diff --git a/.github/workflows/auto-merge-dev.yml b/.github/workflows/auto-merge-dev.yml
index 6824fa94..52319d0c 100644
--- a/.github/workflows/auto-merge-dev.yml
+++ b/.github/workflows/auto-merge-dev.yml
@@ -3,21 +3,51 @@ name: Auto Merge Dev PR
 on:
   pull_request_target:
     branches: ["dev"]
-    types: [opened, reopened, synchronize, ready_for_review]
+    types: [opened, reopened, synchronize, ready_for_review, closed]
 
 permissions:
   contents: write
   pull-requests: write
+  actions: write
 
 jobs:
   enable-auto-merge:
-    if: github.event.pull_request.draft == false && github.event.pull_request.head.repo.full_name == github.repository
+    if: >
+      github.event.action != 'closed'
+      && github.event.pull_request.draft == false
+      && github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ubuntu-latest
     steps:
       - name: Enable auto-merge for dev PR
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           PR_NUMBER: ${{ github.event.pull_request.number }}
+          PR_TITLE: ${{ github.event.pull_request.title }}
         run: |
           set -euo pipefail
-          gh pr merge "${PR_NUMBER}" --auto --squash --repo "${GITHUB_REPOSITORY}"
+          # Preserve origin/main as a git ancestor when syncing main into
+          # dev. Squash would drop that topology and AGENTS.md conflicts
+          # again on the next dev → main promotion.
+          if [[ "${PR_TITLE}" == "Merge main into"* ]] \
+            || [[ "${PR_TITLE}" == "Merge origin/main"* ]]; then
+            gh pr merge "${PR_NUMBER}" --auto --merge --repo "${GITHUB_REPOSITORY}"
+          else
+            gh pr merge "${PR_NUMBER}" --auto --squash --repo "${GITHUB_REPOSITORY}"
+          fi
+
+  dispatch-deploy-dev:
+    if: >
+      github.event.action == 'closed'
+      && github.event.pull_request.merged == true
+      && github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: ubuntu-latest
+    steps:
+      - name: Dispatch Deploy Dev after GITHUB_TOKEN merge
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          # Pushes from GITHUB_TOKEN do not trigger on.push workflows.
+          # Promotion to main requires a successful active "dev"
+          # environment deployment, so kick Deploy Dev explicitly.
+          gh workflow run deploy-dev.yml --ref dev --repo "${GITHUB_REPOSITORY}"
diff --git a/.github/workflows/record-dev-deployment.yml b/.github/workflows/record-dev-deployment.yml
deleted file mode 100644
index b4709894..00000000
--- a/.github/workflows/record-dev-deployment.yml
+++ /dev/null
@@ -1,54 +0,0 @@
-name: Record Dev Deployment
-
-# Branch protection on `dev` requires a successful active GitHub
-# environment deployment named "dev" before a PR can merge. The real
-# cluster workflow (Deploy Dev) only runs after code is already on
-# `dev`, so feature PRs deadlock. This job records a transient GitHub
-# deployment for the PR head SHA; kube deploy still happens via
-# Deploy Dev after merge.
-on:
-  pull_request:
-    branches: [dev]
-    types: [opened, synchronize, reopened, ready_for_review]
-
-permissions:
-  contents: read
-  deployments: write
-
-jobs:
-  record-dev-deployment:
-    name: Record dev environment
-    if: github.event.pull_request.head.repo.full_name == github.repository
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    steps:
-      - name: Record successful GitHub deployment for PR head
-        uses: actions/github-script@v7
-        with:
-          script: |
-            const ref = context.payload.pull_request.head.sha;
-            const prNumber = context.payload.pull_request.number;
-            const { data: deployment } = await github.rest.repos.createDeployment({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              ref,
-              environment: "dev",
-              auto_merge: false,
-              required_contexts: [],
-              transient_environment: true,
-              production_environment: false,
-              description: `PR #${prNumber} head for required "dev" environment`,
-            });
-            if (!deployment || !deployment.id) {
-              core.setFailed(`createDeployment did not return an id: ${JSON.stringify(deployment)}`);
-              return;
-            }
-            await github.rest.repos.createDeploymentStatus({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              deployment_id: deployment.id,
-              state: "success",
-              environment: "dev",
-              description: "Recorded for branch protection; cluster deploy still runs via Deploy Dev after merge",
-            });
-            core.info(`Recorded success deployment ${deployment.id} for ${ref}`);