From f4bdc6856ffa604075f0691d7bcf7db6ba521342 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Wed, 15 Jul 2026 20:15:40 +0000
Subject: [PATCH 1/2] Sync applied migration versions, add supersede invariant
 test, fix nav a11y, commit roadmap

- Rename six migration files to the Supabase ledger versions recorded when they
  were applied to the Memory project on 2026-07-15 (adaptive profile versioning
  columns, operator action center, runner statuses, shadow context pack lab,
  shadow pack preflight, promotion request board), matching the precedent set
  for the adaptive log RLS migration.
- Add the production-checkpoint regression test: repeated distills keep exactly
  one active pack per (user_id, namespace, pack_type), archive (never delete)
  older packs, and never touch other users' packs.
- Mobile Queue-dot accessibility: mark the dot decorative and announce
  "Queue has attention items" via a visually-hidden span (new .pd-sr-only
  utility), since aria-label on a plain <i> is not reliably exposed.
- Add docs/roadmap.md: the committed, evidence-backed roadmap that replaces the
  un-committed numbered list referenced by earlier commits/PRs.

Validated with typecheck, lint, test (642 passed), build, and env:policy.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KuzYogRG6c6324Lq4N4aAC
---
 app/globals.css                               |  1 +
 components/pandora/MobileBottomNav.tsx        |  2 +-
 docs/roadmap.md                               | 66 +++++++++++++++++++
 ...9_adaptive_profile_versioning_columns.sql} |  0
 ...200058_pandora_operator_action_center.sql} |  0
 ...ndora_operator_action_runner_statuses.sql} |  0
 ...00130_pandora_shadow_context_pack_lab.sql} |  0
 ...5200149_pandora_shadow_pack_preflight.sql} |  0
 ...00514_pandora_promotion_request_board.sql} |  0
 tests/unit/retrieval-eval.test.ts             | 33 ++++++++++
 10 files changed, 101 insertions(+), 1 deletion(-)
 create mode 100644 docs/roadmap.md
 rename supabase/migrations/{20260702000000_adaptive_profile_versioning_columns.sql => 20260715200029_adaptive_profile_versioning_columns.sql} (100%)
 rename supabase/migrations/{20260703000000_pandora_operator_action_center.sql => 20260715200058_pandora_operator_action_center.sql} (100%)
 rename supabase/migrations/{20260703010000_pandora_operator_action_runner_statuses.sql => 20260715200108_pandora_operator_action_runner_statuses.sql} (100%)
 rename supabase/migrations/{20260703020000_pandora_shadow_context_pack_lab.sql => 20260715200130_pandora_shadow_context_pack_lab.sql} (100%)
 rename supabase/migrations/{20260704010000_pandora_shadow_pack_preflight.sql => 20260715200149_pandora_shadow_pack_preflight.sql} (100%)
 rename supabase/migrations/{20260704020000_pandora_promotion_request_board.sql => 20260715200514_pandora_promotion_request_board.sql} (100%)

diff --git a/app/globals.css b/app/globals.css
index e116f86..e9ce74e 100644
--- a/app/globals.css
+++ b/app/globals.css
@@ -201,6 +201,7 @@ button, input, textarea, select { font: inherit; }
 .pd-border-emerald { border-color: #a7f3d0; }.pd-border-indigo { border-color: #c7d2fe; }.pd-border-blue { border-color: #bfdbfe; }.pd-border-amber { border-color: #fde68a; }.pd-border-purple { border-color: #e9d5ff; }.pd-border-red { border-color: #fecaca; }.pd-border-slate { border-color: #cbd5e1; }
 .pd-dot-emerald { background: #10b981; }.pd-dot-indigo { background: #6366f1; }.pd-dot-blue { background: #3b82f6; }.pd-dot-amber { background: #f59e0b; }.pd-dot-purple { background: #a855f7; }.pd-dot-red { background: #ef4444; }.pd-dot-slate { background: #64748b; }
 .pd-mobile-nav { display: none; }
+.pd-sr-only { border: 0 !important; clip: rect(0,0,0,0) !important; height: 1px !important; margin: -1px !important; overflow: hidden !important; padding: 0 !important; position: absolute !important; white-space: nowrap !important; width: 1px !important; }
 @media (max-width: 1200px) { .pd-stat-grid { grid-template-columns: repeat(2,minmax(0,1fr)); } .pd-dashboard-grid { grid-template-columns: 1fr; } }
 @media (max-width: 900px) { .pd-shell { display: block; padding-bottom: 86px; } .pd-sidebar { display: none; } .pd-mobile-brand { display: flex; } .pd-topbar { align-items: stretch; flex-direction: column; } .pd-top-actions { justify-content: space-between; } .pd-header-row { align-items: flex-start; flex-direction: column; } .pd-mobile-nav { align-items: center; background: rgba(255,255,255,.94); border-top: 1px solid #e2e8f0; bottom: 0; display: grid; grid-template-columns: repeat(5,1fr); left: 0; padding: 10px 10px calc(env(safe-area-inset-bottom) + .75rem); position: fixed; right: 0; z-index: 30; } .pd-mobile-nav button { background: transparent; border: 0; color: #64748b; display: grid; font-size: .72rem; font-weight: 900; gap: 3px; place-items: center; } .pd-mobile-nav span { position: relative; } .pd-mobile-nav i { background: #f59e0b; border-radius: 999px; height: 7px; position: absolute; right: -5px; top: -3px; width: 7px; } }
 @media (max-width: 620px) { .pd-content, .pd-topbar { padding: 18px; } .pd-stat-grid, .pd-mini-grid { grid-template-columns: 1fr; } .pd-hero-actions, .pd-badges { align-items: stretch; flex-direction: column; } .pd-primary-btn, .pd-secondary-btn, .pd-evidence { width: 100%; } .pd-event-title { align-items: flex-start; flex-direction: column; gap: 2px; } }
diff --git a/components/pandora/MobileBottomNav.tsx b/components/pandora/MobileBottomNav.tsx
index 7040a2b..eb0df40 100644
--- a/components/pandora/MobileBottomNav.tsx
+++ b/components/pandora/MobileBottomNav.tsx
@@ -1,4 +1,4 @@
 import { Brain, Gauge, History, ListChecks, MoreHorizontal } from "lucide-react";
 import { mobileNavItems } from "./nav-items";
 const icons = [Gauge, History, ListChecks, Brain, MoreHorizontal];
-export function MobileBottomNav({ activeNav, onNavChange }: { activeNav: string; onNavChange: (item: string) => void }) { return <nav className="pd-mobile-nav" aria-label="Mobile Pandora navigation">{mobileNavItems.map((item, index) => { const Icon = icons[index]; const active = item === activeNav || (item === "Dashboard" && activeNav === "Dashboard"); return <button type="button" key={item} aria-current={active ? "page" : undefined} onClick={() => onNavChange(item === "Feed" ? "Memory Feed" : item)}><span><Icon size={18} aria-hidden="true" />{item === "Queue" ? <i aria-label="Queue has attention items" /> : null}</span>{item}</button>; })}</nav>; }
+export function MobileBottomNav({ activeNav, onNavChange }: { activeNav: string; onNavChange: (item: string) => void }) { return <nav className="pd-mobile-nav" aria-label="Mobile Pandora navigation">{mobileNavItems.map((item, index) => { const Icon = icons[index]; const active = item === activeNav || (item === "Dashboard" && activeNav === "Dashboard"); return <button type="button" key={item} aria-current={active ? "page" : undefined} onClick={() => onNavChange(item === "Feed" ? "Memory Feed" : item)}><span><Icon size={18} aria-hidden="true" />{item === "Queue" ? <i aria-hidden="true" /> : null}</span>{item}{item === "Queue" ? <span className="pd-sr-only">Queue has attention items</span> : null}</button>; })}</nav>; }
diff --git a/docs/roadmap.md b/docs/roadmap.md
new file mode 100644
index 0000000..8ac3045
--- /dev/null
+++ b/docs/roadmap.md
@@ -0,0 +1,66 @@
+# Pandora Memory Engine — Roadmap
+
+Last updated: 2026-07-15.
+
+This is the committed roadmap. Earlier "roadmap Sprint 1" / "roadmap #9" references in commits
+and PRs (#123, #124, #125) pointed at a numbered list that was never checked into the repo;
+this document replaces it. Update this file when a stage lands, with evidence, per
+`skills/phase-status-ledger`.
+
+## Status snapshot (evidence-backed)
+
+| Stage | Status | Evidence |
+|---|---|---|
+| Phase 1–3F (foundation → append proof → readback/browser/verification/closeout) | complete | merged PRs #93–#97, phase docs, production routes |
+| Phase 4A proposals + daily ChatGPT bridge | complete | migrations `20260626040000`, `20260626041000` applied |
+| Phase 4B Pandora MCP (13 tools, error envelope) | complete | PR #121, #125; `lib/services/pandora-mcp-server.ts` |
+| Phase 4C adaptive memory intelligence | complete | migration `20260627040000` applied; PR #122 |
+| Phase 5A autopilot capture / 5B candidate review / 5C compaction | complete | migrations applied; `/admin/memory/candidates`; supersede smoke 2026-07-03 |
+| Phase 5D scoring/pruning | partial | code + migration `20260629000000` applied; dry-runs NOT yet run/reviewed |
+| Phase 6A operating brain + 6A.2 smoke | complete | migration `20260701000000`; CI run 28467956363; Vercel READY |
+| Phase 6B project context engine | complete | migration `20260701010000`; `/operating/projects` |
+| Ops track: dashboard, verification console, action center, read-only runner | complete | PRs #131–#135 merged and deployed |
+| Shadow context pack lab | complete | PR #136; migration applied 2026-07-15 (`20260715200130`) |
+| Shadow pack preflight | complete | PR #137; migration applied 2026-07-15 (`20260715200149`) |
+| Promotion request board (plans only, no execution) | complete | PR #138 merged 2026-07-15; migration `20260715200514`; Vercel READY on `22b8b1a` |
+
+2026-07-15 operations note: five merged migrations had never been applied to production
+(adaptive profile versioning columns, operator action center, runner statuses, shadow lab,
+preflight). They were reviewed and applied on 2026-07-15 as versions `20260715200029`–
+`20260715200149`, and the local files were renamed to match the ledger. Stale duplicate
+PRs #96, #99, #118, #119 were closed with evidence comments.
+
+## Next (queued, in order)
+
+1. **Promotion executor** — the gated, human-approved path that promotes an approved shadow
+   candidate to the active master. Chain: lab → preflight → request board (all live) →
+   execution (NOT built). Requires its own PR, migration/policy review, dry-run proof, and
+   explicit production approval. Until then every surface must keep saying
+   "execution unavailable".
+2. **Phase 5D closure** per the execution rule in `CLAUDE.md`: protected dry-runs for
+   `real_life` and `au`, human review of dry-run output, explicit approval before any
+   `dryRun:false` run, post-run database verification. Pruning stays review-only regardless
+   (`lib/config/phase-5d-config.ts` hard-codes `review_only`).
+3. **Checkpoint follow-ups** from `docs/pandora-production-checkpoint-2026-07-03.md`:
+   the one-active-master-pack regression test and the mobile Queue-dot accessibility polish
+   landed 2026-07-15; the live dashboard data route landed via PRs #131/#132.
+
+## Gated ladder (requires explicit approval to start)
+
+- **Phase 6C prediction** — blocked until project context is manually verified in production
+  (guardrail in `docs/phase-6b-project-context-engine.md`). After that, in rough order of
+  risk: Gmail/Calendar connectors, LLM-based prediction, intervention engine, autonomous
+  actions.
+- **Capability gates still off by design**: model calls, embeddings, semantic retrieval,
+  GPT Actions enablement, public MCP expansion, batch/automatic memory writes, pruning
+  execution. Each flips only with explicit instruction, review, and deployed proof.
+- **Unbuilt tail of `docs/codex-execution-plan.md`** (the original 36-task V1 plan): AU
+  continuity engine (canon guard, scene aftermath, retcon manager, character/relationship
+  state APIs), real-life analyzers (`/api/real/*`), AI routes (`/api/ai/*`), full AU/canon
+  UI. Never cancelled in writing — adopt into the ladder or park explicitly.
+
+## Housekeeping decisions pending
+
+- The production Supabase project also contains ~25 `plp_*` tables (bookings/resort) whose
+  migrations are not in this repo. Decide whether to split that project into its own
+  database per `17-pandora-architecture-boundary`.
diff --git a/supabase/migrations/20260702000000_adaptive_profile_versioning_columns.sql b/supabase/migrations/20260715200029_adaptive_profile_versioning_columns.sql
similarity index 100%
rename from supabase/migrations/20260702000000_adaptive_profile_versioning_columns.sql
rename to supabase/migrations/20260715200029_adaptive_profile_versioning_columns.sql
diff --git a/supabase/migrations/20260703000000_pandora_operator_action_center.sql b/supabase/migrations/20260715200058_pandora_operator_action_center.sql
similarity index 100%
rename from supabase/migrations/20260703000000_pandora_operator_action_center.sql
rename to supabase/migrations/20260715200058_pandora_operator_action_center.sql
diff --git a/supabase/migrations/20260703010000_pandora_operator_action_runner_statuses.sql b/supabase/migrations/20260715200108_pandora_operator_action_runner_statuses.sql
similarity index 100%
rename from supabase/migrations/20260703010000_pandora_operator_action_runner_statuses.sql
rename to supabase/migrations/20260715200108_pandora_operator_action_runner_statuses.sql
diff --git a/supabase/migrations/20260703020000_pandora_shadow_context_pack_lab.sql b/supabase/migrations/20260715200130_pandora_shadow_context_pack_lab.sql
similarity index 100%
rename from supabase/migrations/20260703020000_pandora_shadow_context_pack_lab.sql
rename to supabase/migrations/20260715200130_pandora_shadow_context_pack_lab.sql
diff --git a/supabase/migrations/20260704010000_pandora_shadow_pack_preflight.sql b/supabase/migrations/20260715200149_pandora_shadow_pack_preflight.sql
similarity index 100%
rename from supabase/migrations/20260704010000_pandora_shadow_pack_preflight.sql
rename to supabase/migrations/20260715200149_pandora_shadow_pack_preflight.sql
diff --git a/supabase/migrations/20260704020000_pandora_promotion_request_board.sql b/supabase/migrations/20260715200514_pandora_promotion_request_board.sql
similarity index 100%
rename from supabase/migrations/20260704020000_pandora_promotion_request_board.sql
rename to supabase/migrations/20260715200514_pandora_promotion_request_board.sql
diff --git a/tests/unit/retrieval-eval.test.ts b/tests/unit/retrieval-eval.test.ts
index 33b0812..2e20f19 100644
--- a/tests/unit/retrieval-eval.test.ts
+++ b/tests/unit/retrieval-eval.test.ts
@@ -191,4 +191,37 @@ describe("supersede-on-distill", () => {
     expect(store.memory_context_packs.find((p) => p.id === "au-keep")!.status).toBe("active");
     expect(store.memory_context_packs.find((p) => p.id === "rl-old")!.status).toBe("archived");
   });
+
+  // Regression for the 2026-07-03 production checkpoint invariant: after repeated distills,
+  // at most one active pack may exist per (user_id, namespace, pack_type), older packs must be
+  // archived (never deleted), and other users' active packs must be untouched.
+  it("repeated distills keep exactly one active pack per (user_id, namespace, pack_type)", async () => {
+    const OTHER_USER = "u-83a07d75";
+    const store: Record<string, Row[]> = {
+      memory_context_packs: [
+        { id: "other-rl", user_id: OTHER_USER, namespace: "real_life", pack_type: "master", status: "active" },
+      ],
+      audit_logs: [],
+    };
+    const client = makeClient(store);
+    for (const namespace of ["au", "real_life"]) {
+      await createContextPack(client, newPack(namespace) as any, bridgePrincipal, runtime);
+      await createContextPack(client, newPack(namespace) as any, bridgePrincipal, runtime);
+    }
+
+    const activeCounts = new Map<string, number>();
+    for (const p of store.memory_context_packs) {
+      if (p.status !== "active") continue;
+      const key = `${p.user_id}/${p.namespace}/${p.pack_type}`;
+      activeCounts.set(key, (activeCounts.get(key) ?? 0) + 1);
+    }
+    for (const [key, count] of activeCounts) expect(count, `active packs for ${key}`).toBe(1);
+
+    // superseded packs are archived in place, never deleted
+    expect(store.memory_context_packs.filter((p) => p.user_id === USER && p.namespace === "au")).toHaveLength(2);
+    expect(store.memory_context_packs.filter((p) => p.user_id === USER && p.namespace === "real_life")).toHaveLength(2);
+
+    // the other user's active master is untouched by this user's distills
+    expect(store.memory_context_packs.find((p) => p.id === "other-rl")!.status).toBe("active");
+  });
 });

From eb8d28f1f8e44b7729c678f8bfee7d3556dead86 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Wed, 15 Jul 2026 20:33:40 +0000
Subject: [PATCH 2/2] Add Pandora Promotion Executor v1 (gated, dry-run-first,
 reversible)

Final stage of the shadow-pack promotion chain: lab -> preflight -> request
board -> executor. Execution is double-gated: it refuses unless
PANDORA_ENABLE_CONTEXT_PACK_PROMOTION=true (dangerous gate, defaults false),
the promotion request is human-approved, a fresh plan recomputation against
live preflight/shadow/master state has zero blockers (including
active-master-unchanged-since-approval), and the caller passes the explicit
confirmation phrase.

Promotion is status-only and reversible: insert new master from the reviewed
shadow candidate, archive (never delete) the previous master, mark the request
promoted, record execution rows/events and an audit_logs entry. Rollback
archives the promoted pack and restores the previous master the same way. The
service never touches memory_events, memory_items, memory_profiles, capture or
pruning candidates, never crosses namespaces, and never uses service-role
clients.

- migration: pandora_promotion_executions(+events) with RLS; widen
  pandora_promotion_requests status check with 'promoted'
- service: lib/services/pandora-promotion-execution-service.ts
- routes: execution dry-run / execute / list / rollback, all with
  server-derived identity and client user_id rejection
- guard test updated: gated execution replaces the no-execution-route
  assertion; legacy ungated paths must still not exist
- 8 unit tests: gate-off refusal, confirmation phrase, dry-run writes nothing,
  happy path, unapproved block, master-changed block, rollback, never-deletes
- env broker: PANDORA_ENABLE_CONTEXT_PACK_PROMOTION cataloged, default false
- docs: pandora-promotion-executor.md + roadmap update

Migration is NOT applied; execution stays impossible until review, merge,
migration, dry-run proof, and explicit gate enablement per rollout skill 07.

Validated with typecheck, lint (0 errors), test (650 passed), build, and
env:policy (90 keys).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KuzYogRG6c6324Lq4N4aAC
---
 .../[id]/rollback/route.ts                    |   6 +
 app/api/pandora/promotion-executions/route.ts |   6 +
 .../[id]/execution/dry-run/route.ts           |   6 +
 .../[id]/execution/route.ts                   |   6 +
 docs/pandora-promotion-executor.md            |  71 +++++++++
 docs/roadmap.md                               |   7 +-
 lib/services/env-discovery-service.ts         |   2 +
 .../pandora-promotion-execution-service.ts    |  67 +++++++++
 ...60716000000_pandora_promotion_executor.sql |  72 ++++++++++
 .../pandora-operator-action-guards.test.ts    |  20 ++-
 ...andora-promotion-execution-service.test.ts | 136 ++++++++++++++++++
 11 files changed, 395 insertions(+), 4 deletions(-)
 create mode 100644 app/api/pandora/promotion-executions/[id]/rollback/route.ts
 create mode 100644 app/api/pandora/promotion-executions/route.ts
 create mode 100644 app/api/pandora/promotion-requests/[id]/execution/dry-run/route.ts
 create mode 100644 app/api/pandora/promotion-requests/[id]/execution/route.ts
 create mode 100644 docs/pandora-promotion-executor.md
 create mode 100644 lib/services/pandora-promotion-execution-service.ts
 create mode 100644 supabase/migrations/20260716000000_pandora_promotion_executor.sql
 create mode 100644 tests/unit/pandora-promotion-execution-service.test.ts

diff --git a/app/api/pandora/promotion-executions/[id]/rollback/route.ts b/app/api/pandora/promotion-executions/[id]/rollback/route.ts
new file mode 100644
index 0000000..94f254a
--- /dev/null
+++ b/app/api/pandora/promotion-executions/[id]/rollback/route.ts
@@ -0,0 +1,6 @@
+import { NextResponse, type NextRequest } from "next/server";
+import { assertNoClientUserIdOverride, resolvePandoraServerSession } from "@/lib/auth/pandora-server-session-resolver";
+import { createSupabaseServerClient } from "@/lib/supabase/server";
+import { rollbackPromotionExecution, type PromotionExecutionDbClient } from "@/lib/services/pandora-promotion-execution-service";
+export const dynamic = "force-dynamic";
+export async function POST(request: NextRequest, context: { params: Promise<{ id: string }> }) { let body: unknown; try { body = await request.json(); } catch { body = {}; } const rejected = await assertNoClientUserIdOverride(request, body); if (rejected) return NextResponse.json({ ok:false, blockers: rejected.blockers }, { status: 400 }); const session = await resolvePandoraServerSession({ request }); if (!session.ok) return NextResponse.json({ ok:false, blockers: session.blockers }, { status: 401 }); try { const { id } = await context.params; const confirmation = typeof (body as Record<string, unknown> | null)?.confirmation === "string" ? String((body as Record<string, unknown>).confirmation) : ""; const supabase = await createSupabaseServerClient(); const execution = await rollbackPromotionExecution(supabase as unknown as PromotionExecutionDbClient, { userId: session.session.userId, executionId: id, confirmation }); return NextResponse.json({ ok:true, execution }); } catch(e) { const message = e instanceof Error ? e.message : "Unable to roll back promotion"; return NextResponse.json({ ok:false, error: message }, { status: message.startsWith("promotion_execution_disabled") ? 403 : 400 }); } }
diff --git a/app/api/pandora/promotion-executions/route.ts b/app/api/pandora/promotion-executions/route.ts
new file mode 100644
index 0000000..af2478f
--- /dev/null
+++ b/app/api/pandora/promotion-executions/route.ts
@@ -0,0 +1,6 @@
+import { NextResponse, type NextRequest } from "next/server";
+import { assertNoClientUserIdOverride, resolvePandoraServerSession } from "@/lib/auth/pandora-server-session-resolver";
+import { createSupabaseServerClient } from "@/lib/supabase/server";
+import { listPromotionExecutions, type PromotionExecutionDbClient } from "@/lib/services/pandora-promotion-execution-service";
+export const dynamic = "force-dynamic";
+export async function GET(request: NextRequest) { const rejected = await assertNoClientUserIdOverride(request, {}); if (rejected) return NextResponse.json({ ok:false, blockers: rejected.blockers }, { status: 400 }); const session = await resolvePandoraServerSession({ request }); if (!session.ok) return NextResponse.json({ ok:false, blockers: session.blockers }, { status: 401 }); try { const supabase = await createSupabaseServerClient(); const executions = await listPromotionExecutions(supabase as unknown as PromotionExecutionDbClient, { userId: session.session.userId }); return NextResponse.json({ ok:true, executions }); } catch(e) { return NextResponse.json({ ok:false, error: e instanceof Error ? e.message : "Unable to list promotion executions" }, { status: 400 }); } }
diff --git a/app/api/pandora/promotion-requests/[id]/execution/dry-run/route.ts b/app/api/pandora/promotion-requests/[id]/execution/dry-run/route.ts
new file mode 100644
index 0000000..c008ac8
--- /dev/null
+++ b/app/api/pandora/promotion-requests/[id]/execution/dry-run/route.ts
@@ -0,0 +1,6 @@
+import { NextResponse, type NextRequest } from "next/server";
+import { assertNoClientUserIdOverride, resolvePandoraServerSession } from "@/lib/auth/pandora-server-session-resolver";
+import { createSupabaseServerClient } from "@/lib/supabase/server";
+import { dryRunPromotionExecution, type PromotionExecutionDbClient } from "@/lib/services/pandora-promotion-execution-service";
+export const dynamic = "force-dynamic";
+export async function POST(request: NextRequest, context: { params: Promise<{ id: string }> }) { let body: unknown; try { body = await request.json(); } catch { body = {}; } const rejected = await assertNoClientUserIdOverride(request, body); if (rejected) return NextResponse.json({ ok:false, blockers: rejected.blockers }, { status: 400 }); const session = await resolvePandoraServerSession({ request }); if (!session.ok) return NextResponse.json({ ok:false, blockers: session.blockers }, { status: 401 }); try { const { id } = await context.params; const supabase = await createSupabaseServerClient(); const dryRun = await dryRunPromotionExecution(supabase as unknown as PromotionExecutionDbClient, { userId: session.session.userId, promotionRequestId: id }); return NextResponse.json({ ok:true, dryRun, no_promotion_performed:true, no_core_memory_mutation_performed:true }); } catch(e) { return NextResponse.json({ ok:false, error: e instanceof Error ? e.message : "Unable to dry-run promotion execution" }, { status: 400 }); } }
diff --git a/app/api/pandora/promotion-requests/[id]/execution/route.ts b/app/api/pandora/promotion-requests/[id]/execution/route.ts
new file mode 100644
index 0000000..ad4ea7f
--- /dev/null
+++ b/app/api/pandora/promotion-requests/[id]/execution/route.ts
@@ -0,0 +1,6 @@
+import { NextResponse, type NextRequest } from "next/server";
+import { assertNoClientUserIdOverride, resolvePandoraServerSession } from "@/lib/auth/pandora-server-session-resolver";
+import { createSupabaseServerClient } from "@/lib/supabase/server";
+import { executeApprovedPromotion, type PromotionExecutionDbClient } from "@/lib/services/pandora-promotion-execution-service";
+export const dynamic = "force-dynamic";
+export async function POST(request: NextRequest, context: { params: Promise<{ id: string }> }) { let body: unknown; try { body = await request.json(); } catch { body = {}; } const rejected = await assertNoClientUserIdOverride(request, body); if (rejected) return NextResponse.json({ ok:false, blockers: rejected.blockers }, { status: 400 }); const session = await resolvePandoraServerSession({ request }); if (!session.ok) return NextResponse.json({ ok:false, blockers: session.blockers }, { status: 401 }); try { const { id } = await context.params; const confirmation = typeof (body as Record<string, unknown> | null)?.confirmation === "string" ? String((body as Record<string, unknown>).confirmation) : ""; const supabase = await createSupabaseServerClient(); const execution = await executeApprovedPromotion(supabase as unknown as PromotionExecutionDbClient, { userId: session.session.userId, promotionRequestId: id, confirmation }); return NextResponse.json({ ok:true, execution }); } catch(e) { const message = e instanceof Error ? e.message : "Unable to execute promotion"; return NextResponse.json({ ok:false, error: message }, { status: message.startsWith("promotion_execution_disabled") ? 403 : 400 }); } }
diff --git a/docs/pandora-promotion-executor.md b/docs/pandora-promotion-executor.md
new file mode 100644
index 0000000..2f09591
--- /dev/null
+++ b/docs/pandora-promotion-executor.md
@@ -0,0 +1,71 @@
+# Pandora Promotion Executor v1
+
+The promotion executor is the final, gated stage of the shadow-pack promotion chain:
+
+Shadow Context Pack Lab → Shadow Pack Preflight → Promotion Request Board → **Promotion Executor**.
+
+It turns a human-approved promotion request into an actual master context-pack swap — and
+nothing else.
+
+## Double gate
+
+Execution refuses unless ALL of the following hold:
+
+1. `PANDORA_ENABLE_CONTEXT_PACK_PROMOTION=true` (dangerous gate, defaults to false, optional —
+   never a required provider env, so an unset value never triggers RED drift).
+2. The promotion request is `approved` with `reviewer_decision=approved`.
+3. A fresh plan recomputation (live preflight, shadow pack, and active master) has zero blockers.
+   In particular: the preflight is still `approved_for_promotion`, risk is not `blocked`, the
+   shadow pack is not rejected/archived, and the active master is still the exact pack recorded
+   at approval time — if the master changed since approval, execution refuses and demands a new
+   preflight + approval cycle.
+4. The request body carries the explicit confirmation phrase `"PROMOTE"` (`"ROLLBACK"` for
+   rollbacks).
+
+## What execution does
+
+Status-only and reversible, in this order:
+
+1. Insert a new `memory_context_packs` row (`pack_type=master`, `status=active`) built from the
+   reviewed shadow candidate payload.
+2. Archive the previous active master(s) for the same `(user_id, namespace, pack_type)` —
+   `status=archived`, never deleted. This preserves the one-active-master invariant.
+3. Mark the promotion request `promoted`.
+4. Record an execution row, execution events, a promotion-request event, and an `audit_logs`
+   entry.
+
+## What it never does
+
+- Never deletes any row anywhere.
+- Never touches `memory_events`, `memory_items`, `memory_profiles`, capture candidates, or
+  pruning candidates.
+- Never crosses namespaces (`real_life` promotion cannot touch `au` packs and vice versa).
+- Never uses service-role/admin clients; all writes go through the authenticated server client
+  under RLS with server-derived identity. Client-supplied `user_id` is rejected.
+
+## Rollback
+
+`POST /api/pandora/promotion-executions/[id]/rollback` (gated, confirmation `"ROLLBACK"`):
+archives the promoted pack and restores the previous master to `active`. Also status-only.
+
+## Routes
+
+- `POST /api/pandora/promotion-requests/[id]/execution/dry-run` — pure compute, no writes,
+  works with the gate off; returns plan, blockers, warnings, `gate_enabled`, `executable`.
+- `POST /api/pandora/promotion-requests/[id]/execution` — gated execute.
+- `GET /api/pandora/promotion-executions` — list own executions.
+- `POST /api/pandora/promotion-executions/[id]/rollback` — gated rollback.
+
+## Rollout sequence (per skill 07)
+
+1. PR reviewed and merged (this feature must not be self-merged by its author).
+2. Migration `pandora_promotion_executor` applied.
+3. Production deployed READY.
+4. Dry-run via the dry-run route on a real approved request; output reviewed.
+5. Human sets `PANDORA_ENABLE_CONTEXT_PACK_PROMOTION=true` in the deployment env.
+6. One controlled execution with confirmation phrase; post-run verification of the
+   one-active-master invariant and audit trail.
+7. Gate may be turned back off between promotions.
+
+Until step 5, all UI banners saying "execution unavailable" remain accurate. When the gate is
+enabled, update the Promotion Request Board banner copy in the same change.
diff --git a/docs/roadmap.md b/docs/roadmap.md
index 8ac3045..3b06c31 100644
--- a/docs/roadmap.md
+++ b/docs/roadmap.md
@@ -34,9 +34,10 @@ PRs #96, #99, #118, #119 were closed with evidence comments.
 
 1. **Promotion executor** — the gated, human-approved path that promotes an approved shadow
    candidate to the active master. Chain: lab → preflight → request board (all live) →
-   execution (NOT built). Requires its own PR, migration/policy review, dry-run proof, and
-   explicit production approval. Until then every surface must keep saying
-   "execution unavailable".
+   execution. Executor v1 code exists in its own PR (see `docs/pandora-promotion-executor.md`);
+   it requires human review + merge, migration apply, dry-run proof, and the
+   `PANDORA_ENABLE_CONTEXT_PACK_PROMOTION` gate (default false) before anything can execute.
+   Until the gate is enabled every surface saying "execution unavailable" stays accurate.
 2. **Phase 5D closure** per the execution rule in `CLAUDE.md`: protected dry-runs for
    `real_life` and `au`, human review of dry-run output, explicit approval before any
    `dryRun:false` run, post-run database verification. Pruning stays review-only regardless
diff --git a/lib/services/env-discovery-service.ts b/lib/services/env-discovery-service.ts
index 86b3360..11ad7c3 100644
--- a/lib/services/env-discovery-service.ts
+++ b/lib/services/env-discovery-service.ts
@@ -16,6 +16,8 @@ knownDefaults.PANDORA_ENABLE_MEMORY_USEFULNESS_SCORING = "false";
 knownDefaults.PANDORA_ENABLE_MEMORY_PRUNING = "false";
 knownDefaults.PANDORA_MEMORY_PRUNING_MODE = "review_only";
 knownDefaults.PANDORA_MEMORY_SCORING_VERSION = "phase-5d-v1";
+// Promotion executor v1 gate. Dangerous, defaults to false; optional (never a required provider env).
+knownDefaults.PANDORA_ENABLE_CONTEXT_PACK_PROMOTION = "false";
 
 const mustRegister = [
   "PANDORA_INTERNAL_JOB_TOKEN", "PANDORA_ENV_BROKER_ENABLED", "PANDORA_VERCEL_API_TOKEN", "PANDORA_ENV_VAULT_KEY", "NEXT_PUBLIC_SUPABASE_URL", "NEXT_PUBLIC_SUPABASE_ANON_KEY", "SUPABASE_SERVICE_ROLE_KEY", "SUPABASE_URL", "SUPABASE_ANON_KEY", "DATABASE_URL", "DIRECT_URL", "OPENAI_API_KEY", "OPENAI_PROJECT_ID", "OPENAI_ORG_ID", "NEXTAUTH_SECRET", "AUTH_SECRET", "NEXTAUTH_URL", "AUTH_URL", "SESSION_SECRET", "COOKIE_SECRET",
diff --git a/lib/services/pandora-promotion-execution-service.ts b/lib/services/pandora-promotion-execution-service.ts
new file mode 100644
index 0000000..0fd47bb
--- /dev/null
+++ b/lib/services/pandora-promotion-execution-service.ts
@@ -0,0 +1,67 @@
+/* eslint-disable @typescript-eslint/no-explicit-any */
+import { randomUUID } from "node:crypto";
+import type { PandoraNamespace } from "@/components/pandora/types";
+import { buildPromotionRequestPlan, getPromotionRequest, createPromotionRequestEvent, type PromotionRequestDbClient, type PromotionRequestRow } from "@/lib/services/pandora-promotion-request-service";
+
+// Promotion executor v1. Execution is double-gated: PANDORA_ENABLE_CONTEXT_PACK_PROMOTION
+// must be "true" AND the promotion request must be human-approved with a fresh, blocker-free
+// plan AND the caller must pass the explicit confirmation phrase. Promotion is status-only on
+// memory_context_packs (insert new master from the reviewed shadow candidate, archive the old
+// master). Nothing is ever deleted; memory_events, memory_items, memory_profiles, capture and
+// pruning candidates are never touched. Rollback restores the previous master the same way.
+
+export type PromotionExecutionDbClient = PromotionRequestDbClient;
+export type PromotionExecutionMode = "execute" | "rollback";
+export type PromotionExecutionStatus = "executed" | "rolled_back" | "blocked" | "failed";
+export type PromotionExecutionRow = { id:string; user_id:string; request_id:string; namespace:PandoraNamespace; promotion_request_id:string; preflight_id:string; shadow_pack_id:string; previous_master_pack_id:string|null; promoted_pack_id:string|null; mode:PromotionExecutionMode; status:PromotionExecutionStatus; plan:Record<string,unknown>; result:Record<string,unknown>; warnings:string[]; created_at:string; updated_at:string; executed_at?:string|null; rolled_back_at?:string|null };
+
+export const PROMOTION_EXECUTION_GATE = "PANDORA_ENABLE_CONTEXT_PACK_PROMOTION";
+export const PROMOTE_CONFIRMATION = "PROMOTE";
+export const ROLLBACK_CONFIRMATION = "ROLLBACK";
+export function isPromotionExecutionEnabled(env: Partial<NodeJS.ProcessEnv> = process.env): boolean { return env[PROMOTION_EXECUTION_GATE] === "true"; }
+
+async function single(q:any){ const r=await q; if(r.error) return null; return Array.isArray(r.data)?r.data[0]??null:r.data??null; }
+async function audit(client:PromotionExecutionDbClient,input:{userId:string; namespace:PandoraNamespace; action:string; recordId:string; metadata:Record<string,unknown>}){ await client.from("audit_logs").insert({ user_id:input.userId, namespace:input.namespace, action:input.action, table_name:"memory_context_packs", record_id:input.recordId, after_snapshot:input.metadata, metadata:{...input.metadata, phase:"promotion_executor_v1", appendOnly:true} }).select("*").single(); }
+async function createExecutionEvent(client:PromotionExecutionDbClient,input:{userId:string; executionId:string; promotionRequestId:string; eventType:string; message:string; metadata?:Record<string,unknown>}){ await client.from("pandora_promotion_execution_events").insert({ id:randomUUID(), user_id:input.userId, execution_id:input.executionId, promotion_request_id:input.promotionRequestId, event_type:input.eventType, message:input.message, metadata:input.metadata??{}, created_at:new Date().toISOString() }).select("*").single(); }
+async function insertExecutionRow(client:PromotionExecutionDbClient,row:Omit<PromotionExecutionRow,"created_at"|"updated_at"> & {created_at?:string; updated_at?:string}):Promise<PromotionExecutionRow>{ const now=new Date().toISOString(); const created=await single(client.from("pandora_promotion_executions").insert({...row,created_at:row.created_at??now,updated_at:row.updated_at??now}).select("*").single()); if(!created) throw new Error("Unable to record promotion execution"); return created; }
+
+export async function listPromotionExecutions(client:PromotionExecutionDbClient,input:{userId:string; limit?:number}):Promise<PromotionExecutionRow[]>{ const r=await client.from("pandora_promotion_executions").select("*").eq("user_id",input.userId).order("created_at",{ascending:false}).limit(input.limit??20); return r.error?[]:(Array.isArray(r.data)?r.data:[]); }
+export async function getPromotionExecution(client:PromotionExecutionDbClient,input:{userId:string; executionId:string}):Promise<PromotionExecutionRow>{ const row=await single(client.from("pandora_promotion_executions").select("*").eq("user_id",input.userId).eq("id",input.executionId).limit(1)); if(!row) throw new Error("Promotion execution not found for current user"); return row; }
+
+// Pure compute. Re-derives the plan from live preflight/shadow/master state and adds the
+// execution-stage blockers on top of the request-stage ones. Performs no writes.
+export async function buildPromotionExecutionPlan(client:PromotionExecutionDbClient,input:{userId:string; promotionRequestId:string}){ const request:PromotionRequestRow=await getPromotionRequest(client,input); const built=await buildPromotionRequestPlan(client,{userId:input.userId,preflightId:request.preflight_id,requestId:request.request_id}); const blockers=[...built.blockers]; const warnings=[...built.warnings]; if(request.status!=="approved") blockers.push(`Promotion request status is ${request.status}; only approved requests can execute.`); if(request.reviewer_decision!=="approved") blockers.push("Promotion request has no approved reviewer decision."); if(["rejected","archived"].includes(String(built.shadow.status))) blockers.push(`Shadow pack status is ${built.shadow.status}; execution refused.`); const liveMasterId=built.currentMaster?.id??null; if((request.active_master_pack_id??null)!==liveMasterId) blockers.push("Active master changed since approval; re-run preflight and re-approve before executing."); const plan={ plan_version:"promotion_executor_v1", namespace:request.namespace, promotion_request_id:request.id, preflight_id:request.preflight_id, shadow_pack_id:request.shadow_pack_id, previous_master_pack_id:liveMasterId, operation:"archive_active_master_then_insert_shadow_candidate_as_master", status_only:true, never_deletes:true, tables_touched:["memory_context_packs","pandora_promotion_requests","pandora_promotion_executions","pandora_promotion_execution_events","pandora_promotion_request_events","audit_logs"], blockers }; return { request, built, blockers, warnings:Array.from(new Set(warnings)), plan, previousMasterId:liveMasterId }; }
+
+export async function dryRunPromotionExecution(client:PromotionExecutionDbClient,input:{userId:string; promotionRequestId:string},env:Partial<NodeJS.ProcessEnv>=process.env){ const computed=await buildPromotionExecutionPlan(client,input); return { mode:"dry_run" as const, gate_enabled:isPromotionExecutionEnabled(env), executable:computed.blockers.length===0&&isPromotionExecutionEnabled(env), blockers:computed.blockers, warnings:computed.warnings, plan:computed.plan, no_core_memory_mutation_performed:true, no_promotion_performed:true }; }
+
+function packFromShadowCandidate(shadow:{id:string; namespace:PandoraNamespace; title:string; summary:string; candidate_payload:Record<string,unknown>}, userId:string){ const p=shadow.candidate_payload??{}; const arr=(v:unknown)=>Array.isArray(v)?v:[]; return { id:randomUUID(), user_id:userId, namespace:shadow.namespace, pack_type:"master", status:"active", title:typeof p.title==="string"&&p.title?p.title:shadow.title, summary:typeof p.summary==="string"&&p.summary?p.summary:shadow.summary, key_points:arr(p.key_points), active_projects:arr(p.active_projects), people_map:arr(p.people_map), decisions:arr(p.decisions), risks:arr(p.risks), open_loops:arr(p.open_loops), generated_from_event_ids:arr(p.generated_from_event_ids), created_at:new Date().toISOString(), updated_at:new Date().toISOString() }; }
+
+export async function executeApprovedPromotion(client:PromotionExecutionDbClient,input:{userId:string; promotionRequestId:string; confirmation:string},env:Partial<NodeJS.ProcessEnv>=process.env):Promise<PromotionExecutionRow>{
+  if(input.confirmation!==PROMOTE_CONFIRMATION) throw new Error(`Execution requires the explicit confirmation phrase "${PROMOTE_CONFIRMATION}".`);
+  if(!isPromotionExecutionEnabled(env)) throw new Error(`promotion_execution_disabled: set ${PROMOTION_EXECUTION_GATE}=true after review to enable execution.`);
+  const computed=await buildPromotionExecutionPlan(client,input); const { request }=computed; const now=new Date().toISOString();
+  if(computed.blockers.length){ const blocked=await insertExecutionRow(client,{ id:randomUUID(), user_id:input.userId, request_id:request.request_id, namespace:request.namespace, promotion_request_id:request.id, preflight_id:request.preflight_id, shadow_pack_id:request.shadow_pack_id, previous_master_pack_id:computed.previousMasterId, promoted_pack_id:null, mode:"execute", status:"blocked", plan:computed.plan, result:{blockers:computed.blockers,no_core_memory_mutation_performed:true,no_promotion_performed:true}, warnings:computed.warnings }); await createExecutionEvent(client,{userId:input.userId,executionId:blocked.id,promotionRequestId:request.id,eventType:"promotion_execution_blocked",message:"Promotion execution blocked; no core memory mutation performed.",metadata:{blockers:computed.blockers}}); throw new Error(`Promotion execution blocked: ${computed.blockers.join("; ")}`); }
+  const promoted=await single(client.from("memory_context_packs").insert(packFromShadowCandidate(computed.built.shadow,input.userId)).select("*").single()); if(!promoted) throw new Error("Promotion failed: unable to insert new master context pack. No archive was performed.");
+  const archived=await (client.from("memory_context_packs").update({status:"archived",updated_at:now}).eq("user_id",input.userId).eq("namespace",request.namespace).eq("pack_type","master").eq("status","active").neq("id",promoted.id).select("id") as unknown as Promise<{data:unknown[]|null; error:{message:string}|null}>);
+  const warnings=[...computed.warnings]; if(archived.error) warnings.push(`archive_previous_master_failed: ${archived.error.message}`);
+  const updatedRequest=await single(client.from("pandora_promotion_requests").update({status:"promoted",updated_at:now}).eq("user_id",input.userId).eq("id",request.id).select("*").single()); if(!updatedRequest) warnings.push("promotion_request_status_update_failed");
+  const execution=await insertExecutionRow(client,{ id:randomUUID(), user_id:input.userId, request_id:request.request_id, namespace:request.namespace, promotion_request_id:request.id, preflight_id:request.preflight_id, shadow_pack_id:request.shadow_pack_id, previous_master_pack_id:computed.previousMasterId, promoted_pack_id:promoted.id, mode:"execute", status:"executed", plan:computed.plan, result:{promoted_pack_id:promoted.id,previous_master_pack_id:computed.previousMasterId,archived_pack_ids:(archived.data??[]).map((r:any)=>r.id),status_only:true,never_deletes:true}, warnings, executed_at:now });
+  await createExecutionEvent(client,{userId:input.userId,executionId:execution.id,promotionRequestId:request.id,eventType:"promotion_executed",message:"Shadow candidate promoted to active master. Previous master archived (status-only, reversible).",metadata:{promoted_pack_id:promoted.id,previous_master_pack_id:computed.previousMasterId}});
+  await createPromotionRequestEvent(client,{userId:input.userId,promotionRequestId:request.id,shadowPackId:request.shadow_pack_id,preflightId:request.preflight_id,eventType:"promotion_executed",message:"Approved promotion request executed via gated executor.",metadata:{execution_id:execution.id,promoted_pack_id:promoted.id}});
+  await audit(client,{userId:input.userId,namespace:request.namespace,action:"memory_context_pack_promoted",recordId:promoted.id,metadata:{execution_id:execution.id,promotion_request_id:request.id,previous_master_pack_id:computed.previousMasterId,status_only:true}});
+  return execution;
+}
+
+export async function rollbackPromotionExecution(client:PromotionExecutionDbClient,input:{userId:string; executionId:string; confirmation:string},env:Partial<NodeJS.ProcessEnv>=process.env):Promise<PromotionExecutionRow>{
+  if(input.confirmation!==ROLLBACK_CONFIRMATION) throw new Error(`Rollback requires the explicit confirmation phrase "${ROLLBACK_CONFIRMATION}".`);
+  if(!isPromotionExecutionEnabled(env)) throw new Error(`promotion_execution_disabled: set ${PROMOTION_EXECUTION_GATE}=true after review to enable rollback.`);
+  const execution=await getPromotionExecution(client,input); if(execution.mode!=="execute"||execution.status!=="executed") throw new Error(`Only executed promotions can be rolled back (found mode=${execution.mode}, status=${execution.status}).`); if(!execution.promoted_pack_id) throw new Error("Execution has no promoted pack to roll back.");
+  const now=new Date().toISOString();
+  const archivedPromoted=await single(client.from("memory_context_packs").update({status:"archived",updated_at:now}).eq("user_id",input.userId).eq("id",execution.promoted_pack_id).select("*").single()); if(!archivedPromoted) throw new Error("Rollback failed: promoted pack not found for current user.");
+  const warnings:string[]=[];
+  if(execution.previous_master_pack_id){ const restored=await single(client.from("memory_context_packs").update({status:"active",updated_at:now}).eq("user_id",input.userId).eq("id",execution.previous_master_pack_id).select("*").single()); if(!restored) warnings.push("restore_previous_master_failed"); } else warnings.push("no_previous_master_to_restore");
+  const updated=await single(client.from("pandora_promotion_executions").update({status:"rolled_back",rolled_back_at:now,updated_at:now,warnings}).eq("user_id",input.userId).eq("id",execution.id).select("*").single()); if(!updated) throw new Error("Unable to record rollback on execution row");
+  await createExecutionEvent(client,{userId:input.userId,executionId:execution.id,promotionRequestId:execution.promotion_request_id,eventType:"promotion_rolled_back",message:"Promotion rolled back: promoted pack archived, previous master restored (status-only, reversible).",metadata:{promoted_pack_id:execution.promoted_pack_id,previous_master_pack_id:execution.previous_master_pack_id}});
+  await audit(client,{userId:input.userId,namespace:execution.namespace,action:"memory_context_pack_promotion_rolled_back",recordId:execution.promoted_pack_id,metadata:{execution_id:execution.id,previous_master_pack_id:execution.previous_master_pack_id,status_only:true}});
+  return updated;
+}
diff --git a/supabase/migrations/20260716000000_pandora_promotion_executor.sql b/supabase/migrations/20260716000000_pandora_promotion_executor.sql
new file mode 100644
index 0000000..86effa5
--- /dev/null
+++ b/supabase/migrations/20260716000000_pandora_promotion_executor.sql
@@ -0,0 +1,72 @@
+-- Pandora promotion executor v1.
+-- Additive: widens the promotion request status set with 'promoted' and adds
+-- execution/audit tables. Execution itself stays disabled unless
+-- PANDORA_ENABLE_CONTEXT_PACK_PROMOTION=true AND the request is human-approved.
+-- Promotion is status-only on memory_context_packs (archive old master, insert
+-- new master from the reviewed shadow candidate); nothing is ever deleted and
+-- memory_events / memory_items / memory_profiles are never touched.
+
+alter table public.pandora_promotion_requests drop constraint if exists pandora_promotion_requests_status_check;
+alter table public.pandora_promotion_requests add constraint pandora_promotion_requests_status_check
+  check (status in ('draft','submitted','approved','blocked','archived','promoted'));
+
+create table if not exists public.pandora_promotion_executions (
+  id uuid primary key default gen_random_uuid(),
+  user_id uuid not null,
+  request_id text not null,
+  namespace text not null check (namespace in ('real_life','au')),
+  promotion_request_id uuid not null references public.pandora_promotion_requests(id) on delete restrict,
+  preflight_id uuid not null references public.pandora_shadow_pack_preflights(id) on delete restrict,
+  shadow_pack_id uuid not null references public.pandora_shadow_context_packs(id) on delete restrict,
+  previous_master_pack_id uuid null,
+  promoted_pack_id uuid null,
+  mode text not null check (mode in ('execute','rollback')),
+  status text not null check (status in ('executed','rolled_back','blocked','failed')),
+  plan jsonb not null default '{}'::jsonb,
+  result jsonb not null default '{}'::jsonb,
+  warnings text[] not null default '{}'::text[],
+  created_at timestamptz not null default now(),
+  updated_at timestamptz not null default now(),
+  executed_at timestamptz null,
+  rolled_back_at timestamptz null
+);
+
+create index if not exists pandora_promotion_executions_user_created_idx on public.pandora_promotion_executions (user_id, created_at desc);
+create index if not exists pandora_promotion_executions_user_request_idx on public.pandora_promotion_executions (user_id, promotion_request_id);
+create index if not exists pandora_promotion_executions_user_namespace_status_idx on public.pandora_promotion_executions (user_id, namespace, status);
+
+create table if not exists public.pandora_promotion_execution_events (
+  id uuid primary key default gen_random_uuid(),
+  user_id uuid not null,
+  execution_id uuid not null references public.pandora_promotion_executions(id) on delete cascade,
+  promotion_request_id uuid not null references public.pandora_promotion_requests(id) on delete restrict,
+  event_type text not null,
+  message text not null,
+  metadata jsonb not null default '{}'::jsonb,
+  created_at timestamptz not null default now()
+);
+
+create index if not exists pandora_promotion_execution_events_user_execution_created_idx on public.pandora_promotion_execution_events (user_id, execution_id, created_at desc);
+
+create or replace function public.set_pandora_promotion_executions_updated_at()
+returns trigger language plpgsql as $$
+begin
+  new.updated_at = now();
+  return new;
+end;
+$$;
+
+drop trigger if exists set_pandora_promotion_executions_updated_at on public.pandora_promotion_executions;
+create trigger set_pandora_promotion_executions_updated_at
+before update on public.pandora_promotion_executions
+for each row execute function public.set_pandora_promotion_executions_updated_at();
+
+alter table public.pandora_promotion_executions enable row level security;
+alter table public.pandora_promotion_execution_events enable row level security;
+
+create policy "pandora_promotion_executions_select_own" on public.pandora_promotion_executions for select to authenticated using (user_id = auth.uid());
+create policy "pandora_promotion_executions_insert_own" on public.pandora_promotion_executions for insert to authenticated with check (user_id = auth.uid());
+create policy "pandora_promotion_executions_update_own" on public.pandora_promotion_executions for update to authenticated using (user_id = auth.uid()) with check (user_id = auth.uid());
+
+create policy "pandora_promotion_execution_events_select_own" on public.pandora_promotion_execution_events for select to authenticated using (user_id = auth.uid());
+create policy "pandora_promotion_execution_events_insert_own" on public.pandora_promotion_execution_events for insert to authenticated with check (user_id = auth.uid());
diff --git a/tests/unit/pandora-operator-action-guards.test.ts b/tests/unit/pandora-operator-action-guards.test.ts
index 849086f..c6377e3 100644
--- a/tests/unit/pandora-operator-action-guards.test.ts
+++ b/tests/unit/pandora-operator-action-guards.test.ts
@@ -6,6 +6,24 @@ describe("operator action center safety guards", () => {
   it("does not render dangerous live action buttons", () => { const text = files.map((f)=>readFileSync(f,"utf8")).join("\n"); for (const bad of ["Promote live", "Replace master", "Execute promotion", "Delete memory", "Prune now", "Merge now", "Distill now"]) expect(text).not.toContain(bad); });
   it("service does not import service-role/admin clients or mutate core memory tables", () => { const text=readFileSync("lib/services/pandora-operator-action-service.ts","utf8")+readFileSync("lib/services/pandora-shadow-context-pack-service.ts","utf8")+readFileSync("lib/services/pandora-promotion-request-service.ts","utf8"); expect(text).not.toContain("service-role"); expect(text).not.toContain("createSupabaseBridgeAdminClient"); expect(text).not.toContain(".delete("); for (const table of ["memory_events","memory_context_packs","memory_profiles","memory_capture_candidates","memory_pruning_candidates"]) expect(text).not.toMatch(new RegExp(`from\\(\\\"${table}\\\"\\).*\\.(insert|update|delete)`)); expect(text).toContain("no_core_memory_mutation_performed: true"); });
   it("production pandora path does not import mock-data and route identity rejects client user ids", () => { expect(readFileSync("app/pandora/page.tsx","utf8")).not.toContain("mock-data"); const route=readFileSync("app/api/pandora/operator-actions/route.ts","utf8")+readFileSync("app/api/pandora/shadow-context-packs/route.ts","utf8")+readFileSync("app/api/pandora/shadow-context-packs/[id]/review/route.ts","utf8")+readFileSync("app/api/pandora/promotion-requests/route.ts","utf8")+readFileSync("app/api/pandora/promotion-requests/[id]/review/route.ts","utf8"); expect(route).toContain("assertNoClientUserIdOverride"); expect(route).not.toContain("searchParams.get(\"user_id\")"); expect(route).not.toContain("body.user_id"); });
-  it("does not add promotion execution routes", () => { const routes = ["app/api/pandora/promotion-requests/[id]/execute/route.ts", "app/api/pandora/promotion-requests/[id]/promote/route.ts"]; for (const route of routes) expect(existsSync(route)).toBe(false); });
+  it("promotion execution exists only behind the env gate + confirmation phrase, and never deletes", () => {
+    // The un-gated legacy execution paths must never exist.
+    for (const route of ["app/api/pandora/promotion-requests/[id]/execute/route.ts", "app/api/pandora/promotion-requests/[id]/promote/route.ts"]) expect(existsSync(route)).toBe(false);
+    // The gated executor (promotion executor v1) must enforce the gate and confirmation phrases,
+    // must not use service-role/admin clients, must never call .delete(, and may write only
+    // memory_context_packs among core memory tables (status-only promotion/rollback).
+    const svc = readFileSync("lib/services/pandora-promotion-execution-service.ts", "utf8");
+    expect(svc).toContain("PANDORA_ENABLE_CONTEXT_PACK_PROMOTION");
+    expect(svc).toContain('PROMOTE_CONFIRMATION = "PROMOTE"');
+    expect(svc).toContain('ROLLBACK_CONFIRMATION = "ROLLBACK"');
+    expect(svc).not.toContain("service-role");
+    expect(svc).not.toContain("createSupabaseBridgeAdminClient");
+    expect(svc).not.toContain(".delete(");
+    for (const table of ["memory_events", "memory_items", "memory_profiles", "memory_capture_candidates", "memory_pruning_candidates"]) expect(svc).not.toMatch(new RegExp(`from\\(\\"${table}\\"\\)`));
+    // Execution routes must derive identity server-side and reject client user ids.
+    const routes = readFileSync("app/api/pandora/promotion-requests/[id]/execution/route.ts", "utf8") + readFileSync("app/api/pandora/promotion-requests/[id]/execution/dry-run/route.ts", "utf8") + readFileSync("app/api/pandora/promotion-executions/[id]/rollback/route.ts", "utf8");
+    expect(routes).toContain("assertNoClientUserIdOverride");
+    expect(routes).not.toContain("body.user_id");
+  });
   it("retrieval eval still has no fabricated accuracy", () => { const text=readFileSync("lib/services/pandora-verification-service.ts","utf8")+readFileSync("lib/services/pandora-dashboard-service.ts","utf8"); expect(text).not.toContain("94.3"); expect(text).not.toContain("fake accuracy"); expect(text).not.toContain("retrieval accuracy: 100%"); });
 });
diff --git a/tests/unit/pandora-promotion-execution-service.test.ts b/tests/unit/pandora-promotion-execution-service.test.ts
new file mode 100644
index 0000000..212531d
--- /dev/null
+++ b/tests/unit/pandora-promotion-execution-service.test.ts
@@ -0,0 +1,136 @@
+/* eslint-disable @typescript-eslint/no-explicit-any */
+import { describe, expect, it } from "vitest";
+import { dryRunPromotionExecution, executeApprovedPromotion, rollbackPromotionExecution, PROMOTION_EXECUTION_GATE } from "@/lib/services/pandora-promotion-execution-service";
+
+const USER = "11111111-1111-4111-8111-111111111111";
+type Row = Record<string, any>;
+type Store = Record<string, Row[]>;
+
+// In-memory client: eq/neq-filtered reads, inserts append, updates patch every matching row.
+function client(store: Store, ops: any[] = []) {
+  return { from(table: string) {
+    const eqs: Record<string, any> = {}; const neqs: Record<string, any> = {}; let lim = Infinity; let mode: "select" | "insert" | "update" = "select"; let patch: Row | null = null; let inserted: Row[] = [];
+    const src = () => (store[table] ??= []);
+    const matches = (r: Row) => Object.entries(eqs).every(([k, v]) => r[k] === v) && Object.entries(neqs).every(([k, v]) => r[k] !== v);
+    const rows = () => src().filter(matches).slice(0, lim);
+    const b: any = {
+      select() { return b; }, order() { return b; }, single() { return b; },
+      eq(k: string, v: any) { eqs[k] = v; return b; }, neq(k: string, v: any) { neqs[k] = v; return b; }, limit(n: number) { lim = n; return b; },
+      insert(value: Row | Row[]) { mode = "insert"; inserted = Array.isArray(value) ? value : [value]; return b; },
+      update(value: Row) { mode = "update"; patch = value; return b; },
+      then(res: any, rej: any) {
+        if (mode === "insert") { src().push(...inserted); return Promise.resolve({ data: inserted, error: null }).then(res, rej); }
+        if (mode === "update") { const affected = rows(); for (const r of affected) Object.assign(r, patch); ops.push({ table, patch, eqs: { ...eqs }, neqs: { ...neqs }, ids: affected.map((r) => r.id) }); return Promise.resolve({ data: affected, error: null }).then(res, rej); }
+        return Promise.resolve({ data: rows(), error: null }).then(res, rej);
+      },
+    };
+    return b;
+  } } as any;
+}
+
+function store(overrides: { requestStatus?: string; reviewerDecision?: string | null; requestMasterId?: string | null; liveMaster?: boolean } = {}): Store {
+  const { requestStatus = "approved", reviewerDecision = "approved", requestMasterId = "m1", liveMaster = true } = overrides;
+  return {
+    pandora_shadow_context_packs: [{ id: "s1", user_id: USER, request_id: "req", namespace: "real_life", pack_type: "master_candidate", status: "reviewed", title: "Shadow RL", summary: "shadow summary", source_window: {}, candidate_payload: { title: "Promoted RL master", summary: "promoted summary", key_points: ["kp"], active_projects: [], people_map: [], decisions: [], risks: [], open_loops: [], generated_from_event_ids: ["e1"] }, evidence: {}, warnings: [], created_at: "2026-01-01", updated_at: "2026-01-01" }],
+    pandora_shadow_pack_preflights: [{ id: "p1", user_id: USER, shadow_pack_id: "s1", namespace: "real_life", active_master_pack_id: "m1", request_id: "pre", status: "approved_for_promotion", diff_summary: { has_active_master: true }, risk_summary: { status: "low", score: 10, reasons: [], blockers: [], warnings: [] }, reviewer_notes: "", reviewer_decision: "approved_for_promotion", warnings: [], created_at: "2026-01-01", updated_at: "2026-01-01" }],
+    pandora_promotion_requests: [{ id: "r1", user_id: USER, request_id: "req-1", namespace: "real_life", shadow_pack_id: "s1", preflight_id: "p1", active_master_pack_id: requestMasterId, status: requestStatus, title: "t", summary: "s", promotion_plan: {}, rollback_plan: {}, risk_snapshot: {}, diff_snapshot: {}, reviewer_notes: "", reviewer_decision: reviewerDecision, warnings: [], created_at: "2026-01-01", updated_at: "2026-01-01" }],
+    pandora_promotion_request_events: [], pandora_promotion_executions: [], pandora_promotion_execution_events: [],
+    memory_context_packs: [
+      ...(liveMaster ? [{ id: "m1", user_id: USER, namespace: "real_life", pack_type: "master", status: "active", title: "old master", summary: "old" }] : []),
+      { id: "au-m", user_id: USER, namespace: "au", pack_type: "master", status: "active", title: "au master", summary: "au" },
+    ],
+    memory_events: [], memory_profiles: [], memory_capture_candidates: [], memory_pruning_candidates: [], audit_logs: [],
+  };
+}
+
+const gateOn = { [PROMOTION_EXECUTION_GATE]: "true" } as any;
+const gateOff = {} as any;
+
+describe("promotion execution service", () => {
+  it("gate defaults off: execute and rollback refuse and mutate nothing", async () => {
+    const s = store();
+    await expect(executeApprovedPromotion(client(s), { userId: USER, promotionRequestId: "r1", confirmation: "PROMOTE" }, gateOff)).rejects.toThrow(/promotion_execution_disabled/);
+    await expect(rollbackPromotionExecution(client(s), { userId: USER, executionId: "x", confirmation: "ROLLBACK" }, gateOff)).rejects.toThrow(/promotion_execution_disabled/);
+    expect(s.memory_context_packs.filter((p) => p.status === "active")).toHaveLength(2);
+    expect(s.pandora_promotion_executions).toHaveLength(0);
+  });
+
+  it("requires the explicit confirmation phrase even with the gate on", async () => {
+    const s = store();
+    await expect(executeApprovedPromotion(client(s), { userId: USER, promotionRequestId: "r1", confirmation: "yes" }, gateOn)).rejects.toThrow(/confirmation phrase/);
+    expect(s.memory_context_packs).toHaveLength(2);
+    expect(s.pandora_promotion_executions).toHaveLength(0);
+  });
+
+  it("dry run computes an executable plan without writing anything", async () => {
+    const s = store();
+    const before = JSON.stringify(s.memory_context_packs);
+    const dry = await dryRunPromotionExecution(client(s), { userId: USER, promotionRequestId: "r1" }, gateOff);
+    expect(dry.blockers).toHaveLength(0);
+    expect(dry.gate_enabled).toBe(false);
+    expect(dry.executable).toBe(false); // plan is clean but the gate is off
+    expect((dry.plan as any).status_only).toBe(true);
+    expect(JSON.stringify(s.memory_context_packs)).toBe(before);
+    expect(s.pandora_promotion_executions).toHaveLength(0);
+    expect(s.audit_logs).toHaveLength(0);
+  });
+
+  it("executes an approved promotion: new master from candidate, old archived, request promoted, audit written", async () => {
+    const s = store();
+    const execution = await executeApprovedPromotion(client(s), { userId: USER, promotionRequestId: "r1", confirmation: "PROMOTE" }, gateOn);
+    expect(execution.status).toBe("executed");
+    expect(execution.previous_master_pack_id).toBe("m1");
+    const rlMasters = s.memory_context_packs.filter((p) => p.namespace === "real_life" && p.pack_type === "master");
+    const active = rlMasters.filter((p) => p.status === "active");
+    expect(active).toHaveLength(1);
+    expect(active[0].id).toBe(execution.promoted_pack_id);
+    expect(active[0].title).toBe("Promoted RL master");
+    expect(s.memory_context_packs.find((p) => p.id === "m1")!.status).toBe("archived"); // archived, not deleted
+    expect(s.memory_context_packs.find((p) => p.id === "au-m")!.status).toBe("active"); // other namespace untouched
+    expect(s.pandora_promotion_requests[0].status).toBe("promoted");
+    expect(s.pandora_promotion_execution_events.map((e) => e.event_type)).toContain("promotion_executed");
+    expect(s.audit_logs.map((a) => a.action)).toContain("memory_context_pack_promoted");
+    expect(s.memory_events).toHaveLength(0);
+    expect(s.memory_profiles).toHaveLength(0);
+  });
+
+  it("blocks execution when the request is not approved, recording a blocked execution row", async () => {
+    const s = store({ requestStatus: "submitted", reviewerDecision: null });
+    await expect(executeApprovedPromotion(client(s), { userId: USER, promotionRequestId: "r1", confirmation: "PROMOTE" }, gateOn)).rejects.toThrow(/blocked/);
+    expect(s.memory_context_packs.filter((p) => p.status === "active")).toHaveLength(2);
+    expect(s.pandora_promotion_executions).toHaveLength(1);
+    expect(s.pandora_promotion_executions[0].status).toBe("blocked");
+  });
+
+  it("blocks execution when the active master changed since approval", async () => {
+    const s = store();
+    s.memory_context_packs.find((p) => p.id === "m1")!.status = "archived";
+    s.memory_context_packs.push({ id: "m2", user_id: USER, namespace: "real_life", pack_type: "master", status: "active", title: "newer", summary: "n" });
+    await expect(executeApprovedPromotion(client(s), { userId: USER, promotionRequestId: "r1", confirmation: "PROMOTE" }, gateOn)).rejects.toThrow(/Active master changed/);
+    expect(s.memory_context_packs.find((p) => p.id === "m2")!.status).toBe("active");
+  });
+
+  it("rolls back an executed promotion: promoted archived, previous master restored", async () => {
+    const s = store();
+    const c = client(s);
+    const execution = await executeApprovedPromotion(c, { userId: USER, promotionRequestId: "r1", confirmation: "PROMOTE" }, gateOn);
+    const rolledBack = await rollbackPromotionExecution(c, { userId: USER, executionId: execution.id, confirmation: "ROLLBACK" }, gateOn);
+    expect(rolledBack.status).toBe("rolled_back");
+    expect(s.memory_context_packs.find((p) => p.id === execution.promoted_pack_id)!.status).toBe("archived");
+    expect(s.memory_context_packs.find((p) => p.id === "m1")!.status).toBe("active");
+    const active = s.memory_context_packs.filter((p) => p.namespace === "real_life" && p.pack_type === "master" && p.status === "active");
+    expect(active).toHaveLength(1);
+    expect(s.audit_logs.map((a) => a.action)).toContain("memory_context_pack_promotion_rolled_back");
+    await expect(rollbackPromotionExecution(c, { userId: USER, executionId: execution.id, confirmation: "ROLLBACK" }, gateOn)).rejects.toThrow(/Only executed promotions/);
+  });
+
+  it("never deletes rows from any table it touches", async () => {
+    const s = store();
+    const c = client(s);
+    const totalRows = () => Object.values(s).reduce((n, rows) => n + rows.length, 0);
+    const before = totalRows();
+    const execution = await executeApprovedPromotion(c, { userId: USER, promotionRequestId: "r1", confirmation: "PROMOTE" }, gateOn);
+    await rollbackPromotionExecution(c, { userId: USER, executionId: execution.id, confirmation: "ROLLBACK" }, gateOn);
+    expect(totalRows()).toBeGreaterThanOrEqual(before); // rows are only ever added or re-statused
+  });
+});