Avi Heartbeat blocked review: carl: merge-ready - Primary review found the DevOps gate hardening ready: acceptance covered, CI and DoR green, targeted local checks pass, and merge safety is clean.; alex: request-changes - Light review found one blocking ship-preflight auto-clean safety gap; CI, focused tests, and dor-check are green otherwise.

Two blockers. (1) Auto-clean data-loss gap: autocleanable? proves the dirty FILES are on origin/release but never checks the local main TIP — a primary with an unpushed local commit plus the routine release-identical merge noise passes all four facts, and autoclean_primary!'s git reset --hard origin/main silently orphans the unpushed commit (before this PR that state aborted loudly). Fix: gather head_at_origin_main in reconcile_offender (git merge-base --is-ancestor HEAD origin/main), require it in autocleanable?, and add the ahead-main + release-identical-dirt REFUSED case to the real-git adversarial matrix in test/lib/release_cli_test.rb (with_primary_repo never starts ahead, so the matrix misses it). Also fix the self-contradicting file_on_release? comment ('an untracked-but-identical file reconciles' is false — the code correctly refuses all untracked). (2) Rebase on origin/release: PR #352 landed the same board_cleared_block.spec.js untag with different comment wording, so #361 is CONFLICTING against the updated base. After both: re-certify — cert goes STALE on any post-cert commit, and your own new dirty-tree guard enforces commit-then-cert order.

Avi Heartbeat blocked review: carl: request-changes - Request changes: direct bin/dor-check crashes before the new fingerprint-delta verdict unless run under Ruby 3.3.11; targeted logic passes under the intended Ruby.; alex: merge-ready - Light review found no blockers. DevOps gate behavior matches acceptance, DoR and CI are green, targeted tests and RuboCop pass under Ruby 3.3.11, and dry merge into current origin/release is conflict-free.