@deftai/directive-runtime 0.129.6 → 0.129.8

package/vendor/directive-core/dist/scope/delivery-evidence.js

@@ -8,12 +8,13 @@
  *
  * Deploy / UAT are separate axes and MUST NOT be inferred from Git alone.
  */
-import { closerSetFromIssueIds } from "../one-pr-unit/closer-set.js";
 import { productPullRequestFromPlan } from "../orphan-active/running-briefs.js";
 import { assertSafeBranchName, FIELD_DELIVERY_BRANCH, isSafeBranchName, resolveDeliveryBranch, trackingFetchArgv, } from "../policy/delivery-branch.js";
+import { parseAllDeftStoryMarks } from "../pr-closing-keywords/main.js";
 import { defaultRunGh } from "../pr-protected-issues/gh.js";
 import { defaultGitRunner, gitIsAncestor } from "../session/git.js";
 import { readRitualState } from "../session/ritual-sentinel.js";
+import { parseGitHubRepoSlug } from "../text/redos-safe.js";
 import { LIFECYCLE_FOLDERS } from "./constants.js";
 /** Prefer-A #5545: refuse resolver error when branch is empty or unsafe. */
 function refuseUnsafeResolvedDelivery(resolved) {
@@ -379,51 +380,643 @@ export function prDiffAddsBrief(files, briefBasename) {
     const touchesCode = files.some((f) => lifecycleBriefBasename(f.filename) === null);
     return addsBrief && touchesCode;
 }
+/** Recut-13 uniqueness-scan budget: units and caps (#5710). */
+export const MERGE_TIME_SCAN_WALL_CLOCK_MS = 20 * 60 * 1000;
+export const MERGE_TIME_SCAN_MIN_GRAPHQL_REMAINING = 200;
+export const MERGE_TIME_SCAN_MIN_CORE_REMAINING = 100;
+/** GitHub `pulls/{n}/files` lists at most 3000 files. */
+export const PR_FILES_LISTING_CAP = 3000;
+/** The three accepted merge-time bases, named in every stranded-shape refusal (#5710). */
+export const MERGE_TIME_ASSOCIATION_BASES = "(a) a unique sole `deft-story: N` mark in the PR body as of merged_at, " +
+    "(b) a closing keyword (close/fix/resolve forms) naming the issue in the PR body as of merged_at, " +
+    "(c) a Connected issue link in effect at merged_at";
+/** Start the Recut-13 scan budget: wall clock from now, live rate limits per call. */
+export function makeScanBudget(forge) {
+    const startMs = forge.nowMs();
+    const wallClock = () => forge.nowMs() - startMs > MERGE_TIME_SCAN_WALL_CLOCK_MS
+        ? `scan budget exhausted: wall-clock cap ${MERGE_TIME_SCAN_WALL_CLOCK_MS / 60000} minutes`
+        : null;
+    const remaining = (bucket, floor, label) => {
+        const clock = wallClock();
+        if (clock !== null)
+            return clock;
+        const rate = forge.probeRateLimit();
+        if (rate === null)
+            return "scan budget unknown: live rate-limit probe failed";
+        return rate[bucket] < floor
+            ? `scan budget exhausted: ${label} remaining ${rate[bucket]} < ${floor}`
+            : null;
+    };
+    return {
+        beforeGraphql: () => remaining("graphqlRemaining", MERGE_TIME_SCAN_MIN_GRAPHQL_REMAINING, "graphql"),
+        beforeRest: () => remaining("coreRemaining", MERGE_TIME_SCAN_MIN_CORE_REMAINING, "REST core"),
+    };
+}
+/** Next cursor of a page with more nodes, or null when the cursor is missing or stuck. */
+function nextCursor(endCursor, after) {
+    const next = endCursor?.trim() ?? "";
+    return next.length === 0 || next === after ? null : next;
+}
+/** Walk every page of a connection; any gap, guard refusal or stuck cursor fails closed. */
+function collectAllPages(fetchPage, guard, label) {
+    const nodes = [];
+    let after = null;
+    for (;;) {
+        const refused = guard();
+        if (refused !== null) {
+            return { ok: false, error: `${label}: ${refused}` };
+        }
+        const page = fetchPage(after);
+        if (!page.ok) {
+            return { ok: false, error: `${label}: ${page.error}` };
+        }
+        nodes.push(...page.nodes);
+        if (!page.hasNextPage) {
+            return { ok: true, nodes };
+        }
+        const next = nextCursor(page.endCursor, after);
+        if (next === null) {
+            return {
+                ok: false,
+                error: `${label}: incomplete page (hasNextPage without a new endCursor)`,
+            };
+        }
+        after = next;
+    }
+}
 /**
- * Prefer-A story→PR→merge identity join before delivery liveness (#3675).
- *
- * Uses plan-derived expected repo/issue, authoritative closingIssuesReferences
- * with per-issue repository preserved (not reassigned to the plan repo), and
- * merge_commit_sha identity equality. Does not require implementationCommit
- * ancestry (squash-safe).
+ * Merge-time body (#5710): the latest `userContentEdits` revision with
+ * editedAt ≤ merged_at, or the current body when the PR has no edit history.
+ * A hidden revision or no revision at or before merged_at is unknown (fail closed).
  */
-export function verifyStoryPrMergeIdentity(input) {
-    const expected = resolvePlanGithubIssueRef(input.plan);
-    if (expected === null) {
+export function selectMergeTimeBody(revisions, currentBody, mergedAt) {
+    const mergedMs = Date.parse(mergedAt);
+    if (Number.isNaN(mergedMs)) {
+        return { ok: false, error: `unreadable merged_at ${JSON.stringify(mergedAt)}` };
+    }
+    if (revisions.length === 0) {
+        return { ok: true, body: currentBody ?? "" };
+    }
+    let chosen = null;
+    let chosenMs = Number.NEGATIVE_INFINITY;
+    for (const revision of revisions) {
+        const editedMs = Date.parse(revision.editedAt);
+        if (Number.isNaN(editedMs)) {
+            return {
+                ok: false,
+                error: `unreadable revision editedAt ${JSON.stringify(revision.editedAt)}`,
+            };
+        }
+        if (editedMs <= mergedMs && editedMs >= chosenMs) {
+            chosen = revision;
+            chosenMs = editedMs;
+        }
+    }
+    if (chosen === null) {
+        return { ok: false, error: "no body revision at or before merged_at" };
+    }
+    if (chosen.body === null) {
+        return { ok: false, error: "merge-time body revision is unreadable" };
+    }
+    return { ok: true, body: chosen.body };
+}
+const CLOSING_KEYWORD_REF_RE = /\b(?:close|closes|closed|fix|fixes|fixed|resolve|resolves|resolved):?[ \t]+(?:#(\d+)|([\w.-]+)\/([\w.-]+)#(\d+)|https?:\/\/github\.com\/([\w.-]+)\/([\w.-]+)\/issues\/(\d+))(?![\w-])/gi;
+/**
+ * True when the body has a GitHub closing keyword naming the issue as `#N`,
+ * `owner/repo#N` or the issue URL (#5710 basis b). `#N` means the PR's repository.
+ */
+export function bodyHasClosingKeywordFor(body, repository, issueNumber) {
+    const repoKey = repository.trim().toLowerCase();
+    const re = new RegExp(CLOSING_KEYWORD_REF_RE.source, CLOSING_KEYWORD_REF_RE.flags);
+    for (let match = re.exec(body); match !== null; match = re.exec(body)) {
+        const [, bare, owner, name, qualified, urlOwner, urlName, urlNumber] = match;
+        if (bare !== undefined) {
+            if (Number(bare) === issueNumber)
+                return true;
+            continue;
+        }
+        const refRepo = `${owner ?? urlOwner ?? ""}/${name ?? urlName ?? ""}`.toLowerCase();
+        if (refRepo === repoKey && Number(qualified ?? urlNumber) === issueNumber) {
+            return true;
+        }
+    }
+    return false;
+}
+/**
+ * Replay Connected / Disconnected events up to merged_at (#5710 basis c).
+ * Events after merged_at do not count.
+ */
+export function connectedAtMergedAt(events, repository, issueNumber, mergedAt) {
+    const mergedMs = Date.parse(mergedAt);
+    if (Number.isNaN(mergedMs)) {
+        return { ok: false, error: `unreadable merged_at ${JSON.stringify(mergedAt)}` };
+    }
+    const repoKey = repository.trim().toLowerCase();
+    const relevant = [];
+    for (const event of events) {
+        const names = event.issues.some((ref) => ref.repository.trim().toLowerCase() === repoKey && ref.issueNumber === issueNumber);
+        if (!names)
+            continue;
+        const ms = Date.parse(event.createdAt);
+        if (Number.isNaN(ms)) {
+            return { ok: false, error: `unreadable event createdAt ${JSON.stringify(event.createdAt)}` };
+        }
+        if (ms <= mergedMs) {
+            relevant.push({ ms, kind: event.kind });
+        }
+    }
+    relevant.sort((a, b) => a.ms - b.ms);
+    const last = relevant[relevant.length - 1];
+    return { ok: true, connected: last?.kind === "connected" };
+}
+/** Ledger that scope completion writes beside the brief moves (#6231 / #680 P5). */
+export const SPEC_DRIFT_LEDGER_REL = "xbrief/.audit/spec-drift-ledger.json";
+/**
+ * Delivery-brief-land path family (#5710 / #680 F1): a brief under an
+ * `xbrief|vbrief/<lifecycle>/` folder, root `CHANGELOG.md`, or the exact
+ * spec-drift ledger. One helper for the delivery gate, the CHANGELOG
+ * exemption, membership and finalize's lifecycle-shaped PR check, so the
+ * family cannot drift between them.
+ */
+export function isDeliveryBriefLandPath(path) {
+    const p = path.replace(/\\/g, "/");
+    if (p === "CHANGELOG.md" || p === SPEC_DRIFT_LEDGER_REL) {
+        return true;
+    }
+    const parts = p.split("/");
+    return (parts.length >= 3 &&
+        (parts[0] === "xbrief" || parts[0] === "vbrief") &&
+        LIFECYCLE_FOLDER_SET.has(parts[1] ?? "") &&
+        (parts[parts.length - 1] ?? "").length > 0);
+}
+/**
+ * Completion-move shape (#680 P5): a non-empty change set of delivery-brief-land
+ * paths with at least one brief under `completed/`. Membership admits the
+ * ledger only under this shape.
+ */
+export function isCompletionMoveShaped(paths) {
+    return (paths.length > 0 &&
+        paths.every((p) => isDeliveryBriefLandPath(p)) &&
+        paths.some((p) => /^(?:xbrief|vbrief)\/completed\/./.test(p.replace(/\\/g, "/"))));
+}
+/**
+ * Delivery-brief-land exclusion (#5710): every changed path, rename sources
+ * included, is in the delivery-brief-land family (`isDeliveryBriefLandPath`),
+ * with at least one such path for a positive
+ * exclusion. CHANGELOG-only, completed-folder renames and deletion-only diffs
+ * on those paths are excluded. A zero-file diff is not a positive exclusion:
+ * as a competitor it still counts (fail closed), and as a candidate it is
+ * refused separately because it carries no delivery. Not identical to
+ * activation `isBriefLandShapedDiff`, which denies completed/ and needs a
+ * non-removed nonterminal brief.
+ */
+export function isDeliveryBriefLandExcluded(files) {
+    return (files.length > 0 &&
+        files.every((file) => isDeliveryBriefLandPath(file.filename) &&
+            ((file.previousFilename ?? "").length === 0 ||
+                isDeliveryBriefLandPath(file.previousFilename ?? ""))));
+}
+/** The single distinct `deft-story` mark in a body, or null when zero or several (#5710). */
+export function soleDeftStoryMark(body) {
+    const marks = parseAllDeftStoryMarks(body);
+    return marks.length === 1 ? (marks[0] ?? null) : null;
+}
+function reconstructMergeTimeBody(forge, budget, target, currentBody, mergedAt) {
+    const { repository, prNumber } = target;
+    const revisions = collectAllPages((after) => forge.fetchBodyRevisionsPage(repository, prNumber, after), budget.beforeGraphql, `PR #${prNumber} body revisions`);
+    if (!revisions.ok) {
+        return revisions;
+    }
+    const selected = selectMergeTimeBody(revisions.nodes, currentBody, mergedAt);
+    return selected.ok
+        ? selected
+        : { ok: false, error: `PR #${prNumber} merge-time body: ${selected.error}` };
+}
+function classifyDeliveryExclusion(forge, budget, repository, prNumber) {
+    // REST budget is checked before every page, not once per PR (#5710).
+    const listed = collectAllPages((after) => forge.fetchPrFilesPage(repository, prNumber, after), budget.beforeRest, `PR #${prNumber} changed files`);
+    if (!listed.ok) {
+        return listed;
+    }
+    // The forge stops listing at its cap, so reaching it means the list may be truncated.
+    if (listed.nodes.length >= PR_FILES_LISTING_CAP) {
         return {
             ok: false,
-            message: "Delivery identity join failed: plan has no x-xbrief/github-issue reference " +
-                "to derive expected repository/issue (#3675).",
+            error: `PR #${prNumber} changed files: listing truncated at the ${PR_FILES_LISTING_CAP}-file cap`,
         };
     }
-    const evidenceRepo = typeof input.evidence.repository === "string" && input.evidence.repository.trim().length > 0
-        ? input.evidence.repository.trim()
-        : null;
-    if (evidenceRepo !== null && evidenceRepo !== expected.repository) {
+    return {
+        ok: true,
+        excluded: isDeliveryBriefLandExcluded(listed.nodes),
+        fileCount: listed.nodes.length,
+    };
+}
+/** Merge-time body of one listed PR; edits only replayed when one landed after merge. */
+function listedMergeTimeBody(forge, budget, repository, node) {
+    const mergedMs = Date.parse(node.mergedAt);
+    const lastEditedMs = node.lastEditedAt === null ? null : Date.parse(node.lastEditedAt);
+    if (Number.isNaN(mergedMs) || (lastEditedMs !== null && Number.isNaN(lastEditedMs))) {
+        return { ok: false, error: `PR #${node.number} has unreadable mergedAt / lastEditedAt` };
+    }
+    // No edit after merge: the latest revision at or before merged_at is the
+    // latest revision, which is the current body.
+    if (lastEditedMs === null || lastEditedMs <= mergedMs) {
+        return { ok: true, body: node.body };
+    }
+    return reconstructMergeTimeBody(forge, budget, { repository, prNumber: node.number }, node.body, node.mergedAt);
+}
+/**
+ * Bounded exhaustive uniqueness scan (#5710 basis a). Enumerates every merged
+ * PR, reconstructs each merge-time body, and classifies sole-mark hits for
+ * `issueNumber`. Returns the non-excluded sole-mark PRs other than the
+ * candidate. Any incomplete page, unreadable revision or competitor, truncated
+ * listing, or exhausted budget fails closed. No recent-window shortcut.
+ */
+export function scanSoleMarkCompetitors(input) {
+    const { repository, issueNumber, candidatePr, forge } = input;
+    const budget = input.budget ?? makeScanBudget(forge);
+    const competitors = [];
+    let after = null;
+    for (;;) {
+        const refused = budget.beforeGraphql();
+        if (refused !== null) {
+            return { ok: false, error: `merged-PR scan: ${refused}` };
+        }
+        const page = forge.listMergedPrsPage(repository, after);
+        if (!page.ok) {
+            return { ok: false, error: `merged-PR scan: ${page.error}` };
+        }
+        for (const node of page.nodes) {
+            if (node.number === candidatePr)
+                continue;
+            const body = listedMergeTimeBody(forge, budget, repository, node);
+            if (!body.ok) {
+                return { ok: false, error: `merged-PR scan: ${body.error}` };
+            }
+            if (soleDeftStoryMark(body.body) !== issueNumber)
+                continue;
+            const exclusion = classifyDeliveryExclusion(forge, budget, repository, node.number);
+            if (!exclusion.ok) {
+                return { ok: false, error: `merged-PR scan: possible competitor ${exclusion.error}` };
+            }
+            if (!exclusion.excluded) {
+                competitors.push(node.number);
+            }
+        }
+        if (!page.hasNextPage) {
+            return { ok: true, competitors };
+        }
+        const next = nextCursor(page.endCursor, after);
+        if (next === null) {
+            return {
+                ok: false,
+                error: "merged-PR scan: incomplete page (hasNextPage without a new endCursor)",
+            };
+        }
+        after = next;
+    }
+}
+/** Basis a: unique sole mark among merged non-excluded PRs (#5710). */
+function proveSoleMarkBasis(input) {
+    const { forge, budget, repository, issueNumber, prNumber } = input;
+    if (soleDeftStoryMark(input.mergeTimeBody) !== issueNumber) {
         return {
             ok: false,
-            message: `Delivery identity join failed: evidence repository '${evidenceRepo}' does not match ` +
-                `plan-derived expected repository '${expected.repository}' (#3675).`,
+            reason: `(a) PR #${prNumber} body as of merged_at has no sole \`deft-story: ${issueNumber}\` mark`,
         };
     }
-    const prNumber = typeof input.evidence.prNumber === "number" &&
-        Number.isInteger(input.evidence.prNumber) &&
-        input.evidence.prNumber > 0
-        ? input.evidence.prNumber
-        : null;
+    const exclusion = classifyDeliveryExclusion(forge, budget, repository, prNumber);
+    if (!exclusion.ok) {
+        return { ok: false, reason: `(a) ${exclusion.error}` };
+    }
+    if (exclusion.fileCount === 0) {
+        return {
+            ok: false,
+            reason: `(a) PR #${prNumber} changes no files (a zero-file PR carries no delivery)`,
+        };
+    }
+    if (exclusion.excluded) {
+        return {
+            ok: false,
+            reason: `(a) PR #${prNumber} changes only briefs and CHANGELOG.md ` +
+                `(delivery-brief-land excluded; not delivery)`,
+        };
+    }
+    const scan = scanSoleMarkCompetitors({
+        repository,
+        issueNumber,
+        candidatePr: prNumber,
+        forge,
+        budget,
+    });
+    if (!scan.ok) {
+        return { ok: false, reason: `(a) uniqueness unknown, refusing: ${scan.error}` };
+    }
+    if (scan.competitors.length > 0) {
+        const list = scan.competitors.map((n) => `#${n}`).join(", ");
+        return {
+            ok: false,
+            reason: `(a) mark is not unique: merged non-excluded PR(s) ${list} also carry a sole ` +
+                `\`deft-story: ${issueNumber}\` mark`,
+        };
+    }
+    return { ok: true };
+}
+/** One GraphQL call through gh; returns `data` or an error (any `errors` entry fails). */
+function runGhGraphql(runGh, query, vars) {
+    const cmd = ["gh", "api", "graphql", "-f", `query=${query}`];
+    for (const [key, value] of Object.entries(vars)) {
+        if (value !== null) {
+            cmd.push("-F", `${key}=${String(value)}`);
+        }
+    }
+    let result;
+    try {
+        result = runGh(cmd);
+    }
+    catch (exc) {
+        return { ok: false, error: exc instanceof Error ? exc.message : String(exc) };
+    }
+    if (result.returncode !== 0) {
+        return { ok: false, error: result.stderr.trim() || "gh api graphql non-zero" };
+    }
+    let payload;
+    try {
+        payload = JSON.parse(result.stdout);
+    }
+    catch {
+        return { ok: false, error: "unparseable GraphQL JSON" };
+    }
+    const rec = asRecord(payload);
+    if (rec === null || (Array.isArray(rec.errors) && rec.errors.length > 0)) {
+        return { ok: false, error: "GraphQL response carried errors" };
+    }
+    const data = asRecord(rec.data);
+    return data === null ? { ok: false, error: "GraphQL response missing data" } : { ok: true, data };
+}
+function readConnection(value) {
+    const conn = asRecord(value);
+    const pageInfo = asRecord(conn?.pageInfo);
+    if (conn === null || pageInfo === null || !Array.isArray(conn.nodes))
+        return null;
+    if (typeof pageInfo.hasNextPage !== "boolean")
+        return null;
+    const endCursor = typeof pageInfo.endCursor === "string" ? pageInfo.endCursor : null;
+    return { nodes: conn.nodes, hasNextPage: pageInfo.hasNextPage, endCursor };
+}
+const MERGED_PRS_GRAPHQL = "query($owner:String!,$name:String!,$after:String){repository(owner:$owner,name:$name){" +
+    "pullRequests(states:MERGED,first:100,after:$after,orderBy:{field:CREATED_AT,direction:ASC}){" +
+    "pageInfo{hasNextPage endCursor} nodes{number mergedAt body lastEditedAt}}}}";
+const BODY_REVISIONS_GRAPHQL = "query($owner:String!,$name:String!,$number:Int!,$after:String){repository(owner:$owner,name:$name){" +
+    "pullRequest(number:$number){userContentEdits(first:100,after:$after){" +
+    "pageInfo{hasNextPage endCursor} nodes{editedAt deletedAt diff}}}}}";
+const SUBJECT_FIELDS = "__typename ... on Issue{number repository{nameWithOwner}}";
+const CONNECTION_EVENTS_GRAPHQL = "query($owner:String!,$name:String!,$number:Int!,$after:String){repository(owner:$owner,name:$name){" +
+    "pullRequest(number:$number){timelineItems(first:100,after:$after," +
+    "itemTypes:[CONNECTED_EVENT,DISCONNECTED_EVENT]){pageInfo{hasNextPage endCursor} nodes{__typename " +
+    `... on ConnectedEvent{createdAt source{${SUBJECT_FIELDS}} subject{${SUBJECT_FIELDS}}} ` +
+    `... on DisconnectedEvent{createdAt source{${SUBJECT_FIELDS}} subject{${SUBJECT_FIELDS}}}}}}}}`;
+function parseEventIssue(value) {
+    const rec = asRecord(value);
+    if (rec === null || rec.__typename !== "Issue")
+        return null;
+    const repo = asRecord(rec.repository)?.nameWithOwner;
+    if (typeof rec.number !== "number" || typeof repo !== "string")
+        return null;
+    return { repository: repo, issueNumber: rec.number };
+}
+function parseMergedPrNode(value) {
+    const rec = asRecord(value);
+    if (rec === null || typeof rec.number !== "number" || typeof rec.mergedAt !== "string") {
+        return null;
+    }
+    if (rec.body !== null && typeof rec.body !== "string")
+        return null;
+    if (rec.lastEditedAt !== null && typeof rec.lastEditedAt !== "string")
+        return null;
+    return {
+        number: rec.number,
+        mergedAt: rec.mergedAt,
+        body: typeof rec.body === "string" ? rec.body : "",
+        lastEditedAt: typeof rec.lastEditedAt === "string" ? rec.lastEditedAt : null,
+    };
+}
+function parseRevisionNode(value) {
+    const rec = asRecord(value);
+    if (rec === null || typeof rec.editedAt !== "string")
+        return null;
+    const hidden = rec.deletedAt !== null && rec.deletedAt !== undefined;
+    return {
+        editedAt: rec.editedAt,
+        body: !hidden && typeof rec.diff === "string" ? rec.diff : null,
+    };
+}
+function parseConnectionEventNode(value) {
+    const rec = asRecord(value);
+    if (rec === null || typeof rec.createdAt !== "string")
+        return null;
+    let kind;
+    if (rec.__typename === "ConnectedEvent") {
+        kind = "connected";
+    }
+    else if (rec.__typename === "DisconnectedEvent") {
+        kind = "disconnected";
+    }
+    else {
+        return null;
+    }
+    const issues = [parseEventIssue(rec.source), parseEventIssue(rec.subject)].filter((ref) => ref !== null);
+    return { kind, createdAt: rec.createdAt, issues };
+}
+function graphqlPage(runGh, request, pick, parseNode) {
+    const response = runGhGraphql(runGh, request.query, request.vars);
+    if (!response.ok)
+        return response;
+    const conn = readConnection(pick(response.data));
+    if (conn === null) {
+        return { ok: false, error: "incomplete page (missing connection or pageInfo)" };
+    }
+    const nodes = [];
+    for (const raw of conn.nodes) {
+        const parsed = parseNode(raw);
+        if (parsed === null)
+            return { ok: false, error: "unreadable node in page" };
+        nodes.push(parsed);
+    }
+    return { ok: true, nodes, hasNextPage: conn.hasNextPage, endCursor: conn.endCursor };
+}
+function parsePrFileEntry(value) {
+    const rec = asRecord(value);
+    if (rec === null || typeof rec.filename !== "string" || rec.filename.length === 0)
+        return null;
+    if (typeof rec.status !== "string")
+        return null;
+    const previous = typeof rec.previous_filename === "string" ? rec.previous_filename : "";
+    return previous.length > 0
+        ? { status: rec.status, filename: rec.filename, previousFilename: previous }
+        : { status: rec.status, filename: rec.filename };
+}
+/**
+ * One REST page of `pulls/{n}/files` with rename sources, read uncached. The
+ * cursor is the next page number; paging ends at the first empty page.
+ */
+function fetchPrFilesPageLive(runGh, repository, prNumber, after) {
+    const parsed = parseOwnerRepo(repository);
+    if (parsed === null)
+        return { ok: false, error: `invalid repository ${repository}` };
+    const page = after === null ? 1 : Number(after);
+    if (!Number.isInteger(page) || page < 1)
+        return { ok: false, error: `invalid page ${after}` };
+    const path = `repos/${parsed.owner}/${parsed.name}/pulls/${prNumber}/files?per_page=100&page=${page}`;
+    let result;
+    try {
+        result = liveRunGh(runGh)(["gh", "api", path]);
+    }
+    catch (exc) {
+        return { ok: false, error: exc instanceof Error ? exc.message : String(exc) };
+    }
+    if (result.returncode !== 0) {
+        return { ok: false, error: result.stderr.trim() || "gh api files non-zero" };
+    }
+    let payload;
+    try {
+        payload = JSON.parse(result.stdout);
+    }
+    catch {
+        return { ok: false, error: "unparseable files page" };
+    }
+    if (!Array.isArray(payload))
+        return { ok: false, error: "files page is not an array" };
+    const nodes = [];
+    for (const raw of payload) {
+        const entry = parsePrFileEntry(raw);
+        if (entry === null)
+            return { ok: false, error: "unreadable files entry" };
+        nodes.push(entry);
+    }
+    const hasNextPage = nodes.length > 0;
+    return { ok: true, nodes, hasNextPage, endCursor: hasNextPage ? String(page + 1) : null };
+}
+/**
+ * Pin plain `gh` for single-path GETs the default runner would send to the
+ * `ghx` cache proxy. A cached read can be stale: a PR cached before merge
+ * reads as unmerged, a rate bucket reads as fuller than it is (#954 / #5710).
+ * Injected runners are used as given.
+ */
+export function liveRunGh(runGh) {
+    return runGh === defaultRunGh ? (cmd) => defaultRunGh(cmd, "gh") : runGh;
+}
+function probeLiveRateLimit(runGh) {
+    const cmd = ["gh", "api", "rate_limit"];
+    let result;
+    try {
+        result = liveRunGh(runGh)(cmd);
+    }
+    catch {
+        return null;
+    }
+    if (result.returncode !== 0)
+        return null;
+    try {
+        const resources = asRecord(asRecord(JSON.parse(result.stdout))?.resources);
+        const graphql = asRecord(resources?.graphql)?.remaining;
+        const core = asRecord(resources?.core)?.remaining;
+        if (typeof graphql !== "number" || typeof core !== "number")
+            return null;
+        return { graphqlRemaining: graphql, coreRemaining: core };
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Live forge reads for merge-time association (#5710): GraphQL pages, REST
+ * changed files with rename sources, and the uncached `gh api rate_limit`.
+ */
+export function defaultMergeTimeForge(runGh = defaultRunGh) {
+    const prVars = (repository, prNumber, after) => {
+        const parsed = parseOwnerRepo(repository);
+        return parsed === null
+            ? null
+            : { owner: parsed.owner, name: parsed.name, number: prNumber, after };
+    };
+    const pullRequestOf = (data) => asRecord(asRecord(data.repository)?.pullRequest);
+    const invalid = (repository) => ({
+        ok: false,
+        error: `invalid repository ${repository}`,
+    });
+    return {
+        listMergedPrsPage: (repository, after) => {
+            const parsed = parseOwnerRepo(repository);
+            if (parsed === null)
+                return invalid(repository);
+            return graphqlPage(runGh, { query: MERGED_PRS_GRAPHQL, vars: { owner: parsed.owner, name: parsed.name, after } }, (data) => asRecord(data.repository)?.pullRequests, parseMergedPrNode);
+        },
+        fetchBodyRevisionsPage: (repository, prNumber, after) => {
+            const vars = prVars(repository, prNumber, after);
+            if (vars === null)
+                return invalid(repository);
+            return graphqlPage(runGh, { query: BODY_REVISIONS_GRAPHQL, vars }, (data) => pullRequestOf(data)?.userContentEdits, parseRevisionNode);
+        },
+        fetchConnectionEventsPage: (repository, prNumber, after) => {
+            const vars = prVars(repository, prNumber, after);
+            if (vars === null)
+                return invalid(repository);
+            return graphqlPage(runGh, { query: CONNECTION_EVENTS_GRAPHQL, vars }, (data) => pullRequestOf(data)?.timelineItems, parseConnectionEventNode);
+        },
+        fetchPrFilesPage: (repository, prNumber, after) => fetchPrFilesPageLive(runGh, repository, prNumber, after),
+        probeRateLimit: () => probeLiveRateLimit(runGh),
+        nowMs: () => Date.now(),
+    };
+}
+/**
+ * Canonical project repository (#5710 P1): OWNER/NAME of the `origin` remote.
+ * `--repo` is a matching assertion only and is never the source of it.
+ */
+export function resolveCanonicalProjectRepository(projectRoot, runGit = defaultGitRunner) {
+    let result;
+    try {
+        result = runGit(projectRoot, ["remote", "get-url", "origin"]);
+    }
+    catch {
+        return null;
+    }
+    if (result.code !== 0)
+        return null;
+    return parseGitHubRepoSlug(result.stdout.trim());
+}
+/**
+ * PR-only delivery identity (#5710 P1): only when the plan has no GitHub issue
+ * reference (today's resolver). Identity is (canonical remote, stamped
+ * productPullRequest). `x-xbrief/github-pr` references are never identity.
+ */
+export function resolvePrOnlyDeliveryIdentity(plan, resolveCanonicalRepository) {
+    const prNumber = productPullRequestFromPlan(plan);
     if (prNumber === null) {
         return {
             ok: false,
-            message: "Delivery identity join failed: missing story-associated PR number. " +
-                "Pass --pr <n> for the PR that forge-closes this story; --pr alone is not identity (#3675).",
+            message: "Delivery identity join failed: plan has no x-xbrief/github-issue reference and no " +
+                "plan.metadata.productPullRequest stamp. Stamp productPullRequest (issue-less briefs only) " +
+                "or add an issue origin. An x-xbrief/github-pr reference is not a delivery identity (#5710).",
+        };
+    }
+    const repository = resolveCanonicalRepository();
+    if (repository === null) {
+        return {
+            ok: false,
+            message: `Delivery identity join failed: plan has productPullRequest=${prNumber} but the ` +
+                `canonical project remote (git remote get-url origin) did not resolve to OWNER/NAME (#5710).`,
         };
     }
-    const payload = input.fetchPrPayload(prNumber, expected.repository);
+    return { ok: true, repository, prNumber };
+}
+function fetchMergedPayload(fetchPrPayload, prNumber, repository) {
+    const payload = fetchPrPayload(prNumber, repository);
     if (payload === null) {
         return {
             ok: false,
             message: `Delivery identity join failed: could not fetch PR #${prNumber} in ` +
-                `${expected.repository} (lookup failure) (#3675).`,
+                `${repository} (lookup failure) (#3675).`,
         };
     }
     const mergedAt = typeof payload.merged_at === "string" && payload.merged_at.trim().length > 0
@@ -435,86 +1028,282 @@ export function verifyStoryPrMergeIdentity(input) {
     if (mergedAt === null || mergeCommitSha === null) {
         return {
             ok: false,
-            message: `Delivery identity join failed: PR #${prNumber} in ${expected.repository} ` +
+            message: `Delivery identity join failed: PR #${prNumber} in ${repository} ` +
                 `is not merged (missing merged_at / merge_commit_sha) (#3675).`,
         };
     }
-    const linked = input.fetchClosingIssueIds(prNumber, expected.repository);
-    if (linked === null) {
+    return { ok: true, payload, mergedAt, mergeCommitSha };
+}
+function payloadHeadSha(payload) {
+    const head = asRecord(payload.head);
+    if (typeof head?.sha === "string" && head.sha.trim().length > 0) {
+        return head.sha.trim();
+    }
+    if (typeof payload.head_sha === "string" && payload.head_sha.trim().length > 0) {
+        return payload.head_sha.trim();
+    }
+    return null;
+}
+function mergeCommitMismatch(mergeCommit, merged, prNumber) {
+    if (shasEqual(mergeCommit, merged.mergeCommitSha)) {
+        return null;
+    }
+    return (`Delivery identity join failed: supplied merge commit ${mergeCommit} does not ` +
+        `equal PR #${prNumber} merge_commit_sha ${merged.mergeCommitSha} (identity, not reachability) (#3675).`);
+}
+function checkRecordedImplementation(evidence, payload, prNumber) {
+    const recordedImpl = typeof evidence.implementationCommit === "string" &&
+        evidence.implementationCommit.trim().length > 0
+        ? evidence.implementationCommit.trim()
+        : null;
+    if (recordedImpl === null) {
+        return null;
+    }
+    const headSha = payloadHeadSha(payload);
+    if (headSha !== null && shasEqual(recordedImpl, headSha)) {
+        return null;
+    }
+    return (`Delivery identity join failed: recorded implementationCommit ${recordedImpl} ` +
+        `does not match PR #${prNumber} head at merge time` +
+        `${headSha !== null ? ` (${headSha})` : ""} (#3675).`);
+}
+/** Shared tail: head check and the success result. */
+function finishIdentityJoin(input) {
+    const { evidence, merged, prNumber } = input;
+    const headCheck = checkRecordedImplementation(evidence, merged.payload, prNumber);
+    if (headCheck !== null) {
+        return { ok: false, message: headCheck };
+    }
+    const base = asRecord(merged.payload.base);
+    return {
+        ok: true,
+        message: `story→PR→merge identity joined: ${input.subject} via PR #${prNumber} ` +
+            `(${input.identityBasis})`,
+        mergeCommitSha: merged.mergeCommitSha,
+        mergedAt: merged.mergedAt,
+        prBase: typeof base?.ref === "string" ? base.ref : null,
+        headSha: payloadHeadSha(merged.payload),
+        identityBasis: input.identityBasis,
+        repository: input.repository,
+    };
+}
+function evidencePrNumber(evidence) {
+    return typeof evidence.prNumber === "number" &&
+        Number.isInteger(evidence.prNumber) &&
+        evidence.prNumber > 0
+        ? evidence.prNumber
+        : null;
+}
+function evidenceRepository(evidence) {
+    return typeof evidence.repository === "string" && evidence.repository.trim().length > 0
+        ? evidence.repository.trim()
+        : null;
+}
+/** PR-only join (#5710 P1): stamp + canonical remote; no issue closer, no merge-time standard. */
+function verifyPrOnlyIdentity(input) {
+    const resolved = resolvePrOnlyDeliveryIdentity(input.plan, input.resolveCanonicalRepository ?? (() => null));
+    if (!resolved.ok) {
+        return { ok: false, message: resolved.message };
+    }
+    const { repository, prNumber: stamped } = resolved;
+    const assertedRepo = evidenceRepository(input.evidence);
+    if (assertedRepo !== null && assertedRepo.toLowerCase() !== repository.toLowerCase()) {
         return {
             ok: false,
-            message: `Delivery identity join failed: could not fetch closingIssuesReferences for ` +
-                `PR #${prNumber} in ${expected.repository} (#3675).`,
+            message: `Delivery identity join failed: --repo '${assertedRepo}' does not match the canonical ` +
+                `project remote '${repository}' (matching assertion only) (#5710).`,
         };
     }
-    const closerSet = linked.flatMap((ref) => closerSetFromIssueIds(ref.repository, [ref.issueNumber]));
-    const expectedRepoKey = expected.repository.trim().toLowerCase();
-    const closesStory = closerSet.some((origin) => origin.repo === expectedRepoKey && origin.issueId === expected.issueNumber);
-    let identityBasis = "forge-closer";
-    if (!closesStory) {
-        const closerMiss = `Delivery identity join failed: PR #${prNumber} forge closer set does not include ` +
-            `${expected.repository}#${expected.issueNumber} (wrong story / absent association) (#3675).`;
-        const briefBasename = input.briefBasename?.trim() ?? "";
-        if (briefBasename.length === 0 || input.fetchPrChangedFiles === undefined) {
-            return { ok: false, message: closerMiss };
-        }
-        const files = input.fetchPrChangedFiles(prNumber, expected.repository);
-        if (files === null) {
-            return {
-                ok: false,
-                message: `${closerMiss} Brief-in-PR-diff fallback could not read PR #${prNumber} changed files ` +
-                    `(lookup failure).`,
-            };
-        }
-        if (!prDiffAddsBrief(files, briefBasename)) {
-            return {
-                ok: false,
-                message: `${closerMiss} Brief-in-PR-diff fallback also failed: PR #${prNumber} did not add ` +
-                    `${briefBasename} alongside code changes.`,
-            };
-        }
-        identityBasis = "brief-in-pr-diff";
+    const prNumber = evidencePrNumber(input.evidence);
+    if (prNumber === null) {
+        return {
+            ok: false,
+            message: `Delivery identity join failed: PR-only brief needs --pr ${stamped} ` +
+                `(plan.metadata.productPullRequest) (#5710).`,
+        };
     }
-    if (!shasEqual(input.mergeCommit, mergeCommitSha)) {
+    if (prNumber !== stamped) {
         return {
             ok: false,
-            message: `Delivery identity join failed: supplied merge commit ${input.mergeCommit} does not ` +
-                `equal PR #${prNumber} merge_commit_sha ${mergeCommitSha} (identity, not reachability) (#3675).`,
+            message: `Delivery identity join failed: --pr ${prNumber} is not plan.metadata.productPullRequest ` +
+                `${stamped}. On a PR-only brief the stamp is the identity; an x-xbrief/github-pr ` +
+                `reference does not override it (#5710).`,
         };
     }
-    const base = asRecord(payload.base);
-    const head = asRecord(payload.head);
-    const prBase = typeof base?.ref === "string" ? base.ref : null;
-    const headSha = typeof head?.sha === "string" && head.sha.trim().length > 0
-        ? head.sha.trim()
-        : typeof payload.head_sha === "string" && payload.head_sha.trim().length > 0
-            ? payload.head_sha.trim()
-            : null;
-    const recordedImpl = typeof input.evidence.implementationCommit === "string" &&
-        input.evidence.implementationCommit.trim().length > 0
-        ? input.evidence.implementationCommit.trim()
-        : null;
-    if (recordedImpl !== null) {
-        if (headSha === null || !shasEqual(recordedImpl, headSha)) {
-            return {
-                ok: false,
-                message: `Delivery identity join failed: recorded implementationCommit ${recordedImpl} ` +
-                    `does not match PR #${prNumber} head at merge time` +
-                    `${headSha !== null ? ` (${headSha})` : ""} (#3675).`,
-            };
+    const merged = fetchMergedPayload(input.fetchPrPayload, prNumber, repository);
+    if (!merged.ok) {
+        return { ok: false, message: merged.message };
+    }
+    const mismatch = mergeCommitMismatch(input.mergeCommit, merged, prNumber);
+    if (mismatch !== null) {
+        return { ok: false, message: mismatch };
+    }
+    return finishIdentityJoin({
+        evidence: input.evidence,
+        merged,
+        prNumber,
+        repository,
+        identityBasis: "pr-only",
+        subject: `${repository} productPullRequest`,
+    });
+}
+/** Brief-in-PR-diff basis (#3675, unchanged). Null = proven; "" = not attempted; else reason. */
+function proveBriefInPrDiff(input, repository, prNumber) {
+    const briefBasename = input.briefBasename?.trim() ?? "";
+    if (briefBasename.length === 0 || input.fetchPrChangedFiles === undefined) {
+        return "";
+    }
+    const files = input.fetchPrChangedFiles(prNumber, repository);
+    if (files === null) {
+        return `brief-in-PR-diff: could not read PR #${prNumber} changed files (lookup failure)`;
+    }
+    if (!prDiffAddsBrief(files, briefBasename)) {
+        return `brief-in-PR-diff: PR #${prNumber} did not add ${briefBasename} alongside code changes`;
+    }
+    return null;
+}
+/** Bases b and c from forge reads; returns the proven basis or appends reasons. */
+function proveKeywordOrConnected(forge, budget, target, reasons) {
+    const { repository, issueNumber, prNumber, mergedAt } = target;
+    let mergeTimeBody = null;
+    const body = reconstructMergeTimeBody(forge, budget, { repository, prNumber }, target.currentBody, mergedAt);
+    if (body.ok) {
+        mergeTimeBody = body.body;
+        if (bodyHasClosingKeywordFor(body.body, repository, issueNumber)) {
+            return { basis: "merge-time-keyword", mergeTimeBody };
+        }
+        reasons.push(`(b) PR #${prNumber} body as of merged_at has no closing keyword for #${issueNumber}`);
+    }
+    else {
+        reasons.push(`(a)/(b) ${body.error}`);
+    }
+    const events = collectAllPages((after) => forge.fetchConnectionEventsPage(repository, prNumber, after), budget.beforeGraphql, `PR #${prNumber} connection events`);
+    if (!events.ok) {
+        reasons.push(`(c) ${events.error}`);
+        return { basis: null, mergeTimeBody };
+    }
+    const state = connectedAtMergedAt(events.nodes, repository, issueNumber, mergedAt);
+    if (state.ok && state.connected) {
+        return { basis: "merge-time-connected", mergeTimeBody };
+    }
+    reasons.push(state.ok
+        ? `(c) no Connected link to #${issueNumber} in effect at merged_at`
+        : `(c) ${state.error}`);
+    return { basis: null, mergeTimeBody };
+}
+/**
+ * Issue-anchored association as of merged_at (#5710 P3). Cheap bases first
+ * (b, c, brief-in-PR-diff), then the exhaustive sole-mark scan (a). A failed
+ * lookup only removes a basis; success always needs a positive proof.
+ */
+function proveIssueAnchoredAssociation(input, target) {
+    const { repository, issueNumber, prNumber } = target;
+    const reasons = [];
+    const forge = input.mergeTimeForge;
+    const budget = forge === undefined ? null : makeScanBudget(forge);
+    let mergeTimeBody = null;
+    if (forge !== undefined && budget !== null) {
+        const cheap = proveKeywordOrConnected(forge, budget, target, reasons);
+        if (cheap.basis !== null) {
+            return { ok: true, basis: cheap.basis };
         }
+        mergeTimeBody = cheap.mergeTimeBody;
+    }
+    else {
+        reasons.push("merge-time association lookups are unavailable");
+    }
+    const briefDiff = proveBriefInPrDiff(input, repository, prNumber);
+    if (briefDiff === null) {
+        return { ok: true, basis: "brief-in-pr-diff" };
+    }
+    if (briefDiff.length > 0) {
+        reasons.push(briefDiff);
+    }
+    if (forge !== undefined && budget !== null && mergeTimeBody !== null) {
+        const mark = proveSoleMarkBasis({
+            forge,
+            budget,
+            repository,
+            issueNumber,
+            prNumber,
+            mergeTimeBody,
+        });
+        if (mark.ok) {
+            return { ok: true, basis: "merge-time-mark" };
+        }
+        reasons.unshift(mark.reason);
     }
     return {
-        ok: true,
-        message: `story→PR→merge identity joined: ${expected.repository}#${expected.issueNumber} via PR #${prNumber}` +
-            (identityBasis === "brief-in-pr-diff" ? " (brief-in-PR-diff)" : ""),
-        mergeCommitSha,
-        mergedAt,
-        prBase,
-        headSha,
-        identityBasis,
+        ok: false,
+        message: `Delivery identity join failed: PR #${prNumber} has no merge-time association with ` +
+            `${repository}#${issueNumber}. Accepted bases: ${MERGE_TIME_ASSOCIATION_BASES}. ` +
+            `A mark, keyword or link added after merged_at does not count, and current ` +
+            `closingIssuesReferences alone is insufficient. Findings: ${reasons.join("; ")}. ` +
+            `Already-merged work with no merge-time basis stays refused until the parked ` +
+            `identity-migration ships (#5710).`,
     };
 }
+/**
+ * Prefer-A story→PR→merge identity join before delivery liveness (#3675 / #5710).
+ *
+ * Issue-anchored briefs (today's `resolvePlanGithubIssueRef`): the association
+ * must hold as of merged_at by (a) a unique sole `deft-story` mark, (b) a
+ * closing keyword in the merge-time body, or (c) a Connected link at merged_at,
+ * or by the unchanged brief-in-PR-diff basis. Current-state
+ * closingIssuesReferences alone is insufficient, and `productPullRequest === --pr`
+ * is not a proof here. A failed issue-anchored check never falls back to the stamp.
+ *
+ * Issue-less briefs use the PR-only identity (#5710 P1). merge_commit_sha must
+ * equal the supplied merge commit on both paths (squash-safe).
+ */
+export function verifyStoryPrMergeIdentity(input) {
+    const expected = resolvePlanGithubIssueRef(input.plan);
+    if (expected === null) {
+        return verifyPrOnlyIdentity(input);
+    }
+    const evidenceRepo = evidenceRepository(input.evidence);
+    if (evidenceRepo !== null && evidenceRepo !== expected.repository) {
+        return {
+            ok: false,
+            message: `Delivery identity join failed: evidence repository '${evidenceRepo}' does not match ` +
+                `plan-derived expected repository '${expected.repository}' (#3675).`,
+        };
+    }
+    const prNumber = evidencePrNumber(input.evidence);
+    if (prNumber === null) {
+        return {
+            ok: false,
+            message: "Delivery identity join failed: missing story-associated PR number. " +
+                "Pass --pr <n> for the PR that delivered this story; --pr alone is not identity (#3675).",
+        };
+    }
+    const merged = fetchMergedPayload(input.fetchPrPayload, prNumber, expected.repository);
+    if (!merged.ok) {
+        return { ok: false, message: merged.message };
+    }
+    const mismatch = mergeCommitMismatch(input.mergeCommit, merged, prNumber);
+    if (mismatch !== null) {
+        return { ok: false, message: mismatch };
+    }
+    const association = proveIssueAnchoredAssociation(input, {
+        repository: expected.repository,
+        issueNumber: expected.issueNumber,
+        prNumber,
+        mergedAt: merged.mergedAt,
+        currentBody: typeof merged.payload.body === "string" ? merged.payload.body : null,
+    });
+    if (!association.ok) {
+        return { ok: false, message: association.message };
+    }
+    return finishIdentityJoin({
+        evidence: input.evidence,
+        merged,
+        prNumber,
+        repository: expected.repository,
+        identityBasis: association.basis,
+        subject: `${expected.repository}#${expected.issueNumber}`,
+    });
+}
 /**
  * Classify stored completion provenance for read paths.
  * Legacy completed records without provenance → unknown/unverified (not delivered).
@@ -777,6 +1566,60 @@ function deliveryEvidenceRemediation(deliveryBranch) {
         `When ${deliveryBranch} is delivery, wait until the merge commit is an ancestor of ` +
         `origin/${deliveryBranch}, then complete. Do not use --non-delivery for work that shipped.`);
 }
+/**
+ * #5710 P4: refuse a non-delivery disposition when the stamped productPullRequest
+ * is merged in the authoritative repository (the issue repository, else the
+ * canonical remote). Merged to an integration branch counts as merged in v1.
+ * Returns null when no stamp exists or the stamped PR is confirmed unmerged.
+ * Any failure to establish merge state fails closed with a retry diagnostic.
+ *
+ * Policy (Recut-13 lean, #5710 comment 6817282070):
+ * - Guarantee: a code-bearing brief (`isCodeBearingScope`) cannot take a
+ *   non-delivery disposition while its stamped PR is merged or unreadable.
+ * - Non-goal in v1: briefs that are not code-bearing (`docs-only` /
+ *   `process-only` tags, `metadata.delivery.required: false`, docs/process/
+ *   research kinds). They return before this check. The lean parks "Moving the
+ *   non-delivery refuse ahead of the !codeBearing early return"; widening it
+ *   needs a new contract, not a review fix.
+ */
+function refuseNonDeliveryForMergedStamp(input) {
+    const productPr = productPullRequestFromPlan(input.plan);
+    if (productPr === null) {
+        return null;
+    }
+    const head = `Refusing scope:complete --non-delivery ${input.disposition}:`;
+    const noWrite = "No completion or provenance was recorded (#5710).";
+    const repository = resolvePlanGithubIssueRef(input.plan)?.repository ?? input.resolveCanonicalRepository();
+    if (repository === null) {
+        return (`${head} cannot resolve the repository of stamped productPullRequest #${productPr} ` +
+            `(no issue origin and no canonical origin remote). Repair the remote or the stamp, ` +
+            `then retry. ${noWrite}`);
+    }
+    let payload;
+    try {
+        payload = input.fetchPrPayload(productPr, repository);
+    }
+    catch {
+        payload = null;
+    }
+    const mergedAt = payload?.merged_at;
+    const unknown = payload === null ||
+        payload === undefined ||
+        !("merged_at" in payload) ||
+        (mergedAt !== null && (typeof mergedAt !== "string" || mergedAt.trim().length === 0));
+    if (unknown) {
+        return (`${head} could not establish whether stamped productPullRequest #${productPr} in ` +
+            `${repository} is merged (lookup failed or malformed response). Retry after fixing gh ` +
+            `auth, rate limit or network, or repair plan.metadata.productPullRequest. ${noWrite}`);
+    }
+    if (mergedAt === null) {
+        return null;
+    }
+    return (`${head} stamped productPullRequest #${productPr} in ${repository} is merged ` +
+        `(merged_at ${String(mergedAt)}). Shipped work completes as delivered: ` +
+        `scope:complete -- --pr ${productPr} --merge-commit <sha>. A merge to an integration ` +
+        `branch also counts as merged here. ${noWrite}`);
+}
 /**
  * Gate delivered completion for a code-bearing scope (#3041 / #3380 / #3675).
  *
@@ -793,14 +1636,19 @@ export function evaluateDeliveryGate(options) {
     const runGh = options.runGh ?? defaultRunGh;
     const fetchPrPayload = options.fetchPrPayload ??
         ((prNumber, repository) => defaultFetchPrPayload(prNumber, repository, runGh));
-    const fetchClosingIssueIds = options.fetchClosingIssueIds ??
-        ((prNumber, repository) => defaultFetchClosingIssueIds(prNumber, repository, runGh));
-    // Default the changed-files fetcher only when closer refs are not injected, so
-    // injected test seams never fall through to a live gh call.
+    // Live defaults only when the PR payload is not injected, so injected test
+    // seams never fall through to a live gh call.
+    const liveForge = options.fetchPrPayload === undefined;
     const fetchPrChangedFiles = options.fetchPrChangedFiles ??
-        (options.fetchClosingIssueIds === undefined
+        (liveForge
             ? (prNumber, repository) => defaultFetchPrChangedFiles(prNumber, repository, runGh)
             : undefined);
+    const mergeTimeForge = options.mergeTimeForge ?? (liveForge ? defaultMergeTimeForge(runGh) : undefined);
+    const resolveCanonicalRepository = () => resolveCanonicalProjectRepository(options.projectRoot, runGit);
+    // #5710 P4: the merged-stamp check needs an uncached read; a stale
+    // "unmerged" would let shipped work record as non-delivery.
+    const fetchStampedPrLive = options.fetchPrPayload ??
+        ((prNumber, repository) => defaultFetchPrPayload(prNumber, repository, liveRunGh(runGh)));
     const verifier = options.verifier ?? "scope:complete";
     const codeBearing = isCodeBearingScope(options.plan);
     // #5693: experiment_archived Findings check runs before the non-code early
@@ -835,6 +1683,16 @@ export function evaluateDeliveryGate(options) {
                 codeBearing: true,
             };
         }
+        // #5710 P4: resolve a stamped productPullRequest before any non-delivery success.
+        const shipped = refuseNonDeliveryForMergedStamp({
+            plan: options.plan,
+            disposition: options.nonDeliveryDisposition,
+            fetchPrPayload: fetchStampedPrLive,
+            resolveCanonicalRepository,
+        });
+        if (shipped !== null) {
+            return { ok: false, message: shipped, provenance: null, codeBearing: true };
+        }
         const branchResult = resolveDeliveryBranch(options.projectRoot, runGit);
         const refused = refuseUnsafeResolvedDelivery(branchResult);
         if (refused !== null) {
@@ -931,9 +1789,10 @@ export function evaluateDeliveryGate(options) {
         evidence,
         mergeCommit,
         fetchPrPayload,
-        fetchClosingIssueIds,
+        mergeTimeForge,
         briefBasename: options.briefBasename,
         fetchPrChangedFiles,
+        resolveCanonicalRepository,
     });
     if (!identity.ok) {
         return {
@@ -945,7 +1804,7 @@ export function evaluateDeliveryGate(options) {
     }
     const boundEvidence = {
         ...evidence,
-        repository: resolvePlanGithubIssueRef(options.plan)?.repository ?? evidence.repository ?? null,
+        repository: identity.repository ?? evidence.repository ?? null,
         prNumber: evidence.prNumber,
         prBase: identity.prBase ?? prBase,
         mergeCommit: identity.mergeCommitSha ?? mergeCommit,
@@ -1372,20 +2231,27 @@ export function discoverDeliveryEvidenceForComplete(options) {
     const expected = resolvePlanGithubIssueRef(options.plan);
     const productPr = productPullRequestFromPlan(options.plan);
     if (productPr !== null) {
-        if (expected === null) {
-            return {
-                ok: false,
-                message: `Delivery auto-discovery failed: plan has productPullRequest=${productPr} but no ` +
-                    `x-xbrief/github-issue reference to derive repository (#3583). ` +
-                    deliveryEvidenceRemediation(deliveryBranch),
-            };
+        // #5710 P1: an issue-less brief uses the same PR-only resolver as the identity join.
+        let repository;
+        if (expected !== null) {
+            repository = expected.repository;
+        }
+        else {
+            const prOnly = resolvePrOnlyDeliveryIdentity(options.plan, () => resolveCanonicalProjectRepository(options.projectRoot, runGit));
+            if (!prOnly.ok) {
+                return {
+                    ok: false,
+                    message: `Delivery auto-discovery failed: ${prOnly.message} ${deliveryEvidenceRemediation(deliveryBranch)}`,
+                };
+            }
+            repository = prOnly.repository;
         }
-        const payload = fetchPrPayload(productPr, expected.repository);
+        const payload = fetchPrPayload(productPr, repository);
         if (payload === null) {
             return {
                 ok: false,
                 message: `Delivery auto-discovery failed: could not fetch productPullRequest #${productPr} ` +
-                    `in ${expected.repository} (#3583). ${deliveryEvidenceRemediation(deliveryBranch)}`,
+                    `in ${repository} (#3583). ${deliveryEvidenceRemediation(deliveryBranch)}`,
             };
         }
         if (!candidatePassesDeliveryBaseFilter(payload, deliveryBranch)) {
@@ -1396,7 +2262,7 @@ export function discoverDeliveryEvidenceForComplete(options) {
                     `territory in v1) (#3583). ${deliveryEvidenceRemediation(deliveryBranch)}`,
             };
         }
-        const discovered = evidenceFromPrPayload(payload, productPr, expected.repository, deliveryBranch, verifier);
+        const discovered = evidenceFromPrPayload(payload, productPr, repository, deliveryBranch, verifier);
         return {
             ok: true,
             evidence: mergePreservingExplicitFacts(existing, discovered),