A push after a human approval costs a full xhigh review, because the required check honours no local override nf-rh1 ← Beads

Twinned from https://github.com/cfsh/ninefold/issues/840 by tools/beads/import_github.py's reconcile pass.

Unclaimed, and it is a governance question rather than a code one — @aedanpope's call, not a session's.

What happens

Ruleset 20540766 is enforcement: active and requires the merge-authority check. That check is published from nflib.authority.decide(), which includes verdict freshness. merge_pr.py's local hatches (STALE_OK, UNCONVERGED_OK) bind the tool and cannot bind the ruleset — correctly, that is the point of a required check.

The consequence: after a human approval, any further push re-blocks the merge server-side, and the only unblock available to a session is a fresh synchronous xhigh review. review_now.py --reconcile-only cannot help — it republishes from the same decide(), which is still stale.

Measured on #829

@aedanpope approved at 03:20Z, with an inline ask (avoid historical language) and *"fix the comment and merge no need to request review_now again"*.

| push | why it happened | cost | |---|---|---| | 0bdef05 | the inline ask itself | 1 xhigh round | | 1ac00b8 | a real bug the merge attempt exposed | 1 xhigh round | | 7b017e6 | the round-3 finding on that fix | 1 xhigh round | | dfc63df | rebase onto #827 | 1 xhigh round |

Four rounds after the approval. One of them found something (the round-3 ledger-pollution finding, real and mine). The other three were freshness, not review — including the rebase, which changed one import line, and the round that reviewed a doc-prose edit.

⚠️ The instruction *"no need to review_now again"* was not followable. That is the part worth deciding on: an operator's explicit "land it" cannot be honoured by the tooling as it stands, and the session either burns the rounds or stops and hands the merge back.

Options, no recommendation — this is a trust call

1. Leave it. Every landed sha is genuinely bot-reviewed; the cost buys that. The status quo is defensible and this issue is then just the note explaining the cost.
2. A bypass actor for jcantsp-bot — ⚠️ bypass_actors is per RULESET, and this one also carries deletion and non_fast_forward (notes/merging.md). Wrong instrument; recorded so nobody reaches for it.
3. Split freshness out of the published check, leaving it a pure authority check and keeping freshness as a merge_pr.py precondition (where STALE_OK already reaches it). Narrow, and it makes the check mean one thing.
4. A cheap freshness re-certification — a no-model review_now mode that re-stamps the existing verdict onto a new sha when the diff since the reviewed sha is trivial by some rule. ⚠️ It is a rule about *what counts as trivial*, which is precisely the judgment the reviewer exists to make; probably the most dangerous of the four.

Refs #829, #784, #763, design 006 §4 Option F.