Status: CANONICAL PRE-ACTIVATION STRATEGY / PRODUCTION_NO_GO

The private control repository is under heavy parallel development. PR #392 drifted by 47 commits before it could be validated. Its successor PR #412 then drifted by another 43 commits while GitHub Actions remained unable to allocate a private hosted runner.

Keeping a long-lived activation PR open therefore creates stale-base churn without increasing evidence. The canonical strategy is now just-in-time materialization.

This capsule preserves the five R2 bootstrap files copied byte-for-byte from the last reconciled successor snapshot. The copy audit is 5/5 exact.

Three files are static and must be materialized unchanged:

• .github/workflows/continuity-r2-observe.yml
• tools/continuity-r2/EXPECTED_PACKAGE.json
• tools/continuity-r2/snapshot_guard.py

Two files are template sources and must be reconciled to the live GitHub state at materialization time:

• tools/continuity-r2/LIVE_STATE.json
• tools/continuity-r2/README.md

The historical PR number, main SHA, drift counts, observer run IDs and external-runtime version inside those two source snapshots are evidence, not reusable authority.

1. Confirm the private repository identity and read the exact current main SHA.
2. Confirm an execution substrate is available. Do not create an activation PR while the observer is known to fail before runner assignment.
3. Create a fresh branch from that exact current main SHA.
4. Reconcile LIVE_STATE.json and README.md to the just-observed state. Preserve production_go=false, merge-disabled state and all unresolved gates.
5. Materialize all five files onto the branch. Prefer one Git tree/commit so the bootstrap lands atomically.
6. Open one DRAFT PR. Do not reuse or reopen historical PRs.
7. Re-read main. If the base moved and the candidate no longer descends from current main, abandon the PR and restart from step 1. Never force-push around authority drift.
8. Obtain a TEST_ONLY receipt from the dedicated external authorizer, bound to the exact PR number, base SHA, head SHA, package SHA-256 and evidence SHA-256.
9. Run the GitHub observer. A job that fails before runner assignment is not observer evidence and cannot advance the gate.
10. Require a green observer receipt plus independent review of the exact PR snapshot.
11. Only then may a separately enabled MERGE_PR authorization be considered.
12. Product/production authorization remains a different gate and is never inferred from installing the observer.

Abort and rematerialize if any of the following changes before merge:

• PR head SHA;
• relevant base/main authority;
• sealed control-package SHA-256;
• repository identity;
• external-authorizer implementation or trust root;
• observer workflow bytes;
• unresolved-gate truth.

A historical TEST_ONLY receipt is never transferable to a new PR/head/base.

• private GitHub execution substrate: blocked before runner allocation;
• Dedicated GitHub App custody: unresolved;
• external deploy-provider credential/runtime: unresolved;
• native private-repository ruleset/branch enforcement: unavailable on current plan;
• real Codex runtime acceptance: pending exact ACK/response/semantic ACK.

This capsule eliminates stale-PR reconciliation loops. It does not itself authorize merge, deployment or product production.