diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md
index 5270ce192..abc3f8a60 100644
--- a/ARCHITECTURE.md
+++ b/ARCHITECTURE.md
@@ -98,7 +98,9 @@ Protected source also binds paired evaluation receipts and evaluator/profile con
 
 Protected #601 adds a separate Noema Policy / Approval CAS ledger. It consumes only a repository-admitted current State / Checkpoint snapshot plus an independently supplied exact policy decision and binds the graph, evaluation-history position, evaluator handoff and expected approval version into an append-only digest chain. `approve_for_pilot` requires the latest evaluation to remain `eligibleForApproval` with `validation_non_regression`; explicit `revoke` may bind a newer authenticated regression history, but only from an already-approved prior state. Exact decision replay is idempotent, stale writers fail the monotonic approval-version CAS, and every retained event/snapshot remains `activationAuthorized:false`. This is point-in-time approval evidence, not graph publication or activation authority.
 
-Cross-product ownership remains outside this protected advisory boundary: released wire contracts belong to `context-graph-contracts`, enterprise adoption/decision records to `enterprise-architecture-core`, model routing to `contextual-orchestrator`, credentials and live signer trust selection to Keyverse/owner composition, and graph content/evaluation outcome truth to the owning product. Mutable sibling PR heads are not consumed. ADR 0017 remains `Proposed`; protected source integration does not establish live trust selection, non-workflow current-lifecycle revocation, deployed Durable Object behavior/performance, fresh publication-time State / Checkpoint plus Policy / Approval reconciliation, graph publication, canary/rollback evidence, production activation, or organization-wide self-evolution.
+Protected #603 adds a Noema Policy / Approval **publication preflight** over those existing owners. `src/policy-approval/procedural-publication-preflight.ts` performs a stable double-read of the admitted State / Checkpoint history and Policy / Approval snapshots, requires unchanged history/approval positions across the read window, rejects current revocation, and binds the exact graph, evaluation history, evaluator handoff, signer, and approval identities before it can emit a process-local admitted receipt. The receipt is deliberately `publicationAuthorized:false` and `activationAuthorized:false`: it proves a point-in-time reconciliation only and is not a graph publisher, lifecycle authority, Keyverse trust selector, or activation capability.
+
+Cross-product ownership remains outside this protected advisory boundary: released wire contracts belong to `context-graph-contracts`, enterprise adoption/decision records to `enterprise-architecture-core`, model routing to `contextual-orchestrator`, credentials and live signer trust selection to Keyverse/owner composition, and graph content/evaluation outcome truth to the owning product. Mutable sibling PR heads are not consumed. ADR 0017 remains `Proposed`; protected source integration does not establish live trust selection, non-workflow current-lifecycle revocation, deployed Durable Object behavior/performance, an actual graph-publication transaction consuming the protected #603 publication preflight, canary/rollback evidence, production activation, or organization-wide self-evolution.
 
 ## 5. Evidence and authority separation
 
@@ -150,6 +152,8 @@ Procedural graph/session and candidate-decision authority remain process-local i
 
 Protected #601 records only exact Noema Policy / Approval decision state. Its retained event chain is keyed to the admitted graph lineage and binds current State / Checkpoint history identity, authenticated evaluator handoff identity and expected approval version. It does not own Keyverse keys, product-domain truth, graph publication, tool invocation, provider routing or activation. Because State / Checkpoint may advance after an approval transaction, publication/activation must freshly read and compare both current authorities rather than treating a prior CAS success as indefinitely current.
 
+Protected #603 is the corresponding point-in-time publication preflight read boundary. It fresh-reads both owner snapshots twice, rejects a moving history or approval head, rejects an already-revoked current approval, and returns only a locally admitted reconciliation receipt whose `publicationAuthorized:false` and `activationAuthorized:false` remain explicit. A future publisher must still consume that exact receipt together with its separately owned released graph contract, current lifecycle/revocation evidence, and live owner/Keyverse trust; #603 does not persist or transfer any of those authorities.
+
 Protected #589 separately reuses the existing durable Workflow / Task Execution state only as current task/cancellation evidence for workflow-backed advisory gating. It does not create another lifecycle store and does not turn Workflow / Task Execution into procedural-history authority. This separation keeps State / Checkpoint evidence retention, Workflow / Task current execution truth, Policy / Approval, and product-domain ownership distinct.
 
 ## 9. Standalone and modular MSA contract
@@ -169,7 +173,7 @@ Protected #589 separately reuses the existing durable Workflow / Task Execution
 | OIDC/GitHub App | issuer/audience/repository/workflow-ref, immutable workflow-source SHA when configured, malformed token/JWKS, replay, redirect/egress, secret non-disclosure regressions |
 | Durable Objects | cross-instance semantics, delayed/retried alarm, current-state reschedule, malformed backend/storage-failure tests |
 | External-extension lifecycle | legal-edge validation; restart/replay/CAS races; exact Policy / Approval and foreign-owner reference binding; corruption/truncation/cross-stream rejection; >128-transition auditability; O(1) verified current projection; full audit/recovery rehearsal; actual Durable Object p95/contention/storage-growth evidence before runtime acceptance |
-| Procedural graph guidance | exact schema/identity bounds; graph/session local admission; canonical digest behavior; cycle-safe bounded neighborhood extraction; unknown/budget abstention; paired holdout separation and exact candidate/base/context binding; safety and measured-score non-regression; `activationAuthorized: false`; exact receipt/envelope and authenticated evaluator-handoff binding; durable history CAS/replay/integrity/restart/capacity; pure same-execution fresh lifecycle projection; workflow-backed plan/session identity rejection before durable lookup plus fresh current Workflow / Task Execution read per decision; Policy / Approval CAS approval/revocation and replay/CAS integrity; live trust selection/non-workflow revocation/deployed-DO/fresh publication-time cross-authority reconciliation/graph-publication/canary evidence before activation |
+| Procedural graph guidance | exact schema/identity bounds; graph/session local admission; canonical digest behavior; cycle-safe bounded neighborhood extraction; unknown/budget abstention; paired holdout separation and exact candidate/base/context binding; safety and measured-score non-regression; `activationAuthorized: false`; exact receipt/envelope and authenticated evaluator-handoff binding; durable history CAS/replay/integrity/restart/capacity; pure same-execution fresh lifecycle projection; workflow-backed plan/session identity rejection before durable lookup plus fresh current Workflow / Task Execution read per decision; Policy / Approval CAS approval/revocation and replay/CAS integrity; protected #603 stable double-read publication preflight with `publicationAuthorized:false`; live trust selection/non-workflow revocation/deployed-DO/actual graph-publication/canary evidence before activation |
 | GitHub Actions/control plane | least privilege, exact-head/live-base binding, full pagination, stale-head refusal, evidence-class separation |
 | LLM integration | gateway contract, provider-key isolation, deterministic gates independent of model judgement |
 | release/acquisition | protected source, CI/security/coverage, package/SBOM/provenance/reproducibility, licensing/NOTICE, rollback/recovery, later operational/buyer evidence |
@@ -182,7 +186,7 @@ Repository source/docs cannot fabricate stronger live `main` governance than the
 
 Protected external-extension lifecycle source cannot establish actual Durable Object p95, contention/partition behavior, backup/restore success, production recovery, or deployed invocation enforcement by documentation alone. Those remain later exact operational evidence.
 
-Protected procedural-graph source can authenticate the supplied evaluator assertion, retain bounded evaluation/rejection history, and record source-level Policy / Approval CAS decisions through protected #601, but it cannot establish live signer/trust selection, cross-language/released digest semantics, non-workflow current-lifecycle revocation, deployed Workflow / Task, history-store or Policy / Approval behavior/performance, fresh publication-time reconciliation, graph publication, canary operation, rollback success, or production outcome improvement. Those remain later owner, contract, operational, and product-owner evidence.
+Protected procedural-graph source can authenticate the supplied evaluator assertion, retain bounded evaluation/rejection history, record source-level Policy / Approval CAS decisions through protected #601, and produce a stable point-in-time publication preflight through protected #603. It still cannot establish live signer/trust selection, cross-language/released digest semantics, non-workflow current-lifecycle revocation, deployed Workflow / Task, history-store or Policy / Approval behavior/performance, actual graph publication, canary operation, rollback success, or production outcome improvement. The #603 receipt itself remains `publicationAuthorized:false` and `activationAuthorized:false`; those later authorities remain owner, contract, operational, and product-owner evidence.
 
 ## 12. Canonical documentation graph
 
@@ -207,6 +211,6 @@ The default shape is **small credential-exchange service + explicit state coordi
 
 The external-extension lifecycle remains a bounded Tool Capability / State / Checkpoint aggregate rather than a new scanner, quarantine runtime, egress engine, identity provider, or model router. Its synchronous projection path and full audit/recovery path are deliberately separate so buyer/runtime latency does not require scanning retained history while recovery still verifies the complete chain.
 
-The protected procedural-graph advisory remains a bounded Agent Runtime aggregate rather than an execution engine or autonomous policy plane. Its pure execution adapter may project localized context against a caller-supplied fresh authenticated same-execution `running` lifecycle snapshot. Protected #589 adds only a workflow-backed current-state ACL over the existing canonical Workflow / Task Execution owner. Protected #597 adds a separate bounded State / Checkpoint history for evaluation/rejection evidence, not a second Workflow / Task or lifecycle truth. Protected #601 adds the distinct Noema Policy / Approval CAS ledger without granting publication or activation. Any future release, live signer-trust selection, graph publication, non-workflow current-lifecycle revocation, publication-time cross-authority reconciliation, canary, or activation path must cross explicit versioned owner contracts and retain `activationAuthorized:false` until those independent authorities are proven.
+The protected procedural-graph advisory remains a bounded Agent Runtime aggregate rather than an execution engine or autonomous policy plane. Its pure execution adapter may project localized context against a caller-supplied fresh authenticated same-execution `running` lifecycle snapshot. Protected #589 adds only a workflow-backed current-state ACL over the existing canonical Workflow / Task Execution owner. Protected #597 adds a separate bounded State / Checkpoint history for evaluation/rejection evidence, not a second Workflow / Task or lifecycle truth. Protected #601 adds the distinct Noema Policy / Approval CAS ledger without granting publication or activation. Protected #603 adds only the stable publication preflight read boundary and keeps `publicationAuthorized:false` and `activationAuthorized:false`; any future release, live signer-trust selection, graph publication, non-workflow current-lifecycle revocation, canary, or activation path must still cross explicit versioned owner contracts and prove those independent authorities.
 
 Architecture changes must keep source behavior, realistic regression tests, canonical documentation, traceability, and CHANGELOG semantics consistent without promoting active-PR behavior to protected truth.
diff --git a/CHANGELOG.md b/CHANGELOG.md
index ff85f0d67..c05b5bfb8 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,6 +3,7 @@
 - Add a Noema-owned exact-claim evidence receipt contract whose execution and research producers serialize one canonical artifact that binds every receipt semantic field, including command/result/isolation/network or source revision/excerpt/retrieval policy. Admission accepts only a receipt ID from untrusted model output. The owner API first verifies the exact authenticated OpenCode-handoff manifest digest, canonical envelope bytes, reviewed producer-to-kind policy, and repository/head/workflow/run/attempt identity before it can construct an immutable typed index; admission then reconstructs each canonical artifact and verifies time/claim/artifact identity. The version-2 manifest now binds a separate producer-authenticated `ClaimEvidenceRequirement` containing the exact claim, independently required evidence kind, and `context` or `finding` publication authority. Raw current-head source lines are context only: they are withheld from finding-reference prompts and cannot publish a finding or `request_changes`; an explicitly producer-authorized source finding remains usable and retains exact path/line checks. Finding-free model `request_changes` and `blocked` verdicts cannot bypass receipt admission to publish a vacuous blocking review. Requirement/receipt kind mismatch, fixed-artifact semantic substitution, caller-supplied receipt dictionaries, model self-classification, stale identities, cross-kind receipts, marker-only sandbox output, noncanonical artifact bytes, and expired receipts fail closed before the GitHub publisher. This remains the owner prerequisite for ContextualWisdomLab/.github#1641 and issue #555. The reviewed `sandboxed_verify` adapter exists in owner source, but its actual central stdout/stderr/marker-to-manifest wiring and the trusted research producer are not yet integrated; exact-head hosted GREEN, immutable release, and the verified central consumer bump remain required.
 
 ## Unreleased
+- Noema Policy / Approval에 procedural graph **publication preflight**를 추가했다. PR #603에서 current State / Checkpoint history와 Policy / Approval snapshot을 stable double-read로 다시 읽어 moving authority와 current revoke를 실패-폐쇄하고 exact graph/history/evaluator handoff/signer/approval identity를 결합한다. 반환되는 process-local preflight receipt는 `publicationAuthorized:false`와 `activationAuthorized:false`를 유지한다. 실제 graph publication, current lifecycle/revocation, live Keyverse/owner trust, immutable released `context-graph-contracts`, canary/rollback 및 production outcome authority는 별도다.
 - Policy / Approval에 procedural graph lineage의 독립 승인·취소 CAS 원장을 추가한다. 기존 Agent Runtime이 admit한 exact graph와 State / Checkpoint가 provenance-preserving read authority로 반환한 verified evaluation history를 exact candidate/history/evaluator handoff identity에 결합하고, monotonic approval-version CAS·exact decision replay·explicit revoke·bounded digest-chain integrity를 검증한다. structural clone history/approval snapshot, stale writer, malformed 또는 mismatched independent decision과 retained-byte integrity 위반은 실패-폐쇄하며 모든 event/snapshot은 `activationAuthorized:false`를 유지한다. Keyverse signer/key custody, graph publication, immutable release/deployment/canary, tool/model/provider routing과 product/domain truth는 이 경계 밖이다. issue #584, PR #601.
 - State / Checkpoint의 durable procedural evaluation history에 provenance-preserving read authority를 추가한다. canonical repository가 retained bytes와 graph lineage를 검증해 반환한 immutable snapshot만 process-local admission으로 표시하고, structural clone·deserialized lookalike·append-return snapshot·caller-created object·null은 downstream Policy / Approval anti-corruption boundary에서 authority로 오인되지 않도록 실패-폐쇄한다. 이 표시는 읽은 시점의 verified provenance만 증명하며 이후 append에 대한 currentness, Policy / Approval decision, graph publication/promotion 또는 activation authority를 부여하지 않는다. issue #584, PR #599.
 - State / Checkpoint에 authenticated procedural evaluation/rejection history를 추가한다. 기존 Agent Runtime이 admit한 exact graph/evaluation/handoff identity만 tenant/task/graph lineage별 bounded complete event chain으로 저장하고 monotonic CAS·exact replay·digest-chain integrity·durable rejection projection을 검증한다. stale writer, rejection-context omission, structural forgery, wrong lineage, retained-byte corruption, duplicate handoff, 128-event capacity 초과는 실패-폐쇄하며 eviction은 하지 않는다. 이 저장소는 Workflow / Task lifecycle, Policy / Approval, graph publication/promotion 또는 activation authority를 만들지 않고 모든 event는 `activationAuthorized:false`를 유지한다. issue #584, PR #597.
diff --git a/docs/PRD.md b/docs/PRD.md
index 3c99048a9..b3758e9bd 100644
--- a/docs/PRD.md
+++ b/docs/PRD.md
@@ -108,11 +108,13 @@ Protected source now also includes exact paired evaluation-receipt identities, e
 
 Protected #601 adds the Noema Policy / Approval CAS boundary. It consumes an admitted current State / Checkpoint snapshot plus an independently supplied exact policy decision and retains an append-only digest-linked approval/revocation ledger bound to exact graph, history, evaluator-handoff and approval-version identities. `approve_for_pilot` requires the latest history to remain `eligibleForApproval` with `validation_non_regression`; explicit `revoke` may bind a newer authenticated non-eligible regression history, but only when the prior Policy / Approval state is approved. Exact replay is idempotent, stale writers lose the monotonic approval-version CAS, and every event/snapshot remains `activationAuthorized:false`. This source is Policy / Approval evidence only: it does not publish or activate a graph, own Keyverse signer custody, or make a point-in-time approval permanently current.
 
+Protected #603 adds a Noema Policy / Approval **publication preflight** on top of those existing authorities. It rereads admitted State / Checkpoint history and Policy / Approval snapshots across a stable window, rejects changed history or approval positions, rejects a current revoked approval, and requires the graph, history, evaluator handoff, signer, and approval identities to agree before returning a process-local receipt. The receipt remains `publicationAuthorized:false` and `activationAuthorized:false`; it is evidence that these Noema-owned authorities agreed at one point in time, not graph publication, lifecycle/revocation, live Keyverse trust selection, or activation authority.
+
 Protected source also includes the #586 execution-lifecycle adapter. It projects procedural guidance only when the caller supplies a fresh authenticated `running` lifecycle snapshot for the same canonical execution identity and suppresses guidance for accepted, cancellation-requested, or terminal states. The adapter is not itself durable lifecycle/revocation authority and cannot prove that a canonical `running` snapshot has not become stale after the caller obtained it.
 
 Protected source includes the #589 workflow-backed current-state ACL without replacing that pure adapter. It re-admits the workflow plan, validates the locally admitted procedural session against the same canonical execution identity before selecting any execution-scoped Durable Object, then re-reads the existing Workflow / Task Execution owner before each guidance decision. Current cancellation, terminal task evidence, and pre-start evidence suppress guidance; only other current nonterminal workflow evidence can reach the existing running-only advisory gate. This protected ACL does not make Workflow / Task Execution the Agent Runtime lifecycle store and does not grant mutation, retry, Policy / Approval, tool, release, or activation authority. Non-workflow Agent Runtime callers still require their own fresh authenticated lifecycle source, and source/fake-Durable-Object tests do not establish deployed Durable Object compatibility, restart behavior, availability, or synchronous buyer-path p95.
 
-Procedural graph ownership follows existing CWL boundaries. Any released cross-service schema belongs to `context-graph-contracts`; enterprise adoption/decision records belong to `enterprise-architecture-core`; model discovery/routing remains in `contextual-orchestrator`; credentials and live signer trust selection remain in Keyverse/owner composition; graph content and outcome/evaluation truth remain with the consuming product. Noema owns only the execution-local advisory mechanics, deterministic candidate-screening/evaluation binding, bounded State / Checkpoint history, and its separate Policy / Approval CAS ledger. Mutable sibling PR heads are not production dependencies. ADR 0017 remains `Proposed`; source integration does not authorize release, graph publication, canary, rollback, or activation. Publication/activation must freshly reconcile current State / Checkpoint and current Policy / Approval rather than treating source integration or an earlier CAS result as activation authority.
+Procedural graph ownership follows existing CWL boundaries. Any released cross-service schema belongs to `context-graph-contracts`; enterprise adoption/decision records belong to `enterprise-architecture-core`; model discovery/routing remains in `contextual-orchestrator`; credentials and live signer trust selection remain in Keyverse/owner composition; graph content and outcome/evaluation truth remain with the consuming product. Noema owns only the execution-local advisory mechanics, deterministic candidate-screening/evaluation binding, bounded State / Checkpoint history, its separate Policy / Approval CAS ledger, and the protected #603 point-in-time publication preflight. Mutable sibling PR heads are not production dependencies. ADR 0017 remains `Proposed`; source integration does not authorize release, graph publication, canary, rollback, or activation. A future publisher must consume the exact admitted #603 preflight together with separately owned current lifecycle/revocation, live trust, and immutable released graph-contract authority rather than treating source integration, an earlier CAS result, or the preflight receipt itself as publication authority.
 
 ## 5. Functional requirements
 
@@ -141,7 +143,7 @@ Procedural graph ownership follows existing CWL boundaries. Any released cross-s
 | FR-021 | Model discovery, routing, test-time compute, provider failover, and provider credentials remain owned by `contextual-orchestrator`; Noema runtime code must not duplicate direct provider SDKs, credentials, fallback lists, or routing policy. |
 | FR-022 | Workflow/task, tool/capability, isolation, policy/approval, observability, recovery, Context Graph, and EA integration must cross explicit versioned ports/contracts; Context Graph integration must use immutable released versioned contracts, reject open or unreleased Draft contracts, and require conformance/admission evidence, canonical object/authority references, provenance, and valid/system time semantics. Arbitrary tool authority, ambient secret propagation, unbounded recursive work, silent side-effect retry, unreleased Context Graph source coupling, and cross-service SQL are forbidden. |
 | FR-023 | External-extension lifecycle authority must be append-only, exact-stream partitioned, restart-reconstructable, and CAS-serialized; current projection must be cryptographically bound to its audit tail, full audit must detect sequence/hash/stream truncation or substitution, exact duplicate replay must preserve committed history, and every genuinely new activation must bind a fresh Noema Policy / Approval and owner-evidence re-read without copying foreign-owner truth. |
-| FR-024 | Procedural graph guidance must remain tenant/task/execution scoped, immutable and advisory-only; reject forged graph/session identities and unsafe input, return bounded localized context or explicit abstention, bind candidate screening to exact direct-child lineage and paired held-out context, prevent train/holdout leakage, reject safety or measured-score regression, and keep activation unauthorized. Protected source must bind evaluation receipts/envelopes to exact identities, verify authenticated evaluator handoff without owning signer custody, retain bounded evaluation/rejection history only under the existing State / Checkpoint authority, and bind independent approval/revocation to exact current history through the protected #601 Policy / Approval CAS ledger. The pure adapter still requires a caller-supplied fresh authenticated same-execution `running` lifecycle snapshot; workflow-backed guidance must match plan/session execution identity before any durable lookup and re-read canonical Workflow / Task Execution state before every decision. Live Keyverse/owner trust selection, non-workflow lifecycle freshness, released contracts, deployed durable compatibility/performance, fresh publication-time State / Checkpoint plus Policy / Approval reconciliation, graph publication, canary/rollback and product-outcome authority remain separate prerequisites. |
+| FR-024 | Procedural graph guidance must remain tenant/task/execution scoped, immutable and advisory-only; reject forged graph/session identities and unsafe input, return bounded localized context or explicit abstention, bind candidate screening to exact direct-child lineage and paired held-out context, prevent train/holdout leakage, reject safety or measured-score regression, and keep activation unauthorized. Protected source must bind evaluation receipts/envelopes to exact identities, verify authenticated evaluator handoff without owning signer custody, retain bounded evaluation/rejection history only under the existing State / Checkpoint authority, bind independent approval/revocation to exact current history through the protected #601 Policy / Approval CAS ledger, and use protected #603 publication preflight to reject a moving or revoked State / Checkpoint + Policy / Approval view while still returning `publicationAuthorized:false` and `activationAuthorized:false`. The pure adapter still requires a caller-supplied fresh authenticated same-execution `running` lifecycle snapshot; workflow-backed guidance must match plan/session execution identity before any durable lookup and re-read canonical Workflow / Task Execution state before every decision. Live Keyverse/owner trust selection, non-workflow lifecycle freshness, released contracts, deployed durable compatibility/performance, actual graph publication, canary/rollback and product-outcome authority remain separate prerequisites. |
 
 ## 6. Non-functional requirements
 
@@ -199,7 +201,7 @@ Protected source can establish implementation contracts, deterministic tests, pa
 - 30-day production KPI evidence;
 - immutable release publication and deployment success unless those events actually occur;
 - customer/pilot, revenue/pipeline, support ownership, owner/legal rights, or contributor/IP transfer authority;
-- live procedural signer/trust selection, non-workflow lifecycle freshness, deployed State / Checkpoint or Policy / Approval behavior/performance, production graph publication, publication-time fresh cross-authority reconciliation, canary/rollback success, or product-outcome improvement merely because protected source can authenticate evaluator handoff, retain bounded evaluation/rejection history, and record #601 Policy / Approval CAS decisions.
+- live procedural signer/trust selection, non-workflow lifecycle freshness, deployed State / Checkpoint or Policy / Approval behavior/performance, production graph publication, canary/rollback success, or product-outcome improvement merely because protected source can authenticate evaluator handoff, retain bounded evaluation/rejection history, record #601 Policy / Approval CAS decisions, and produce a #603 point-in-time publication preflight whose `publicationAuthorized:false` and `activationAuthorized:false` remain explicit.
 
 Those remain separate external or later-stage evidence and must fail closed when required but absent.
 
@@ -222,7 +224,7 @@ An earlier stage never proves a later stage.
 - generalizing the narrow short-lived Actions App-token capability-file bootstrap into an ambient or long-lived secret transport mechanism;
 - inventing trust controls or deployment evidence absent from the owning source/live system;
 - creating direct cross-service application-database coupling;
-- treating procedural graph content, digest identity, candidate non-regression, authenticated evaluator handoff, retained history, or `eligibleForApproval` as tool, lifecycle, Policy / Approval, publication, or activation authority;
+- treating procedural graph content, digest identity, candidate non-regression, authenticated evaluator handoff, retained history, `eligibleForApproval`, Policy / Approval CAS, or a #603 publication preflight receipt as tool, lifecycle, graph publication, or activation authority;
 - fabricating release, deployment, KPI, customer, revenue, licensing, ownership, or certification evidence;
 - adding a physical relational ERD before Noema owns such persistence.
 
diff --git a/docs/TRACEABILITY.md b/docs/TRACEABILITY.md
index 04b367f8d..38a2d431f 100644
--- a/docs/TRACEABILITY.md
+++ b/docs/TRACEABILITY.md
@@ -4,7 +4,7 @@
 
 This document maps requirements and architecture decisions to executable Noema surfaces and to the evidence that can legitimately prove them. File presence, PR prose, model output, queued checks, or predecessor results are never promoted into implementation, approval, merge, release, deployment, or acquisition authority.
 
-Protected-main branch-point reference for this refresh: `1742bb9be40b2587d54c1194c539b863abb11d22`. This is a snapshot anchor, not evergreen current authority; live protected `main` must be refetched before any merge, release, deployment, or acquisition claim.
+Protected-main branch-point reference for this refresh: `70c997e45db975a2ac43197ec2c49c9916a3e238`. This is a snapshot anchor, not evergreen current authority; live protected `main` must be refetched before any merge, release, deployment, or acquisition claim.
 
 Noema's execution rule is:
 
@@ -60,7 +60,7 @@ Each arrow is a separate authority. Success at an earlier stage cannot fabricate
 | Release/acquisition readiness | release/provenance/acquisition contracts | release verification and evidence scripts, digest-bound revenue/transfer source documents | exact-source package/SBOM/provenance/readiness and retained-source byte-integrity tests | immutable release/deployment/customer/revenue/legal authority | Technical byte binding implemented; commercial/legal authenticity remains external |
 | External Claude plugin admission | ADR 0015 + issue #545 + FR-022 | `src/tool-capability/external-extension-admission.ts` local fail-closed port/ACL | external-extension suites covering mutable source, catalog mismatch, forged receipts, independent Policy / Approval, pilot ceiling, activation provenance, activation→invocation chronology, expiry/rollback, catalog drift, replay, instruction promotion, product-runtime wrappers, and secret/product/reasoning receipts | immutable `context-graph-contracts` artifact contract, AppGuardrail successor evidence, isolation/egress operation, measured pilots | Implemented on protected main as admission boundary; later shared-contract/pilot evidence remains separate |
 | External-extension lifecycle State / Checkpoint evidence | ADR 0015 + issue #561 | protected `src/tool-capability/external-extension-lifecycle-store.ts`, lifecycle evidence/runtime binding and private operability projection; foreign owners remain reference/digest authorities | hostile lifecycle suites covering legal edges, exact replay/conflict, expected-version/head CAS, restart/audit integrity, >128 retention, projection-tail integrity, transaction replay races, activation evidence races, Policy / Approval/effective-scope drift and storage projection validation | actual Durable Object p95/contention/storage-growth/recovery; immutable owner-issued activation authority; immutable release/deployment/pilot evidence | Implemented on protected main; ADR remains Proposed and operational evidence is not inferred from source/unit tests |
-| Procedural graph advisory runtime | Proposed ADR 0017 + issue #584 | protected graph/session/screening/lifecycle surfaces, `procedural-evaluation-authority.ts`, `procedural-evaluation-handoff.ts`, State / Checkpoint bounded evaluation/rejection history, and `src/policy-approval/procedural-policy-approval.ts` | hostile schema/accessor/proxy/resource-limit tests; graph/session provenance; paired holdout and exact receipt identities; evaluation-envelope binding; P-256 signed-handoff verification; canonical signature transport; expiry-at-consumption; stable signed-claim handoff identity; history CAS/replay/digest-chain/restart/capacity evidence; Policy / Approval approval/revocation CAS/replay/integrity; `activationAuthorized: false` | live owner/Keyverse trust selection and credential custody; non-workflow current-lifecycle/revocation authority; deployed history/workflow-state/Policy-Approval compatibility and p95; immutable released cross-service contract; fresh publication-time cross-authority reconciliation; graph publication, canary/rollback and production outcome evidence | Implemented on protected main with bounded durable evaluation/rejection history and protected #601 Policy / Approval CAS; graph publication/activation remains explicitly unauthorized |
+| Procedural graph advisory runtime | Proposed ADR 0017 + issue #584 | protected graph/session/screening/lifecycle surfaces, `procedural-evaluation-authority.ts`, `procedural-evaluation-handoff.ts`, State / Checkpoint bounded evaluation/rejection history, `src/policy-approval/procedural-policy-approval.ts`, and `src/policy-approval/procedural-publication-preflight.ts` | hostile schema/accessor/proxy/resource-limit tests; graph/session provenance; paired holdout and exact receipt identities; evaluation-envelope binding; P-256 signed-handoff verification; canonical signature transport; expiry-at-consumption; stable signed-claim handoff identity; history CAS/replay/digest-chain/restart/capacity evidence; Policy / Approval approval/revocation CAS/replay/integrity; protected #603 stable double-read publication preflight, current-revocation and lookalike rejection; `publicationAuthorized:false`; `activationAuthorized:false` | live owner/Keyverse trust selection and credential custody; non-workflow current-lifecycle/revocation authority; deployed history/workflow-state/Policy-Approval/preflight compatibility and p95; immutable released cross-service contract; actual graph-publication transaction consuming the admitted preflight; canary/rollback and production outcome evidence | Implemented on protected main with bounded durable evaluation/rejection history, protected #601 Policy / Approval CAS, and protected #603 publication preflight; graph publication/activation remains explicitly unauthorized |
 
 ## 3. Live governance traceability
 
@@ -83,7 +83,7 @@ Historical or integrated PR numbers are deliberately omitted from current owners
 | Acquisition coordination | issue #5 | Coordinates evidence families without promoting earlier evidence into buyer/legal/commercial authority. |
 | External Claude plugin admission | issue #545 | Local fail-closed Tool / Capability port only; marketplace installation, Anthropic review, isolation runtime, and shared-contract GA remain separate authorities. |
 | External-extension lifecycle persistence | issue #561 | Noema owns lifecycle State / Checkpoint / Recovery evidence; Policy / Approval plus AppGuardrail/quarantine/Egress/identity/model-routing authorities remain separate and are retained only as immutable references/digests. |
-| Procedural graph advisory runtime | issue #584 | Noema owns bounded execution-local advisory graph/session mechanics, deterministic candidate screening, exact evaluation-envelope/authenticated handoff binding, bounded durable evaluation/rejection history under State / Checkpoint, and the separate protected #601 Noema Policy / Approval CAS ledger. Released wire contracts, live signer trust/key custody, enterprise adoption, model routing, non-workflow current lifecycle/revocation, graph-domain truth, publication and canary/rollback evidence remain with their canonical owners. |
+| Procedural graph advisory runtime | issue #584 | Noema owns bounded execution-local advisory graph/session mechanics, deterministic candidate screening, exact evaluation-envelope/authenticated handoff binding, bounded durable evaluation/rejection history under State / Checkpoint, the separate protected #601 Noema Policy / Approval CAS ledger, and protected #603 publication preflight. Released wire contracts, live signer trust/key custody, enterprise adoption, model routing, non-workflow current lifecycle/revocation, graph-domain truth, actual publication and canary/rollback evidence remain with their canonical owners. |
 
 Canonical architecture/documentation is code-current by revision and is not owned by a historical documentation PR. Transient queue/green states belong to observation-scoped evidence, not timeless architecture claims.
 
@@ -221,16 +221,16 @@ strict tenant/task/graph input
 → stable signed-claim handoff identity + expiry-at-consumption
 → bounded durable evaluation/rejection history under State / Checkpoint
 → protected #601 Noema Policy / Approval approval/revocation CAS, activationAuthorized: false
-→ fresh publication-time State / Checkpoint + Policy / Approval reconciliation
-→ later live trust selection + current-lifecycle revocation + graph publication/canary/rollback evidence
-→ immutable released-contract and production outcome evidence owned by their canonical owners
+→ protected #603 publication preflight, publicationAuthorized:false, activationAuthorized:false
+→ later live trust selection + current-lifecycle revocation + immutable released graph contract + actual graph publication/canary/rollback evidence
+→ immutable release and production outcome evidence owned by their canonical owners
 ```
 
 Protected signed-handoff verification authenticates the supplied evaluator assertion against the public key and signer key id selected by the composition root, binds it to the exact evaluation envelope and bounded validity interval, rejects noncanonical signature transport, and re-checks expiry when process-local evidence is consumed. The stable handoff identity is derived from the signed claim semantics rather than the ECDSA signature instance. Protected #597 then retains bounded durable evaluation/rejection history under State / Checkpoint, binding admitted graph/evaluation/authenticated signed-claim identities and minimized rejection evidence with monotonic CAS, exact replay, digest-chain integrity, duplicate-handoff refusal, restart reconstruction, and fail-closed bounded capacity.
 
 Neither the verified handoff nor the retained State / Checkpoint history is Policy / Approval by itself. Protected #601 separately consumes the current admitted history position plus an independently supplied exact policy decision and records append-only approval/revocation evidence bound to graph, evaluation history, evaluator handoff and expected approval version. `approve_for_pilot` requires the latest evaluation to remain eligible with validation non-regression; `revoke` requires an already approved prior state and may bind a newer authenticated regression history. Exact replay is idempotent, stale writers fail monotonic approval-version CAS, and every event/snapshot remains `activationAuthorized:false`.
 
-Protected #601 still does not establish live signer trust, graph publication or activation. Noema does not discover or custody Keyverse credentials, prove that a caller-cached lifecycle snapshot is current, grant tools, publish a cross-language contract, or own product-domain outcome truth. `context-graph-contracts` owns any released cross-service schema; `enterprise-architecture-core` owns enterprise adoption/decision records; `contextual-orchestrator` owns model discovery/routing; Keyverse/owner composition owns identity/key custody and live signer selection; the consuming product owns graph content and outcome truth. Any future publication/activation path must freshly read and reconcile current State / Checkpoint and Policy / Approval with current lifecycle/revocation and owner evidence rather than treating `eligibleForApproval`, an authenticated handoff, retained history, a supplied `running` snapshot, or a prior CAS success as indefinitely current authority.
+Protected #603 then performs the Noema-owned publication preflight by reading current State / Checkpoint and Policy / Approval twice, proving a stable overlapping read window, rejecting a revoked current approval, and requiring exact candidate/history/evaluator/signer/approval identity agreement. Its result is only a process-local admitted receipt with `publicationAuthorized:false` and `activationAuthorized:false`. It does not establish live signer trust, graph publication or activation. Noema does not discover or custody Keyverse credentials, prove that a caller-cached non-workflow lifecycle snapshot is current, grant tools, publish a cross-language contract, or own product-domain outcome truth. `context-graph-contracts` owns any released cross-service schema; `enterprise-architecture-core` owns enterprise adoption/decision records; `contextual-orchestrator` owns model discovery/routing; Keyverse/owner composition owns identity/key custody and live signer selection; the consuming product owns graph content and outcome truth. Any actual publication/activation path must consume the exact admitted #603 preflight together with current lifecycle/revocation and owner evidence rather than treating `eligibleForApproval`, an authenticated handoff, retained history, a supplied `running` snapshot, a prior CAS success, or the preflight receipt as indefinitely current publication authority.
 
 ## 14. Update rule
 
diff --git a/docs/TRD.md b/docs/TRD.md
index 09fdd0853..ffdd5f1eb 100644
--- a/docs/TRD.md
+++ b/docs/TRD.md
@@ -64,13 +64,15 @@ Protected source extends that screening boundary with exact paired evaluation-re
 
 Protected #601 adds the separate Noema Policy / Approval CAS boundary. `DurableProceduralPolicyApprovalRepository` consumes a locally admitted graph, a repository-verified current State / Checkpoint history snapshot, and an independently supplied exact policy decision. It binds graph/history/evaluator-handoff identities and expected approval version into an append-only digest-linked event chain. `approve_for_pilot` requires the latest history to remain approval-eligible with `validation_non_regression`; `revoke` may bind newer authenticated non-eligible evidence such as `score_regression`, but only when the prior state is `approved_for_pilot`. Exact decision replay is idempotent, a stale writer loses the monotonic CAS race, and every event/snapshot retains `activationAuthorized:false`. The repository does not select/custody signer keys, publish graphs, route providers, invoke tools, or grant activation.
 
+Protected #603 adds a Noema Policy / Approval **publication preflight** in `src/policy-approval/procedural-publication-preflight.ts`. The preflight fresh-reads the repository-admitted State / Checkpoint history and Policy / Approval snapshots twice, fails closed if either authority moves during reconciliation, rejects a current revoked approval, and requires exact graph/candidate/history/evaluator/signer/approval identity agreement. Its locally admitted receipt remains `publicationAuthorized:false` and `activationAuthorized:false`; the preflight does not publish a graph, select live Keyverse trust, own lifecycle/revocation state, or grant activation.
+
 `guideProceduralExecution()` consumes only a locally admitted procedural session and a caller-supplied fresh authenticated lifecycle snapshot for the same canonical execution identity. It projects bounded advisory context only while that supplied lifecycle is `running`; accepted, cancellation-requested and terminal states suppress guidance. This pure adapter does not persist lifecycle state and cannot independently prove that a previously authenticated `running` snapshot has not become stale.
 
 Protected source `guideProceduralExecutionFromCurrentWorkflowState()` provides a workflow-backed freshness ACL without changing the pure adapter's ownership. It first re-admits the workflow plan and validates the locally admitted procedural session against that exact execution identity before any Durable Object is selected or read. It then issues only the existing private Workflow / Task Execution `read` command to the execution-scoped `NOEMA_WORKFLOW_STATE` owner, validates exact execution/plan identity, complete unique task identities, allowed task states, cancellation identity and transition sequence, and projects only the minimum Agent Runtime state needed for the existing running-only advisory gate. Cancellation and terminal work suppress guidance, initialized pre-start evidence remains unavailable, and other current nonterminal workflow evidence may be treated as running for advisory purposes. The ACL cannot claim/mutate tasks, create lifecycle transitions, retry effects, grant Policy / Approval or tool authority, or replace Agent Runtime lifecycle semantics. Cross-execution plan/session mismatch is rejected before another execution's durable owner can be read.
 
-This protected ACL closes only the cached-workflow-snapshot gap for workflow-backed executions at source level. Non-workflow Agent Runtime callers still require their own fresh authenticated lifecycle source. Fake/in-memory Durable Object tests do not establish deployed transaction compatibility, restart/failure behavior, availability, synchronous buyer-path p95, graph publication, canary/rollback, release, deployment, or activation evidence. The #597 history path and #601 Policy / Approval CAS path also still require real Durable Object compatibility/restart/failure and latency evidence before they can be treated as production-operable persistence. Publication/activation must freshly re-read and reconcile current State / Checkpoint and current Policy / Approval because either authority may advance after an earlier point-in-time decision.
+This protected ACL closes only the cached-workflow-snapshot gap for workflow-backed executions at source level. Non-workflow Agent Runtime callers still require their own fresh authenticated lifecycle source. Fake/in-memory Durable Object tests do not establish deployed transaction compatibility, restart/failure behavior, availability, synchronous buyer-path p95, graph publication, canary/rollback, release, deployment, or activation evidence. The #597 history path and #601 Policy / Approval CAS path also still require real Durable Object compatibility/restart/failure and latency evidence before they can be treated as production-operable persistence. Protected #603 now performs the point-in-time State / Checkpoint + Policy / Approval reconciliation, but an actual publication/activation transaction must still consume the exact admitted preflight together with separately owned current lifecycle/revocation and live trust evidence.
 
-Released cross-service procedural graph schemas belong to `context-graph-contracts`; enterprise adoption records belong to `enterprise-architecture-core`; model discovery/routing remains owned by `contextual-orchestrator`; credentials and live signer trust selection remain in Keyverse/owner composition; graph content and product outcome truth remain with the consuming product. No mutable sibling PR-head dependency is accepted as production authority. ADR 0017 remains `Proposed`: protected source integration, authenticated evaluator verification, bounded State / Checkpoint retention, and protected #601 Policy / Approval CAS are not release, graph publication, canary or activation evidence.
+Released cross-service procedural graph schemas belong to `context-graph-contracts`; enterprise adoption records belong to `enterprise-architecture-core`; model discovery/routing remains owned by `contextual-orchestrator`; credentials and live signer trust selection remain in Keyverse/owner composition; graph content and product outcome truth remain with the consuming product. No mutable sibling PR-head dependency is accepted as production authority. ADR 0017 remains `Proposed`: protected source integration, authenticated evaluator verification, bounded State / Checkpoint retention, protected #601 Policy / Approval CAS, and protected #603 publication preflight are not release, graph publication, canary or activation evidence.
 
 ## 3. Identity and revision semantics
 
@@ -313,7 +315,7 @@ Deterministic Node/npm과 lockfile control은 protected main의 `.github/lockfil
 - reviewer Python: line/branch 100%, public docstrings 100%.
 - workflow/document contracts: shipped YAML/docs/source 관계를 executable tests로 검증.
 - security: hostile input, stale identity, partial pagination, duplicate keys, symlink/race, provider/network failure 포함.
-- procedural graph protected source: exact-key descriptor-safe input, forged/copied/proxy graph/session rejection, canonical digest/order behavior, cycle-safe bounded traversal, unknown/budget abstention, direct-child lineage, paired held-out completeness, train/holdout leakage, invalid score/safety regression, rejection replay, `activationAuthorized: false`, signed evaluator-envelope/handoff identity and expiry, durable history CAS/replay/integrity/restart/capacity behavior, Policy / Approval CAS approval/revocation/exact-replay/stale-writer behavior, same-execution lifecycle gating and non-running suppression must remain executable regressions.
+- procedural graph protected source: exact-key descriptor-safe input, forged/copied/proxy graph/session rejection, canonical digest/order behavior, cycle-safe bounded traversal, unknown/budget abstention, direct-child lineage, paired held-out completeness, train/holdout leakage, invalid score/safety regression, rejection replay, `activationAuthorized: false`, signed evaluator-envelope/handoff identity and expiry, durable history CAS/replay/integrity/restart/capacity behavior, Policy / Approval CAS approval/revocation/exact-replay/stale-writer behavior, protected #603 stable double-read publication preflight with moving-authority/current-revocation/lookalike rejection and `publicationAuthorized:false`, same-execution lifecycle gating and non-running suppression must remain executable regressions.
 - numerical/psychometric 계산이 추가되면 Rust-first CPU reference와 material GPU parity를 별도 requirement로 적용합니다.
 
 자세한 내용은 `docs/TEST_STRATEGY.md`를 따릅니다.
@@ -347,13 +349,13 @@ Protected external-extension lifecycle persistence owns exact-stream event recor
 
 The procedural graph/session and candidate-decision authorities remain process-local immutable values, but protected #597 now owns bounded durable evaluation/rejection history under the existing State / Checkpoint boundary. The retained history binds admitted graph/evaluation/authenticated signed-claim identities and minimized rejection evidence with monotonic CAS, exact replay, digest-chain integrity, restart reconstruction, duplicate-handoff refusal, and fail-closed bounded capacity. A retained history event is not durable approval or activation authority by itself.
 
-Protected #601 separately owns the Noema Policy / Approval CAS event stream for a procedural graph lineage. It retains exact independent decision identity, action, policy version, graph/history/evaluator-handoff evidence, expected approval version, prior-event digest and resulting approval/revocation state while forcing `activationAuthorized:false`. State / Checkpoint remains the evaluation-history owner; the Policy / Approval ledger does not duplicate Workflow / Task or lifecycle truth. Live signer trust, graph publication, current non-workflow lifecycle/revocation, fresh publication-time cross-authority reconciliation, canary/rollback and product-owner outcome evidence remain separate authorities.
+Protected #601 separately owns the Noema Policy / Approval CAS event stream for a procedural graph lineage. It retains exact independent decision identity, action, policy version, graph/history/evaluator-handoff evidence, expected approval version, prior-event digest and resulting approval/revocation state while forcing `activationAuthorized:false`. State / Checkpoint remains the evaluation-history owner; the Policy / Approval ledger does not duplicate Workflow / Task or lifecycle truth. Protected #603 then rereads the admitted current history and approval snapshots across a stable window and returns only a process-local preflight receipt with `publicationAuthorized:false` and `activationAuthorized:false`. Live signer trust, graph publication, current non-workflow lifecycle/revocation, canary/rollback and product-owner outcome evidence remain separate authorities.
 
 ## Protected procedural implementation
 
-Protected source implements procedural graph admission/session, offline direct-child candidate screening, exact paired evaluation-receipt/envelope identities, separately authenticated signed evaluator handoff, bounded State / Checkpoint evaluation/rejection history, protected #601 Policy / Approval CAS, and the #586 lifecycle-gated advisory projection with hostile tests for malformed descriptors, forged local authority, graph identity/scope, resource bounds, cycle-safe traversal, abstention, lineage/context mismatch, train/holdout leakage, paired evidence completeness, safety regression, measured-score regression, signed claim/disposition binding, history replay/integrity/restart/capacity, approval/revocation/exact-replay/stale-writer CAS, same-execution lifecycle binding, and non-running suppression. ADR 0017 remains `Proposed`; root architecture and traceability retain graph content as advisory-only and activation as unauthorized. This source is not a deployed route, production graph publication store, automatic refiner, live Keyverse trust-selection owner, automatic activation system, or organization rollout.
+Protected source implements procedural graph admission/session, offline direct-child candidate screening, exact paired evaluation-receipt/envelope identities, separately authenticated signed evaluator handoff, bounded State / Checkpoint evaluation/rejection history, protected #601 Policy / Approval CAS, protected #603 publication preflight, and the #586 lifecycle-gated advisory projection with hostile tests for malformed descriptors, forged local authority, graph identity/scope, resource bounds, cycle-safe traversal, abstention, lineage/context mismatch, train/holdout leakage, paired evidence completeness, safety regression, measured-score regression, signed claim/disposition binding, history replay/integrity/restart/capacity, approval/revocation/exact-replay/stale-writer CAS, preflight moving-authority/revocation/lookalike rejection, same-execution lifecycle binding, and non-running suppression. ADR 0017 remains `Proposed`; root architecture and traceability retain graph content as advisory-only and publication/activation as unauthorized. This source is not a deployed route, production graph publication store, automatic refiner, live Keyverse trust-selection owner, automatic activation system, or organization rollout.
 
-Protected source reuses the Workflow / Task Execution Durable Object only as current task/cancellation evidence for procedural guidance through the #589 workflow-backed current-state ACL. It does not create a second lifecycle database, and it validates local session/execution identity before any execution-scoped durable read. This protected ACL narrows stale workflow-backed guidance at source level but does not establish deployed Durable Object behavior, universal lifecycle freshness, publication-time reconciliation, or rollout authority.
+Protected source reuses the Workflow / Task Execution Durable Object only as current task/cancellation evidence for procedural guidance through the #589 workflow-backed current-state ACL. It does not create a second lifecycle database, and it validates local session/execution identity before any execution-scoped durable read. This protected ACL narrows stale workflow-backed guidance at source level but does not establish deployed Durable Object behavior, universal lifecycle freshness, graph publication, or rollout authority.
 
 ## Implemented
 
@@ -362,7 +364,7 @@ Protected source reuses the Workflow / Task Execution Durable Object only as cur
 - Worker routing, OIDC/GitHub App exchange, bounded request/egress controls.
 - distributed rate-limit and OIDC replay Durable Objects.
 - external-extension admission and append-only lifecycle storage/runtime binding, while real-backend operational/activation evidence remains separate.
-- procedural graph local admission/session, deterministic direct-child screening, authenticated evaluator-envelope/handoff binding, bounded durable evaluation/rejection history, protected #601 Policy / Approval CAS, lifecycle-gated advisory projection, and workflow-backed current-state ACL while live trust selection, deployed durability/latency, graph publication and rollout evidence remain separate.
+- procedural graph local admission/session, deterministic direct-child screening, authenticated evaluator-envelope/handoff binding, bounded durable evaluation/rejection history, protected #601 Policy / Approval CAS, protected #603 publication preflight, lifecycle-gated advisory projection, and workflow-backed current-state ACL while live trust selection, deployed durability/latency, actual graph publication and rollout evidence remain separate.
 - central-review/commercial-readiness/product-development/readiness/acquisition workflow 계열과 policy/test 기반.
 - evidence-class separation을 반영한 maintenance policy code.
 - configured 100% production coverage and reviewer-quality gates.
@@ -376,7 +378,7 @@ Protected source reuses the Workflow / Task Execution Durable Object only as cur
 - issue #30의 organization-level runner-assignment root-cause evidence.
 - release/deployment provenance chain의 실제 production acceptance.
 - external-extension lifecycle actual Durable Object current-projection/contended-append p95 measurement, partition/lock/storage-growth capture, full audit rebuild, backup/restore or equivalent recovery rehearsal, and rollback/suspension verification before ADR 0015 can advance.
-- released procedural wire-contract work, live Keyverse/owner trust-selection wiring, non-workflow current-lifecycle/revocation authority, deployed workflow-state plus #597 history and #601 Policy / Approval compatibility/restart/failure/p95 evidence, publication-time fresh State / Checkpoint + Policy / Approval reconciliation, graph publication, canary/rollback evidence, and product-owner production outcome measurement before ADR 0017 can advance beyond its current Proposed/advisory-only state.
+- released procedural wire-contract work, live Keyverse/owner trust-selection wiring, non-workflow current-lifecycle/revocation authority, deployed workflow-state plus #597 history/#601 Policy / Approval/#603 preflight compatibility/restart/failure/p95 evidence, an actual graph-publication path consuming the exact admitted preflight, canary/rollback evidence, and product-owner production outcome measurement before ADR 0017 can advance beyond its current Proposed/advisory-only state.
 
 ## External evidence
 
@@ -388,7 +390,7 @@ repository source만으로 충족되지 않는 항목:
 - private vulnerability-reporting repository setting and benign exercise where required.
 - production environment protection and independent reviewer configuration.
 - production KPI/log provenance, deployment receipts/attestations.
-- live procedural signer/trust selection, enterprise adoption approval, non-workflow current-state/revocation evidence, deployed Workflow / Task, durable-history and Policy / Approval compatibility/performance, publication-time fresh cross-authority reconciliation, graph publication, canary/rollback evidence, and product outcome truth from their owning systems.
+- live procedural signer/trust selection, enterprise adoption approval, non-workflow current-state/revocation evidence, deployed Workflow / Task, durable-history/Policy / Approval/preflight compatibility and performance, immutable released graph-contract authority, actual graph publication, canary/rollback evidence, and product outcome truth from their owning systems.
 
 ## 17. References
 
diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md
index d52382018..b8e01a29b 100644
--- a/docs/product-technical-gap-baseline.md
+++ b/docs/product-technical-gap-baseline.md
@@ -4,11 +4,11 @@
 
 이 문서는 protected source, active candidate, transient workflow evidence와 foreign-owner authority를 분리한다. Open PR exact head, protected base, required workflow, review thread, release와 central dependency는 mutation·merge·release 직전에 다시 읽는다. predecessor GREEN, queued/pending/in-progress/skipped/cancelled run, 오래된 PR base snapshot과 scanner/model judgement는 다음 revision의 merge authority로 전용하지 않는다. queued는 GREEN이 아니다.
 
-Current protected source는 mutation·merge·release 시점에 live protected `main`을 다시 조회해 결정한다. 이 문서 안의 exact source SHA는 dated observation 또는 protected history일 뿐 future merge 뒤 evergreen current authority로 사용하지 않는다. Dated protected observation for this repair는 `main@1742bb9be40b2587d54c1194c539b863abb11d22`이며, 이 revision은 merged PR #582 exact `0f20a4dc78e423fd5df49e137a4eb286c7075ea4`의 exact stream-scoped SQLite storage observation primitive, merged #583의 live-authority/ADR-index repair, protected procedural graph source #585/#586, merged #587의 source-vs-rollout doctoring repair, merged #588/#590/#595의 documentation convergence, merged #589의 workflow-backed current-state ACL, #591/#592/#593/#594/#596의 procedural decision/evaluation/authenticated-handoff source, #597의 State / Checkpoint history source, 그리고 #601의 Noema Policy / Approval CAS source를 포함한다.
+Current protected source는 mutation·merge·release 시점에 live protected `main`을 다시 조회해 결정한다. 이 문서 안의 exact source SHA는 dated observation 또는 protected history일 뿐 future merge 뒤 evergreen current authority로 사용하지 않는다. Dated protected observation for this repair는 `main@70c997e45db975a2ac43197ec2c49c9916a3e238`이며, 이 revision은 merged PR #582 exact `0f20a4dc78e423fd5df49e137a4eb286c7075ea4`의 exact stream-scoped SQLite storage observation primitive, merged #583의 live-authority/ADR-index repair, protected procedural graph source #585/#586, merged #587의 source-vs-rollout doctoring repair, merged #588/#590/#595의 documentation convergence, merged #589의 workflow-backed current-state ACL, #591/#592/#593/#594/#596의 procedural decision/evaluation/authenticated-handoff source, #597의 State / Checkpoint history source, #601의 Noema Policy / Approval CAS source, 그리고 #603의 protected publication preflight source를 포함한다.
 
 Dated central control-plane observation for this repair는 central `.github/main@cb0872c9a20d5584703dffacca65c096fc034c6c`다. Noema runtime의 reviewed immutable central consumer pin은 `c9052e607e5f3cc76e73207e7786b21500721b79`이고 runtime authority 표현은 `ALLOWED_WORKFLOW_SHA = c9052e607e5f3cc76e73207e7786b21500721b79`다. Moving foreign head와 reviewed immutable pin을 같은 권위로 취급하지 않으며 central moving head가 전진했다고 consumer pin을 자동 승격하지 않는다.
 
-Protected history에는 merged PR #535 exact `82b20b293f0a5f0ac0e69857c1b61dddfe478491`, merged PR #540 exact `05bc2d47c3899ebe17538070f9a30172f90307ac`, merged PR #542 exact `ca839298fcaeec409091dc909789b6f87eb67fdc`, merged PR #547 exact `30b7e7e5cdab8de65715834a16f994b2047eafa6`, merged PR #550 exact `f2ec2dc6709814070cc3e3d6932ce280aee966db`, merged PR #553 exact `3bd9f543e97ce856f78b1c608141436298ce9e74`, merged PR #558 exact `2f91bf8641212ecae435b5fbcc9084cc0acd6295`, merged PR #556 exact `860714cba46dba06260a5dce09d0e9152fcb0a8c`, merged PR #560 exact `5aab7c098f3478069127f34e398326415ec599a4`와 이후 external-extension lifecycle/operability source integrations #574, #577, #578, #579, #580, #581, #582, documentation-authority integration #583, procedural graph source integrations #585/#586, doctoring/canonical-documentation integrations #587/#588/#590/#595, workflow-backed current-state integration #589, procedural decision/evaluation/authentication integrations #591/#592/#593/#594/#596, State / Checkpoint history integration #597, Policy / Approval CAS integration #601이 포함돼 있다. 이 식별자는 역사 증거이지 open-candidate authority가 아니다.
+Protected history에는 merged PR #535 exact `82b20b293f0a5f0ac0e69857c1b61dddfe478491`, merged PR #540 exact `05bc2d47c3899ebe17538070f9a30172f90307ac`, merged PR #542 exact `ca839298fcaeec409091dc909789b6f87eb67fdc`, merged PR #547 exact `30b7e7e5cdab8de65715834a16f994b2047eafa6`, merged PR #550 exact `f2ec2dc6709814070cc3e3d6932ce280aee966db`, merged PR #553 exact `3bd9f543e97ce856f78b1c608141436298ce9e74`, merged PR #558 exact `2f91bf8641212ecae435b5fbcc9084cc0acd6295`, merged PR #556 exact `860714cba46dba06260a5dce09d0e9152fcb0a8c`, merged PR #560 exact `5aab7c098f3478069127f34e398326415ec599a4`와 이후 external-extension lifecycle/operability source integrations #574, #577, #578, #579, #580, #581, #582, documentation-authority integration #583, procedural graph source integrations #585/#586, doctoring/canonical-documentation integrations #587/#588/#590/#595, workflow-backed current-state integration #589, procedural decision/evaluation/authentication integrations #591/#592/#593/#594/#596, State / Checkpoint history integration #597, Policy / Approval CAS integration #601, publication-preflight integration #603이 포함돼 있다. 이 식별자는 역사 증거이지 open-candidate authority가 아니다.
 
 이 baseline과 executable documentation-authority test는 active documentation-authority lane 하나만 write한다. mutation 직전 open PR/Issue/branch를 fresh-read해 writer를 결정하며 merged/closed historical PR 번호를 active sole writer로 고정하지 않는다. 다른 feature lane의 과거 baseline blob은 ordinary/non-force semantic convergence 때 current authority로 승계하지 않는다.
 
@@ -18,7 +18,7 @@ Noema Core Domain은 Agent Runtime과 Workflow / Task Execution이다. Tool / Ca
 
 `contextual-orchestrator`는 provider/model discovery, routing, retry/failover, test-time compute와 provider credential을 소유한다. Noema는 released gateway contract와 canonical `orchestrator/free` alias를 소비하며 direct provider SDK, provider key, provider/model/group fallback policy를 소유하지 않는다. `.github`는 organization reusable workflow/control-plane source다. Keyverse는 identity backend다. `quarantine-sandbox-runtime`, Wardnet, EgressWeave, AppGuardrail은 각자의 isolation/security/outbound/scanning truth를 소유한다. Noema는 그 owner evidence를 reference/pin으로 소비할 뿐 foreign implementation이나 domain table을 복제하지 않는다. Cross-service SQL과 mutable sibling PR dependency는 금지한다.
 
-Baseline의 요구·설계·데이터·경계 authority는 `docs/PRD.md`, `docs/TRD.md`, `docs/UML.md`, `docs/ERD.md`, `docs/CONTEXT_MAP.md`다. 이 register는 그 문서와 ADR을 대체하지 않고 current Gap/Action/Status를 exact source·PR·workflow evidence에 결합한다. ADR 0015는 protected source에 포함됐지만 상태는 `Proposed`이며 production activation-authority integration, deployed lifecycle operability/recovery evidence, immutable shared-contract consumption, live pilot와 release evidence가 남아 있다. ADR 0017도 `Proposed`다. Protected #585/#586은 bounded Noema Agent Runtime advisory graph/session mechanics, deterministic direct-child screening, caller-supplied fresh authenticated lifecycle snapshot에 대한 running-only projection을 구현했다. Protected #589는 workflow-backed execution에 한해 기존 execution-scoped Workflow / Task Execution Durable Object를 매 guidance decision 전에 다시 읽고, locally admitted session과 re-admitted plan의 execution identity를 durable lookup 전에 검증하는 current-state ACL을 추가했다. Protected #591/#592/#593/#594/#596은 candidate-decision provenance, exact paired evaluation-receipt identity, evaluation-envelope binding, separately authenticated signed evaluator handoff와 rejection/disposition binding을 구현했고 #595는 그 signed-handoff 상태를 canonical TRACEABILITY에 수렴시킨 documentation integration이다. Protected #597은 기존 State / Checkpoint 경계 아래 bounded durable evaluation/rejection history를 추가했다. Protected #601은 이 history의 exact current position과 independently supplied policy decision을 결합해 append-only digest-linked approval/revocation events를 기록하는 별도 Noema Policy / Approval CAS ledger를 추가했다. `approve_for_pilot`과 `revoke`는 monotonic approval-version CAS 및 exact replay semantics를 갖지만 모든 event/snapshot은 `activationAuthorized:false`다. Non-workflow lifecycle freshness, released wire contracts, live Keyverse/owner signer trust selection, deployed Durable Object compatibility/p95/recovery, fresh publication-time State / Checkpoint + Policy / Approval reconciliation, graph publication, canary/rollback과 product-outcome authority는 여전히 별도다.
+Baseline의 요구·설계·데이터·경계 authority는 `docs/PRD.md`, `docs/TRD.md`, `docs/UML.md`, `docs/ERD.md`, `docs/CONTEXT_MAP.md`다. 이 register는 그 문서와 ADR을 대체하지 않고 current Gap/Action/Status를 exact source·PR·workflow evidence에 결합한다. ADR 0015는 protected source에 포함됐지만 상태는 `Proposed`이며 production activation-authority integration, deployed lifecycle operability/recovery evidence, immutable shared-contract consumption, live pilot와 release evidence가 남아 있다. ADR 0017도 `Proposed`다. Protected #585/#586은 bounded Noema Agent Runtime advisory graph/session mechanics, deterministic direct-child screening, caller-supplied fresh authenticated lifecycle snapshot에 대한 running-only projection을 구현했다. Protected #589는 workflow-backed execution에 한해 기존 execution-scoped Workflow / Task Execution Durable Object를 매 guidance decision 전에 다시 읽고, locally admitted session과 re-admitted plan의 execution identity를 durable lookup 전에 검증하는 current-state ACL을 추가했다. Protected #591/#592/#593/#594/#596은 candidate-decision provenance, exact paired evaluation-receipt identity, evaluation-envelope binding, separately authenticated signed evaluator handoff와 rejection/disposition binding을 구현했고 #595는 그 signed-handoff 상태를 canonical TRACEABILITY에 수렴시킨 documentation integration이다. Protected #597은 기존 State / Checkpoint 경계 아래 bounded durable evaluation/rejection history를 추가했다. Protected #601은 이 history의 exact current position과 independently supplied policy decision을 결합해 append-only digest-linked approval/revocation events를 기록하는 별도 Noema Policy / Approval CAS ledger를 추가했다. `approve_for_pilot`과 `revoke`는 monotonic approval-version CAS 및 exact replay semantics를 갖지만 모든 event/snapshot은 `activationAuthorized:false`다. Protected #603은 현재 State / Checkpoint와 Policy / Approval을 안정적인 double-read window에서 다시 읽고, moving authority와 current revocation을 실패-폐쇄하며 exact graph/history/evaluator/signer/approval identity 일치를 요구하는 Noema Policy / Approval publication preflight를 추가했다. 이 preflight receipt는 `publicationAuthorized:false`와 `activationAuthorized:false`를 유지한다. Non-workflow lifecycle freshness, released wire contracts, live Keyverse/owner signer trust selection, deployed Durable Object compatibility/p95/recovery, 실제 graph publication transaction, canary/rollback과 product-outcome authority는 여전히 별도다.
 
 ## Integrated exact-claim evidence — issue #555 / merged PR #556
 
@@ -62,7 +62,7 @@ This source chain does not complete #561. A genuinely new `active` transition re
 
 Operational acceptance still requires the actual deployed SQLite Durable Object: realistic current-read and contended-append denominators with evaluator-computed p95 ≤20 ms where synchronous, exactly-one-winner CAS contention, >128-event audit/restart continuity, malformed/truncated state rejection, exact-object storage growth, PITR or equivalent recovery rehearsal, and deployment/release provenance authenticating the producer. Local/workerd timing, namespace storage charts, synthetic evidence and self-asserted JSON do not satisfy that boundary.
 
-## Protected procedural graph advisory source — issue #584 / merged #585 + #586 + #589 + #597 + #601
+## Protected procedural graph advisory source — issue #584 / merged #585 + #586 + #589 + #597 + #601 + #603
 
 Protected source includes the library-only Agent Runtime procedural graph aggregate, its execution-lifecycle projection, and the workflow-backed current-state ACL. The graph boundary uses strict descriptor-safe input, immutable tenant/task/graph snapshots, canonical content/structure identities, module-local graph/session admission, canonical execution identity, cycle-safe bounded directed context and explicit unknown/budget abstention. Candidate screening accepts only an admitted direct child under exact paired held-out evidence, rejects training/holdout leakage, incomplete/duplicate cases, invalid scores, candidate safety violations and measured mean regression, and retains `activationAuthorized: false` for every decision. `guideProceduralExecution()` projects context only from a locally admitted session when the caller supplies a fresh authenticated same-execution `running` lifecycle snapshot; accepted, cancellation-requested and terminal states suppress guidance. Protected #589 adds a read-only workflow-backed ACL that verifies session/plan execution identity before durable lookup and re-reads the existing Workflow / Task Execution owner before every decision so current cancellation, terminal work and pre-start evidence suppress guidance. Neither adapter becomes a second lifecycle store or approval/activation authority.
 
@@ -70,9 +70,11 @@ Protected #591/#592/#593/#594/#596 additionally bind process-local candidate-dec
 
 Protected #601 adds the distinct Noema Policy / Approval CAS ledger. It consumes the current admitted State / Checkpoint history snapshot plus an independently supplied exact policy decision and binds candidate graph digest, evaluation-history version/head, evaluation envelope, authenticated evaluator handoff, signer key id and expected approval version into an append-only digest chain. `approve_for_pilot` requires the latest history to remain eligible with validation non-regression; explicit `revoke` may bind a newer authenticated non-eligible regression history only from an already approved prior state. Exact replay is idempotent and stale writers lose monotonic approval-version CAS. Every retained approval event/snapshot remains `activationAuthorized:false`; point-in-time approval evidence is not publication or activation authority.
 
-Noema does not absorb downstream owners to complete this lane. Released procedural graph wire/schema identity belongs to `context-graph-contracts`; enterprise adoption and decision records to `enterprise-architecture-core`; model discovery/routing to `contextual-orchestrator`; credentials and live signer trust selection to Keyverse/owner composition; graph content, evaluation design and production outcome truth to the consuming product. Protected graph/session identity, `eligibleForApproval`, authenticated handoff, retained State / Checkpoint history, or a #601 approval snapshot are Noema evidence, not tool, lifecycle, publication or activation authority. This source adds no provider SDK/key, second Workflow / Task or lifecycle store, product-domain graph store, HTTP activation route or automatic model refiner.
+Protected #603 adds the Noema Policy / Approval publication preflight. It rereads the admitted current State / Checkpoint history and Policy / Approval snapshots twice, proves that both positions stayed stable across the overlapping read window, rejects a currently revoked approval, and requires the candidate graph, evaluation history, evaluator handoff, signer and approval identities to agree exactly. The process-local admitted preflight receipt remains `publicationAuthorized:false` and `activationAuthorized:false`; it is not a graph publication transaction, lifecycle authority, Keyverse trust selector or activation capability.
 
-Source integration is complete for #585/#586/#589, #591/#592/#593/#594/#596, #597 and #601; #595 is documentation-only convergence. ADR 0017 remains `Proposed` until immutable released contracts, live Keyverse/owner trust selection, non-workflow current-lifecycle/revocation authority, deployed Workflow / Task, State / Checkpoint history and Policy / Approval compatibility plus synchronous buyer-path p95/recovery evidence, fresh publication-time State / Checkpoint + Policy / Approval reconciliation, graph publication, canary/rollback evidence and product-owner production outcome evidence exist. Canonical documentation must describe that separation without treating historical PR numbers as moving current authority.
+Noema does not absorb downstream owners to complete this lane. Released procedural graph wire/schema identity belongs to `context-graph-contracts`; enterprise adoption and decision records to `enterprise-architecture-core`; model discovery/routing to `contextual-orchestrator`; credentials and live signer trust selection to Keyverse/owner composition; graph content, evaluation design and production outcome truth to the consuming product. Protected graph/session identity, `eligibleForApproval`, authenticated handoff, retained State / Checkpoint history, a #601 approval snapshot, or a #603 publication preflight receipt are Noema evidence, not tool, lifecycle, publication or activation authority. This source adds no provider SDK/key, second Workflow / Task or lifecycle store, product-domain graph store, HTTP activation route or automatic model refiner.
+
+Source integration is complete for #585/#586/#589, #591/#592/#593/#594/#596, #597, #601 and #603; #595 is documentation-only convergence. ADR 0017 remains `Proposed` until immutable released contracts, live Keyverse/owner trust selection, non-workflow current-lifecycle/revocation authority, deployed Workflow / Task, State / Checkpoint history, Policy / Approval and publication-preflight compatibility plus synchronous buyer-path p95/recovery evidence, an actual graph-publication transaction consuming the exact admitted #603 preflight, canary/rollback evidence and product-owner production outcome evidence exist. Canonical documentation must describe that separation without treating historical PR numbers as moving current authority.
 
 ## Protected workflow-backed procedural current-state ACL — merged PR #589
 
@@ -96,7 +98,7 @@ PR 0은 useful work를 닫아 제조하지 않는다. Open lane은 normal merge
 | --- | --- | --- | --- | --- | --- | --- |
 | P0 | Exact-claim evidence supply chain | Tool/research claim이 producer evidence 없이 reviewer authority가 될 위험 | protected #556 + release/consumer lanes | Source integrated; producer/release/consumer open | protected source + execution/research producer + immutable Noema release + released central consumer corpus RED→GREEN | release/producer evidence를 별도 lane에서 완성 |
 | P0 | External extension lifecycle evidence | third-party extension의 stale/revoked authority, process-local lifecycle, forged operability 또는 unbound storage/recovery evidence가 runtime truth로 오인될 위험 | protected #574/#577/#578/#579/#580/#581/#582 + issue #561 | Lifecycle/SQLite DO source integrated; production activation adapter + deployed operability/recovery/release evidence open | immutable source + Noema Policy/Approval + immutable foreign-owner refs + append-only lifecycle/CAS/restart + exact deployed p95/contention/storage/recovery + deployment/release provenance | fail-closed `active`를 유지하고 immutable owner-issued refs가 준비된 뒤 production adapter를 연결한 후 actual deployed #561 acceptance를 실행 |
-| P0 | Procedural graph advisory activation boundary | deterministic graph/session/screening, authenticated evaluation, retained history 또는 point-in-time approval이 durable publication/activation이나 product authority처럼 소비될 위험 | protected #585/#586/#589/#591/#592/#593/#594/#596/#597/#601 + issue #584 | Advisory/runtime/evaluation-auth/history/Policy-Approval CAS source integrated; publication/activation intentionally unavailable | protected exact source + released `context-graph-contracts` contract + live owner/Keyverse signer trust + deployed current-state/history/Policy-Approval evidence + fresh publication-time State / Checkpoint + Policy / Approval reconciliation + graph publication/canary/rollback + product-owner outcome evidence | live trust-selection owner path를 검증하고 publication-time cross-authority reconciliation을 별도 successor로 test-first 구현하되 `activationAuthorized:false`를 유지 |
+| P0 | Procedural graph advisory activation boundary | deterministic graph/session/screening, authenticated evaluation, retained history 또는 point-in-time approval/preflight가 durable publication/activation이나 product authority처럼 소비될 위험 | protected #585/#586/#589/#591/#592/#593/#594/#596/#597/#601/#603 + issue #584 | Advisory/runtime/evaluation-auth/history/Policy-Approval CAS/publication-preflight source integrated; publication/activation intentionally unavailable | protected exact source + protected #603 admitted preflight + released `context-graph-contracts` contract + live owner/Keyverse signer trust + current lifecycle/revocation + deployed current-state/history/Policy-Approval/preflight evidence + actual graph publication/canary/rollback + product-owner outcome evidence | publication은 fail-closed로 유지한다. immutable `context-graph-contracts` release, live Keyverse/owner trust, current non-workflow lifecycle/revocation evidence가 준비된 뒤 exact admitted #603 preflight를 소비하는 실제 publication transaction을 test-first로 구현하되 `activationAuthorized:false`를 유지 |
 | P0 | Protected-main governance closure | required Security workflow만으로 PR/review/history/deletion/bypass 통제를 증명했다고 오인할 위험 | issue #27 | Open; external control evidence absent | fresh live ruleset + required PR/review/conversation/history/deletion controls + independent bypass/break-glass evidence + protected-source governance receipt | source가 만들 수 없는 organization/admin control은 issue #27에서 독립 검증 |
 | P0 | Strict orchestrator/free consumer release | source 통합만으로 immutable consumer activation을 증명할 수 없음 | merged #535 + release lane | Source integrated; release/consumer open | version/tag/package/SBOM/provenance/reproducibility/rollback + released consumer | release-ready protected head에서만 publication |
 | P0 | Patch-validator operational publication | source/image CI success만으로 reusable immutable runtime을 증명할 수 없음 | issue #66 | Open; publication evidence absent | protected execution + immutable image/signature/SBOM/provenance/reproducibility/rollback | protected-main operational image receipt 뒤 immutable publication/signing/attestation/activation을 별도 증거로 완성 |
diff --git a/test/procedural-publication-preflight-protected-documentation.test.ts b/test/procedural-publication-preflight-protected-documentation.test.ts
new file mode 100644
index 000000000..75d3b23cb
--- /dev/null
+++ b/test/procedural-publication-preflight-protected-documentation.test.ts
@@ -0,0 +1,39 @@
+import { readFileSync } from "node:fs";
+import { describe, expect, it } from "vitest";
+
+const canonicalDocuments = [
+  "ARCHITECTURE.md",
+  "docs/PRD.md",
+  "docs/TRD.md",
+  "docs/TRACEABILITY.md",
+  "docs/product-technical-gap-baseline.md",
+] as const;
+
+describe("protected procedural publication-preflight documentation authority", () => {
+  it("classifies merged #603 as protected preflight without promoting publication or activation", () => {
+    for (const path of canonicalDocuments) {
+      const content = readFileSync(path, "utf8");
+      expect(content).toContain("#603");
+      expect(content).toContain("publication preflight");
+    }
+
+    const architecture = readFileSync("ARCHITECTURE.md", "utf8");
+    const prd = readFileSync("docs/PRD.md", "utf8");
+    const trd = readFileSync("docs/TRD.md", "utf8");
+    const traceability = readFileSync("docs/TRACEABILITY.md", "utf8");
+    const baseline = readFileSync("docs/product-technical-gap-baseline.md", "utf8");
+    const changelog = readFileSync("CHANGELOG.md", "utf8");
+
+    for (const content of [architecture, prd, trd, traceability, baseline]) {
+      expect(content).toContain("publicationAuthorized:false");
+      expect(content).toContain("activationAuthorized:false");
+    }
+
+    expect(changelog).toContain("PR #603");
+    expect(changelog).toContain("publication preflight");
+    expect(baseline).toContain("ADR 0017도 `Proposed`다.");
+    expect(baseline).toContain("graph publication");
+    expect(baseline).toContain("532cfaadf655d3158434db8a1c3a985a33ad3a9f");
+    expect(baseline).not.toContain("#603 candidate");
+  });
+});