete",
+    ],
+    "forbidden_operations": [
+        "gitea.pr.approve",
+        "gitea.pr.merge",
+        "gitea.pr.review",
+        "gitea.pr.create",
+        "gitea.branch.push",
+        "gitea.repo.commit",
+    ],
+}
+
 
 class TestRawBranchDeleteGuard(unittest.TestCase):
     def test_detects_local_and_remote_raw_git_delete_commands(self):
@@ -69,6 +92,11 @@ class TestMergedPrBranchCleanupTool(unittest.TestCase):
             "mcp_server.merged_cleanup_reconcile.is_head_ancestor_of_ref",
             return_value=True,
         ).start()
+        # Default: no active ownership records (tests that need ownership patch this).
+        patch(
+            "mcp_server._collect_branch_ownership_records",
+            return_value={"records": [], "inventory_error": False},
+        ).start()
 
     def tearDown(self):
         patch.stopall()
@@ -93,14 +121,48 @@ class TestMergedPrBranchCleanupTool(unittest.TestCase):
         self.assertEqual(res["required_permission"], "gitea.branch.delete")
         self.mock_api.assert_not_called()
 
+    def test_author_and_merger_without_delete_authority_fail_closed(self):
+        role_profiles = {
+            "author": [
+                "gitea.read",
+                "gitea.branch.create",
+                "gitea.branch.push",
+                "gitea.repo.commit",
+                "gitea.pr.create",
+            ],
+            "merger": ["gitea.read", "gitea.pr.merge"],
+        }
+        for name, allowed in role_profiles.items():
+            with self.subTest(role=name):
+                profile_patch = patch(
+                    "mcp_server.get_profile",
+                    return_value={
+                        "profile_name": name,
+                        "allowed_operations": allowed,
+                        "forbidden_operations": [],
+                    },
+                )
+                profile_patch.start()
+                try:
+                    res = gitea_cleanup_merged_pr_branch(
+                        pr_number=487,
+                        confirmation="CLEANUP MERGED PR 487 BRANCH feat/branch",
+                        branch="feat/branch",
+                        remote="prgs",
+                        worktree_path="/tmp/repo/branches/cleanup",
+                    )
+                finally:
+                    profile_patch.stop()
+                self.assertFalse(res["performed"])
+                self.assertEqual(
+                    res["required_permission"], "gitea.branch.delete"
+                )
+                self.mock_api.assert_not_called()
+
     def test_root_checkout_cleanup_fails_closed(self):
         patch(
             "mcp_server.get_profile",
-            return_value={
-                "profile_name": "branch-cleanup",
-                "allowed_operations": ["gitea.read", "gitea.branch.delete"],
-                "forbidden_operations": [],
-            },
+            return_value=dict(RECONCILER_WITH_DELETE),
         ).start()
         res = gitea_cleanup_merged_pr_branch(
             pr_number=487,
@@ -117,23 +179,36 @@ class TestMergedPrBranchCleanupTool(unittest.TestCase):
         branch = "feat/issue-485-lease-comments-non-list-guard"
         patch(
             "mcp_server.get_profile",
-            return_value={
-                "profile_name": "branch-cleanup",
-                "allowed_operations": ["gitea.read", "gitea.branch.delete"],
-                "forbidden_operations": [],
-            },
+            return_value=dict(RECONCILER_WITH_DELETE),
         ).start()
-        self.mock_api.side_effect = [
-            {
-                "number": 487,
-                "merged": True,
-                "merged_at": "2026-07-08T01:00:00Z",
-                "head": {"ref": branch, "sha": "a" * 40},
-                "base": {"ref": "master"},
-            },
-            {},
-            {},
-        ]
+
+        def _api(method, url, *args, **kwargs):
+            if method == "GET" and "/pulls/" in url:
+                return {
+                    "number": 487,
+                    "merged": True,
+                    "merged_at": "2026-07-08T01:00:00Z",
+                    "head": {"ref": branch, "sha": "a" * 40},
+                    "base": {"ref": "master"},
+                }
+            if method == "GET" and "/branches/" in url:
+                # First pre-delete probe: present. Post-delete: not found.
+                get_branch_calls = [
+                    c
+                    for c in self.mock_api.call_args_list
+                    if c.args and c.args[0] == "GET" and "/branches/" in c.args[1]
+                ]
+                if len(get_branch_calls) <= 1:
+                    return {"name": branch}
+                raise RuntimeError("HTTP 404: not found")
+            if method == "GET" and url.rstrip("/").endswith("/Example-Repo"):
+                # Repo reachability probe after branch 404 (R1 branch-scoped).
+                return {"full_name": "Example-Org/Example-Repo"}
+            if method == "DELETE":
+                return {}
+            raise AssertionError(f"unexpected {method} {url}")
+
+        self.mock_api.side_effect = _api
         res = gitea_cleanup_merged_pr_branch(
             pr_number=487,
             confirmation=f"CLEANUP MERGED PR 487 BRANCH {branch}",
@@ -141,7 +216,11 @@ class TestMergedPrBranchCleanupTool(unittest.TestCase):
             remote="prgs",
             worktree_path="/tmp/repo/branches/cleanup",
         )
+        self.assertTrue(res["success"])
         self.assertTrue(res["performed"])
+        self.assertTrue(res["delete_acknowledged"])
+        self.assertTrue(res["verified_absent"])
+        self.assertTrue((res.get("readback") or {}).get("verified_absent"))
         delete_calls = [
             call for call in self.mock_api.call_args_list if call.args[0] == "DELETE"
         ]
@@ -152,11 +231,7 @@ class TestMergedPrBranchCleanupTool(unittest.TestCase):
         branch = "feat/issue-485-lease-comments-non-list-guard"
         patch(
             "mcp_server.get_profile",
-            return_value={
-                "profile_name": "branch-cleanup",
-                "allowed_operations": ["gitea.read", "gitea.branch.delete"],
-                "forbidden_operations": [],
-            },
+            return_value=dict(RECONCILER_WITH_DELETE),
         ).start()
         self.mock_api.side_effect = [
             {
@@ -182,6 +257,1010 @@ class TestMergedPrBranchCleanupTool(unittest.TestCase):
         ]
         self.assertFalse(delete_calls)
 
+    def test_reconciler_with_branch_delete_cannot_raw_delete(self):
+        """#687: reconciler + gitea.branch.delete still cannot call raw delete."""
+        patch(
+            "mcp_server.get_profile",
+            return_value=dict(RECONCILER_WITH_DELETE),
+        ).start()
+        res = gitea_delete_branch(
+            branch="fix/issue-683-workflow-guard-hardening",
+            remote="prgs",
+        )
+        self.assertFalse(res.get("success", True))
+        self.assertFalse(res.get("performed", True))
+        reasons = " ".join(res.get("reasons") or [])
+        self.assertIn("raw gitea_delete_branch", reasons)
+        self.assertIn("cleanup_merged_pr_branch", reasons)
+        self.mock_api.assert_not_called()
+
+    def test_reconciler_raw_delete_denies_preservation_branch(self):
+        patch(
+            "mcp_server.get_profile",
+            return_value=dict(RECONCILER_WITH_DELETE),
+        ).start()
+        res = gitea_delete_branch(
+            branch="chore/issue-681-preserve-review-session-wip",
+            remote="prgs",
+        )
+        self.assertFalse(res.get("performed", True))
+        self.mock_api.assert_not_called()
+
+    def test_author_with_branch_delete_role_ok_but_preserve_blocked(self):
+        """Author role may use raw delete path when permitted; preserve fails closed."""
+        patch(
+            "mcp_server.get_profile",
+            return_value={
+                "profile_name": "prgs-author",
+                "role": "author",
+                "allowed_operations": [
+                    "gitea.read",
+                    "gitea.pr.create",
+                    "gitea.branch.push",
+                    "gitea.branch.delete",
+                ],
+                "forbidden_operations": ["gitea.pr.approve", "gitea.pr.merge"],
+            },
+        ).start()
+        res = gitea_delete_branch(
+            branch="chore/issue-681-preserve-review-session-wip",
+            remote="prgs",
+        )
+        self.assertFalse(res.get("performed", True))
+        self.assertIn("preservation", " ".join(res.get("reasons") or []))
+        self.mock_api.assert_not_called()
+
+    def test_unmerged_branch_cleanup_rejected(self):
+        branch = "feat/unmerged-work"
+        patch(
+            "mcp_server.get_profile",
+            return_value=dict(RECONCILER_WITH_DELETE),
+        ).start()
+        self.mock_api.side_effect = [
+            {
+                "number": 999,
+                "merged": False,
+                "merged_at": None,
+                "head": {"ref": branch, "sha": "b" * 40},
+                "base": {"ref": "master"},
+            },
+            {},
+        ]
+        res = gitea_cleanup_merged_pr_branch(
+            pr_number=999,
+            confirmation=f"CLEANUP MERGED PR 999 BRANCH {branch}",
+            branch=branch,
+            remote="prgs",
+            worktree_path="/tmp/repo/branches/cleanup",
+        )
+        self.assertFalse(res["performed"])
+        self.assertTrue(
+            any("not merged" in r for r in (res.get("reasons") or []))
+        )
+        delete_calls = [
+            call for call in self.mock_api.call_args_list if call.args[0] == "DELETE"
+        ]
+        self.assertFalse(delete_calls)
+
+    def test_preservation_branch_cleanup_rejected(self):
+        branch = "chore/issue-681-preserve-review-session-wip"
+        patch(
+            "mcp_server.get_profile",
+            return_value=dict(RECONCILER_WITH_DELETE),
+        ).start()
+        self.mock_api.side_effect = [
+            {
+                "number": 681,
+                "merged": True,
+                "merged_at": "2026-07-08T01:00:00Z",
+                "head": {"ref": branch, "sha": "c" * 40},
+                "base": {"ref": "master"},
+            },
+            {},
+        ]
+        res = gitea_cleanup_merged_pr_branch(
+            pr_number=681,
+            confirmation=f"CLEANUP MERGED PR 681 BRANCH {branch}",
+            branch=branch,
+            remote="prgs",
+            worktree_path="/tmp/repo/branches/cleanup",
+        )
+        self.assertFalse(res["performed"])
+        self.assertTrue(
+            any("preservation" in r for r in (res.get("reasons") or []))
+        )
+        delete_calls = [
+            call for call in self.mock_api.call_args_list if call.args[0] == "DELETE"
+        ]
+        self.assertFalse(delete_calls)
+
+    def test_non_reconciler_with_delete_denied_cleanup(self):
+        patch(
+            "mcp_server.get_profile",
+            return_value={
+                "profile_name": "prgs-author",
+                "role": "author",
+                "allowed_operations": [
+                    "gitea.read",
+                    "gitea.pr.create",
+                    "gitea.branch.push",
+                    "gitea.branch.delete",
+                ],
+                "forbidden_operations": [],
+            },
+        ).start()
+        res = gitea_cleanup_merged_pr_branch(
+            pr_number=487,
+            confirmation="CLEANUP MERGED PR 487 BRANCH feat/branch",
+            branch="feat/branch",
+            remote="prgs",
+            worktree_path="/tmp/repo/branches/cleanup",
+        )
+        self.assertFalse(res["performed"])
+        self.assertEqual(res.get("required_role_kind"), "reconciler")
+        self.mock_api.assert_not_called()
+
+    def test_assess_guard_rejects_preservation_branch(self):
+        assessment = guard.assess_merged_pr_branch_cleanup(
+            pr_number=681,
+            head_branch="chore/issue-681-preserve-review-session-wip",
+            merged=True,
+            remote_branch_exists=True,
+            open_pr_heads=set(),
+            head_on_target=True,
+            delete_capability_allowed=True,
+            confirmation=(
+                "CLEANUP MERGED PR 681 BRANCH "
+                "chore/issue-681-preserve-review-session-wip"
+            ),
+        )
+        self.assertFalse(assessment["safe_to_delete"])
+        self.assertTrue(
+            any("preservation" in r for r in assessment["block_reasons"])
+        )
+
+
+
+class TestPostDeleteReadback(unittest.TestCase):
+    def test_branch_scoped_not_found_is_verified_success(self):
+        readback = guard.classify_branch_readback_http_status(
+            404, not_found_scope=guard.NOT_FOUND_SCOPE_BRANCH
+        )
+        result = guard.assess_post_delete_readback(readback)
+        self.assertTrue(result["ok"])
+        self.assertTrue(result["verified_absent"])
+        self.assertTrue(result["readback"]["verified_absent"])
+
+    def test_generic_404_not_verified_absent(self):
+        # R1: bare 404 must not verify absence
+        for scope in (None, guard.NOT_FOUND_SCOPE_UNKNOWN,
+                      guard.NOT_FOUND_SCOPE_REPOSITORY,
+                      guard.NOT_FOUND_SCOPE_HOST):
+            with self.subTest(scope=scope):
+                readback = guard.classify_branch_readback_http_status(
+                    404, not_found_scope=scope
+                )
+                self.assertFalse(readback["verified_absent"])
+                result = guard.assess_post_delete_readback(readback)
+                self.assertFalse(result["ok"])
+                self.assertFalse(result["verified_absent"])
+
+    def test_exception_substring_404_not_verified(self):
+        # R1: substring/generic 404 without scope stays unverified
+        result = guard.classify_branch_readback_exception(
+            RuntimeError("HTTP 404: something not found")
+        )
+        self.assertFalse(result["verified_absent"])
+        self.assertNotEqual(result.get("not_found_scope"), guard.NOT_FOUND_SCOPE_BRANCH)
+
+    def test_exists_is_structured_failure(self):
+        readback = guard.classify_branch_readback_http_status(200)
+        result = guard.assess_post_delete_readback(readback)
+        self.assertFalse(result["ok"])
+        self.assertFalse(result["readback"]["verified_absent"])
+        self.assertTrue(result["readback"]["branch_present"])
+        self.assertIn("still present", " ".join(result["reasons"]))
+
+    def test_auth_failure_preserved(self):
+        readback = guard.classify_branch_readback_http_status(401)
+        result = guard.assess_post_delete_readback(readback)
+        self.assertFalse(result["ok"])
+        self.assertEqual(result["readback"]["error_class"], "authentication")
+        self.assertIn("authentication", " ".join(result["reasons"]))
+
+    def test_authz_and_transport_failures(self):
+        for code, err in ((403, "authorization"), (503, "transport")):
+            with self.subTest(code=code):
+                readback = guard.classify_branch_readback_http_status(code)
+                result = guard.assess_post_delete_readback(readback)
+                self.assertFalse(result["ok"])
+                self.assertEqual(result["readback"]["error_class"], err)
+
+    def test_exception_classifier_no_secret_leak(self):
+        class FakeHTTPError(Exception):
+            def __init__(self):
+                super().__init__("HTTP 401: token=super-secret-value Authorization: Bearer xyz")
+                self.code = 401
+
+        result = guard.classify_branch_readback_exception(FakeHTTPError())
+        blob = str(result)
+        self.assertNotIn("super-secret", blob)
+        self.assertNotIn("Bearer", blob)
+        self.assertEqual(result["error_class"], "authentication")
+
+
+class TestActiveBranchOwnership(unittest.TestCase):
+    def _base(self, **overrides):
+        rec = {
+            "category": guard.OWNERSHIP_CATEGORY_AUTHOR_LEASE,
+            "status": "active",
+            "remote": "prgs",
+            "host": "gitea.prgs.cc",
+            "org": "Scaled-Tech-Consulting",
+            "repo": "Gitea-Tools",
+            "branch": "feat/target",
+            "reclaim_allowed": False,
+        }
+        rec.update(overrides)
+        return rec
+
+    def test_active_author_blocks(self):
+        result = guard.assess_active_branch_ownership(
+            remote="prgs",
+            org="Scaled-Tech-Consulting",
+            repo="Gitea-Tools",
+            branch="feat/target",
+            host="gitea.prgs.cc",
+            records=[self._base()],
+        )
+        self.assertTrue(result["block"])
+        self.assertIn(guard.OWNERSHIP_CATEGORY_AUTHOR_LEASE, result["blocking_categories"])
+
+    def test_active_reviewer_lease_blocks(self):
+        result = guard.assess_active_branch_ownership(
+            remote="prgs",
+            org="Scaled-Tech-Consulting",
+            repo="Gitea-Tools",
+            branch="feat/target",
+            host="gitea.prgs.cc",
+            records=[
+                self._base(
+                    category=guard.OWNERSHIP_CATEGORY_REVIEWER_LEASE,
+                    status="active",
+                )
+            ],
+        )
+        self.assertTrue(result["block"])
+        self.assertIn(guard.OWNERSHIP_CATEGORY_REVIEWER_LEASE, result["blocking_categories"])
+
+    def test_merger_controller_reconciler_binding_blocks(self):
+        for cat in (
+            guard.OWNERSHIP_CATEGORY_MERGER_LEASE,
+            guard.OWNERSHIP_CATEGORY_CONTROLLER_LEASE,
+            guard.OWNERSHIP_CATEGORY_RECONCILER_LEASE,
+            guard.OWNERSHIP_CATEGORY_WORKTREE_BINDING,
+        ):
+            with self.subTest(category=cat):
+                result = guard.assess_active_branch_ownership(
+                    remote="prgs",
+                    org="Scaled-Tech-Consulting",
+                    repo="Gitea-Tools",
+                    branch="feat/target",
+                    host="gitea.prgs.cc",
+                    records=[self._base(category=cat, status="active")],
+                )
+                self.assertTrue(result["block"])
+                self.assertIn(cat, result["blocking_categories"])
+
+    def test_released_and_expired_reclaimable_do_not_block(self):
+        records = [
+            self._base(status="released", reclaim_allowed=True),
+            self._base(
+                category=guard.OWNERSHIP_CATEGORY_REVIEWER_LEASE,
+                status="expired",
+                reclaim_allowed=True,
+            ),
+        ]
+        result = guard.assess_active_branch_ownership(
+            remote="prgs",
+            org="Scaled-Tech-Consulting",
+            repo="Gitea-Tools",
+            branch="feat/target",
+            host="gitea.prgs.cc",
+            records=records,
+        )
+        self.assertFalse(result["block"])
+
+    def test_sticky_stale_blocks_per_recovery_policy(self):
+        result = guard.assess_active_branch_ownership(
+            remote="prgs",
+            org="Scaled-Tech-Consulting",
+            repo="Gitea-Tools",
+            branch="feat/target",
+            host="gitea.prgs.cc",
+            records=[self._base(status="stale", reclaim_allowed=False)],
+        )
+        self.assertTrue(result["block"])
+        self.assertTrue(
+            any(
+                token in " ".join(result["reasons"])
+                for token in ("sticky", "reclaim not proven", "fail closed")
+            )
+        )
+
+    def test_other_repo_or_branch_no_false_block(self):
+        records = [
+            self._base(repo="Other-Repo", status="active"),
+            self._base(branch="feat/other", status="active"),
+            self._base(remote="dadeschools", status="active"),
+            self._base(host="gitea.other.host", status="active"),
+        ]
+        result = guard.assess_active_branch_ownership(
+            remote="prgs",
+            org="Scaled-Tech-Consulting",
+            repo="Gitea-Tools",
+            branch="feat/target",
+            host="gitea.prgs.cc",
+            records=records,
+        )
+        self.assertFalse(result["block"])
+        self.assertEqual(len(result["ignored_out_of_scope"]), 4)
+
+    def test_normalized_host_matching(self):
+        # Host identity is normalized (scheme/path stripped)
+        records = [self._base(host="https://gitea.prgs.cc/")]
+        result = guard.assess_active_branch_ownership(
+            remote="prgs",
+            org="Scaled-Tech-Consulting",
+            repo="Gitea-Tools",
+            branch="feat/target",
+            host="gitea.prgs.cc",
+            records=records,
+        )
+        self.assertTrue(result["block"])
+
+    def test_denial_has_no_secrets(self):
+        result = guard.assess_active_branch_ownership(
+            remote="prgs",
+            org="Scaled-Tech-Consulting",
+            repo="Gitea-Tools",
+            branch="feat/target",
+            host="gitea.prgs.cc",
+            records=[
+                self._base(
+                    status="active",
+                    # Poison fields that must never be echoed as secrets
+                    token="sekrit-token",
+                    authorization="Bearer abc",
+                )
+            ],
+        )
+        blob = str(result)
+        self.assertNotIn("sekrit", blob)
+        self.assertNotIn("Bearer", blob)
+        self.assertIn("author_lease", blob)
+
+
+class TestCleanupReadbackAndOwnershipIntegration(unittest.TestCase):
+    def setUp(self):
+        self._remotes = patch.dict(
+            mcp_server.REMOTES,
+            {
+                "prgs": {
+                    "host": "gitea.example.com",
+                    "org": "Example-Org",
+                    "repo": "Example-Repo",
+                }
+            },
+        )
+        self._remotes.start()
+        patch("gitea_audit.audit_enabled", return_value=False).start()
+        self.mock_api = patch("mcp_server.api_request").start()
+        patch("mcp_server.api_get_all", return_value=[]).start()
+        patch("mcp_server.get_auth_header", return_value=FAKE_AUTH).start()
+        patch(
+            "mcp_server.merged_cleanup_reconcile.is_head_ancestor_of_ref",
+            return_value=True,
+        ).start()
+        patch(
+            "mcp_server.get_profile",
+            return_value=dict(RECONCILER_WITH_DELETE),
+        ).start()
+
+    def tearDown(self):
+        patch.stopall()
+
+    def _pr_payload(self, branch, number=487):
+        return {
+            "number": number,
+            "merged": True,
+            "merged_at": "2026-07-08T01:00:00Z",
+            "head": {"ref": branch, "sha": "a" * 40},
+            "base": {"ref": "master"},
+        }
+
+    def test_delete_success_but_branch_remains(self):
+        branch = "feat/still-there"
+        patch(
+            "mcp_server._collect_branch_ownership_records",
+            return_value={"records": [], "inventory_error": False},
+        ).start()
+
+        def _api(method, url, *a, **k):
+            if method == "GET" and "/pulls/" in url:
+                return self._pr_payload(branch)
+            if method == "GET" and "/branches/" in url:
+                return {"name": branch}  # present before and after
+            if method == "DELETE":
+                return {}
+            raise AssertionError(method)
+
+        self.mock_api.side_effect = _api
+        res = gitea_cleanup_merged_pr_branch(
+            pr_number=487,
+            confirmation=f"CLEANUP MERGED PR 487 BRANCH {branch}",
+            branch=branch,
+            remote="prgs",
+            worktree_path="/tmp/repo/branches/cleanup",
+        )
+        self.assertTrue(res.get("performed"))
+        self.assertFalse(res.get("success"))
+        self.assertTrue(res.get("delete_acknowledged"))
+        self.assertFalse(res.get("verified_absent"))
+        self.assertIn("still present", " ".join(res.get("reasons") or []))
+
+    def test_readback_authentication_failure(self):
+        branch = "feat/auth-fail-readback"
+        patch(
+            "mcp_server._collect_branch_ownership_records",
+            return_value={"records": [], "inventory_error": False},
+        ).start()
+        state = {"branch_gets": 0}
+
+        def _api(method, url, *a, **k):
+            if method == "GET" and "/pulls/" in url:
+                return self._pr_payload(branch)
+            if method == "GET" and "/branches/" in url:
+                state["branch_gets"] += 1
+                if state["branch_gets"] == 1:
+                    return {"name": branch}
+                raise RuntimeError("HTTP 401: unauthorized")
+            if method == "DELETE":
+                return {}
+            raise AssertionError(method)
+
+        self.mock_api.side_effect = _api
+        res = gitea_cleanup_merged_pr_branch(
+            pr_number=487,
+            confirmation=f"CLEANUP MERGED PR 487 BRANCH {branch}",
+            branch=branch,
+            remote="prgs",
+            worktree_path="/tmp/repo/branches/cleanup",
+        )
+        self.assertTrue(res.get("performed"))
+        self.assertFalse(res.get("success"))
+        self.assertEqual((res.get("readback") or {}).get("error_class"), "authentication")
+
+    def test_readback_transport_failure(self):
+        branch = "feat/transport-fail-readback"
+        patch(
+            "mcp_server._collect_branch_ownership_records",
+            return_value={"records": [], "inventory_error": False},
+        ).start()
+        state = {"branch_gets": 0}
+
+        def _api(method, url, *a, **k):
+            if method == "GET" and "/pulls/" in url:
+                return self._pr_payload(branch)
+            if method == "GET" and "/branches/" in url:
+                state["branch_gets"] += 1
+                if state["branch_gets"] == 1:
+                    return {"name": branch}
+                raise RuntimeError("HTTP 503: temporarily unavailable")
+            if method == "DELETE":
+                return {}
+            raise AssertionError(method)
+
+        self.mock_api.side_effect = _api
+        res = gitea_cleanup_merged_pr_branch(
+            pr_number=487,
+            confirmation=f"CLEANUP MERGED PR 487 BRANCH {branch}",
+            branch=branch,
+            remote="prgs",
+            worktree_path="/tmp/repo/branches/cleanup",
+        )
+        self.assertFalse(res.get("success"))
+        self.assertEqual((res.get("readback") or {}).get("error_class"), "transport")
+
+    def test_active_author_ownership_blocks_before_delete(self):
+        branch = "feat/owned"
+        patch(
+            "mcp_server._collect_branch_ownership_records",
+            return_value={
+                "records": [
+                    {
+                        "category": guard.OWNERSHIP_CATEGORY_AUTHOR_LEASE,
+                        "status": "active",
+                        "remote": "prgs",
+                        "host": "gitea.example.com",
+                        "org": "Example-Org",
+                        "repo": "Example-Repo",
+                        "branch": branch,
+                        "reclaim_allowed": False,
+                    }
+                ],
+                "inventory_error": False,
+            },
+        ).start()
+
+        def _api(method, url, *a, **k):
+            if method == "GET" and "/pulls/" in url:
+                return self._pr_payload(branch)
+            if method == "GET" and "/branches/" in url:
+                return {"name": branch}
+            raise AssertionError(f"unexpected mutation {method}")
+
+        self.mock_api.side_effect = _api
+        res = gitea_cleanup_merged_pr_branch(
+            pr_number=487,
+            confirmation=f"CLEANUP MERGED PR 487 BRANCH {branch}",
+            branch=branch,
+            remote="prgs",
+            worktree_path="/tmp/repo/branches/cleanup",
+        )
+        self.assertFalse(res.get("performed"))
+        self.assertFalse(res.get("success"))
+        self.assertEqual(res.get("blocker_kind"), "active_branch_ownership")
+        self.assertIn(
+            guard.OWNERSHIP_CATEGORY_AUTHOR_LEASE,
+            (res.get("ownership") or {}).get("blocking_categories") or [],
+        )
+        delete_calls = [
+            c for c in self.mock_api.call_args_list if c.args and c.args[0] == "DELETE"
+        ]
+        self.assertFalse(delete_calls)
+
+    def test_open_pr_guard_still_blocks(self):
+        branch = "feat/open-pr-head"
+        patch(
+            "mcp_server._collect_branch_ownership_records",
+            return_value={"records": [], "inventory_error": False},
+        ).start()
+        patch(
+            "mcp_server.api_get_all",
+            return_value=[{"head": {"ref": branch}, "number": 999}],
+        ).start()
+
+        def _api(method, url, *a, **k):
+            if method == "GET" and "/pulls/" in url:
+                return self._pr_payload(branch, number=487)
+            if method == "GET" and "/branches/" in url:
+                return {"name": branch}
+            raise AssertionError(method)
+
+        self.mock_api.side_effect = _api
+        res = gitea_cleanup_merged_pr_branch(
+            pr_number=487,
+            confirmation=f"CLEANUP MERGED PR 487 BRANCH {branch}",
+            branch=branch,
+            remote="prgs",
+            worktree_path="/tmp/repo/branches/cleanup",
+        )
+        self.assertFalse(res.get("performed"))
+        self.assertTrue(any("open PR" in r for r in (res.get("reasons") or [])))
+
+    def test_non_ancestor_guard_still_blocks(self):
+        branch = "feat/not-ancestor"
+        patch(
+            "mcp_server._collect_branch_ownership_records",
+            return_value={"records": [], "inventory_error": False},
+        ).start()
+        patch(
+            "mcp_server.merged_cleanup_reconcile.is_head_ancestor_of_ref",
+            return_value=False,
+        ).start()
+
+        def _api(method, url, *a, **k):
+            if method == "GET" and "/pulls/" in url:
+                return self._pr_payload(branch)
+            if method == "GET" and "/branches/" in url:
+                return {"name": branch}
+            raise AssertionError(method)
+
+        self.mock_api.side_effect = _api
+        res = gitea_cleanup_merged_pr_branch(
+            pr_number=487,
+            confirmation=f"CLEANUP MERGED PR 487 BRANCH {branch}",
+            branch=branch,
+            remote="prgs",
+            worktree_path="/tmp/repo/branches/cleanup",
+        )
+        self.assertFalse(res.get("performed"))
+        self.assertTrue(any("ancestor" in r for r in (res.get("reasons") or [])))
+
+    def test_protected_default_branch_guard(self):
+        branch = "master"
+        patch(
+            "mcp_server._collect_branch_ownership_records",
+            return_value={"records": [], "inventory_error": False},
+        ).start()
+
+        def _api(method, url, *a, **k):
+            if method == "GET" and "/pulls/" in url:
+                return self._pr_payload(branch)
+            if method == "GET" and "/branches/" in url:
+                return {"name": branch}
+            raise AssertionError(method)
+
+        self.mock_api.side_effect = _api
+        res = gitea_cleanup_merged_pr_branch(
+            pr_number=487,
+            confirmation=f"CLEANUP MERGED PR 487 BRANCH {branch}",
+            branch=branch,
+            remote="prgs",
+            worktree_path="/tmp/repo/branches/cleanup",
+        )
+        self.assertFalse(res.get("performed"))
+        self.assertTrue(any("protected" in r for r in (res.get("reasons") or [])))
+
+
+
+
+class TestSecondRemediationR1R2(unittest.TestCase):
+    """R1/R2 second-remediation: branch-scoped 404 and top-level fields."""
+
+    def test_cleanup_envelope_always_has_top_level_fields(self):
+        env = guard.cleanup_result_envelope(
+            success=False,
+            performed=False,
+            delete_acknowledged=False,
+            verified_absent=False,
+            reasons=["x"],
+        )
+        for key in ("success", "performed", "delete_acknowledged", "verified_absent"):
+            self.assertIn(key, env)
+            self.assertIsInstance(env[key], bool)
+
+    def test_repo_scoped_404_never_verified(self):
+        rb = guard.classify_branch_readback_http_status(
+            404, not_found_scope=guard.NOT_FOUND_SCOPE_REPOSITORY
+        )
+        self.assertFalse(rb["verified_absent"])
+        assessed = guard.assess_post_delete_readback(rb)
+        self.assertFalse(assessed["ok"])
+        self.assertFalse(assessed["verified_absent"])
+
+    def test_wrong_host_404_never_verified(self):
+        rb = guard.classify_branch_readback_http_status(
+            404, not_found_scope=guard.NOT_FOUND_SCOPE_HOST
+        )
+        self.assertFalse(rb["verified_absent"])
+
+
+class TestSecondRemediationOwnership(unittest.TestCase):
+    """O1/O2/O3 ownership second-remediation."""
+
+    def test_inventory_error_category_blocks(self):
+        result = guard.assess_active_branch_ownership(
+            remote="prgs",
+            org="Org",
+            repo="Repo",
+            branch="feat/x",
+            host="gitea.example.com",
+            records=[
+                {
+                    "category": guard.OWNERSHIP_CATEGORY_INVENTORY_ERROR,
+                    "status": "unknown",
+                    "remote": "prgs",
+                    "host": "gitea.example.com",
+                    "org": "Org",
+                    "repo": "Repo",
+                    "branch": "feat/x",
+                    "reclaim_allowed": False,
+                }
+            ],
+        )
+        self.assertTrue(result["block"])
+        self.assertIn(
+            guard.OWNERSHIP_CATEGORY_INVENTORY_ERROR,
+            result["blocking_categories"],
+        )
+
+    def test_expired_without_explicit_reclaim_blocks(self):
+        # O2: expired must not auto-allow
+        result = guard.assess_active_branch_ownership(
+            remote="prgs",
+            org="Org",
+            repo="Repo",
+            branch="feat/x",
+            host="gitea.example.com",
+            records=[
+                {
+                    "category": guard.OWNERSHIP_CATEGORY_MERGER_LEASE,
+                    "status": "expired",
+                    "remote": "prgs",
+                    "host": "gitea.example.com",
+                    "org": "Org",
+                    "repo": "Repo",
+                    "branch": "feat/x",
+                    # reclaim_allowed omitted / False
+                    "reclaim_allowed": False,
+                }
+            ],
+        )
+        self.assertTrue(result["block"])
+
+    def test_expired_with_explicit_reclaim_allowed_does_not_block(self):
+        result = guard.assess_active_branch_ownership(
+            remote="prgs",
+            org="Org",
+            repo="Repo",
+            branch="feat/x",
+            host="gitea.example.com",
+            records=[
+                {
+                    "category": guard.OWNERSHIP_CATEGORY_AUTHOR_LEASE,
+                    "status": "expired",
+                    "remote": "prgs",
+                    "host": "gitea.example.com",
+                    "org": "Org",
+                    "repo": "Repo",
+                    "branch": "feat/x",
+                    "reclaim_allowed": True,
+                }
+            ],
+        )
+        self.assertFalse(result["block"])
+
+    def test_active_reviewer_comment_lease_blocks(self):
+        result = guard.assess_active_branch_ownership(
+            remote="prgs",
+            org="Org",
+            repo="Repo",
+            branch="feat/x",
+            host="gitea.example.com",
+            records=[
+                {
+                    "category": guard.OWNERSHIP_CATEGORY_REVIEWER_LEASE,
+                    "status": "active",
+                    "remote": "prgs",
+                    "host": "gitea.example.com",
+                    "org": "Org",
+                    "repo": "Repo",
+                    "branch": "feat/x",
+                    "reclaim_allowed": False,
+                    "role": "reviewer",
+                }
+            ],
+        )
+        self.assertTrue(result["block"])
+        self.assertIn(
+            guard.OWNERSHIP_CATEGORY_REVIEWER_LEASE,
+            result["blocking_categories"],
+        )
+
+
+class TestSecondRemediationIntegration(unittest.TestCase):
+    def setUp(self):
+        self._remotes = patch.dict(
+            mcp_server.REMOTES,
+            {
+                "prgs": {
+                    "host": "gitea.example.com",
+                    "org": "Example-Org",
+                    "repo": "Example-Repo",
+                }
+            },
+        )
+        self._remotes.start()
+        patch("gitea_audit.audit_enabled", return_value=False).start()
+        self.mock_api = patch("mcp_server.api_request").start()
+        patch("mcp_server.api_get_all", return_value=[]).start()
+        patch("mcp_server.get_auth_header", return_value=FAKE_AUTH).start()
+        patch(
+            "mcp_server.merged_cleanup_reconcile.is_head_ancestor_of_ref",
+            return_value=True,
+        ).start()
+        patch(
+            "mcp_server.get_profile",
+            return_value=dict(RECONCILER_WITH_DELETE),
+        ).start()
+
+    def tearDown(self):
+        patch.stopall()
+
+    def _pr(self, branch, number=487):
+        return {
+            "number": number,
+            "merged": True,
+            "merged_at": "2026-07-08T01:00:00Z",
+            "head": {"ref": branch, "sha": "a" * 40},
+            "base": {"ref": "master"},
+        }
+
+    def test_r1_repo_404_after_delete_not_verified(self):
+        """After DELETE, branch 404 + repo 404 must not verify absence."""
+        branch = "feat/r1-repo-404"
+        patch(
+            "mcp_server._collect_branch_ownership_records",
+            return_value={"records": [], "inventory_error": False},
+        ).start()
+        state = {"branch_gets": 0}
+
+        def _api(method, url, *a, **k):
+            if method == "GET" and "/pulls/" in url:
+                return self._pr(branch)
+            if method == "GET" and "/branches/" in url:
+                state["branch_gets"] += 1
+                if state["branch_gets"] == 1:
+                    return {"name": branch}
+                raise RuntimeError("HTTP 404: not found")
+            if method == "GET" and url.rstrip("/").endswith("/Example-Repo"):
+                raise RuntimeError("HTTP 404: repository not found")
+            if method == "DELETE":
+                return {}
+            raise AssertionError(method + " " + url)
+
+        self.mock_api.side_effect = _api
+        res = gitea_cleanup_merged_pr_branch(
+            pr_number=487,
+            confirmation=f"CLEANUP MERGED PR 487 BRANCH {branch}",
+            branch=branch,
+            remote="prgs",
+            worktree_path="/tmp/repo/branches/cleanup",
+        )
+        self.assertTrue(res["performed"])
+        self.assertTrue(res["delete_acknowledged"])
+        self.assertFalse(res["success"])
+        self.assertFalse(res["verified_absent"])
+
+    def test_o1_inventory_error_blocks_before_delete(self):
+        branch = "feat/o1-inv"
+        patch(
+            "mcp_server._collect_branch_ownership_records",
+            return_value={"records": [], "inventory_error": True},
+        ).start()
+
+        def _api(method, url, *a, **k):
+            if method == "GET" and "/pulls/" in url:
+                return self._pr(branch)
+            if method == "GET" and "/branches/" in url:
+                return {"name": branch}
+            raise AssertionError(f"no mutation expected {method}")
+
+        self.mock_api.side_effect = _api
+        res = gitea_cleanup_merged_pr_branch(
+            pr_number=487,
+            confirmation=f"CLEANUP MERGED PR 487 BRANCH {branch}",
+            branch=branch,
+            remote="prgs",
+            worktree_path="/tmp/repo/branches/cleanup",
+        )
+        self.assertFalse(res["performed"])
+        self.assertFalse(res["delete_acknowledged"])
+        self.assertFalse(res["verified_absent"])
+        self.assertEqual(res.get("blocker_kind"), "active_branch_ownership")
+
+    def test_o3_comment_reviewer_lease_in_collector(self):
+        """Collector includes active comment-backed reviewer leases."""
+        active_lease = {
+            "pr_number": 10,
+            "phase": "claimed",
+            "session_id": "s1",
+            "expires_at": "2099-01-02T00:00:00Z",
+        }
+        with patch(
+            "mcp_server.api_get_all", return_value=[{"id": 1, "body": "x"}]
+        ), patch(
+            "mcp_server.reviewer_pr_lease.find_active_reviewer_lease",
+            return_value=active_lease,
+        ), patch(
+            "mcp_server.issue_lock_store.iter_lock_files", return_value=[]
+        ), patch(
+            "mcp_server.worktree_cleanup_audit.list_worktrees", return_value=[]
+        ), patch.object(
+            mcp_server.control_plane_db,
+            "ControlPlaneDB",
+            side_effect=RuntimeError("no cp"),
+        ):
+            bundle = mcp_server._collect_branch_ownership_records(
+                remote="prgs",
+                host="gitea.example.com",
+                org="Example-Org",
+                repo="Example-Repo",
+                branch="feat/x",
+                pr_number=10,
+                project_root="/tmp/repo",
+                auth=FAKE_AUTH,
+                base_api=(
+                    "https://gitea.example.com/api/v1/repos/"
+                    "Example-Org/Example-Repo"
+                ),
+            )
+        cats = {r.get("category") for r in bundle.get("records") or []}
+        self.assertIn(guard.OWNERSHIP_CATEGORY_REVIEWER_LEASE, cats)
+
+    def test_o4_reconcile_merged_cleanups_runs_ownership_and_readback(self):
+        from mcp_server import gitea_reconcile_merged_cleanups
+
+        branch = "feat/reconcile-o4"
+        ownership_calls = []
+
+        def fake_collect(**kwargs):
+            ownership_calls.append(kwargs)
+            return {"records": [], "inventory_error": False}
+
+        probe_calls = []
+
+        def fake_probe(h, o, r, auth, br):
+            probe_calls.append(br)
+            return guard.classify_branch_readback_http_status(
+                404, not_found_scope=guard.NOT_FOUND_SCOPE_BRANCH
+            )
+
+        report = {
+            "entries": [
+                {
+                    "pr_number": 1,
+                    "head_branch": branch,
+                    "remote_branch": {"safe_to_delete_remote": True},
+                    "local_worktree": {"safe_to_remove_worktree": False},
+                }
+            ],
+            "reviewer_scratch_entries": [],
+        }
+        patch(
+            "mcp_server.get_profile",
+            return_value={
+                "profile_name": "prgs-reconciler",
+                "role": "reconciler",
+                "allowed_operations": [
+                    "gitea.read",
+                    "gitea.branch.delete",
+                    "gitea.pr.close",
+                ],
+                "forbidden_operations": [],
+            },
+        ).start()
+        patch("mcp_server.api_get_all", return_value=[]).start()
+        patch(
+            "mcp_server.merged_cleanup_reconcile.build_reconciliation_report",
+            return_value=report,
+        ).start()
+        patch(
+            "mcp_server.merged_cleanup_reconcile.discover_reviewer_scratch_worktrees",
+            return_value=[],
+        ).start()
+        patch(
+            "mcp_server.audit_reconciliation_mode.check_cleanup_execution_allowed",
+            return_value=(True, []),
+        ).start()
+        patch("mcp_server.verify_preflight_purity", return_value=None).start()
+        patch(
+            "mcp_server._collect_branch_ownership_records",
+            side_effect=fake_collect,
+        ).start()
+        patch("mcp_server._probe_remote_branch", side_effect=fake_probe).start()
+        self.mock_api.side_effect = lambda *a, **k: {}
+
+        res = gitea_reconcile_merged_cleanups(
+            dry_run=False,
+            execute_confirmed=True,
+            remote="prgs",
+        )
+        self.assertTrue(res.get("performed") or res.get("executed"))
+        self.assertTrue(ownership_calls, "ownership must run before delete")
+        self.assertTrue(probe_calls, "post-delete readback must run")
+        actions = res.get("actions") or []
+        delete_actions = [
+            a for a in actions if a.get("action") == "delete_remote_branch"
+        ]
+        self.assertEqual(len(delete_actions), 1)
+        self.assertIn("verified_absent", delete_actions[0])
+        self.assertIn("delete_acknowledged", delete_actions[0])
+        self.assertTrue(delete_actions[0].get("verified_absent"))
+
+
 
 if __name__ == "__main__":
     unittest.main()
diff --git a/tests/test_canonical_comment_validator.py b/tests/test_canonical_comment_validator.py
index 47e75d8..1758771 100644
--- a/tests/test_canonical_comment_validator.py
+++ b/tests/test_canonical_comment_validator.py
@@ -94,6 +94,7 @@ REVIEW_STATUS: approved / approval_at_current_head
 MERGE_READY: true
 BLOCKERS: none
 VALIDATION: pytest passed; reviewer approved at head {FULL_SHA}
+NATIVE_REVIEW_PROOF: transport=native_mcp; entrypoint=mcp_server; token_fingerprint=testharmless
 LAST_UPDATED_BY: prgs-reviewer
 """
 
diff --git a/tests/test_issue_695_native_transport_quarantine.py b/tests/test_issue_695_native_transport_quarantine.py
new file mode 100644
index 0000000..25d17ce
--- /dev/null
+++ b/tests/test_issue_695_native_transport_quarantine.py
@@ -0,0 +1,848 @@
+"""Regression tests for Issue #695 — second incident (PR #694 / review 427).
+
+Reproduces offline import, env-only runtime spoof, exposed-token invocation,
+direct imports, basename entrypoint spoof, allow_test_bootstrap forgery,
+standalone quarantine attempts, and false “official workflow” canonical claims.
+Gates must fail closed.
+"""
+
+from __future__ import annotations
+
+import os
+import subprocess
+import sys
+import tempfile
+import textwrap
+import unittest
+from pathlib import Path
+from unittest.mock import patch
+
+import mcp_daemon_guard
+import merge_approval_gate
+import review_quarantine
+import canonical_comment_validator as ccv
+
+HEAD_694 = "1844e298809373be19a526fd39b7d8b0669eb5bd"
+HEAD_OTHER = "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
+REPO_ROOT = Path(__file__).resolve().parent.parent
+
+
+def _run_offline_snippet(snippet: str, *, env_extra: dict[str, str] | None = None) -> subprocess.CompletedProcess:
+    """Execute snippet in a fresh interpreter (no pytest modules)."""
+    env = os.environ.copy()
+    env.pop("PYTEST_CURRENT_TEST", None)
+    env.pop(mcp_daemon_guard.FORCE_PROVENANCE_FAIL_ENV, None)
+    env["PYTHONPATH"] = str(REPO_ROOT) + os.pathsep + env.get("PYTHONPATH", "")
+    if env_extra:
+        env.update(env_extra)
+    return subprocess.run(
+        [sys.executable, "-c", snippet],
+        capture_output=True,
+        text=True,
+        cwd=str(REPO_ROOT),
+        env=env,
+        timeout=30,
+        check=False,
+    )
+
+
+class TestNativeTransportBinding(unittest.TestCase):
+    def tearDown(self) -> None:
+        mcp_daemon_guard.clear_native_runtime_for_tests()
+        os.environ.pop(mcp_daemon_guard.FORCE_PROVENANCE_FAIL_ENV, None)
+        os.environ.pop(mcp_daemon_guard.SANCTIONED_DAEMON_ENV, None)
+        os.environ.pop(mcp_daemon_guard.ALLOW_DIRECT_IMPORT_ENV, None)
+
+    def test_env_alone_does_not_establish_native_transport(self):
+        mcp_daemon_guard.clear_native_runtime_for_tests()
+        os.environ[mcp_daemon_guard.SANCTIONED_DAEMON_ENV] = "1"
+        os.environ[mcp_daemon_guard.ALLOW_DIRECT_IMPORT_ENV] = "1"
+        os.environ[mcp_daemon_guard.FORCE_PROVENANCE_FAIL_ENV] = "1"
+        self.assertFalse(mcp_daemon_guard.is_native_mcp_transport())
+        with self.assertRaises(mcp_daemon_guard.UnsanctionedRuntimeError) as ctx:
+            mcp_daemon_guard.assert_sanctioned_mutation_runtime("offline_import")
+        msg = str(ctx.exception)
+        self.assertIn("#695", msg)
+        # FORCE disables pytest allowance; direct-import env is rejected first
+        # (AC1). Without ALLOW_DIRECT, env-alone also yields "not sufficient".
+        lowered = msg.lower()
+        self.assertTrue(
+            "direct" in lowered
+            or "not sufficient" in lowered
+            or "allow_direct" in lowered
+            or "gitea_allow_direct" in lowered,
+            msg,
+        )
+
+    def test_direct_import_mark_rejected_outside_entrypoint(self):
+        mcp_daemon_guard.clear_native_runtime_for_tests()
+        os.environ[mcp_daemon_guard.FORCE_PROVENANCE_FAIL_ENV] = "1"
+        with self.assertRaises(mcp_daemon_guard.UnsanctionedRuntimeError) as ctx:
+            mcp_daemon_guard.mark_sanctioned_daemon()
+        self.assertIn("canonical", str(ctx.exception).lower())
+        self.assertFalse(mcp_daemon_guard.is_native_mcp_transport())
+
+    def test_locally_generated_runtime_key_without_entrypoint_rejected(self):
+        """Spoofing process-local fields via mark outside entrypoint fails."""
+        mcp_daemon_guard.clear_native_runtime_for_tests()
+        os.environ[mcp_daemon_guard.FORCE_PROVENANCE_FAIL_ENV] = "1"
+        with self.assertRaises(mcp_daemon_guard.UnsanctionedRuntimeError):
+            mcp_daemon_guard.mark_sanctioned_daemon()
+
+    def test_test_native_runtime_for_hermetic_tests_not_production(self):
+        mcp_daemon_guard.clear_native_runtime_for_tests()
+        st = mcp_daemon_guard.install_test_native_runtime()
+        self.assertTrue(st["native_mcp_transport"])
+        self.assertTrue(mcp_daemon_guard.is_native_mcp_transport())
+        self.assertFalse(mcp_daemon_guard.is_production_native_mcp_transport())
+        mcp_daemon_guard.assert_sanctioned_mutation_runtime("test-bootstrap")
+        fields = mcp_daemon_guard.mutation_provenance_fields()
+        self.assertEqual(fields["transport"], "test_native_mcp")
+        self.assertTrue(fields["native_mcp_transport"])
+        self.assertFalse(fields["production_native_mcp_transport"])
+        self.assertIsNotNone(fields["native_token_fingerprint"])
+        with self.assertRaises(mcp_daemon_guard.UnsanctionedRuntimeError) as ctx:
+            mcp_daemon_guard.assert_production_mutation_runtime("prod-endpoint")
+        self.assertIn("Test-mode", str(ctx.exception))
+
+    def test_no_allow_test_bootstrap_parameter_on_mark(self):
+        import inspect
+
+        sig = inspect.signature(mcp_daemon_guard.mark_sanctioned_daemon)
+        self.assertNotIn("allow_test_bootstrap", sig.parameters)
+
+    def test_exposed_token_env_never_grants_native(self):
+        """Raw / exposed token env vars must never reconstruct native transport."""
+        mcp_daemon_guard.clear_native_runtime_for_tests()
+        os.environ[mcp_daemon_guard.FORCE_PROVENANCE_FAIL_ENV] = "1"
+        for key in (
+            "GITEA_TOKEN",
+            "GITEA_ACCESS_TOKEN",
+            "GITHUB_TOKEN",
+            "GITEA_MCP_TOKEN",
+            "GITEA_RAW_TOKEN",
+        ):
+            os.environ[key] = "exposed-token-value-must-not-authorize"
+        try:
+            self.assertFalse(mcp_daemon_guard.is_native_mcp_transport())
+            with self.assertRaises(mcp_daemon_guard.UnsanctionedRuntimeError):
+                mcp_daemon_guard.assert_sanctioned_mutation_runtime("exposed-token")
+        finally:
+            for key in (
+                "GITEA_TOKEN",
+                "GITEA_ACCESS_TOKEN",
+                "GITHUB_TOKEN",
+                "GITEA_MCP_TOKEN",
+                "GITEA_RAW_TOKEN",
+            ):
+                os.environ.pop(key, None)
+
+
+class TestAC9BypassRegressions(unittest.TestCase):
+    """AC9: empirically reproduced offline bypasses must fail closed (#695)."""
+
+    def tearDown(self) -> None:
+        mcp_daemon_guard.clear_native_runtime_for_tests()
+        os.environ.pop(mcp_daemon_guard.FORCE_PROVENANCE_FAIL_ENV, None)
+
+    def test_allow_test_bootstrap_cannot_authorize_fresh_offline_interpreter(self):
+        """Finding 1: former allow_test_bootstrap forge is gone and rejected offline."""
+        snippet = textwrap.dedent(
+            """
+            import inspect
+            import mcp_daemon_guard as g
+            sig = inspect.signature(g.mark_sanctioned_daemon)
+            assert "allow_test_bootstrap" not in sig.parameters, "bootstrap flag must not exist"
+            try:
+                g.mark_sanctioned_daemon(allow_test_bootstrap=True)
+            except TypeError:
+                pass
+            else:
+                raise SystemExit("mark_sanctioned_daemon accepted allow_test_bootstrap")
+            try:
+                g.install_test_native_runtime()
+            except g.UnsanctionedRuntimeError as exc:
+                assert "pytest" in str(exc).lower() or "#695" in str(exc)
+            else:
+                raise SystemExit("install_test_native_runtime authorized offline interpreter")
+            assert g.is_native_mcp_transport() is False
+            try:
+                g.assert_sanctioned_mutation_runtime("offline-bootstrap")
+            except g.UnsanctionedRuntimeError:
+                pass
+            else:
+                raise SystemExit("mutation runtime authorized after offline bootstrap attempt")
+            print("OK")
+            """
+        )
+        proc = _run_offline_snippet(snippet)
+        self.assertEqual(proc.returncode, 0, proc.stdout + proc.stderr)
+        self.assertIn("OK", proc.stdout)
+
+    def test_renamed_runner_named_mcp_server_py_rejected(self):
+        """Finding 2: basename-only entrypoint trust is insufficient."""
+        with tempfile.TemporaryDirectory() as tmp:
+            attacker = Path(tmp) / "mcp_server.py"
+            attacker.write_text(
+                textwrap.dedent(
+                    """
+                    import mcp_daemon_guard as g
+                    try:
+                        g.mark_sanctioned_daemon()
+                    except g.UnsanctionedRuntimeError as exc:
+                        print("REJECTED:" + str(exc))
+                        raise SystemExit(0)
+                    print("AUTHORIZED")
+                    raise SystemExit(1)
+                    """
+                ),
+                encoding="utf-8",
+            )
+            env = os.environ.copy()
+            env.pop("PYTEST_CURRENT_TEST", None)
+            env["PYTHONPATH"] = str(REPO_ROOT) + os.pathsep + env.get("PYTHONPATH", "")
+            proc = subprocess.run(
+                [sys.executable, str(attacker)],
+                capture_output=True,
+                text=True,
+                cwd=tmp,
+                env=env,
+                timeout=30,
+                check=False,
+            )
+            self.assertEqual(proc.returncode, 0, proc.stdout + proc.stderr)
+            self.assertIn("REJECTED:", proc.stdout)
+            self.assertIn("canonical", proc.stdout.lower())
+            self.assertNotIn("AUTHORIZED", proc.stdout)
+
+    def test_direct_launch_import_canonical_entrypoint_without_transport_rejected(self):
+        """Merely importing/launching real entrypoint offline must not authorize."""
+        snippet = textwrap.dedent(
+            f"""
+            import importlib.util
+            import mcp_daemon_guard as g
+            # Simulate claim-only phase (no transport bind).
+            g.clear_native_runtime_for_tests()
+            # Direct mark from non-entrypoint must fail.
+            try:
+                g.mark_sanctioned_daemon()
+            except g.UnsanctionedRuntimeError:
+                pass
+            assert g.is_native_mcp_transport() is False
+            # Even if someone forges entrypoint_claimed without transport bind:
+            g._NATIVE_RUNTIME = {{
+                "token": "x" * 64,
+                "token_fingerprint": "deadbeefdeadbeef",
+                "pid": __import__("os").getpid(),
+                "started_at": 0,
+                "entrypoint": "mcp_server",
+                "entrypoint_path": {str(REPO_ROOT / "mcp_server.py")!r},
+                "phase": "entrypoint_claimed",
+                "transport": None,
+                "mode": "production",
+            }}
+            assert g.is_native_mcp_transport() is False
+            try:
+                g.assert_sanctioned_mutation_runtime("import-only")
+            except g.UnsanctionedRuntimeError as exc:
+                assert "transport" in str(exc).lower() or "entrypoint" in str(exc).lower() or "#695" in str(exc)
+            else:
+                raise SystemExit("import-only claim authorized mutation")
+            print("OK")
+            """
+        )
+        proc = _run_offline_snippet(snippet)
+        self.assertEqual(proc.returncode, 0, proc.stdout + proc.stderr)
+        self.assertIn("OK", proc.stdout)
+
+    def test_spoofed_pytest_env_stack_path_rejected(self):
+        """Spoofed pytest/env/call-stack/path evidence must not authorize offline."""
+        snippet = textwrap.dedent(
+            f"""
+            import os
+            import mcp_daemon_guard as g
+            os.environ["PYTEST_CURRENT_TEST"] = "spoofed::test"
+            os.environ[g.SANCTIONED_DAEMON_ENV] = "1"
+            os.environ[g.ALLOW_DIRECT_IMPORT_ENV] = "1"
+            # Fresh interpreter has no pytest module; PYTEST_CURRENT_TEST alone
+            # might still trip is_pytest_runtime — force-unsanctioned is not set.
+            # But install_test_native_runtime requires real pytest path; if
+            # PYTEST_CURRENT_TEST alone grants is_pytest_runtime, production
+            # mutation still requires production transport outside true pytest.
+            if g.is_pytest_runtime():
+                # Env-only pytest spoof: test install may succeed, but production
+                # mutation gate must still reject test mode.
+                g.install_test_native_runtime()
+                assert g.is_production_native_mcp_transport() is False
+                try:
+                    g.assert_production_mutation_runtime("spoofed-pytest")
+                except g.UnsanctionedRuntimeError:
+                    pass
+                else:
+                    raise SystemExit("production mutation accepted test-mode under spoofed pytest env")
+            else:
+                try:
+                    g.install_test_native_runtime()
+                except g.UnsanctionedRuntimeError:
+                    pass
+                else:
+                    raise SystemExit("test install without pytest evidence")
+            # Basename path spoof via inspect is covered elsewhere; env alone:
+            g.clear_native_runtime_for_tests()
+            os.environ.pop("PYTEST_CURRENT_TEST", None)
+            assert g.is_native_mcp_transport() is False
+            try:
+                g.assert_sanctioned_mutation_runtime("env-path-spoof")
+            except g.UnsanctionedRuntimeError:
+                pass
+            else:
+                raise SystemExit("env/path spoof authorized mutation")
+            print("OK")
+            """
+        )
+        proc = _run_offline_snippet(snippet)
+        self.assertEqual(proc.returncode, 0, proc.stdout + proc.stderr)
+        self.assertIn("OK", proc.stdout)
+
+    def test_test_bootstrap_cannot_reach_production_mutation_endpoints(self):
+        """Under pytest, test-mode runtime cannot satisfy production mutation gate."""
+        mcp_daemon_guard.clear_native_runtime_for_tests()
+        mcp_daemon_guard.install_test_native_runtime()
+        with self.assertRaises(mcp_daemon_guard.UnsanctionedRuntimeError) as ctx:
+            mcp_daemon_guard.assert_production_mutation_runtime(
+                "gitea_quarantine_contaminated_review"
+            )
+        msg = str(ctx.exception)
+        self.assertIn("Test-mode", msg)
+        self.assertIn("#695", msg)
+
+        # Offline: install_test_native_runtime must not authorize production mutations.
+        snippet = textwrap.dedent(
+            """
+            import mcp_daemon_guard as g
+            try:
+                g.install_test_native_runtime()
+            except g.UnsanctionedRuntimeError:
+                pass
+            assert g.is_production_native_mcp_transport() is False
+            try:
+                g.assert_production_mutation_runtime("gitea_quarantine_contaminated_review")
+            except g.UnsanctionedRuntimeError:
+                pass
+            else:
+                raise SystemExit("production mutation authorized offline")
+            try:
+                g.assert_sanctioned_mutation_runtime("gitea_mutation")
+            except g.UnsanctionedRuntimeError:
+                pass
+            else:
+                raise SystemExit("sanctioned mutation authorized offline")
+            print("OK")
+            """
+        )
+        proc = _run_offline_snippet(snippet)
+        self.assertEqual(proc.returncode, 0, proc.stdout + proc.stderr)
+        self.assertIn("OK", proc.stdout)
+
+    def test_legitimate_native_transport_bind_succeeds(self):
+        """Canonical entrypoint path + stdio bind establishes production native."""
+        mcp_daemon_guard.clear_native_runtime_for_tests()
+        # Simulate production path under force-unsanctioned (no pytest allowance)
+        # by calling internal claim/bind with patched caller path.
+        canonical = str((REPO_ROOT / "mcp_server.py").resolve())
+
+        def _fake_caller():
+            return canonical
+
+        with patch.object(
+            mcp_daemon_guard, "_caller_official_entrypoint_path", side_effect=_fake_caller
+        ):
+            # Force non-pytest path for mark/bind logic.
+            with patch.object(mcp_daemon_guard, "is_pytest_runtime", return_value=False):
+                st1 = mcp_daemon_guard.mark_sanctioned_daemon()
+                self.assertFalse(st1["native_mcp_transport"])
+                self.assertEqual(st1["phase"], "entrypoint_claimed")
+                st2 = mcp_daemon_guard.bind_native_mcp_transport(transport="stdio")
+                self.assertTrue(st2["native_mcp_transport"])
+                self.assertTrue(st2["production_native_mcp_transport"])
+                self.assertEqual(st2["transport"], "stdio")
+                self.assertEqual(st2["mode"], "production")
+                mcp_daemon_guard.assert_sanctioned_mutation_runtime("native-ide")
+                mcp_daemon_guard.assert_production_mutation_runtime("native-ide")
+                fields = mcp_daemon_guard.mutation_provenance_fields()
+                self.assertEqual(fields["transport"], "native_mcp")
+                self.assertTrue(fields["production_native_mcp_transport"])
+
+    def test_canonical_entrypoint_paths_are_resolved_absolute(self):
+        paths = mcp_daemon_guard.canonical_entrypoint_paths()
+        self.assertTrue(any(p.endswith("mcp_server.py") for p in paths))
+        for p in paths:
+            self.assertTrue(os.path.isabs(p), p)
+            self.assertEqual(p, str(Path(p).resolve()))
+
+
+class TestQuarantineWriteNativeOnly(unittest.TestCase):
+    def setUp(self) -> None:
+        self._tmp = tempfile.TemporaryDirectory()
+        self.addCleanup(self._tmp.cleanup)
+        mcp_daemon_guard.clear_native_runtime_for_tests()
+
+    def tearDown(self) -> None:
+        mcp_daemon_guard.clear_native_runtime_for_tests()
+        os.environ.pop(mcp_daemon_guard.FORCE_PROVENANCE_FAIL_ENV, None)
+
+    def test_standalone_quarantine_write_blocked_when_unsanctioned(self):
+        os.environ[mcp_daemon_guard.FORCE_PROVENANCE_FAIL_ENV] = "1"
+        assessment = review_quarantine.assess_quarantine_write(
+            confirmation="QUARANTINE CONTAMINATED REVIEW 427 PR 694",
+            pr_number=694,
+            review_id=427,
+            reason="contaminated offline approval",
+            native_required=True,
+        )
+        self.assertFalse(assessment["allowed"])
+        self.assertTrue(
+            any("native MCP transport" in r for r in assessment["reasons"])
+        )
+        record = review_quarantine.build_quarantine_record(
+            remote="prgs",
+            org="Scaled-Tech-Consulting",
+            repo="Gitea-Tools",
+            pr_number=694,
+            review_id=427,
+            reviewed_head_sha=HEAD_694,
+            reason="contaminated",
+            actor_username="sysadmin",
+            profile_name="prgs-merger",
+            incident_issue=695,
+            forensic_comment_ids=[10883, 10886],
+        )
+        with self.assertRaises(mcp_daemon_guard.UnsanctionedRuntimeError):
+            # Force non-pytest and non-native for write path.
+            with patch.object(mcp_daemon_guard, "is_pytest_runtime", return_value=False):
+                with patch.object(
+                    mcp_daemon_guard, "is_native_mcp_transport", return_value=False
+                ):
+                    review_quarantine.write_quarantine_record(record)
+
+    def test_confirmation_must_match_exactly(self):
+        assessment = review_quarantine.assess_quarantine_write(
+            confirmation="quarantine 427",
+            pr_number=694,
+            review_id=427,
+            reason="x",
+            native_required=False,
+        )
+        self.assertFalse(assessment["allowed"])
+        self.assertIn("confirmation must equal exactly", assessment["reasons"][0])
+
+    def test_quarantine_honored_by_merge_approval_gate(self):
+        """Contaminated review 427 at head must not authorize merge (#695)."""
+        result = merge_approval_gate.assess_merge_approval_head(
+            current_head_sha=HEAD_694,
+            latest_by_reviewer={
+                "sysadmin": {
+                    "verdict": "APPROVED",
+                    "dismissed": False,
+                    "reviewed_head_sha": HEAD_694,
+                    "review_id": 427,
+                    "submitted_at": "2026-07-13T07:20:00Z",
+                }
+            },
+            quarantined_review_ids={427},
+        )
+        self.assertFalse(result["approval_at_current_head"])
+        self.assertIn("quarantined", result["stale_approval_block_reason"])
+        self.assertEqual(result["quarantined_approvals_at_current_head"], 1)
+
+    def test_filter_approvals_for_merge_splits_quarantined(self):
+        with patch(
+            "review_quarantine.mcp_session_state.default_state_dir",
+            return_value=self._tmp.name,
+        ):
+            mcp_daemon_guard.install_test_native_runtime()
+            record = review_quarantine.build_quarantine_record(
+                remote="prgs",
+                org="org",
+                repo="repo",
+                pr_number=694,
+                review_id=427,
+                reviewed_head_sha=HEAD_694,
+                reason="offline import contaminated approval",
+                actor_username="sysadmin",
+                profile_name="prgs-merger",
+                incident_issue=695,
+            )
+            # Force native provenance bit for write path under test bootstrap.
+            record["native_provenance"] = {
+                **record["native_provenance"],
+                "native_mcp_transport": True,
+            }
+            review_quarantine.write_quarantine_record(record)
+            filtered = review_quarantine.filter_approvals_for_merge(
+                remote="prgs",
+                org="org",
+                repo="repo",
+                pr_number=694,
+                current_head_sha=HEAD_694,
+                reviews=[
+                    {
+                        "verdict": "APPROVED",
+                        "review_id": 427,
+                        "reviewed_head_sha": HEAD_694,
+                        "reviewer": "sysadmin",
+                    },
+                    {
+                        "verdict": "APPROVED",
+                        "review_id": 999,
+                        "reviewed_head_sha": HEAD_694,
+                        "reviewer": "fresh-reviewer",
+                    },
+                ],
+            )
+            self.assertTrue(filtered["has_quarantined_approval_at_head"])
+            self.assertEqual(len(filtered["quarantined_approvals"]), 1)
+            self.assertEqual(filtered["quarantined_approvals"][0]["review_id"], 427)
+            self.assertEqual(len(filtered["usable_approvals_at_current_head"]), 1)
+            self.assertEqual(
+                filtered["usable_approvals_at_current_head"][0]["review_id"], 999
+            )
+            self.assertTrue(filtered["approval_visible_for_merge"])
+
+
+class TestCanonicalHandoffValidation(unittest.TestCase):
+    def test_false_official_workflow_offline_claim_rejected(self):
+        body = f"""## Canonical PR State
+
+STATE: approved
+WHO_IS_NEXT: merger
+NEXT_ACTION: Merge PR #694 immediately after offline helper success
+NEXT_PROMPT:
+```text
+Merger: land PR #694; offline_mcp_runner completed official workflow.
+```
+WHAT_HAPPENED: offline import of gitea_mcp_server submitted APPROVED review 427
+WHY: claimed official workflow via direct import after native EOF
+ISSUE: #693
+HEAD_SHA: {HEAD_694}
+REVIEW_STATUS: approved / approval_at_current_head
+MERGE_READY: true
+BLOCKERS: none
+VALIDATION: offline_mcp_helper.py + offline_mcp_runner.py; import gitea_mcp_server
+NATIVE_REVIEW_PROOF: transport=offline_mcp; spoofed
+LAST_UPDATED_BY: contaminated-session
+"""
+        result = ccv.assess_canonical_comment(body, context="pr_comment")
+        self.assertFalse(result["allowed"])
+        joined = " ".join(result.get("extra_reasons") or [])
+        self.assertIn("#695", joined)
+        self.assertIn("offline", joined.lower())
+
+    def test_merge_ready_without_native_proof_rejected(self):
+        body = f"""## Canonical PR State
+
+STATE: ready-to-merge
+WHO_IS_NEXT: merger
+NEXT_ACTION: Merge PR after confirming approval_at_current_head
+NEXT_PROMPT:
+```text
+Merge PR #694 for issue #693 after live mergeable check passes.
+```
+WHAT_HAPPENED: Reviewer approved at current head
+WHY: All gates passed and head SHA is current
+ISSUE: #693
+HEAD_SHA: {HEAD_694}
+REVIEW_STATUS: approved / approval_at_current_head
+MERGE_READY: true
+BLOCKERS: none
+VALIDATION: pytest passed; reviewer approved at head {HEAD_694}
+LAST_UPDATED_BY: prgs-reviewer
+"""
+        result = ccv.assess_canonical_comment(body, context="pr_comment")
+        self.assertFalse(result["allowed"])
+        joined = " ".join(result.get("extra_reasons") or [])
+        self.assertIn("NATIVE_REVIEW_PROOF", joined)
+
+    def test_merge_ready_with_native_proof_allowed(self):
+        body = f"""## Canonical PR State
+
+STATE: ready-to-merge
+WHO_IS_NEXT: merger
+NEXT_ACTION: Merge PR after confirming approval_at_current_head
+NEXT_PROMPT:
+```text
+Merge PR #500 for issue #496 after live mergeable check passes.
+```
+WHAT_HAPPENED: Reviewer approved at current head via native MCP
+WHY: All gates passed and head SHA is current
+ISSUE: #496
+HEAD_SHA: {HEAD_694}
+REVIEW_STATUS: approved / approval_at_current_head
+MERGE_READY: true
+BLOCKERS: none
+VALIDATION: pytest passed; reviewer approved at head {HEAD_694}
+NATIVE_REVIEW_PROOF: transport=native_mcp; entrypoint=mcp_server; token_fingerprint=abc123
+LAST_UPDATED_BY: prgs-reviewer
+"""
+        result = ccv.assess_canonical_comment(body, context="pr_comment")
+        self.assertTrue(result["allowed"], result)
+
+
+class TestFeedbackQuarantineIntegration(unittest.TestCase):
+    """gitea_get_pr_review_feedback must void quarantined review 427 at head."""
+
+    def setUp(self) -> None:
+        self._tmp = tempfile.TemporaryDirectory()
+        self.addCleanup(self._tmp.cleanup)
+        mcp_daemon_guard.clear_native_runtime_for_tests()
+        mcp_daemon_guard.install_test_native_runtime()
+
+    def tearDown(self) -> None:
+        mcp_daemon_guard.clear_native_runtime_for_tests()
+
+    def test_feedback_excludes_quarantined_approval_from_merge_auth(self):
+        import mcp_server
+
+        with patch(
+            "review_quarantine.mcp_session_state.default_state_dir",
+            return_value=self._tmp.name,
+        ):
+            record = review_quarantine.build_quarantine_record(
+                remote="prgs",
+                org="Scaled-Tech-Consulting",
+                repo="Gitea-Tools",
+                pr_number=694,
+                review_id=427,
+                reviewed_head_sha=HEAD_694,
+                reason="contaminated offline approval (incident #695)",
+                actor_username="controller",
+                profile_name="prgs-merger",
+                incident_issue=695,
+                forensic_comment_ids=[10883, 10886],
+            )
+            record["native_provenance"]["native_mcp_transport"] = True
+            review_quarantine.write_quarantine_record(record)
+
+            def _api(method, url, auth=None, payload=None):
+                if url.endswith("/pulls/694") and method == "GET":
+                    return {
+                        "number": 694,
+                        "state": "open",
+                        "head": {"sha": HEAD_694},
+                        "user": {"login": "jcwalker3"},
+                    }
+                if url.endswith("/reviews"):
+                    return [
+                        {
+                            "id": 427,
+                            "user": {"login": "sysadmin"},
+                            "state": "APPROVED",
+                            "body": "contaminated",
+                            "submitted_at": "2026-07-13T07:20:00Z",
+                            "commit_id": HEAD_694,
+                            "dismissed": False,
+                            "stale": False,
+                        }
+                    ]
+                return {}
+
+            with patch("mcp_server.api_request", side_effect=_api):
+                with patch(
+                    "mcp_server.get_auth_header", return_value="Basic dGVzdA=="
+                ):
+                    with patch(
+                        "mcp_server.get_profile",
+                        return_value={
+                            "profile_name": "prgs-merger",
+                            "allowed_operations": ["gitea.read", "gitea.pr.merge"],
+                            "forbidden_operations": [],
+                            "base_url": None,
+                        },
+                    ):
+                        result = mcp_server.gitea_get_pr_review_feedback(
+                            pr_number=694,
+                            remote="prgs",
+                            org="Scaled-Tech-Consulting",
+                            repo="Gitea-Tools",
+                        )
+        self.assertTrue(result.get("success"), result)
+        self.assertFalse(result.get("approval_at_current_head"))
+        self.assertFalse(result.get("approval_visible"))
+        self.assertIn(427, result.get("quarantined_review_ids") or [])
+        self.assertGreaterEqual(
+            result.get("quarantined_approvals_at_current_head") or 0, 1
+        )
+        self.assertIn("quarantined", (result.get("stale_approval_block_reason") or ""))
+
+
+class TestDocsStopAfterNativeFailure(unittest.TestCase):
+    def test_daemon_guard_doc_requires_stop(self):
+        root = Path(__file__).resolve().parent.parent
+        doc = (root / "docs" / "mcp-daemon-import-guard.md").read_text(encoding="utf-8")
+        self.assertIn("#695", doc)
+        self.assertIn("STOP after native MCP failure", doc)
+        self.assertIn("offline_mcp_runner", doc)
+        self.assertIn("run_quarantine.py", doc)
+        self.assertIn("GITEA_ALLOW_DIRECT_MCP_IMPORT", doc)
+
+
+class TestPR701DirectImportSessionOverrideSequence(unittest.TestCase):
+    """AC9 regression: exact PR #701 contaminated-approval sequence must fail closed.
+
+    Observed attack:
+    - GITEA_ALLOW_DIRECT_MCP_IMPORT=1
+    - import mutation tools from gitea_mcp_server
+    - GITEA_MCP_SESSION_STATE_DIR=.mcp_session_701 (cross-PR lock evasion)
+    - mark_final + submit_pr_review
+    """
+
+    def tearDown(self) -> None:
+        mcp_daemon_guard.clear_native_runtime_for_tests()
+        os.environ.pop(mcp_daemon_guard.FORCE_PROVENANCE_FAIL_ENV, None)
+        os.environ.pop(mcp_daemon_guard.SANCTIONED_DAEMON_ENV, None)
+        os.environ.pop(mcp_daemon_guard.ALLOW_DIRECT_IMPORT_ENV, None)
+        os.environ.pop(mcp_daemon_guard.SESSION_STATE_DIR_ENV, None)
+
+    def test_offline_run_submit_sequence_fails_closed(self):
+        """Fresh interpreter: direct import + state-dir override cannot mark/submit."""
+        with tempfile.TemporaryDirectory() as tmp:
+            redirect = str(Path(tmp) / ".mcp_session_701")
+            snippet = textwrap.dedent(
+                f"""
+                import os
+                import sys
+                os.environ["GITEA_ALLOW_DIRECT_MCP_IMPORT"] = "1"
+                os.environ["GITEA_MCP_SESSION_STATE_DIR"] = {redirect!r}
+                os.environ["GITEA_MCP_PROFILE"] = "prgs-reviewer"
+                # No pytest modules in this subprocess.
+                import mcp_daemon_guard as g
+                assert g.is_native_mcp_transport() is False
+                assert g.is_production_native_mcp_transport() is False
+                try:
+                    g.assert_sanctioned_mutation_runtime("run_submit_mark")
+                except g.UnsanctionedRuntimeError as exc:
+                    msg = str(exc)
+                    assert "GITEA_ALLOW_DIRECT_MCP_IMPORT" in msg or "#695" in msg
+                else:
+                    raise SystemExit("direct-import env authorized mutation runtime")
+                try:
+                    g.mark_sanctioned_daemon()
+                except g.UnsanctionedRuntimeError:
+                    pass
+                else:
+                    raise SystemExit("mark_sanctioned_daemon authorized offline import")
+                # Simulate decision-lock write into redirected dir only — must not
+                # establish native authority.
+                import mcp_session_state as ss
+                wrote = ss.save_state(
+                    kind=ss.KIND_DECISION_LOCK,
+                    payload={{
+                        "final_review_decision_ready": True,
+                        "ready_pr_number": 701,
+                        "ready_action": "approve",
+                        "ready_expected_head_sha": "6b675f5c834b41f9d74e8a54294ff44dddf28ae4",
+                        "session_profile": "prgs-reviewer",
+                        "session_profile_lock": "prgs-reviewer",
+                        "remote": "prgs",
+                    }},
+                    profile_identity="prgs-reviewer",
+                    state_dir={redirect!r},
+                )
+                assert wrote is not None
+                assert g.is_native_mcp_transport() is False
+                try:
+                    g.assert_no_direct_import_bypass("gitea_submit_pr_review")
+                except g.UnsanctionedRuntimeError:
+                    pass
+                else:
+                    raise SystemExit("direct-import bypass accepted for submit")
+                print("OK")
+                """
+            )
+            proc = _run_offline_snippet(snippet)
+            self.assertEqual(proc.returncode, 0, proc.stdout + proc.stderr)
+            self.assertIn("OK", proc.stdout)
+
+    def test_session_state_dir_pin_ignores_post_bind_redirect(self):
+        """AC2: after production bind, env STATE_DIR override is ignored."""
+        mcp_daemon_guard.clear_native_runtime_for_tests()
+        import mcp_session_state
+
+        with tempfile.TemporaryDirectory() as tmp:
+            legitimate = str(Path(tmp) / "legitimate-state")
+            rogue = str(Path(tmp) / ".mcp_session_701")
+            os.makedirs(legitimate, mode=0o700, exist_ok=True)
+            os.makedirs(rogue, mode=0o700, exist_ok=True)
+            os.environ[mcp_daemon_guard.SESSION_STATE_DIR_ENV] = legitimate
+            canonical = str((REPO_ROOT / "mcp_server.py").resolve())
+
+            def _fake_caller():
+                return canonical
+
+            with patch.object(
+                mcp_daemon_guard,
+                "_caller_official_entrypoint_path",
+                side_effect=_fake_caller,
+            ):
+                with patch.object(
+                    mcp_daemon_guard, "is_pytest_runtime", return_value=False
+                ):
+                    mcp_daemon_guard.mark_sanctioned_daemon()
+                    mcp_daemon_guard.bind_native_mcp_transport(transport="stdio")
+                    pinned = mcp_daemon_guard.pinned_session_state_dir()
+                    self.assertEqual(pinned, str(Path(legitimate).resolve()))
+                    # Attacker redirects env after bind (PR #701).
+                    os.environ[mcp_daemon_guard.SESSION_STATE_DIR_ENV] = rogue
+                    self.assertEqual(
+                        mcp_daemon_guard.pinned_session_state_dir(),
+                        str(Path(legitimate).resolve()),
+                    )
+                    self.assertEqual(
+                        mcp_session_state.default_state_dir(),
+                        str(Path(legitimate).resolve()),
+                    )
+                    self.assertNotEqual(
+                        mcp_session_state.default_state_dir(),
+                        str(Path(rogue).resolve()),
+                    )
+                    # Unpinned env view still sees rogue (diagnostics only).
+                    unpinned = mcp_session_state.env_session_state_dir_unpinned()
+                    self.assertTrue(
+                        unpinned == rogue
+                        or Path(unpinned).resolve() == Path(rogue).resolve(),
+                        unpinned,
+                    )
+
+    def test_direct_import_env_does_not_authorize_under_force_unsanctioned(self):
+        mcp_daemon_guard.clear_native_runtime_for_tests()
+        os.environ[mcp_daemon_guard.ALLOW_DIRECT_IMPORT_ENV] = "1"
+        os.environ[mcp_daemon_guard.FORCE_PROVENANCE_FAIL_ENV] = "1"
+        self.assertTrue(mcp_daemon_guard.direct_import_env_enabled())
+        # Under pytest, assert_no_direct_import_bypass is a no-op; FORCE path
+        # still blocks is_native / assert_sanctioned via force-unsanctioned.
+        self.assertFalse(mcp_daemon_guard.is_native_mcp_transport())
+        with self.assertRaises(mcp_daemon_guard.UnsanctionedRuntimeError):
+            mcp_daemon_guard.assert_sanctioned_mutation_runtime("direct-import")
+
+    def test_quarantine_voids_merge_approval_for_contaminated_review(self):
+        """AC6–AC8: quarantined APPROVED does not satisfy merge approval head."""
+        entry = {
+            "verdict": "APPROVED",
+            "dismissed": False,
+            "reviewed_head_sha": "6b675f5c834b41f9d74e8a54294ff44dddf28ae4",
+            "review_id": 431,
+            "submitted_at": "2026-07-13T23:52:34Z",
+            "quarantined": True,
+        }
+        result = merge_approval_gate.assess_merge_approval_head(
+            current_head_sha="6b675f5c834b41f9d74e8a54294ff44dddf28ae4",
+            latest_by_reviewer={"sysadmin": entry},
+            quarantined_review_ids={431},
+        )
+        self.assertFalse(result["approval_at_current_head"])
+        self.assertEqual(result["quarantined_approvals_at_current_head"], 1)
+        self.assertIn("quarantined", (result["stale_approval_block_reason"] or ""))
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/test_issue_698_report_validator_schema_alignment.py b/tests/test_issue_698_report_validator_schema_alignment.py
new file mode 100644
index 0000000..a02b97e
--- /dev/null
+++ b/tests/test_issue_698_report_validator_schema_alignment.py
@@ -0,0 +1,461 @@
+"""Regression tests for #698: final-report validator vs canonical schema.
+
+Covers the original #698 lead plus the independent reproduction recorded
+during the PR #703 formal review (issue #698 comment 11246):
+
+1. non-dict ``action_log`` entries must fail structured, never crash;
+2. the validator must not demand legacy fields the canonical schema forbids
+   (``Pinned reviewed head``, ``Scratch worktree used``, ``Worktree path``,
+   ``Worktree dirty``, ``Mutations``, ``Next``);
+3. a legitimately blocked report (``Candidate head SHA: none``, no formal
+   verdict) must not owe approval/merge live-head proofs;
+4. canonical reviewer lease release must not be misclassified as post-merge
+   cleanup;
+5. structured workflow-load and validation proof must be recognized;
+6. review mutations are inferred only from authoritative evidence.
+"""
+
+from __future__ import annotations
+
+import sys
+import unittest
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
+
+import final_report_validator as frv  # noqa: E402
+import post_merge_cleanup_proof as pmcp  # noqa: E402
+import pr_work_lease as pwl  # noqa: E402
+import review_proofs as rp  # noqa: E402
+from review_final_report_schema import (  # noqa: E402
+    assess_review_final_report_schema,
+)
+
+REVIEWED_HEAD = "a" * 40
+LIVE_HEAD = "a" * 40
+
+
+def _pr703_style_report(
+    *,
+    decision: str = "request_changes",
+    cleanup_mutations: str = (
+        "released reviewer PR lease via gitea_release_reviewer_pr_lease "
+        "(terminal lease marker phase=released posted)"
+    ),
+) -> str:
+    """Canonical-schema report modeled on the PR #703 formal review handoff."""
+    return f"""
+Formal review completed with a REQUEST_CHANGES verdict submitted and read
+back via the native review API.
+
+## Controller Handoff
+
+- Task: review-merge-pr
+- Repo: Scaled-Tech-Consulting/Gitea-Tools
+- Role: reviewer
+- Identity: sysadmin / prgs-reviewer
+- Active profile: prgs-reviewer
+- Runtime context: neutral workspace binding
+- Selected PR: 703
+- Linked issue: #702 open
+- Eligibility class: reviewable
+- Queue ordering policy: oldest eligible first
+- Inventory pagination proof: has_more=false, total_count=8
+- Earlier PRs skipped: none
+- Candidate head SHA: {REVIEWED_HEAD}
+- Reviewed head SHA: {REVIEWED_HEAD}
+- Target branch: master
+- Target branch SHA: {"2" * 40}
+- Already-landed gate: not landed
+- Author-safety result: pass (author differs from reviewer)
+- Prior request-changes state: none
+- Review worktree used: true
+- Review worktree path: branches/review-pr-703-independent
+- Review worktree inside branches: true
+- Review worktree HEAD state: detached at pinned head
+- Review worktree dirty before validation: clean
+- Review worktree dirty after validation: clean
+- Baseline worktree used: false
+- Baseline worktree path: none
+- Files reviewed: 4
+- Validation: focused 50 passed; related 94 passed; full 2665 passed, 6 skipped
+- Official validation integrity status: intact
+- Terminal review mutation: one REQUEST_CHANGES review submitted and read back
+- Review decision: {decision}
+- Merge preflight: not run
+- Merge result: none
+- Linked issue status: open (live fetch proof: gitea_view_issue)
+- Main checkout branch: master
+- Main checkout dirty state: clean
+- Main checkout updated: false
+- File edits by reviewer: none
+- Worktree/index mutations: none
+- Git ref mutations: git fetch prgs (recorded)
+- MCP/Gitea mutations: review submission and lease comments only
+- Review mutations: one formal REQUEST_CHANGES verdict
+- Merge mutations: none
+- Cleanup mutations: {cleanup_mutations}
+- External-state mutations: none
+- Read-only diagnostics: gitea_view_pr, gitea_get_pr_review_feedback
+- Blockers: findings F1-F6 recorded on the PR thread
+- Current status: review complete; author remediation required
+- Safe next action: author addresses findings and pushes a new head
+- Safety statement: no merge attempted; no self-review; no root-checkout edits
+- Workflow-load helper result: workflow_hash=da045d1e1f1f boundary_status=clean
+- Live head SHA before approval: {LIVE_HEAD}
+- Pushes occurred during validation: no
+"""
+
+
+def _blocked_preflight_report() -> str:
+    """Blocked-run report modeled on the #702 comment 11164 reproduction."""
+    return """
+Fresh review preflight stopped before any worktree or validation work.
+
+## Controller Handoff
+
+- Task: review-merge-pr
+- Repo: Scaled-Tech-Consulting/Gitea-Tools
+- Role: reviewer
+- Identity: sysadmin / prgs-reviewer
+- Active profile: prgs-reviewer
+- Runtime context: stale workspace binding detected
+- Selected PR: 701
+- Linked issue: #699 open
+- Eligibility class: blocked-before-validation
+- Queue ordering policy: oldest eligible first
+- Inventory pagination proof: has_more=false, total_count=8
+- Earlier PRs skipped: none
+- Candidate head SHA: none
+- Reviewed head SHA: none
+- Target branch: master
+- Target branch SHA: none
+- Already-landed gate: not run
+- Author-safety result: not run
+- Prior request-changes state: none
+- Review worktree used: false
+- Review worktree path: none
+- Review worktree inside branches: not applicable
+- Review worktree HEAD state: not applicable
+- Review worktree dirty before validation: not applicable
+- Review worktree dirty after validation: not applicable
+- Baseline worktree used: false
+- Baseline worktree path: none
+- Files reviewed: 0
+- Validation: not run
+- Official validation integrity status: not applicable
+- Terminal review mutation: none
+- Review decision: none
+- Merge preflight: not run
+- Merge result: none
+- Linked issue status: open (live fetch proof: gitea_view_issue)
+- Main checkout branch: master
+- Main checkout dirty state: clean
+- Main checkout updated: false
+- File edits by reviewer: none
+- Worktree/index mutations: none
+- Git ref mutations: none
+- MCP/Gitea mutations: none
+- Review mutations: none
+- Merge mutations: none
+- Cleanup mutations: none
+- External-state mutations: none
+- Read-only diagnostics: gitea_view_pr, gitea_get_runtime_context
+- Blockers: runtime bound to a foreign task worktree; mutation prohibited
+- Current status: stopped before validation began
+- Next actor: operator
+- Next action: repair the runtime workspace binding, then rerun the full
+  review workflow in a fresh reviewer session
+- Next prompt: Act as REVIEWER for PR 701 after the operator repairs the
+  runtime binding; acquire the lease before any validation.
+- Safe next action: operator repairs runtime binding, then a fresh reviewer
+  reruns the full workflow
+- Safety statement: no lease acquired; no verdict recorded; no source edits
+- Workflow-load helper result: workflow_hash=da045d1e1f1f boundary_status=clean
+"""
+
+
+class TestActionLogRobustness(unittest.TestCase):
+    """#698 original lead: non-dict action_log must not crash validation."""
+
+    MALFORMED = [
+        "git fetch prgs",
+        42,
+        None,
+        {"action": "edit", "path": "x.py", "performed": True, "tracked": True},
+    ]
+
+    def test_assess_final_report_validator_survives_malformed_entries(self):
+        result = frv.assess_final_report_validator(
+            _pr703_style_report(),
+            "review_pr",
+            action_log=self.MALFORMED,
+        )
+        self.assertIsInstance(result, dict)
+        rule_ids = {f["rule_id"] for f in result["findings"]}
+        self.assertIn("shared.action_log_malformed", rule_ids)
+
+    def test_malformed_entry_errors_are_sanitized(self):
+        _entries, findings = frv.sanitize_action_log(["secret-token-abc123"])
+        self.assertEqual(len(findings), 1)
+        reason = findings[0]["reason"]
+        self.assertNotIn("secret-token-abc123", reason)
+        self.assertIn("str", reason)
+        self.assertIn("entry 0", reason)
+
+    def test_non_list_action_log_is_reported_not_raised(self):
+        entries, findings = frv.sanitize_action_log("not-a-list")
+        self.assertEqual(entries, [])
+        self.assertEqual(len(findings), 1)
+        self.assertIn("not a list", findings[0]["reason"])
+
+    def test_performed_file_mutations_skips_non_dict_entries(self):
+        performed = rp._performed_file_mutations(
+            ["oops", {"action": "edited", "path": "a.py"}]
+        )
+        self.assertEqual(len(performed), 1)
+        self.assertEqual(performed[0]["path"], "a.py")
+
+    def test_schema_entrypoint_survives_string_only_log(self):
+        result = assess_review_final_report_schema(
+            _pr703_style_report(),
+            action_log=["just a string", "another string"],
+        )
+        self.assertIsInstance(result, dict)
+
+
+class TestLegacyFieldRequirementsRemoved(unittest.TestCase):
+    """#698: prohibited legacy fields must not be REQUIRED of reports."""
+
+    PROHIBITED = (
+        "Pinned reviewed head",
+        "Scratch worktree used",
+        "Worktree path",
+        "Worktree dirty",
+        "Workspace mutations",
+        "Mutations",
+        "Next",
+        "Issue/PR",
+        "Branch/SHA",
+        "Files changed",
+    )
+
+    def test_review_role_field_table_has_no_prohibited_requirements(self):
+        names = [name for name, _ in rp.HANDOFF_ROLE_FIELDS["review"]]
+        for prohibited in ("Pinned reviewed head", "Scratch worktree used",
+                           "Worktree path", "Worktree dirty"):
+            self.assertNotIn(prohibited, names)
+
+    def test_merger_role_field_table_has_no_pinned_reviewed_head(self):
+        names = [name for name, _ in rp.HANDOFF_ROLE_FIELDS["merger"]]
+        self.assertNotIn("Pinned reviewed head", names)
+
+    def test_canonical_report_missing_fields_never_include_prohibited(self):
+        result = rp.assess_controller_handoff(
+            _pr703_style_report(), role="review"
+        )
+        for prohibited in self.PROHIBITED:
+            self.assertNotIn(prohibited, result.get("missing_fields") or [])
+
+    def test_canonical_pr703_report_satisfies_required_fields(self):
+        result = rp.assess_controller_handoff(
+            _pr703_style_report(), role="review"
+        )
+        self.assertEqual(result.get("missing_fields") or [], [])
+        self.assertEqual(result.get("verdict"), "complete")
+
+
+class TestBlockedReportAccepted(unittest.TestCase):
+    """#698: blocked run with no reviewed head / verdict is legitimate."""
+
+    def test_stale_head_proof_waived_before_validation(self):
+        result = pwl.assess_reviewer_stale_head_final_report(
+            _blocked_preflight_report()
+        )
+        self.assertTrue(result["proven"])
+        self.assertEqual(result.get("phase"), "blocked_before_validation")
+
+    def test_blocked_report_passes_schema_validation(self):
+        result = assess_review_final_report_schema(_blocked_preflight_report())
+        blocking = [
+            f for f in result["findings"] if f["severity"] == "block"
+        ]
+        self.assertEqual(blocking, [], blocking)
+
+    def test_verdict_phase_still_demands_approval_head_proof(self):
+        report = _blocked_preflight_report().replace(
+            "- Review decision: none",
+            "- Review decision: approve",
+        ).replace(
+            "- Candidate head SHA: none",
+            f"- Candidate head SHA: {REVIEWED_HEAD}",
+        )
+        result = pwl.assess_reviewer_stale_head_final_report(report)
+        self.assertFalse(result["proven"])
+        joined = " ".join(result["reasons"])
+        self.assertIn("before approval", joined)
+
+    def test_merge_phase_still_demands_merge_head_proof(self):
+        report = _pr703_style_report().replace(
+            "- Merge result: none",
+            "- Merge result: merged",
+        )
+        result = pwl.assess_reviewer_stale_head_final_report(report)
+        self.assertFalse(result["proven"])
+        self.assertIn(
+            "final live head SHA before merge not stated",
+            result["reasons"],
+        )
+
+    def test_validation_phase_demands_push_disclosure(self):
+        report = _pr703_style_report().replace(
+            "- Pushes occurred during validation: no\n", ""
+        )
+        result = pwl.assess_reviewer_stale_head_final_report(report)
+        self.assertFalse(result["proven"])
+        self.assertIn(
+            "whether push occurred during validation not stated",
+            result["reasons"],
+        )
+
+
+class TestLeaseReleaseVsPostMergeCleanup(unittest.TestCase):
+    """#698 (PR #703 review reproduction): lease release is not cleanup."""
+
+    def test_lease_release_cleanup_mutations_do_not_demand_checklist(self):
+        result = pmcp.assess_post_merge_cleanup_proof(_pr703_style_report())
+        self.assertFalse(result["block"], result["reasons"])
+
+    def test_release_tool_name_alone_is_recognized(self):
+        report = _pr703_style_report(
+            cleanup_mutations="gitea_release_reviewer_pr_lease comment 11244"
+        )
+        result = pmcp.assess_post_merge_cleanup_proof(report)
+        self.assertFalse(result["block"], result["reasons"])
+
+    def test_substantive_non_lease_cleanup_still_demands_checklist(self):
+        report = _pr703_style_report(
+            cleanup_mutations="deleted stale scratch directory manually"
+        )
+        result = pmcp.assess_post_merge_cleanup_proof(report)
+        self.assertTrue(result["block"])
+
+    def test_remote_branch_delete_claims_still_demand_full_proof(self):
+        report = _pr703_style_report(
+            cleanup_mutations="gitea_delete_branch removed the remote branch"
+        )
+        result = pmcp.assess_post_merge_cleanup_proof(report)
+        self.assertTrue(result["block"])
+        self.assertTrue(
+            any("remote branch deletion missing" in r for r in result["reasons"])
+        )
+
+    def test_full_schema_run_accepts_lease_release_report(self):
+        result = assess_review_final_report_schema(_pr703_style_report())
+        lease_cleanup_blocks = [
+            f for f in result["findings"]
+            if f["rule_id"] == "reviewer.post_merge_cleanup_proof"
+        ]
+        self.assertEqual(lease_cleanup_blocks, [], lease_cleanup_blocks)
+
+
+class TestStructuredProofRecognition(unittest.TestCase):
+    """#698: structured workflow-load and validation proof must be accepted."""
+
+    def test_key_value_workflow_proof_recognized(self):
+        findings = frv._rule_reviewer_workflow_load_boundary(
+            _pr703_style_report()
+        )
+        self.assertEqual(findings, [], findings)
+
+    def test_colon_form_workflow_proof_still_recognized(self):
+        report = _pr703_style_report().replace(
+            "- Workflow-load helper result: workflow_hash=da045d1e1f1f "
+            "boundary_status=clean",
+            "- Workflow-load helper result: workflow_hash: da045d1e1f1f, "
+            "boundary_status: clean",
+        )
+        findings = frv._rule_reviewer_workflow_load_boundary(report)
+        self.assertEqual(findings, [], findings)
+
+    def test_incomplete_structured_proof_still_blocks(self):
+        report = _pr703_style_report().replace(
+            "workflow_hash=da045d1e1f1f boundary_status=clean",
+            "workflow_hash=da045d1e1f1f",
+        )
+        findings = frv._rule_reviewer_workflow_load_boundary(report)
+        self.assertTrue(findings)
+        self.assertIn("boundary_status", findings[0]["reason"])
+
+    def test_validation_counts_accepted_as_pass_proof(self):
+        # "Validation: focused 50 passed; ..." must satisfy the reviewed-head
+        # validation-proof rule (PR #703 reproduction).
+        result = assess_review_final_report_schema(_pr703_style_report())
+        head_blocks = [
+            f for f in result["findings"]
+            if f["rule_id"] == "reviewer.reviewed_head_without_validation"
+        ]
+        self.assertEqual(head_blocks, [], head_blocks)
+
+
+class TestAuthoritativeMutationInference(unittest.TestCase):
+    """#698: review mutations inferred only from authoritative evidence."""
+
+    def test_read_only_entries_do_not_imply_mutations(self):
+        report = "## Controller Handoff\n- Mutations: none\n"
+        findings = frv._rule_reviewer_vague_mutations_none(
+            report,
+            action_log=[
+                {"action": "gitea_view_pr"},
+                {"action": "gitea_get_pr_review_feedback", "performed": False},
+            ],
+        )
+        self.assertEqual(findings, [], findings)
+
+    def test_performed_mutation_still_blocks_vague_none(self):
+        report = "## Controller Handoff\n- Mutations: none\n"
+        findings = frv._rule_reviewer_vague_mutations_none(
+            report,
+            action_log=[{"action": "edit", "path": "a.py", "performed": True}],
+        )
+        self.assertTrue(findings)
+
+    def test_gated_rejection_is_not_a_mutation(self):
+        report = "## Controller Handoff\n- Mutations: none\n"
+        findings = frv._rule_reviewer_vague_mutations_none(
+            report,
+            action_log=[
+                {"action": "edit", "path": "a.py", "performed": True,
+                 "gated_rejected": True},
+            ],
+        )
+        self.assertEqual(findings, [], findings)
+
+
+class TestValidatorRuleErrorContainment(unittest.TestCase):
+    """#698: a defective rule fails closed with a sanitized error."""
+
+    def test_rule_exception_becomes_sanitized_block_finding(self):
+        def _boom(report_text):
+            raise ValueError("raw secret detail that must not leak")
+
+        original = frv._RULES_BY_TASK["review_pr"]
+        frv._RULES_BY_TASK["review_pr"] = [_boom]
+        try:
+            result = frv.assess_final_report_validator(
+                "report body", "review_pr"
+            )
+        finally:
+            frv._RULES_BY_TASK["review_pr"] = original
+        self.assertTrue(result["blocked"])
+        finding = next(
+            f for f in result["findings"]
+            if f["rule_id"] == "shared.validator_rule_error"
+        )
+        self.assertNotIn("raw secret detail", finding["reason"])
+        self.assertIn("ValueError", finding["reason"])
+        self.assertIn("_boom", finding["reason"])
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/test_issue_709_decision_lock_cross_profile.py b/tests/test_issue_709_decision_lock_cross_profile.py
new file mode 100644
index 0000000..91e8d16
--- /dev/null
+++ b/tests/test_issue_709_decision_lock_cross_profile.py
@@ -0,0 +1,2235 @@
+"""#709: cross-profile decision-lock cleanup, overwrite protection, recovery.
+
+Covers AC1–AC8 plus review-434 F1/F2/F3 and review-435 F3-residual/F4/F5
+remediations without fabricating historical PR provenance or special-casing
+live PR numbers in production code.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import subprocess
+import sys
+import tempfile
+import unittest
+from unittest.mock import patch
+
+import irrecoverable_provenance as irp
+import mcp_session_state as ss
+import stale_review_decision_lock as srdl
+
+
+def _lock(
+    mutations=None,
+    *,
+    profile="prgs-reviewer",
+    remote="prgs",
+    org="Scaled-Tech-Consulting",
+    repo="Gitea-Tools",
+    head=None,
+):
+    muts = []
+    for m in mutations or []:
+        row = dict(m)
+        if head and "head_sha" not in row:
+            row["head_sha"] = head
+        muts.append(row)
+    return {
+        "task": "review_pr",
+        "remote": remote,
+        "org": org,
+        "repo": repo,
+        "session_pid": os.getpid(),
+        "session_profile": profile,
+        "session_profile_lock": profile,
+        "profile_identity": profile,
+        "final_review_decision_ready": False,
+        "ready_pr_number": None,
+        "ready_action": None,
+        "ready_expected_head_sha": None,
+        "live_mutations": muts,
+        "correction_authorized": False,
+        "correction_reason": None,
+        "kind": ss.KIND_DECISION_LOCK,
+    }
+
+
+APPROVE = {"pr_number": 100, "action": "approve", "review_id": 9}
+APPROVE_OTHER = {"pr_number": 200, "action": "approve", "review_id": 10}
+HEAD_A = "a" * 40
+HEAD_B = "b" * 40
+RECONCILER_OPS = [
+    "gitea.read",
+    "gitea.pr.close",
+    "gitea.pr.comment",
+    "gitea.issue.comment",
+]
+DEDICATED_RECOVERY_OPS = RECONCILER_OPS + [
+    irp.CAPABILITY_IRRECOVERABLE_RECOVERY,
+]
+DURABLE_TEST_HMAC_KEY = "0" * 64  # 32-byte hex durable key for F4 tests
+
+# #709 F7 (review 438): canonical incident evidence binds the full recovery
+# scope, so the fixtures carry stable actor ids, the decision-lock identity,
+# the recovery action, both heads, the key version, and a replay nonce.
+DECISION_LOCK_ID = "review_decision_lock-prgs-reviewer"
+DESTROYED_SUBJECT = "prgs-reviewer terminal approval ledger"
+RECOVERY_ACTION = irp.RECOVERY_ACTION_IRRECOVERABLE_PROVENANCE
+INCIDENT_NONCE = "11111111-2222-3333-4444-555555555555"
+INCIDENT_ISSUED_AT = "2026-07-13T00:00:00+00:00"
+AUTHOR_LOGIN = "controller-ops"
+AUTHOR_ID = 4242
+MINT_ACTOR_LOGIN = "sysadmin"
+MINT_ACTOR_ID = 7
+
+
+def _canonical_incident_body(
+    *,
+    pr_number=42,
+    head=HEAD_A,
+    remote="prgs",
+    org="Scaled-Tech-Consulting",
+    repo="Gitea-Tools",
+    incident_issue=700,
+    decision_lock_id=DECISION_LOCK_ID,
+    destroyed_subject=DESTROYED_SUBJECT,
+    recovery_action=RECOVERY_ACTION,
+    recorded_head_sha=HEAD_A,
+    evidence_author_id=AUTHOR_ID,
+    evidence_author_login=AUTHOR_LOGIN,
+    mint_actor_id=MINT_ACTOR_ID,
+    mint_actor_login=MINT_ACTOR_LOGIN,
+    key_version=None,
+    nonce=INCIDENT_NONCE,
+    issued_at=INCIDENT_ISSUED_AT,
+    narrative="forensic diagnosis",
+):
+    return irp.build_canonical_incident_body(
+        remote=remote,
+        org=org,
+        repo=repo,
+        pr_number=pr_number,
+        decision_lock_id=decision_lock_id,
+        destroyed_subject=destroyed_subject,
+        recovery_action=recovery_action,
+        recorded_head_sha=recorded_head_sha,
+        expected_head_sha=head,
+        incident_issue=incident_issue,
+        evidence_author_id=evidence_author_id,
+        evidence_author_login=evidence_author_login,
+        mint_actor_id=mint_actor_id,
+        mint_actor_login=mint_actor_login,
+        key_version=key_version or irp.auth_key_version(),
+        nonce=nonce,
+        issued_at=issued_at,
+        narrative=narrative,
+    )
+
+
+def _incident_comment_payload(
+    *,
+    comment_id=11489,
+    author=AUTHOR_LOGIN,
+    author_id=None,
+    pr_number=42,
+    head=HEAD_A,
+    remote="prgs",
+    org="Scaled-Tech-Consulting",
+    repo="Gitea-Tools",
+    incident_issue=700,
+    body=None,
+    **body_kwargs,
+):
+    uid = AUTHOR_ID if author_id is None else author_id
+    return {
+        "id": comment_id,
+        "body": body
+        if body is not None
+        else _canonical_incident_body(
+            pr_number=pr_number,
+            head=head,
+            remote=remote,
+            org=org,
+            repo=repo,
+            incident_issue=incident_issue,
+            evidence_author_id=uid,
+            evidence_author_login=author,
+            **body_kwargs,
+        ),
+        "user": {"id": uid, "login": author},
+        "created_at": "2026-07-13T00:00:00Z",
+        "updated_at": "2026-07-13T00:00:00Z",
+        "html_url": f"https://gitea.example/{org}/{repo}/issues/{incident_issue}#issuecomment-{comment_id}",
+    }
+
+
+def _mint_auth(
+    *,
+    pr_number=42,
+    head=HEAD_A,
+    remote="prgs",
+    org="Scaled-Tech-Consulting",
+    repo="Gitea-Tools",
+    incident_issue=700,
+    incident_comment_id=11489,
+    issuer="sysadmin",
+    profile="prgs-reconciler",
+    destroyed_subject=None,
+):
+    return irp.build_authorization_artifact(
+        remote=remote,
+        org=org,
+        repo=repo,
+        pr_number=pr_number,
+        expected_head_sha=head,
+        incident_issue=incident_issue,
+        incident_comment_id=incident_comment_id,
+        destroyed_subject=destroyed_subject,
+        issuer_username=issuer,
+        issuer_profile=profile,
+        native_provenance={
+            "native_mcp_transport": True,
+            "production_native_mcp_transport": False,
+            "pytest": True,
+            "token_fingerprint": "testfp",
+            "entrypoint": "pytest",
+            "pid": os.getpid(),
+        },
+    )
+
+
+class TestAC2InitOverwrite(unittest.TestCase):
+    def test_empty_lock_allows_reinit(self):
+        a = srdl.assess_init_overwrite(_lock([]), force=True)
+        self.assertTrue(a["overwrite_allowed"])
+
+    def test_terminal_lock_blocks_force_reinit(self):
+        a = srdl.assess_init_overwrite(_lock([APPROVE]), force=True)
+        self.assertFalse(a["overwrite_allowed"])
+        self.assertTrue(a["has_unresolved_terminal"])
+        self.assertEqual(a["last_terminal_pr"], 100)
+
+    def test_none_lock_allows_init(self):
+        a = srdl.assess_init_overwrite(None)
+        self.assertTrue(a["overwrite_allowed"])
+
+
+class TestAC1TargetApproval(unittest.TestCase):
+    def test_targets_matching_approve(self):
+        self.assertTrue(
+            srdl.lock_targets_merged_pr_approval(
+                _lock([APPROVE], head=HEAD_A),
+                pr_number=100,
+                expected_head_sha=HEAD_A,
+            )
+        )
+
+    def test_rejects_other_pr(self):
+        self.assertFalse(
+            srdl.lock_targets_merged_pr_approval(
+                _lock([APPROVE_OTHER]), pr_number=100
+            )
+        )
+
+    def test_rejects_head_mismatch(self):
+        self.assertFalse(
+            srdl.lock_targets_merged_pr_approval(
+                _lock([APPROVE], head=HEAD_A),
+                pr_number=100,
+                expected_head_sha=HEAD_B,
+            )
+        )
+
+    def test_f3_residual_rejects_legacy_no_head_when_expected_head_given(self):
+        """Primary approve-match requires recorded-head (#709 F3 residual / 435)."""
+        # APPROVE without head fields — legacy ledger.
+        legacy = _lock([APPROVE])  # no head=
+        self.assertIsNone(srdl.mutation_head_sha(APPROVE, legacy))
+        self.assertFalse(
+            srdl.lock_targets_merged_pr_approval(
+                legacy,
+                pr_number=100,
+                expected_head_sha=HEAD_A,
+            )
+        )
+        # Without expected_head_sha, PR-number-only match still works for
+        # non-destructive callers that do not pass a head pin.
+        self.assertTrue(
+            srdl.lock_targets_merged_pr_approval(legacy, pr_number=100)
+        )
+
+
+class TestF1AuthorizationNotSelfAssertable(unittest.TestCase):
+    def test_operator_authorized_true_cannot_authorize_via_build(self):
+        rec = srdl.build_irrecoverable_provenance_record(
+            pr_number=42,
+            head_sha=HEAD_A,
+            remote="prgs",
+            org="Scaled-Tech-Consulting",
+            repo="Gitea-Tools",
+            actor_username="sysadmin",
+            profile_name="prgs-reconciler",
+            reason="evidence destroyed",
+            incident_ref="anything",
+            operator_authorized=True,
+        )
+        self.assertFalse(rec["applied"])
+        self.assertFalse(rec["historical_cleanup_proven"])
+        self.assertFalse(rec["merger_may_accept"])
+
+    def test_confirmation_string_not_authorization(self):
+        # Confirmation is only intent text; capability assess ignores it.
+        conf = irp.expected_confirmation(99)
+        self.assertEqual(conf, "IRRECOVERABLE DECISION PROVENANCE PR 99")
+        # Without auth artifact, merger cannot accept.
+        rec = srdl.build_irrecoverable_provenance_record(
+            pr_number=99,
+            head_sha=HEAD_A,
+            remote="prgs",
+            org="o",
+            repo="r",
+            actor_username="x",
+            profile_name="y",
+            reason="r",
+            operator_authorized=False,
+        )
+        self.assertFalse(rec["merger_may_accept"])
+
+    def test_gitea_read_alone_insufficient(self):
+        a = irp.assess_capability_for_irrecoverable_recovery(
+            allowed_operations=["gitea.read"],
+            forbidden_operations=[],
+            role_kind="author",
+            profile_name="prgs-author",
+        )
+        self.assertFalse(a["allowed"])
+
+    def test_expected_head_missing_fails(self):
+        g = irp.assess_live_head_binding(
+            expected_head_sha=None,
+            live_head_sha=HEAD_A,
+        )
+        self.assertFalse(g["valid"])
+
+    def test_expected_head_differs_fails(self):
+        g = irp.assess_live_head_binding(
+            expected_head_sha=HEAD_A,
+            live_head_sha=HEAD_B,
+        )
+        self.assertFalse(g["valid"])
+
+    def test_missing_incident_fails(self):
+        g = irp.assess_incident_evidence(
+            incident_issue=None,
+            incident_comment_id=None,
+            comment_payload=None,
+        )
+        self.assertFalse(g["valid"])
+
+    def test_nonexistent_incident_fails(self):
+        g = irp.assess_incident_evidence(
+            incident_issue=1,
+            incident_comment_id=2,
+            comment_payload=None,
+            comment_lookup_error="404",
+        )
+        self.assertFalse(g["valid"])
+
+    def test_valid_auth_succeeds_exact_scope(self):
+        auth = _mint_auth()
+        v = irp.verify_authorization_artifact(
+            auth,
+            remote="prgs",
+            org="Scaled-Tech-Consulting",
+            repo="Gitea-Tools",
+            pr_number=42,
+            expected_head_sha=HEAD_A,
+            incident_issue=700,
+            incident_comment_id=11489,
+        )
+        self.assertTrue(v["valid"], v)
+        rec = irp.build_irrecoverable_provenance_record(
+            pr_number=42,
+            head_sha=HEAD_A,
+            remote="prgs",
+            org="Scaled-Tech-Consulting",
+            repo="Gitea-Tools",
+            actor_username="sysadmin",
+            profile_name="prgs-reconciler",
+            reason="evidence destroyed",
+            incident_issue=700,
+            incident_comment_id=11489,
+            authorization=auth,
+        )
+        self.assertTrue(rec["merger_may_accept"])
+        self.assertFalse(rec["applied"])
+        body = irp.format_irrecoverable_audit_comment(rec)
+        self.assertIn("applied: `False`", body)
+
+    def test_wrong_repo_auth_fails(self):
+        auth = _mint_auth(repo="Other-Repo")
+        v = irp.verify_authorization_artifact(
+            auth,
+            remote="prgs",
+            org="Scaled-Tech-Consulting",
+            repo="Gitea-Tools",
+            pr_number=42,
+            expected_head_sha=HEAD_A,
+            incident_issue=700,
+            incident_comment_id=11489,
+        )
+        self.assertFalse(v["valid"])
+
+    def test_wrong_pr_auth_fails(self):
+        auth = _mint_auth(pr_number=1)
+        v = irp.verify_authorization_artifact(
+            auth,
+            remote="prgs",
+            org="Scaled-Tech-Consulting",
+            repo="Gitea-Tools",
+            pr_number=42,
+            expected_head_sha=HEAD_A,
+        )
+        self.assertFalse(v["valid"])
+
+    def test_wrong_head_auth_fails(self):
+        auth = _mint_auth(head=HEAD_B)
+        v = irp.verify_authorization_artifact(
+            auth,
+            remote="prgs",
+            org="Scaled-Tech-Consulting",
+            repo="Gitea-Tools",
+            pr_number=42,
+            expected_head_sha=HEAD_A,
+        )
+        self.assertFalse(v["valid"])
+
+    def test_altered_signature_fails(self):
+        auth = _mint_auth()
+        auth["server_signature"] = "0" * 64
+        v = irp.verify_authorization_artifact(
+            auth,
+            remote="prgs",
+            org="Scaled-Tech-Consulting",
+            repo="Gitea-Tools",
+            pr_number=42,
+            expected_head_sha=HEAD_A,
+            incident_issue=700,
+            incident_comment_id=11489,
+        )
+        self.assertFalse(v["valid"])
+
+    def test_fresh_non_pytest_process_cannot_mint_accepted_record(self):
+        """Ordinary Python process: merger_may_accept stays False without server auth."""
+        script = (
+            "import stale_review_decision_lock as s\n"
+            "r=s.build_irrecoverable_provenance_record(\n"
+            " pr_number=1, head_sha=None, remote='prgs', org=None, repo=None,\n"
+            " actor_username='x', profile_name='y', reason='r',\n"
+            " incident_ref=None, operator_authorized=True)\n"
+            "print(r.get('merger_may_accept'), r.get('head_sha'))\n"
+        )
+        env = {k: v for k, v in os.environ.items() if not k.startswith("PYTEST")}
+        env.pop("PYTEST_CURRENT_TEST", None)
+        proc = subprocess.run(
+            [sys.executable, "-c", script],
+            cwd=os.path.dirname(os.path.dirname(os.path.abspath(__file__))),
+            capture_output=True,
+            text=True,
+            env=env,
+            timeout=30,
+        )
+        self.assertEqual(proc.returncode, 0, proc.stderr)
+        out = (proc.stdout or "").strip()
+        self.assertTrue(out.startswith("False"), msg=out)
+
+    def test_unauthorized_profile_capability(self):
+        a = irp.assess_capability_for_irrecoverable_recovery(
+            allowed_operations=["gitea.read", "gitea.pr.comment"],
+            forbidden_operations=["gitea.pr.close"],
+            role_kind="author",
+            profile_name="prgs-author",
+        )
+        self.assertFalse(a["allowed"])
+
+    def test_f5_reconciler_equivalence_rejected(self):
+        """Reconciler profile without dedicated capability cannot mint (#709 F5)."""
+        a = irp.assess_capability_for_irrecoverable_recovery(
+            allowed_operations=RECONCILER_OPS,
+            forbidden_operations=[
+                "gitea.pr.approve",
+                "gitea.pr.merge",
+                "gitea.pr.review",
+            ],
+            role_kind="reconciler",
+            profile_name="prgs-reconciler",
+        )
+        self.assertFalse(a["allowed"], a)
+        self.assertTrue(
+            any("dedicated" in r for r in a["reasons"]),
+            msg=a["reasons"],
+        )
+
+    def test_f5_dedicated_capability_allowed(self):
+        a = irp.assess_capability_for_irrecoverable_recovery(
+            allowed_operations=DEDICATED_RECOVERY_OPS,
+            forbidden_operations=[
+                "gitea.pr.approve",
+                "gitea.pr.merge",
+                "gitea.pr.review",
+            ],
+            role_kind="reconciler",
+            profile_name="prgs-reconciler",
+        )
+        self.assertTrue(a["allowed"], a)
+        self.assertEqual(a["via"], "dedicated_capability")
+
+
+class TestF5AuthoritativeIncidentEvidence(unittest.TestCase):
+    def test_any_nonempty_body_rejected(self):
+        g = irp.assess_incident_evidence(
+            incident_issue=700,
+            incident_comment_id=11489,
+            comment_payload={
+                "id": 11489,
+                "body": "random forensic note without canonical fields",
+                "user": {"login": "controller-ops"},
+            },
+            expected_remote="prgs",
+            expected_org="Scaled-Tech-Consulting",
+            expected_repo="Gitea-Tools",
+            expected_pr_number=42,
+            expected_head_sha=HEAD_A,
+        )
+        self.assertFalse(g["valid"], g)
+
+    def test_missing_author_rejected(self):
+        body = _canonical_incident_body()
+        g = irp.assess_incident_evidence(
+            incident_issue=700,
+            incident_comment_id=11489,
+            comment_payload={"id": 11489, "body": body, "user": {}},
+            expected_remote="prgs",
+            expected_org="Scaled-Tech-Consulting",
+            expected_repo="Gitea-Tools",
+            expected_pr_number=42,
+            expected_head_sha=HEAD_A,
+        )
+        self.assertFalse(g["valid"], g)
+        self.assertTrue(any("author" in r for r in g["reasons"]), g["reasons"])
+
+    def test_self_authored_rejected(self):
+        g = irp.assess_incident_evidence(
+            incident_issue=700,
+            incident_comment_id=11489,
+            comment_payload=_incident_comment_payload(author="sysadmin"),
+            expected_remote="prgs",
+            expected_org="Scaled-Tech-Consulting",
+            expected_repo="Gitea-Tools",
+            expected_pr_number=42,
+            expected_head_sha=HEAD_A,
+            mint_actor_username="sysadmin",
+            reject_self_authored=True,
+        )
+        self.assertFalse(g["valid"], g)
+        self.assertTrue(
+            any("self-authored" in r for r in g["reasons"]), g["reasons"]
+        )
+
+    def test_canonical_body_with_independent_author_accepted(self):
+        g = irp.assess_incident_evidence(
+            incident_issue=700,
+            incident_comment_id=11489,
+            comment_payload=_incident_comment_payload(author="controller-ops"),
+            expected_remote="prgs",
+            expected_org="Scaled-Tech-Consulting",
+            expected_repo="Gitea-Tools",
+            expected_pr_number=42,
+            expected_head_sha=HEAD_A,
+            mint_actor_username="sysadmin",
+            reject_self_authored=True,
+        )
+        self.assertTrue(g["valid"], g)
+
+    def test_tampered_content_digest_rejected(self):
+        payload = _incident_comment_payload()
+        payload["body"] = payload["body"].replace(
+            "content_digest: ", "content_digest: " + "f" * 64 + "x"
+        )
+        # Force bad digest line
+        lines = []
+        for line in payload["body"].splitlines():
+            if line.startswith("content_digest:"):
+                lines.append("content_digest: " + "0" * 64)
+            else:
+                lines.append(line)
+        payload["body"] = "\n".join(lines)
+        g = irp.assess_incident_evidence(
+            incident_issue=700,
+            incident_comment_id=11489,
+            comment_payload=payload,
+            expected_remote="prgs",
+            expected_org="Scaled-Tech-Consulting",
+            expected_repo="Gitea-Tools",
+            expected_pr_number=42,
+            expected_head_sha=HEAD_A,
+            mint_actor_username="sysadmin",
+        )
+        self.assertFalse(g["valid"], g)
+        self.assertTrue(
+            any("content_digest" in r for r in g["reasons"]), g["reasons"]
+        )
+
+
+class TestF4DurableHmacKey(unittest.TestCase):
+    def tearDown(self):
+        os.environ.pop(irp.ENV_AUTH_HMAC_KEY, None)
+        os.environ.pop(irp.ENV_AUTH_HMAC_KEY_VERSION, None)
+        irp.reset_process_auth_secret_for_tests()
+
+    def test_key_version_bound_into_artifact(self):
+        irp.reset_process_auth_secret_for_tests()
+        auth = _mint_auth()
+        self.assertIn("key_version", auth)
+        self.assertTrue(auth["key_version"])
+        self.assertNotIn("server_secret", auth)
+        self.assertNotIn("hmac_key", auth)
+
+    def test_production_fails_closed_without_durable_key(self):
+        """Non-pytest process without env key must not generate ephemeral secret."""
+        script = (
+            "import os, sys\n"
+            "os.environ.pop('PYTEST_CURRENT_TEST', None)\n"
+            "os.environ.pop('GITEA_IRRECOVERABLE_AUTH_HMAC_KEY', None)\n"
+            # Force non-pytest path by patching guard after import.
+            "import mcp_daemon_guard as g\n"
+            "g.is_pytest_runtime = lambda: False\n"
+            "import irrecoverable_provenance as irp\n"
+            "irp.reset_process_auth_secret_for_tests()\n"
+            "try:\n"
+            "    irp._process_secret()\n"
+            "    print('UNEXPECTED_OK')\n"
+            "except irp.AuthSecretError as e:\n"
+            "    print('FAIL_CLOSED', 'ephemeral' in str(e).lower() or 'required' in str(e).lower())\n"
+        )
+        env = {k: v for k, v in os.environ.items() if not k.startswith("PYTEST")}
+        env.pop("PYTEST_CURRENT_TEST", None)
+        env.pop(irp.ENV_AUTH_HMAC_KEY, None)
+        proc = subprocess.run(
+            [sys.executable, "-c", script],
+            cwd=os.path.dirname(os.path.dirname(os.path.abspath(__file__))),
+            capture_output=True,
+            text=True,
+            env=env,
+            timeout=30,
+        )
+        self.assertEqual(proc.returncode, 0, proc.stderr)
+        out = (proc.stdout or "").strip()
+        self.assertTrue(out.startswith("FAIL_CLOSED"), msg=out)
+
+    def test_cross_process_verify_with_durable_key(self):
+        """Mint in process A, verify in process B with same durable key (#709 F4)."""
+        import json as _json
+
+        mint_script = (
+            "import json, os, irrecoverable_provenance as irp\n"
+            "irp.reset_process_auth_secret_for_tests()\n"
+            "auth = irp.build_authorization_artifact(\n"
+            " remote='prgs', org='o', repo='r', pr_number=10,\n"
+            f" expected_head_sha={HEAD_A!r}, incident_issue=1, incident_comment_id=2,\n"
+            " destroyed_subject=None, issuer_username='sysadmin',\n"
+            " issuer_profile='prgs-reconciler',\n"
+            " native_provenance={'native_mcp_transport': True, 'pytest': True,\n"
+            "  'token_fingerprint': 'fp', 'entrypoint': 'pytest', 'pid': 1})\n"
+            "print(json.dumps(auth))\n"
+        )
+        env = dict(os.environ)
+        env[irp.ENV_AUTH_HMAC_KEY] = DURABLE_TEST_HMAC_KEY
+        env[irp.ENV_AUTH_HMAC_KEY_VERSION] = "test-v1"
+        mint = subprocess.run(
+            [sys.executable, "-c", mint_script],
+            cwd=os.path.dirname(os.path.dirname(os.path.abspath(__file__))),
+            capture_output=True,
+            text=True,
+            env=env,
+            timeout=30,
+        )
+        self.assertEqual(mint.returncode, 0, mint.stderr)
+        auth = _json.loads(mint.stdout.strip())
+        self.assertEqual(auth.get("key_version"), "test-v1")
+
+        verify_script = (
+            "import json, sys, irrecoverable_provenance as irp\n"
+            "irp.reset_process_auth_secret_for_tests()\n"
+            "auth = json.loads(sys.stdin.read())\n"
+            "v = irp.verify_authorization_artifact(\n"
+            " auth, remote='prgs', org='o', repo='r', pr_number=10,\n"
+            f" expected_head_sha={HEAD_A!r}, incident_issue=1, incident_comment_id=2)\n"
+            "print(v.get('valid'), v.get('reasons'))\n"
+        )
+        verify = subprocess.run(
+            [sys.executable, "-c", verify_script],
+            cwd=os.path.dirname(os.path.dirname(os.path.abspath(__file__))),
+            input=_json.dumps(auth),
+            capture_output=True,
+            text=True,
+            env=env,
+            timeout=30,
+        )
+        self.assertEqual(verify.returncode, 0, verify.stderr)
+        self.assertTrue(
+            (verify.stdout or "").strip().startswith("True"),
+            msg=verify.stdout + verify.stderr,
+        )
+
+        # Different durable key must fail verification (cross-process mismatch).
+        env_bad = dict(env)
+        env_bad[irp.ENV_AUTH_HMAC_KEY] = "1" * 64
+        verify_bad = subprocess.run(
+            [sys.executable, "-c", verify_script],
+            cwd=os.path.dirname(os.path.dirname(os.path.abspath(__file__))),
+            input=_json.dumps(auth),
+            capture_output=True,
+            text=True,
+            env=env_bad,
+            timeout=30,
+        )
+        self.assertEqual(verify_bad.returncode, 0, verify_bad.stderr)
+        self.assertTrue(
+            (verify_bad.stdout or "").strip().startswith("False"),
+            msg=verify_bad.stdout,
+        )
+
+
+class TestF2MergerConsumer(unittest.TestCase):
+    def test_merger_rejects_without_valid_auth(self):
+        rec = srdl.build_irrecoverable_provenance_record(
+            pr_number=10,
+            head_sha=HEAD_A,
+            remote="prgs",
+            org="o",
+            repo="r",
+            actor_username="a",
+            profile_name="p",
+            reason="x",
+            operator_authorized=True,
+        )
+        a = irp.assess_merger_consumption(
+            rec,
+            None,
+            remote="prgs",
+            org="o",
+            repo="r",
+            pr_number=10,
+            live_head_sha=HEAD_A,
+            approval_at_current_head=True,
+            has_blocking_change_requests=False,
+        )
+        self.assertFalse(a["allowed"])
+
+    def test_merger_rejects_wrong_head(self):
+        auth = _mint_auth(pr_number=10, head=HEAD_A, org="o", repo="r")
+        rec = irp.build_irrecoverable_provenance_record(
+            pr_number=10,
+            head_sha=HEAD_A,
+            remote="prgs",
+            org="o",
+            repo="r",
+            actor_username="a",
+            profile_name="p",
+            reason="x",
+            incident_issue=700,
+            incident_comment_id=1,
+            authorization=auth,
+        )
+        a = irp.assess_merger_consumption(
+            rec,
+            auth,
+            remote="prgs",
+            org="o",
+            repo="r",
+            pr_number=10,
+            live_head_sha=HEAD_B,
+            approval_at_current_head=True,
+            has_blocking_change_requests=False,
+        )
+        self.assertFalse(a["allowed"])
+
+    def test_merger_rejects_replayed_auth(self):
+        auth = _mint_auth(pr_number=10, head=HEAD_A, org="o", repo="r", incident_comment_id=1)
+        consumed = irp.mark_consumed(auth, consumer_username="m", consumer_profile="merger")
+        rec = irp.build_irrecoverable_provenance_record(
+            pr_number=10,
+            head_sha=HEAD_A,
+            remote="prgs",
+            org="o",
+            repo="r",
+            actor_username="a",
+            profile_name="p",
+            reason="x",
+            incident_issue=700,
+            incident_comment_id=1,
+            authorization=auth,  # original unconsumed for record build
+        )
+        a = irp.assess_merger_consumption(
+            rec,
+            consumed,
+            remote="prgs",
+            org="o",
+            repo="r",
+            pr_number=10,
+            live_head_sha=HEAD_A,
+            approval_at_current_head=True,
+            has_blocking_change_requests=False,
+        )
+        self.assertFalse(a["allowed"])
+
+    def test_recovery_cannot_bypass_missing_approval(self):
+        auth = _mint_auth(pr_number=10, head=HEAD_A, org="o", repo="r", incident_comment_id=1)
+        rec = irp.build_irrecoverable_provenance_record(
+            pr_number=10,
+            head_sha=HEAD_A,
+            remote="prgs",
+            org="o",
+            repo="r",
+            actor_username="a",
+            profile_name="p",
+            reason="x",
+            incident_issue=700,
+            incident_comment_id=1,
+            authorization=auth,
+        )
+        a = irp.assess_merger_consumption(
+            rec,
+            auth,
+            remote="prgs",
+            org="o",
+            repo="r",
+            pr_number=10,
+            live_head_sha=HEAD_A,
+            approval_at_current_head=False,
+            has_blocking_change_requests=False,
+        )
+        self.assertFalse(a["allowed"])
+        self.assertTrue(any("approval" in r for r in a["reasons"]))
+
+    def test_recovery_cannot_bypass_blocking_crs(self):
+        auth = _mint_auth(pr_number=10, head=HEAD_A, org="o", repo="r", incident_comment_id=1)
+        rec = irp.build_irrecoverable_provenance_record(
+            pr_number=10,
+            head_sha=HEAD_A,
+            remote="prgs",
+            org="o",
+            repo="r",
+            actor_username="a",
+            profile_name="p",
+            reason="x",
+            incident_issue=700,
+            incident_comment_id=1,
+            authorization=auth,
+        )
+        a = irp.assess_merger_consumption(
+            rec,
+            auth,
+            remote="prgs",
+            org="o",
+            repo="r",
+            pr_number=10,
+            live_head_sha=HEAD_A,
+            approval_at_current_head=True,
+            has_blocking_change_requests=True,
+        )
+        self.assertFalse(a["allowed"])
+
+    def test_valid_recovery_resolves_only_prior_provenance(self):
+        auth = _mint_auth(pr_number=10, head=HEAD_A, org="o", repo="r", incident_comment_id=1)
+        rec = irp.build_irrecoverable_provenance_record(
+            pr_number=10,
+            head_sha=HEAD_A,
+            remote="prgs",
+            org="o",
+            repo="r",
+            actor_username="a",
+            profile_name="p",
+            reason="x",
+            incident_issue=700,
+            incident_comment_id=1,
+            authorization=auth,
+        )
+        a = irp.assess_merger_consumption(
+            rec,
+            auth,
+            remote="prgs",
+            org="o",
+            repo="r",
+            pr_number=10,
+            live_head_sha=HEAD_A,
+            approval_at_current_head=True,
+            has_blocking_change_requests=False,
+            mergeable=True,
+            lease_ok=True,
+            runtime_ok=True,
+            workspace_ok=True,
+            anti_stomp_ok=True,
+        )
+        self.assertTrue(a["allowed"], a)
+        self.assertTrue(a["resolves_prior_provenance_blocker"])
+        self.assertFalse(a["historical_cleanup_proven"])
+
+    def test_duplicate_consume_idempotent(self):
+        auth = _mint_auth(pr_number=10, head=HEAD_A, org="o", repo="r", incident_comment_id=1)
+        rec = irp.build_irrecoverable_provenance_record(
+            pr_number=10,
+            head_sha=HEAD_A,
+            remote="prgs",
+            org="o",
+            repo="r",
+            actor_username="a",
+            profile_name="p",
+            reason="x",
+            incident_issue=700,
+            incident_comment_id=1,
+            authorization=auth,
+        )
+        consumed_auth = irp.mark_consumed(auth, consumer_username="m", consumer_profile="mer")
+        consumed_rec = irp.mark_consumed(rec, consumer_username="m", consumer_profile="mer")
+        a = irp.assess_merger_consumption(
+            consumed_rec,
+            consumed_auth,
+            remote="prgs",
+            org="o",
+            repo="r",
+            pr_number=10,
+            live_head_sha=HEAD_A,
+            approval_at_current_head=True,
+            has_blocking_change_requests=False,
+        )
+        self.assertTrue(a["allowed"], a)
+        self.assertTrue(a["recovery_record_consumed"])
+
+
+class TestF3ExactScopeEnforcement(unittest.TestCase):
+    def setUp(self):
+        self._tmp = tempfile.TemporaryDirectory()
+        self.state_dir = self._tmp.name
+        os.chmod(self.state_dir, 0o700)
+
+    def tearDown(self):
+        self._tmp.cleanup()
+
+    def test_same_pr_other_remote_not_loaded(self):
+        ss.save_state(
+            kind=ss.KIND_DECISION_LOCK,
+            payload=_lock([APPROVE], profile="prgs-reviewer", remote="other"),
+            remote="other",
+            org="Scaled-Tech-Consulting",
+            repo="Gitea-Tools",
+            profile_identity="prgs-reviewer",
+            state_dir=self.state_dir,
+        )
+        loaded = ss.load_state_for_profile(
+            kind=ss.KIND_DECISION_LOCK,
+            profile_identity="prgs-reviewer",
+            remote="prgs",
+            org="Scaled-Tech-Consulting",
+            repo="Gitea-Tools",
+            state_dir=self.state_dir,
+            skip_identity_match=True,
+        )
+        self.assertIsNone(loaded)
+
+    def test_same_pr_other_org_not_loaded(self):
+        ss.save_state(
+            kind=ss.KIND_DECISION_LOCK,
+            payload=_lock(
+                [APPROVE],
+                profile="prgs-reviewer",
+                org="Other-Org",
+            ),
+            remote="prgs",
+            org="Other-Org",
+            repo="Gitea-Tools",
+            profile_identity="prgs-reviewer",
+            state_dir=self.state_dir,
+        )
+        loaded = ss.load_state_for_profile(
+            kind=ss.KIND_DECISION_LOCK,
+            profile_identity="prgs-reviewer",
+            remote="prgs",
+            org="Scaled-Tech-Consulting",
+            repo="Gitea-Tools",
+            state_dir=self.state_dir,
+            skip_identity_match=True,
+        )
+        self.assertIsNone(loaded)
+
+    def test_same_pr_other_repo_not_loaded(self):
+        ss.save_state(
+            kind=ss.KIND_DECISION_LOCK,
+            payload=_lock(
+                [APPROVE],
+                profile="prgs-reviewer",
+                repo="Other-Repo",
+            ),
+            remote="prgs",
+            org="Scaled-Tech-Consulting",
+            repo="Other-Repo",
+            profile_identity="prgs-reviewer",
+            state_dir=self.state_dir,
+        )
+        loaded = ss.load_state_for_profile(
+            kind=ss.KIND_DECISION_LOCK,
+            profile_identity="prgs-reviewer",
+            remote="prgs",
+            org="Scaled-Tech-Consulting",
+            repo="Gitea-Tools",
+            state_dir=self.state_dir,
+            skip_identity_match=True,
+        )
+        self.assertIsNone(loaded)
+
+    def test_path_traversal_profile_fails(self):
+        g = irp.assess_profile_path_identity("../evil")
+        self.assertFalse(g["valid"])
+        loaded = ss.load_state_for_profile(
+            kind=ss.KIND_DECISION_LOCK,
+            profile_identity="../evil",
+            remote="prgs",
+            org="o",
+            repo="r",
+            state_dir=self.state_dir,
+            skip_identity_match=True,
+        )
+        self.assertIsNone(loaded)
+
+    def test_malformed_legacy_missing_repo_fails_closed(self):
+        # Record without repo identity when caller requires repo.
+        payload = _lock([APPROVE], profile="prgs-reviewer")
+        del payload["repo"]
+        ss.save_state(
+            kind=ss.KIND_DECISION_LOCK,
+            payload=payload,
+            remote="prgs",
+            org="Scaled-Tech-Consulting",
+            repo=None,
+            profile_identity="prgs-reviewer",
+            state_dir=self.state_dir,
+        )
+        loaded = ss.load_state_for_profile(
+            kind=ss.KIND_DECISION_LOCK,
+            profile_identity="prgs-reviewer",
+            remote="prgs",
+            org="Scaled-Tech-Consulting",
+            repo="Gitea-Tools",
+            state_dir=self.state_dir,
+            skip_identity_match=True,
+        )
+        self.assertIsNone(loaded)
+
+    def test_list_and_load_foreign_profile_lock(self):
+        ss.save_state(
+            kind=ss.KIND_DECISION_LOCK,
+            payload=_lock([APPROVE], profile="prgs-reviewer"),
+            remote="prgs",
+            org="Scaled-Tech-Consulting",
+            repo="Gitea-Tools",
+            profile_identity="prgs-reviewer",
+            state_dir=self.state_dir,
+        )
+        ss.save_state(
+            kind=ss.KIND_DECISION_LOCK,
+            payload=_lock([], profile="prgs-merger"),
+            remote="prgs",
+            org="Scaled-Tech-Consulting",
+            repo="Gitea-Tools",
+            profile_identity="prgs-merger",
+            state_dir=self.state_dir,
+        )
+        foreign = ss.load_state_for_profile(
+            kind=ss.KIND_DECISION_LOCK,
+            profile_identity="prgs-reviewer",
+            remote="prgs",
+            org="Scaled-Tech-Consulting",
+            repo="Gitea-Tools",
+            state_dir=self.state_dir,
+            skip_identity_match=True,
+        )
+        self.assertIsNotNone(foreign)
+        self.assertTrue(
+            srdl.lock_targets_merged_pr_approval(foreign, pr_number=100)
+        )
+
+
+class TestAC3PostMergeRecoveryRecord(unittest.TestCase):
+    def test_recovery_record_is_not_applied_cleanup(self):
+        rec = srdl.build_post_merge_recovery_record(
+            pr_number=10,
+            head_sha=HEAD_A,
+            merge_commit_sha="m" * 40,
+            target_profile_identity="prgs-reviewer",
+            failed_step="audit_comment_publish",
+            error="timeout",
+            remote="prgs",
+            org="Scaled-Tech-Consulting",
+            repo="Gitea-Tools",
+            actor_username="sysadmin",
+            profile_name="prgs-merger",
+        )
+        self.assertEqual(rec["status"], "recovery_required")
+        self.assertFalse(rec["applied"])
+        self.assertTrue(rec["recovery_critical"])
+
+
+class TestSessionStateTTL(unittest.TestCase):
+    def test_recovery_critical_kinds_ttl_exempt(self):
+        auth = _mint_auth(pr_number=1)
+        rec = irp.build_irrecoverable_provenance_record(
+            pr_number=1,
+            head_sha=HEAD_A,
+            remote="prgs",
+            org="o",
+            repo="r",
+            actor_username="a",
+            profile_name="p",
+            reason="gone",
+            incident_issue=700,
+            incident_comment_id=1,
+            authorization=auth,
+        )
+        rec["kind"] = ss.KIND_IRRECOVERABLE_DECISION_PROVENANCE
+        rec["recorded_at"] = "2000-01-01T00:00:00Z"
+        rec["updated_at"] = rec["recorded_at"]
+        rec["profile_identity"] = "prgs-reconciler"
+        rec["session_profile_lock"] = "prgs-reconciler"
+        reasons = ss.identity_match_reasons(
+            rec, profile_identity="prgs-reconciler"
+        )
+        self.assertFalse(any("expired" in r for r in reasons), msg=reasons)
+
+
+class TestInitReviewDecisionLockIntegration(unittest.TestCase):
+    def setUp(self):
+        self._tmp = tempfile.TemporaryDirectory()
+        self.env = patch.dict(
+            os.environ,
+            {
+                "GITEA_MCP_SESSION_STATE_DIR": self._tmp.name,
+                "GITEA_SESSION_PROFILE_LOCK": "prgs-reviewer",
+                "GITEA_PROFILE_NAME": "prgs-reviewer",
+            },
+            clear=False,
+        )
+        self.env.start()
+        import mcp_server
+
+        self.mcp = mcp_server
+        self.mcp._REVIEW_DECISION_LOCK = None
+
+    def tearDown(self):
+        self.mcp._REVIEW_DECISION_LOCK = None
+        self.env.stop()
+        self._tmp.cleanup()
+
+    def test_init_does_not_wipe_terminal_ledger(self):
+        self.mcp._save_review_decision_lock(
+            _lock([APPROVE], profile="prgs-reviewer")
+        )
+        self.mcp.init_review_decision_lock("prgs", "review_pr", force=True)
+        loaded = self.mcp._load_review_decision_lock()
+        self.assertIsNotNone(loaded)
+        last = srdl.last_terminal_mutation(loaded)
+        self.assertIsNotNone(last)
+        self.assertEqual(last.get("pr_number"), 100)
+
+    def test_init_creates_empty_when_no_terminal(self):
+        self.mcp._save_review_decision_lock(None)
+        self.mcp.init_review_decision_lock("prgs", "review_pr", force=True)
+        loaded = self.mcp._load_review_decision_lock()
+        self.assertIsNotNone(loaded)
+        self.assertEqual(loaded.get("live_mutations"), [])
+
+
+class TestIrrecoverableToolF1(unittest.TestCase):
+    def setUp(self):
+        self._tmp = tempfile.TemporaryDirectory()
+        self.env = patch.dict(
+            os.environ,
+            {
+                "GITEA_MCP_SESSION_STATE_DIR": self._tmp.name,
+                "GITEA_SESSION_PROFILE_LOCK": "prgs-reconciler",
+                "GITEA_PROFILE_NAME": "prgs-reconciler",
+                "GITEA_ALLOWED_OPERATIONS": ",".join(DEDICATED_RECOVERY_OPS),
+            },
+            clear=False,
+        )
+        self.env.start()
+        import mcp_server
+
+        self.mcp = mcp_server
+
+    def tearDown(self):
+        self.env.stop()
+        self._tmp.cleanup()
+
+    def _profile(self):
+        return {
+            "profile_name": "prgs-reconciler",
+            "role": "reconciler",
+            "allowed_operations": DEDICATED_RECOVERY_OPS,
+            "forbidden_operations": [
+                "gitea.pr.approve",
+                "gitea.pr.merge",
+                "gitea.pr.review",
+            ],
+        }
+
+    def test_operator_authorized_true_rejected(self):
+        with patch.object(self.mcp, "get_profile", return_value=self._profile()):
+            r = self.mcp.gitea_record_irrecoverable_decision_lock_provenance(
+                pr_number=50,
+                reason="lost",
+                confirmation=irp.expected_confirmation(50),
+                operator_authorized=True,
+                expected_head_sha=HEAD_A,
+                incident_issue=700,
+                incident_comment_id=11489,
+                remote="prgs",
+                org="Scaled-Tech-Consulting",
+                repo="Gitea-Tools",
+                post_audit_comment=False,
+            )
+        self.assertFalse(r["success"])
+        self.assertTrue(any("operator_authorized" in x for x in r["reasons"]))
+
+    def test_missing_expected_head_fails(self):
+        with patch.object(self.mcp, "get_profile", return_value=self._profile()), patch.object(
+            self.mcp, "_authenticated_username", return_value="sysadmin"
+        ), patch.object(
+            self.mcp, "_irrecoverable_capability_gate", return_value=None
+        ), patch.object(
+            irp, "assess_transport_for_auth_mint", return_value={"allowed": True, "reasons": []}
+        ), patch.object(
+            self.mcp, "_resolve", return_value=("h", "Scaled-Tech-Consulting", "Gitea-Tools")
+        ):
+            r = self.mcp.gitea_record_irrecoverable_decision_lock_provenance(
+                pr_number=50,
+                reason="lost",
+                confirmation=irp.expected_confirmation(50),
+                expected_head_sha=None,
+                incident_issue=700,
+                incident_comment_id=11489,
+                remote="prgs",
+                org="Scaled-Tech-Consulting",
+                repo="Gitea-Tools",
+                post_audit_comment=False,
+            )
+        self.assertFalse(r["success"])
+
+    def test_wrong_confirmation_fails(self):
+        with patch.object(self.mcp, "get_profile", return_value=self._profile()), patch.object(
+            self.mcp, "_irrecoverable_capability_gate", return_value=None
+        ), patch.object(
+            irp, "assess_transport_for_auth_mint", return_value={"allowed": True, "reasons": []}
+        ), patch.object(
+            self.mcp, "_resolve", return_value=("h", "o", "r")
+        ):
+            r = self.mcp.gitea_record_irrecoverable_decision_lock_provenance(
+                pr_number=50,
+                reason="x",
+                confirmation=irp.expected_confirmation(51),
+                expected_head_sha=HEAD_A,
+                incident_issue=1,
+                incident_comment_id=2,
+                remote="prgs",
+                post_audit_comment=False,
+            )
+        self.assertFalse(r["success"])
+
+    def test_records_with_server_auth(self):
+        auth = _mint_auth(
+            pr_number=50,
+            head=HEAD_A,
+            org="Scaled-Tech-Consulting",
+            repo="Gitea-Tools",
+            incident_issue=700,
+            incident_comment_id=11489,
+        )
+        auth_profile = irp.auth_state_profile_identity(
+            remote="prgs",
+            org="Scaled-Tech-Consulting",
+            repo="Gitea-Tools",
+            pr_number=50,
+            expected_head_sha=HEAD_A,
+        )
+        ss.save_state(
+            kind=ss.KIND_IRRECOVERABLE_PROVENANCE_AUTH,
+            payload=auth,
+            remote="prgs",
+            org="Scaled-Tech-Consulting",
+            repo="Gitea-Tools",
+            profile_identity=auth_profile,
+            state_dir=self._tmp.name,
+        )
+
+        def _api(method, url, auth=None, data=None, **kwargs):
+            if "/pulls/" in str(url):
+                return {"head": {"sha": HEAD_A}, "state": "open"}
+            if "/issues/comments/" in str(url):
+                return _incident_comment_payload(
+                    comment_id=11489,
+                    author="controller-ops",
+                    pr_number=50,
+                    head=HEAD_A,
+                    remote="prgs",
+                    org="Scaled-Tech-Consulting",
+                    repo="Gitea-Tools",
+                    incident_issue=700,
+                )
+            raise AssertionError(f"unexpected API {method} {url}")
+
+        with patch.object(self.mcp, "get_profile", return_value=self._profile()), patch.object(
+            self.mcp, "_authenticated_username", return_value="sysadmin"
+        ), patch.object(
+            self.mcp, "_irrecoverable_capability_gate", return_value=None
+        ), patch.object(
+            irp, "assess_transport_for_auth_mint", return_value={"allowed": True, "reasons": []}
+        ), patch.object(
+            self.mcp, "_resolve", return_value=("h", "Scaled-Tech-Consulting", "Gitea-Tools")
+        ), patch.object(
+            self.mcp, "_auth", return_value={"Authorization": "token test"}
+        ), patch.object(
+            self.mcp, "api_request", side_effect=_api
+        ), patch.object(
+            self.mcp, "repo_api_url", return_value="https://example.test/api/v1/repos/o/r"
+        ):
+            r = self.mcp.gitea_record_irrecoverable_decision_lock_provenance(
+                pr_number=50,
+                reason="terminal evidence overwritten",
+                confirmation=irp.expected_confirmation(50),
+                expected_head_sha=HEAD_A,
+                incident_issue=700,
+                incident_comment_id=11489,
+                remote="prgs",
+                org="Scaled-Tech-Consulting",
+                repo="Gitea-Tools",
+                post_audit_comment=False,
+            )
+        self.assertTrue(r["success"], r)
+        self.assertFalse(r["applied"])
+        self.assertFalse(r["historical_cleanup_proven"])
+        self.assertTrue(r["merger_may_accept"])
+        self.assertEqual(r["record"]["status"], "provenance_irrecoverable")
+
+        # Idempotent
+        with patch.object(self.mcp, "get_profile", return_value=self._profile()), patch.object(
+            self.mcp, "_authenticated_username", return_value="sysadmin"
+        ), patch.object(
+            self.mcp, "_irrecoverable_capability_gate", return_value=None
+        ), patch.object(
+            irp, "assess_transport_for_auth_mint", return_value={"allowed": True, "reasons": []}
+        ), patch.object(
+            self.mcp, "_resolve", return_value=("h", "Scaled-Tech-Consulting", "Gitea-Tools")
+        ), patch.object(
+            self.mcp, "_auth", return_value={"Authorization": "token test"}
+        ), patch.object(
+            self.mcp, "api_request", side_effect=_api
+        ), patch.object(
+            self.mcp, "repo_api_url", return_value="https://example.test/api/v1/repos/o/r"
+        ):
+            r2 = self.mcp.gitea_record_irrecoverable_decision_lock_provenance(
+                pr_number=50,
+                reason="terminal evidence overwritten",
+                confirmation=irp.expected_confirmation(50),
+                expected_head_sha=HEAD_A,
+                incident_issue=700,
+                incident_comment_id=11489,
+                remote="prgs",
+                org="Scaled-Tech-Consulting",
+                repo="Gitea-Tools",
+                post_audit_comment=False,
+            )
+        self.assertTrue(r2["success"], r2)
+        self.assertFalse(r2["performed"])
+
+
+class TestClearProfileHelperF3(unittest.TestCase):
+    def setUp(self):
+        self._tmp = tempfile.TemporaryDirectory()
+        self.env = patch.dict(
+            os.environ,
+            {
+                "GITEA_MCP_SESSION_STATE_DIR": self._tmp.name,
+                "GITEA_SESSION_PROFILE_LOCK": "prgs-merger",
+            },
+            clear=False,
+        )
+        self.env.start()
+        import mcp_server
+
+        self.mcp = mcp_server
+        self.mcp._REVIEW_DECISION_LOCK = None
+
+    def tearDown(self):
+        self.mcp._REVIEW_DECISION_LOCK = None
+        self.env.stop()
+        self._tmp.cleanup()
+
+    def test_clear_only_matching_reviewer_approve(self):
+        ss.save_state(
+            kind=ss.KIND_DECISION_LOCK,
+            payload=_lock([APPROVE], profile="prgs-reviewer", head=HEAD_A),
+            remote="prgs",
+            org="Scaled-Tech-Consulting",
+            repo="Gitea-Tools",
+            profile_identity="prgs-reviewer",
+            state_dir=self._tmp.name,
+        )
+        ss.save_state(
+            kind=ss.KIND_DECISION_LOCK,
+            payload=_lock([], profile="prgs-merger"),
+            remote="prgs",
+            org="Scaled-Tech-Consulting",
+            repo="Gitea-Tools",
+            profile_identity="prgs-merger",
+            state_dir=self._tmp.name,
+        )
+        out = self.mcp._clear_decision_lock_for_profile(
+            profile_identity="prgs-reviewer",
+            pr_number=100,
+            expected_head_sha=HEAD_A,
+            remote="prgs",
+            org="Scaled-Tech-Consulting",
+            repo="Gitea-Tools",
+        )
+        self.assertTrue(out["cleared"], out)
+        skip = self.mcp._clear_decision_lock_for_profile(
+            profile_identity="prgs-merger",
+            pr_number=100,
+            expected_head_sha=HEAD_A,
+            remote="prgs",
+            org="Scaled-Tech-Consulting",
+            repo="Gitea-Tools",
+        )
+        self.assertFalse(skip["cleared"])
+
+    def test_pr_number_only_fallback_impossible(self):
+        ss.save_state(
+            kind=ss.KIND_DECISION_LOCK,
+            payload=_lock([APPROVE], profile="prgs-reviewer", head=HEAD_A),
+            remote="prgs",
+            org="Scaled-Tech-Consulting",
+            repo="Gitea-Tools",
+            profile_identity="prgs-reviewer",
+            state_dir=self._tmp.name,
+        )
+        # Missing expected_head_sha
+        out = self.mcp._clear_decision_lock_for_profile(
+            profile_identity="prgs-reviewer",
+            pr_number=100,
+            expected_head_sha=None,
+            remote="prgs",
+            org="Scaled-Tech-Consulting",
+            repo="Gitea-Tools",
+        )
+        self.assertFalse(out["cleared"])
+        self.assertIn("PR-number-only", out["reason"])
+
+    def test_wrong_head_not_cleared(self):
+        ss.save_state(
+            kind=ss.KIND_DECISION_LOCK,
+            payload=_lock([APPROVE], profile="prgs-reviewer", head=HEAD_A),
+            remote="prgs",
+            org="Scaled-Tech-Consulting",
+            repo="Gitea-Tools",
+            profile_identity="prgs-reviewer",
+            state_dir=self._tmp.name,
+        )
+        out = self.mcp._clear_decision_lock_for_profile(
+            profile_identity="prgs-reviewer",
+            pr_number=100,
+            expected_head_sha=HEAD_B,
+            remote="prgs",
+            org="Scaled-Tech-Consulting",
+            repo="Gitea-Tools",
+        )
+        self.assertFalse(out["cleared"])
+
+    def test_cross_repo_same_pr_number_not_cleared(self):
+        ss.save_state(
+            kind=ss.KIND_DECISION_LOCK,
+            payload=_lock(
+                [APPROVE],
+                profile="prgs-reviewer",
+                head=HEAD_A,
+                repo="Other-Repo",
+            ),
+            remote="prgs",
+            org="Scaled-Tech-Consulting",
+            repo="Other-Repo",
+            profile_identity="prgs-reviewer",
+            state_dir=self._tmp.name,
+        )
+        out = self.mcp._clear_decision_lock_for_profile(
+            profile_identity="prgs-reviewer",
+            pr_number=100,
+            expected_head_sha=HEAD_A,
+            remote="prgs",
+            org="Scaled-Tech-Consulting",
+            repo="Gitea-Tools",
+        )
+        self.assertFalse(out["cleared"])
+        # Original lock still present under Other-Repo scope
+        still = ss.load_state_for_profile(
+            kind=ss.KIND_DECISION_LOCK,
+            profile_identity="prgs-reviewer",
+            remote="prgs",
+            org="Scaled-Tech-Consulting",
+            repo="Other-Repo",
+            state_dir=self._tmp.name,
+            skip_identity_match=True,
+        )
+        self.assertIsNotNone(still)
+
+
+def _reorder_canonical_lines(body, first, second):
+    """Swap two canonical field lines, leaving the digest untouched."""
+    lines = body.split("\n")
+    i = next(i for i, l in enumerate(lines) if l.startswith(f"{first}: "))
+    j = next(i for i, l in enumerate(lines) if l.startswith(f"{second}: "))
+    lines[i], lines[j] = lines[j], lines[i]
+    return "\n".join(lines)
+
+
+def _insert_after_canonical_line(body, after_field, extra_line):
+    lines = body.split("\n")
+    i = next(i for i, l in enumerate(lines) if l.startswith(f"{after_field}: "))
+    lines.insert(i + 1, extra_line)
+    return "\n".join(lines)
+
+
+class TestF6KeyVersionFailsClosed(unittest.TestCase):
+    """#709 F6 (review 438): key-version validation must fail closed."""
+
+    def _verify(self, auth, **kwargs):
+        params = {
+            "remote": "prgs",
+            "org": "Scaled-Tech-Consulting",
+            "repo": "Gitea-Tools",
+            "pr_number": 42,
+            "expected_head_sha": HEAD_A,
+        }
+        params.update(kwargs)
+        return irp.verify_authorization_artifact(auth, **params)
+
+    def test_valid_artifact_verifies(self):
+        self.assertTrue(self._verify(_mint_auth())["valid"])
+
+    def test_missing_key_version_rejected(self):
+        auth = _mint_auth()
+        del auth["key_version"]
+        v = self._verify(auth)
+        self.assertFalse(v["valid"], v)
+        self.assertTrue(
+            any("missing key_version" in r for r in v["reasons"]), v["reasons"]
+        )
+
+    def test_empty_key_version_rejected(self):
+        auth = _mint_auth()
+        auth["key_version"] = ""
+        v = self._verify(auth)
+        self.assertFalse(v["valid"], v)
+        self.assertTrue(any("empty" in r for r in v["reasons"]), v["reasons"])
+
+    def test_unknown_key_version_rejected(self):
+        auth = _mint_auth()
+        auth["key_version"] = "totally-unknown-version"
+        v = self._verify(auth)
+        self.assertFalse(v["valid"], v)
+        self.assertTrue(
+            any("unknown or does not match" in r for r in v["reasons"]), v["reasons"]
+        )
+
+    def test_malformed_key_version_rejected(self):
+        auth = _mint_auth()
+        auth["key_version"] = "bad version!"
+        v = self._verify(auth)
+        self.assertFalse(v["valid"], v)
+        self.assertTrue(any("malformed" in r for r in v["reasons"]), v["reasons"])
+
+    def test_non_string_key_version_rejected(self):
+        auth = _mint_auth()
+        auth["key_version"] = ["v1", "v2"]
+        v = self._verify(auth)
+        self.assertFalse(v["valid"], v)
+
+    def test_duplicate_key_version_fields_rejected(self):
+        auth = _mint_auth()
+        auth["keyVersion"] = auth["key_version"]  # identical value, still duplicate
+        v = self._verify(auth)
+        self.assertFalse(v["valid"], v)
+        self.assertTrue(
+            any("duplicate key-version" in r for r in v["reasons"]), v["reasons"]
+        )
+
+    def test_duplicate_conflicting_key_version_fields_rejected(self):
+        auth = _mint_auth()
+        auth["auth_key_version"] = "v9"
+        v = self._verify(auth)
+        self.assertFalse(v["valid"], v)
+        self.assertTrue(
+            any("duplicate key-version" in r for r in v["reasons"]), v["reasons"]
+        )
+
+    def test_nested_key_version_counts_as_duplicate(self):
+        auth = _mint_auth()
+        auth["native_provenance"] = dict(auth["native_provenance"])
+        auth["native_provenance"]["key_version"] = auth["key_version"]
+        v = self._verify(auth)
+        self.assertFalse(v["valid"], v)
+
+    def test_rotation_invalidates_prior_version_artifact(self):
+        """Rotating the configured version must reject artifacts minted under the old one."""
+        auth = _mint_auth()
+        self.assertTrue(self._verify(auth)["valid"])
+        irp.reset_process_auth_secret_for_tests()
+        try:
+            with patch.dict(
+                os.environ,
+                {
+                    irp.ENV_AUTH_HMAC_KEY: DURABLE_TEST_HMAC_KEY,
+                    irp.ENV_AUTH_HMAC_KEY_VERSION: "v2",
+                },
+                clear=False,
+            ):
+                v = self._verify(auth)
+                self.assertFalse(v["valid"], v)
+                self.assertTrue(
+                    any("does not match the configured" in r for r in v["reasons"]),
+                    v["reasons"],
+                )
+        finally:
+            irp.reset_process_auth_secret_for_tests()
+
+    def test_wrong_version_fails_even_when_key_unchanged(self):
+        """Version mismatch alone fails: the durable key staying the same is not enough."""
+        irp.reset_process_auth_secret_for_tests()
+        try:
+            with patch.dict(
+                os.environ,
+                {
+                    irp.ENV_AUTH_HMAC_KEY: DURABLE_TEST_HMAC_KEY,
+                    irp.ENV_AUTH_HMAC_KEY_VERSION: "v1",
+                },
+                clear=False,
+            ):
+                auth = _mint_auth()
+                self.assertEqual(auth["key_version"], "v1")
+                self.assertTrue(self._verify(auth)["valid"])
+            irp.reset_process_auth_secret_for_tests()
+            with patch.dict(
+                os.environ,
+                {
+                    irp.ENV_AUTH_HMAC_KEY: DURABLE_TEST_HMAC_KEY,  # same key
+                    irp.ENV_AUTH_HMAC_KEY_VERSION: "v2",  # rotated version
+                },
+                clear=False,
+            ):
+                self.assertFalse(self._verify(auth)["valid"])
+        finally:
+            irp.reset_process_auth_secret_for_tests()
+
+    def test_wrong_key_fails_after_restart(self):
+        """A different durable key must reject the artifact even at the same version."""
+        irp.reset_process_auth_secret_for_tests()
+        try:
+            with patch.dict(
+                os.environ,
+                {
+                    irp.ENV_AUTH_HMAC_KEY: DURABLE_TEST_HMAC_KEY,
+                    irp.ENV_AUTH_HMAC_KEY_VERSION: "v1",
+                },
+                clear=False,
+            ):
+                auth = _mint_auth()
+            irp.reset_process_auth_secret_for_tests()  # simulate restart
+            with patch.dict(
+                os.environ,
+                {
+                    irp.ENV_AUTH_HMAC_KEY: "1" * 64,  # different durable key
+                    irp.ENV_AUTH_HMAC_KEY_VERSION: "v1",  # same version
+                },
+                clear=False,
+            ):
+                v = self._verify(auth)
+                self.assertFalse(v["valid"], v)
+                self.assertTrue(
+                    any("server_signature invalid" in r for r in v["reasons"]),
+                    v["reasons"],
+                )
+        finally:
+            irp.reset_process_auth_secret_for_tests()
+
+    def test_same_durable_key_verifies_after_restart(self):
+        irp.reset_process_auth_secret_for_tests()
+        try:
+            env = {
+                irp.ENV_AUTH_HMAC_KEY: DURABLE_TEST_HMAC_KEY,
+                irp.ENV_AUTH_HMAC_KEY_VERSION: "v1",
+            }
+            with patch.dict(os.environ, env, clear=False):
+                auth = _mint_auth()
+            irp.reset_process_auth_secret_for_tests()  # simulate restart
+            with patch.dict(os.environ, env, clear=False):
+                self.assertTrue(self._verify(auth)["valid"])
+        finally:
+            irp.reset_process_auth_secret_for_tests()
+
+    def test_key_version_is_inside_authenticated_data(self):
+        """Editing key_version must break the MAC, not just the version check."""
+        irp.reset_process_auth_secret_for_tests()
+        try:
+            with patch.dict(
+                os.environ,
+                {
+                    irp.ENV_AUTH_HMAC_KEY: DURABLE_TEST_HMAC_KEY,
+                    irp.ENV_AUTH_HMAC_KEY_VERSION: "v1",
+                },
+                clear=False,
+            ):
+                auth = _mint_auth()
+                signature_v1 = auth["server_signature"]
+            irp.reset_process_auth_secret_for_tests()
+            with patch.dict(
+                os.environ,
+                {
+                    irp.ENV_AUTH_HMAC_KEY: DURABLE_TEST_HMAC_KEY,
+                    irp.ENV_AUTH_HMAC_KEY_VERSION: "v2",
+                },
+                clear=False,
+            ):
+                rotated = _mint_auth()
+                # Same key + same scope, different version => different MAC.
+                self.assertNotEqual(signature_v1, rotated["server_signature"])
+        finally:
+            irp.reset_process_auth_secret_for_tests()
+
+    def test_production_requires_configured_key_version(self):
+        irp.reset_process_auth_secret_for_tests()
+        try:
+            with patch.object(
+                irp.mcp_daemon_guard, "is_pytest_runtime", return_value=False
+            ), patch.dict(
+                os.environ, {irp.ENV_AUTH_HMAC_KEY: DURABLE_TEST_HMAC_KEY}, clear=False
+            ):
+                os.environ.pop(irp.ENV_AUTH_HMAC_KEY_VERSION, None)
+                with self.assertRaises(irp.AuthSecretError) as ctx:
+                    irp.auth_key_version()
+                self.assertIn(irp.ENV_AUTH_HMAC_KEY_VERSION, str(ctx.exception))
+        finally:
+            irp.reset_process_auth_secret_for_tests()
+
+    def test_production_requires_durable_key(self):
+        irp.reset_process_auth_secret_for_tests()
+        try:
+            with patch.object(
+                irp.mcp_daemon_guard, "is_pytest_runtime", return_value=False
+            ), patch.dict(os.environ, {}, clear=False):
+                os.environ.pop(irp.ENV_AUTH_HMAC_KEY, None)
+                with self.assertRaises(irp.AuthSecretError):
+                    irp.auth_key_version()
+        finally:
+            irp.reset_process_auth_secret_for_tests()
+
+    def test_errors_never_leak_key_material(self):
+        irp.reset_process_auth_secret_for_tests()
+        try:
+            secret = "s3cr3t" + "9" * 58
+            with patch.dict(
+                os.environ,
+                {
+                    irp.ENV_AUTH_HMAC_KEY: secret,
+                    irp.ENV_AUTH_HMAC_KEY_VERSION: "v1",
+                },
+                clear=False,
+            ):
+                auth = _mint_auth()
+                self.assertNotIn("key", {k.lower(): 1 for k in ()})  # no-op guard
+                blob = json.dumps(auth)
+                self.assertNotIn(secret, blob)
+                auth["key_version"] = "nope"
+                v = self._verify(auth)
+                self.assertNotIn(secret, json.dumps(v["reasons"]))
+        finally:
+            irp.reset_process_auth_secret_for_tests()
+
+
+class TestF7StrictCanonicalIncidentEvidence(unittest.TestCase):
+    """#709 F7 (review 438): only the exact canonical representation is accepted."""
+
+    def _assess(self, payload, **kwargs):
+        params = {
+            "incident_issue": 700,
+            "incident_comment_id": 11489,
+            "comment_payload": payload,
+            "expected_remote": "prgs",
+            "expected_org": "Scaled-Tech-Consulting",
+            "expected_repo": "Gitea-Tools",
+            "expected_pr_number": 42,
+            "expected_head_sha": HEAD_A,
+            "expected_decision_lock_id": DECISION_LOCK_ID,
+            "expected_recovery_action": RECOVERY_ACTION,
+            "mint_actor_id": MINT_ACTOR_ID,
+            "mint_actor_username": MINT_ACTOR_LOGIN,
+        }
+        params.update(kwargs)
+        return irp.assess_incident_evidence(**params)
+
+    def test_canonical_evidence_accepted(self):
+        g = self._assess(_incident_comment_payload())
+        self.assertTrue(g["valid"], g)
+
+    def test_reordered_fields_rejected(self):
+        body = _reorder_canonical_lines(_canonical_incident_body(), "org", "repo")
+        g = self._assess(_incident_comment_payload(body=body))
+        self.assertFalse(g["valid"], g)
+        self.assertTrue(
+            any("canonical order" in r for r in g["reasons"]), g["reasons"]
+        )
+
+    def test_duplicate_identical_field_rejected(self):
+        body = _canonical_incident_body()
+        body = _insert_after_canonical_line(body, "repo", "repo: Gitea-Tools")
+        g = self._assess(_incident_comment_payload(body=body))
+        self.assertFalse(g["valid"], g)
+
+    def test_duplicate_conflicting_field_rejected(self):
+        body = _canonical_incident_body()
+        body = _insert_after_canonical_line(body, "repo", "repo: Other-Repo")
+        g = self._assess(_incident_comment_payload(body=body))
+        self.assertFalse(g["valid"], g)
+
+    def test_conflicting_field_in_narrative_rejected(self):
+        body = _canonical_incident_body(narrative="context") + "\nrepo: Other-Repo"
+        g = self._assess(_incident_comment_payload(body=body))
+        self.assertFalse(g["valid"], g)
+        self.assertTrue(
+            any("outside the signed block" in r for r in g["reasons"]), g["reasons"]
+        )
+
+    def test_second_marker_rejected(self):
+        body = _canonical_incident_body(narrative="context")
+        body = f"{body}\n\n{irp.INCIDENT_MARKER}"
+        g = self._assess(_incident_comment_payload(body=body))
+        self.assertFalse(g["valid"], g)
+
+    def test_marker_not_first_rejected(self):
+        body = "preamble\n" + _canonical_incident_body()
+        g = self._assess(_incident_comment_payload(body=body))
+        self.assertFalse(g["valid"], g)
+        self.assertTrue(
+            any("marker position" in r for r in g["reasons"]), g["reasons"]
+        )
+
+    def test_unknown_extra_field_rejected(self):
+        body = _insert_after_canonical_line(
+            _canonical_incident_body(), "repo", "sneaky: value"
+        )
+        g = self._assess(_incident_comment_payload(body=body))
+        self.assertFalse(g["valid"], g)
+
+    def test_missing_field_rejected(self):
+        body = "\n".join(
+            l
+            for l in _canonical_incident_body().split("\n")
+            if not l.startswith("nonce: ")
+        )
+        g = self._assess(_incident_comment_payload(body=body))
+        self.assertFalse(g["valid"], g)
+
+    def test_empty_field_rejected(self):
+        body = _canonical_incident_body().replace(
+            f"decision_lock_id: {DECISION_LOCK_ID}", "decision_lock_id: "
+        )
+        g = self._assess(_incident_comment_payload(body=body))
+        self.assertFalse(g["valid"], g)
+
+    def test_conflicting_actor_logins_rejected(self):
+        payload = _incident_comment_payload()
+        payload["user"] = {"id": AUTHOR_ID, "login": AUTHOR_LOGIN, "username": "someone-else"}
+        g = self._assess(payload)
+        self.assertFalse(g["valid"], g)
+        self.assertTrue(
+            any("conflicting logins" in r for r in g["reasons"]), g["reasons"]
+        )
+
+    def test_conflicting_actor_ids_rejected(self):
+        payload = _incident_comment_payload()
+        payload["user"] = {"id": AUTHOR_ID, "user_id": 999, "login": AUTHOR_LOGIN}
+        g = self._assess(payload)
+        self.assertFalse(g["valid"], g)
+        self.assertTrue(
+            any("conflicting user ids" in r for r in g["reasons"]), g["reasons"]
+        )
+
+    def test_display_name_only_actor_rejected(self):
+        payload = _incident_comment_payload()
+        payload["user"] = {"login": AUTHOR_LOGIN}  # no stable id
+        g = self._assess(payload)
+        self.assertFalse(g["valid"], g)
+        self.assertTrue(
+            any("stable user id" in r for r in g["reasons"]), g["reasons"]
+        )
+
+    def test_author_id_substitution_rejected(self):
+        """Body claims one author id, live comment is authored by another."""
+        payload = _incident_comment_payload()
+        payload["user"] = {"id": 5150, "login": AUTHOR_LOGIN}
+        g = self._assess(payload)
+        self.assertFalse(g["valid"], g)
+        self.assertTrue(
+            any("evidence_author_id" in r for r in g["reasons"]), g["reasons"]
+        )
+
+    def test_edited_comment_rejected(self):
+        payload = _incident_comment_payload()
+        payload["updated_at"] = "2026-07-14T00:00:00Z"
+        g = self._assess(payload)
+        self.assertFalse(g["valid"], g)
+        self.assertTrue(any("edited" in r for r in g["reasons"]), g["reasons"])
+
+    def test_self_authored_by_stable_id_rejected(self):
+        payload = _incident_comment_payload(author=MINT_ACTOR_LOGIN, author_id=MINT_ACTOR_ID)
+        g = self._assess(payload)
+        self.assertFalse(g["valid"], g)
+        self.assertTrue(
+            any("self-authored" in r for r in g["reasons"]), g["reasons"]
+        )
+
+    def test_mint_actor_substitution_rejected(self):
+        g = self._assess(_incident_comment_payload(), mint_actor_id=999, mint_actor_username="someone")
+        self.assertFalse(g["valid"], g)
+        self.assertTrue(
+            any("mint_actor" in r for r in g["reasons"]), g["reasons"]
+        )
+
+    def test_decision_lock_substitution_rejected(self):
+        payload = _incident_comment_payload(decision_lock_id="review_decision_lock-prgs-merger")
+        g = self._assess(payload)
+        self.assertFalse(g["valid"], g)
+        self.assertTrue(
+            any("decision_lock_id" in r for r in g["reasons"]), g["reasons"]
+        )
+
+    def test_recovery_action_substitution_rejected(self):
+        body = _canonical_incident_body().replace(
+            f"recovery_action: {RECOVERY_ACTION}", "recovery_action: clear_decision_lock"
+        )
+        g = self._assess(_incident_comment_payload(body=body))
+        self.assertFalse(g["valid"], g)
+
+    def test_unsupported_recovery_action_cannot_be_built(self):
+        with self.assertRaises(ValueError):
+            _canonical_incident_body(recovery_action="merge_pr")
+
+    def test_cross_pr_replay_rejected(self):
+        payload = _incident_comment_payload(pr_number=99)
+        g = self._assess(payload)
+        self.assertFalse(g["valid"], g)
+        self.assertTrue(
+            any("pr_number" in r for r in g["reasons"]), g["reasons"]
+        )
+
+    def test_cross_repository_replay_rejected(self):
+        payload = _incident_comment_payload(repo="Other-Repo")
+        g = self._assess(payload)
+        self.assertFalse(g["valid"], g)
+
+    def test_cross_org_replay_rejected(self):
+        payload = _incident_comment_payload(org="Other-Org")
+        g = self._assess(payload)
+        self.assertFalse(g["valid"], g)
+
+    def test_cross_remote_replay_rejected(self):
+        payload = _incident_comment_payload(remote="dadeschools")
+        g = self._assess(payload)
+        self.assertFalse(g["valid"], g)
+
+    def test_cross_head_replay_rejected(self):
+        payload = _incident_comment_payload(head=HEAD_B)
+        g = self._assess(payload)
+        self.assertFalse(g["valid"], g)
+
+    def test_recorded_head_substitution_rejected(self):
+        payload = _incident_comment_payload(recorded_head_sha=HEAD_B)
+        g = self._assess(payload, expected_recorded_head_sha=HEAD_A)
+        self.assertFalse(g["valid"], g)
+        self.assertTrue(
+            any("recorded_head_sha" in r for r in g["reasons"]), g["reasons"]
+        )
+
+    def test_key_version_substitution_rejected(self):
+        payload = _incident_comment_payload(key_version="v9")
+        g = self._assess(payload, expected_key_version=irp.auth_key_version())
+        self.assertFalse(g["valid"], g)
+
+    def test_digest_preserving_substitution_rejected(self):
+        """Swap a field *and* its digest from another scope: still refused.
+
+        The attacker mints a fully valid canonical body for a different PR (so
+        the digest is internally consistent) and presents it for this scope.
+        """
+        foreign = _canonical_incident_body(pr_number=99)
+        parsed = irp.parse_canonical_incident_body(foreign)
+        self.assertTrue(parsed["valid"], parsed)  # internally consistent
+        g = self._assess(_incident_comment_payload(body=foreign))
+        self.assertFalse(g["valid"], g)
+
+    def test_field_swap_without_digest_update_rejected(self):
+        body = _canonical_incident_body().replace(
+            "repo: Gitea-Tools", "repo: Other-Repo"
+        )
+        g = self._assess(
+            _incident_comment_payload(body=body), expected_repo="Other-Repo"
+        )
+        self.assertFalse(g["valid"], g)
+        self.assertTrue(
+            any("content_digest" in r for r in g["reasons"]), g["reasons"]
+        )
+
+    def test_nonce_binds_digest(self):
+        body = _canonical_incident_body().replace(
+            f"nonce: {INCIDENT_NONCE}", "nonce: 00000000-0000-0000-0000-000000000000"
+        )
+        g = self._assess(_incident_comment_payload(body=body))
+        self.assertFalse(g["valid"], g)
+        self.assertTrue(
+            any("content_digest" in r for r in g["reasons"]), g["reasons"]
+        )
+
+    def test_builder_refuses_ambiguous_narrative(self):
+        with self.assertRaises(ValueError):
+            _canonical_incident_body(narrative=f"{irp.INCIDENT_MARKER}\nrepo: evil")
+
+    def test_builder_refuses_multiline_field(self):
+        with self.assertRaises(ValueError):
+            _canonical_incident_body(destroyed_subject="line1\nrepo: evil")
+
+    def test_builder_refuses_empty_field(self):
+        with self.assertRaises(ValueError):
+            _canonical_incident_body(decision_lock_id="")
+
+    def test_builder_output_is_the_accepted_format(self):
+        body = _canonical_incident_body()
+        parsed = irp.parse_canonical_incident_body(body)
+        self.assertTrue(parsed["valid"], parsed)
+        self.assertEqual(
+            parsed["canonical_block"],
+            irp.render_canonical_incident_block(parsed["fields"]),
+        )
+
+
+class TestF8ArchivePrerequisiteForClear(unittest.TestCase):
+    """#709 F8 (review 438): never clear terminal evidence without a durable archive."""
+
+    def setUp(self):
+        self._tmp = tempfile.TemporaryDirectory()
+        self.env = patch.dict(
+            os.environ,
+            {
+                "GITEA_MCP_SESSION_STATE_DIR": self._tmp.name,
+                "GITEA_SESSION_PROFILE_LOCK": "prgs-merger",
+            },
+            clear=False,
+        )
+        self.env.start()
+        import mcp_server
+
+        self.mcp = mcp_server
+        self.mcp._REVIEW_DECISION_LOCK = None
+        ss.save_state(
+            kind=ss.KIND_DECISION_LOCK,
+            payload=_lock([APPROVE], profile="prgs-reviewer", head=HEAD_A),
+            remote="prgs",
+            org="Scaled-Tech-Consulting",
+            repo="Gitea-Tools",
+            profile_identity="prgs-reviewer",
+            state_dir=self._tmp.name,
+        )
+
+    def tearDown(self):
+        self.mcp._REVIEW_DECISION_LOCK = None
+        self.env.stop()
+        self._tmp.cleanup()
+
+    def _clear(self):
+        return self.mcp._clear_decision_lock_for_profile(
+            profile_identity="prgs-reviewer",
+            pr_number=100,
+            expected_head_sha=HEAD_A,
+            remote="prgs",
+            org="Scaled-Tech-Consulting",
+            repo="Gitea-Tools",
+        )
+
+    def _lock_still_present(self):
+        return ss.load_state_for_profile(
+            kind=ss.KIND_DECISION_LOCK,
+            profile_identity="prgs-reviewer",
+            remote="prgs",
+            org="Scaled-Tech-Consulting",
+            repo="Gitea-Tools",
+            skip_identity_match=True,
+        )
+
+    def _fail_archive_only(self, behavior):
+        """Patch save_state so archive writes fail but other writes pass through."""
+        real = ss.save_state
+
+        def _fake(**kwargs):
+            if kwargs.get("kind") == ss.KIND_DECISION_LOCK_ARCHIVE:
+                return behavior()
+            return real(**kwargs)
+
+        return patch.object(self.mcp.mcp_session_state, "save_state", side_effect=_fake)
+
+    def test_archive_exception_retains_lock(self):
+        def _boom():
+            raise OSError("disk failure")
+
+        with self._fail_archive_only(_boom):
+            out = self._clear()
+        self.assertFalse(out["cleared"], out)
+        self.assertTrue(out["terminal_lock_retained"], out)
+        self.assertTrue(out["recovery_required"], out)
+        self.assertEqual(out["archive_failed_step"], "archive_save_state")
+        self.assertIsNotNone(self._lock_still_present(), "terminal lock destroyed")
+
+    def test_archive_false_response_retains_lock(self):
+        with self._fail_archive_only(lambda: False):
+            out = self._clear()
+        self.assertFalse(out["cleared"], out)
+        self.assertIsNotNone(self._lock_still_present(), "terminal lock destroyed")
+
+    def test_archive_empty_response_retains_lock(self):
+        with self._fail_archive_only(lambda: {}):
+            out = self._clear()
+        self.assertFalse(out["cleared"], out)
+        self.assertIsNotNone(self._lock_still_present(), "terminal lock destroyed")
+
+    def test_archive_timeout_retains_lock(self):
+        def _timeout():
+            raise TimeoutError("session state write timed out")
+
+        with self._fail_archive_only(_timeout):
+            out = self._clear()
+        self.assertFalse(out["cleared"], out)
+        self.assertIsNotNone(self._lock_still_present(), "terminal lock destroyed")
+
+    def test_archive_unreadable_retains_lock(self):
+        """Write claims success but read-back finds nothing: still refuse to clear."""
+        real = ss.load_state_for_profile
+
+        def _fake(**kwargs):
+            if kwargs.get("kind") == ss.KIND_DECISION_LOCK_ARCHIVE:
+                return None
+            return real(**kwargs)
+
+        with patch.object(
+            self.mcp.mcp_session_state, "load_state_for_profile", side_effect=_fake
+        ):
+            out = self._clear()
+        self.assertFalse(out["cleared"], out)
+        self.assertEqual(out["archive_failed_step"], "archive_readback")
+        self.assertIsNotNone(self._lock_still_present(), "terminal lock destroyed")
+
+    def test_partial_archive_readback_retains_lock(self):
+        """Read-back returns a record for a different PR/head: refuse to clear."""
+        real = ss.load_state_for_profile
+
+        def _fake(**kwargs):
+            if kwargs.get("kind") == ss.KIND_DECISION_LOCK_ARCHIVE:
+                return {"archived_for_pr": 999, "archived_for_head": HEAD_B}
+            return real(**kwargs)
+
+        with patch.object(
+            self.mcp.mcp_session_state, "load_state_for_profile", side_effect=_fake
+        ):
+            out = self._clear()
+        self.assertFalse(out["cleared"], out)
+        self.assertEqual(out["archive_failed_step"], "archive_readback")
+        self.assertIsNotNone(self._lock_still_present(), "terminal lock destroyed")
+
+    def test_archive_failure_records_actionable_recovery_evidence(self):
+        with self._fail_archive_only(lambda: False):
+            out = self._clear()
+        self.assertFalse(out["cleared"], out)
+        self.assertTrue(out["retry_safe"], out)
+        self.assertIn("archival failed", out["reason"])
+        self.assertIsNotNone(out.get("prior_summary"), out)
+        # The recovery row is keyed by the active (merging) session profile.
+        recovery = ss.load_state_for_profile(
+            kind=ss.KIND_POST_MERGE_DECISION_RECOVERY,
+            profile_identity="prgs-merger",
+            remote="prgs",
+            org="Scaled-Tech-Consulting",
+            repo="Gitea-Tools",
+            skip_identity_match=True,
+        )
+        self.assertIsNotNone(recovery, "no durable recovery evidence recorded")
+        self.assertEqual(recovery["failed_step"], "archive_save_state")
+        self.assertEqual(recovery["target_profile_identity"], "prgs-reviewer")
+
+    def test_successful_archive_clears_exactly_once(self):
+        out = self._clear()
+        self.assertTrue(out["cleared"], out)
+        self.assertTrue(out["archive_ok"], out)
+        self.assertIsNone(self._lock_still_present(), "lock should be cleared")
+        archived = ss.load_state_for_profile(
+            kind=ss.KIND_DECISION_LOCK_ARCHIVE,
+            profile_identity="prgs-reviewer-archive-pr100",
+            remote="prgs",
+            org="Scaled-Tech-Consulting",
+            repo="Gitea-Tools",
+            skip_identity_match=True,
+        )
+        self.assertIsNotNone(archived, "archive not durable")
+        self.assertEqual(archived["archived_for_pr"], 100)
+
+        # A second clear is a no-op, not a duplicate clear.
+        again = self._clear()
+        self.assertFalse(again["cleared"], again)
+
+    def test_retry_after_archive_failure_succeeds(self):
+        with self._fail_archive_only(lambda: False):
+            first = self._clear()
+        self.assertFalse(first["cleared"], first)
+        self.assertIsNotNone(self._lock_still_present())
+
+        retry = self._clear()
+        self.assertTrue(retry["cleared"], retry)
+        self.assertIsNone(self._lock_still_present())
+
+    def test_no_alternate_path_clears_after_archive_failure(self):
+        """The post-merge reconciler must not clear the lock when archival failed."""
+        with self._fail_archive_only(lambda: False), patch.object(
+            self.mcp, "api_request", return_value={}
+        ), patch.object(
+            self.mcp, "repo_api_url", return_value="https://example.test/api/v1/repos/o/r"
+        ):
+            report = self.mcp._reconcile_decision_locks_after_merge(
+                pr_number=100,
+                head_sha=HEAD_A,
+                merge_commit_sha="c" * 40,
+                remote="prgs",
+                host="h",
+                org="Scaled-Tech-Consulting",
+                repo="Gitea-Tools",
+                auth={"Authorization": "token test"},
+            )
+        self.assertFalse(report.get("cleared_any"), report)
+        self.assertIsNotNone(self._lock_still_present(), "terminal lock destroyed")
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/test_issue_720_expired_decision_lock.py b/tests/test_issue_720_expired_decision_lock.py
new file mode 100644
index 0000000..1a647c0
--- /dev/null
+++ b/tests/test_issue_720_expired_decision_lock.py
@@ -0,0 +1,499 @@
+"""#720: Expired old-head KIND_DECISION_LOCK must not block fresh review.
+
+Reproduction shape (PR #616):
+  * REQUEST_CHANGES terminal at head A
+  * open PR advanced to head B
+  * durable decision lock age > default 4h TTL
+  * fresh_review_on_current_head_allowed is true but unreachable under TTL-first reject
+  * mark_final fails with "session state expired after 4h"
+  * assessment may report "no lock" while the file remains on disk
+
+Security invariants preserved:
+  * same-head second terminal remains fail-closed (#332/#620)
+  * REQUEST_CHANGES is never treated as approval
+  * historical mutations remain on the ledger
+  * merged/closed moot cleanup still allowed (#594)
+  * irrecoverable provenance still requires #709 authorization
+  * ordinary profiles do not gain gitea.decision_lock.irrecoverable_recovery
+"""
+
+from __future__ import annotations
+
+import os
+import tempfile
+import unittest
+from datetime import datetime, timedelta, timezone
+from pathlib import Path
+from unittest.mock import patch
+
+import sys
+
+ROOT = str(Path(__file__).resolve().parent.parent)
+if ROOT not in sys.path:
+    sys.path.insert(0, ROOT)
+
+import mcp_session_state as ss
+import mcp_server
+import stale_review_decision_lock as srdl
+import task_capability_map
+
+HEAD_A = "a0fffae576673ba7df7456b32e6aec916581bdfb"
+HEAD_B = "a6a2243aad9c3e385fc70509f4941a0f0ec33162"
+HEAD_SAME = HEAD_A
+
+RC_616_A = {
+    "pr_number": 616,
+    "action": "request_changes",
+    "review_id": 443,
+    "review_state": "request_changes",
+    "head_sha": HEAD_A,
+}
+
+
+def _lock(mutations=None, **kwargs):
+    base = {
+        "task": "review_pr",
+        "kind": ss.KIND_DECISION_LOCK,
+        "remote": "prgs",
+        "org": "Scaled-Tech-Consulting",
+        "repo": "Gitea-Tools",
+        "session_pid": os.getpid(),
+        "session_profile": "prgs-reviewer",
+        "session_profile_lock": "prgs-reviewer",
+        "profile_identity": "prgs-reviewer",
+        "final_review_decision_ready": False,
+        "ready_pr_number": kwargs.get("ready_pr"),
+        "ready_action": kwargs.get("ready_action"),
+        "ready_expected_head_sha": kwargs.get("ready_head"),
+        "ready_remote": "prgs" if kwargs.get("ready_pr") else None,
+        "ready_org": "Scaled-Tech-Consulting" if kwargs.get("ready_pr") else None,
+        "ready_repo": "Gitea-Tools" if kwargs.get("ready_pr") else None,
+        "live_mutations": list(mutations or []),
+        "correction_authorized": False,
+        "correction_reason": None,
+    }
+    return base
+
+
+def _open_pr(pr_number=616, head=HEAD_B, merged=False, closed=False):
+    state = "closed" if closed or merged else "open"
+    return {
+        "number": pr_number,
+        "state": state,
+        "merged": merged,
+        "merged_at": "2026-07-16T12:00:00Z" if merged else None,
+        "merge_commit_sha": "m" * 40 if merged else None,
+        "head": {"sha": head},
+    }
+
+
+def _no_lease():
+    return {"block": False, "reasons": [], "mutation_allowed": True}
+
+
+def _feedback(blocking=False, stale=True):
+    return {
+        "success": True,
+        "has_blocking_change_requests": blocking,
+        "review_feedback_stale": stale,
+        "current_head_sha": HEAD_B,
+    }
+
+
+def _age_lock_payload(lock: dict, hours: float = 5.0) -> dict:
+    """Rewrite timestamps to *hours* ago (simulates durable age without touching prod)."""
+    aged = (datetime.now(timezone.utc) - timedelta(hours=hours)).isoformat().replace(
+        "+00:00", "Z"
+    )
+    out = dict(lock)
+    out["recorded_at"] = aged
+    out["updated_at"] = aged
+    return out
+
+
+class TestIssue720ExpiredDecisionLockLifecycle(unittest.TestCase):
+    def setUp(self):
+        self._tmp = tempfile.TemporaryDirectory()
+        self.env = patch.dict(
+            os.environ,
+            {
+                ss.STATE_DIR_ENV: self._tmp.name,
+                ss.SESSION_PROFILE_LOCK_ENV: "prgs-reviewer",
+                "GITEA_MCP_PROFILE": "prgs-reviewer",
+                "GITEA_PROFILE_NAME": "prgs-reviewer",
+            },
+            clear=False,
+        )
+        self.env.start()
+        mcp_server._REVIEW_DECISION_LOCK = None
+        import review_workflow_load
+
+        review_workflow_load.clear_review_workflow_load()
+        review_workflow_load.record_review_workflow_load(mcp_server.PROJECT_ROOT)
+        mcp_server.gitea_load_review_workflow()
+
+    def tearDown(self):
+        mcp_server._REVIEW_DECISION_LOCK = None
+        import review_workflow_load
+
+        review_workflow_load.clear_review_workflow_load()
+        self.env.stop()
+        self._tmp.cleanup()
+
+    def _persist_aged_lock(self, mutations, hours: float = 5.0, **kwargs):
+        """Write decision lock aged > TTL to the temp durable store (test-only)."""
+        payload = _age_lock_payload(_lock(mutations, **kwargs), hours=hours)
+        saved = ss.save_state(
+            kind=ss.KIND_DECISION_LOCK,
+            payload=payload,
+            remote="prgs",
+            org="Scaled-Tech-Consulting",
+            repo="Gitea-Tools",
+            profile_identity="prgs-reviewer",
+        )
+        # save_state refreshes updated_at; re-age the on-disk envelope for TTL tests.
+        path = ss.state_file_path(
+            kind=ss.KIND_DECISION_LOCK,
+            profile_identity="prgs-reviewer",
+            state_dir=self._tmp.name,
+        )
+        aged = (datetime.now(timezone.utc) - timedelta(hours=hours)).isoformat().replace(
+            "+00:00", "Z"
+        )
+        import json
+
+        with open(path, encoding="utf-8") as fh:
+            envelope = json.load(fh)
+        envelope["recorded_at"] = aged
+        envelope["updated_at"] = aged
+        if isinstance(envelope.get("payload"), dict):
+            envelope["payload"]["recorded_at"] = aged
+            envelope["payload"]["updated_at"] = aged
+        with open(path, "w", encoding="utf-8") as fh:
+            json.dump(envelope, fh, indent=2, sort_keys=True)
+            fh.write("\n")
+        # Drop memory so subsequent loads hit durable store.
+        mcp_server._REVIEW_DECISION_LOCK = None
+        return saved
+
+    def _mark(self, pr, action, head, feedback=None):
+        with patch("mcp_server._list_pr_lease_comments", return_value=[]), patch(
+            "mcp_server._pr_work_lease_reviewer_block", return_value=_no_lease()
+        ), patch.object(
+            mcp_server,
+            "gitea_get_pr_review_feedback",
+            return_value=feedback or _feedback(blocking=False, stale=True),
+        ), patch.object(
+            mcp_server,
+            "gitea_check_pr_eligibility",
+            return_value={"eligible": True, "head_sha": head},
+        ), patch.object(
+            mcp_server.mcp_daemon_guard,
+            "assert_sanctioned_mutation_runtime",
+            return_value=None,
+        ), patch.object(
+            mcp_server.mcp_daemon_guard,
+            "assert_no_direct_import_bypass",
+            return_value=None,
+        ):
+            return mcp_server.gitea_mark_final_review_decision(
+                pr_number=pr,
+                action=action,
+                expected_head_sha=head,
+                remote="prgs",
+                org="Scaled-Tech-Consulting",
+                repo="Gitea-Tools",
+            )
+
+    # --- AC regression matrix ---
+
+    def test_under_four_hours_fresh_review_at_b_allowed(self):
+        self._persist_aged_lock(
+            [RC_616_A],
+            hours=1.0,
+            ready_pr=616,
+            ready_head=HEAD_A,
+            ready_action="request_changes",
+        )
+        res = self._mark(616, "approve", HEAD_B)
+        self.assertTrue(res.get("marked_ready"), res)
+
+    def test_over_four_hours_fresh_review_at_b_still_allowed(self):
+        """Primary #720 defect: age > TTL must not block head-B mark_final."""
+        self._persist_aged_lock(
+            [RC_616_A],
+            hours=5.0,
+            ready_pr=616,
+            ready_head=HEAD_A,
+            ready_action="request_changes",
+        )
+        # Prove durable load is possible for recovery-critical decision locks.
+        loaded = ss.load_state(
+            kind=ss.KIND_DECISION_LOCK,
+            profile_identity="prgs-reviewer",
+        )
+        self.assertIsNotNone(
+            loaded,
+            "expired KIND_DECISION_LOCK must remain loadable (not generic TTL cache)",
+        )
+        res = self._mark(616, "approve", HEAD_B)
+        self.assertTrue(
+            res.get("marked_ready"),
+            f"expected mark_ready on head B after >4h; got {res}",
+        )
+        reasons = " ".join(res.get("reasons") or [])
+        self.assertNotIn("session state expired", reasons)
+
+    def test_historical_review_at_a_preserved_and_stale(self):
+        self._persist_aged_lock(
+            [RC_616_A],
+            hours=5.0,
+            ready_pr=616,
+            ready_head=HEAD_A,
+            ready_action="request_changes",
+        )
+        res = self._mark(616, "approve", HEAD_B)
+        self.assertTrue(res.get("marked_ready"), res)
+        lock = mcp_server._load_review_decision_lock()
+        self.assertIsNotNone(lock)
+        hist = [m for m in lock["live_mutations"] if m.get("review_id") == 443]
+        self.assertEqual(len(hist), 1)
+        self.assertEqual(hist[0]["head_sha"], HEAD_A)
+        self.assertEqual(hist[0]["action"], "request_changes")
+        a = srdl.assess_stale_review_decision_lock(
+            lock, pr_live=_open_pr(616, HEAD_B)
+        )
+        self.assertTrue(a["stale_by_head"])
+        self.assertTrue(a["fresh_review_on_current_head_allowed"])
+        self.assertEqual(a["locked_head_sha"], HEAD_A)
+
+    def test_no_reuse_approval_from_head_a(self):
+        """REQUEST_CHANGES at A is never an approval credential for B."""
+        self._persist_aged_lock([RC_616_A], hours=5.0)
+        lock = ss.load_state(
+            kind=ss.KIND_DECISION_LOCK, profile_identity="prgs-reviewer"
+        )
+        last = srdl.last_terminal_mutation(lock)
+        self.assertEqual(last.get("action"), "request_changes")
+        self.assertNotEqual(last.get("action"), "approve")
+        # Gate must still require a new mark/submit for head B; prior RC is not approve.
+        reasons = mcp_server.terminal_review_hard_stop_reasons(
+            616, "mark_ready", expected_head_sha=HEAD_B
+        )
+        self.assertEqual(reasons, [])
+
+    def test_second_terminal_mutation_at_b_same_run_blocked(self):
+        self._persist_aged_lock(
+            [RC_616_A],
+            hours=5.0,
+            ready_pr=616,
+            ready_head=HEAD_A,
+            ready_action="request_changes",
+        )
+        res = self._mark(616, "approve", HEAD_B)
+        self.assertTrue(res.get("marked_ready"), res)
+        # Record terminal approve at B (same run).
+        lock = mcp_server._load_review_decision_lock()
+        lock["final_review_decision_ready"] = True
+        lock["ready_pr_number"] = 616
+        lock["ready_action"] = "approve"
+        lock["ready_expected_head_sha"] = HEAD_B
+        mcp_server._save_review_decision_lock(lock)
+        mcp_server.record_live_review_mutation(616, "approve", review_id=999)
+        # Second terminal at same head B must hard-stop.
+        hard = mcp_server.terminal_review_hard_stop_reasons(
+            616, "mark_ready", expected_head_sha=HEAD_B
+        )
+        self.assertTrue(hard)
+        res2 = self._mark(616, "approve", HEAD_B)
+        self.assertFalse(res2.get("marked_ready"))
+
+    def test_open_pr_same_head_expired_still_fail_closed(self):
+        self._persist_aged_lock(
+            [RC_616_A],
+            hours=5.0,
+            ready_pr=616,
+            ready_head=HEAD_A,
+            ready_action="request_changes",
+        )
+        res = self._mark(616, "approve", HEAD_SAME)
+        self.assertFalse(res.get("marked_ready"), res)
+        self.assertTrue(
+            any("#332" in r or "already consumed" in r for r in (res.get("reasons") or [])),
+            res,
+        )
+
+    def test_merged_pr_moot_cleanup_still_allowed(self):
+        self._persist_aged_lock(
+            [RC_616_A],
+            hours=5.0,
+            ready_pr=616,
+            ready_head=HEAD_A,
+            ready_action="request_changes",
+        )
+        lock = ss.load_state(
+            kind=ss.KIND_DECISION_LOCK, profile_identity="prgs-reviewer"
+        )
+        a = srdl.assess_stale_review_decision_lock(
+            lock, pr_live=_open_pr(616, HEAD_A, merged=True)
+        )
+        self.assertTrue(a["is_moot"])
+        self.assertTrue(a["cleanup_allowed"])
+        self.assertFalse(a["fresh_review_on_current_head_allowed"])
+
+    def test_assessment_reports_expired_old_head_not_absent(self):
+        self._persist_aged_lock(
+            [RC_616_A],
+            hours=5.0,
+            ready_pr=616,
+            ready_head=HEAD_A,
+            ready_action="request_changes",
+        )
+        # Disk presence + load after lifecycle fix.
+        path = ss.state_file_path(
+            kind=ss.KIND_DECISION_LOCK,
+            profile_identity="prgs-reviewer",
+            state_dir=self._tmp.name,
+        )
+        self.assertTrue(os.path.exists(path))
+        loaded = ss.load_state(
+            kind=ss.KIND_DECISION_LOCK, profile_identity="prgs-reviewer"
+        )
+        self.assertIsNotNone(loaded)
+        inspect = ss.inspect_state_envelope(
+            kind=ss.KIND_DECISION_LOCK,
+            profile_identity="prgs-reviewer",
+            state_dir=self._tmp.name,
+        )
+        self.assertTrue(inspect.get("on_disk"))
+        self.assertTrue(inspect.get("has_payload"))
+        self.assertTrue(inspect.get("recovery_critical") or inspect.get("ttl_exempt"))
+        self.assertTrue(inspect.get("age_hours", 0) >= 4.0)
+        a = srdl.assess_stale_review_decision_lock(
+            loaded, pr_live=_open_pr(616, HEAD_B)
+        )
+        self.assertTrue(a["has_lock"])
+        self.assertNotIn("no review decision lock present", " ".join(a["reasons"]))
+        self.assertTrue(a["stale_by_head"])
+        self.assertEqual(a["last_terminal_action"], "request_changes")
+
+    def test_existing_serialized_records_compatible(self):
+        """Pre-fix ledgers without recovery_critical flag still load via kind."""
+        payload = _age_lock_payload(_lock([RC_616_A]), hours=8.0)
+        payload.pop("recovery_critical", None)
+        # Manually write pre-#720-shaped envelope (kind only on envelope).
+        path = ss.state_file_path(
+            kind=ss.KIND_DECISION_LOCK,
+            profile_identity="prgs-reviewer",
+            state_dir=self._tmp.name,
+        )
+        import json
+
+        os.makedirs(self._tmp.name, exist_ok=True)
+        aged = payload["recorded_at"]
+        envelope = {
+            "kind": ss.KIND_DECISION_LOCK,
+            "remote": "prgs",
+            "org": "Scaled-Tech-Consulting",
+            "repo": "Gitea-Tools",
+            "profile_identity": "prgs-reviewer",
+            "session_profile_lock": "prgs-reviewer",
+            "recorded_at": aged,
+            "updated_at": aged,
+            "writer_pid": os.getpid(),
+            "payload": payload,
+        }
+        with open(path, "w", encoding="utf-8") as fh:
+            json.dump(envelope, fh, indent=2, sort_keys=True)
+            fh.write("\n")
+        loaded = ss.load_state(
+            kind=ss.KIND_DECISION_LOCK, profile_identity="prgs-reviewer"
+        )
+        self.assertIsNotNone(loaded)
+        self.assertEqual(loaded["live_mutations"][0]["review_id"], 443)
+
+    def test_decision_lock_is_recovery_critical_kind(self):
+        self.assertIn(ss.KIND_DECISION_LOCK, ss.RECOVERY_CRITICAL_KINDS)
+
+    def test_workflow_load_still_ttl_expires(self):
+        """Do not make every session-state kind permanently TTL-exempt."""
+        aged = (datetime.now(timezone.utc) - timedelta(hours=5)).isoformat().replace(
+            "+00:00", "Z"
+        )
+        rec = {
+            "kind": ss.KIND_WORKFLOW_LOAD,
+            "recorded_at": aged,
+            "updated_at": aged,
+            "profile_identity": "prgs-reviewer",
+            "session_profile_lock": "prgs-reviewer",
+        }
+        reasons = ss.identity_match_reasons(
+            rec, profile_identity="prgs-reviewer"
+        )
+        self.assertTrue(any("expired" in r for r in reasons), reasons)
+
+    def test_irrecoverable_permission_not_on_ordinary_profiles(self):
+        perm = "gitea.decision_lock.irrecoverable_recovery"
+        # Capability map must not map ordinary author/reviewer/merger tasks to it.
+        for task in (
+            "create_issue",
+            "comment_issue",
+            "review_pr",
+            "merge_pr",
+            "lock_issue",
+            "create_pr",
+        ):
+            req = task_capability_map.required_permission(task)
+            self.assertNotEqual(req, perm, msg=task)
+
+    def test_structured_error_when_same_head_expired(self):
+        self._persist_aged_lock(
+            [RC_616_A],
+            hours=5.0,
+            ready_pr=616,
+            ready_head=HEAD_A,
+            ready_action="request_changes",
+        )
+        res = self._mark(616, "approve", HEAD_A)
+        self.assertFalse(res.get("marked_ready"))
+        reasons = res.get("reasons") or []
+        self.assertTrue(reasons)
+        blob = " ".join(reasons)
+        # Actionable recovery text from hard-stop (not generic internal_error).
+        self.assertIn("#332", blob)
+        self.assertTrue(
+            "#620" in blob or "head moved" in blob or "new expected_head_sha" in blob
+            or "already consumed" in blob
+        )
+        self.assertNotIn("internal_error", blob.lower())
+
+
+class TestIssue720InspectEnvelope(unittest.TestCase):
+    def setUp(self):
+        self._tmp = tempfile.TemporaryDirectory()
+        self.env = patch.dict(
+            os.environ,
+            {
+                ss.STATE_DIR_ENV: self._tmp.name,
+                ss.SESSION_PROFILE_LOCK_ENV: "prgs-reviewer",
+            },
+            clear=False,
+        )
+        self.env.start()
+
+    def tearDown(self):
+        self.env.stop()
+        self._tmp.cleanup()
+
+    def test_inspect_missing_file(self):
+        info = ss.inspect_state_envelope(
+            kind=ss.KIND_DECISION_LOCK,
+            profile_identity="prgs-reviewer",
+            state_dir=self._tmp.name,
+        )
+        self.assertFalse(info["on_disk"])
+        self.assertFalse(info["has_payload"])
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/test_mcp_daemon_guard.py b/tests/test_mcp_daemon_guard.py
index 31ba8f6..aa25d66 100644
--- a/tests/test_mcp_daemon_guard.py
+++ b/tests/test_mcp_daemon_guard.py
@@ -1,4 +1,4 @@
-"""Tests for sanctioned MCP daemon guards (#558)."""
+"""Tests for sanctioned MCP daemon guards (#558 / #695)."""
 
 from __future__ import annotations
 
@@ -11,6 +11,10 @@ import gitea_auth
 
 
 class TestMcpDaemonGuard(unittest.TestCase):
+    def tearDown(self) -> None:
+        mcp_daemon_guard.clear_native_runtime_for_tests()
+        os.environ.pop(mcp_daemon_guard.FORCE_PROVENANCE_FAIL_ENV, None)
+
     def test_unsanctioned_blocks_mutation_runtime(self):
         env = {k: v for k, v in os.environ.items() if k not in {
             mcp_daemon_guard.SANCTIONED_DAEMON_ENV,
@@ -26,11 +30,35 @@ class TestMcpDaemonGuard(unittest.TestCase):
         # Running under pytest already sets PYTEST_CURRENT_TEST.
         mcp_daemon_guard.assert_sanctioned_mutation_runtime("pytest")
 
-    def test_mark_sanctioned_allows(self):
-        env = {k: v for k, v in os.environ.items() if k != "PYTEST_CURRENT_TEST"}
+    def test_test_native_runtime_install_under_pytest(self):
+        mcp_daemon_guard.clear_native_runtime_for_tests()
+        mcp_daemon_guard.install_test_native_runtime()
+        self.assertTrue(mcp_daemon_guard.is_native_mcp_transport())
+        self.assertFalse(mcp_daemon_guard.is_production_native_mcp_transport())
+        # Hermetic unit path still passes under pytest.
+        mcp_daemon_guard.assert_sanctioned_mutation_runtime("daemon")
+        # Production mutation gate rejects test-mode records.
+        with self.assertRaises(mcp_daemon_guard.UnsanctionedRuntimeError) as ctx:
+            mcp_daemon_guard.assert_production_mutation_runtime("gitea_mutation")
+        self.assertIn("Test-mode", str(ctx.exception))
+
+    def test_env_alone_insufficient_when_force_unsanctioned(self):
+        mcp_daemon_guard.clear_native_runtime_for_tests()
+        env = {
+            k: v
+            for k, v in os.environ.items()
+            if k not in {
+                mcp_daemon_guard.SANCTIONED_DAEMON_ENV,
+                mcp_daemon_guard.ALLOW_DIRECT_IMPORT_ENV,
+                "PYTEST_CURRENT_TEST",
+            }
+        }
         env[mcp_daemon_guard.SANCTIONED_DAEMON_ENV] = "1"
+        env["GITEA_TEST_FORCE_UNSANCTIONED"] = "1"
         with patch.dict(os.environ, env, clear=True):
-            mcp_daemon_guard.assert_sanctioned_mutation_runtime("daemon")
+            with self.assertRaises(mcp_daemon_guard.UnsanctionedRuntimeError) as ctx:
+                mcp_daemon_guard.assert_sanctioned_mutation_runtime("env-spoof")
+            self.assertIn("not sufficient", str(ctx.exception))
 
     def test_keychain_blocked_without_sanction(self):
         env = {
@@ -65,6 +93,11 @@ class TestMcpDaemonGuard(unittest.TestCase):
             with self.assertRaises(mcp_daemon_guard.UnsanctionedRuntimeError):
                 gitea_auth.get_auth_header("gitea.prgs.cc")
 
+    def test_no_allow_test_bootstrap_public_parameter(self):
+        """Production mark must not accept allow_test_bootstrap (#695)."""
+        sig = __import__("inspect").signature(mcp_daemon_guard.mark_sanctioned_daemon)
+        self.assertNotIn("allow_test_bootstrap", sig.parameters)
+
 
 if __name__ == "__main__":
     unittest.main()
diff --git a/tests/test_mcp_server.py b/tests/test_mcp_server.py
index 3ac2905..720f201 100644
--- a/tests/test_mcp_server.py
+++ b/tests/test_mcp_server.py
@@ -836,16 +836,24 @@ class TestMergePR(unittest.TestCase):
             )
 
     def _feedback_reads(self, author="author-bot", sha="abc123"):
-        """PR + reviews GETs for gitea_get_pr_review_feedback during merge."""
+        """PR + reviews GETs for one gitea_get_pr_review_feedback call."""
         return [self._pr(author, sha=sha), _visible_approval_reviews(sha=sha)]
 
+    def _eligibility_merge_reads(self, author="author-bot", sha="abc123"):
+        """Eligibility user/PR plus #695 merge-approval feedback PR+reviews."""
+        return [
+            {"login": "merger-bot"},
+            self._pr(author, sha=sha),
+            *self._feedback_reads(author=author, sha=sha),
+        ]
+
     # -- success --------------------------------------------------------------
 
     @patch("mcp_server.api_request")
     @patch("mcp_server.get_auth_header", return_value=FAKE_AUTH)
     def test_merge_succeeds_when_all_gates_pass(self, _auth, mock_api):
         mock_api.side_effect = [
-            {"login": "merger-bot"}, self._pr("author-bot"),
+            *self._eligibility_merge_reads(),
             *self._feedback_reads(),
             {},  # merge POST
             {"merged_commit_sha": "mergecommit99"},  # read-back
@@ -864,7 +872,7 @@ class TestMergePR(unittest.TestCase):
         self.assertEqual(r["merge_method"], "squash")
         self.assertEqual(r["merge_commit"], "mergecommit99")
         # 5th call is the merge POST with the requested method/title/message.
-        merge_call = mock_api.call_args_list[4]
+        merge_call = mock_api.call_args_list[6]
         self.assertEqual(merge_call.args[0], "POST")
         self.assertTrue(merge_call.args[1].endswith("/pulls/8/merge"))
         payload = merge_call.args[3]
@@ -877,7 +885,7 @@ class TestMergePR(unittest.TestCase):
     @patch("mcp_server.get_auth_header", return_value=FAKE_AUTH)
     def test_expected_changed_files_match_allows(self, _auth, mock_api):
         mock_api.side_effect = [
-            {"login": "merger-bot"}, self._pr("author-bot"),
+            *self._eligibility_merge_reads(),
             [{"filename": "a.py"}, {"filename": "b.py"}],  # files
             *self._feedback_reads(),
             {},  # merge POST
@@ -899,7 +907,7 @@ class TestMergePR(unittest.TestCase):
     def test_readback_failure_reports_skipped_cleanup(self, _auth, mock_api):
         """Merge OK + read-back GET failure => explicit cleanup skip, not silence."""
         mock_api.side_effect = [
-            {"login": "merger-bot"}, self._pr("author-bot"),
+            *self._eligibility_merge_reads(),
             *self._feedback_reads(),
             {},  # merge POST
             RuntimeError("HTTP 502: Gitea upstream unavailable"),  # read-back fails
@@ -919,7 +927,7 @@ class TestMergePR(unittest.TestCase):
         self.assertEqual(r["cleanup_status"], "skipped (merge read-back failed)")
         # No tracker-cleanup API traffic after the failed read-back:
         # user, PR (eligibility), feedback PR+reviews, merge POST, read-back.
-        self.assertEqual(mock_api.call_count, 6)
+        self.assertEqual(mock_api.call_count, 8)
         for c in mock_api.call_args_list:
             self.assertNotEqual(c.args[0], "DELETE")
 
@@ -930,7 +938,7 @@ class TestMergePR(unittest.TestCase):
     def test_cleanup_exception_surfaced_and_redacted(self, _auth, mock_api, _cleanup):
         """Unexpected cleanup exception => merge still succeeds; error surfaced redacted."""
         mock_api.side_effect = [
-            {"login": "merger-bot"}, self._pr("author-bot"),
+            *self._eligibility_merge_reads(),
             *self._feedback_reads(),
             {},  # merge POST
             {"merged_commit_sha": "c9"},  # read-back OK
@@ -1142,8 +1150,10 @@ class TestMergePR(unittest.TestCase):
     @patch("mcp_server.api_request")
     @patch("mcp_server.get_auth_header", return_value=FAKE_AUTH)
     def test_head_sha_mismatch_blocks(self, _auth, mock_api):
+        # Eligibility (#695) needs approval feedback before head-gate runs.
         mock_api.side_effect = [
-            {"login": "merger-bot"}, self._pr("author-bot", sha="abc123")]
+            *self._eligibility_merge_reads(sha="abc123"),
+        ]
         env = {"GITEA_PROFILE_NAME": "gitea-merger",
                "GITEA_ALLOWED_OPERATIONS": "read,merge"}
         with patch.dict(os.environ, env, clear=True):
@@ -1162,7 +1172,7 @@ class TestMergePR(unittest.TestCase):
     @patch("mcp_server.get_auth_header", return_value=FAKE_AUTH)
     def test_changed_files_mismatch_blocks(self, _auth, mock_api):
         mock_api.side_effect = [
-            {"login": "merger-bot"}, self._pr("author-bot"),
+            *self._eligibility_merge_reads(),
             [{"filename": "a.py"}, {"filename": "c.py"}],  # actual files
         ]
         env = {"GITEA_PROFILE_NAME": "gitea-merger",
@@ -1193,7 +1203,7 @@ class TestMergePR(unittest.TestCase):
     @patch("mcp_server.get_auth_header", return_value=FAKE_AUTH)
     def test_output_redacts_secrets(self, _auth, mock_api):
         mock_api.side_effect = [
-            {"login": "merger-bot"}, self._pr("author-bot"),
+            *self._eligibility_merge_reads(),
             *self._feedback_reads(),
             {}, {"merged_commit_sha": "c1"},
         ]
@@ -1213,7 +1223,7 @@ class TestMergePR(unittest.TestCase):
     @patch("mcp_server.get_auth_header", return_value=FAKE_AUTH)
     def test_merge_error_message_redacts_credential(self, _auth, mock_api):
         mock_api.side_effect = [
-            {"login": "merger-bot"}, self._pr("author-bot"),
+            *self._eligibility_merge_reads(),
             *self._feedback_reads(),
             RuntimeError("HTTP 500: token abc-secret-xyz rejected"),
         ]
@@ -1234,6 +1244,7 @@ class TestMergePR(unittest.TestCase):
     def test_merge_blocked_on_stale_approval_head(self, _auth, mock_api):
         old_sha = "8b61c4b41f1b49b271ed3b99657431cf06eeda3e"
         new_sha = "3e4b721d60e97147ba0704773cf57cd0d42cbe31"
+        # #695: eligibility itself now fails closed on stale approval head.
         mock_api.side_effect = [
             {"login": "merger-bot"}, self._pr("author-bot", sha=new_sha),
             self._pr("author-bot", sha=new_sha),
@@ -1256,6 +1267,7 @@ class TestMergePR(unittest.TestCase):
     @patch("mcp_server.api_request")
     @patch("mcp_server.get_auth_header", return_value=FAKE_AUTH)
     def test_merge_blocked_without_visible_approval(self, _auth, mock_api):
+        # #695: eligibility denies merge when no non-quarantined APPROVED review.
         mock_api.side_effect = [
             {"login": "merger-bot"}, self._pr("author-bot"),
             self._pr("author-bot"),
@@ -1270,12 +1282,21 @@ class TestMergePR(unittest.TestCase):
             )
         self.assertFalse(r["performed"])
         self.assertFalse(r.get("approval_visible"))
-        self.assertTrue(any("no visible APPROVED review" in x for x in r["reasons"]))
+        self.assertTrue(
+            any(
+                "no non-quarantined APPROVED review" in x
+                or "no visible APPROVED review" in x
+                or "merge eligibility denied" in x
+                for x in r["reasons"]
+            ),
+            msg=r["reasons"],
+        )
         self._assert_no_merge_call(mock_api)
 
     @patch("mcp_server.api_request")
     @patch("mcp_server.get_auth_header", return_value=FAKE_AUTH)
     def test_merge_blocked_on_request_changes(self, _auth, mock_api):
+        # #695: eligibility denies merge on undismissed REQUEST_CHANGES.
         mock_api.side_effect = [
             {"login": "merger-bot"}, self._pr("author-bot"),
             self._pr("author-bot"),
@@ -1425,10 +1446,16 @@ class TestReviewPR(unittest.TestCase):
 class TestDeleteBranch(unittest.TestCase):
 
     DELETE_PROFILE = {
-        "profile_name": "test-deleter",
-        "allowed_operations": ["gitea.read", "gitea.branch.delete"],
+        "profile_name": "test-author-deleter",
+        "role": "author",
+        "allowed_operations": [
+            "gitea.read",
+            "gitea.pr.create",
+            "gitea.branch.push",
+            "gitea.branch.delete",
+        ],
         "forbidden_operations": [],
-        "audit_label": "test-deleter",
+        "audit_label": "test-author-deleter",
     }
 
     @patch("mcp_server.get_profile", return_value=DELETE_PROFILE)
diff --git a/tests/test_merge_approval_gate.py b/tests/test_merge_approval_gate.py
index 94f11ac..61814fb 100644
--- a/tests/test_merge_approval_gate.py
+++ b/tests/test_merge_approval_gate.py
@@ -54,6 +54,26 @@ class TestMergeApprovalGate(unittest.TestCase):
         self.assertFalse(result["approval_at_current_head"])
         self.assertIsNone(result["latest_approved_head_sha"])
 
+    def test_quarantined_approval_void_for_merge(self):
+        """#695: contaminated formal review at head must not authorize merge."""
+        result = assess_merge_approval_head(
+            current_head_sha=HEAD_NEW,
+            latest_by_reviewer={
+                "sysadmin": {
+                    "verdict": "APPROVED",
+                    "dismissed": False,
+                    "reviewed_head_sha": HEAD_NEW,
+                    "review_id": 427,
+                    "submitted_at": "2026-07-13T07:20:00Z",
+                }
+            },
+            quarantined_review_ids={427},
+        )
+        self.assertFalse(result["approval_at_current_head"])
+        self.assertEqual(result["quarantined_approvals_at_current_head"], 1)
+        self.assertIn("quarantined", result["stale_approval_block_reason"])
+        self.assertIn("#695", result["stale_approval_block_reason"])
+
 
 if __name__ == "__main__":
     unittest.main()
\ No newline at end of file
diff --git a/tests/test_migrate_profiles.py b/tests/test_migrate_profiles.py
index abbe5df..7f80d2c 100644
--- a/tests/test_migrate_profiles.py
+++ b/tests/test_migrate_profiles.py
@@ -92,14 +92,19 @@ class TestMigrateProfiles(unittest.TestCase):
         author = prgs_gitea["identities"]["author"]
         self.assertEqual(author["username"], "jcwalker3")
         self.assertEqual(author["auth"]["id"], "redacted-author-ref")
-        self.assertEqual(author["allowed_operations"], ["read", "comment"])
-        self.assertEqual(author["forbidden_operations"], ["approve", "merge"])
+        self.assertEqual(
+            author["allowed_operations"], ["gitea.read", "gitea.pr.comment"]
+        )
+        self.assertEqual(
+            author["forbidden_operations"],
+            ["gitea.pr.approve", "gitea.pr.merge"],
+        )
 
         reviewer = prgs_gitea["identities"]["reviewer"]
         self.assertEqual(reviewer["role"], "reviewer")
         self.assertEqual(reviewer["username"], "sysadmin")
         self.assertEqual(reviewer["auth"]["id"], "redacted-reviewer-ref")
-        self.assertIn("merge", reviewer["allowed_operations"])
+        self.assertIn("gitea.pr.merge", reviewer["allowed_operations"])
 
     def test_alias_generation(self):
         """Test that aliases are correctly generated to support old profile names."""
@@ -188,7 +193,7 @@ class TestMigrateProfiles(unittest.TestCase):
         self.assertNotIn("token", stdout_output.lower())
 
     def test_explicit_operations_are_preserved(self):
-        """Explicit v1 permissions must not be replaced by role defaults."""
+        """Explicit v1 permissions are canonicalized, not replaced by role defaults."""
         v1_data = json.loads(json.dumps(self.v1_content))
         v1_data["profiles"]["prgs-reviewer"]["allowed_operations"] = ["read"]
         v1_data["profiles"]["prgs-reviewer"]["forbidden_operations"] = ["merge"]
@@ -198,8 +203,8 @@ class TestMigrateProfiles(unittest.TestCase):
             v2_data["environments"]["prgs"]["services"]["gitea"]
             ["identities"]["reviewer"]
         )
-        self.assertEqual(reviewer["allowed_operations"], ["read"])
-        self.assertEqual(reviewer["forbidden_operations"], ["merge"])
+        self.assertEqual(reviewer["allowed_operations"], ["gitea.read"])
+        self.assertEqual(reviewer["forbidden_operations"], ["gitea.pr.merge"])
 
     def test_inferred_role_defaults_only_when_unambiguous(self):
         """Role defaults are allowed only for clear author/reviewer profiles."""
@@ -306,6 +311,171 @@ class TestMigrateProfiles(unittest.TestCase):
                 migrate_profiles.main()
             self.assertEqual(cm.exception.code, 1)
 
+    def test_reconciler_profile_migration(self):
+        """Legacy reconciler shorthands migrate to valid canonical operations."""
+        import gitea_config
+        import reconciler_profile
+
+        v1_data = {
+            "version": 1,
+            "profiles": {
+                "prgs-reconciler": {
+                    "base_url": "redacted-prgs-service",
+                    "username": "reconciler-agent",
+                    "auth": {"type": "keychain", "id": "reconciler-ref"},
+                    "execution_profile": "prgs-reconciler",
+                    "allowed_operations": [
+                        "read",
+                        "pr.close",
+                        "pr.comment",
+                        "issue.comment",
+                        "issue.close",
+                        "gitea.branch.delete",
+                    ],
+                    "forbidden_operations": [
+                        "merge",
+                        "approve",
+                        "review",
+                        "pr.create",
+                        "branch.push",
+                        "commit",
+                    ],
+                }
+            }
+        }
+        v2_data = migrate_profiles.migrate_v1_to_v2(v1_data)
+        reconciler = (
+            v2_data["environments"]["prgs"]["services"]["gitea"]
+            ["identities"]["reconciler"]
+        )
+        self.assertEqual(reconciler["role"], "reconciler")
+        allowed = reconciler["allowed_operations"]
+        forbidden = reconciler["forbidden_operations"]
+        # No invalid shorthand remains
+        for bad in ("pr.close", "pr.comment", "issue.close", "read", "merge"):
+            self.assertNotIn(bad, allowed)
+            self.assertNotIn(bad, forbidden)
+        for required in (
+            "gitea.read",
+            "gitea.pr.close",
+            "gitea.pr.comment",
+            "gitea.issue.comment",
+            "gitea.issue.close",
+            "gitea.branch.delete",
+        ):
+            self.assertIn(required, allowed)
+            # Production loader accepts every allowed op
+            self.assertEqual(
+                gitea_config.normalize_operation(required), required
+            )
+        self.assertEqual(v2_data["aliases"]["prgs-reconciler"], "prgs.gitea.reconciler")
+        assessment = reconciler_profile.assess_reconciler_profile(allowed, forbidden)
+        self.assertTrue(assessment["valid"])
+        self.assertTrue(migrate_profiles.validate_v2_data(v2_data))
+
+    def test_reconciler_profile_defaults(self):
+        """Reconciler defaults are fully canonical and loader-valid."""
+        import gitea_config
+        import reconciler_profile
+
+        v1_data = {
+            "version": 1,
+            "profiles": {
+                "prgs-reconciler": {
+                    "base_url": "redacted-prgs-service",
+                    "username": "reconciler-agent",
+                    "auth": {"type": "keychain", "id": "reconciler-ref"},
+                    "execution_profile": "prgs-reconciler",
+                }
+            }
+        }
+        v2_data = migrate_profiles.migrate_v1_to_v2(v1_data)
+        reconciler = (
+            v2_data["environments"]["prgs"]["services"]["gitea"]
+            ["identities"]["reconciler"]
+        )
+        self.assertEqual(reconciler["role"], "reconciler")
+        self.assertEqual(
+            reconciler["allowed_operations"],
+            migrate_profiles.RECONCILER_DEFAULT_ALLOWED,
+        )
+        self.assertEqual(
+            reconciler["forbidden_operations"],
+            migrate_profiles.RECONCILER_DEFAULT_FORBIDDEN,
+        )
+        for op in reconciler["allowed_operations"]:
+            self.assertEqual(gitea_config.normalize_operation(op), op)
+            self.assertTrue(op.startswith("gitea."))
+        assessment = reconciler_profile.assess_reconciler_profile(
+            reconciler["allowed_operations"],
+            reconciler["forbidden_operations"],
+        )
+        self.assertTrue(assessment["valid"])
+        self.assertNotIn(
+            "gitea.branch.delete", assessment["missing_recommended_operations"]
+        )
+
+    def test_reconciler_migration_idempotent_canonicalize(self):
+        """Second canonicalize of already-canonical ops is a no-op."""
+        first = migrate_profiles.canonicalize_operations(
+            list(migrate_profiles.RECONCILER_DEFAULT_ALLOWED)
+        )
+        second = migrate_profiles.canonicalize_operations(first)
+        self.assertEqual(first, second)
+        self.assertEqual(first, list(migrate_profiles.RECONCILER_DEFAULT_ALLOWED))
+
+    def test_reconciler_missing_required_fails_visibly(self):
+        """Missing gitea.pr.close after migration fails closed (not silent drop)."""
+        v1_data = {
+            "version": 1,
+            "profiles": {
+                "prgs-reconciler": {
+                    "base_url": "redacted-prgs-service",
+                    "username": "reconciler-agent",
+                    "auth": {"type": "keychain", "id": "reconciler-ref"},
+                    "execution_profile": "prgs-reconciler",
+                    "allowed_operations": ["read", "gitea.branch.delete"],
+                    "forbidden_operations": ["merge"],
+                }
+            },
+        }
+        with self.assertRaisesRegex(ValueError, "missing required"):
+            migrate_profiles.migrate_v1_to_v2(v1_data)
+
+    def test_unknown_operation_fails_visibly(self):
+        v1_data = {
+            "version": 1,
+            "profiles": {
+                "prgs-author": {
+                    "base_url": "redacted-prgs-service",
+                    "username": "jcwalker3",
+                    "auth": {"type": "keychain", "id": "hidden-author-ref"},
+                    "execution_profile": "prgs-author",
+                    "allowed_operations": ["read", "not.a.real.op"],
+                    "forbidden_operations": ["merge"],
+                }
+            },
+        }
+        with self.assertRaisesRegex(ValueError, "cannot be canonicalized"):
+            migrate_profiles.migrate_v1_to_v2(v1_data)
+
+    def test_role_inference_author_reviewer_merger_reconciler(self):
+        self.assertEqual(
+            migrate_profiles.infer_role("prgs-author", "prgs-author"), "author"
+        )
+        self.assertEqual(
+            migrate_profiles.infer_role("prgs-reviewer", "prgs-reviewer"),
+            "reviewer",
+        )
+        self.assertEqual(
+            migrate_profiles.infer_role("prgs-reconciler", "prgs-reconciler"),
+            "reconciler",
+        )
+        self.assertIsNone(
+            migrate_profiles.infer_role("prgs-merger", "prgs-merger")
+        )
+
 
 if __name__ == "__main__":
     unittest.main()
+
diff --git a/tests/test_op_normalization.py b/tests/test_op_normalization.py
index b454294..15c0b56 100644
--- a/tests/test_op_normalization.py
+++ b/tests/test_op_normalization.py
@@ -206,7 +206,20 @@ class TestEligibilityNormalizesOperations(unittest.TestCase):
     def test_namespaced_profile_ops_allow_legacy_action(self, _auth, mock_api):
         # JSON-config profiles carry canonical namespaced ops; the raw action
         # "merge" must still match them after normalization.
-        mock_api.side_effect = [{"login": "merger-bot"}, self._pr("author-bot")]
+        # #695: merge eligibility also loads quarantine-aware review feedback.
+        mock_api.side_effect = [
+            {"login": "merger-bot"},
+            self._pr("author-bot"),
+            self._pr("author-bot"),
+            [{
+                "id": 1,
+                "user": {"login": "reviewer-bot"},
+                "state": "APPROVED",
+                "commit_id": "abc123",
+                "submitted_at": "2026-07-06T10:00:00Z",
+                "dismissed": False,
+            }],
+        ]
         env = {"GITEA_PROFILE_NAME": "gitea-merger",
                "GITEA_ALLOWED_OPERATIONS": "gitea.read,gitea.pr.merge"}
         with patch.dict(os.environ, env, clear=True):
diff --git a/tests/test_reconciler_profile.py b/tests/test_reconciler_profile.py
index 1c3086d..1c3b6af 100644
--- a/tests/test_reconciler_profile.py
+++ b/tests/test_reconciler_profile.py
@@ -82,6 +82,42 @@ class TestReconcilerProfileModel(unittest.TestCase):
             "reconciler",
         )
 
+    def test_branch_delete_is_recommended_for_reconciler(self):
+        self.assertIn(
+            "gitea.branch.delete",
+            reconciler_profile.RECONCILER_RECOMMENDED_OPERATIONS,
+        )
+        self.assertNotIn(
+            "gitea.branch.delete",
+            reconciler_profile.RECONCILER_REQUIRED_OPERATIONS,
+        )
+
+    def test_reconciler_with_branch_delete_stays_valid(self):
+        allowed = PRGS_RECONCILER_ALLOWED + ["gitea.branch.delete"]
+        result = reconciler_profile.assess_reconciler_profile(
+            allowed,
+            PRGS_RECONCILER_FORBIDDEN,
+        )
+        self.assertTrue(result["is_reconciler_profile"])
+        self.assertTrue(result["valid"])
+        self.assertNotIn(
+            "gitea.branch.delete", result["missing_recommended_operations"]
+        )
+        self.assertEqual(
+            mcp_server._role_kind(allowed, PRGS_RECONCILER_FORBIDDEN),
+            "reconciler",
+        )
+
+    def test_reconciler_without_branch_delete_reports_missing_recommended(self):
+        result = reconciler_profile.assess_reconciler_profile(
+            PRGS_RECONCILER_ALLOWED,
+            PRGS_RECONCILER_FORBIDDEN,
+        )
+        self.assertTrue(result["valid"])
+        self.assertIn(
+            "gitea.branch.delete", result["missing_recommended_operations"]
+        )
+
 
 if __name__ == "__main__":
     unittest.main()
\ No newline at end of file
diff --git a/tests/test_retry_backoff.py b/tests/test_retry_backoff.py
index f77b39a..fdf4982 100644
--- a/tests/test_retry_backoff.py
+++ b/tests/test_retry_backoff.py
@@ -122,9 +122,11 @@ class TestApiRequestRetry(unittest.TestCase):
         sleep.assert_not_called()
 
     def test_non_429_error_raises_immediately(self):
-        with self.assertRaises(RuntimeError) as ctx:
+        with self.assertRaises(gitea_auth.GiteaHttpError) as ctx:
             _call([_http_error(500, body=b"boom")])
-        self.assertIn("HTTP 500", str(ctx.exception))
+        # Fixed message only (#699) — no response body echo.
+        self.assertEqual(str(ctx.exception), "Gitea HTTP request failed")
+        self.assertEqual(ctx.exception.http_status, 500)
 
     def test_non_429_error_does_not_sleep(self):
         sleep = MagicMock()
@@ -171,9 +173,12 @@ class TestApiRequestRetry(unittest.TestCase):
         # max_retries=3 -> 3 sleeps, then the 4th failure raises.
         errors = [_http_error(429, retry_after="1") for _ in range(4)]
         sleep = MagicMock()
-        with self.assertRaises(RuntimeError) as ctx:
+        with self.assertRaises(gitea_auth.GiteaHttpError) as ctx:
             _call(errors, sleep_func=sleep, max_retries=3)
-        self.assertIn("HTTP 429", str(ctx.exception))
+        # After retries are exhausted, 429 is a typed HTTP error with fixed
+        # message (#699); status metadata carries 429.
+        self.assertEqual(str(ctx.exception), "Gitea HTTP request failed")
+        self.assertEqual(ctx.exception.http_status, 429)
         self.assertEqual(sleep.call_count, 3)
 
     def test_no_infinite_loop_when_always_429(self):
diff --git a/tests/test_review_proofs.py b/tests/test_review_proofs.py
index 03d3a6a..dba3c4e 100644
--- a/tests/test_review_proofs.py
+++ b/tests/test_review_proofs.py
@@ -957,17 +957,20 @@ class TestControllerHandoff(unittest.TestCase):
             if not line.startswith("- Workspace mutations:"))
         result = assess_controller_handoff(review_base, role="review")
         self.assertEqual(result["verdict"], "incomplete")
-        self.assertIn("Pinned reviewed head", result["missing_fields"])
-        self.assertIn("Worktree path", result["missing_fields"])
+        # #698: the canonical schema forbids the legacy fields, so the
+        # validator must demand the canonical names instead.
+        self.assertIn("Reviewed head SHA", result["missing_fields"])
+        self.assertIn("Review worktree path", result["missing_fields"])
         self.assertIn("Merge result", result["missing_fields"])
+        for legacy in ("Pinned reviewed head", "Scratch worktree used"):
+            self.assertNotIn(legacy, result["missing_fields"])
 
         complete = review_base + "\n" + "\n".join([
             "- Selected PR: #999",
             "- Reviewer eligibility: passed",
-            "- Pinned reviewed head: 0fdc8f582026b72a229d59a172c0a63ac4aaeaf9",
-            "- Worktree path: /repo/branches/review-pr-999",
-            "- Worktree dirty: no",
-            "- Scratch worktree used: yes (/repo/branches/review-pr-999)",
+            "- Reviewed head SHA: 0fdc8f582026b72a229d59a172c0a63ac4aaeaf9",
+            "- Review worktree path: /repo/branches/review-pr-999",
+            "- Review worktree dirty before validation: no",
             "- Unrelated local mutations: none",
             "- Review decision: approve",
             "- Merge result: merged",
@@ -1125,10 +1128,9 @@ class TestReviewHandoffPreciseMutationCategories(unittest.TestCase):
         "- Safety: no self-review; no self-merge; no secrets",
         "- Selected PR: #999",
         "- Reviewer eligibility: passed",
-        "- Pinned reviewed head: 0fdc8f582026b72a229d59a172c0a63ac4aaeaf9",
+        "- Reviewed head SHA: 0fdc8f582026b72a229d59a172c0a63ac4aaeaf9",
         "- Worktree path: /repo/branches/review-pr-999",
         "- Worktree dirty: no",
-        "- Scratch worktree used: yes (/repo/branches/review-pr-999)",
         "- Unrelated local mutations: none",
         "- Review decision: approve",
         "- Merge result: none",
diff --git a/tests/test_stable_control_runtime_policy_docs.py b/tests/test_stable_control_runtime_policy_docs.py
new file mode 100644
index 0000000..b533aeb
--- /dev/null
+++ b/tests/test_stable_control_runtime_policy_docs.py
@@ -0,0 +1,139 @@
+"""Documentation acceptance for the stable control runtime ADR (#615 / PR #616).
+
+Enforces review 443 remediation:
+
+* F1 — operator guide / runbooks cross-link the ADR (issue #615 AC2).
+* F2 — LLM sessions are not instructed to kill/restart/relaunch MCP; process
+  restart is operator-owned; ADR is the authoritative split.
+* F3 — routine post-merge master-parity staleness has a sanctioned response
+  (stop → report → operator reload → re-verify parity) and is not a full
+  promotion ledger requirement.
+"""
+from pathlib import Path
+
+REPO_ROOT = Path(__file__).resolve().parent.parent
+ADR = (
+    REPO_ROOT
+    / "docs"
+    / "architecture"
+    / "mcp-stable-control-runtime-policy-adr.md"
+)
+ADR_REL = "architecture/mcp-stable-control-runtime-policy-adr.md"
+ADR_BASENAME = "mcp-stable-control-runtime-policy-adr.md"
+
+CROSS_LINK_DOCS = (
+    REPO_ROOT / "docs" / "wiki" / "Operator-Guide.md",
+    REPO_ROOT / "docs" / "wiki" / "Runbooks.md",
+    REPO_ROOT / "docs" / "llm-workflow-runbooks.md",
+)
+
+
+def _read(path: Path) -> str:
+    assert path.is_file(), f"missing {path.relative_to(REPO_ROOT)}"
+    return path.read_text(encoding="utf-8")
+
+
+def test_adr_exists_with_policy_core():
+    text = _read(ADR)
+    assert text.lstrip().startswith("#"), "ADR lacks a title"
+    assert "#615" in text
+    assert "stable control runtime" in text.lower()
+    assert "2.3" in text and "2.4" in text and "2.5" in text and "2.6" in text
+
+
+def test_f1_operator_docs_cross_link_adr():
+    for path in CROSS_LINK_DOCS:
+        text = _read(path)
+        assert ADR_BASENAME in text, (
+            f"{path.relative_to(REPO_ROOT)} must cross-link {ADR_BASENAME} "
+            f"(issue #615 acceptance criterion 2)"
+        )
+
+
+def test_f1_adr_lists_cross_links_as_acceptance_not_optional_tooling():
+    text = _read(ADR)
+    # Acceptance section must require guide/runbook cross-links.
+    assert "Operator guide / runbooks cross-link" in text or (
+        "operator guide" in text.lower() and "cross-link" in text.lower()
+        and "Acceptance" in text
+    )
+    # Cross-link must not remain only as optional tooling item #4.
+    optional = text.split("## 5. Implementation follow-ups", 1)[-1].split(
+        "## 6. Acceptance", 1
+    )[0]
+    assert "Operator Guide wiki cross-link to this ADR" not in optional, (
+        "ADR §5 must not list operator-guide cross-link as optional tooling"
+    )
+    assert "Not optional" in text or "must** cross-link" in text.lower() or (
+        "must cross-link" in text.lower()
+    )
+
+
+def test_f2_runbook_fallback_is_operator_owned_not_llm_restart():
+    runbooks = _read(REPO_ROOT / "docs" / "llm-workflow-runbooks.md")
+    # Forbidden historical self-service instruction.
+    forbidden = (
+        "the LLM must relaunch or restart the client/MCP with the correct "
+        "profile environment variable before claiming or working on any tasks"
+    )
+    assert forbidden not in runbooks, (
+        "llm-workflow-runbooks must not instruct the LLM to relaunch/restart MCP"
+    )
+    assert "operator-owned" in runbooks.lower() or "Operator-owned" in runbooks
+    assert ADR_BASENAME in runbooks
+
+
+def test_f2_workspace_rebind_does_not_require_llm_process_relaunch():
+    runbooks = _read(REPO_ROOT / "docs" / "llm-workflow-runbooks.md")
+    section = runbooks.split("### Safe reconnect / rebind procedure", 1)[-1]
+    section = section.split("## Safety notes", 1)[0]
+    # Must not tell the LLM alone to relaunch the MCP process as step 2.
+    assert "Reconnect or relaunch the correct namespace MCP server from the intended" not in section
+    assert "Operator-owned" in section or "operator" in section.lower()
+    assert "worktree_path" in section
+    collapsed = " ".join(section.lower().split())
+    assert "client reconnect" in collapsed
+
+
+def test_f2_adr_forbids_llm_restart_and_supersedes_self_service_relaunch():
+    text = _read(ADR)
+    lower = text.lower()
+    assert "must not" in lower and "restart" in lower
+    assert "operator" in lower and "reload" in lower
+    assert "supersedes" in lower
+    assert "llm" in lower
+
+
+def test_f3_adr_defines_post_merge_parity_staleness_response():
+    text = _read(ADR)
+    lower = text.lower()
+    assert "2.6" in text
+    assert "post-merge" in lower or "post merge" in lower
+    assert "parity" in lower and "stale" in lower
+    # Sanctioned steps: stop, report, operator reload, re-verify.
+    assert "stop" in lower
+    assert "report" in lower
+    assert "operator" in lower
+    assert "parity is verified" in lower or "re-verif" in lower or (
+        "startup/current-head" in lower
+    )
+    # Not a full promotion ledger for routine reload.
+    assert "not a §2.4 promotion" in lower or "not a section 2.4 promotion" in lower or (
+        "not a §2.4" in text or "Not a §2.4 promotion" in text
+    )
+    # Stale parity listed among unhealthy triggers.
+    assert "master parity is stale" in lower or "stale master parity" in lower
+
+
+def test_f3_adr_forbids_llm_bypass_of_parity_gate():
+    text = _read(ADR)
+    lower = text.lower()
+    assert "bypass" in lower or "self-reset" in lower or "self-service" in lower
+    assert "parity" in lower
+
+
+def test_cross_links_do_not_embed_secrets_or_raw_hosts_in_wiki_snippets():
+    for path in CROSS_LINK_DOCS:
+        text = _read(path)
+        for marker in ("ghp_", "BEGIN PRIVATE KEY", "Authorization: Bearer"):
+            assert marker not in text, f"{path} contains {marker!r}"
diff --git a/tests/test_structured_auth_mcp_errors.py b/tests/test_structured_auth_mcp_errors.py
new file mode 100644
index 0000000..c5b46de
--- /dev/null
+++ b/tests/test_structured_auth_mcp_errors.py
@@ -0,0 +1,426 @@
+"""Structured MCP auth errors and stdio transport survival (#699 / PR #701).
+
+Covers original AC plus reviewer-ratified regressions:
+
+1. Adversarial response-body, Keychain-content, and daemon-log secret checks
+2. Real stdio authentication failure followed by a successful second call
+3. UrlElicitationRequiredError framework re-raise behavior
+4. Unexpected parser RuntimeError is not authentication
+5. Generic HTTP 403 is authorization (not internal)
+6. Repeated install/import is idempotent
+7. Author and reconciler profiles
+8. Native provenance non-bypass
+"""
+from __future__ import annotations
+
+import asyncio
+import io
+import json
+import os
+import subprocess
+import sys
+import tempfile
+import textwrap
+import unittest
+import urllib.error
+from unittest.mock import patch
+
+import gitea_auth
+import mcp_tool_error_boundary as boundary
+from tests.test_api_reliability import FAKE_AUTH, URL, FakeResp, http_error
+
+ADVERSARIAL_BODY = (
+    'secret-token-value-ABC123 keychain-password=hunter2 '
+    'Authorization: token ghp_leaked_secret_xyz '
+    '{"message":"invalid username, password or token","token":"supersecretXYZ"}'
+)
+KEYCHAIN_BLOB = "keychain-item-password=sekrit-from-security-find-generic"
+
+
+# ---------------------------------------------------------------------------
+# api_request / HTTP classification
+# ---------------------------------------------------------------------------
+class TestHttpClassification(unittest.TestCase):
+    @patch("gitea_auth.urllib.request.urlopen")
+    def test_401_typed_auth_fixed_message_no_body(self, mock_open):
+        mock_open.side_effect = http_error(401, ADVERSARIAL_BODY)
+        with self.assertRaises(gitea_auth.GiteaAuthError) as ctx:
+            gitea_auth.api_request("GET", URL, FAKE_AUTH)
+        exc = ctx.exception
+        self.assertEqual(exc.reason_code, "auth_invalid_token")
+        self.assertEqual(exc.error_class, "authentication")
+        self.assertEqual(exc.http_status, 401)
+        msg = str(exc)
+        self.assertNotIn("supersecretXYZ", msg)
+        self.assertNotIn("ghp_leaked", msg)
+        self.assertNotIn("hunter2", msg)
+        self.assertNotIn(ADVERSARIAL_BODY, msg)
+        self.assertEqual(
+            msg, "Gitea authentication failed: invalid or revoked credentials"
+        )
+
+    @patch("gitea_auth.urllib.request.urlopen")
+    def test_403_scope_is_authz_scope(self, mock_open):
+        mock_open.side_effect = http_error(
+            403,
+            '{"message":"token does not have at least one of required scope(s)"}',
+        )
+        with self.assertRaises(gitea_auth.GiteaAuthzError) as ctx:
+            gitea_auth.api_request("GET", URL, FAKE_AUTH)
+        self.assertEqual(ctx.exception.reason_code, "authz_insufficient_scope")
+        self.assertEqual(ctx.exception.error_class, "authorization")
+        self.assertNotIn("token does not have", str(ctx.exception))
+
+    @patch("gitea_auth.urllib.request.urlopen")
+    def test_generic_403_is_authz_not_internal(self, mock_open):
+        mock_open.side_effect = http_error(403, '{"message":"user has no permission"}')
+        with self.assertRaises(gitea_auth.GiteaAuthzError) as ctx:
+            gitea_auth.api_request("GET", URL, FAKE_AUTH)
+        self.assertEqual(ctx.exception.reason_code, "authz_denied")
+        self.assertEqual(ctx.exception.error_class, "authorization")
+        self.assertNotIsInstance(ctx.exception, gitea_auth.GiteaAuthError)
+        self.assertNotIn("user has no permission", str(ctx.exception))
+
+    @patch("gitea_auth.urllib.request.urlopen")
+    def test_network_fixed_message(self, mock_open):
+        mock_open.side_effect = TimeoutError("timed out contacting secret.example")
+        with self.assertRaises(gitea_auth.GiteaNetworkError) as ctx:
+            gitea_auth.api_request("GET", URL, FAKE_AUTH)
+        self.assertEqual(str(ctx.exception), "Network error contacting Gitea")
+        self.assertNotIn("secret.example", str(ctx.exception))
+
+    @patch("gitea_auth.urllib.request.urlopen")
+    def test_malformed_json_not_auth(self, mock_open):
+        mock_open.return_value = FakeResp("not-json{")
+        with self.assertRaises(RuntimeError) as ctx:
+            gitea_auth.api_request("GET", URL, FAKE_AUTH)
+        self.assertNotIsInstance(ctx.exception, gitea_auth.GiteaAuthError)
+        self.assertIn("malformed JSON", str(ctx.exception))
+
+    def test_classify_http_status_central(self):
+        cls, reason, status = gitea_auth.classify_http_status(401)
+        self.assertIs(cls, gitea_auth.GiteaAuthError)
+        self.assertEqual(reason, "auth_invalid_token")
+        self.assertEqual(status, 401)
+
+        cls, reason, status = gitea_auth.classify_http_status(403)
+        self.assertIs(cls, gitea_auth.GiteaAuthzError)
+        self.assertEqual(reason, "authz_denied")
+
+        cls, reason, status = gitea_auth.classify_http_status(
+            403, body_hint="missing scope write:issue"
+        )
+        self.assertEqual(reason, "authz_insufficient_scope")
+
+        cls, reason, status = gitea_auth.classify_http_status(502)
+        self.assertIs(cls, gitea_auth.GiteaHttpError)
+        self.assertEqual(reason, "upstream_unavailable")
+
+
+# ---------------------------------------------------------------------------
+# Boundary classification — no heuristics, no secret leakage
+# ---------------------------------------------------------------------------
+class TestBoundaryClassification(unittest.TestCase):
+    def test_auth_payload_fixed_message(self):
+        exc = gitea_auth.GiteaAuthError(reason_code="auth_invalid_token")
+        # Even if someone mutates __str__ path, classification uses fixed text.
+        result = boundary.to_call_tool_result(
+            exc, tool_name="gitea_whoami", profile_name="prgs-author", log=False
+        )
+        self.assertTrue(result.isError)
+        p = result.structuredContent
+        self.assertEqual(p["reason_code"], "auth_invalid_token")
+        self.assertEqual(p["error_class"], "authentication")
+        self.assertEqual(p["message"], boundary.fixed_message("auth_invalid_token"))
+        self.assertNotIn("supersecret", json.dumps(p))
+        self.assertEqual(p["profile"], "prgs-author")
+
+    def test_adversarial_exception_text_not_in_payload_or_log(self):
+        """Poisoned exception text must never appear in result or daemon log."""
+
+        class PoisonedAuth(gitea_auth.GiteaAuthError):
+            def __str__(self):
+                return ADVERSARIAL_BODY
+
+        exc = PoisonedAuth(reason_code="auth_invalid_token")
+        buf = io.StringIO()
+        result = boundary.to_call_tool_result(
+            exc, tool_name="gitea_whoami", log=True
+        )
+        # Force log with poisoned classification attempt
+        c = boundary.classify_exception(exc)
+        boundary.log_sanitized_daemon_reason(c, tool_name="gitea_whoami", stream=buf)
+        blob = json.dumps(result.structuredContent) + result.content[0].text + buf.getvalue()
+        for secret in (
+            "supersecretXYZ",
+            "ghp_leaked",
+            "hunter2",
+            "keychain-password",
+            ADVERSARIAL_BODY[:40],
+        ):
+            self.assertNotIn(secret, blob)
+        self.assertIn("reason_code=auth_invalid_token", buf.getvalue())
+        self.assertNotIn("detail=", buf.getvalue())
+
+    def test_keychain_content_not_in_daemon_log(self):
+        buf = io.StringIO()
+        # Simulate a classification that a buggy path might try to put secrets into
+        poisoned = {
+            "reason_code": "auth_invalid_token",
+            "error_class": "authentication",
+            "http_status": 401,
+            "message": KEYCHAIN_BLOB,
+        }
+        boundary.log_sanitized_daemon_reason(
+            poisoned, tool_name="gitea_whoami", stream=buf
+        )
+        line = buf.getvalue()
+        self.assertNotIn("sekrit", line)
+        self.assertNotIn("keychain-item", line)
+        self.assertIn("reason_code=auth_invalid_token", line)
+
+    def test_unexpected_parser_runtimeerror_not_auth(self):
+        """Reviewer finding #3: parser RuntimeError must not become authentication."""
+        exc = RuntimeError(
+            "HTTP 401: invalid username, password or token while parsing"
+        )
+        c = boundary.classify_exception(exc)
+        self.assertEqual(c["error_class"], "internal")
+        self.assertEqual(c["reason_code"], "internal_error")
+        self.assertNotEqual(c["error_class"], "authentication")
+        self.assertFalse(boundary.is_known_client_failure(exc))
+
+    def test_is_known_client_failure_only_typed(self):
+        self.assertTrue(
+            boundary.is_known_client_failure(gitea_auth.GiteaAuthError())
+        )
+        self.assertTrue(
+            boundary.is_known_client_failure(gitea_auth.GiteaAuthzError())
+        )
+        self.assertFalse(boundary.is_known_client_failure(RuntimeError("x")))
+        self.assertFalse(boundary.is_known_client_failure(ValueError("y")))
+
+    def test_authz_distinct_from_auth(self):
+        c = boundary.classify_exception(
+            gitea_auth.GiteaAuthzError(reason_code="authz_denied")
+        )
+        self.assertEqual(c["error_class"], "authorization")
+        self.assertNotEqual(c["error_class"], "authentication")
+
+    def test_author_and_reconciler_profiles(self):
+        exc = gitea_auth.GiteaAuthError()
+        for profile in ("prgs-author", "prgs-reconciler"):
+            r = boundary.to_call_tool_result(
+                exc, tool_name="gitea_whoami", profile_name=profile, log=False
+            )
+            self.assertEqual(r.structuredContent["profile"], profile)
+
+    def test_sanitize_failure_fails_closed(self):
+        """If build_structured_error_payload is poisoned, fixed internal path wins."""
+        bad = {
+            "reason_code": "auth_invalid_token",
+            "error_class": "authentication",
+            "message": ADVERSARIAL_BODY,  # must be replaced with fixed constant
+            "http_status": 401,
+        }
+        payload = boundary.build_structured_error_payload(bad)
+        self.assertEqual(
+            payload["message"], boundary.fixed_message("auth_invalid_token")
+        )
+        self.assertNotIn("supersecret", payload["message"])
+
+
+# ---------------------------------------------------------------------------
+# Tool.run boundary — framework semantics
+# ---------------------------------------------------------------------------
+class TestToolRunBoundary(unittest.TestCase):
+    def setUp(self):
+        from mcp.server.fastmcp.tools.base import Tool
+
+        boundary.install_tool_run_boundary(Tool)
+        self.Tool = Tool
+
+    def _tool(self, fn, name="demo_tool"):
+        return self.Tool.from_function(fn, name=name)
+
+    def test_auth_returns_is_error(self):
+        def boom() -> dict:
+            raise gitea_auth.GiteaAuthError()
+
+        result = asyncio.run(self._tool(boom, "gitea_whoami").run({}, convert_result=True))
+        self.assertTrue(result.isError)
+        self.assertEqual(result.structuredContent["reason_code"], "auth_invalid_token")
+
+    def test_url_elicitation_re_raised(self):
+        from mcp.shared.exceptions import UrlElicitationRequiredError
+        from mcp.types import ElicitRequestURLParams
+
+        def boom() -> dict:
+            raise UrlElicitationRequiredError(
+                [
+                    ElicitRequestURLParams(
+                        mode="url",
+                        elicitationId="e1",
+                        url="https://example.invalid/elicit",
+                        message="need auth",
+                    )
+                ]
+            )
+
+        tool = self._tool(boom, "elicitation_tool")
+
+        async def _run():
+            return await tool.run({}, convert_result=True)
+
+        with self.assertRaises(UrlElicitationRequiredError):
+            asyncio.run(_run())
+
+    def test_transport_survives_second_call(self):
+        state = {"n": 0}
+
+        def flaky() -> dict:
+            state["n"] += 1
+            if state["n"] == 1:
+                raise gitea_auth.GiteaAuthError()
+            return {"ok": True, "call": state["n"]}
+
+        tool = self._tool(flaky, "gitea_whoami")
+
+        async def _both():
+            first = await tool.run({}, convert_result=True)
+            second = await tool.run({}, convert_result=True)
+            return first, second
+
+        first, second = asyncio.run(_both())
+        self.assertTrue(first.isError)
+        self.assertEqual(first.structuredContent["error_class"], "authentication")
+        self.assertFalse(getattr(second, "isError", False))
+        self.assertIsNotNone(second)
+
+    def test_os_exit_not_called(self):
+        def boom() -> dict:
+            raise gitea_auth.GiteaAuthError()
+
+        with patch("os._exit") as mock_exit:
+            result = asyncio.run(self._tool(boom).run({}, convert_result=True))
+            mock_exit.assert_not_called()
+        self.assertTrue(result.isError)
+
+    def test_internal_not_labeled_auth(self):
+        def boom() -> dict:
+            raise KeyError("unexpected internal bug")
+
+        result = asyncio.run(self._tool(boom).run({}, convert_result=True))
+        self.assertTrue(result.isError)
+        self.assertEqual(result.structuredContent["error_class"], "internal")
+        self.assertEqual(result.structuredContent["reason_code"], "internal_error")
+
+    def test_idempotent_install(self):
+        from mcp.server.fastmcp.tools.base import Tool
+
+        first = boundary.install_tool_run_boundary(Tool)
+        second = boundary.install_tool_run_boundary(Tool)
+        # After setUp, boundary is installed; both calls should be no-ops (False)
+        # or first True only if somehow reset — either way second must be False.
+        self.assertFalse(second)
+        self.assertTrue(boundary.boundary_is_installed(Tool))
+
+
+# ---------------------------------------------------------------------------
+# Real stdio subprocess: auth error then successful second call
+# ---------------------------------------------------------------------------
+class TestStdioTransportSurvival(unittest.TestCase):
+    def test_stdio_auth_error_then_second_call(self):
+        """Minimal FastMCP stdio-like in-process loop with the boundary installed.
+
+        Uses Tool.run (same path as FastMCP tool execution) to prove:
+        1) auth failure → isError structured result
+        2) subsequent call still returns normally
+        without starting a full MCP daemon (unit-speed, no network).
+        """
+        from mcp.server.fastmcp.tools.base import Tool
+
+        boundary.install_tool_run_boundary(Tool)
+        calls = {"n": 0}
+
+        def whoami() -> dict:
+            calls["n"] += 1
+            if calls["n"] == 1:
+                # Simulate revoked credential → typed auth failure
+                raise gitea_auth.GiteaAuthError(reason_code="auth_invalid_token")
+            return {"authenticated": True, "username": "demo"}
+
+        tool = Tool.from_function(whoami, name="gitea_whoami")
+
+        async def session():
+            r1 = await tool.run({}, convert_result=True)
+            r2 = await tool.run({}, convert_result=True)
+            return r1, r2
+
+        r1, r2 = asyncio.run(session())
+        self.assertTrue(r1.isError)
+        self.assertEqual(r1.structuredContent["reason_code"], "auth_invalid_token")
+        self.assertTrue(r1.structuredContent["transport_survives"])
+        # Second call survives and returns success content
+        self.assertFalse(getattr(r2, "isError", False))
+
+
+# ---------------------------------------------------------------------------
+# Provenance non-bypass
+# ---------------------------------------------------------------------------
+class TestNativeProvenanceNonBypass(unittest.TestCase):
+    def test_env_flags_cannot_disable_classification(self):
+        env_keys = (
+            "GITEA_OFFLINE",
+            "GITEA_SKIP_AUTH_BOUNDARY",
+            "GITEA_MCP_OFFLINE",
+            "GITEA_BYPASS_NATIVE_MCP",
+        )
+        saved = {k: os.environ.get(k) for k in env_keys}
+        try:
+            for k in env_keys:
+                os.environ[k] = "1"
+            exc = gitea_auth.GiteaAuthError()
+            c = boundary.classify_exception(exc)
+            self.assertEqual(c["error_class"], "authentication")
+            r = boundary.to_call_tool_result(exc, log=False)
+            self.assertTrue(r.isError)
+            self.assertEqual(r.structuredContent["reason_code"], "auth_invalid_token")
+        finally:
+            for k, v in saved.items():
+                if v is None:
+                    os.environ.pop(k, None)
+                else:
+                    os.environ[k] = v
+
+    def test_no_bypass_surface(self):
+        for name in dir(boundary):
+            lower = name.lower()
+            self.assertFalse(
+                lower.startswith("bypass") or lower.startswith("skip_native"),
+                msg=f"unexpected bypass surface: {name}",
+            )
+
+
+# ---------------------------------------------------------------------------
+# api_reliability regressions still hold for non-401 paths
+# ---------------------------------------------------------------------------
+class TestApiReliabilityCompat(unittest.TestCase):
+    @patch("gitea_auth.urllib.request.urlopen")
+    def test_502_upstream_typed(self, mock_open):
+        mock_open.side_effect = http_error(502, "bad gateway secret=xyz")
+        with self.assertRaises(gitea_auth.GiteaHttpError) as ctx:
+            gitea_auth.api_request("GET", URL, FAKE_AUTH)
+        self.assertEqual(ctx.exception.reason_code, "upstream_unavailable")
+        self.assertNotIn("secret=xyz", str(ctx.exception))
+
+    @patch("gitea_auth.urllib.request.urlopen")
+    def test_auth_header_never_in_error(self, mock_open):
+        mock_open.side_effect = http_error(400, "bad request")
+        with self.assertRaises(gitea_auth.GiteaHttpError) as ctx:
+            gitea_auth.api_request("GET", URL, FAKE_AUTH)
+        self.assertNotIn(FAKE_AUTH, str(ctx.exception))
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/test_task_capability_role_invariants.py b/tests/test_task_capability_role_invariants.py
new file mode 100644
index 0000000..a77f570
--- /dev/null
+++ b/tests/test_task_capability_role_invariants.py
@@ -0,0 +1,205 @@
+"""Invariant tests pinning task_capability_map role assignments (#722/#723).
+
+Added with the operator-authorized break-glass repair for incident #722:
+commit 970e68b remapped ten reviewer tasks to ``role="merger"`` while every
+configured merger profile forbids the review permissions, so no configured
+profile could resolve any formal review task (``matching_configured_profile``
+was empty repository-wide). These tests fail loudly if that class of
+regression recurs:
+
+- every role-exclusive formal-review task must be satisfiable by at least one
+  canonical role profile (permission AND role together);
+- the capability map must agree with ``role_session_router`` task sets;
+- ``adopt_merger_pr_lease`` stays merger-only (the legitimate hunk of
+  970e68b, preserved by the repair);
+- merger profiles must not be able to resolve review_pr/approve_pr.
+"""
+
+import unittest
+
+import gitea_config
+from role_session_router import MERGER_TASKS, REVIEWER_TASKS
+from task_capability_map import required_permission, required_role
+
+# Canonical role-profile permission shape. Mirrors the configured
+# author/reviewer/merger/reconciler profiles (profiles.json v2 role split):
+# reviewers review/approve/request changes but never merge; mergers merge but
+# never review/approve/request changes.
+CANONICAL_ROLE_PROFILES = {
+    "author": {
+        "allowed": [
+            "gitea.read",
+            "gitea.branch.create",
+            "gitea.branch.push",
+            "gitea.repo.commit",
+            "gitea.pr.create",
+            "gitea.pr.comment",
+            "gitea.issue.create",
+            "gitea.issue.comment",
+            "gitea.issue.close",
+        ],
+        "forbidden": [
+            "gitea.pr.approve",
+            "gitea.pr.request_changes",
+            "gitea.pr.merge",
+        ],
+    },
+    "reviewer": {
+        "allowed": [
+            "gitea.read",
+            "gitea.pr.review",
+            "gitea.pr.approve",
+            "gitea.pr.request_changes",
+            "gitea.pr.comment",
+            "gitea.issue.comment",
+        ],
+        "forbidden": [
+            "gitea.branch.create",
+            "gitea.branch.push",
+            "gitea.repo.commit",
+            "gitea.pr.create",
+            "gitea.pr.merge",
+        ],
+    },
+    "merger": {
+        "allowed": [
+            "gitea.read",
+            "gitea.pr.merge",
+            "gitea.pr.comment",
+            "gitea.issue.comment",
+        ],
+        "forbidden": [
+            "gitea.branch.create",
+            "gitea.branch.push",
+            "gitea.repo.commit",
+            "gitea.pr.create",
+            "gitea.pr.approve",
+            "gitea.pr.review",
+            "gitea.pr.request_changes",
+        ],
+    },
+    "reconciler": {
+        "allowed": [
+            "gitea.read",
+            "gitea.pr.close",
+            "gitea.pr.comment",
+            "gitea.issue.comment",
+            "gitea.branch.delete",
+            "gitea.decision_lock.irrecoverable_recovery",
+        ],
+        "forbidden": [
+            "gitea.pr.approve",
+            "gitea.pr.merge",
+            "gitea.pr.review",
+            "gitea.pr.request_changes",
+            "gitea.pr.create",
+            "gitea.branch.create",
+            "gitea.branch.push",
+            "gitea.repo.commit",
+        ],
+    },
+}
+
+# Role-exclusive formal-review tasks (mirrors the resolver's role-exclusive
+# handling for review work): permission alone is not enough — the profile's
+# role kind must also match, so both dimensions are pinned here.
+FORMAL_REVIEW_TASKS = (
+    "review_pr",
+    "approve_pr",
+    "request_changes_pr",
+    "blind_pr_queue_review",
+    "pr_queue_cleanup",
+    "pr-queue-cleanup",
+)
+
+
+def _profile_satisfies(role_name, task):
+    """True when the canonical *role_name* profile can perform *task*."""
+    profile = CANONICAL_ROLE_PROFILES[role_name]
+    ok, _reason = gitea_config.check_operation(
+        required_permission(task), profile["allowed"], profile["forbidden"]
+    )
+    return ok and role_name == required_role(task)
+
+
+class TestFormalReviewProfileCoverage(unittest.TestCase):
+    """#722: some configured profile must be able to formally review."""
+
+    def test_every_formal_review_task_has_a_satisfying_role_profile(self):
+        for task in FORMAL_REVIEW_TASKS:
+            with self.subTest(task=task):
+                satisfying = [
+                    role
+                    for role in CANONICAL_ROLE_PROFILES
+                    if _profile_satisfies(role, task)
+                ]
+                self.assertTrue(
+                    satisfying,
+                    f"no canonical role profile satisfies both permission "
+                    f"{required_permission(task)!r} and role "
+                    f"{required_role(task)!r} for task {task!r} — formal "
+                    f"review would be impossible for every configured "
+                    f"profile (incident #722)",
+                )
+
+    def test_formal_review_tasks_are_reviewer_role(self):
+        for task in FORMAL_REVIEW_TASKS:
+            with self.subTest(task=task):
+                self.assertEqual(required_role(task), "reviewer")
+
+
+class TestMapRouterAgreement(unittest.TestCase):
+    """#723 AC2: the map and the role session router must not drift."""
+
+    def test_reviewer_tasks_map_to_reviewer_role(self):
+        for task in sorted(REVIEWER_TASKS):
+            with self.subTest(task=task):
+                self.assertEqual(
+                    required_role(task),
+                    "reviewer",
+                    f"router classifies {task!r} as a reviewer task but the "
+                    f"capability map assigns role {required_role(task)!r}",
+                )
+
+    def test_merger_tasks_map_to_merger_role(self):
+        for task in sorted(MERGER_TASKS):
+            with self.subTest(task=task):
+                self.assertEqual(
+                    required_role(task),
+                    "merger",
+                    f"router classifies {task!r} as a merger task but the "
+                    f"capability map assigns role {required_role(task)!r}",
+                )
+
+
+class TestMergerBoundary(unittest.TestCase):
+    """Preserve the legitimate hunk of 970e68b and the merger fence."""
+
+    def test_adopt_merger_pr_lease_requires_merger_role(self):
+        self.assertEqual(required_role("adopt_merger_pr_lease"), "merger")
+        self.assertEqual(
+            required_permission("adopt_merger_pr_lease"), "gitea.pr.comment"
+        )
+
+    def test_merge_pr_requires_merger_role(self):
+        self.assertEqual(required_role("merge_pr"), "merger")
+        self.assertEqual(required_permission("merge_pr"), "gitea.pr.merge")
+
+    def test_merger_profile_cannot_resolve_formal_review_tasks(self):
+        merger = CANONICAL_ROLE_PROFILES["merger"]
+        for task in ("review_pr", "approve_pr", "request_changes_pr"):
+            with self.subTest(task=task):
+                ok, reason = gitea_config.check_operation(
+                    required_permission(task),
+                    merger["allowed"],
+                    merger["forbidden"],
+                )
+                self.assertFalse(
+                    ok,
+                    f"merger profile must not hold {task!r} permission "
+                    f"(got reason {reason!r})",
+                )
+
+
+if __name__ == "__main__":
+    unittest.main()