The product branch changes only through the promotion door

master is never edited or merged into directly, and the checkout that holds it is never used as a work tree by an agent. Once testing is committed and green under UR-09, it reaches master through the repository’s promotion door (today MERGE-GUIDE.md; the generic harness promote of PROMO-DIR replaces it), never a plain git merge; then master is pushed.