fix(refinery): funnel direct→pr auto-promote through the single mr PR surface (tk-kcr8v6)

[zook-bot]

Summary

Problem

When direct push to a protected branch is rejected (GH013), the refinery's
auto-promote path at formulas/mol-refinery-patrol.toml:411-423 flips
MERGE_STRATEGY=mr and is supposed to fall through to the mr block — but in
practice the refinery agent has skipped the gate twice in a row.

Live evidence

2026-05-25:

• PR feat(refinery): wire default_merge_strategy var into mol-refinery-patrol (tk-sma1xw) #68 (tk-sma1xw) — opened non-draft, no codex review bead dispatched.
• PR feat(cycle-recycle): switch to input_tokens >= 200K trigger (tk-d8jhjb) #69 (tk-d8jhjb) — opened non-draft, no codex review bead dispatched.

Both close reasons: "auto-promoted direct→pr (main protected, GH013); PR
#NN opened with rebased branch ff to origin/main".

Operator caught both on 2026-05-25, recovered by drafting the PRs and
hand-filing review beads (tk-m76f0h, tk-26oacb) routed to
gc-toolkit/gc-toolkit.polecat-codex.

Root cause

The formula's prose at line 416 says:

# Fall through to the "If MERGE_STRATEGY = 'mr'" block below.

And at line 426-428:

**If `$MERGE_STRATEGY` was just flipped to `mr` (auto-promotion fired),
skip steps 2-5 below and execute the "If MERGE_STRATEGY = 'mr'" block
instead. The rebased `temp` branch is still available for the PR push.**

This is correct prose, but the gate steps (lines 525-528 setting
PR_DRAFT_FLAG, lines 621-644 dispatching the codex review bead) live ~110
lines downstream and across two visually-similar shell blocks. The agent
has skipped them on both auto-promote firings — apparently shortcutting
to gh pr create + close once the rebased branch is pushed and the PR
URL is in hand.

Proposed fix (one of)

A. Inline the gate at the auto-promote site. Move the draft-flag check
and the review-bead dispatch into the auto-promote stanza itself so
the fall-through doesn't have to traverse the whole mr block. The mr
block keeps its existing logic for the bead-metadata=mr case.

B. Restructure so steps 2-5 of mr are the only PR-creation surface.
The auto-promote stanza becomes "set MERGE_STRATEGY=mr, reset hard,
GOTO mr-step-1" with no PR creation outside the mr block. Cleaner, but
requires the prose to be unambiguous that the auto-promote case must
re-enter the mr flow at step 1 (push), not at step 2 (create PR), since
the rebased branch hasn't been pushed yet.

B is the cleaner architecture (single source of truth for PR creation);
A is the lower-risk patch. Pick one based on appetite.

Acceptance criteria

• A new refinery pour that hits GH013 on direct push opens its PR as draft
  AND files a codex review bead with the standard metadata (task_kind=review,
  pr_url, pr_number, work_bead, fix_target_pool, gc.routed_to).
• The review_gate=codex default still gates the auto-promote path; setting
  review_gate="" (empty) disables it parallel to the mr path.
• Regression coverage: a test or rehearsal exercising the auto-promote
  branch confirms both gate steps fire.

Implementation notes

Implemented: funnel direct→pr auto-promote through the single mr PR-creation surface (Option B). Auto-promote arm only flips MERGE_STRATEGY=mr and resets; direct-success tail (verify/close/cleanup/auto-ff) guarded with [ "$MERGE_STRATEGY" = "direct" ] so it no-ops after promotion (no false merged-close, temp survives for the PR). Added regression doctor check check-refinery-autopromote-review-gate (passes on fix, fails on pre-fix). All 6 pack doctor checks pass; TOML + bash -n valid. Branch polecat/tk-kcr8v6, target main.

Refinery handoff

• Issue: tk-kcr8v6
• Source branch: polecat/tk-kcr8v6 → Target: main
• Rebased clean on main (ff); auto-promoted direct→pr (GH013 protected main).
• Validation: all 6 pack doctor checks pass on the fix; the new check-refinery-autopromote-review-gate fails on pre-fix main (confirmed discriminating); TOML + bash -n valid.

[zook-bot]

No blocking findings.

Validation performed:

• Reviewed the formula control-flow changes and the new static doctor check.
• gc formula show mol-refinery-patrol --json parsed successfully.
• bash -n doctor/check-refinery-autopromote-review-gate/run.sh passed.
• GC_PACK_DIR=. ./doctor/check-refinery-autopromote-review-gate/run.sh passed on this branch.
• All six doctor/*/run.sh checks passed with GC_PACK_DIR=..
• The new doctor check fails against origin/main with the expected unguarded direct-close finding, so it discriminates the regression.
• GitHub reports no branch checks for this PR.

[zook-bot]

Back to draft to flag follow-up (operator, 2026-06-05). The formula control-flow fix is sound — auto-promote arm only flips strategy; direct-success tail guarded with [ "$MERGE_STRATEGY" = "direct" ]; single mr PR-creation surface. Keep that.

The follow-up is the 258-line awk doctor check: it pins the exact textual structure of the merge-push bash (if/else depth, guard strings) and will false-positive on any future refactor — it polices the prose, not the behavior. The gate also being enforced in formula prose (an LLM following a 110-line fall-through) is why the bypass happened (#68/#69). Rework options: (a) replace the check with a behavioral post-condition (after merge-push, assert: protected-branch PR ⇒ draft AND review bead exists), or (b) push the invariant into gc's refinery logic (gascity bead). Do not merge until the check is reworked or dropped.