developer(ET): auto-commit from developer run_id=355

src/config.py

@@ -374,6 +374,27 @@ class Settings(BaseSettings):
     reaper_finalize_grace_s: int = 300
     lease_reclaim_enabled: bool = True
 
+    # ORCH-071: merge-verify under-gate on the `deploy -> done` edge. For the
+    # self-hosting repo the `deploy` stage runs the DETERMINISTIC self-deploy path
+    # (Phase A/B/C), where the LLM `deployer` agent — historically the ONLY actor
+    # that merged the feature PR into `main` — never runs. Result: a "green" deploy
+    # could reach `done` while the PR stayed `open` (phantom merge, postmortem
+    # LESSONS_2026-06-08). This under-gate (врезка in advance_stage, NOT a new
+    # STAGE_TRANSITIONS edge or registered QG) runs a deterministic merge-actor +
+    # post-deploy verification before `done`: not-merged -> alert + HOLD (no done),
+    # merged -> normal advance. Mirrors merge_gate_* / image_freshness_* rollout.
+    #   merge_verify_enabled  -> global kill-switch; False -> strictly the prior
+    #                            behaviour (no merge/verify), env ORCH_MERGE_VERIFY_ENABLED.
+    #   merge_verify_repos    -> CSV of repos where the under-gate is REAL; empty ->
+    #                            only the self-hosting repo (orchestrator). Mirrors
+    #                            merge_gate_repos / self_deploy_repos.
+    #   merge_pr_timeout_s    -> per Gitea merge/list HTTP call timeout.
+    #   merge_verify_timeout_s-> git fetch/merge-base timeout for the ancestor check.
+    merge_verify_enabled: bool = True
+    merge_verify_repos: str = ""
+    merge_pr_timeout_s: int = 60
+    merge_verify_timeout_s: int = 60
+
     # Telegram notifications
     telegram_bot_token: str = ""
     telegram_chat_id: str = ""