suggestion (non-blocking): A present-but-malformed submission-plan.json (literal null, a scalar, or an object with no bindable event/body/comments) folds to planStaged === undefined, so rule 7 is skipped silently and the gate still reports conformant — unlike the routing.json parse (dispatch-gate.ts:777-781), which records a present but unparseable note. Run forensics then cannot distinguish plan matched from plan staged but never bound. Consider pushing a note when the plan file exists but parses to undefined/null, mirroring the routing.json precedent. Non-blocking: the null fold is the right fail-open direction and an agent that can rewrite the plan can also delete it, so this is observability, not a new bypass.

suggestion (non-blocking): The no-submission skip gates only on the plan shape (bare comment-less APPROVE), not the prior-review-APPROVED half review.md requires. priorReviews is already an input to evaluateDispatchConformance, but the skip branch never consults it — so on a first run with no prior review, an orchestrator that queues nothing passes green and an earned approval is silently withheld. Consider requiring the latest github-actions[bot] review to already be APPROVED before allowing the skip.

note (non-blocking): Rule 7 binds the queued event, body, and comments to the plan but never compares queued resolves against planStaged.resolve. Rule 6 catches a dropped resolve only as a deficit note, not a block — asymmetric with how event/body/comments are made binding. Likely the benign deficit direction, but worth naming since the rule advertises making the queued outputs match the plan.

nitpick (non-blocking): The plan-comment filter predicate narrows to {path: string; line: number; body: string} but only checks that path and body are strings, never line. It fails closed (a non-numeric line yields a planned key that can never match a queued key, so the run blocks rather than falsely passing), so there is no live defect — the writer always stages numeric lines. But it falls short of the file own defensive-parse convention; adding typeof (comment as {line?: unknown}).line === "number" to the predicate makes the asserted type actually checked and drops a malformed entry the same way a bad path/body already is.

note (non-blocking): .toLowerCase() and the global backtick strip here don't correspond to any gh-aw sanitizer transform (NFKC doesn't case-fold ASCII, and the sanitizer has no backtick strip). Because every fold is symmetric, rule 7's "matches the plan verbatim" guarantee actually tolerates case, backtick, and whitespace changes the orchestrator may freely make. Worth justifying these two folds in the doc (or dropping them) so the binding's real looseness is legible.

suggestion (non-blocking): normalizeBody folds https URLs with \S* (greedy to whitespace), but gh-aw's sanitizer path class is [^\s,] — it stops at commas. A claim discussion with a URL immediately followed by , (or a markdown link whose trailing )/. the two sides split differently) normalizes differently on the plan vs queued sides, so rule 7 false-blocks a byte-faithful submission. Mirror the sanitizer's [^\s,] boundary instead of \S*, and pin tests for URL+comma, URL+), and a markdown link to a redacted host.