See T13552. When a commit is an ancestor of a permanent ref, "fully imported" means it has undergone the "message", "change", and "publish" parsing steps.

When a commit is not an ancestor of a permanent ref, it only really needs the "message" and "change" steps.

However, "fully imported" is identified by having all the steps completed, so it's most reasonable today to do a no-op publish, then clear the "published" flag later. This is a bit more complex than necessary: instead, commits could have a separate "imported" bit which is checked after any step finishes, and only requires "message" and "change" if the commit isn't publishable.