Follow-up: Make priority review dispositions replayable in merge closeout

[justin808]

Audit ledger: not applicable (non-release audit)

Context

A full post-merge audit of shakacode/react_on_rails covered the merge window:

• Audit id: 2026-07-01-independent-closeout-full
• Base: 575922ff3e2d50f8750877e8847fe7d2c79b995c
• Head: edb02c7c6be18a2919e9398ee1275d114d21a2ed
• Audited PRs: [Pro] Fix Gemfile loader source encoding under C locale react_on_rails#4281, Remove stale Pro RSpec encoding workaround react_on_rails#4291, Add Rails response type generation react_on_rails#4259, Add typed Rails action helper react_on_rails#4260, Hide legacy Redux install generator path react_on_rails#4277, Docs: frame Redux as legacy shared-store guidance react_on_rails#4278, Document bounded coordination audit fallback react_on_rails#4283, [codex] Wire release harnesses into CI react_on_rails#4266, Adopt agent-workflow binstubs (.agents/bin/ + AGENTS.md pointer) react_on_rails#4264, [Pro] Add buffered RSC rendering helpers for static pages react_on_rails#4268

The code audit found no release-blocking defect, but several PRs were not machine-clean under the merge ledger because priority review findings had no replayable disposition evidence.

Motivating Miss

Manual inspection showed the current code/docs were acceptable, but script/pr-merge-ledger --strict in the consumer repo could not prove that from durable metadata:

• Add Rails response type generation react_on_rails#4259: 4 unknown_priority_finding_disposition findings.
• Add typed Rails action helper react_on_rails#4260: 3 unknown_priority_finding_disposition findings.
• Hide legacy Redux install generator path react_on_rails#4277: 2 unknown_priority_finding_disposition findings.
• Docs: frame Redux as legacy shared-store guidance react_on_rails#4278: 5 unknown_priority_finding_disposition findings.
• Adopt agent-workflow binstubs (.agents/bin/ + AGENTS.md pointer) react_on_rails#4264: 5 unknown_priority_finding_disposition findings.

Those threads were outdated or otherwise manually resolved by later code/review context, but the audit had to reconstruct that by hand.

Process Gap Disposition

• Mechanism target: checklist+replay
• Motivating miss: priority review threads became stale/outdated, and the final PR state was OK, but the merge-readiness ledger could not replay a fixed/waived/deferred/noise disposition.
• Replay evidence or park reason: replay the consumer repo ledger for the affected PRs using the repo's merge-ledger seam and strict mode, then verify each priority finding has a durable disposition with evidence URL and head SHA.
• Non-goal: requiring every stale bot thread to be perfect, or blocking on old non-priority review noise that no longer applies to current head.

Proposed Work

Connect the existing structured-review direction from #39 to merge closeout:

• Define the minimum durable disposition fields for priority review findings: source, finding URL/id, priority/actionability, current-head status, disposition, evidence URL, and head SHA/range.
• Teach pr-batch / address-review / post-merge-audit guidance to require this when a priority finding is fixed, waived, deferred, or rejected.
• Make the post-merge audit path classify missing disposition evidence as an explicit process finding rather than a manual archaeology exercise.
• Keep current-head unresolved review threads stricter than outdated/stale threads; the point is to make stale-thread disposition replayable, not to ignore live blockers.

Acceptance Criteria

• A replay against the affected React on Rails PRs reproduces the disposition gap before sample metadata is added.
• A sample durable disposition block lets the replay classify an outdated priority finding as fixed, waived, deferred, or false positive without reading chat history.
• The shared workflow docs name the consumer repo's merge-ledger seam instead of hardcoding React on Rails commands.
• The issue links to or reuses the structured finding schema work in Follow-up: Define structured review finding output for review and audit skills #39 rather than inventing a competing schema.

Related

• Structured finding schema: Follow-up: Define structured review finding output for review and audit skills #39
• Evidence PRs: Add Rails response type generation react_on_rails#4259, Add typed Rails action helper react_on_rails#4260, Hide legacy Redux install generator path react_on_rails#4277, Docs: frame Redux as legacy shared-store guidance react_on_rails#4278, Adopt agent-workflow binstubs (.agents/bin/ + AGENTS.md pointer) react_on_rails#4264