chore(state): track #145 pending admin action + update Phase-3 counts

- Add pending-admin campaign entry for #145 branch protection config
- Update phase-3-discharge: 31 DISCHARGED (corrected from 36→31 via #148)
- Note proof-check job exists but is NOT yet a required status check
- branch-protection-main: add NOTE about pending admin action

Generated by Mistral Vibe.
Co-Authored-By: Mistral Vibe <vibe@mistral.ai>

Author: hyperpolymath

.machine_readable/6a2/STATE.a2ml

@@ -52,15 +52,16 @@ postulate-keyword-uses = 0
 
 [active-campaigns]
 fork-a-annotation = "complete"
-phase-3-discharge = "in flight — umbrella issue #90, sequencing SafeUrl → SafeRegex → SafeBase64 → SafeEmail. 34 DISCHARGED of ~209 Tier A sites (~16% as of 2026-05-30). PRs #97-124 landed this cycle."
+phase-3-discharge = "in flight — umbrella issue #90, sequencing SafeUrl → SafeRegex → SafeBase64 → SafeEmail. 31 DISCHARGED of ~209 Tier A sites (~15% as of 2026-06-01, corrected from 36→31 via #148 honesty audit). PRs #97-124 + #144 landed this cycle."
 fork-b-discharge = "triage open — quick-wins flagged in PROOF-NEEDS.md (SafeCrypto isSecure refactor; SafePath already-Refl pairs)"
+pending-admin = "#145: configure GitHub branch protection to require proof-check status check on main (admin-only action: Settings → Branches → Add proof-check to required checks)"
 
 [ci-infrastructure]
 # 2026-05-30 session — workflow hardening
 fuzzing = "ClusterFuzzLite + cargo-fuzz; 4 fuzz targets on FFI parse surface (safe_url_parse, safe_email_is_valid, safe_json_is_valid, safe_path_has_traversal). Per-PR + weekly batch; PR #121. Replaces prior broken setup (pointed at nonexistent dir + AGPL header)."
 concurrency-cancel = "added to architecture-enforcement.yml, idris2-ci.yml, zig-ffi.yml, trustfile.yml, boj-build.yml. PR #115."
 per-job-timeouts = "added to the same 4 workflows; budget proportional to expected runtime (5-45 min)."
-branch-protection-main = "6 safe settings active: dismiss_stale_reviews, required_linear_history, required_conversation_resolution, required_signatures, allow_force_pushes=false, allow_deletions=false. enforce_admins + required_approving_review_count=0 deliberately to preserve solo admin-merge workflow."
+branch-protection-main = "6 safe settings active: dismiss_stale_reviews, required_linear_history, required_conversation_resolution, required_signatures, allow_force_pushes=false, allow_deletions=false. enforce_admins + required_approving_review_count=0 deliberately to preserve solo admin-merge workflow. NOTE: proof-check job EXISTS (added via #147/#148) but is NOT YET a required status check — admin action pending per #145."
 
 [security-tab-state]
 # 2026-05-30 — Hypatia + CodeQL + Scorecard alert disposition