diff --git a/.github/codex/maintenance/investigation.md b/.github/codex/maintenance/investigation.md
index 3c75e69..9c0db47 100644
--- a/.github/codex/maintenance/investigation.md
+++ b/.github/codex/maintenance/investigation.md
@@ -9,6 +9,11 @@ artifact installation, or readiness state must change. Cite exact public policy
 commit and digests. Do not independently fetch or classify upstream PHP data.
 Return GO only when every criterion passes and unresolved is empty.
 
+Treat `requiredChecks` as downstream exact-head gates, not investigation-phase
+advisory checks. Declare them in the plan, but do not run them in this read-only
+phase or treat their not-yet-run status as unresolved; writable deterministic
+jobs execute them before merge.
+
 The plan must cite each of the four records in `policy-capture.json` exactly
 once. Each evidence item has `captureId`, the captured `digest`, and a
 `locator` with `kind: json_pointer` and a resolving JSON Pointer `value`.
diff --git a/.github/workflows/maintenance-consumer.yml b/.github/workflows/maintenance-consumer.yml
index c8facd2..9769649 100644
--- a/.github/workflows/maintenance-consumer.yml
+++ b/.github/workflows/maintenance-consumer.yml
@@ -75,7 +75,7 @@ jobs:
               actionKey:$actionKey,
               preconditions:{misePhpHead:$misePhpHead,phpBinPolicyCommit:$phpBinPolicyCommit,supportPolicyDigest:$supportPolicyDigest,policyInvariantsDigest:$policyInvariantsDigest,phpBinOperatorCommit:$phpBinOperatorCommit,operatorState:$operatorState},
               allowedAuthority:["read_repository","read_captured_policy"],
-              nonGoals:["upstream_php_classification","repository_mutation","irreversible_github_effect"],
+              nonGoals:["upstream_php_classification","repository_mutation","required_check_execution","irreversible_github_effect"],
               completionCriteria:[
                 {id:"phase-goal-correct",requirement:"The goal matches exact inputs.",evidenceRequired:"Exact preconditions."},
                 {id:"policy-difference-explained",requirement:"Every required local change is bound to captured policy.",evidenceRequired:"Policy digest and JSON locator."},
diff --git a/test/test_maintenance.py b/test/test_maintenance.py
index 4add3d5..c3a6e26 100644
--- a/test/test_maintenance.py
+++ b/test/test_maintenance.py
@@ -70,6 +70,19 @@ def test_protected_controls_are_not_admissible(self):
         self.assertTrue(protected("readiness/new-branch.json"))
         self.assertFalse(protected("lib/releases.lua"))
 
+    def test_investigation_defers_required_checks_to_writable_jobs(self):
+        root = pathlib.Path(__file__).resolve().parents[1]
+        instructions = (root / ".github/codex/maintenance/investigation.md").read_text()
+        consumer = (root / ".github/workflows/maintenance-consumer.yml").read_text()
+        self.assertIn("Treat `requiredChecks` as downstream exact-head gates", instructions)
+        self.assertIn("do not run them in this read-only", instructions)
+        self.assertIn("not-yet-run status as unresolved", instructions)
+        self.assertIn(
+            'nonGoals:["upstream_php_classification","repository_mutation",'
+            '"required_check_execution","irreversible_github_effect"]',
+            consumer,
+        )
+
     def test_policy_capture_urls_are_commit_pinned(self):
         sha = "a" * 40
         policy, invariants = pinned_policy_urls(sha)