diff --git a/.github/bench/README.md b/.github/bench/README.md
index a9e4d742..06218717 100644
--- a/.github/bench/README.md
+++ b/.github/bench/README.md
@@ -3,17 +3,58 @@
 Origin: [`docs/plans/2026-07-10-001-feat-benchmark-ci-pipeline-plan.md`](../../docs/plans/2026-07-10-001-feat-benchmark-ci-pipeline-plan.md)
 (and the requirements brainstorm it links). Doctrine in one line: **B/op
 (`-prof gc` allocation norm) is deterministic on shared runners and is the
-only metric that may ever gate; ns/op is directional advice.**
+calibrated regression signal; ns/op is directional advice. PR benchmarks
+are informational comments, never merge gates.**
 
 ## The pieces
 
 | Piece | What it does |
 |---|---|
-| `bench_tools.py` | All pipeline logic (mapping, diff, rendering). `python3 -m unittest discover .github/bench` runs its suite; both workflows run it as their first step. |
-| `bench-pr.yml` | Same-job A/B on same-repo PRs touching mapped paths: merge-base run, head run, sticky comment. `perf:full` label ⇒ full suite. `workflow_dispatch mode=aa` ⇒ noise calibration. |
+| `bench_tools.py` | Mapping, diff, rendering. `python3 -m unittest discover .github/bench` runs its suite and the PR-planning tests; both workflows run it as their first step. |
+| `pr_bench.py` | Trusted PR resolution, immutable SHA planning, and freshness check before posting. |
+| `bench-pr.yml` | After successful PR CI, runs on the default branch: same-VM merge-base vs exact PR-head comparison, then sticky comment. No benchmark check is attached to the PR head. `perf:full` ⇒ full suite. Manual A/B reruns and A/A calibration remain available. |
 | `bench-sweep.yml` | Nightly-if-changed + release-tag full sweep. One atomic bot commit to main (`[skip ci]`) carrying `BENCHMARKS.md` + an append to `site/laika-static/bench/series.jsonl`; attaches `jmh-results-<tag>.json` to releases. |
 | `site/laika-static/bench/index.html` | Static history chart, shipped in-tree; Laika copies it (and the series) verbatim into the docs site, so it serves at `/bench/` on the existing Cloudflare Pages deployment — refreshed at each site deploy (preview per main push, production per `v*` tag). |
-| `thresholds.json` | **Absent = advisory (current state).** Present = the B/op gate is live. |
+| `thresholds.json` | Absent = no calibrated allocation warnings (current state). Present = highlight B/op threshold breaches in the comment, still non-blocking. The local `diff` CLI retains exit 3 for callers that want a gate. |
+
+## Automatic reports and manual reruns
+
+`workflow_run` listens for a successful **Continuous Integration** run
+whose event was `pull_request`. Push CI runs, fork PRs, closed PRs, stale
+head SHAs, and PRs not targeting `main` are ignored. GitHub sometimes omits
+`workflow_run.pull_requests`, so resolution uses the same-repository head
+branch and verifies the exact triggering head SHA against the live PR.
+
+Planning and publishing use the workflow's default-branch SHA. Measurement
+uses the exact PR head (not a moving branch or synthetic merge ref), compared
+with its merge-base against the PR base. Both runs still share one VM and
+the existing reduced JMH profile. Docs/site/tests-only changes skip unless
+`perf:full` is set. Adding that label **after** CI completes does not trigger
+another workflow; dispatch a rerun:
+
+```sh
+gh workflow run bench-pr.yml --ref main -f pr=129
+gh workflow run bench-pr.yml --ref main -f pr=129 -f filter='.*LensBench.*'
+gh workflow run bench-pr.yml --ref main -f mode=aa
+```
+
+Use the default branch in the Actions UI too. A/A benchmarks that branch's
+workflow SHA twice and writes a noise report to the summary and artifact;
+leave `pr` blank. Dispatching the workflow from a feature branch is rejected
+to avoid attaching a long-running check to that branch.
+
+The comment includes its head SHA and a link to the benchmark run. Immediately
+before posting, the publisher rechecks that the PR is open, same-repository,
+targets `main`, and still has that SHA. Obsolete results remain in Actions
+artifacts but cannot overwrite the current revision's comment. Different head
+revisions can finish independently; duplicate measurements of the same PR/head
+cancel one another. Cancelled measurements do not publish a failure comment.
+
+Bench/build/tooling failures produce an explicit ❌ comment and a failed
+**detached** Actions run; threshold breaches only highlight the result.
+Neither blocks the PR. This workflow must first be on the default branch for
+`workflow_run` or manual dispatch to work. Existing PR-head checks from older
+workflow runs remain historical records.
 
 ## Running the tool locally
 
@@ -47,9 +88,9 @@ but never silently skip. When adding a module or bench class: update the
 dict; `validate-mapping` (run by both workflows) fails loudly on stale
 entries, and the unit tests pin the semantics.
 
-## Calibration and flipping the gate (advisory → gating)
+## Calibration and enabling allocation warnings
 
-1. Dispatch **Benchmark A/B** with `mode=aa` (same ref twice) at least 3
+1. Dispatch **Benchmark A/B** from `main` with `mode=aa` (same SHA twice) at least 3
    times; each posts a noise report to the run summary and artifact.
 2. B/op floor must be ~0. If it isn't: first pin the fork JVM's
    allocation ergonomics — adaptive TLAB sizing makes `gc.alloc.rate.norm`
@@ -62,7 +103,7 @@ entries, and the unit tests pin the semantics.
    see step 4.
 3. Commit `.github/bench/thresholds.json`, e.g.
    `{"bop_regression_pct": 1.0, "bop_min_delta_bytes": 16}` — quantile
-   data from the reports, not guesses.
+   data from the reports, not guesses. This enables warnings, not PR gating.
 4. **Profile binding (R5):** any change to `JMH_PROFILE`, the JDK, or the
    runner image invalidates calibration — delete `thresholds.json` in the
    same PR and recalibrate before restoring it.
@@ -79,9 +120,17 @@ recorded in the provenance (`--jmh-params` / `--profile`).
 
 ## Credentials and trust boundaries (R15)
 
-- `bench-pr.yml` executes PR code ⇒ same-repo PRs only, token holds only
-  `contents: read` + `pull-requests: write`; the sticky-comment action is
-  SHA-pinned. Fork PRs get no run/comment (deploy-site.yml caveat).
+- `bench-pr.yml` accepts same-repo PRs only. Its planning job reads Git
+  objects with a read-only token and never executes PR code. The measurement
+  job executes PR code with only `contents: read`, no persisted checkout
+  credentials, and restore-only caches (no PR cache saves on the default
+  branch). It uploads raw JMH JSON only.
+- A separate publisher checks out trusted default-branch tooling, renders
+  that JSON as data, and holds `pull-requests: write` for the SHA-pinned
+  sticky-comment action. PR number and SHAs come from the trusted plan, not
+  the artifact; artifacts cannot supply executable tooling or publication
+  targets. Threshold configuration also comes from that trusted checkout.
+  Fork PRs get no run/comment.
 - `bench-sweep.yml` executes trusted main/tag code only and is the sole
   holder of `contents: write` and the sole writer of the series file.
 - Bot pushes use the plain `GITHUB_TOKEN` (proven by
diff --git a/.github/bench/bench_tools.py b/.github/bench/bench_tools.py
index b78b2063..7a35a07f 100644
--- a/.github/bench/bench_tools.py
+++ b/.github/bench/bench_tools.py
@@ -291,7 +291,7 @@ def comment_md(deltas: dict | None, failure: str | None) -> str:
 
     if deltas["gate"]["enabled"] and deltas["gate"]["violations"]:
         lines += [
-            "### 🚨 B/op gate: "
+            "### 🚨 B/op regression exceeds calibrated threshold: "
             + ", ".join(esc(v) for v in deltas["gate"]["violations"]),
             "",
         ]
diff --git a/.github/bench/pr_bench.py b/.github/bench/pr_bench.py
new file mode 100644
index 00000000..0caf6fe8
--- /dev/null
+++ b/.github/bench/pr_bench.py
@@ -0,0 +1,160 @@
+"""Trusted planning and freshness checks for detached PR benchmarks.
+
+Runs only on the default-branch checkout, never alongside PR build code.
+The benchmark's artifact is data, not a source of PR numbers or SHAs.
+"""
+
+import argparse
+import itertools
+import json
+import os
+import pathlib
+import re
+import subprocess
+import urllib.parse
+import urllib.request
+
+import bench_tools
+
+
+class GitHub:
+    def __init__(self, repository):
+        self.repository = repository
+
+    def get(self, path, **query):
+        url = f"{os.environ.get('GITHUB_API_URL', 'https://api.github.com')}/repos/{self.repository}/{path}"
+        if query:
+            url += "?" + urllib.parse.urlencode(query)
+        request = urllib.request.Request(url, headers={
+            "Authorization": f"Bearer {os.environ['GH_TOKEN']}",
+            "Accept": "application/vnd.github+json",
+            "X-GitHub-Api-Version": "2022-11-28",
+        })
+        with urllib.request.urlopen(request, timeout=30) as response:
+            return json.load(response)
+
+    def pulls(self, branch):
+        # workflow_run.pull_requests can be empty even for same-repo PRs.
+        for page in itertools.count(1):
+            batch = self.get("pulls", state="open", base="main",
+                             head=f"{self.repository.split('/')[0]}:{branch}",
+                             per_page=100, page=page)
+            yield from batch
+            if len(batch) < 100:
+                return
+
+
+def current_pr(pr, repository, head=None):
+    """One rule shared by planning and the last check before commenting."""
+    return (
+        pr.get("state") == "open"
+        and pr.get("base", {}).get("ref") == "main"
+        and (pr.get("head", {}).get("repo") or {}).get("full_name") == repository
+        and (head is None or pr["head"]["sha"] == head)
+    )
+
+
+def resolve(event_name, event, github, workflow_sha):
+    """Return (PR or None, mode, filter), or None when no run is eligible."""
+    if event_name == "workflow_run":
+        run = event["workflow_run"]
+        if (run.get("event") != "pull_request" or run.get("conclusion") != "success"
+                or (run.get("head_repository") or {}).get("full_name") != github.repository):
+            return None
+        candidates = [
+            pr for pr in github.pulls(run["head_branch"])
+            if current_pr(pr, github.repository, run["head_sha"])
+        ]
+        if len(candidates) != 1:
+            return None
+        return candidates[0], "ab", ""
+
+    if event_name != "workflow_dispatch":
+        raise ValueError(f"Unsupported event: {event_name}")
+    inputs = event.get("inputs", {})
+    mode = inputs.get("mode", "ab")
+    number = inputs.get("pr", "").strip()
+    regex = inputs.get("filter", "")
+    if mode == "aa":
+        if number:
+            raise ValueError("A/A calibration uses the default branch; leave pr blank")
+        checked_sha(workflow_sha)
+        return None, mode, regex
+    if mode != "ab" or not number.isdecimal() or int(number) < 1:
+        raise ValueError("A/B requires a positive PR number; use mode=aa for calibration")
+    pr = github.get(f"pulls/{int(number)}")
+    if not current_pr(pr, github.repository):
+        return None
+    return pr, mode, regex
+
+
+def checked_sha(value):
+    if not re.fullmatch(r"[0-9a-f]{40}", value):
+        raise ValueError("Expected an immutable Git SHA")
+    return value
+
+
+def git(*args):
+    return subprocess.check_output(["git", *args], text=True).strip()
+
+
+def plan(request, workflow_sha):
+    if request is None:
+        return {"run": "false"}
+    pr, mode, override = request
+    head = checked_sha(pr["head"]["sha"] if pr else workflow_sha)
+    if mode == "aa":
+        base = head
+        regex = override or "FULL"
+    else:
+        target = checked_sha(pr["base"]["sha"])
+        git("fetch", "--no-tags", "origin", head, target)
+        base = checked_sha(git("merge-base", target, head))
+        full = any(label["name"] == "perf:full" for label in pr.get("labels", []))
+        regex = override or ("FULL" if full else bench_tools.affected(
+            git("diff", "--name-only", f"{base}...{head}").splitlines()))
+    return {
+        "run": "true" if regex else "false",
+        "pr": str(pr["number"]) if pr else "",
+        "mode": mode,
+        "base": base,
+        "head": head,
+        "regex": r".*Bench\..*" if regex == "FULL" else regex,
+    }
+
+
+def write_outputs(values, path):
+    # Filters are operator input, not executable shell fragments. Reject
+    # newlines rather than allowing extra workflow outputs to be injected.
+    lines = []
+    for key, value in values.items():
+        if "\n" in value or "\r" in value:
+            raise ValueError("Workflow outputs must be single-line values")
+        lines.append(f"{key}={value}\n")
+    with pathlib.Path(path).open("a", encoding="utf-8") as output:
+        output.writelines(lines)
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("command", choices=["plan", "check"])
+    args = parser.parse_args()
+    github = GitHub(os.environ["GITHUB_REPOSITORY"])
+    if args.command == "plan":
+        event = json.loads(pathlib.Path(os.environ["GITHUB_EVENT_PATH"]).read_text())
+        default_ref = f"refs/heads/{event['repository']['default_branch']}"
+        if os.environ["GITHUB_REF"] != default_ref:
+            raise ValueError("Dispatch the benchmark workflow from the default branch")
+        values = plan(resolve(os.environ["GITHUB_EVENT_NAME"], event, github,
+                              os.environ["GITHUB_SHA"]), os.environ["GITHUB_SHA"])
+    else:
+        number = int(os.environ["PR_NUMBER"])
+        head = checked_sha(os.environ["HEAD_SHA"])
+        values = {"current": str(current_pr(
+            github.get(f"pulls/{number}"), github.repository, head)).lower()}
+    write_outputs(values, os.environ["GITHUB_OUTPUT"])
+    print(json.dumps(values))
+
+
+if __name__ == "__main__":
+    main()
diff --git a/.github/bench/test_bench_tools.py b/.github/bench/test_bench_tools.py
index 78fbdd18..f1a1810c 100644
--- a/.github/bench/test_bench_tools.py
+++ b/.github/bench/test_bench_tools.py
@@ -187,12 +187,14 @@ def test_untrusted_names_are_escaped(self):
         self.assertNotIn("<script>", md)
         self.assertNotIn("](http://x)", md)
 
-    def test_gate_violation_banner(self):
+    def test_threshold_violation_banner_is_informational(self):
         base = load([jmh_entry(FQN, 100, bop=40)])
         head = load([jmh_entry(FQN, 100, bop=80)])
         d = bt.diff(base, head, {}, {"bop_regression_pct": 2.0, "bop_min_delta_bytes": 16})
         md = bt.comment_md(d, None)
         self.assertIn("🚨", md)
+        self.assertIn("exceeds calibrated threshold", md)
+        self.assertNotIn("B/op gate", md)
 
 
 class BenchmarksMd(unittest.TestCase):
diff --git a/.github/bench/test_pr_bench.py b/.github/bench/test_pr_bench.py
new file mode 100644
index 00000000..a4c35f4e
--- /dev/null
+++ b/.github/bench/test_pr_bench.py
@@ -0,0 +1,220 @@
+"""Detached benchmark planning tests; no network, Git fetches, or sbt."""
+
+import copy
+import json
+import os
+import pathlib
+import tempfile
+import unittest
+from unittest.mock import Mock, patch
+
+import pr_bench as pb
+
+
+REPOSITORY = "Constructive-Programming/eo"
+HEAD = "a" * 40
+BASE = "b" * 40
+MERGE_BASE = "c" * 40
+PR = {
+    "number": 129,
+    "state": "open",
+    "head": {"sha": HEAD, "repo": {"full_name": REPOSITORY}},
+    "base": {"ref": "main", "sha": BASE},
+    "labels": [],
+}
+EVENT = {
+    "workflow_run": {
+        "event": "pull_request",
+        "conclusion": "success",
+        "head_repository": {"full_name": REPOSITORY},
+        "head_branch": "feature/indexed",
+        "head_sha": HEAD,
+        "pull_requests": [],
+    },
+}
+
+
+class Resolve(unittest.TestCase):
+    def setUp(self):
+        self.api = Mock(repository=REPOSITORY)
+        self.api.pulls.return_value = [copy.deepcopy(PR)]
+        self.api.get.return_value = copy.deepcopy(PR)
+
+    def test_resolves_even_when_workflow_run_pr_array_is_empty(self):
+        result = pb.resolve("workflow_run", EVENT, self.api, BASE)
+        self.assertEqual(result, (PR, "ab", ""))
+        self.api.pulls.assert_called_once_with("feature/indexed")
+
+    def test_ignores_push_failed_cancelled_and_fork_ci_without_api_access(self):
+        for field, value in [
+            ("event", "push"),
+            ("conclusion", "failure"),
+            ("conclusion", "cancelled"),
+            ("head_repository", {"full_name": "someone/eo"}),
+            ("head_repository", None),
+        ]:
+            with self.subTest(field=field, value=value):
+                event = copy.deepcopy(EVENT)
+                event["workflow_run"][field] = value
+                self.assertIsNone(pb.resolve("workflow_run", event, self.api, BASE))
+        self.api.pulls.assert_not_called()
+
+    def test_stale_closed_wrong_base_fork_and_deleted_repo_prs_are_rejected(self):
+        for field, value in [
+            ("state", "closed"),
+            ("base", {"ref": "release"}),
+            ("head", {"sha": BASE, "repo": {"full_name": REPOSITORY}}),
+            ("head", {"sha": HEAD, "repo": {"full_name": "someone/eo"}}),
+            ("head", {"sha": HEAD, "repo": None}),
+        ]:
+            with self.subTest(field=field, value=value):
+                pr = copy.deepcopy(PR)
+                pr[field] = value
+                self.assertFalse(pb.current_pr(pr, REPOSITORY, HEAD))
+                self.api.pulls.return_value = [pr]
+                self.assertIsNone(pb.resolve("workflow_run", EVENT, self.api, BASE))
+
+    def test_does_not_guess_when_no_pr_or_ambiguous_prs_match(self):
+        for candidates in [[], [PR, PR]]:
+            self.api.pulls.return_value = candidates
+            self.assertIsNone(pb.resolve("workflow_run", EVENT, self.api, BASE))
+
+    def test_manual_ab_resolves_pr_and_preserves_filter_as_data(self):
+        result = pb.resolve("workflow_dispatch", {
+            "inputs": {"pr": "129", "mode": "ab", "filter": ".*LensBench.*"},
+        }, self.api, BASE)
+        self.assertEqual(result, (PR, "ab", ".*LensBench.*"))
+        self.api.get.assert_called_once_with("pulls/129")
+
+    def test_manual_fork_pr_is_rejected(self):
+        self.api.get.return_value["head"]["repo"]["full_name"] = "someone/eo"
+        self.assertIsNone(pb.resolve("workflow_dispatch", {
+            "inputs": {"pr": "129"},
+        }, self.api, BASE))
+
+    def test_manual_invalid_or_missing_pr_fails_clearly(self):
+        for number in ["", "0", "-1", "129\nhead=bad", "not-a-number"]:
+            with self.subTest(number=number), self.assertRaises(ValueError):
+                pb.resolve("workflow_dispatch", {"inputs": {"pr": number}}, self.api, BASE)
+
+    def test_aa_does_not_query_pr_and_rejects_accidental_pr_input(self):
+        result = pb.resolve("workflow_dispatch", {"inputs": {"mode": "aa"}}, self.api, BASE)
+        self.assertEqual(result, (None, "aa", ""))
+        self.api.get.assert_not_called()
+        with self.assertRaises(ValueError):
+            pb.resolve("workflow_dispatch", {
+                "inputs": {"mode": "aa", "pr": "129"},
+            }, self.api, BASE)
+
+    def test_paginated_branch_lookup_keeps_same_repo_and_main_filters(self):
+        api = pb.GitHub(REPOSITORY)
+        with patch.object(api, "get", side_effect=[[PR] * 100, [PR]]) as get:
+            self.assertEqual(len(list(api.pulls("feature/indexed"))), 101)
+        self.assertEqual(get.call_count, 2)
+        self.assertEqual(get.call_args.kwargs, {
+            "state": "open", "base": "main",
+            "head": "Constructive-Programming:feature/indexed",
+            "per_page": 100, "page": 2,
+        })
+
+
+class Plan(unittest.TestCase):
+    def planned(self, paths, labels=(), override=""):
+        pr = copy.deepcopy(PR)
+        pr["labels"] = [{"name": label} for label in labels]
+        with patch.object(pb, "git", side_effect=["", MERGE_BASE, "\n".join(paths)]) as git:
+            result = pb.plan((pr, "ab", override), BASE)
+        git.assert_any_call("fetch", "--no-tags", "origin", HEAD, BASE)
+        git.assert_any_call("merge-base", BASE, HEAD)
+        return result
+
+    def test_raw_pr_head_and_merge_base_are_immutable(self):
+        result = self.planned(["core/src/main/scala/Optic.scala"])
+        self.assertEqual(result, {
+            "run": "true", "pr": "129", "mode": "ab",
+            "head": HEAD, "base": MERGE_BASE, "regex": r".*Bench\..*",
+        })
+
+    def test_docs_only_skip_and_module_mapping_are_preserved(self):
+        self.assertEqual(self.planned(["site/docs/indexed.md"])["run"], "false")
+        result = self.planned(["avro/src/main/scala/AvroCodec.scala"])
+        self.assertEqual(result["run"], "true")
+        self.assertIn("OrderAvroBench", result["regex"])
+        self.assertNotIn("SchemesBench", result["regex"])
+
+    def test_full_label_and_explicit_override_take_precedence(self):
+        result = self.planned(["README.md"], labels=["perf:full"])
+        self.assertEqual(result["regex"], r".*Bench\..*")
+        result = self.planned(["core/Foo.scala"], labels=["perf:full"], override=".*LensBench.*")
+        self.assertEqual(result["regex"], ".*LensBench.*")
+
+    def test_aa_runs_same_default_branch_sha_twice_without_git(self):
+        with patch.object(pb, "git") as git:
+            result = pb.plan((None, "aa", ""), BASE)
+        git.assert_not_called()
+        self.assertEqual(result["head"], result["base"])
+        self.assertEqual(result["pr"], "")
+        self.assertEqual(result["run"], "true")
+
+    def test_ineligible_request_does_not_fetch(self):
+        with patch.object(pb, "git") as git:
+            self.assertEqual(pb.plan(None, BASE), {"run": "false"})
+        git.assert_not_called()
+
+    def test_refs_and_shell_fragments_are_not_accepted_as_shas(self):
+        for value in ["main", "a" * 39, HEAD + "\n", "-x", "$(echo bad)"]:
+            with self.subTest(value=value), self.assertRaises(ValueError):
+                pb.checked_sha(value)
+
+    def test_output_injection_is_rejected_before_any_output_is_written(self):
+        with tempfile.TemporaryDirectory() as directory:
+            path = pathlib.Path(directory) / "outputs"
+            for value in ["x\npr=5", "x\rpr=5"]:
+                with self.assertRaises(ValueError):
+                    pb.write_outputs({"run": "true", "regex": value}, path)
+                self.assertFalse(path.exists())
+            pb.write_outputs({"run": "true", "regex": ".*LensBench.*"}, path)
+            self.assertEqual(path.read_text(), "run=true\nregex=.*LensBench.*\n")
+
+
+class CommandLine(unittest.TestCase):
+    def test_plan_rejects_feature_branch_dispatch_before_resolving_pr(self):
+        with tempfile.TemporaryDirectory() as directory:
+            event_path = pathlib.Path(directory) / "event.json"
+            event_path.write_text(json.dumps({
+                "repository": {"default_branch": "main"},
+                "inputs": {"mode": "aa"},
+            }))
+            with patch.dict(os.environ, {
+                "GITHUB_REPOSITORY": REPOSITORY,
+                "GITHUB_EVENT_PATH": str(event_path),
+                "GITHUB_REF": "refs/heads/feature/indexed",
+            }), patch("sys.argv", ["pr_bench.py", "plan"]), patch.object(pb, "resolve") as resolve:
+                with self.assertRaisesRegex(ValueError, "default branch"):
+                    pb.main()
+                resolve.assert_not_called()
+
+    def test_final_check_requeries_live_pr_and_drops_changed_or_closed_heads(self):
+        for change, expected in [(None, "true"), ("head", "false"), ("closed", "false")]:
+            with self.subTest(change=change), tempfile.TemporaryDirectory() as directory:
+                output = pathlib.Path(directory) / "output"
+                pr = copy.deepcopy(PR)
+                if change == "head":
+                    pr["head"]["sha"] = BASE
+                elif change == "closed":
+                    pr["state"] = "closed"
+                api = Mock(repository=REPOSITORY)
+                api.get.return_value = pr
+                with patch.dict(os.environ, {
+                    "GITHUB_REPOSITORY": REPOSITORY,
+                    "PR_NUMBER": "129",
+                    "HEAD_SHA": HEAD,
+                    "GITHUB_OUTPUT": str(output),
+                }), patch("sys.argv", ["pr_bench.py", "check"]), patch.object(pb, "GitHub", return_value=api):
+                    pb.main()
+                api.get.assert_called_once_with("pulls/129")
+                self.assertEqual(output.read_text(), f"current={expected}\n")
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/.github/workflows/bench-pr.yml b/.github/workflows/bench-pr.yml
index c5b77b1a..34393385 100644
--- a/.github/workflows/bench-pr.yml
+++ b/.github/workflows/bench-pr.yml
@@ -1,41 +1,31 @@
-# Benchmark A/B on pull requests — same-job, same-VM base/head comparison.
+# Detached PR benchmark report — same-job, same-VM base/head comparison.
 #
 # Hand-maintained (like benchmarks.yml) — NOT generated by sbt
 # githubWorkflowGenerate; keep it out of the sbt-typelevel config.
 #
-# Design (docs/plans/2026-07-10-001-feat-benchmark-ci-pipeline-plan.md):
-#   * Same-repo PRs only. This job executes PR-head code (sbt = arbitrary
-#     execution) while holding pull-requests:write for the sticky comment,
-#     so fork PRs are excluded entirely — same accepted caveat as
-#     deploy-site.yml. Fork PRs get no run and no comment.
-#   * Affected-only: `.github/bench/bench_tools.py affected` maps the PR
-#     diff to bench classes (transitively: core/ or harness changes mean
-#     the full suite). Docs/site/tests-only PRs skip after a seconds-cheap
-#     first step. A `perf:full` label forces the full suite.
-#   * Reduced JMH profile (benchQuick params + -prof gc): B/op — the gc
-#     allocation norm — is deterministic on shared runners and is the only
-#     metric that may ever gate; ns/op is directional advice. Full-rigor
-#     numbers come from the nightly sweep, not from PRs.
-#   * Advisory-first: while `.github/bench/thresholds.json` does not exist
-#     the diff never fails the job; bench/compile failures surface as an
-#     explicit ❌ comment, never silent green tables (and never a red X
-#     blocking review on an advisory signal).
-#   * A/A calibration: workflow_dispatch with mode=aa benchmarks the same
-#     ref twice in one job and emits the noise-floor report used to set
-#     thresholds (R5). Calibration is bound to the JMH profile below —
-#     changing the profile invalidates thresholds.json.
+# workflow_run attaches this workflow to the default branch, NOT the PR
+# head. CI remains on the PR; this report never gates its merge.
+# Same-repo PRs only. Trusted planning/publishing run separately from sbt:
+# the benchmark has no write token, persisted Git credentials, or cache saves.
+# Only raw JMH JSON crosses that boundary; publisher scripts come from the
+# default-branch workflow SHA, never from the benchmark checkout/artifact.
 
 name: Benchmark A/B
 
 on:
-  pull_request:
-    branches: [main]
-    types: [opened, reopened, synchronize, labeled]
+  workflow_run:
+    workflows: [Continuous Integration]
+    types: [completed]
   workflow_dispatch:
     inputs:
-      mode:
-        description: "ab = merge-base vs ref; aa = ref vs itself (noise calibration)"
+      pr:
+        description: "PR number for A/B (blank for A/A calibration)"
         required: false
+        default: ""
+      mode:
+        description: "A/B PR comparison or A/A default-branch noise calibration"
+        type: choice
+        options: [ab, aa]
         default: "ab"
       filter:
         description: "JMH class/method regex override (blank = affected/full)"
@@ -44,15 +34,10 @@ on:
 
 permissions:
   contents: read
-  pull-requests: write
-
-concurrency:
-  group: bench-pr-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
 
 env:
   # The measurement profile. thresholds.json is calibrated against exactly
-  # this string — change it and the gate reverts to advisory until an A/A
+  # this string — change it and warnings are uncalibrated until an A/A
   # recalibration (delete thresholds.json in the same PR).
   #
   # Pinned allocation ergonomics (-XX:-ResizeTLAB + fixed heap): adaptive
@@ -66,77 +51,85 @@ env:
   JMH_FLAGS: "-i 3 -wi 2 -f 1 -t 1 -foe true -prof gc -rf json -jvmArgsAppend -XX:-ResizeTLAB -jvmArgsAppend -Xms1g -jvmArgsAppend -Xmx1g"
 
 jobs:
-  bench-ab:
-    name: A/B (${{ github.event_name == 'workflow_dispatch' && inputs.mode || 'pr' }})
+  plan:
+    name: Plan report
     runs-on: ubuntu-22.04
-    timeout-minutes: 300
-    # Same-repo guard: never run fork PR code in a job that holds a write
-    # scope (see header). deploy-site.yml documents the same policy.
+    timeout-minutes: 5
+    permissions:
+      contents: read
+      pull-requests: read
+    # Manual runs also belong on the default branch, not on the PR head.
     if: >-
-      github.event_name == 'workflow_dispatch' ||
-      github.event.pull_request.head.repo.full_name == github.repository
+      github.ref == format('refs/heads/{0}', github.event.repository.default_branch) &&
+      (github.event_name == 'workflow_dispatch' ||
+       (github.event.workflow_run.event == 'pull_request' &&
+        github.event.workflow_run.conclusion == 'success' &&
+        github.event.workflow_run.head_repository.full_name == github.repository))
+    outputs:
+      run: ${{ steps.plan.outputs.run }}
+      pr: ${{ steps.plan.outputs.pr }}
+      mode: ${{ steps.plan.outputs.mode }}
+      base: ${{ steps.plan.outputs.base }}
+      head: ${{ steps.plan.outputs.head }}
+      regex: ${{ steps.plan.outputs.regex }}
     steps:
-      - name: Checkout (full history for merge-base)
+      - name: Checkout trusted tooling
         uses: actions/checkout@v7
         with:
+          ref: ${{ github.sha }}
           fetch-depth: 0
+          # This job reads Git objects but never executes PR code.
 
       - name: Bench tool self-test + mapping drift check
         run: |
           python3 -m unittest discover .github/bench
           python3 .github/bench/bench_tools.py validate-mapping
 
-      - name: Determine affected benchmarks and SHAs
+      - name: Resolve current PR and affected benchmarks
         id: plan
         env:
-          EVENT: ${{ github.event_name }}
-          MODE: ${{ inputs.mode || 'ab' }}
-          FILTER_OVERRIDE: ${{ inputs.filter || '' }}
-          PERF_FULL: ${{ contains(github.event.pull_request.labels.*.name, 'perf:full') }}
-          PR_HEAD: ${{ github.event.pull_request.head.sha }}
-        run: |
-          HEAD_REF="$(git rev-parse HEAD)"   # PR events: the merge commit
-          if [ "$EVENT" = "workflow_dispatch" ] && [ "$MODE" = "aa" ]; then
-            BASE_REF="$HEAD_REF"
-            REGEX="${FILTER_OVERRIDE:-FULL}"
-          else
-            BASE_REF="$(git merge-base origin/main HEAD)"
-            if [ -n "$FILTER_OVERRIDE" ]; then
-              REGEX="$FILTER_OVERRIDE"
-            elif [ "$PERF_FULL" = "true" ]; then
-              REGEX="FULL"
-            else
-              REGEX="$(git diff --name-only "$BASE_REF"...HEAD \
-                       | python3 .github/bench/bench_tools.py affected)"
-            fi
-          fi
-          if [ -z "$REGEX" ]; then
-            echo "No benchmark-mapped paths changed — skipping."
-            echo "skip=true" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-          # FULL = run the whole suite (every bench class matches Bench.)
-          [ "$REGEX" = "FULL" ] && REGEX='.*Bench\..*'
-          {
-            echo "skip=false"
-            echo "regex=$REGEX"
-            echo "base=$BASE_REF"
-            echo "head=$HEAD_REF"
-            echo "head_display=${PR_HEAD:-$HEAD_REF}"
-          } >> "$GITHUB_OUTPUT"
+          GH_TOKEN: ${{ github.token }}
+        run: python3 .github/bench/pr_bench.py plan
+
+  bench-ab:
+    name: Measure (${{ needs.plan.outputs.mode }})
+    needs: plan
+    if: needs.plan.outputs.run == 'true'
+    runs-on: ubuntu-22.04
+    timeout-minutes: 300
+    permissions:
+      contents: read
+    concurrency:
+      # A late old-head plan must not cancel a newer revision's measurement.
+      group: bench-measure-${{ needs.plan.outputs.pr || 'calibration' }}-${{ needs.plan.outputs.head }}
+      cancel-in-progress: true
+    outputs:
+      base_outcome: ${{ steps.base.outcome }}
+      head_outcome: ${{ steps.head.outcome }}
+    env:
+      BASE_SHA: ${{ needs.plan.outputs.base }}
+      HEAD_SHA: ${{ needs.plan.outputs.head }}
+      REGEX: ${{ needs.plan.outputs.regex }}
+    steps:
+      - name: Checkout benchmark revision
+        uses: actions/checkout@v7
+        with:
+          ref: ${{ needs.plan.outputs.head }}
+          fetch-depth: 0
+          persist-credentials: false
 
       - name: Setup sbt
-        if: steps.plan.outputs.skip == 'false'
         uses: sbt/setup-sbt@v1
 
-      - name: Setup Java (temurin@21)
-        if: steps.plan.outputs.skip == 'false'
+      - name: Setup Java (temurin@25)
         uses: actions/setup-java@v6
         with:
           distribution: temurin
           java-version: 25 # kyoIntegration (KyoDiBench dep) targets JDK 25 since v0.15.0
-      - name: Cache coursier + ivy + sbt boot
-        uses: actions/cache@v6
+      # workflow_run caches belong to the default branch. Never save
+      # PR-produced cache contents into that trusted namespace.
+      - name: Restore coursier + ivy + sbt boot
+        uses: actions/cache/restore@v6
         with:
           path: |
             ~/.cache/coursier
@@ -146,39 +139,78 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-sbt-
 
-      - name: Base run (${{ steps.plan.outputs.base }})
+      - name: Base run (${{ needs.plan.outputs.base }})
         id: base
-        if: steps.plan.outputs.skip == 'false'
         continue-on-error: true # failure becomes an explicit ❌ comment state
         run: |
-          git checkout --quiet "${{ steps.plan.outputs.base }}"
+          git checkout --quiet "$BASE_SHA"
           sbt -batch -Dsbt.color=false \
-            "benchmarks/Jmh/run $JMH_FLAGS -rff base.json ${{ steps.plan.outputs.regex }}"
+            "benchmarks/Jmh/run $JMH_FLAGS -rff base.json $REGEX"
 
-      - name: Head run (${{ steps.plan.outputs.head_display }})
+      - name: Head run (${{ needs.plan.outputs.head }})
         id: head
-        if: steps.plan.outputs.skip == 'false'
         continue-on-error: true
         run: |
-          git checkout --quiet "${{ steps.plan.outputs.head }}"
+          git checkout --quiet "$HEAD_SHA"
           sbt -batch -Dsbt.color=false \
-            "benchmarks/Jmh/run $JMH_FLAGS -rff head.json ${{ steps.plan.outputs.regex }}"
+            "benchmarks/Jmh/run $JMH_FLAGS -rff head.json $REGEX"
+
+      - name: Upload raw results
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: bench-raw-${{ github.run_id }}
+          overwrite: true
+          path: |
+            benchmarks/base.json
+            benchmarks/head.json
+          retention-days: 30
+          if-no-files-found: warn
+
+  report:
+    name: Publish report
+    needs: [plan, bench-ab]
+    if: always() && !cancelled() && needs.plan.outputs.run == 'true' && needs.bench-ab.result != 'cancelled'
+    runs-on: ubuntu-22.04
+    timeout-minutes: 5
+    permissions:
+      contents: read
+      actions: read
+      pull-requests: write
+    env:
+      BASE_SHA: ${{ needs.plan.outputs.base }}
+      HEAD_SHA: ${{ needs.plan.outputs.head }}
+      PR_NUMBER: ${{ needs.plan.outputs.pr }}
+    steps:
+      - name: Checkout trusted publisher
+        uses: actions/checkout@v7
+        with:
+          ref: ${{ github.sha }}
+          persist-credentials: false
+
+      - name: Download raw JMH JSON
+        id: download
+        if: needs.bench-ab.outputs.base_outcome == 'success' && needs.bench-ab.outputs.head_outcome == 'success'
+        continue-on-error: true
+        uses: actions/download-artifact@v8
+        with:
+          name: bench-raw-${{ github.run_id }}
+          path: results
 
       - name: Diff and render comment
         id: diff
-        if: steps.plan.outputs.skip == 'false'
         env:
-          BASE_OUTCOME: ${{ steps.base.outcome }}
-          HEAD_OUTCOME: ${{ steps.head.outcome }}
+          BASE_OUTCOME: ${{ needs.bench-ab.outputs.base_outcome }}
+          HEAD_OUTCOME: ${{ needs.bench-ab.outputs.head_outcome }}
+          DOWNLOAD_OUTCOME: ${{ steps.download.outcome }}
         run: |
-          PROV=(--base-sha "${{ steps.plan.outputs.base }}" \
-                --head-sha "${{ steps.plan.outputs.head_display }}" \
-                --jdk temurin-21 --runner ubuntu-22.04 \
+          PROV=(--base-sha "$BASE_SHA" --head-sha "$HEAD_SHA" \
+                --jdk temurin-25 --runner ubuntu-22.04 \
                 --jmh-params "$JMH_FLAGS" --profile "$JMH_PROFILE")
-          GATE=0
           TOOLFAIL=0
-          if [ "$BASE_OUTCOME" != "success" ] || [ "$HEAD_OUTCOME" != "success" ]; then
-            FAIL="base: $BASE_OUTCOME, head: $HEAD_OUTCOME — sbt Jmh/run failed (compile error on that side? see the run logs)"
+          if [ "$BASE_OUTCOME" != "success" ] || [ "$HEAD_OUTCOME" != "success" ] || [ "$DOWNLOAD_OUTCOME" != "success" ]; then
+            TOOLFAIL=1
+            FAIL="base: ${BASE_OUTCOME:-not run}, head: ${HEAD_OUTCOME:-not run}, results: $DOWNLOAD_OUTCOME — no comparison available; see run logs"
             python3 .github/bench/bench_tools.py comment-md --failure "$FAIL" > comment.md
           else
             # Exit 3 = B/op gate violation; any OTHER non-zero exit is a
@@ -186,11 +218,10 @@ jobs:
             # an explicit ❌ comment, never masquerade as a gate result.
             set +e
             python3 .github/bench/bench_tools.py diff \
-              benchmarks/base.json benchmarks/head.json -o deltas.json "${PROV[@]}"
+              results/base.json results/head.json -o deltas.json "${PROV[@]}"
             RC=$?
             set -e
             if [ "$RC" -eq 0 ] || [ "$RC" -eq 3 ]; then
-              GATE=$RC
               python3 .github/bench/bench_tools.py comment-md deltas.json > comment.md
             else
               TOOLFAIL=$RC
@@ -198,33 +229,41 @@ jobs:
                 --failure "bench tooling failed (diff exit $RC) — truncated JMH JSON? see run logs" > comment.md
             fi
           fi
+          printf '\n_Informational only · head `%s` · [benchmark run](%s/%s/actions/runs/%s)_\n' \
+            "$HEAD_SHA" "$GITHUB_SERVER_URL" "$GITHUB_REPOSITORY" "$GITHUB_RUN_ID" >> comment.md
           cat comment.md >> "$GITHUB_STEP_SUMMARY"
-          echo "gate=$GATE" >> "$GITHUB_OUTPUT"
           echo "toolfail=$TOOLFAIL" >> "$GITHUB_OUTPUT"
 
+      - name: Reject stale or closed PR results
+        id: current
+        if: needs.plan.outputs.pr != ''
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: python3 .github/bench/pr_bench.py check
+
       - name: Post sticky comment
-        if: steps.plan.outputs.skip == 'false' && github.event_name == 'pull_request'
+        if: steps.current.outputs.current == 'true'
         # Pinned by SHA (v3.0.5): the one third-party action in a job with a
         # write scope.
         uses: marocchino/sticky-pull-request-comment@5770ad5eb8f42dd2c4f34da00c94c5381e49af88
         with:
+          number: ${{ needs.plan.outputs.pr }}
           header: bench-ab
           path: comment.md
 
       - name: A/A noise report
-        if: steps.plan.outputs.skip == 'false' && inputs.mode == 'aa'
+        if: needs.plan.outputs.mode == 'aa' && steps.diff.outputs.toolfail == '0'
         run: |
           python3 .github/bench/bench_tools.py noise-report deltas.json \
             | tee noise-report.md >> "$GITHUB_STEP_SUMMARY"
 
       - name: Upload results
-        if: always() && steps.plan.outputs.skip == 'false'
+        if: always()
         uses: actions/upload-artifact@v7
         with:
           name: bench-ab-${{ github.run_id }}
+          overwrite: true
           path: |
-            benchmarks/base.json
-            benchmarks/head.json
             deltas.json
             comment.md
             noise-report.md
@@ -232,18 +271,11 @@ jobs:
           if-no-files-found: warn
 
       # A tool crash is a broken pipeline, not a benchmark result — fail the
-      # job loudly AFTER the ❌ comment has been posted.
+      # detached job loudly AFTER publishing any eligible ❌ comment.
       - name: Fail on tooling error
-        if: steps.plan.outputs.skip == 'false' && steps.diff.outputs.toolfail != '0'
+        if: steps.diff.outputs.toolfail != '0'
         run: |
-          echo "bench tooling failed (exit ${{ steps.diff.outputs.toolfail }}); ❌ comment posted."
+          echo "Benchmark execution/results failed; see the run summary."
           exit 1
 
-      # Advisory-first (R4): while thresholds.json is absent, `diff` always
-      # exits 0 and this step never fires. Once calibration lands a
-      # thresholds.json, a B/op regression beyond threshold fails the job.
-      - name: B/op gate
-        if: steps.plan.outputs.skip == 'false' && steps.diff.outputs.gate != '0'
-        run: |
-          echo "B/op gate violation (see sticky comment / step summary)."
-          exit 1
+      # Threshold breaches are reported in the table, not as a merge gate.
diff --git a/CLAUDE.md b/CLAUDE.md
index 03aa86fc..6fc12eb3 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -219,16 +219,22 @@ reminder that "the numbers below are just data".
 Three hand-written workflows (NOT in the generated ci.yml) automate this:
 `bench-pr.yml` posts a same-VM A/B delta comment on PRs touching
 benchmark-mapped paths (reduced profile, `perf:full` label escalates,
-same-repo PRs only); `bench-sweep.yml` runs the nightly-if-changed /
+same-repo PRs only). It runs on the default branch after successful PR CI,
+not as a check on the PR head; read-only measurement and trusted comment
+publication use separate jobs. Manual dispatch from `main` with `pr=<number>`
+reruns A/B, or `mode=aa` calibrates the default branch. `bench-sweep.yml`
+runs the nightly-if-changed /
 release-tag full sweep, appends `bench/series.jsonl` on gh-pages, renders
 the chart, bot-commits `BENCHMARKS.md` (generated — never hand-edit), and
-attaches results to releases. All logic lives in
-`.github/bench/bench_tools.py` (stdlib-only, unit-tested — run
+attaches results to releases. Logic lives in
+`.github/bench/bench_tools.py` and `.github/bench/pr_bench.py`
+(stdlib-only, unit-tested — run
 `python3 -m unittest discover .github/bench`); the path→bench mapping is
 its `MODULE_BENCHES` dict (import-derived; `core/` or harness changes ⇒
-full suite). Doctrine: **B/op gates (only once
+full suite). Doctrine: **B/op warns against calibrated thresholds (once
 `.github/bench/thresholds.json` exists, set from A/A calibration), ns/op
-advises**. Operator runbook: `.github/bench/README.md`.
+advises; PR benchmark comments never gate merges**.
+Operator runbook: `.github/bench/README.md`.
 
 ### Auto-derivation: `eo-generics`
 
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 8ad58947..1e12fe6a 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -80,19 +80,24 @@ and in [`benchmarks/README.md`](./benchmarks/README.md).
 
 PRs that touch benchmark-mapped code (core/, avro/, circe/, jsoniter/,
 schemes/, generics/, the harness, or the build) automatically get a
-**Benchmark A/B** sticky comment: the affected benchmarks run on the
-merge-base and on your head, on the same VM, at a reduced JMH profile.
+**Benchmark A/B** sticky comment after successful CI: the affected benchmarks
+run on the merge-base and on your exact head, on the same VM, at a reduced
+JMH profile. The benchmark workflow runs separately on the default branch,
+so it adds no long-running check to your PR head and never gates merging.
 Read it with the project doctrine in mind — **the B/op (allocation) delta
 is authoritative; the ns/op delta is directional**. A `perf:full` label
 escalates to the full suite; docs/site/tests-only PRs get no comment, and
 PRs from forks are excluded (same caveat as the docs-preview workflow).
 An ❌ comment means a side failed to build or run — it is never a pass.
+Results for closed PRs or superseded heads are not posted. If you add
+`perf:full` after CI completes, rerun with
+`gh workflow run bench-pr.yml --ref main -f pr=<number>`.
 
 Current numbers live in [`BENCHMARKS.md`](./BENCHMARKS.md) (generated by
 the nightly sweep — never edit it by hand) with per-sweep history charts
 on the project's GitHub Pages under `/bench/`, and each release carries
 its `jmh-results-<tag>.json` as a downloadable asset. Operational details
-(calibration, gate thresholds, mapping maintenance):
+(calibration, warning thresholds, mapping maintenance):
 [`.github/bench/README.md`](./.github/bench/README.md).
 
 ## Previewing the docs site locally