Status: PASS / JIT_PREPARER_READY / BROKER_CUSTODY_PENDING / DEPLOY_DISABLED / PRODUCTION_NO_GO

Implementation: R2_DEPLOYER_CONTROLLER_V3_5_JIT_ACTIVATION_PREPARER.

V3.5 adds a fail-closed JIT activation preparation endpoint without adding Git ref write or merge authority:

POST /v3/jit/prepare-activation

The endpoint is root-authenticated, requires the dedicated GitHub App broker to be ready, refuses to operate while deploy is enabled, verifies all five dormant R2 bootstrap files, pins the three static Git blobs, creates/reuses only one DRAFT R2 activation PR, refreshes that PR against exact current main through GitHub's pull-request update-branch API, revalidates main after refresh, aborts on main drift, rechecks static pins, verifies final lineage, and emits only a preparation receipt for the next signed-external-observer gate.

It does not call Git ref write endpoints and does not call a merge endpoint. It returns merge_authorized=false, deploy_enabled=false, product_production=NO_GO, and production_go=false.

Selftest evaluation while broker custody is intentionally unavailable: 01a04c0b-7f91-7519-8a4a-0286b5f2dd36 — PASS. Unauthenticated JIT preparation returned 401; authenticated preparation stopped at broker custody with 424 CUSTODY_NOT_READY before any GitHub mutation.

Independent static source audit: 19/19 PASS across draft-only behavior, no direct ref write, no merge endpoint, exact static pins, five-file verification, duplicate R2 PR guard, pre/post main revalidation, post-refresh pin recheck, final lineage, audit event, unchanged authorizer pin, preserved merge gates and global NO_GO.

The provider adapter remains GITHUB_REST_2026_03_10_IMPLEMENTED. Actual JIT PR creation is deliberately impossible until the dedicated GitHub App is created and installed on the exact private repository.