diff --git a/docs/process-hardening.md b/docs/process-hardening.md
index e82038e8db..fb79c24a5c 100644
--- a/docs/process-hardening.md
+++ b/docs/process-hardening.md
@@ -73,7 +73,7 @@ This document turns the current process review into phased, durable repo practic
 
 - CI is now two parallel PR jobs instead of one serial 6-7 minute job: `verify` (runtime alignment, edge typecheck, CI-safe production readiness, lint, typecheck, unit tests with coverage gate, build — ~3 min) and `ui-smoke` (Chromium Playwright smoke against its own dev server — ~4.5 min). Wall-clock PR feedback drops to the slower of the two, and a flaky smoke rerun no longer repeats lint/typecheck/tests/build.
 - The deployment boot smoke and full browser matrix remain gated to `main`, `release/*`, manual dispatch, and the weekly schedule — they are deliberately not PR gates.
-- **Required-check debt (the reason #131/#133 merged red): `main` has no branch protection.** The intended configuration is a ruleset/branch protection on `main` requiring `verify`, `ui-smoke`, and `Gitleaks`, with "require branches up to date" left OFF (strict up-to-dateness would force constant rebases across the many concurrent agent branches). Until that is applied in repo settings, CI remains advisory. Note: once applied, direct pushes to `main` are blocked for non-bypass users; repository admins retaining the bypass (`enforce_admins` OFF) can still push directly but should prefer PRs to preserve the required-check gate.
+- **Required-check debt: RESOLVED 2026-07-02.** Branch protection is now applied on `main` requiring `verify`, `ui-smoke`, and `Gitleaks`, with "require branches up to date" left OFF (strict up-to-dateness would force constant rebases across the many concurrent agent branches), `enforce_admins` OFF (admin bypass retained as an emergency hatch), and no required PR-review count (a solo+agents flow has no second human approver). This closes the gap that let #131/#133 merge red. Consequence now in effect: **direct pushes to `main` are blocked for non-bypass users; normal work must land via PR.** Repository admins can still use the retained bypass only as an emergency hatch. To adjust, edit the rule under repo Settings → Branches or via `gh api -X PUT repos/BigSimmo/Database/branches/main/protection`.
 - If `ui-smoke` proves flaky as a required check, demote it to advisory (remove from required contexts) rather than tolerating red merges — the deterministic `verify` gate stays required regardless.
 
 ## CSS cascade layering (2026-07-02)