[Troublor]

What this does

Settlement stops being "merge a settle PR" and becomes a decision read from repository state. A release branch nobody touched produces no settle PR at all, and an explicit versioned workflow_dispatch tags the candidate PR's merge commit - the commit that already sits on the default branch - behind the review-gated publish environment. When the branch does carry fixes, today's settle PR remains and merging it is still the approval.

Shape

Behaviour	Before	After
Clean branch	a dated entry re-committed, plus an --allow-empty settlement commit and a PR	settled=false; identity, notes and PR steps all skipped
Tag placement	always on the settle merge commit	on the candidate merge commit when the branch is unchanged
Changelog heading	dated at settle	undated; the Release body is the tagged tree's section verbatim
Dispatch	refreshed settle PRs only, never published	publishes on clean/resume, refreshes otherwise, skips when already published
Stale entry	undetectable	--section-matches makes a stale section needs-settle-pr; publish refuses to tag one
Candidate drift	nothing refreshed it	stage: refresh merges the PR's own base (never rebases) and re-drafts
Credentials	app credentials inside release	repository scope; only the tag/Release and upload jobs sit behind publish
Lint L2	required environment: release	exact file allowlist for the release workflows; L2' + unchanged L1/L3/L4/L6

Verification

Local only - no workflow has executed this code:

• python3 -m unittest discover -s .github/actions/release-tools - 84 tests OK
• python3 -m unittest discover -s .github/scripts - 85 tests OK
• action_docs.py --check - documentation up to date
• app_token_lint.py --repo my-repo workflow-templates/ - 5 files clean
• route() driven end to end with the payload the route action emits: clean -> publish with pr_number, resume -> publish at the tagged SHA, open settle PR -> refresh, published -> skip, push -> never publish

Known gaps, deliberately not hidden

• The plan's acceptance tests for the clean-state no-op, the publish verification and the refresh stage are not written yet (audit R1). This is why the plan's F1 audit still fails.
• actions-test.yml has never run - no act on the authoring host.
• No live release has been attempted: megaeth-labs/test-release-pipeline is unreachable (404), so cases A-D and the adversarial probes are unproven.
• Route's dispatch path does not compute section_matches; a stale section there is refused loudly at publish, not routed to refresh.
• The publish environment still needs its one required reviewer (owner console action).

Consumer impact

Nothing changes for a repo until it copies these templates. release-v2.3.0 and PR #2551 in mega-reth are untouched by this branch and publish through the existing marker path.