A merge changes production state, which makes the release gate an authority gate. If the fail-closed merge check cannot resolve, the merge halts. It does not proceed on the assumption that green-enough is good enough.
Teams guard runtime mutations carefully and then merge to main on a glance at a checkmark. But a merge is a state mutation — often the most consequential one, the moment a change crosses from proposal into what runs. If the gate in front of it cannot conclusively resolve and still lets the merge through, the release boundary is governed by optimism.
The merge gate is an authority gate at a different altitude. Its check evaluates the actual merge state, and on anything it cannot resolve — a degraded signal, an ambiguous result, a missing required check — it halts. Default-deny does not stop at runtime; it belongs at every boundary where intent becomes durable state, and the merge is one of them.