[finding] Governed Surface Queue Guard: the merge_group leg installs no dependencies, so the #11705 generated-surface lift NEVER applies at queue time — pure-regeneration PRs still need a human APPROVED review; the trade needs a ruling #12874

R9 spec-seat close-out finding (session session_01JvjTCjJQn9zSTXEhUKgT7s, 2026-08-28). Recording only — unassigned. This is a decision-needing mismatch between two mechanisms that both claim to answer "is this diff governed": it should be graded toward a maintainer ruling, not silently fixed either way.

The mismatch, measured on PR #12718

• Seat-side predicate: node scripts/pm/check-governed-merges.mjs --test <paths> on feat(spec): retire preview mode — the RuntimeMode 'preview' value and the whole PreviewModeConfig block #12718's tree, with dependencies installed, exits 0 — "NOT governed — PURE REGENERATION": the touched skills/objectstack-platform/references/_index.md is byte-equal to a fresh gen:skill-refs recompute, which is exactly the [finding] skills/*/references/_index.md is generator-owned (gen:skill-refs) yet sits inside the skills/** governed-merge fence — every spec PR touching an indexed headline is forced to carry a governed-surface file #11705/[Decision] 新增任何手写文档页都必须改一个 .claude/ 生成物，于是每张文档卡都变成人工合并 —— 这一条要不要开机械化例外 #10277-C generated-artifact exception. (Without deps the same script FAILS CLOSED — generator --check exit 254 — also measured.)
• Queue-side reality: the Governed Surface Queue Guard's merge_group leg installs no dependencies by design, so it can never evaluate the byte-equality lift: any skills/** row fails closed at queue time and the run demands an APPROVED review from any account ≠ PR author ([governance] ADR maintainer approval is unsatisfiable on any PR the maintainer authored — GitHub forbids self-approval, so the gate is permanently red exactly when the human IS driving #8161 predicate). Measured as PR feat(spec): retire preview mode — the RuntimeMode 'preview' value and the whole PreviewModeConfig block #12718's CI_FAILURE dequeue (run 33099507477), resolved only by the maintainer's review (5048199709).
• The guard's own header records this as a filed-not-taken trade (fast queue leg vs. lift fidelity).

Cost observed this shift

One code PR whose only governed-glob touch was a byte-identical regenerated index consumed: one queue kick, one standing-down comment, one review request, and one maintainer interaction — for a diff the register's own predicate calls not governed. Multiply by every future spec PR whose regeneration sweeps the skills index.

The question for the ruling (options, not a recommendation)

A. Accept the cost: human review stays the queue-time answer for anything under a governed glob; document it so seats park such PRs for review immediately instead of discovering the kick. (Status quo, now documented.)
B. Let the merge_group leg install the minimal dependency closure needed by the generators' --check twins so the #11705 lift works at queue time — pays queue latency for lift fidelity.
C. Precompute: a pull_request-leg artifact (byte-equality attestation signed by the run) that the merge_group leg can verify without deps.

Refs: #11705, #10277, #8161, #9495; PR #12718 (both kicks + the recovery); scripts/pm/check-governed-merges.mjs header.