diff --git a/.github/AGENTS.md b/.github/AGENTS.md
index 35f0103169..965145639f 100644
--- a/.github/AGENTS.md
+++ b/.github/AGENTS.md
@@ -4,4 +4,6 @@ Run jobs on Windows runners (`windows-*` labels) under native `pwsh`. Native Win
 
 The manual [Windows packaging workflow](workflows/windows-package.yml) uses the dedicated self-hosted Windows x64 label `dsh-win-package-trial` under native `pwsh`; preserve this routing separately from the automatic CI lanes.
 
+The merge checks run from three workflows named `Policy`, which run on `pull_request_target` so their definitions come from master, and call the `deepseek-harness-check` action directly: `pr-check-on-head-branch.yml` on pull-request updates gives `Policy / Master Change` and `Policy / Pre-Merge Check`, `pr-check-after-approve.yml` on pull-request updates and submitted or dismissed reviews gives `Policy / Approve Check` and `Policy / Reviewer Evaluate`, and `pr-check-on-base-branch.yml` on master pushes re-runs the head-branch checks as `Policy / Recheck`. Branch rules require those check names, so keep the job names and the workflow name. Each check reads its mode from a repository variable: `MERGE_POLICY_MASTER_DIFF`, `MERGE_POLICY_PRE_MERGE`, `MERGE_POLICY_HEAD_DIFF`, and `MERGE_POLICY_REVIEW`, each `off` (skip), `report` (run without failing the job), or `block` (fail the job); a missing value or an unknown one counts as `report`. `Policy / Pre-Merge Check` merges the commit `Policy / Master Change` reports, so it runs only after that job and stays off while `MERGE_POLICY_MASTER_DIFF` is `off`.
+
 The manual Desktop publication workflow selects a successful package run and attempt, then routes each retained build through `DESKTOP_PUBLISH_RUNNERS` to its original machine's unique label. Keep Windows run steps on native PowerShell and Mac run steps on the default POSIX shell; shared entrypoints are Node scripts. Test and production jobs use separate `desktop-test` and `desktop-production` approval Environments after a credential-free preparation job.
diff --git a/.github/workflows/pr-check-after-approve.yml b/.github/workflows/pr-check-after-approve.yml
new file mode 100644
index 0000000000..1255ae9373
--- /dev/null
+++ b/.github/workflows/pr-check-after-approve.yml
@@ -0,0 +1,94 @@
+name: Policy
+on:
+  pull_request_target:
+    branches: [master]
+    types: [opened, synchronize, reopened, ready_for_review]
+  pull_request_review:
+    types: [submitted, dismissed]
+permissions:
+  contents: read
+  pull-requests: read
+concurrency:
+  group: pr-check-after-approve-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+jobs:
+  approve:
+    name: Approve Check
+    # Each check runs only while its repository variable is neither empty nor `off`; otherwise the job is skipped.
+    if: ${{ vars.MERGE_POLICY_HEAD_DIFF != '' && vars.MERGE_POLICY_HEAD_DIFF != 'off' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read
+      pull-requests: read
+    steps:
+      # The head checkout is only the Git repository the check fetches into; it needs no files and runs no code.
+      - uses: actions/checkout@v7.0.1
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          fetch-depth: 1
+          filter: blob:none
+          sparse-checkout: README.md
+          sparse-checkout-cone-mode: false
+
+      - uses: actions/setup-node@v7.0.0
+        with:
+          node-version: '24'
+          package-manager-cache: false
+
+      - uses: deepseek-harness/deepseek-harness-check@master
+        env:
+          CHECK_MODE: ${{ vars.MERGE_POLICY_HEAD_DIFF }}
+        with:
+          check: head-diff
+          base-branch: ${{ github.event.pull_request.base.ref }}
+          head-sha: ${{ github.event.pull_request.head.sha }}
+          pr-number: ${{ github.event.pull_request.number }}
+          pr-author: ${{ github.event.pull_request.user.login }}
+
+  review:
+    name: Reviewer Evaluate
+    if: ${{ vars.MERGE_POLICY_REVIEW != '' && vars.MERGE_POLICY_REVIEW != 'off' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read
+      pull-requests: read
+      # The check posts its verdict as a check run of its own.
+      checks: write
+    steps:
+      # The head checkout is only the Git repository the check fetches into; it needs no files and runs no code.
+      - uses: actions/checkout@v7.0.1
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          fetch-depth: 1
+          filter: blob:none
+          sparse-checkout: README.md
+          sparse-checkout-cone-mode: false
+
+      - uses: actions/setup-node@v7.0.0
+        with:
+          node-version: '24'
+          package-manager-cache: false
+
+      # The check app's token makes the review check run its own row instead of joining this workflow's suite.
+      - id: token
+        continue-on-error: true
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
+        with:
+          client-id: ${{ vars.DSH_APPROVAL_APP_CLIENT_ID }}
+          private-key: ${{ secrets.DSH_APPROVAL_APP_PRIVATE_KEY }}
+          owner: deepseek-harness
+          repositories: deepseek-harness
+          permission-checks: write
+
+      - uses: deepseek-harness/deepseek-harness-check@master
+        env:
+          CHECK_MODE: ${{ vars.MERGE_POLICY_REVIEW }}
+          CHECK_TOKEN: ${{ steps.token.outputs.token }}
+        with:
+          check: review
+          base-branch: ${{ github.event.pull_request.base.ref }}
+          head-sha: ${{ github.event.pull_request.head.sha }}
+          pr-number: ${{ github.event.pull_request.number }}
+          pr-author: ${{ github.event.pull_request.user.login }}
diff --git a/.github/workflows/pr-check-on-base-branch.yml b/.github/workflows/pr-check-on-base-branch.yml
new file mode 100644
index 0000000000..32d4d46165
--- /dev/null
+++ b/.github/workflows/pr-check-on-base-branch.yml
@@ -0,0 +1,30 @@
+name: Policy
+on:
+  push:
+    branches: [master]
+  workflow_dispatch:
+permissions: {}
+concurrency:
+  group: pr-check-on-base-branch-${{ github.ref_name }}
+jobs:
+  recheck:
+    name: Recheck
+    # Re-runs the head-branch checks, so it follows their variables.
+    if: ${{ vars.MERGE_POLICY_MASTER_DIFF != '' && vars.MERGE_POLICY_MASTER_DIFF != 'off' || vars.MERGE_POLICY_PRE_MERGE != '' && vars.MERGE_POLICY_PRE_MERGE != 'off' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      actions: write
+      contents: read
+      pull-requests: read
+    steps:
+      - uses: actions/setup-node@v7.0.0
+        with:
+          node-version: '24'
+          package-manager-cache: false
+
+      - uses: deepseek-harness/deepseek-harness-check@master
+        with:
+          check: recheck
+          base-branch: ${{ github.ref_name }}
+          recheck-label-token: ${{ secrets.DSH_RECHECK_LABEL_TOKEN }}
diff --git a/.github/workflows/pr-check-on-head-branch.yml b/.github/workflows/pr-check-on-head-branch.yml
new file mode 100644
index 0000000000..cb72293c53
--- /dev/null
+++ b/.github/workflows/pr-check-on-head-branch.yml
@@ -0,0 +1,84 @@
+name: Policy
+on:
+  pull_request_target:
+    branches: [master]
+    types: [opened, synchronize, reopened, ready_for_review, review_requested, auto_merge_enabled, labeled]
+permissions:
+  contents: read
+concurrency:
+  group: pr-check-on-head-branch-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+jobs:
+  master:
+    name: Master Change
+    # Each check runs only while its repository variable is neither empty nor `off`; otherwise the job is skipped.
+    if: ${{ vars.MERGE_POLICY_MASTER_DIFF != '' && vars.MERGE_POLICY_MASTER_DIFF != 'off' && !github.event.pull_request.draft }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    outputs:
+      base_sha: ${{ steps.check.outputs.base_sha }}
+      since: ${{ steps.check.outputs.since }}
+    steps:
+      # The head checkout is only the Git repository the check fetches into; it needs no files and runs no code.
+      - uses: actions/checkout@v7.0.1
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          fetch-depth: 1
+          filter: blob:none
+          sparse-checkout: README.md
+          sparse-checkout-cone-mode: false
+
+      - uses: actions/setup-node@v7.0.0
+        with:
+          node-version: '24'
+          package-manager-cache: false
+
+      - id: check
+        uses: deepseek-harness/deepseek-harness-check@master
+        env:
+          CHECK_MODE: ${{ vars.MERGE_POLICY_MASTER_DIFF }}
+        with:
+          check: master-diff
+          base-branch: ${{ github.event.pull_request.base.ref }}
+          head-sha: ${{ github.event.pull_request.head.sha }}
+
+  pre-merge:
+    name: Pre-Merge Check
+    needs: master
+    if: ${{ vars.MERGE_POLICY_PRE_MERGE != '' && vars.MERGE_POLICY_PRE_MERGE != 'off' && needs.master.result == 'success' }}
+    runs-on: blacksmith-4vcpu-ubuntu-2404
+    timeout-minutes: 60
+    # This job installs and compiles the pull request: it reads contents only and receives no secret.
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v7.0.1
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          fetch-depth: 1
+
+      - name: Merge the checked base-branch commit
+        env:
+          BASE_SHA: ${{ needs.master.outputs.base_sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+          SINCE: ${{ needs.master.outputs.since }}
+        run: |
+          [[ "$BASE_SHA" =~ ^[0-9a-f]{40}$ && "$SINCE" =~ ^[0-9]+$ ]] || { echo "::error::the master diff check reported no base commit"; exit 1; }
+          git fetch --no-tags --no-write-fetch-head --shallow-since="$SINCE" origin "$HEAD_SHA" "$BASE_SHA"
+          git -c user.name=pr-check -c user.email=pr-check@users.noreply.github.com merge --no-ff --no-edit -m "Merge $BASE_SHA into $HEAD_SHA" "$BASE_SHA"
+
+      - uses: pnpm/action-setup@v5.0.0
+
+      - uses: actions/setup-node@v7.0.0
+        with:
+          node-version: '24'
+          package-manager-cache: false
+
+      - name: Run the pre-merge command
+        env:
+          CHECK_MODE: ${{ vars.MERGE_POLICY_PRE_MERGE }}
+        run: |
+          if ! bash -euxo pipefail -c 'pnpm install --frozen-lockfile && pnpm exec tsx scripts/compile-referenced-projects.ts host-contracts && pnpm exec tsx scripts/compile-referenced-projects.ts client'; then
+            if [ "$CHECK_MODE" = block ]; then exit 1; fi
+            echo "::warning title=Pre-Merge Check::the merged tree does not install or compile; this check does not block"
+          fi