@patronage/software-factory 0.23.0 → 0.25.0

package/dist/index.js

@@ -9,16 +9,16 @@ import crypto, { createHash, createSign, randomUUID } from "node:crypto";
 import { z } from "zod";
 import { execFileSync, spawnSync } from "node:child_process";
 import { link, lstat, mkdir, open, readFile, readdir, realpath, rename, stat, unlink } from "node:fs/promises";
+import os, { homedir } from "node:os";
 import { createInterface } from "node:readline";
 import { setImmediate } from "node:timers";
 import { setImmediate as setImmediate$1, setTimeout as setTimeout$1 } from "node:timers/promises";
 import { Worker } from "node:worker_threads";
 import picomatch from "picomatch";
-import os, { homedir } from "node:os";
 import { promisify } from "node:util";
 import { parse } from "yaml";
 //#region package.json
-var version = "0.23.0";
+var version = "0.25.0";
 //#endregion
 //#region src/review-rungs.ts
 const EVIDENCE_REVIEW_RUNGS$1 = [
@@ -936,6 +936,14 @@ const fetchPullRequestReviews = (fullName, prNumber) => {
 const CF_ACCESS_CLIENT_ID_ENV = "CF-Access-Client-Id";
 const CF_ACCESS_CLIENT_SECRET_ENV = "CF-Access-Client-Secret";
 /**
+* True in a hosted runner, where secret-manager resolution must not be
+* tried (#312). Lives here — a dependency-free leaf both
+* `hq-ingest-preflight.ts` and `hq-credentials.ts` already import from for
+* the env var names above — so neither of those two needs to import the
+* other for it; that import, either direction, would close a cycle (#394).
+*/
+const isHostedRunner = (env) => env.CI === "true" || env.CI === "1" || env.GITHUB_ACTIONS === "true";
+/**
 * Builds a credential-bearing HQ request that cannot follow redirects. Access
 * credentials must never leave the origin selected by the caller.
 */
@@ -1387,8 +1395,52 @@ function formatUserConfigError(configPath, error) {
 	return `User config is invalid: ${configPath}: ${formatZodIssues(error)}`;
 }
 const DEFAULT_HQ_TRANSPORT_TIMEOUT_MS = 2500;
-const DEFAULT_HQ_RETRY_JOURNAL_PATH = ".factory-memory/hq-retry-journal.jsonl";
-const DEFAULT_HQ_RETRY_SPOOL_PATH = ".factory-memory/hq-retry-spool";
+const HQ_RETRY_SPOOL_DIRNAME = "hq-retry-spool";
+const HQ_RETRY_JOURNAL_BASENAME = "hq-retry-journal.jsonl";
+/**
+* Appended to a spooled event that can never be delivered (#445).
+*
+* The suffix *is* the disposition: every reader in this module selects work by
+* `*.json`, so a renamed file leaves the drain candidates and the pending
+* counters at once, without a second state file to keep in step with it. The
+* bytes are untouched and the original name is one `.undeliverable` away, so
+* this discards a claim about the file, not the file.
+*/
+const UNDELIVERABLE_SUFFIX = ".undeliverable";
+/**
+* Names the repository whose evidence a spool directory holds (#447).
+*
+* The sweep's problem has always been that a directory on a shared root
+* carries no statement about who wrote it. #420 walked the root and called
+* everything unfamiliar an orphan, which described another repository's
+* ordinary spool exactly as well as this repository's obsolete one. #446
+* replaced the walk with keys derived from this checkout's own identity, which
+* cannot lie — but also cannot generate a key *encoding* it no longer produces,
+* losing the retired non-injective era.
+*
+* A marker written at enqueue time ends that guessing: the directory says whose
+* it is, so "an old encoding of mine" and "a current key of someone else's"
+* stop being indistinguishable. It is written beside the events by the one path
+* that knows the answer from the profile, and read by the sweep.
+*
+* It does **not** cover renames or owner changes. The marker holds the name
+* that was current when the directory was written, and `markerClaims` compares
+* it to the name that is current now, so a pre-rename directory does not match.
+* See `sweepHqSpoolOrphans` — #447 stays open for that.
+*
+* Deliberately not `*.json`: every reader in this module selects events by that
+* suffix, and a marker that looked like an event would be drained as one.
+*/
+const SPOOL_REPOSITORY_MARKER = ".repository-identity";
+/**
+* Depth cap for the marker walk. `<owner>/<repo>/hq-retry-spool` is depth 3,
+* and the extra level is slack for a key scheme that nests one deeper.
+*/
+const HQ_SPOOL_SWEEP_MAX_DEPTH = 4;
+`${HQ_RETRY_JOURNAL_BASENAME}`;
+`${HQ_RETRY_SPOOL_DIRNAME}`;
+const LEGACY_FACTORY_MEMORY_DIRNAME = ".factory-memory";
+const HQ_SPOOL_STATE_SEGMENTS = ["patronage-factory", "hq-spool"];
 const MAX_HQ_CONFIG_BYTES = 1024 * 1024;
 const MAX_HQ_INGEST_PAYLOAD_BYTES = 256 * 1024;
 const MAX_HQ_REPLAY_ENTRIES = 32;
@@ -1429,45 +1481,152 @@ const secureStateDirectory = async (directory, deadline) => {
 		return false;
 	}
 };
-const secureRetrySpoolPath = async (cwd, deadline) => {
+const layoutPath = (layout) => path.join(layout.root, ...layout.segments);
+/**
+* Where the spool tree lives. Under test, the implicit answer is refused
+* (#445).
+*
+* Three `retro-envelope` fixtures recorded against `https://hq.example` were
+* found sitting in a real operator's `~/.local/state` — written by tests that
+* simply never redirected the state home, and invisible until #420's sweep
+* made stranded evidence loud. The vitest package has a global setup that
+* redirects it; `scripts/factory-cli.test.mjs` runs under `node --test`, never
+* sees that setup, and spawns the CLI with `...process.env`, so the real home
+* flows straight through. That leaves the property "tests do not touch
+* operator state" resting on discipline at every callsite — and the callsite
+* that forgets is silent, because falling back to the real home is exactly
+* what this function is supposed to do.
+*
+* So the fallback itself is what a test may not have. Under `NODE_ENV=test`,
+* an absent `XDG_STATE_HOME` is an error rather than a default, and the error
+* names the fix. One guard covers both runners and any runner added later,
+* which per-callsite discipline demonstrably cannot.
+*
+* What this guarantees is that the *write cannot happen*, not that anyone sees
+* it: emit-path HQ delivery is advisory and swallows its own failures on
+* purpose, so a caller inside that path turns this throw into a silent no-op.
+* That is the right trade here — the property being defended is "tests do not
+* touch operator state", and a refused write defends it whether or not the
+* refusal is announced. Tests that resolve the spool directly, like the one in
+* `hq-spool-inspection.test.ts`, do see the error.
+*/
+const stateHomeDirectory = (env) => {
+	const stateHome = env.XDG_STATE_HOME;
+	if (stateHome !== void 0 && stateHome !== "") return stateHome;
+	if ((env.NODE_ENV ?? process.env.NODE_ENV) === "test") throw new Error("Refusing to resolve the HQ spool state home from HOME under NODE_ENV=test: a test that writes there writes into the real operator's state (#445). Set XDG_STATE_HOME to a temporary directory for this test.");
+	const home = env.HOME !== void 0 && env.HOME !== "" ? env.HOME : os.homedir();
+	return path.join(home, ".local", "state");
+};
+/**
+* One filesystem-safe segment per repository *component*.
+*
+* Owner and repo are separate path segments, and each is escaped reversibly:
+* joining them into a single `<owner>-<repo>` name is ambiguous (owner `a-b`
+* repo `c` and owner `a` repo `b-c` produce the same string), and a lossy
+* `[^A-Za-z0-9._-] → _` substitution is ambiguous for the same reason. Two
+* repositories that collide would interleave spools and drain each other's
+* events to the wrong endpoint, so the encoding has to be injective:
+* percent-escape every byte outside the safe set, `%` included, and escape a
+* segment made only of dots so no component can become `.` or `..`.
+*/
+const hqSpoolSegment = (component) => {
+	const escaped = component.replaceAll(/[^A-Za-z0-9._-]/gu, (character) => [...Buffer.from(character, "utf-8")].map((byte) => `%${byte.toString(16).toUpperCase().padStart(2, "0")}`).join(""));
+	return /^\.+$/u.test(escaped) ? escaped.replaceAll(".", "%2E") : escaped;
+};
+/** The repository's own two segments, outermost first. */
+const repositorySegments = (repository) => [hqSpoolSegment(repository.owner), hqSpoolSegment(repository.repo)];
+/** The state directory holding one spool tree per repository. */
+const hqSpoolRoot = (env = process.env) => path.join(stateHomeDirectory(env), ...HQ_SPOOL_STATE_SEGMENTS);
+/** The repo-keyed spool directory: outlives any worktree that produced it. */
+const hqSpoolDirectory = (repository, env = process.env) => path.join(hqSpoolRoot(env), ...repositorySegments(repository), HQ_RETRY_SPOOL_DIRNAME);
+/** The only location current producers write. */
+const repositorySpoolLayout = (repository, env = process.env) => ({
+	create: true,
+	createRoot: true,
+	repository,
+	root: stateHomeDirectory(env),
+	segments: [
+		...HQ_SPOOL_STATE_SEGMENTS,
+		...repositorySegments(repository),
+		HQ_RETRY_SPOOL_DIRNAME
+	]
+});
+/** Read-only drain source for spools written before the relocation. */
+const legacySpoolLayout = (cwd) => ({
+	create: false,
+	root: cwd,
+	segments: [LEGACY_FACTORY_MEMORY_DIRNAME, HQ_RETRY_SPOOL_DIRNAME]
+});
+/**
+* An operator-named directory (`hq:flush --dir`). Accepts either the spool
+* itself or the directory holding it, so a `.factory-memory` path and a
+* `.../hq-retry-spool` path both drain.
+*/
+const explicitSpoolLayout = (directory) => {
+	const resolved = path.resolve(directory);
+	const spool = path.basename(resolved) === "hq-retry-spool" ? resolved : path.join(resolved, HQ_RETRY_SPOOL_DIRNAME);
+	const memory = path.dirname(spool);
+	return {
+		create: false,
+		root: path.dirname(memory),
+		segments: [path.basename(memory), path.basename(spool)]
+	};
+};
+const secureChain = async (layout, segments, deadline) => {
 	let root;
 	try {
-		const canonical = await settleWithin(realpath(cwd), remainingMs(deadline));
+		if (layout.createRoot === true) await settleWithin(mkdir(layout.root, { recursive: true }), remainingMs(deadline));
+		const canonical = await settleWithin(realpath(layout.root), remainingMs(deadline));
 		if (canonical.status !== "fulfilled") return;
 		root = canonical.value;
 	} catch {
 		return;
 	}
 	const rootIdentity = await readDirectoryIdentity(root, deadline);
-	if (rootIdentity === void 0) return;
-	const memory = path.join(root, ".factory-memory");
-	const spool = path.join(root, DEFAULT_HQ_RETRY_SPOOL_PATH);
-	if (!(await secureStateDirectory(memory, deadline) && await secureStateDirectory(spool, deadline))) return;
-	const plainMemoryIdentity = await readDirectoryIdentity(memory, deadline);
-	const plainSpoolIdentity = await readDirectoryIdentity(spool, deadline);
-	if (plainMemoryIdentity === void 0 || plainSpoolIdentity === void 0) return;
-	const rootAnchor = {
+	if (rootIdentity === void 0 || segments.length === 0) return;
+	const ancestors = [{
 		directory: root,
 		identity: {
 			dev: rootIdentity.dev,
 			ino: rootIdentity.ino
 		}
-	};
-	const memoryIdentity = {
-		...plainMemoryIdentity,
-		ancestors: [rootAnchor]
-	};
-	const spoolIdentity = {
-		...plainSpoolIdentity,
-		ancestors: [rootAnchor, {
-			directory: memory,
+	}];
+	const identities = [];
+	const directories = [];
+	let current = root;
+	for (const segment of segments) {
+		current = path.join(current, segment);
+		if (layout.create && !await secureStateDirectory(current, deadline)) return;
+		const plain = await readDirectoryIdentity(current, deadline);
+		if (plain === void 0) return;
+		identities.push({
+			...plain,
+			ancestors: [...ancestors]
+		});
+		ancestors.push({
+			directory: current,
 			identity: {
-				dev: plainMemoryIdentity.dev,
-				ino: plainMemoryIdentity.ino
+				dev: plain.dev,
+				ino: plain.ino
 			}
-		}]
-	};
-	if (!await directoryIdentityMatches(memory, memoryIdentity, deadline) || !await directoryIdentityMatches(spool, spoolIdentity, deadline)) return;
+		});
+		directories.push(current);
+	}
+	return {
+		directories,
+		identities
+	};
+};
+const secureSpoolLayout = async (layout, deadline) => {
+	if (layout.segments.length < 2) return;
+	const chain = await secureChain(layout, layout.segments, deadline);
+	if (chain === void 0) return;
+	const { directories, identities } = chain;
+	const spool = directories.at(-1);
+	const memory = directories.at(-2);
+	const spoolIdentity = identities.at(-1);
+	const memoryIdentity = identities.at(-2);
+	if (spool === void 0 || memory === void 0 || spoolIdentity === void 0 || memoryIdentity === void 0 || !await directoryIdentityMatches(memory, memoryIdentity, deadline) || !await directoryIdentityMatches(spool, spoolIdentity, deadline)) return;
 	return {
 		memory,
 		memoryIdentity,
@@ -1475,6 +1634,24 @@ const secureRetrySpoolPath = async (cwd, deadline) => {
 		spoolIdentity
 	};
 };
+/**
+* The legacy JSONL journal lives one level above the spool. Securing it on its
+* own lets a pre-spool `.factory-memory` (journal but no spool directory)
+* drain without the read path creating anything inside the worktree.
+*/
+const secureJournalDirectory = async (layout, deadline) => {
+	const segments = layout.segments.slice(0, -1);
+	if (segments.length === 0) return;
+	const chain = await secureChain(layout, segments, deadline);
+	if (chain === void 0) return;
+	const directory = chain.directories.at(-1);
+	const identity = chain.identities.at(-1);
+	if (directory === void 0 || identity === void 0 || !await directoryIdentityMatches(directory, identity, deadline)) return;
+	return {
+		directory,
+		identity
+	};
+};
 const readDirectoryIdentity = async (directory, deadline) => {
 	const opened = await openWithin(directory, constants.O_RDONLY + constants.O_DIRECTORY + constants.O_NOFOLLOW, remainingMs(deadline));
 	if (opened.status !== "fulfilled") return;
@@ -1524,19 +1701,58 @@ const publishImmutableFile = async (directory, directoryIdentity, sourcePath, de
 	await mutateBoundDirectory(directory, directoryIdentity, deadline, async () => unlink(sourcePath));
 	return true;
 };
-const removeRetrySpoolEvent = async (cwd, eventPath, deadline) => {
-	const secured = await settleWithin(secureRetrySpoolPath(cwd, deadline), remainingMs(deadline));
+const removeRetrySpoolEvent = async (layout, eventPath, deadline) => {
+	const secured = await settleWithin(secureSpoolLayout(layout, deadline), remainingMs(deadline));
 	if (secured.status !== "fulfilled" || secured.value === void 0 || path.dirname(eventPath) !== secured.value.spool) return false;
 	const { spool, spoolIdentity } = secured.value;
 	const metadata = await settleWithin(lstat(eventPath), remainingMs(deadline));
 	if (metadata.status !== "fulfilled" || !metadata.value.isFile() || metadata.value.isSymbolicLink()) return false;
 	return mutateBoundDirectory(spool, spoolIdentity, deadline, async () => unlink(eventPath));
 };
+/**
+* Stamps the spool directory with the repository writing into it (#447).
+*
+* Best-effort on purpose, and never on the delivery path's critical line: a
+* marker that cannot be written costs future coverage, never this event. An
+* enqueue that failed because the provenance file could not be created would
+* trade evidence for bookkeeping, which is the wrong way round.
+*
+* Written once and then left alone — the first enqueue under a key stamps it,
+* and later ones find it present. Rewriting it per enqueue would churn a file
+* that never changes while the identity does not, for no gain: the sweep reads
+* it, and the sweep runs later.
+*
+* Note what write-once means for a rename: the marker keeps the *old* name,
+* and `markerClaims` matches on the current one, so the stamp does not survive
+* a rename as a claim. That is a known limit, not an intended property (#447).
+*/
+const writeRepositoryMarker = async (layout, spool, identity, deadline) => {
+	if (layout.repository === void 0) return;
+	const markerPath = path.join(spool, SPOOL_REPOSITORY_MARKER);
+	const probed = await settleWithin(lstat(markerPath), remainingMs(deadline));
+	if (probed.status !== "rejected" || !isMissingEntryError(probed.error)) return;
+	const body = JSON.stringify({
+		owner: layout.repository.owner,
+		repo: layout.repository.repo,
+		schemaVersion: 1
+	});
+	const temporary = path.join(spool, `${SPOOL_REPOSITORY_MARKER}.${randomUUID()}.tmp`);
+	const opened = await openWithin(temporary, constants.O_CREAT + constants.O_EXCL + constants.O_WRONLY + constants.O_NOFOLLOW, remainingMs(deadline), 384);
+	if (opened.status !== "fulfilled") return;
+	const handle = opened.value;
+	const written = await settleWithin(handle.writeFile(body, "utf-8"), remainingMs(deadline));
+	await settleWithin(handle.close(), remainingMs(deadline));
+	if (written.status !== "fulfilled") {
+		await mutateBoundDirectory(spool, identity, deadline, async () => unlink(temporary));
+		return;
+	}
+	if (!await mutateBoundDirectory(spool, identity, deadline, async () => rename(temporary, markerPath))) await mutateBoundDirectory(spool, identity, deadline, async () => unlink(temporary));
+};
 const spoolFileName = (entry) => {
 	const { eventId } = entry.event;
 	return /^[A-Za-z0-9_-]{1,160}$/u.test(eventId) ? `${eventId}.json` : `${randomUUID()}.json`;
 };
-const persistRetrySpool = async (cwd, entry, deadline) => {
+const persistRetrySpool = async (layout, entry, deadline) => {
 	let body;
 	try {
 		body = JSON.stringify(entry);
@@ -1550,12 +1766,13 @@ const persistRetrySpool = async (cwd, entry, deadline) => {
 		failure: "failed",
 		status: "failed"
 	};
-	const secured = await settleWithin(secureRetrySpoolPath(cwd, deadline), remainingMs(deadline));
+	const secured = await settleWithin(secureSpoolLayout(layout, deadline), remainingMs(deadline));
 	if (secured.status !== "fulfilled" || secured.value === void 0) return {
 		failure: secured.status === "timed-out" ? "timed-out" : "failed",
 		status: "failed"
 	};
 	const { spool, spoolIdentity: identity } = secured.value;
+	await writeRepositoryMarker(layout, spool, identity, deadline);
 	const finalName = `${randomUUID()}-${spoolFileName(entry)}`;
 	const temporary = path.join(spool, `.${finalName}.tmp`);
 	const finalPath = path.join(spool, finalName);
@@ -1603,8 +1820,8 @@ const persistRetrySpool = async (cwd, entry, deadline) => {
 		status: "failed"
 	};
 };
-const appendCloseoutSpool = async (cwd, entry, deadline) => {
-	const result = await persistRetrySpool(cwd, entry, deadline);
+const appendCloseoutSpool = async (layout, entry, deadline) => {
+	const result = await persistRetrySpool(layout, entry, deadline);
 	return result.status === "failed" ? result.failure : void 0;
 };
 const positiveBudget = (value) => typeof value === "number" && Number.isFinite(value) && value > 0 ? value : void 0;
@@ -1652,8 +1869,11 @@ const settleWithin = async (operation, budgetMs) => {
 				status: "fulfilled",
 				value: await operation
 			};
-		} catch {
-			return { status: "rejected" };
+		} catch (error) {
+			return {
+				error,
+				status: "rejected"
+			};
 		}
 	};
 	const timeoutAbort = new AbortController();
@@ -1828,21 +2048,21 @@ const validatedIngestEndpoint = (value) => {
 	const origin = validatedEndpoint(value);
 	return origin === void 0 ? void 0 : new URL(HQ_INGEST_PATH, origin.origin);
 };
-const retainRetryEntry = async (cwd, entry, dependencies, deadline, options = {}) => {
+const retainRetryEntry = async (layout, entry, dependencies, deadline, options = {}) => {
 	let customAppend;
 	try {
 		customAppend = dependencies.appendJournal;
 	} catch {
 		return "failed";
 	}
-	if (customAppend === void 0) return appendCloseoutSpool(cwd, entry, deadline);
+	if (customAppend === void 0) return appendCloseoutSpool(layout, entry, deadline);
 	let row;
 	try {
 		row = JSON.stringify(entry);
 	} catch {
 		return "failed";
 	}
-	const target = path.resolve(cwd, DEFAULT_HQ_RETRY_SPOOL_PATH, `${randomUUID()}-${spoolFileName(entry)}`);
+	const target = path.join(path.resolve(layout.root, ...layout.segments), `${randomUUID()}-${spoolFileName(entry)}`);
 	if (options.awaitCustom !== true) {
 		setImmediate(async () => {
 			try {
@@ -1956,11 +2176,38 @@ async function handoffHqIngest(input, dependencies, setupDeadline) {
 		failedAt,
 		reason
 	};
-	const journalFailure = dependencies.appendJournal === void 0 ? await appendCloseoutSpool(input.cwd, retryEntry, flushDeadline) : await retainRetryEntry(input.cwd, retryEntry, dependencies, flushDeadline, { awaitCustom: true });
+	const writeLayout = repositorySpoolLayout({
+		owner: input.profile.repository.owner,
+		repo: input.profile.repository.name
+	}, env);
+	const journalFailure = dependencies.appendJournal === void 0 ? await appendCloseoutSpool(writeLayout, retryEntry, flushDeadline) : await retainRetryEntry(writeLayout, retryEntry, dependencies, flushDeadline, { awaitCustom: true });
 	if (journalFailure) await reportDiagnostic(dependencies, flushDeadline, `closeout advisory handoff local spool ${journalFailure}`);
 	return journalFailure === void 0 && !dropped ? "deferred" : "held";
 }
-async function attemptTransport(request, endpoint, clientId, clientSecret, body, transportBudgetMs) {
+/**
+* A bounded read of the ingest receipt body. Only the explicit drain asks for
+* it: the gate path must not add a body read to its transport leg. Nothing but
+* HQ's own `duplicate` flag and a truncated error string is retained.
+*/
+const readIngestReceipt = async (response, budgetMs) => {
+	const text = await settleWithin(Promise.resolve().then(async () => response.text()), budgetMs);
+	if (text.status !== "fulfilled") return {};
+	const source = text.value.slice(0, 4096);
+	let parsed;
+	try {
+		parsed = JSON.parse(source);
+	} catch {
+		return source.trim() === "" ? {} : { detail: source.slice(0, 200).trim() };
+	}
+	if (parsed === null || typeof parsed !== "object") return {};
+	const record = parsed;
+	const message = [record.error, record.message].filter((value) => typeof value === "string").join(": ");
+	return {
+		...message === "" ? {} : { detail: message.slice(0, 200) },
+		...typeof record.duplicate === "boolean" ? { duplicate: record.duplicate } : {}
+	};
+};
+async function attemptTransport(request, endpoint, clientId, clientSecret, body, transportBudgetMs, receipt = false) {
 	if (transportBudgetMs <= 0) return {
 		ok: false,
 		reason: "transport-timeout",
@@ -1994,13 +2241,20 @@ async function attemptTransport(request, endpoint, clientId, clientSecret, body,
 	};
 	if (!transport.value.ok) {
 		const { status } = transport.value;
+		const rejection = receipt ? await readIngestReceipt(transport.value, transportBudgetMs) : {};
 		return {
+			...rejection.detail === void 0 ? {} : { detail: rejection.detail },
 			ok: false,
 			reason: typeof status === "number" && Number.isFinite(status) ? `http-status-${status}` : "http-error",
 			unconfirmed: false
 		};
 	}
-	return { ok: true };
+	if (!receipt) return { ok: true };
+	const accepted = await readIngestReceipt(transport.value, transportBudgetMs);
+	return {
+		ok: true,
+		...accepted.duplicate === void 0 ? {} : { duplicate: accepted.duplicate }
+	};
 }
 const isReplayableEntry = (value) => {
 	if (value === null || typeof value !== "object") return false;
@@ -2011,8 +2265,27 @@ const isReplayableEntry = (value) => {
 	const eventRecord = event;
 	return "payload" in eventRecord && typeof eventRecord.eventId === "string" && typeof eventRecord.kind === "string";
 };
-const replayCloseoutSpool = async (cwd, endpoint, clientId, clientSecret, request, transportBudgetMs, setupDeadline, replayDeadline, flushBudgetMs, excludedEventPath) => {
-	const secured = await settleWithin(secureRetrySpoolPath(cwd, setupDeadline), remainingMs(setupDeadline));
+/**
+* 4xx is HQ refusing the content; anything else is the transport failing.
+* Non-content client statuses are transport-shaped — the content was never
+* judged — so classifying them as rejected would let a drain exit clean while
+* automation stops retrying: 401/403 (Access refusing expired or wrong
+* service-token credentials), 408 (request timeout), 429 (rate limit).
+*/
+const NON_CONTENT_CLIENT_STATUSES = new Set([
+	401,
+	403,
+	408,
+	429
+]);
+const drainFailureStatus = (reason) => {
+	const status = Number(reason.replace("http-status-", ""));
+	return reason.startsWith("http-status-") && Number.isFinite(status) && status >= 400 && status < 500 && !NON_CONTENT_CLIENT_STATUSES.has(status) ? "rejected" : "unreachable";
+};
+const replayCloseoutSpool = async (layout, endpoint, clientId, clientSecret, request, transportBudgetMs, setupDeadline, replayDeadline, flushBudgetMs, excludedEventPath, options = {}) => {
+	const maxEntries = options.maxEntries ?? MAX_HQ_REPLAY_ENTRIES;
+	const { report } = options;
+	const secured = await settleWithin(secureSpoolLayout(layout, setupDeadline), remainingMs(setupDeadline));
 	if (secured.status !== "fulfilled" || secured.value === void 0) return;
 	const { spool, spoolIdentity } = secured.value;
 	const initialListing = await settleWithin(readdir(spool), remainingMs(setupDeadline));
@@ -2053,7 +2326,7 @@ const replayCloseoutSpool = async (cwd, endpoint, clientId, clientSecret, reques
 	let attempted = 0;
 	for (const eventPath of candidates) {
 		if (!await directoryIdentityMatches(spool, spoolIdentity, setupDeadline)) return;
-		if (attempted >= MAX_HQ_REPLAY_ENTRIES || remainingMs(replayDeadline) <= 0) break;
+		if (attempted >= maxEntries || remainingMs(replayDeadline) <= 0) break;
 		const metadata = await settleWithin(lstat(eventPath), remainingMs(setupDeadline));
 		if (metadata.status !== "fulfilled" || !metadata.value.isFile() || metadata.value.isSymbolicLink() || metadata.value.size > MAX_HQ_INGEST_PAYLOAD_BYTES + 16 * 1024) continue;
 		const claimPath = `${eventPath}.draining-${randomUUID()}`;
@@ -2071,7 +2344,14 @@ const replayCloseoutSpool = async (cwd, endpoint, clientId, clientSecret, reques
 		}
 		const entryEndpoint = validatedEndpoint(entry.endpoint);
 		if (!entryEndpoint || entryEndpoint.origin !== endpoint.origin) {
-			await mutateBoundDirectory(spool, spoolIdentity, setupDeadline, async () => rename(claimPath, eventPath));
+			if (!await mutateBoundDirectory(spool, spoolIdentity, performance.now() + flushBudgetMs, async () => rename(claimPath, `${eventPath}.undeliverable`))) return;
+			report?.({
+				detail: `recorded endpoint ${entryEndpoint?.origin ?? "(unusable)"} is not this repository's authorized HQ origin ${endpoint.origin}; dispositioned as ${path.basename(eventPath)}${UNDELIVERABLE_SUFFIX}`,
+				eventId: entry.event.eventId,
+				kind: entry.event.kind,
+				spool,
+				status: "undeliverable"
+			});
 			continue;
 		}
 		let body;
@@ -2082,7 +2362,22 @@ const replayCloseoutSpool = async (cwd, endpoint, clientId, clientSecret, reques
 			continue;
 		}
 		attempted += 1;
-		const outcome = await attemptTransport(request, endpoint, clientId, clientSecret, body, Math.min(transportBudgetMs, remainingMs(replayDeadline)));
+		const outcome = await attemptTransport(request, endpoint, clientId, clientSecret, body, Math.min(transportBudgetMs, remainingMs(replayDeadline)), report !== void 0);
+		if (report) {
+			const common = {
+				eventId: entry.event.eventId,
+				kind: entry.event.kind,
+				spool
+			};
+			report(outcome.ok ? {
+				...common,
+				status: outcome.duplicate === true ? "duplicate" : "delivered"
+			} : {
+				...common,
+				detail: outcome.detail === void 0 ? outcome.reason : `${outcome.reason}: ${outcome.detail}`,
+				status: drainFailureStatus(outcome.reason)
+			});
+		}
 		if (!await mutateBoundDirectory(spool, spoolIdentity, performance.now() + flushBudgetMs, () => outcome.ok ? unlink(claimPath) : rename(claimPath, eventPath))) return;
 	}
 };
@@ -2125,11 +2420,13 @@ const releaseLegacyClaim = async (claimPath, target, directory, directoryIdentit
 	const readyPath = `${target}.legacy-ready-${randomUUID()}`;
 	return mutateBoundDirectory(directory, directoryIdentity, deadline, async () => rename(claimPath, readyPath));
 };
-async function replayRetryJournal(cwd, endpoint, clientId, clientSecret, request, dependencies, transportBudgetMs, setupDeadline, replayDeadline) {
-	const secured = await settleWithin(secureRetrySpoolPath(cwd, setupDeadline), remainingMs(setupDeadline));
+async function replayRetryJournal(layout, writeLayout, endpoint, clientId, clientSecret, request, dependencies, transportBudgetMs, setupDeadline, replayDeadline, options = {}) {
+	const maxEntries = options.maxEntries ?? MAX_HQ_REPLAY_ENTRIES;
+	const { report } = options;
+	const secured = await settleWithin(secureJournalDirectory(layout, setupDeadline), remainingMs(setupDeadline));
 	if (secured.status !== "fulfilled" || secured.value === void 0) return;
-	const { memory: directory, memoryIdentity: directoryIdentity } = secured.value;
-	const target = path.join(directory, path.basename(DEFAULT_HQ_RETRY_JOURNAL_PATH));
+	const { directory, identity: directoryIdentity } = secured.value;
+	const target = path.join(directory, HQ_RETRY_JOURNAL_BASENAME);
 	const baseName = path.basename(target);
 	const listing = await settleWithin(readdir(directory), remainingMs(setupDeadline));
 	if (listing.status !== "fulfilled") return;
@@ -2137,7 +2434,7 @@ async function replayRetryJournal(cwd, endpoint, clientId, clientSecret, request
 	let corruptDropped = 0;
 	const sources = listing.value.filter((name) => name === baseName || name.startsWith(`${baseName}.legacy-ready-`) || name.startsWith(`${baseName}.draining-`) || name.startsWith(`${baseName}.legacy-claim-`)).filter((name) => !name.includes(".cursor")).toSorted();
 	for (const name of sources) {
-		if (delivered >= MAX_HQ_REPLAY_ENTRIES || remainingMs(replayDeadline) <= 0) break;
+		if (delivered >= maxEntries || remainingMs(replayDeadline) <= 0) break;
 		const sourcePath = path.join(directory, name);
 		if (name.startsWith(`${baseName}.draining-`) || name.startsWith(`${baseName}.legacy-claim-`)) {
 			const metadata = await settleWithin(lstat(sourcePath), remainingMs(setupDeadline));
@@ -2185,7 +2482,7 @@ async function replayRetryJournal(cwd, endpoint, clientId, clientSecret, request
 		let reachedEof = true;
 		try {
 			for await (const line of lines) {
-				if (delivered >= MAX_HQ_REPLAY_ENTRIES || remainingMs(replayDeadline) <= 0 || remainingMs(setupDeadline) <= 0) {
+				if (delivered >= maxEntries || remainingMs(replayDeadline) <= 0 || remainingMs(setupDeadline) <= 0) {
 					reachedEof = false;
 					break;
 				}
@@ -2220,7 +2517,21 @@ async function replayRetryJournal(cwd, endpoint, clientId, clientSecret, request
 				}
 				const entryEndpoint = validatedEndpoint(parsed.endpoint);
 				let handled = false;
+				const row = {
+					eventId: parsed.event.eventId,
+					kind: parsed.event.kind
+				};
+				let rowOutcome = {
+					detail: `recorded endpoint ${entryEndpoint?.origin ?? "(unusable)"} is not this repository's authorized HQ origin ${endpoint.origin}`,
+					...row,
+					spool: directory,
+					status: "migrated"
+				};
 				if (entryEndpoint?.origin === endpoint.origin) {
+					rowOutcome = {
+						...rowOutcome,
+						detail: "event could not be serialized for delivery"
+					};
 					let body;
 					try {
 						body = JSON.stringify(parsed.event);
@@ -2228,16 +2539,35 @@ async function replayRetryJournal(cwd, endpoint, clientId, clientSecret, request
 						body = void 0;
 					}
 					if (body !== void 0) {
-						handled = (await attemptTransport(request, endpoint, clientId, clientSecret, body, Math.min(transportBudgetMs, remainingMs(replayDeadline)))).ok;
+						const outcome = await attemptTransport(request, endpoint, clientId, clientSecret, body, Math.min(transportBudgetMs, remainingMs(replayDeadline)), report !== void 0);
+						handled = outcome.ok;
 						if (handled) delivered += 1;
+						rowOutcome = outcome.ok ? {
+							...row,
+							spool: directory,
+							status: outcome.duplicate === true ? "duplicate" : "delivered"
+						} : {
+							...row,
+							detail: outcome.detail === void 0 ? outcome.reason : `${outcome.reason}: ${outcome.detail}`,
+							spool: directory,
+							status: drainFailureStatus(outcome.reason)
+						};
 					}
 				}
 				if (!handled) {
-					if (await appendCloseoutSpool(cwd, parsed, performance.now() + journalFlushBudgetFor(dependencies)) !== void 0) {
+					const retained = await appendCloseoutSpool(writeLayout, parsed, performance.now() + journalFlushBudgetFor(dependencies));
+					if (retained === void 0) options.onMigrate?.();
+					if (retained !== void 0) {
+						report?.({
+							...rowOutcome,
+							detail: `${rowOutcome.detail ?? rowOutcome.status}; migration into the current spool ${retained}`,
+							status: "unreachable"
+						});
 						reachedEof = false;
 						break;
 					}
 				}
+				report?.(rowOutcome);
 				offset = nextOffset;
 				if (!await writeLegacyCursor(directory, directoryIdentity, cursorPath, offset, setupDeadline)) {
 					reachedEof = false;
@@ -2309,6 +2639,11 @@ async function deliverHqIngest(input, dependencies, setupDeadline, timeoutMs, tr
 	} catch {
 		request = void 0;
 	}
+	const writeLayout = repositorySpoolLayout({
+		owner: input.profile.repository.owner,
+		repo: input.profile.repository.name
+	}, env);
+	const readLayouts = [writeLayout, legacySpoolLayout(input.cwd)];
 	const now = dependencies.now ?? (() => /* @__PURE__ */ new Date());
 	const makeEventId = dependencies.randomUUID ?? randomUUID;
 	let event;
@@ -2354,7 +2689,7 @@ async function deliverHqIngest(input, dependencies, setupDeadline, timeoutMs, tr
 			} catch {
 				failedAt = "unknown";
 			}
-			const persisted = await persistRetrySpool(input.cwd, {
+			const persisted = await persistRetrySpool(writeLayout, {
 				endpoint: endpoint.href,
 				event,
 				failedAt,
@@ -2379,14 +2714,16 @@ async function deliverHqIngest(input, dependencies, setupDeadline, timeoutMs, tr
 			throw new Error(reason);
 		}
 		const replayDeadline = performance.now() + timeoutMs;
-		await replayCloseoutSpool(input.cwd, endpoint, clientId, clientSecret, request, transportBudgetMs, replayDeadline, replayDeadline, journalFlushBudgetFor(dependencies), persistedEventPath);
-		await replayRetryJournal(input.cwd, endpoint, clientId, clientSecret, request, dependencies, transportBudgetMs, replayDeadline, replayDeadline);
+		for (const readLayout of readLayouts) {
+			await replayCloseoutSpool(readLayout, endpoint, clientId, clientSecret, request, transportBudgetMs, replayDeadline, replayDeadline, journalFlushBudgetFor(dependencies), persistedEventPath);
+			await replayRetryJournal(readLayout, writeLayout, endpoint, clientId, clientSecret, request, dependencies, transportBudgetMs, replayDeadline, replayDeadline);
+		}
 		const outcome = await attemptTransport(request, endpoint, clientId, clientSecret, body, transportBudgetMs);
 		if (!outcome.ok) {
 			({reason, unconfirmed} = outcome);
 			throw new Error(reason);
 		}
-		if (persistedEventPath !== void 0) await removeRetrySpoolEvent(input.cwd, persistedEventPath, performance.now() + journalFlushBudgetFor(dependencies));
+		if (persistedEventPath !== void 0) await removeRetrySpoolEvent(writeLayout, persistedEventPath, performance.now() + journalFlushBudgetFor(dependencies));
 		return "delivered";
 	} catch {}
 	const flushDeadline = performance.now() + journalFlushBudgetFor(dependencies);
@@ -2411,16 +2748,17 @@ async function deliverHqIngest(input, dependencies, setupDeadline, timeoutMs, tr
 			reason,
 			...unconfirmed ? { unconfirmed: true } : {}
 		};
-		if (customJournal && persistedEventPath === void 0) journalFailure = await retainRetryEntry(input.cwd, retryEntry, dependencies, flushDeadline);
+		if (customJournal && persistedEventPath === void 0) journalFailure = await retainRetryEntry(writeLayout, retryEntry, dependencies, flushDeadline);
 		else if (!customJournal) {
-			const updated = await persistRetrySpool(input.cwd, retryEntry, flushDeadline);
+			const updated = await persistRetrySpool(writeLayout, retryEntry, flushDeadline);
 			if (updated.status === "persisted") {
-				if (persistedEventPath !== void 0) await removeRetrySpoolEvent(input.cwd, persistedEventPath, flushDeadline);
+				if (persistedEventPath !== void 0) await removeRetrySpoolEvent(writeLayout, persistedEventPath, flushDeadline);
 				persistedEventPath = updated.eventPath;
 				journalFailure = void 0;
 			} else journalFailure = updated.failure;
 		}
 	}
+	if (!unconfirmed && journalFailure === void 0 && persistedEventPath !== void 0) return "deferred";
 	const journalSuffix = journalFailure ? `; retry spool ${journalFailure}` : "";
 	await reportDiagnostic(dependencies, flushDeadline, unconfirmed ? `sent, awaiting confirmation (${reason})${journalSuffix}` : `${reason}${journalSuffix}`, unconfirmed ? "HQ ingest unconfirmed" : "HQ ingest deferred");
 	return "deferred";
@@ -2454,6 +2792,376 @@ const trackPendingHqIngest = (delivery) => {
 async function awaitPendingHqIngest() {
 	await Promise.allSettled(pendingHqIngest);
 }
+/** Wall-clock ceiling for one explicit drain. Flush is not a gate; it may wait. */
+const DEFAULT_HQ_FLUSH_BUDGET_MS = 600 * 1e3;
+/** ENOENT is the only filesystem answer that means "this location is absent". */
+const isMissingEntryError = (error) => typeof error === "object" && error !== null && error.code === "ENOENT";
+const journalRowCount = (contents) => contents.split("\n").filter((line) => line.trim() !== "").length;
+const journalLineTimestamps = (contents) => {
+	const timestamps = [];
+	for (const line of contents.split("\n")) {
+		const trimmed = line.trim();
+		if (trimmed === "") continue;
+		try {
+			const parsed = JSON.parse(trimmed);
+			if (typeof parsed.failedAt === "string") timestamps.push(parsed.failedAt);
+		} catch {}
+	}
+	return timestamps;
+};
+const countRemainingSpoolWork = async (spools, drainLayouts, deadline) => {
+	let remaining = 0;
+	let unlistableScans = 0;
+	let oldestMs;
+	const noteTimestamp = (iso) => {
+		const ms = Date.parse(iso);
+		if (Number.isFinite(ms) && (oldestMs === void 0 || ms < oldestMs)) oldestMs = ms;
+	};
+	const countUnlistable = async (directory) => {
+		if (remainingMs(deadline) <= 0) {
+			unlistableScans += 1;
+			return;
+		}
+		const probed = await settleWithin(lstat(directory), remainingMs(deadline));
+		if (probed.status !== "rejected" || !isMissingEntryError(probed.error)) unlistableScans += 1;
+	};
+	for (const spool of spools) {
+		const listing = await settleWithin(readdir(spool), remainingMs(deadline));
+		if (listing.status !== "fulfilled") {
+			await countUnlistable(spool);
+			continue;
+		}
+		const pendingNames = listing.value.filter((name) => name.endsWith(".json") || name.includes(".json.draining-") || name.startsWith(".") && name.endsWith(".json.tmp"));
+		remaining += pendingNames.length;
+		for (const name of pendingNames) {
+			const probed = await settleWithin(lstat(path.join(spool, name)), remainingMs(deadline));
+			if (probed.status === "fulfilled") noteTimestamp(probed.value.mtime.toISOString());
+		}
+	}
+	for (const layout of drainLayouts) {
+		const journalDir = path.dirname(layoutPath(layout));
+		const journalListing = await settleWithin(readdir(journalDir), remainingMs(deadline));
+		if (journalListing.status !== "fulfilled") {
+			await countUnlistable(journalDir);
+			continue;
+		}
+		const journalNames = journalListing.value.filter((name) => name === "hq-retry-journal.jsonl" || name.startsWith(`hq-retry-journal.jsonl.legacy-ready-`) || name.startsWith(`hq-retry-journal.jsonl.legacy-claim-`) || name.startsWith(`hq-retry-journal.jsonl.draining-`));
+		for (const name of journalNames) {
+			const journalFilePath = path.join(journalDir, name);
+			const read = await settleWithin(readFile(journalFilePath, "utf-8"), remainingMs(deadline));
+			if (read.status === "fulfilled") {
+				remaining += journalRowCount(read.value);
+				for (const timestamp of journalLineTimestamps(read.value)) noteTimestamp(timestamp);
+				continue;
+			}
+			remaining += 1;
+			const probed = await settleWithin(lstat(journalFilePath), remainingMs(deadline));
+			if (probed.status === "fulfilled") noteTimestamp(probed.value.mtime.toISOString());
+		}
+	}
+	return {
+		...oldestMs === void 0 ? {} : { oldestQueuedAt: new Date(oldestMs).toISOString() },
+		remaining,
+		unlistableScans
+	};
+};
+/** Wall-clock ceiling for the read-only inspection below. */
+const DEFAULT_HQ_SPOOL_INSPECT_BUDGET_MS = 5e3;
+/**
+* Counts spooled work for a repository without draining it or touching a
+* credential (#414).
+*
+* `hq:flush` used to resolve the HQ Access token before it ever looked at the
+* spool, so a lane with nothing to send still paid a secret-manager round trip
+* — and still failed, opaquely, in a sandbox that has no keychain access. The
+* same locations `flushHqSpool` drains are inspected here, read-only: no
+* directory is created, nothing is secured, and nothing is delivered.
+*/
+async function countHqSpoolWork(input, dependencies = {}) {
+	const env = dependencies.env ?? process.env;
+	const layouts = input.explicitDirectories && input.explicitDirectories.length > 0 ? input.explicitDirectories.map(explicitSpoolLayout) : [repositorySpoolLayout(input.repository, env), legacySpoolLayout(input.cwd)];
+	const deadline = performance.now() + (dependencies.budgetMs ?? DEFAULT_HQ_SPOOL_INSPECT_BUDGET_MS);
+	const paths = layouts.map((layout) => layoutPath(layout));
+	const { oldestQueuedAt, remaining, unlistableScans } = await countRemainingSpoolWork(paths, layouts, deadline);
+	const existing = await Promise.all(paths.map(async (spool) => {
+		return (await settleWithin(lstat(spool), remainingMs(deadline))).status === "fulfilled" ? spool : void 0;
+	}));
+	return {
+		...oldestQueuedAt === void 0 ? {} : { oldestQueuedAt },
+		pending: remaining,
+		spools: existing.filter((spool) => spool !== void 0),
+		unlistable: unlistableScans
+	};
+}
+/** Wall-clock ceiling for the orphan sweep below. */
+const DEFAULT_HQ_SPOOL_SWEEP_BUDGET_MS = 5e3;
+/**
+* The pre-#390 lossy substitution, kept only so a key written under it can
+* still be *found*. Nothing writes this scheme any more; it is ambiguous,
+* which is why `hqSpoolSegment` replaced it. It only ever appeared in the
+* single joined segment (`fb1d14a`) — never as two segments, which is why no
+* two-segment lossy candidate is derived below.
+*/
+const lossyHqSpoolSegment = (component) => component.replaceAll(/[^A-Za-z0-9._-]/gu, "_");
+const hqSpoolCandidateKeys = (repository) => {
+	const joined = `${repository.owner}-${repository.repo}`;
+	const candidates = [
+		repositorySegments(repository),
+		[hqSpoolSegment(joined)],
+		[lossyHqSpoolSegment(joined)]
+	];
+	const seen = /* @__PURE__ */ new Set();
+	return candidates.filter((segments) => {
+		const key = segments.join("/");
+		if (seen.has(key)) return false;
+		seen.add(key);
+		return true;
+	});
+};
+/**
+* Does this spool directory's marker name the given repository (#447)?
+*
+* Every answer other than an unambiguous yes is no. An absent, unreadable,
+* malformed, or foreign marker all mean the same thing here — nothing on disk
+* says this directory is ours — and the sweep may only act on directories that
+* say so. Failing closed in the other direction would be #446 again:
+* prescribing `hq:flush --dir` against evidence belonging to someone else.
+*/
+const markerClaims = async (spool, repository, deadline) => {
+	const file = await readBoundedTextFileNoFollow(path.join(spool, SPOOL_REPOSITORY_MARKER), deadline, 4096);
+	if (file === void 0) return false;
+	let parsed;
+	try {
+		parsed = JSON.parse(file.contents);
+	} catch {
+		return false;
+	}
+	if (typeof parsed !== "object" || parsed === null) return false;
+	const marker = parsed;
+	return marker.owner === repository.owner && marker.repo === repository.repo;
+};
+/**
+* Walks the shared root for spool directories this repository has stamped
+* (#447).
+*
+* Symlinks are not followed and depth is capped: this is a read-only inventory
+* of one state tree, not a traversal of wherever an operator pointed something.
+*
+* A directory that cannot be listed is skipped rather than reported, which is
+* the opposite of how `countRemainingSpoolWork` treats an unreadable spool —
+* deliberately. There, "unknown" concerns a location already known to be ours,
+* so failing closed means reporting it. Here, "unknown" concerns *ownership*,
+* and failing closed means claiming a directory that may be another
+* repository's. The candidate-key probes above still fail closed for every
+* location this checkout can name on its own, so nothing that was reported
+* before stops being reported.
+*/
+const findMarkedSpools = async (repository, directory, deadline, depth = 1, found = []) => {
+	if (depth > HQ_SPOOL_SWEEP_MAX_DEPTH || remainingMs(deadline) <= 0) return found;
+	const listing = await settleWithin(readdir(directory, { withFileTypes: true }), remainingMs(deadline));
+	if (listing.status !== "fulfilled") return found;
+	for (const entry of listing.value) {
+		if (!entry.isDirectory() || entry.isSymbolicLink()) continue;
+		const child = path.join(directory, entry.name);
+		if (entry.name === "hq-retry-spool") {
+			if (await markerClaims(child, repository, deadline)) found.push(child);
+			continue;
+		}
+		await findMarkedSpools(repository, child, deadline, depth + 1, found);
+	}
+	return found;
+};
+/**
+* Reports spooled evidence sitting under an earlier key for *this* repository
+* (#420).
+*
+* The spool is keyed by owner and repo, so a change to the segment encoding
+* itself — which happened during #390's own development — moves the address
+* without moving the evidence. Both readers of the spool resolve exactly one
+* key, so the events under the old one become invisible: the drain reports
+* success, doctor reports empty, and three real proofs sat unread until an
+* attended recovery enumerated the tree by hand.
+*
+* This sweep only reports. Draining another key's events is a decision this
+* does not make — the operator gets the location and the count, and
+* `hq:flush --dir` remains the recovery path.
+*
+* **Why candidate keys and not a walk of the root (#446).** The root is shared
+* by every factory repository on the machine, so enumerating it and calling
+* everything that is not the current key an orphan describes another
+* repository's ordinary, current, correct spool exactly as well as it describes
+* this repository's obsolete one. That made doctor red in one checkout because
+* a different repository had pending work, and told the operator to drain it —
+* confidently prescribing the wrong action. Nothing on disk distinguishes the
+* two cases: an unrecognised key carries no statement about who wrote it.
+*
+* So discovery is scoped to the keys *this* repository could plausibly have
+* produced — the current scheme plus the earlier ones listed in
+* `hqSpoolCandidateKeys` — and a key outside that set is never this
+* repository's business. The #420 incident is inside it: the joined
+* single-segment key is one of the candidates.
+*
+* **And a marked walk beside them (#447).** Derivation's other blind spot is a
+* key whose *encoding* this checkout no longer produces but whose owner and
+* repo are unchanged — the retired non-injective era being the live example.
+* That era cannot be derived safely, because a candidate built from it can
+* equal a different repository's current key, so #446 dropped it rather than
+* risk the cross-repository claim again.
+*
+* `SPOOL_REPOSITORY_MARKER` supplies the proof that derivation could not. Every
+* enqueue stamps its spool with the repository writing it, so the root can be
+* walked again: a directory whose marker names *this* repository is this
+* repository's, whatever key encoding it sits under, and a directory whose
+* marker names another repository is never reported here. That is the
+* discriminator #446 correctly said did not exist — it exists now because
+* something writes it down.
+*
+* The two discoveries are complements, not alternatives. The walk sees only
+* what was stamped; directories written before this shipped have no marker, and
+* candidate keys still find those. An unmarked directory is still never
+* reported, because it still carries no statement about who wrote it.
+*
+* **What this does NOT close, despite being the marker's obvious use: renames
+* and owner changes.** A marker records the identity that was current when the
+* directory was written, so after `patronage/old` becomes `patronage/new` the
+* stranded directory is stamped `patronage/old` — and matching is equality
+* against the checkout's *present* identity, which rejects it. Making that work
+* needs an identifier that survives a rename, which neither the profile nor the
+* marker carries today; accepting a non-matching marker instead would be
+* guessing, which is the #446 defect wearing a new hat. #447 stays open for it.
+*
+* Also outside the sweep, by construction: evidence under a *different state
+* root*, if `XDG_STATE_HOME` moves. No walk of this root can reach another one.
+*/
+async function sweepHqSpoolOrphans(input, dependencies = {}) {
+	const env = dependencies.env ?? process.env;
+	const root = hqSpoolRoot(env);
+	const deadline = performance.now() + (dependencies.budgetMs ?? DEFAULT_HQ_SPOOL_SWEEP_BUDGET_MS);
+	const own = hqSpoolDirectory(input.repository, env);
+	const orphans = [];
+	for (const segments of hqSpoolCandidateKeys(input.repository)) {
+		const spool = path.join(root, ...segments, HQ_RETRY_SPOOL_DIRNAME);
+		if (spool === own) continue;
+		if (remainingMs(deadline) <= 0) {
+			orphans.push({
+				directory: spool,
+				pending: 0,
+				unlistable: 1
+			});
+			continue;
+		}
+		const counted = await countRemainingSpoolWork([spool], [explicitSpoolLayout(spool)], deadline);
+		if (counted.remaining === 0 && counted.unlistableScans === 0) continue;
+		orphans.push({
+			directory: spool,
+			...counted.oldestQueuedAt === void 0 ? {} : { oldestQueuedAt: counted.oldestQueuedAt },
+			pending: counted.remaining,
+			unlistable: counted.unlistableScans
+		});
+	}
+	const claimed = await findMarkedSpools(input.repository, root, deadline);
+	for (const spool of claimed) {
+		if (spool === own || orphans.some((found) => found.directory === spool)) continue;
+		if (remainingMs(deadline) <= 0) {
+			orphans.push({
+				directory: spool,
+				pending: 0,
+				unlistable: 1
+			});
+			continue;
+		}
+		const counted = await countRemainingSpoolWork([spool], [explicitSpoolLayout(spool)], deadline);
+		if (counted.remaining === 0 && counted.unlistableScans === 0) continue;
+		orphans.push({
+			directory: spool,
+			...counted.oldestQueuedAt === void 0 ? {} : { oldestQueuedAt: counted.oldestQueuedAt },
+			pending: counted.remaining,
+			unlistable: counted.unlistableScans
+		});
+	}
+	return {
+		orphans,
+		root
+	};
+}
+/**
+* Drains every spooled event for a repository and reports each one (#390).
+*
+* This is the deliberate counterpart to the sink's advisory emit path: the
+* caller has already resolved credentials explicitly, so there is no cap, no
+* daemon, and no background retry — one pass, bounded, over the repo-keyed
+* location plus the legacy cwd location (or the operator's `--dir`). Delivery
+* itself is the sink's own replay, so there is exactly one POST path.
+*/
+async function flushHqSpool(input, dependencies = {}) {
+	const endpoint = validatedIngestEndpoint(input.endpoint);
+	if (endpoint === void 0) throw new Error("HQ endpoint must be an HTTPS origin without embedded credentials.");
+	const env = dependencies.env ?? process.env;
+	const request = dependencies.fetch ?? fetch;
+	const transportBudgetMs = dependencies.transportTimeoutMs ?? DEFAULT_HQ_TRANSPORT_TIMEOUT_MS;
+	const flushBudgetMs = dependencies.journalFlushBudgetMs ?? HQ_JOURNAL_FLUSH_BUDGET_MS;
+	const deadline = performance.now() + (dependencies.budgetMs ?? DEFAULT_HQ_FLUSH_BUDGET_MS);
+	const writeLayout = repositorySpoolLayout(input.repository, env);
+	const layouts = input.explicitDirectories && input.explicitDirectories.length > 0 ? input.explicitDirectories.map(explicitSpoolLayout) : [writeLayout, legacySpoolLayout(input.cwd)];
+	const outcomeById = /* @__PURE__ */ new Map();
+	let rejectedFiles = 0;
+	let unreachableFiles = 0;
+	let unsecurableSpools = 0;
+	const record = (outcome) => {
+		outcomeById.set(outcome.eventId, outcome);
+		dependencies.report?.(outcome);
+	};
+	const journalReport = (outcome) => {
+		if (outcome.status === "unreachable" && outcome.detail?.includes("migration into the current spool")) unreachableFiles += 1;
+		record(outcome);
+	};
+	const spoolReport = (outcome) => {
+		if (outcome.status === "rejected") rejectedFiles += 1;
+		if (outcome.status === "unreachable") unreachableFiles += 1;
+		record(outcome);
+	};
+	const spools = [];
+	let migratedIntoWriteLayout = false;
+	const journalDrainOptions = {
+		maxEntries: Number.POSITIVE_INFINITY,
+		onMigrate: () => {
+			migratedIntoWriteLayout = true;
+		},
+		report: journalReport
+	};
+	for (const layout of layouts) await replayRetryJournal(layout, writeLayout, endpoint, input.clientId, input.clientSecret, request, {
+		env,
+		fetch: request,
+		journalFlushBudgetMs: flushBudgetMs
+	}, transportBudgetMs, deadline, deadline, journalDrainOptions);
+	const drainLayouts = migratedIntoWriteLayout && !layouts.some((layout) => layoutPath(layout) === layoutPath(writeLayout)) ? [...layouts, writeLayout] : layouts;
+	for (const layout of drainLayouts) {
+		await replayCloseoutSpool(layout, endpoint, input.clientId, input.clientSecret, request, transportBudgetMs, deadline, deadline, flushBudgetMs, void 0, {
+			maxEntries: Number.POSITIVE_INFINITY,
+			report: spoolReport
+		});
+		const secured = await secureSpoolLayout(layout, deadline);
+		if (secured === void 0) {
+			if ((await settleWithin(lstat(layoutPath(layout)), remainingMs(deadline))).status === "fulfilled") unsecurableSpools += 1;
+		} else spools.push(secured.spool);
+	}
+	const { remaining, unlistableScans } = await countRemainingSpoolWork(spools, drainLayouts, deadline);
+	const outcomes = [...outcomeById.values()];
+	const count = (status) => outcomes.filter((outcome) => outcome.status === status).length;
+	const rejected = count("rejected");
+	return {
+		delivered: count("delivered"),
+		duplicate: count("duplicate"),
+		incomplete: remainingMs(deadline) <= 0 || unsecurableSpools > 0 || unlistableScans > 0 || remaining > rejectedFiles + unreachableFiles,
+		outcomes,
+		rejected,
+		remaining,
+		spools,
+		undeliverable: count("undeliverable"),
+		unreachable: count("unreachable"),
+		unreachableFiles
+	};
+}
 /**
 * Schedules one bounded HQ delivery after the current command stack. Producers
 * provide the already-written proof through payloadPath (or bounded payloadJson);
@@ -2647,22 +3355,32 @@ const ISOLATED_CLOSEOUT_FS_WORKER_SOURCE = String.raw`
       if (Buffer.byteLength(workerData.body, "utf8") > 278528) {
         reply({ status: "failed" });
       } else {
-        const root = fs.realpathSync(workerData.cwd);
-        const memory = path.join(root, ".factory-memory");
-        const spool = path.join(memory, "hq-retry-spool");
+        try { fs.mkdirSync(workerData.root, { recursive: true }); } catch {}
+        const root = fs.realpathSync(workerData.root);
         const rootIdentity = inspectDirectory(root);
-        const memoryIdentity =
-          rootIdentity === undefined ? undefined : secureDirectory(memory);
-        const spoolIdentity =
-          memoryIdentity === undefined ? undefined : secureDirectory(spool);
-        if (
-          rootIdentity === undefined ||
-          memoryIdentity === undefined ||
-          spoolIdentity === undefined ||
-          !sameDirectory(root, rootIdentity) ||
-          !sameDirectory(memory, memoryIdentity) ||
-          !sameDirectory(spool, spoolIdentity)
-        ) {
+        const directories = [];
+        const identities = [];
+        let current = root;
+        let secured = rootIdentity !== undefined;
+        for (const segment of workerData.segments) {
+          current = path.join(current, segment);
+          const identity = secured ? secureDirectory(current) : undefined;
+          if (identity === undefined) {
+            secured = false;
+            break;
+          }
+          directories.push(current);
+          identities.push(identity);
+        }
+        const spool = directories[directories.length - 1];
+        const verifyChain = () =>
+          rootIdentity !== undefined &&
+          sameDirectory(root, rootIdentity) &&
+          directories.every((directory, index) =>
+            sameDirectory(directory, identities[index])
+          );
+        const spoolIdentity = identities[identities.length - 1];
+        if (!secured || spool === undefined || !verifyChain()) {
           reply({ status: "failed" });
         } else {
           const safeEventId = /^[A-Za-z0-9_-]{1,160}$/.test(workerData.eventId)
@@ -2686,18 +3404,12 @@ const ISOLATED_CLOSEOUT_FS_WORKER_SOURCE = String.raw`
             fs.fsyncSync(descriptor);
             fs.closeSync(descriptor);
             descriptor = undefined;
-            if (
-              !sameDirectory(root, rootIdentity) ||
-              !sameDirectory(memory, memoryIdentity) ||
-              !sameDirectory(spool, spoolIdentity)
-            ) {
+            if (!verifyChain()) {
               reply({ status: "failed" });
             } else {
               fs.linkSync(temporary, finalPath);
               if (
-                !sameDirectory(root, rootIdentity) ||
-                !sameDirectory(memory, memoryIdentity) ||
-                !sameDirectory(spool, spoolIdentity) ||
+                !verifyChain() ||
                 !syncDirectory(spool, spoolIdentity)
               ) {
                 reply({ status: "failed" });
@@ -2835,10 +3547,15 @@ const deferProjectHqIngestIsolated = async (input) => {
 	} catch {
 		return "held";
 	}
+	const layout = repositorySpoolLayout({
+		owner: parsedProfile.repository.owner,
+		repo: parsedProfile.repository.name
+	}, process.env);
 	const persisted = await runCloseoutFsWorker({
 		body,
-		cwd: input.cwd,
 		eventId,
+		root: layout.root,
+		segments: layout.segments,
 		type: "persist"
 	}, HQ_JOURNAL_FLUSH_BUDGET_MS);
 	return persisted !== null && typeof persisted === "object" && persisted.status === "persisted" ? "deferred" : "held";
@@ -2895,6 +3612,191 @@ function assertCleanWorktreeForProof({ changedFiles, cwd, dirtyMessage, statusPo
 	if (offendingLines.length > 0) throw new Error(`${dirtyMessage}\n${offendingLines.join("\n")}`);
 }
 //#endregion
+//#region src/demand-keys.ts
+/** The demands that exist at most once per candidate. */
+const DEMAND_KEYS = {
+	/** The PR is still a draft. */
+	draft: "draft",
+	/** The candidate is not the intended final human review point. */
+	finalReviewPoint: "final-review-point",
+	/** GitHub's own check rollup for the candidate head. */
+	githubChecks: "github-checks",
+	/** Local HEAD and the GitHub PR head must be the same commit. */
+	headIdentity: "head-identity",
+	/** An unhandled post-readiness human comment or review submission. */
+	humanBlocker: "human-blocker",
+	/** The repository-wide merge freeze. */
+	mergeFreeze: "merge-freeze",
+	/** GitHub's mergeability / merge-state rollup. */
+	mergeState: "merge-state",
+	/** The PR body's required rendered sections. */
+	prBodySections: "pr-body-sections",
+	/** A current, head-bound, passing typed `pr:verify` proof. */
+	prVerify: "pr-verify",
+	/** The profile-resolved review ladder policy. */
+	reviewLadder: "review-ladder",
+	/** Unresolved GitHub review threads. */
+	reviewThreads: "review-threads",
+	/** An explicit trivial waiver that the diff does not support. */
+	trivialWaiver: "trivial-waiver"
+};
+/** The families whose instances are named by a resolved value. */
+const QUALIFIED_DEMAND_FAMILIES = [
+	"required-check",
+	"review-mode",
+	"review-rung"
+];
+const QUALIFIER_PATTERN = /^[A-Za-z0-9._%/-]{1,64}$/u;
+const percentEncode = (character) => {
+	const code = character.codePointAt(0) ?? 0;
+	if (code >= 55296 && code <= 57343) return `%u${code.toString(16).toUpperCase().padStart(4, "0")}`;
+	return [...new TextEncoder().encode(character)].map((byte) => `%${byte.toString(16).toUpperCase().padStart(2, "0")}`).join("");
+};
+/**
+* Express a resolved value as a qualifier. Percent-encoding, not scrubbing:
+* the mapping is injective, so two differently named required checks can never
+* collapse into one key — which would let one operator waiver silently cover a
+* demand nobody waived, and make HQ count two causes as one.
+*
+* Deterministic in both directions of use: the key a `pr:ready` proof records
+* is the key a `pr:merge-check` waiver matches.
+*/
+const demandQualifier = (value) => value.replaceAll(/[^A-Za-z0-9._/-]/gu, percentEncode);
+/** The demand one profile-declared external required check makes. */
+const requiredCheckDemand = (name) => `required-check:${demandQualifier(name)}`;
+/** The demand one applicable review mode makes (correctness, security). */
+const reviewModeDemand = (mode) => `review-mode:${demandQualifier(mode)}`;
+/** The demand the review rung in force makes (profile default or wave rung). */
+const reviewRungDemand = (rung) => `review-rung:${demandQualifier(rung)}`;
+const FIXED_DEMAND_KEYS = Object.values(DEMAND_KEYS);
+/** The review modes a profile can resolve, and therefore demand. */
+const REVIEW_MODE_DEMAND_VALUES = ["correctness", "security"];
+const escapePattern = /%(?:u[0-9A-F]{4}|[0-9A-F]{2})/gu;
+/**
+* Reverse `demandQualifier`. A qualifier is canonical exactly when encoding
+* its decoded form reproduces it — which rejects both malformed escapes and
+* noncanonical aliases like `%41` for `A`. Returns undefined when the
+* qualifier cannot have been minted here.
+*/
+const decodeQualifier = (qualifier) => {
+	const bytes = [];
+	let decoded = "";
+	let index = 0;
+	const flush = () => {
+		if (bytes.length === 0) return true;
+		try {
+			decoded += new TextDecoder("utf-8", {
+				fatal: true,
+				ignoreBOM: true
+			}).decode(Uint8Array.from(bytes));
+		} catch {
+			return false;
+		}
+		bytes.length = 0;
+		return true;
+	};
+	while (index < qualifier.length) {
+		const character = qualifier[index];
+		if (character !== "%") {
+			if (!flush()) return;
+			decoded += character;
+			index += 1;
+			continue;
+		}
+		escapePattern.lastIndex = index;
+		const escape = escapePattern.exec(qualifier);
+		if (!escape || escape.index !== index) return;
+		if (escape[0][1] === "u") {
+			if (!flush()) return;
+			decoded += String.fromCodePoint(Number.parseInt(escape[0].slice(2), 16));
+		} else bytes.push(Number.parseInt(escape[0].slice(1), 16));
+		index += escape[0].length;
+	}
+	return flush() ? decoded : void 0;
+};
+const qualifierIsMintable = (family, qualifier) => {
+	if (!QUALIFIER_PATTERN.test(qualifier)) return false;
+	const decoded = decodeQualifier(qualifier);
+	if (decoded === void 0 || demandQualifier(decoded) !== qualifier) return false;
+	if (family === "review-rung") return EVIDENCE_REVIEW_RUNGS$1.includes(decoded);
+	if (family === "review-mode") return REVIEW_MODE_DEMAND_VALUES.includes(decoded);
+	return true;
+};
+/**
+* A demand key from the closed vocabulary: a known unqualified family, or a
+* known qualified family with a qualifier this module could actually have
+* minted. Closed on purpose — an invented family, an unresolvable rung, or a
+* noncanonical encoding would be indistinguishable from a typo to anyone
+* counting causes, which is the whole point of recording codes.
+*/
+const demandKeySchema = z.string().refine((value) => {
+	if (FIXED_DEMAND_KEYS.includes(value)) return true;
+	const separator = value.indexOf(":");
+	if (separator === -1) return false;
+	const family = value.slice(0, separator);
+	return QUALIFIED_DEMAND_FAMILIES.includes(family) && qualifierIsMintable(family, value.slice(separator + 1));
+}, { message: `a demand key is one of ${FIXED_DEMAND_KEYS.join(", ")} or a resolvable ${QUALIFIED_DEMAND_FAMILIES.join(" / ")} key` });
+/**
+* The key shape an operator may *name* in a waiver: syntactic, not closed.
+*
+* Deliberately distinct from `demandKeySchema` above, which is what a proof's
+* reason codes must come from. A waiver store is durable operator evidence
+* written before today's vocabulary existed, so tightening its validation
+* would make an existing record parse as no waiver and let the next write drop
+* it. A waiver naming a key nobody resolves is already inert — `pr:merge-check`
+* reports it as an unapplied waiver — so nothing is admitted by accepting it.
+*/
+const waiverDemandKeySchema = z.string().regex(/^[a-z][a-z0-9-]*(?::[A-Za-z0-9._%/-]+)?$/u, "A demand key is a lowercase family, optionally qualified by its resolved value (e.g. review-rung:human).");
+/** One refusal sentence: single line, trimmed, bounded. */
+const blockedReasonDetailSchema = z.string().min(1).max(280).refine((value) => value.trim().length > 0, { message: "must not be blank" }).refine((value) => !/[\r\n]/u.test(value), { message: "must be one line, not a multi-line payload" });
+const blockedReasonSchema = z.object({
+	code: demandKeySchema,
+	detail: blockedReasonDetailSchema
+});
+const blockedReasonsSchema = z.array(blockedReasonSchema).max(100);
+/** Fit one refusal sentence to the wire bound without losing its head. */
+const blockedReasonDetail = (reason) => {
+	const line = reason.replaceAll(/\s+/gu, " ").trim();
+	return line.length <= 280 ? line : `${line.slice(0, 279)}…`;
+};
+const blockedReasonIssue = (message) => [{
+	code: "custom",
+	message,
+	path: ["blockedReasons"]
+}];
+/**
+* The invariant every reader enforces, shared by the emitting schema and the
+* wire schema so it is one rule rather than two that can drift. It is the
+* producer's state machine, written down:
+*
+* - `ready` refused nothing, so it carries neither projection, and it is the
+*   final review point;
+* - `slice-ready/not-final` was held back by exactly one demand — being a
+*   slice — and names it;
+* - `blocked` refused something other than being a slice, and says so;
+* - whichever it is, `blockedReasons` names every refusal listed in
+*   `blockingReasons`, in the same order, as the bounded form of that sentence.
+*
+* Naming the slice demand and the ledger's `finalReviewPoint` are the same
+* fact, so a proof that says one and not the other is refused.
+*/
+const blockedReasonIssues = (proof) => {
+	const named = proof.blockedReasons ?? [];
+	const reasons = proof.blockingReasons ?? [];
+	const slice = DEMAND_KEYS.finalReviewPoint;
+	const namesSlice = named.some((reason) => reason.code === slice);
+	if (proof.status === "ready") {
+		if (named.length > 0 || reasons.length > 0) return blockedReasonIssue("a ready pr:ready proof must carry no blocking reasons");
+	} else if (proof.status === "slice-ready/not-final") {
+		if (named.length !== 1 || !namesSlice) return blockedReasonIssue(`a slice-ready/not-final pr:ready proof is held back by exactly one demand, ${slice}`);
+	} else if (reasons.length === 0) return blockedReasonIssue("a blocked pr:ready proof must record what blocked it");
+	else if (named.length > 0 && !named.some((r) => r.code !== slice)) return blockedReasonIssue(`a blocked pr:ready proof must name a demand other than ${slice}`);
+	if (proof.finalReviewPoint !== void 0 && namesSlice === proof.finalReviewPoint) return blockedReasonIssue(`naming ${slice} and the ledger's finalReviewPoint are the same fact; this proof says both`);
+	if (named.length !== reasons.length) return blockedReasonIssue(`blockedReasons must name every blocking reason: ${reasons.length} reason(s), ${named.length} named`);
+	const drifted = named.findIndex((reason, index) => reason.detail !== blockedReasonDetail(reasons[index]));
+	return drifted === -1 ? [] : blockedReasonIssue(`blockedReasons[${drifted}] does not carry blocking reason ${drifted}; the two projections must tell one story`);
+};
+//#endregion
 //#region src/factory-session.ts
 const FACTORY_SESSION_ID_ENV = "FACTORY_SESSION_ID";
 const UNKNOWN_AUTHORING_SESSION = "unknown";
@@ -2917,20 +3819,12 @@ const resolveAuthoringSessionIds = ({ override, recorded }) => {
 const DEMAND_WAIVER_SCHEMA_VERSION$1 = 1;
 const DEFAULT_DEMAND_WAIVER_PATH = ".factory-memory/demand-waivers.json";
 const shaSchema$6 = z.string().regex(/^[0-9a-f]{40}$/u);
-/**
-* A resolved demand's key: a family, optionally qualified by the resolved
-* value that makes it this demand *instance* (`review-rung:human`,
-* `required-check:core`, `merge-freeze`). The consumer that resolved the
-* demand owns the key; this module only matches on it, which is why no
-* control name is enumerated here.
-*/
-const demandKeySchema = z.string().regex(/^[a-z][a-z0-9-]*(?::[A-Za-z0-9._/-]+)?$/u, "A demand key is a lowercase family, optionally qualified by its resolved value (e.g. review-rung:human).");
 const demandWaiverSchema = z.object({
 	candidate: z.object({
 		headSha: shaSchema$6,
 		pr: z.number().int().positive()
 	}),
-	demand: demandKeySchema,
+	demand: waiverDemandKeySchema,
 	operator: z.string().trim().min(1),
 	rationale: z.string().trim().min(1),
 	recordedAt: z.iso.datetime(),
@@ -2943,7 +3837,7 @@ const demandWaiverStoreSchema = z.object({
 });
 const validateDemandWaiverStore = (value) => demandWaiverStoreSchema.parse(value);
 const waivedDemandSchema = z.object({
-	demand: demandKeySchema,
+	demand: waiverDemandKeySchema,
 	operator: z.string().trim().min(1),
 	rationale: z.string().trim().min(1),
 	recordedAt: z.iso.datetime(),
@@ -4013,7 +4907,15 @@ const managedReadinessLedgerSchema$1 = z.object({
 		verifiedHeadSha: z.string().optional()
 	})
 });
+/**
+* The pr:ready proof versions a reader still accepts. `pr:ready` emits v2 only
+* (#391) — one current contract — but v1 events were spooled before the bump
+* and HQ must ingest them without degrading, so the wire schema parses both.
+*/
+const SUPPORTED_PR_READY_SCHEMA_VERSIONS = [1, 2];
+const prReadySchemaVersionSchema = z.number().refine((value) => SUPPORTED_PR_READY_SCHEMA_VERSIONS.includes(value), { message: `schemaVersion must be one of: ${SUPPORTED_PR_READY_SCHEMA_VERSIONS.join(", ")}` });
 z.object({
+	blockedReasons: blockedReasonsSchema.optional(),
 	blockingReasons: z.array(z.string()),
 	command: z.literal("patronage-factory pr:ready"),
 	followUp: followUpActionSchema.optional(),
@@ -4023,12 +4925,25 @@ z.object({
 	profilePath: z.string().min(1).optional(),
 	repairs: z.array(readinessRepairSchema$1).default([]),
 	repository: z.string().regex(/^[^/\s]+\/[^/\s]+$/u).optional(),
-	schemaVersion: z.literal(1),
+	schemaVersion: prReadySchemaVersionSchema,
 	status: z.enum([
 		"ready",
 		"blocked",
 		"slice-ready/not-final"
 	])
+}).superRefine((proof, context) => {
+	if (proof.schemaVersion < 2) {
+		if (proof.blockedReasons !== void 0) context.addIssue({
+			code: "custom",
+			message: "blockedReasons is a schemaVersion 2 field; a v1 pr:ready proof must not carry it.",
+			path: ["blockedReasons"]
+		});
+		return;
+	}
+	for (const issue of blockedReasonIssues({
+		...proof,
+		finalReviewPoint: proof.ledger.finalReviewPoint
+	})) context.addIssue(issue);
 });
 //#endregion
 //#region src/boundary-check.ts
@@ -9030,11 +9945,8 @@ function renderCloseoutMarkdown(artifact) {
 		...ledgerLines
 	].join("\n");
 }
-//#endregion
-//#region src/epic-closeout/write-artifact.ts
-const DEFAULT_OUT_DIR = ".factory-memory/closeouts";
 function closeoutArtifactPaths(opts) {
-	const dir = path.resolve(opts.repoRoot, opts.outDir ?? DEFAULT_OUT_DIR);
+	const dir = path.resolve(opts.repoRoot, opts.outDir ?? ".factory-memory/closeouts");
 	const filename = sanitizeEpicFilename(opts.epic);
 	return {
 		dir,
@@ -9058,43 +9970,487 @@ function writeCloseoutArtifact(opts) {
 	};
 }
 //#endregion
-//#region src/commands/closeout.ts
-const formatUtcDate = (date) => date.toISOString().slice(0, 10);
-const nonEmptyRepoRoot = (value) => {
-	if (value.trim() === "") throw new InvalidArgumentError("--repo-root requires a non-empty path");
-	return value;
-};
-const codexThreadIdsForCloseout = (env = process.env) => {
-	const threadId = normalizeSessionId(env.CODEX_THREAD_ID);
-	return threadId === void 0 ? [] : [threadId];
-};
-const resolveRetroSubject = (issue, pr) => {
-	if (issue !== void 0) return { issueNumber: issue };
-	if (pr !== void 0) return { prNumber: pr };
-};
-const tokenFamilySummary = (tokenFamilies) => {
-	const available = [];
-	const unavailable = [];
-	for (const family of ["claude", "gpt"]) if (tokenFamilies[family] === void 0) unavailable.push(family);
-	else available.push(family);
-	return {
-		available,
-		unavailable
-	};
-};
-const reportLocalCloseoutOutcome = (output, input) => {
-	const harvest = tokenFamilySummary(input.retro.envelope.tokenFamilies);
-	output.stdout.write(`local artifacts: ${input.paths.markdownPath}, ${input.paths.jsonPath}, and ${input.retro.envelopePath}\n`);
-	output.stdout.write(`boundary thermo input: runs=${input.boundaryThermo.runs}, owner=${input.boundaryThermo.owner}, waived=${input.boundaryThermo.waived}${input.boundaryThermo.waiverRationale === void 0 ? "" : `, waiver rationale=${input.boundaryThermo.waiverRationale}`}\n`);
-	if (harvest.unavailable.length > 0) output.stderr.write(`harvest data unavailable: ${harvest.available.length === 0 ? "no token families were recorded" : `missing ${harvest.unavailable.join(" and ")} token family data`}; recorded gaps: ${input.retro.envelope.dataGaps.join(" | ")}\n`);
-	else if (input.retro.envelope.dataGaps.length > 0) output.stderr.write(`retro-envelope data gaps recorded: ${input.retro.envelope.dataGaps.join(" | ")}\n`);
-};
+//#region src/epic-structure.ts
+/**
+* Producer-side `epic-structure` v1 emitter (epic #132, lane #135).
+*
+* `psf epic:publish-structure` reads a planner's ephemeral `dag.yml` (never
+* committed — see epic #132 / ADR 0018), validates the graph fail-closed, and
+* POSTs an `epic-structure` v1 event to HQ's `/api/ingest` boundary. This
+* module is the pure core: parse-to-IR validation, the wire mapping, and the
+* deterministic content-addressed eventId. All I/O (stdin/file read, fetch)
+* lives in the command wrapper.
+*
+* WIRE PARITY (do not fork the schema): the emitted payload is the exact shape
+* HQ's `EpicGraphSchema` accepts (`software-factory-hq/src/contracts/
+* epic-schemas.ts`) and is built by hand the same way `seed-dev.ts` builds it
+* — no re-declared zod twin. HQ's `epic-structure-parity.test.ts` imports
+* {@link buildEpicStructureEvent} and runs its output through the real
+* `EpicGraphSchema`, so any drift (field, enum, bound, strictness) fails CI.
+*
+* The `dag.yml` schema itself is documented with the epic skill (lane #137);
+* this module is the executable contract, not a second source of truth.
+*/
+const EPIC_STRUCTURE_SCHEMA_VERSION = 1;
+/**
+* DAG-node PLANNING statuses — the planning-plane vocabulary a planner authors
+* on a `dag.yml` node. Carried forward by ADR 0018 §4 and defined by the epic
+* skill (`reference/epic-artifacts.md`) and both `CONTEXT.md` glossaries.
+*
+* A DAG node is a unit of *plan*; an HQ lane is a unit of *runtime execution*.
+* These are two planes with two vocabularies and must not be conflated — the
+* producer validates and emits ONLY planning statuses:
+*
+*   - `open`              authored, not yet done
+*   - `closed`            done (a PR merged, or otherwise resolved)
+*   - `satisfied-on-main` already true on main without a dedicated PR
+*   - `parked`            real node, scope still moving — relabeled off
+*                         `ready-for-agent`, never closed
+*
+* HQ's `DagNodeSchema` (`software-factory-hq/src/contracts/epic-schemas.ts`)
+* accepts this planning vocabulary on ingest AND overlays a runtime LANE status
+* onto a node once a lane is linked (`syncNodesWithLanes` /
+* `projectEpicMembership`) — the overlay is HQ-internal; the producer never
+* emits a lane status. HQ's `epic-structure-parity.test.ts` fails CI if the
+* producer emits any status HQ won't accept.
+*/
+const EPIC_STRUCTURE_NODE_STATUSES = [
+	"open",
+	"closed",
+	"satisfied-on-main",
+	"parked"
+];
+/**
+* Fail-closed validation error carrying every offending node/edge diagnostic.
+*/
+var EpicStructureValidationError = class extends Error {
+	diagnostics;
+	constructor(diagnostics) {
+		super(`epic:publish-structure refused: dag graph is invalid\n${diagnostics.map((line) => `  - ${line}`).join("\n")}`);
+		this.name = "EpicStructureValidationError";
+		this.diagnostics = diagnostics;
+	}
+};
+const isPlainObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const nonEmptyString = (value) => typeof value === "string" && value.trim().length > 0;
+const isPositiveInteger = (value) => typeof value === "number" && Number.isInteger(value) && value > 0;
+const slugify = (value) => value.trim().toLowerCase().replaceAll(/[^a-z0-9]+/gu, "-").replaceAll(/^-+|-+$/gu, "") || "epic";
+const laneIdFor = (repo, issue) => `lane-${repo}-issue-${issue}`;
+const validateNodes = (rawNodes, diagnostics) => {
+	const nodes = [];
+	const slugs = /* @__PURE__ */ new Set();
+	for (const [index, raw] of rawNodes.entries()) {
+		if (!isPlainObject(raw)) {
+			diagnostics.push(`node[${index}]: expected a mapping`);
+			continue;
+		}
+		const label = nonEmptyString(raw.slug) ? `"${raw.slug}"` : `node[${index}]`;
+		if (!nonEmptyString(raw.slug)) diagnostics.push(`node[${index}]: missing required \`slug\``);
+		else if (slugs.has(raw.slug)) diagnostics.push(`node ${label}: duplicate slug`);
+		else slugs.add(raw.slug);
+		if (!nonEmptyString(raw.title)) diagnostics.push(`node ${label}: missing required \`title\``);
+		const external = raw.external === true;
+		if (!external && !isPositiveInteger(raw.issue)) diagnostics.push(`node ${label}: \`issue\` number is required — non-external nodes must carry a minted issue (this runs post-ratification); set \`external: true\` to exempt an adoption/upstream node`);
+		let status = "open";
+		if (raw.status === void 0) status = "open";
+		else if (EPIC_STRUCTURE_NODE_STATUSES.includes(raw.status)) status = raw.status;
+		else diagnostics.push(`node ${label}: \`status\` must be one of ${EPIC_STRUCTURE_NODE_STATUSES.join(", ")} (DAG-node planning statuses, not HQ lane statuses)`);
+		if (raw.laneId !== void 0 && !nonEmptyString(raw.laneId)) diagnostics.push(`node ${label}: \`laneId\` must be a non-empty string`);
+		nodes.push({
+			external,
+			...isPositiveInteger(raw.issue) ? { issue: raw.issue } : {},
+			...nonEmptyString(raw.laneId) ? { laneId: raw.laneId } : {},
+			slug: nonEmptyString(raw.slug) ? raw.slug : `node[${index}]`,
+			status,
+			title: nonEmptyString(raw.title) ? raw.title : ""
+		});
+	}
+	return {
+		nodes,
+		slugs
+	};
+};
+const validateEdges = (rawEdges, slugs, diagnostics) => {
+	const edges = [];
+	for (const [index, raw] of rawEdges.entries()) {
+		if (!isPlainObject(raw)) {
+			diagnostics.push(`edge[${index}]: expected a mapping`);
+			continue;
+		}
+		if (raw.type !== "depends-on") continue;
+		if (!nonEmptyString(raw.from) || !nonEmptyString(raw.to)) {
+			diagnostics.push(`edge[${index}]: depends-on edge requires string \`from\` and \`to\``);
+			continue;
+		}
+		if (!slugs.has(raw.from)) diagnostics.push(`edge ${raw.from} -> ${raw.to}: \`from\` references unknown slug "${raw.from}"`);
+		if (!slugs.has(raw.to)) diagnostics.push(`edge ${raw.from} -> ${raw.to}: \`to\` references unknown slug "${raw.to}"`);
+		if (raw.from === raw.to) diagnostics.push(`edge ${raw.from} -> ${raw.to}: self-dependency (cycle)`);
+		edges.push({
+			from: raw.from,
+			to: raw.to
+		});
+	}
+	return edges;
+};
+/**
+* Detects a dependency cycle over the depends-on edges and returns the offending
+* cycle path (`a -> b -> a`) if one exists, else undefined. Only edges whose
+* endpoints both resolve to known slugs are walked, so unknown-slug diagnostics
+* are reported independently and never masquerade as cycles.
+*/
+const findCycle = (slugs, edges) => {
+	const adjacency = /* @__PURE__ */ new Map();
+	for (const { from, to } of edges) if (slugs.has(from) && slugs.has(to)) {
+		const list = adjacency.get(from) ?? [];
+		list.push(to);
+		adjacency.set(from, list);
+	}
+	const UNVISITED = 0;
+	const IN_STACK = 1;
+	const DONE = 2;
+	const state = /* @__PURE__ */ new Map();
+	const stack = [];
+	const walk = (node) => {
+		state.set(node, IN_STACK);
+		stack.push(node);
+		for (const next of adjacency.get(node) ?? []) {
+			const marker = state.get(next) ?? UNVISITED;
+			if (marker === IN_STACK) {
+				const start = stack.indexOf(next);
+				return [...stack.slice(start), next];
+			}
+			if (marker === UNVISITED) {
+				const found = walk(next);
+				if (found) return found;
+			}
+		}
+		stack.pop();
+		state.set(node, DONE);
+	};
+	for (const slug of slugs) if ((state.get(slug) ?? UNVISITED) === UNVISITED) {
+		const found = walk(slug);
+		if (found) return found;
+	}
+};
+const resolveEpicId = (epic) => {
+	if (typeof epic === "number") return String(epic);
+	if (nonEmptyString(epic)) return epic.trim();
+};
+/**
+* Validates a dag document fail-closed. Throws {@link
+* EpicStructureValidationError} with a diagnostic per offending node/edge.
+*/
+const validateDagDocument = (input) => {
+	const doc = input.document;
+	const diagnostics = [];
+	if (!isPlainObject(doc)) throw new EpicStructureValidationError(["dag document must be a YAML/JSON mapping with `epic` and `nodes`"]);
+	const epicId = resolveEpicId(doc.epic);
+	if (epicId === void 0) diagnostics.push("dag document requires a top-level `epic` id");
+	const repo = input.repo ?? (nonEmptyString(doc.repo) ? doc.repo.trim() : void 0);
+	if (repo === void 0) diagnostics.push("repo is required — pass `--repo <name>` or set `repo:` in the dag document (needed for the epic record and lane-id derivation)");
+	const rawNodes = Array.isArray(doc.nodes) ? doc.nodes : void 0;
+	if (rawNodes === void 0 || rawNodes.length === 0) diagnostics.push("dag document requires a non-empty `nodes` array");
+	const { nodes, slugs } = validateNodes(rawNodes ?? [], diagnostics);
+	const edges = validateEdges(Array.isArray(doc.edges) ? doc.edges : [], slugs, diagnostics);
+	const cycle = findCycle(slugs, edges);
+	if (cycle) diagnostics.push(`dependency cycle detected: ${cycle.join(" -> ")}`);
+	if (diagnostics.length > 0 || epicId === void 0 || repo === void 0) throw new EpicStructureValidationError(diagnostics);
+	return {
+		boundary: slugify(input.boundary ?? (nonEmptyString(doc.boundary) ? doc.boundary : `epic-${epicId}`)),
+		edges,
+		epicId,
+		name: input.name ?? (nonEmptyString(doc.name) ? doc.name.trim() : `Epic ${epicId}`),
+		nodes,
+		repo
+	};
+};
+/**
+* Builds the wire payload with deterministic ordering (nodes by slug, edges by
+* from then to) so re-emission of the same graph is byte-stable regardless of
+* the planner's source ordering — the basis for the content-addressed eventId.
+*/
+const buildEpicStructurePayload = (dag) => {
+	const nodes = dag.nodes.map((node) => {
+		const laneId = node.laneId ?? (node.issue === void 0 ? void 0 : laneIdFor(dag.repo, node.issue));
+		return {
+			epicId: dag.epicId,
+			...laneId === void 0 ? {} : { laneId },
+			slug: node.slug,
+			status: node.status,
+			title: node.title
+		};
+	}).toSorted((a, b) => a.slug.localeCompare(b.slug));
+	return {
+		edges: dag.edges.map((edge) => ({
+			epicId: dag.epicId,
+			from: edge.from,
+			to: edge.to,
+			type: "depends-on"
+		})).toSorted((a, b) => a.from.localeCompare(b.from) || a.to.localeCompare(b.to)),
+		epics: [{
+			id: dag.epicId,
+			name: dag.name,
+			repo: dag.repo
+		}],
+		nodes
+	};
+};
+/** Stable, key-sorted JSON for content hashing (values already ordered). */
+const stableStringify = (value) => {
+	if (Array.isArray(value)) return `[${value.map(stableStringify).join(",")}]`;
+	if (isPlainObject(value)) return `{${Object.keys(value).toSorted().map((key) => `${JSON.stringify(key)}:${stableStringify(value[key])}`).join(",")}}`;
+	return JSON.stringify(value ?? null);
+};
+/**
+* Deterministic eventId = `epic-structure-<boundary>-<sha256(payload)[0:16]>`.
+* Re-emitting identical graph content yields the same eventId (HQ dedups →
+* 200/duplicate); an amendment changes the content hash → a new eventId that
+* supersedes the prior structure wholesale (HQ keeps the latest). This mirrors
+* seed-dev's fixed-eventId idempotency, content-addressed instead of literal.
+*/
+const epicStructureEventId = (boundary, payload) => `epic-structure-${slugify(boundary)}-${createHash("sha256").update(stableStringify(payload)).digest("hex").slice(0, 16)}`;
+/**
+* Validates and builds the full `epic-structure` v1 ingest event, ready to POST
+* to `/api/ingest`. Throws {@link EpicStructureValidationError} fail-closed.
+*/
+const buildEpicStructureEvent = (input) => {
+	const dag = validateDagDocument(input);
+	const payload = buildEpicStructurePayload(dag);
+	return {
+		eventId: epicStructureEventId(dag.boundary, payload),
+		kind: "epic-structure",
+		observedAt: input.observedAt ?? (/* @__PURE__ */ new Date()).toISOString(),
+		payload,
+		schemaVersion: 1
+	};
+};
+/** The prod HQ worker is reachable at `hq.patronage.com` and its frozen
+* `-v1.*.workers.dev` alias. Emitting there without an Access service token is
+* fail-closed. */
+const isProductionHqUrl = (url) => url.includes("hq.patronage.com") || /-v1\.[^/]*\.workers\.dev/iu.test(url);
+/**
+* POSTs the event to HQ ingest. Fail-closed: a production URL without a
+* Cloudflare Access service token is refused before any request; a 401/403 is
+* surfaced with actionable guidance; any non-2xx throws.
+*/
+const publishEpicStructure = async (args) => {
+	if (!args.accessServiceToken && isProductionHqUrl(args.url)) throw new Error(`epic:publish-structure refusing to publish to production ${args.url} without a Cloudflare Access service token: set CF-Access-Client-Id and CF-Access-Client-Secret`);
+	const doFetch = args.fetchImpl ?? globalThis.fetch;
+	const requestInit = args.accessServiceToken ? buildCloudflareAccessRequestInit(args.accessServiceToken, {
+		body: JSON.stringify(args.event),
+		headers: { "content-type": "application/json" },
+		method: "POST",
+		...args.signal ? { signal: args.signal } : {}
+	}) : {
+		body: JSON.stringify(args.event),
+		headers: { "content-type": "application/json" },
+		method: "POST",
+		...args.signal ? { signal: args.signal } : {}
+	};
+	let response;
+	try {
+		const normalizedUrl = args.url.replace(/\/+$/u, "");
+		response = await doFetch(normalizedUrl.endsWith("/api/ingest") ? normalizedUrl : `${normalizedUrl}/api/ingest`, requestInit);
+	} catch {
+		throw new Error(`epic:publish-structure could not reach HQ ingest at ${args.url}: request failed. Check the endpoint and network; redirects are refused to protect Cloudflare Access credentials.`);
+	}
+	const text = await response.text();
+	if (response.status === 401 || response.status === 403) throw new Error(`epic:publish-structure rejected by Cloudflare Access or HQ ingest (${response.status}): set valid CF-Access-Client-Id and CF-Access-Client-Secret service-token inputs. Response: ${text}`);
+	if (response.status < 200 || response.status >= 300) throw new Error(`epic:publish-structure failed: HQ ingest returned ${response.status} ${text}`);
+	let duplicate = false;
+	try {
+		duplicate = JSON.parse(text).duplicate === true;
+	} catch {
+		duplicate = response.status === 200;
+	}
+	return {
+		duplicate,
+		eventId: args.event.eventId,
+		status: response.status
+	};
+};
+//#endregion
+//#region src/commands/epic-publish-structure.ts
+const STDIN = "-";
+/** Reads a dag.yml source path, or stdin when `source` is `-`. */
+const readSource = (source) => {
+	const fd = source === STDIN ? 0 : source;
+	try {
+		return readFileSync(fd, "utf-8");
+	} catch (error) {
+		const cause = error instanceof Error ? error.message : String(error);
+		throw new Error(`epic:publish-structure could not read ${source === STDIN ? "stdin" : source} (${cause})`, { cause: error });
+	}
+};
+/** Parses a dag.yml/JSON document read from `readSource`. */
+const parseDocument = (raw, source) => {
+	if (raw.trim() === "") throw new Error(`epic:publish-structure received empty input from ${source === STDIN ? "stdin" : source}`);
+	try {
+		return parse(raw);
+	} catch (error) {
+		const cause = error instanceof Error ? error.message : String(error);
+		throw new Error(`epic:publish-structure could not parse YAML: ${cause}`, { cause: error });
+	}
+};
+/**
+* Reads and validates a dag.yml/JSON source into a full `epic-structure` v1
+* event, ready to POST or dry-run print. Shared with `factory:closeout`'s
+* terminal-snapshot re-emission (issue #392) so both commands build the exact
+* same wire event from the exact same source format — one current contract,
+* not a forked parser.
+*/
+const buildEvent = (source, options = {}) => {
+	return buildEpicStructureEvent({
+		document: parseDocument(readSource(source), source),
+		...options.boundary ? { boundary: options.boundary } : {},
+		...options.name ? { name: options.name } : {},
+		...options.repo ? { repo: options.repo } : {}
+	});
+};
+function createEpicPublishStructureCommand(output, deps = {}) {
+	const env = deps.env ?? process.env;
+	return new Command("epic:publish-structure").description("Emit-only: read a planner's ephemeral dag.yml (or - for stdin), validate the graph fail-closed (YAML parses, required fields, edges reference known slugs, acyclic, issue numbers on every non-external node), and POST an epic-structure v1 event to HQ ingest. Idempotent by a content-addressed eventId (re-emission of an amendment supersedes the prior structure). Production auth uses the CF-Access-Client-Id and CF-Access-Client-Secret environment inputs. URL: --url or HQ_INGEST_URL. The dag.yml schema is documented with the epic skill (#137).").argument("[source]", "path to dag.yml, or - for stdin", STDIN).option("--url <url>", "HQ ingest base URL (default: HQ_INGEST_URL env). The command POSTs to <url>/api/ingest").option("--boundary <slug>", "boundary slug for the eventId namespace (default: dag `boundary:`, else `epic-<id>`)").option("--repo <name>", "repository name for the epic record and lane-id derivation (default: dag `repo:`)").option("--name <title>", "epic display name (default: dag `name:`)").option("--dry-run", "validate and build the event, print it, and exit without POSTing").option("--json", "print the built event / publish result as JSON").action(async (source, options) => {
+		const event = buildEvent(source, options);
+		if (options.dryRun) {
+			output.stdout.write(options.json ? `${JSON.stringify(event, null, 2)}\n` : `epic:publish-structure OK (dry-run) — eventId ${event.eventId}, ${event.payload.nodes.length} node(s), ${event.payload.edges.length} edge(s)\n`);
+			return;
+		}
+		const url = options.url ?? env.HQ_INGEST_URL;
+		if (!url) throw new Error("epic:publish-structure requires an HQ ingest URL: pass --url or set HQ_INGEST_URL");
+		const clientId = env[CF_ACCESS_CLIENT_ID_ENV];
+		const clientSecret = env[CF_ACCESS_CLIENT_SECRET_ENV];
+		const result = await publishEpicStructure({
+			...clientId && clientSecret ? { accessServiceToken: {
+				clientId,
+				clientSecret
+			} } : {},
+			event,
+			fetchImpl: deps.fetchImpl,
+			url
+		});
+		output.stdout.write(options.json ? `${JSON.stringify(result, null, 2)}\n` : `epic:publish-structure ${result.duplicate ? "no-op (duplicate)" : "accepted"} — eventId ${result.eventId} [HTTP ${result.status}]\n`);
+	});
+}
+//#endregion
+//#region src/commands/closeout.ts
+const formatUtcDate = (date) => date.toISOString().slice(0, 10);
+const nonEmptyRepoRoot = (value) => {
+	if (value.trim() === "") throw new InvalidArgumentError("--repo-root requires a non-empty path");
+	return value;
+};
+const codexThreadIdsForCloseout = (env = process.env) => {
+	const threadId = normalizeSessionId(env.CODEX_THREAD_ID);
+	return threadId === void 0 ? [] : [threadId];
+};
+const resolveRetroSubject = (issue, pr) => {
+	if (issue !== void 0) return { issueNumber: issue };
+	if (pr !== void 0) return { prNumber: pr };
+};
+const tokenFamilySummary = (tokenFamilies) => {
+	const available = [];
+	const unavailable = [];
+	for (const family of ["claude", "gpt"]) if (tokenFamilies[family] === void 0) unavailable.push(family);
+	else available.push(family);
+	return {
+		available,
+		unavailable
+	};
+};
+const reportLocalCloseoutOutcome = (output, input) => {
+	const harvest = tokenFamilySummary(input.retro.envelope.tokenFamilies);
+	output.stdout.write(`local artifacts: ${input.paths.markdownPath}, ${input.paths.jsonPath}, and ${input.retro.envelopePath}\n`);
+	output.stdout.write(`boundary thermo input: runs=${input.boundaryThermo.runs}, owner=${input.boundaryThermo.owner}, waived=${input.boundaryThermo.waived}${input.boundaryThermo.waiverRationale === void 0 ? "" : `, waiver rationale=${input.boundaryThermo.waiverRationale}`}\n`);
+	if (harvest.unavailable.length > 0) output.stderr.write(`harvest data unavailable: ${harvest.available.length === 0 ? "no token families were recorded" : `missing ${harvest.unavailable.join(" and ")} token family data`}; recorded gaps: ${input.retro.envelope.dataGaps.join(" | ")}\n`);
+	else if (input.retro.envelope.dataGaps.length > 0) output.stderr.write(`retro-envelope data gaps recorded: ${input.retro.envelope.dataGaps.join(" | ")}\n`);
+};
 const reportRetroHqDeliveryOutcome = (output, outcome) => {
 	output.stderr.write(`advisory HQ handoff ${outcome} for the retro envelope; local closeout success does not depend on HQ.\n`);
 };
 const reportArtifactHqHandoffOutcome = (output, outcome) => {
 	output.stderr.write(`advisory HQ handoff ${outcome} for the closeout artifact; local closeout success does not depend on HQ.\n`);
 };
+const reportStructureReemissionOutcome = (output, outcome, detail) => {
+	output.stderr.write(`advisory HQ epic-structure re-emission ${outcome}${detail ? ` (${detail})` : ""}; local closeout success does not depend on HQ.\n`);
+};
+const DEFAULT_STRUCTURE_REEMISSION_TIMEOUT_MS = 5e3;
+const withTimeout = async (operation, timeoutMs, message) => {
+	const raceAbort = new AbortController();
+	const fetchAbort = new AbortController();
+	const settleTimeout = async () => {
+		try {
+			await setTimeout$1(Math.max(0, timeoutMs), void 0, { signal: raceAbort.signal });
+		} catch {}
+		return { status: "timed-out" };
+	};
+	const settleOperation = async () => ({
+		status: "fulfilled",
+		value: await operation(fetchAbort.signal)
+	});
+	try {
+		const result = await Promise.race([settleOperation(), settleTimeout()]);
+		if (result.status === "timed-out") {
+			fetchAbort.abort();
+			throw new Error(message);
+		}
+		return result.value;
+	} finally {
+		raceAbort.abort();
+	}
+};
+const bareRepoName = (ownerRepo) => {
+	const separatorIndex = ownerRepo.lastIndexOf("/");
+	return separatorIndex === -1 ? ownerRepo : ownerRepo.slice(separatorIndex + 1);
+};
+const structureIdentityMismatch = (event, expected) => {
+	const expectedRepo = bareRepoName(expected.repo);
+	const { epics } = event.payload;
+	if (epics.length === 0) return;
+	if (epics.every((epic) => epic.id !== expected.epic)) return `dag epic id(s) [${epics.map((epic) => epic.id).join(", ")}] do not include --epic ${expected.epic}`;
+	if (epics.every((epic) => epic.repo !== expectedRepo)) return `dag repo(s) [${epics.map((epic) => epic.repo).join(", ")}] do not include --repo ${expected.repo} (bare "${expectedRepo}")`;
+};
+const reemitEpicStructureAtCloseout = async (input) => {
+	if (input.dagSource === void 0) return;
+	const build = input.buildEvent ?? buildEvent;
+	const publish = input.publish ?? publishEpicStructure;
+	const url = input.url ?? input.env.HQ_INGEST_URL;
+	if (!url) {
+		reportStructureReemissionOutcome(input.output, "skipped", "no HQ ingest URL: pass --structure-url or set HQ_INGEST_URL");
+		return;
+	}
+	let event;
+	try {
+		event = build(input.dagSource);
+	} catch (error) {
+		reportStructureReemissionOutcome(input.output, "failed", error instanceof Error ? error.message : String(error));
+		return;
+	}
+	const mismatch = structureIdentityMismatch(event, {
+		epic: input.expectedEpic,
+		repo: input.expectedRepo
+	});
+	if (mismatch !== void 0) {
+		reportStructureReemissionOutcome(input.output, "failed", mismatch);
+		return;
+	}
+	const clientId = input.env[CF_ACCESS_CLIENT_ID_ENV];
+	const clientSecret = input.env[CF_ACCESS_CLIENT_SECRET_ENV];
+	const timeoutMs = input.timeoutMs ?? DEFAULT_STRUCTURE_REEMISSION_TIMEOUT_MS;
+	try {
+		const result = await withTimeout((signal) => publish({
+			...clientId && clientSecret ? { accessServiceToken: {
+				clientId,
+				clientSecret
+			} } : {},
+			event,
+			fetchImpl: input.fetchImpl,
+			signal,
+			url
+		}), timeoutMs, `epic-structure re-emission exceeded its ${timeoutMs}ms advisory deadline`);
+		reportStructureReemissionOutcome(input.output, result.duplicate ? "duplicate" : "accepted", `eventId ${result.eventId}`);
+	} catch (error) {
+		reportStructureReemissionOutcome(input.output, "failed", error instanceof Error ? error.message : String(error));
+	}
+};
 const handoffCloseoutToHq = async (input) => {
 	const epicIssue = Number(input.artifact.epic);
 	let artifactOutcome = "deferred";
@@ -9139,7 +10495,7 @@ const defaultTraceWindow = () => {
 function createCloseoutCommand(output, dependencies = {}) {
 	const buildRetroGate = dependencies.buildRetroEnvelope ?? buildAndPersistRetroEnvelope;
 	const persistArtifact = dependencies.writeArtifact ?? writeCloseoutArtifact;
-	return new Command("factory:closeout").description("Emit an epic-close metrics + lessons closeout (markdown + HQ-ledger JSON)").requiredOption("--epic <id>", "epic identifier").option("--repo <owner/repo>", "repository", DEFAULT_FACTORY_REPOSITORY).option("--repo-root <path>", "consumer repo root for trace shards and output", nonEmptyRepoRoot, ".").option("--out-dir <path>", "output directory under repo root", ".factory-memory/closeouts").option("--from <YYYY-MM-DD>", "trace diagnostics scan window start — surfaces malformed trace shards only, no metrics (default: today minus 30 days UTC)").option("--to <YYYY-MM-DD>", "trace diagnostics scan window end (default: today UTC)").option("--lane <name>", "interior telemetry lane label", "epic-closeout").option("--chats-dir <path>", "Cursor chats directory for interior telemetry").option("--usage-csv <path>", "Cursor usage CSV for interior telemetry").option("--codex-log <path>", "Codex exec JSON log for interior telemetry").option("--epic-chat-id <id>", "allowlist a Cursor chatId for epic interior scoping (repeatable)", (value, previous) => [...previous, value], []).option("--epic-chat-cwd <path>", "allowlist a worktree cwd for epic interior scoping (repeatable)", (value, previous) => [...previous, value], []).option("--issue <n>", "optional issue-number filter for the trace diagnostics scan", Number.parseInt).option("--pr <n>", "optional pull-request-number filter for the trace diagnostics scan", Number.parseInt).option("--json", "print the artifact JSON to stdout").option("--dry-run", "run aggregation without writing files; print intended output paths").option("--boundary-thermo-runs <n>", "deep boundary-thermo run count for this wave/epic (default: 0 → tripwire)", (value) => sanitizeBoundaryThermoRuns(value)).option("--boundary-thermo-owner <name>", "named owner of the boundary-thermo gate (default: epic-closeout orchestrator)").option("--boundary-thermo-waived", "record an explicit waiver for zero boundary-thermo runs").option("--boundary-thermo-waiver <text>", "waiver rationale when --boundary-thermo-waived is set").action(withGateTiming({
+	return new Command("factory:closeout").description("Emit an epic-close metrics + lessons closeout (markdown + HQ-ledger JSON)").requiredOption("--epic <id>", "epic identifier").option("--repo <owner/repo>", "repository", DEFAULT_FACTORY_REPOSITORY).option("--repo-root <path>", "consumer repo root for trace shards and output", nonEmptyRepoRoot, ".").option("--out-dir <path>", "output directory under repo root", ".factory-memory/closeouts").option("--from <YYYY-MM-DD>", "trace diagnostics scan window start — surfaces malformed trace shards only, no metrics (default: today minus 30 days UTC)").option("--to <YYYY-MM-DD>", "trace diagnostics scan window end (default: today UTC)").option("--lane <name>", "interior telemetry lane label", "epic-closeout").option("--chats-dir <path>", "Cursor chats directory for interior telemetry").option("--usage-csv <path>", "Cursor usage CSV for interior telemetry").option("--codex-log <path>", "Codex exec JSON log for interior telemetry").option("--epic-chat-id <id>", "allowlist a Cursor chatId for epic interior scoping (repeatable)", (value, previous) => [...previous, value], []).option("--epic-chat-cwd <path>", "allowlist a worktree cwd for epic interior scoping (repeatable)", (value, previous) => [...previous, value], []).option("--issue <n>", "optional issue-number filter for the trace diagnostics scan", Number.parseInt).option("--pr <n>", "optional pull-request-number filter for the trace diagnostics scan", Number.parseInt).option("--json", "print the artifact JSON to stdout").option("--dry-run", "run aggregation without writing files; print intended output paths").option("--boundary-thermo-runs <n>", "deep boundary-thermo run count for this wave/epic (default: 0 → tripwire)", (value) => sanitizeBoundaryThermoRuns(value)).option("--boundary-thermo-owner <name>", "named owner of the boundary-thermo gate (default: epic-closeout orchestrator)").option("--boundary-thermo-waived", "record an explicit waiver for zero boundary-thermo runs").option("--boundary-thermo-waiver <text>", "waiver rationale when --boundary-thermo-waived is set").option("--structure-dag <path>", "path to a terminal dag.yml/JSON document (or - for stdin) to re-emit as the closeout epic-structure snapshot, via the same builder epic:publish-structure uses. Advisory and idempotent by content-addressed eventId. Omit to skip re-emission entirely — closeout never fabricates a structure snapshot that was never authored.").option("--structure-url <url>", "HQ ingest base URL for the closeout structure re-emission (default: HQ_INGEST_URL env)").action(withGateTiming({
 		gate: "factory:closeout",
 		resolveLedgerRoot: (options) => resolveCwdOption(options.repoRoot),
 		shouldRecord: (options) => options.dryRun !== true,
@@ -9219,6 +10575,18 @@ function createCloseoutCommand(output, dependencies = {}) {
 			retro,
 			written
 		});
+		await reemitEpicStructureAtCloseout({
+			buildEvent: dependencies.buildEpicStructureEvent,
+			dagSource: options.structureDag,
+			env: dependencies.env ?? process.env,
+			expectedEpic: options.epic,
+			expectedRepo: options.repo,
+			fetchImpl: dependencies.structureFetch,
+			output,
+			publish: dependencies.publishEpicStructure,
+			timeoutMs: dependencies.structureTimeoutMs,
+			url: options.structureUrl
+		});
 		output.stdout.write(`wrote ${written.markdownPath} and ${written.jsonPath}\n`);
 	}));
 }
@@ -10660,7 +12028,7 @@ const runDemandWaive = (args, dependencies = {}) => {
 	const cwd = path.resolve(args.cwd ?? process.cwd());
 	const env = dependencies.env ?? process.env;
 	const repository = (dependencies.checkoutRepository ?? checkoutRepository)(cwd);
-	const parsedDemand = demandKeySchema.safeParse(args.demand.trim());
+	const parsedDemand = waiverDemandKeySchema.safeParse(args.demand.trim());
 	const rationale = args.rationale.trim();
 	const refusals = requestRefusals({
 		demand: args.demand,
@@ -10854,6 +12222,145 @@ const demandedRungSatisfactionReasons = ({ demandedRung, liveHumanReviews, revie
 	return reviewRuns?.flatMap((review) => review.outcome === "passed" && review.rung !== void 0 ? [review.rung] : []).find((candidate) => rungMeetsMinimum(candidate, demandedRung)) ? [] : [`Boundary wave requires the ${demandedRung} rung, but the recorded review evidence has no passing review at that authority.`];
 };
 //#endregion
+//#region src/hq-credentials.ts
+/**
+* Resolving the HQ Access credentials, and saying *why* when that fails.
+*
+* A deliberate command (`psf hq:flush`, and doctor's remote checks in #394) is
+* the one place allowed to ask the secret manager for the HQ Access token. It
+* used to keep a value-or-nothing answer, so a missing binary, a sandbox that
+* cannot reach the keychain, and a mistyped reference all collapsed into one
+* generic "credentials are unavailable" line. A sandboxed lane read that as
+* environmental noise while every one of its proofs stayed spooled.
+*
+* Two boundaries hold everywhere in this module:
+*
+* - **Classification comes from the failure mode, never from resolver output.**
+*   No stderr is captured and no resolver text is retained or rendered: a
+*   secret manager's diagnostics can quote the material it was asked for.
+*   Exit status, spawn error code, and signal are the whole evidence base.
+* - **Trusted-local only.** Hosted runners never invoke a secret manager
+*   (#312); references stay inert there and the failure says so.
+*/
+/** Ceiling for one secret-manager probe; expiry means unresolved, never a hang. */
+const SECRET_PROBE_TIMEOUT_MS = 1e4;
+/** The operator's resolution path: `op-fast` first, official `op` as fallback. */
+const SECRET_RESOLVER_BINARIES = ["op-fast", "op"];
+const spawnFailure = (error) => {
+	const code = error?.code;
+	if (code === "ENOENT") return "resolver-missing";
+	if (code === "EACCES" || code === "EPERM") return "resolver-blocked";
+	return "resolver-timeout";
+};
+const probe = (binary, reference, capture) => {
+	const result = spawnSync(binary, ["read", reference], {
+		encoding: "utf-8",
+		stdio: [
+			"ignore",
+			capture ? "pipe" : "ignore",
+			"ignore"
+		],
+		timeout: SECRET_PROBE_TIMEOUT_MS
+	});
+	if (result.error) return { status: spawnFailure(result.error) };
+	if (result.signal) return { status: "resolver-timeout" };
+	if (result.status !== 0) return { status: "resolver-refused" };
+	if (!capture) return {
+		status: "resolved",
+		value: ""
+	};
+	const value = result.stdout.trim();
+	return value === "" ? { status: "resolver-refused" } : {
+		status: "resolved",
+		value
+	};
+};
+/**
+* `op-fast` first, official `op` as the fallback, matching `doctor
+* --preflight`'s resolvability probe. The reported failure is the first
+* *informative* one: a machine without `op-fast` that has `op` installed and
+* denied must report the denial, not the missing binary.
+*/
+const resolveThrough = (reference, capture) => {
+	let failure = "resolver-missing";
+	for (const binary of SECRET_RESOLVER_BINARIES) {
+		const outcome = probe(binary, reference, capture);
+		if (outcome.status === "resolved") return outcome;
+		if (failure === "resolver-missing") failure = outcome.status;
+	}
+	return { status: failure };
+};
+const defaultSecretReferenceResolver = (reference) => resolveThrough(reference, true);
+/**
+* Answers only *whether* a reference resolves. The secret is never read into
+* this process — stdout goes to `/dev/null`, so a `resolved` outcome here
+* carries an empty value by construction. `doctor --preflight` uses this: it
+* reports resolvability and must never materialize a credential to do it
+* (#312's boundary, restated by #414's no-retention rule).
+*/
+const defaultSecretReferenceProbe = (reference) => resolveThrough(reference, false);
+/**
+* Environment first (the #312 emit-time path), then the operator's configured
+* references. The first reference that fails ends the resolution: a second
+* probe would add nothing but another chance to hang.
+*/
+const resolveHqCredentials = ({ env, references, resolve = defaultSecretReferenceResolver }) => {
+	const clientId = env[CF_ACCESS_CLIENT_ID_ENV];
+	const clientSecret = env[CF_ACCESS_CLIENT_SECRET_ENV];
+	if (clientId && clientSecret) return {
+		credentials: {
+			clientId,
+			clientSecret
+		},
+		source: "environment",
+		status: "resolved"
+	};
+	if (!references) return {
+		failure: "no-reference",
+		status: "unresolved"
+	};
+	if (isHostedRunner(env)) return {
+		failure: "hosted-runner",
+		status: "unresolved"
+	};
+	const resolvedId = resolve(references.clientIdRef);
+	if (resolvedId.status !== "resolved") return {
+		failure: resolvedId.status,
+		reference: references.clientIdRef,
+		status: "unresolved"
+	};
+	const resolvedSecret = resolve(references.clientSecretRef);
+	if (resolvedSecret.status !== "resolved") return {
+		failure: resolvedSecret.status,
+		reference: references.clientSecretRef,
+		status: "unresolved"
+	};
+	return {
+		credentials: {
+			clientId: resolvedId.value,
+			clientSecret: resolvedSecret.value
+		},
+		source: "references",
+		status: "resolved"
+	};
+};
+const SANDBOX_REMEDY = "Run this command in a trusted local session outside the sandbox (`psf hq:flush` and `psf pr:publish` both need one).";
+/** One sentence per failure mode. Exhaustive by construction. */
+const FAILURE_SENTENCE = {
+	"hosted-runner": () => `this is a hosted runner, where resolving a secret reference is never attempted (#312). Provide ${CF_ACCESS_CLIENT_ID_ENV} and ${CF_ACCESS_CLIENT_SECRET_ENV} in the workflow environment instead.`,
+	"no-reference": () => `neither ${CF_ACCESS_CLIENT_ID_ENV}/${CF_ACCESS_CLIENT_SECRET_ENV} in the environment nor \`hqIngestCredentials\` references in the operator user config. Record the references there to make this resolvable.`,
+	"resolver-blocked": (reference) => `this session may not execute a secret manager, so ${reference} was never read. ${SANDBOX_REMEDY}`,
+	"resolver-missing": (reference) => `no secret manager was found on PATH (tried ${SECRET_RESOLVER_BINARIES.join(", ")}), so ${reference} could not be resolved.`,
+	"resolver-refused": (reference) => `the secret manager ran but returned no value for ${reference}: its store is unreachable from this session (a sandbox has no keychain access) or the reference is not readable. No resolver output is captured, so these are one answer. ${SANDBOX_REMEDY} If the session is already trusted, warm the reference (\`op-fast read '<ref>' >/dev/null\`) or correct it in the user config.`,
+	"resolver-timeout": (reference) => `the secret manager did not answer within ${SECRET_PROBE_TIMEOUT_MS}ms for ${reference} — typically a desktop approval nobody can grant here. ${SANDBOX_REMEDY}`
+};
+/**
+* The operator-facing reason. Names the failure mode and its remedy, and can
+* contain a reference but never a value — the resolver's own output is never
+* read, so nothing here can quote a secret.
+*/
+const describeHqCredentialFailure = (resolution) => `HQ Access credentials are unavailable: ${FAILURE_SENTENCE[resolution.failure](resolution.reference ?? "the configured reference")}`;
+//#endregion
 //#region src/hq-ingest-preflight.ts
 /**
 * Whether the HQ ingest credentials resolve (#312).
@@ -10866,6 +12373,8 @@ const demandedRungSatisfactionReasons = ({ demandedRung, liveHumanReviews, revie
 * Nothing connected "this variable is missing" to "a resolvable reference for it
 * exists", so a silent degradation persisted because nothing surfaced the
 * remedy.
+* Since #369 this check is the *only* owner of that question: the runtime
+* admission commands defer silently and retain the reason in the retry spool.
 *
 * Hard boundaries, all of them decided:
 * - **Resolvability only, never values.** Nothing here reads, prints, logs,
@@ -10877,28 +12386,17 @@ const demandedRungSatisfactionReasons = ({ demandedRung, liveHumanReviews, revie
 *   In CI the probe is inert — not merely unused.
 * - **The factory never acquires credentials.** No auto-export, no writing to
 *   shell profiles, no auth flow. It names the remedy; the operator acts.
-*/
-const HQ_INGEST_PREFLIGHT_CHECK_NAME = "admission:hq-ingest";
-/**
-* The operator's existing resolution path: `op-fast` first, official `op` as the
-* fallback, consistent with the trusted-local Alchemy commands. Output is
-* discarded — only the exit status is read.
-*/
-const defaultSecretReferenceProbe = (reference) => ["op-fast", "op"].some((binary) => {
-	const result = spawnSync(binary, ["read", reference], {
-		encoding: "utf-8",
-		stdio: [
-			"ignore",
-			"ignore",
-			"ignore"
-		]
-	});
-	return !result.error && result.status === 0;
-});
+*/
+const HQ_INGEST_PREFLIGHT_CHECK_NAME = "admission:hq-ingest";
 const REMEDY_SHAPE = `The variable names are literally hyphenated, so a plain \`export\` does not set them — prefix the command: \`env '${CF_ACCESS_CLIENT_ID_ENV}=…' '${CF_ACCESS_CLIENT_SECRET_ENV}=…' <command>\`. \`HQ_INGEST_URL\` wants the origin (https://hq.patronage.com), not the profile's /api/ingest endpoint.`;
-/** True in a hosted runner, where secret-manager resolution must not be tried. */
-const isHostedRunner = (env) => env.CI === "true" || env.CI === "1" || env.GITHUB_ACTIONS === "true";
-function hqIngestCredentialCheck({ env, probe = defaultSecretReferenceProbe, references }) {
+/** One short, operator-facing hint per resolver failure mode (#394 fold). */
+const RESOLUTION_HINT = {
+	"resolver-blocked": "this session may not execute a secret manager",
+	"resolver-missing": "no secret manager was found on PATH",
+	"resolver-refused": "the secret manager ran but returned no value (its store is unreachable from this session, or the reference is wrong)",
+	"resolver-timeout": "the secret manager did not answer in time"
+};
+function hqIngestCredentialCheck({ env, resolve = defaultSecretReferenceProbe, references }) {
 	if (Boolean(env["CF-Access-Client-Id"] && env["CF-Access-Client-Secret"])) return {
 		message: `HQ ingest credentials are present in the environment (${CF_ACCESS_CLIENT_ID_ENV}, ${CF_ACCESS_CLIENT_SECRET_ENV}); ingest will deliver.`,
 		name: HQ_INGEST_PREFLIGHT_CHECK_NAME,
@@ -10914,9 +12412,14 @@ function hqIngestCredentialCheck({ env, probe = defaultSecretReferenceProbe, ref
 		name: HQ_INGEST_PREFLIGHT_CHECK_NAME,
 		status: "warning"
 	};
-	const unresolvable = [references.clientIdRef, references.clientSecretRef].filter((reference) => !probe(reference)).join(", ");
-	if (unresolvable) return {
-		message: `HQ ingest credentials are absent and ${unresolvable} did not resolve from the operator's secret store. Warm the reference (\`op-fast read '<ref>' >/dev/null\`) or correct it in the operator user config. ${REMEDY_SHAPE}`,
+	const unresolved = [references.clientIdRef, references.clientSecretRef].map((reference) => ({
+		reference,
+		resolution: resolve(reference)
+	})).filter(({ resolution }) => resolution.status !== "resolved");
+	if (unresolved.length > 0) return {
+		message: `HQ ingest credentials are absent and did not resolve from the operator's secret store: ${unresolved.map(({ reference, resolution }) => {
+			return `${reference} (${RESOLUTION_HINT[resolution.status]})`;
+		}).join("; ")}. Warm the reference (\`op-fast read '<ref>' >/dev/null\`) or correct it in the operator user config. ${REMEDY_SHAPE}`,
 		name: HQ_INGEST_PREFLIGHT_CHECK_NAME,
 		status: "warning"
 	};
@@ -11565,16 +13068,42 @@ const statusFromBlockingReasons = ({ blockingReasons, finalReviewBlockingReasons
 	return "blocked";
 };
 const addReviewBlockingReasons = ({ blockers, correctnessRequired, correctnessStatus, correctnessUntyped }) => {
-	if (correctnessRequired && correctnessUntyped) blockers.push({ reason: CORRECTNESS_UNTYPED_REVIEW_BLOCKER_REASON });
-	else if (correctnessStatus === "missing") blockers.push({ reason: "Missing current Correctness review proof." });
-	else if (correctnessStatus === "stale") blockers.push({ reason: "Correctness review proof is stale because the PR-owned patch-id changed." });
-	else if (correctnessStatus === "blocked") blockers.push({ reason: "Correctness review proof ran and explicitly failed (open blocking findings or errored run); resolve the findings and re-run pr:review." });
+	const demand = reviewModeDemand("correctness");
+	if (correctnessRequired && correctnessUntyped) blockers.push({
+		demand,
+		reason: CORRECTNESS_UNTYPED_REVIEW_BLOCKER_REASON
+	});
+	else if (correctnessStatus === "missing") blockers.push({
+		demand,
+		reason: "Missing current Correctness review proof."
+	});
+	else if (correctnessStatus === "stale") blockers.push({
+		demand,
+		reason: "Correctness review proof is stale because the PR-owned patch-id changed."
+	});
+	else if (correctnessStatus === "blocked") blockers.push({
+		demand,
+		reason: "Correctness review proof ran and explicitly failed (open blocking findings or errored run); resolve the findings and re-run pr:review."
+	});
 };
 const addSecurityBlockingReasons = ({ blockers, securityRequired, securityStatus, securityUntyped }) => {
-	if (securityRequired && securityUntyped) blockers.push({ reason: SECURITY_UNTYPED_REVIEW_BLOCKER_REASON });
-	else if (securityStatus === "missing") blockers.push({ reason: "Missing current Security review proof." });
-	else if (securityStatus === "stale") blockers.push({ reason: "Security review proof is stale because the PR-owned patch-id changed." });
-	else if (securityStatus === "blocked") blockers.push({ reason: "Security review proof ran and explicitly failed (open blocking findings or errored run); resolve or disposition the findings and re-run pr:review." });
+	const demand = reviewModeDemand("security");
+	if (securityRequired && securityUntyped) blockers.push({
+		demand,
+		reason: SECURITY_UNTYPED_REVIEW_BLOCKER_REASON
+	});
+	else if (securityStatus === "missing") blockers.push({
+		demand,
+		reason: "Missing current Security review proof."
+	});
+	else if (securityStatus === "stale") blockers.push({
+		demand,
+		reason: "Security review proof is stale because the PR-owned patch-id changed."
+	});
+	else if (securityStatus === "blocked") blockers.push({
+		demand,
+		reason: "Security review proof ran and explicitly failed (open blocking findings or errored run); resolve or disposition the findings and re-run pr:review."
+	});
 };
 const requiredChecksEvaluation = (input) => {
 	const requiredChecks = input.externalRequiredChecks ?? [];
@@ -11597,14 +13126,20 @@ const requiredChecksEvaluation = (input) => {
 			labels: input.prLabels
 		}
 	});
+	const blockers = outcomes.flatMap((outcome) => outcome.reason ? [{
+		demand: requiredCheckDemand(outcome.name),
+		reason: outcome.reason
+	}] : []);
+	if (blockers.length !== blockingReasons.length) throw new Error("requiredChecks evaluation produced a blocking reason with no owning check; this is a factory bug.");
 	return {
-		blockers: blockingReasons.map((reason) => ({ reason })),
+		blockers,
 		outcomes
 	};
 };
 const collectBlockers = ({ correctnessRequired, correctnessStatus, correctnessUntyped, input, prVerifyStatus, verificationProof, sectionReady, securityRequired, securityStatus, securityUntyped, trivialWaiverPresent }) => {
 	const blockers = [];
 	if (!sectionReady) blockers.push({
+		demand: DEMAND_KEYS.prBodySections,
 		reason: RENDER_PR_BODY_SECTIONS_BLOCKER_REASON,
 		repair: {
 			action: "Render the required Verification / Review proof / How to review sections into the PR body from typed proof data (renderPrBodySections).",
@@ -11612,10 +13147,19 @@ const collectBlockers = ({ correctnessRequired, correctnessStatus, correctnessUn
 			command: `gh pr edit ${input.pr} --body-file -`
 		}
 	});
-	if (prVerifyStatus === "missing") blockers.push({ reason: "Missing passing typed pr:verify proof for the current PR head." });
-	else if (prVerifyStatus === "stale") blockers.push({ reason: "Typed pr:verify proof is stale because it is not tied to the current PR head." });
+	if (prVerifyStatus === "missing") blockers.push({
+		demand: DEMAND_KEYS.prVerify,
+		reason: "Missing passing typed pr:verify proof for the current PR head."
+	});
+	else if (prVerifyStatus === "stale") blockers.push({
+		demand: DEMAND_KEYS.prVerify,
+		reason: "Typed pr:verify proof is stale because it is not tied to the current PR head."
+	});
 	const proofBlockingReason = verificationProofBlockingReason(verificationProof);
-	if (proofBlockingReason) blockers.push({ reason: proofBlockingReason });
+	if (proofBlockingReason) blockers.push({
+		demand: DEMAND_KEYS.prVerify,
+		reason: proofBlockingReason
+	});
 	addReviewBlockingReasons({
 		blockers,
 		correctnessRequired,
@@ -11628,12 +13172,28 @@ const collectBlockers = ({ correctnessRequired, correctnessStatus, correctnessUn
 		securityStatus,
 		securityUntyped
 	});
-	if (trivialWaiverPresent && input.classification === "non-trivial") blockers.push({ reason: "Explicit trivial waiver is incompatible with a non-trivial diff." });
-	if (input.unresolvedReviewThreads > 0) blockers.push({ reason: `GitHub has ${input.unresolvedReviewThreads} unresolved review thread(s).` });
-	if (input.localHeadSha && !sameHeadSha(input.localHeadSha, input.headSha)) blockers.push({ reason: "Local HEAD does not match the GitHub PR head." });
-	if (input.mergeable !== "MERGEABLE" || !["CLEAN", "BLOCKED"].includes(input.mergeStateStatus)) blockers.push({ reason: `GitHub merge state is ${input.mergeStateStatus}/${input.mergeable}; expected CLEAN or review-only BLOCKED with MERGEABLE.` });
-	if (input.requiredChecks === "none" && input.classification !== "docs/process-only") blockers.push({ reason: "GitHub has no current checks for a non-docs PR." });
+	if (trivialWaiverPresent && input.classification === "non-trivial") blockers.push({
+		demand: DEMAND_KEYS.trivialWaiver,
+		reason: "Explicit trivial waiver is incompatible with a non-trivial diff."
+	});
+	if (input.unresolvedReviewThreads > 0) blockers.push({
+		demand: DEMAND_KEYS.reviewThreads,
+		reason: `GitHub has ${input.unresolvedReviewThreads} unresolved review thread(s).`
+	});
+	if (input.localHeadSha && !sameHeadSha(input.localHeadSha, input.headSha)) blockers.push({
+		demand: DEMAND_KEYS.headIdentity,
+		reason: "Local HEAD does not match the GitHub PR head."
+	});
+	if (input.mergeable !== "MERGEABLE" || !["CLEAN", "BLOCKED"].includes(input.mergeStateStatus)) blockers.push({
+		demand: DEMAND_KEYS.mergeState,
+		reason: `GitHub merge state is ${input.mergeStateStatus}/${input.mergeable}; expected CLEAN or review-only BLOCKED with MERGEABLE.`
+	});
+	if (input.requiredChecks === "none" && input.classification !== "docs/process-only") blockers.push({
+		demand: DEMAND_KEYS.githubChecks,
+		reason: "GitHub has no current checks for a non-docs PR."
+	});
 	else if (input.requiredChecks !== "passed" && input.requiredChecks !== "none") blockers.push({
+		demand: DEMAND_KEYS.githubChecks,
 		reason: `${PENDING_CHECKS_BLOCKER_REASON_PREFIX} ${input.requiredChecks}; expected passed.`,
 		...input.requiredChecks === "pending" ? { repair: {
 			action: "Poll and retry until post-undraft GitHub checks settle or fail; UNSTABLE/pending is a transient route-owned state, not a human blocker.",
@@ -11642,6 +13202,7 @@ const collectBlockers = ({ correctnessRequired, correctnessStatus, correctnessUn
 		} } : {}
 	});
 	if (input.draft) blockers.push({
+		demand: DEMAND_KEYS.draft,
 		reason: DRAFT_BLOCKER_REASON,
 		repair: {
 			action: "Mark the PR ready for review; draft is route-owned once proof gates pass.",
@@ -11652,7 +13213,10 @@ const collectBlockers = ({ correctnessRequired, correctnessStatus, correctnessUn
 	return blockers;
 };
 const orderRepairs = (repairs) => repairs.toSorted((a, b) => READINESS_REPAIR_CODES.indexOf(a.code) - READINESS_REPAIR_CODES.indexOf(b.code));
-const SLICE_NOT_FINAL_BLOCKER = { reason: "This PR is a slice, not the intended final human review point." };
+const SLICE_NOT_FINAL_BLOCKER = {
+	demand: DEMAND_KEYS.finalReviewPoint,
+	reason: "This PR is a slice, not the intended final human review point."
+};
 const postReadinessHumanCommentState = (input) => {
 	const checkRunUrls = input.checkRunHandledCommentUrls ?? [];
 	const cliHandledUrls = input.handledCommentUrls ?? [];
@@ -11675,15 +13239,21 @@ const postReadinessHumanCommentState = (input) => {
 		reviews: input.reviews ?? []
 	});
 	return {
-		blockers: [...activeComments.map((comment) => ({ reason: postReadinessHumanCommentReason({
-			comment,
-			pr: input.pr,
-			prTitle: input.prTitle
-		}) })), ...activeReviews.map((review) => ({ reason: postReadinessHumanReviewReason({
-			pr: input.pr,
-			prTitle: input.prTitle,
-			review
-		}) }))],
+		blockers: [...activeComments.map((comment) => ({
+			demand: DEMAND_KEYS.humanBlocker,
+			reason: postReadinessHumanCommentReason({
+				comment,
+				pr: input.pr,
+				prTitle: input.prTitle
+			})
+		})), ...activeReviews.map((review) => ({
+			demand: DEMAND_KEYS.humanBlocker,
+			reason: postReadinessHumanReviewReason({
+				pr: input.pr,
+				prTitle: input.prTitle,
+				review
+			})
+		}))],
 		comments: activeComments,
 		ledgerFields: {
 			...input.handledCommentsProducer ? { handledCommentsProducer: input.handledCommentsProducer } : {},
@@ -11691,933 +13261,850 @@ const postReadinessHumanCommentState = (input) => {
 			...activeComments.length > 0 ? { postReadinessHumanComments: activeComments } : {},
 			...activeReviews.length > 0 ? { postReadinessHumanReviews: activeReviews } : {}
 		},
-		status: (status) => activeComments.length > 0 || activeReviews.length > 0 ? "blocked" : status
-	};
-};
-const verificationProofForInput = ({ input }) => {
-	if (input.verificationProof) return {
-		fullVerifiedHeadShas: input.docsOnlyVerifyBaselineHeadShas,
-		verificationProof: input.verificationProof
-	};
-	return {
-		fullVerifiedHeadShas: [],
-		verificationProof: {
-			kind: "typed-missing",
-			path: "",
-			reason: "enoent"
-		}
-	};
-};
-const verifyGateFor = ({ input }) => {
-	const verification = verificationProofForInput({ input });
-	const verificationProof = verificationProofForReadiness(verification.verificationProof);
-	return {
-		verification,
-		...prVerifyEvaluation({
-			acceptedBaselineHeadShas: verification.fullVerifiedHeadShas,
-			currentHeadSha: input.headSha,
-			docsOnlyProofCanStandAlone: input.classification === "docs/process-only",
-			prVerifyProof: verificationProof,
-			trivialProofCanStandAlone: input.classification === "trivial" || input.classification === "docs/process-only"
-		})
-	};
-};
-const previewDeployRequired = false;
-const evaluateReadiness = (input) => {
-	const bodyMetadata = readPrBodyMetadata(input.body);
-	const reviewModes = input.reviewModes ?? ["correctness"];
-	const epoch = reviewEpochModeFor(input.reviewProof ?? {}, input.ladderPolicy);
-	const verifyGate = verifyGateFor({
-		bodyMetadata,
-		input
-	});
-	const { correctnessDocsOnlyDeltaAccepted, correctnessProof, correctnessRequired, correctnessStatus, correctnessUntyped, gateCapMismatchBlockers, reviewCycleState, reviewTerminalState, reviewLadder, securityDocsOnlyDeltaAccepted, securityProof, securityRequired, securityStatus, securityUntyped } = resolveReviewRequiredness({
-		bodyMetadata,
-		classification: input.classification,
-		docsOnlySinceReviewProof: input.docsOnlySinceReviewProof,
-		epoch,
-		headSha: input.headSha,
-		ladderPolicy: input.ladderPolicy,
-		patchId: input.patchId,
-		reviewModes,
-		reviewProof: input.reviewProof
-	});
-	const { docsOnlyVerifiedHeadSha, docsOnlyVerifyDeltaAccepted, prVerifyStatus, trivialVerifiedHeadSha, trivialVerifyDeltaAccepted, verifiedHeadSha } = verifyGate;
-	const requiredChecks = requiredChecksEvaluation(input);
-	const blockers = [
-		...collectBlockers({
-			correctnessRequired,
-			correctnessStatus,
-			correctnessUntyped,
-			input,
-			prVerifyStatus,
-			sectionReady: bodyMetadata.requiredSectionsPresent,
-			securityRequired,
-			securityStatus,
-			securityUntyped,
-			trivialWaiverPresent: bodyMetadata.trivialWaiverAccepted,
-			verificationProof: verifyGate.verification.verificationProof
-		}),
-		...requiredChecks.blockers,
-		...gateCapMismatchBlockers,
-		...input.waveReviewDemand ? demandedRungSatisfactionReasons({
-			demandedRung: input.waveReviewDemand.review,
-			liveHumanReviews: input.reviews ?? [],
-			reviewRuns: input.reviewProof?.reviews
-		}).map((reason) => ({ reason })) : []
-	];
-	const blockingReasons = blockers.map((blocker) => blocker.reason);
-	const humanBlockingReasons = blockers.flatMap((blocker) => blocker.repair ? [] : [blocker.reason]);
-	const repairs = orderRepairs(blockers.flatMap((blocker) => blocker.repair ? [blocker.repair] : []));
-	const finalReviewBlockingReasons = [...blockingReasons];
-	if (!bodyMetadata.finalReviewPoint) {
-		finalReviewBlockingReasons.push(SLICE_NOT_FINAL_BLOCKER.reason);
-		humanBlockingReasons.push(SLICE_NOT_FINAL_BLOCKER.reason);
-	}
-	const status = statusFromBlockingReasons({
-		blockingReasons,
-		finalReviewBlockingReasons,
-		finalReviewPoint: bodyMetadata.finalReviewPoint
-	});
-	const postReadiness = postReadinessHumanCommentState(input);
-	const ledger = {
-		baseSha: input.baseSha,
-		blockingReasons: finalReviewBlockingReasons,
-		classification: input.classification,
-		...requiredChecks.outcomes.length > 0 ? { externalChecks: requiredChecks.outcomes.map((outcome) => ({
-			checkType: outcome.checkType,
-			inScope: outcome.inScope,
-			name: outcome.name,
-			...outcome.reason ? { reason: outcome.reason } : {},
-			...outcome.scope ? { scope: outcome.scope } : {},
-			scopeReason: outcome.scopeReason,
-			status: outcome.status
-		})) } : {},
-		finalReviewPoint: bodyMetadata.finalReviewPoint,
-		github: {
-			currentWithBase: input.currentWithBase,
-			draft: input.draft,
-			mergeStateStatus: input.mergeStateStatus,
-			mergeable: input.mergeable,
-			requiredChecks: input.requiredChecks,
-			unresolvedReviewThreads: input.unresolvedReviewThreads
-		},
-		headSha: input.headSha,
-		...input.mergeBaseSha ? { mergeBaseSha: input.mergeBaseSha } : {},
-		patchId: input.patchId,
-		pr: input.pr,
-		previewDeployRequired,
-		...postReadiness.ledgerFields,
-		reviewRuns: input.reviewProof?.reviews.map((review) => ({
-			durationMs: review.durationMs,
-			endedAt: review.endedAt,
-			findings: review.findings,
-			issuesFlagged: review.issuesFlagged,
-			kind: review.kind,
-			...recordedReviewIdentityFields(review),
-			outcome: review.outcome,
-			startedAt: review.startedAt,
-			summary: review.summary
-		})),
-		...reviewCycleState ? { reviewCycleState } : {},
-		...reviewTerminalState ? { reviewTerminalState } : {},
-		...reviewLadder ? { reviewLadder } : {},
-		repairs,
-		reviews: {
-			correctness: {
-				...correctnessDocsOnlyDeltaAccepted ? { docsOnlyDeltaAccepted: true } : {},
-				required: correctnessRequired,
-				status: correctnessStatus,
-				...correctnessProof
-			},
-			...reviewModes.includes("security") ? { security: {
-				...securityDocsOnlyDeltaAccepted ? { docsOnlyDeltaAccepted: true } : {},
-				required: securityRequired,
-				status: securityStatus,
-				...securityProof
-			} } : {}
-		},
-		schemaVersion: 1,
-		stackRole: bodyMetadata.stackRole,
-		verification: verificationLedgerFields({
-			docsOnlyVerifiedHeadSha,
-			docsOnlyVerifyDeltaAccepted,
-			prVerifyStatus,
-			trivialVerifiedHeadSha,
-			trivialVerifyDeltaAccepted,
-			verifiedHeadSha
-		})
-	};
-	const finalBlockingReasons = [...ledger.blockingReasons, ...postReadiness.blockers.map((blocker) => blocker.reason)];
-	humanBlockingReasons.push(...postReadiness.blockers.map((blocker) => blocker.reason));
-	ledger.blockingReasons = finalBlockingReasons;
-	return {
-		blockingReasons: finalBlockingReasons,
-		humanBlockingReasons,
-		ledger,
-		repairs,
-		status: postReadiness.status(status)
-	};
-};
-//#endregion
-//#region src/admission-preflight.ts
-const errorMessage$1 = (error) => error instanceof Error ? error.message : String(error);
-const resolveCandidate = ({ base, cwd, verifyProof }) => {
-	try {
-		const files = changedFiles(cwd, base);
-		const { headSha, mergeBaseSha: mergeBaseSha$1, patchId } = resolveCandidateIdentity({
-			base,
-			cwd,
-			git: {
-				currentHeadSha,
-				mergeBaseSha,
-				stablePatchId
-			}
-		});
-		return { candidate: {
-			classification: verifyProof && evidenceFresh({
-				candidate: { patchId },
-				recorded: { patchId: verifyProof.patchId },
-				rule: "patch-id"
-			}) ? verifyProof.classification : void 0,
-			files,
-			headSha,
-			mergeBaseSha: mergeBaseSha$1,
-			patchId
-		} };
-	} catch (error) {
-		return { error: errorMessage$1(error) };
-	}
-};
-/**
-* Authoring-session identity. Not modelled by readiness: `pr:verify` enforces
-* it unconditionally at the command layer (v0.13.2 on) and records it on the
-* proof, so it can only fail at verification runtime — which is exactly the
-* late discovery #292 exists to remove.
-*/
-const authoringSessionCheck = (env) => {
-	const discovered = discoverFactorySessionId(env);
-	return discovered ? {
-		message: `Authoring session resolves from FACTORY_SESSION_ID (${discovered}); pr:verify records it on the proof.`,
-		name: "admission:authoring-session",
-		status: "ok"
-	} : {
-		message: "FACTORY_SESSION_ID is unset, so pr:verify requires --authoring-session <id>; without one it fails at verification runtime, and any review-type evidence stays unconfirmable (fail closed).",
-		name: "admission:authoring-session",
-		status: "warning"
-	};
-};
-/**
-* Verification proof at the current head. The verdict comes from the single
-* shared verify-once applicability entry point (#692 / ADR 0016), and a refusal
-* is rendered with readiness's own blocking reason — never a second opinion.
-*/
-const verifyProofCheck = ({ candidate, candidateError, preread, verifyProofPath }) => {
-	if (!candidate) return {
-		message: `Verification proof state is unknown: no git candidate is resolvable here (${candidateError ?? "unknown error"}).`,
-		name: "admission:verify-proof",
-		status: "warning"
-	};
-	const { verificationProof } = resolveVerifyProofApplicability({
-		currentVerifyIdentityForBase: () => ({ patchId: candidate.patchId }),
-		explicitProof: false,
-		files: candidate.files,
-		headSha: candidate.headSha,
-		preread,
-		proofPath: verifyProofPath
-	});
-	if (verificationProof.kind === "typed") return {
-		message: `Applicable ${verificationProof.proof.mode} pr:verify proof for head ${candidate.headSha} (verified at ${verificationProof.proof.headSha}); pr:publish will reuse it.`,
-		name: "admission:verify-proof",
-		status: "ok"
-	};
-	return {
-		message: verificationProofBlockingReason(verificationProof) ?? "No applicable pr:verify proof covers this candidate.",
-		name: "admission:verify-proof",
-		status: "warning"
+		status: (status) => activeComments.length > 0 || activeReviews.length > 0 ? "blocked" : status
 	};
 };
-/**
-* Independent review proof. Requiredness comes from the profile-resolved review
-* modes; currency and acceptance come from the same identity and
-* terminal-state helpers `pr:publish` uses.
-*/
-const reviewProofCheck = ({ candidate, candidateError, profile, proof, reviewModes }) => {
-	const name = "admission:review-proof";
-	if (!candidate) return {
-		message: `Review proof state is unknown: no git candidate is resolvable here (${candidateError ?? "unknown error"}).`,
-		name,
-		status: "warning"
-	};
-	if (reviewModes.length === 0) return {
-		message: "Independent review is not required: no profile review mode applies to the changed files.",
-		name,
-		status: "ok"
+const verificationProofForInput = ({ input }) => {
+	if (input.verificationProof) return {
+		fullVerifiedHeadShas: input.docsOnlyVerifyBaselineHeadShas,
+		verificationProof: input.verificationProof
 	};
-	const status = reviewStatus({
-		headSha: candidate.headSha,
-		patchId: candidate.patchId,
-		required: true,
-		reviewedHeadSha: proof?.headSha,
-		reviewedPatchId: proof?.patchId
-	});
-	const terminal = proof ? resolveReviewTerminalStateAcrossReviewsForPolicy(proof, resolveReviewLadderPolicy(profile)) : void 0;
-	const accepted = status === "current" && (terminal === "clean" || terminal === "accepted-with-findings");
 	return {
-		message: accepted ? `pr:review proof is current for this candidate (${terminal}) across ${reviewModes.join(", ")}.` : `pr:review proof is ${status}${terminal ? ` (${terminal})` : ""}; ${reviewModes.join(", ")} review(s) are required. Have an independent clean session write findings and pass them to pr:publish --findings <path>.`,
-		name,
-		status: accepted ? "ok" : "warning"
+		fullVerifiedHeadShas: [],
+		verificationProof: {
+			kind: "typed-missing",
+			path: "",
+			reason: "enoent"
+		}
 	};
 };
-/**
-* PR-body sections. Readiness owns the requirement and its wording; publish
-* owns satisfying it by patching the managed sections from the two proofs, so
-* this is named rather than evaluated — the body is a live GitHub fact a
-* read-only local pass cannot see.
-*/
-const prBodySectionsCheck = () => ({
-	message: `${RENDER_PR_BODY_SECTIONS_BLOCKER_REASON} pr:publish patches those managed sections from the pr:verify and pr:review proofs.`,
-	name: "admission:pr-body-sections",
-	status: "ok"
-});
-const requiredCheckMessage = (outcome) => {
-	if (outcome.status === "out-of-scope") return `Not demanded for this candidate: ${outcome.scopeReason}.`;
-	if (outcome.status === "satisfied") return `Satisfied by a ${outcome.checkType}-type evidence envelope${outcome.matchedPath ? ` (${outcome.matchedPath})` : ""}.`;
-	return outcome.reason ?? `Required ${outcome.checkType} check has no passing, current evidence envelope.`;
+const verifyGateFor = ({ input }) => {
+	const verification = verificationProofForInput({ input });
+	const verificationProof = verificationProofForReadiness(verification.verificationProof);
+	return {
+		verification,
+		...prVerifyEvaluation({
+			acceptedBaselineHeadShas: verification.fullVerifiedHeadShas,
+			currentHeadSha: input.headSha,
+			docsOnlyProofCanStandAlone: input.classification === "docs/process-only",
+			prVerifyProof: verificationProof,
+			trivialProofCanStandAlone: input.classification === "trivial" || input.classification === "docs/process-only"
+		})
+	};
 };
-/**
-* Profile-declared external required checks — the evidence-envelope demands,
-* including a preview-deploy proof when the profile declares one. Evaluated by
-* readiness's own `evaluateRequiredChecks`, so scoping, freshness and
-* independence stay exactly one implementation.
-*/
-const requiredCheckChecks = ({ candidate, candidateError, cwd, profile, verifyProof }) => {
-	const requiredChecks = profile.requiredChecks ?? [];
-	if (requiredChecks.length === 0) return [{
-		message: "Profile declares no requiredChecks; no external evidence envelope (including a preview-deploy proof) is demanded.",
-		name: "admission:required-checks",
-		status: "ok"
-	}];
-	if (!candidate) return [{
-		message: `${requiredChecks.length} profile requiredCheck(s) are declared but cannot be evaluated: no git candidate is resolvable here (${candidateError ?? "unknown error"}).`,
-		name: "admission:required-checks",
-		status: "warning"
-	}];
-	const { outcomes } = evaluateRequiredChecks({
-		authoringSessionIds: resolveAuthoringSessionIds({ recorded: verifyProof?.authoringSession }),
-		candidate: {
-			headSha: candidate.headSha,
-			mergeBaseSha: candidate.mergeBaseSha,
-			patchId: candidate.patchId
-		},
-		envelopes: loadEvidenceEnvelopes(cwd),
-		requiredChecks,
-		scopeContext: {
-			classification: candidate.classification,
-			labels: void 0
-		}
-	});
-	return outcomes.map((outcome) => ({
-		message: requiredCheckMessage(outcome),
-		name: `admission:required-check:${outcome.name}`,
-		status: outcome.status === "unmet" ? "warning" : "ok"
+const waveRungBlockers = (input) => {
+	const demanded = input.waveReviewDemand;
+	if (!demanded) return [];
+	return demandedRungSatisfactionReasons({
+		demandedRung: demanded.review,
+		liveHumanReviews: input.reviews ?? [],
+		reviewRuns: input.reviewProof?.reviews
+	}).map((reason) => ({
+		demand: reviewRungDemand(demanded.review),
+		reason
 	}));
 };
-/**
-* The full admission checklist for the current repository and candidate, in the
-* order the requirements bind: identity, verification proof, review proof,
-* PR-body sections, external evidence demands. The factory GitHub App
-* requirement is reported by the doctor `github-app` check, which states the
-* consequence of its absence.
-*/
-const admissionPreflightChecks = ({ base = "origin/main", cwd, env = process.env, hqIngestCredentials, profile, reviewProofPath = DEFAULT_PR_REVIEW_PROOF_PATH, verifyProofPath = DEFAULT_PR_VERIFY_PROOF_PATH }) => {
-	const resolvedVerifyProofPath = path.resolve(cwd, verifyProofPath);
-	const preread = tryReadProof(readPrVerifyProof, resolvedVerifyProofPath);
-	const resolved = resolveCandidate({
-		base,
-		cwd,
-		verifyProof: preread.proof
+const previewDeployRequired = false;
+const evaluateReadiness = (input) => {
+	const bodyMetadata = readPrBodyMetadata(input.body);
+	const reviewModes = input.reviewModes ?? ["correctness"];
+	const epoch = reviewEpochModeFor(input.reviewProof ?? {}, input.ladderPolicy);
+	const verifyGate = verifyGateFor({
+		bodyMetadata,
+		input
 	});
-	const candidate = "candidate" in resolved ? resolved.candidate : void 0;
-	const candidateError = "error" in resolved ? resolved.error : void 0;
-	const reviewProof = readOptionalProofFor(PR_REVIEW_PROOF_DESCRIPTOR, cwd, reviewProofPath);
-	return [
-		authoringSessionCheck(env),
-		verifyProofCheck({
-			candidate,
-			candidateError,
-			preread,
-			verifyProofPath: resolvedVerifyProofPath
-		}),
-		reviewProofCheck({
-			candidate,
-			candidateError,
-			profile,
-			proof: reviewProof,
-			reviewModes: candidate ? resolveApplicableReviewModes(profile, candidate.files) : profile.review.modes
-		}),
-		prBodySectionsCheck(),
-		...requiredCheckChecks({
-			candidate,
-			candidateError,
-			cwd,
-			profile,
-			verifyProof: preread.proof
+	const { correctnessDocsOnlyDeltaAccepted, correctnessProof, correctnessRequired, correctnessStatus, correctnessUntyped, gateCapMismatchBlockers, reviewCycleState, reviewTerminalState, reviewLadder, securityDocsOnlyDeltaAccepted, securityProof, securityRequired, securityStatus, securityUntyped } = resolveReviewRequiredness({
+		bodyMetadata,
+		classification: input.classification,
+		docsOnlySinceReviewProof: input.docsOnlySinceReviewProof,
+		epoch,
+		headSha: input.headSha,
+		ladderPolicy: input.ladderPolicy,
+		patchId: input.patchId,
+		reviewModes,
+		reviewProof: input.reviewProof
+	});
+	const { docsOnlyVerifiedHeadSha, docsOnlyVerifyDeltaAccepted, prVerifyStatus, trivialVerifiedHeadSha, trivialVerifyDeltaAccepted, verifiedHeadSha } = verifyGate;
+	const requiredChecks = requiredChecksEvaluation(input);
+	const blockers = [
+		...collectBlockers({
+			correctnessRequired,
+			correctnessStatus,
+			correctnessUntyped,
+			input,
+			prVerifyStatus,
+			sectionReady: bodyMetadata.requiredSectionsPresent,
+			securityRequired,
+			securityStatus,
+			securityUntyped,
+			trivialWaiverPresent: bodyMetadata.trivialWaiverAccepted,
+			verificationProof: verifyGate.verification.verificationProof
 		}),
-		hqIngestCredentialCheck({
-			env,
-			...hqIngestCredentials === void 0 ? {} : { references: hqIngestCredentials }
-		})
+		...requiredChecks.blockers,
+		...gateCapMismatchBlockers.map((blocker) => ({
+			demand: DEMAND_KEYS.reviewLadder,
+			reason: blocker.reason
+		})),
+		...waveRungBlockers(input)
 	];
-};
-//#endregion
-//#region src/doctor.ts
-function doctorProjectProfile(input = {}) {
-	const { path, profile } = loadProjectProfile(input);
-	const env = input.env ?? process.env;
-	const cwd = input.cwd ?? process.cwd();
-	const userConfig = resolveDoctorUserConfig(env, input.userConfig);
-	const checks = [...buildProfileChecks(profile, cwd, {
-		env,
-		userConfig: userConfig.loaded?.config,
-		userConfigCheck: userConfig.check
-	}), ...input.preflight ? admissionPreflightChecks({
-		base: input.base,
-		cwd,
-		env,
-		...userConfig.loaded?.config.hqIngestCredentials === void 0 ? {} : { hqIngestCredentials: userConfig.loaded.config.hqIngestCredentials },
-		profile,
-		profilePath: path
-	}) : []];
-	return {
-		checks,
-		ok: checks.every((check) => check.status !== "error"),
-		profilePath: path,
-		projectKey: profile.project.key,
-		repository: {
-			defaultBranch: profile.repository.defaultBranch,
-			name: profile.repository.name,
-			owner: profile.repository.owner
-		},
-		schemaVersion: profile.schemaVersion
-	};
-}
-function resolveDoctorUserConfig(env, provided) {
-	const configPath = provided?.path ?? defaultUserConfigPath(env);
-	if (provided === void 0 && !existsSync(configPath)) return { check: {
-		message: `User config not found at ${configPath}; no optional operator credentials or HQ origins are configured.`,
-		name: "user-config",
-		status: "warning"
-	} };
-	try {
-		const loaded = provided ?? loadUserConfig({
-			configPath,
-			env
-		});
-		const ignoredDefaultHarness = loaded.ignoredKeys?.includes("defaultHarness") ?? false;
-		return {
-			check: {
-				message: ignoredDefaultHarness ? `defaultHarness is ignored; remove it from ${loaded.path}. The factory does not select an agent runtime.` : `Loaded schema version ${loaded.config.schemaVersion} user config from ${loaded.path}.`,
-				name: "user-config",
-				status: ignoredDefaultHarness ? "warning" : "ok"
-			},
-			loaded
-		};
-	} catch (error) {
-		return { check: {
-			message: error instanceof Error ? error.message : String(error),
-			name: "user-config",
-			status: "error"
-		} };
+	const blockingReasons = blockers.map((blocker) => blocker.reason);
+	const humanBlockingReasons = blockers.flatMap((blocker) => blocker.repair ? [] : [blocker.reason]);
+	const repairs = orderRepairs(blockers.flatMap((blocker) => blocker.repair ? [blocker.repair] : []));
+	const finalReviewBlockers = [...blockers];
+	if (!bodyMetadata.finalReviewPoint) {
+		finalReviewBlockers.push(SLICE_NOT_FINAL_BLOCKER);
+		humanBlockingReasons.push(SLICE_NOT_FINAL_BLOCKER.reason);
 	}
-}
-function buildProfileChecks(profile, cwd, userConfigInput) {
-	return [
-		{
-			message: `Loaded schema version ${profile.schemaVersion} profile for ${profile.project.key}.`,
-			name: "profile",
-			status: "ok"
-		},
-		{
-			message: `${profile.repository.owner}/${profile.repository.name} uses ${profile.repository.defaultBranch}.`,
-			name: "repository",
-			status: "ok"
-		},
-		{
-			message: `${profile.verification.commands.length} verification commands configured.`,
-			name: "verification",
-			status: "ok"
+	const finalReviewBlockingReasons = finalReviewBlockers.map((blocker) => blocker.reason);
+	const status = statusFromBlockingReasons({
+		blockingReasons,
+		finalReviewBlockingReasons,
+		finalReviewPoint: bodyMetadata.finalReviewPoint
+	});
+	const postReadiness = postReadinessHumanCommentState(input);
+	const ledger = {
+		baseSha: input.baseSha,
+		blockingReasons: finalReviewBlockingReasons,
+		classification: input.classification,
+		...requiredChecks.outcomes.length > 0 ? { externalChecks: requiredChecks.outcomes.map((outcome) => ({
+			checkType: outcome.checkType,
+			inScope: outcome.inScope,
+			name: outcome.name,
+			...outcome.reason ? { reason: outcome.reason } : {},
+			...outcome.scope ? { scope: outcome.scope } : {},
+			scopeReason: outcome.scopeReason,
+			status: outcome.status
+		})) } : {},
+		finalReviewPoint: bodyMetadata.finalReviewPoint,
+		github: {
+			currentWithBase: input.currentWithBase,
+			draft: input.draft,
+			mergeStateStatus: input.mergeStateStatus,
+			mergeable: input.mergeable,
+			requiredChecks: input.requiredChecks,
+			unresolvedReviewThreads: input.unresolvedReviewThreads
 		},
-		requiredEnvironmentCheck(profile, userConfigInput.env),
-		{
-			message: `${profile.review.modes.join(", ")} review modes configured with ${profile.review.defaultMaxCycles} cycle cap.${profile.review.standingChecklist && profile.review.standingChecklist.length > 0 ? ` Standing review checklist: ${profile.review.standingChecklist.length} line(s).` : ""}`,
-			name: "review-policy",
-			status: "ok"
+		headSha: input.headSha,
+		...input.mergeBaseSha ? { mergeBaseSha: input.mergeBaseSha } : {},
+		patchId: input.patchId,
+		pr: input.pr,
+		previewDeployRequired,
+		...postReadiness.ledgerFields,
+		reviewRuns: input.reviewProof?.reviews.map((review) => ({
+			durationMs: review.durationMs,
+			endedAt: review.endedAt,
+			findings: review.findings,
+			issuesFlagged: review.issuesFlagged,
+			kind: review.kind,
+			...recordedReviewIdentityFields(review),
+			outcome: review.outcome,
+			startedAt: review.startedAt,
+			summary: review.summary
+		})),
+		...reviewCycleState ? { reviewCycleState } : {},
+		...reviewTerminalState ? { reviewTerminalState } : {},
+		...reviewLadder ? { reviewLadder } : {},
+		repairs,
+		reviews: {
+			correctness: {
+				...correctnessDocsOnlyDeltaAccepted ? { docsOnlyDeltaAccepted: true } : {},
+				required: correctnessRequired,
+				status: correctnessStatus,
+				...correctnessProof
+			},
+			...reviewModes.includes("security") ? { security: {
+				...securityDocsOnlyDeltaAccepted ? { docsOnlyDeltaAccepted: true } : {},
+				required: securityRequired,
+				status: securityStatus,
+				...securityProof
+			} } : {}
 		},
-		reviewLadderCheck(profile),
-		userConfigInput.userConfigCheck,
-		githubAppCheck(userConfigInput.userConfig),
-		gitRemoteCheck(profile, cwd)
-	];
-}
-function requiredEnvironmentCheck(profile, env) {
-	const required = profile.env?.required ?? [];
-	const unset = required.filter((name) => !env[name]);
-	if (unset.length > 0) return {
-		message: `Required environment variables are unset: ${unset.join(", ")}.`,
-		name: "environment",
-		status: "error"
-	};
-	return {
-		message: required.length === 0 ? "No required environment variables declared." : `${required.length} required environment variable name(s) are set.`,
-		name: "environment",
-		status: "ok"
-	};
-}
-function githubAppCheck(userConfig) {
-	const app = userConfig?.githubApp;
-	if (!app) return {
-		message: "Patronage Factory GitHub App credentials are not configured; gate publishing will use user-token commit statuses with Details links. Proof bindings cannot publish, so hosted required checks cannot be satisfied by local proof and must go green by their own means.",
-		name: "github-app",
-		status: "warning"
-	};
-	if (!existsSync(app.privateKeyPath)) return {
-		message: `Patronage Factory GitHub App id ${app.appId} is configured, but private key ${app.privateKeyPath} was not found.`,
-		name: "github-app",
-		status: "warning"
-	};
-	return {
-		message: `Patronage Factory GitHub App id ${app.appId} is configured${app.installationId ? ` for installation ${app.installationId}` : " with repository installation discovery"}.`,
-		name: "github-app",
-		status: "ok"
-	};
-}
-function reviewLadderCheck(profile) {
-	const policy = resolveReviewLadderPolicy(profile);
-	return {
-		message: `Review ladder ${profile.review.ladder ? "configured" : "defaulted"}: gate cap ${policy.gate.cap}.`,
-		name: "review-ladder",
-		status: "ok"
-	};
-}
-function gitRemoteCheck(profile, cwd) {
-	const origin = readGitOrigin(cwd);
-	if (!origin) return {
-		message: "No git origin remote was available for this working directory.",
-		name: "git-origin",
-		status: "warning"
-	};
-	if (repositoryUrlMatches(origin, profile)) return {
-		message: `Git origin matches ${profile.repository.owner}/${profile.repository.name}.`,
-		name: "git-origin",
-		status: "ok"
+		schemaVersion: 1,
+		stackRole: bodyMetadata.stackRole,
+		verification: verificationLedgerFields({
+			docsOnlyVerifiedHeadSha,
+			docsOnlyVerifyDeltaAccepted,
+			prVerifyStatus,
+			trivialVerifiedHeadSha,
+			trivialVerifyDeltaAccepted,
+			verifiedHeadSha
+		})
 	};
+	const finalBlockers = [...finalReviewBlockers, ...postReadiness.blockers];
+	const finalBlockingReasons = finalBlockers.map((blocker) => blocker.reason);
+	humanBlockingReasons.push(...postReadiness.blockers.map((blocker) => blocker.reason));
+	ledger.blockingReasons = finalBlockingReasons;
 	return {
-		message: `Git origin ${origin} does not match ${profile.repository.owner}/${profile.repository.name}.`,
-		name: "git-origin",
-		status: "warning"
+		blockedReasons: finalBlockers.map((blocker) => ({
+			code: blocker.demand,
+			detail: blockedReasonDetail(blocker.reason)
+		})),
+		blockingReasons: finalBlockingReasons,
+		humanBlockingReasons,
+		ledger,
+		repairs,
+		status: postReadiness.status(status)
 	};
-}
-function readGitOrigin(cwd) {
+};
+//#endregion
+//#region src/admission-preflight.ts
+const errorMessage$1 = (error) => error instanceof Error ? error.message : String(error);
+const resolveCandidate = ({ base, cwd, verifyProof }) => {
 	try {
-		return execFileSync("git", [
-			"remote",
-			"get-url",
-			"origin"
-		], {
+		const files = changedFiles(cwd, base);
+		const { headSha, mergeBaseSha: mergeBaseSha$1, patchId } = resolveCandidateIdentity({
+			base,
 			cwd,
-			encoding: "utf-8",
-			stdio: [
-				"ignore",
-				"pipe",
-				"ignore"
-			]
-		}).trim();
-	} catch {
-		return null;
-	}
-}
-function repositoryUrlMatches(origin, profile) {
-	const normalized = origin.replace(/\.git$/u, "");
-	const repoPath = `${profile.repository.owner}/${profile.repository.name}`;
-	return normalized.endsWith(`github.com:${repoPath}`) || normalized.endsWith(`github.com/${repoPath}`) || normalized.endsWith(repoPath);
-}
-//#endregion
-//#region src/commands/doctor.ts
-function createDoctorCommand(output) {
-	return new Command("doctor").description("Validate a project profile without mutating GitHub or local files").option("--base <ref>", "base branch or ref for --preflight", "origin/main").option("--cwd <path>", "working directory to validate", ".").option("--json", "print the doctor report as JSON").option("--preflight", "also list every admission requirement for the current candidate (read-only; never blocks)").option("--profile <path>", "path to the project profile JSON file").action((options) => {
-		const report = doctorProjectProfile({
-			base: options.base,
-			cwd: resolveCwdOption(options.cwd),
-			preflight: options.preflight,
-			profilePath: options.profile
+			git: {
+				currentHeadSha,
+				mergeBaseSha,
+				stablePatchId
+			}
 		});
-		if (options.json) output.stdout.write(`${JSON.stringify(report, null, 2)}\n`);
-		else output.stdout.write(formatHumanReport(report));
-		if (!report.ok) process.exitCode = 1;
-	});
-}
-function formatHumanReport(report) {
-	return [
-		`Profile: ${report.projectKey} (schema ${report.schemaVersion})`,
-		`Repository: ${report.repository.owner}/${report.repository.name} default ${report.repository.defaultBranch}`,
-		`Path: ${report.profilePath}`,
-		"",
-		...report.checks.map((check) => `[${check.status}] ${check.name}: ${check.message}`),
-		""
-	].join("\n");
-}
-//#endregion
-//#region src/epic-structure.ts
-/**
-* Producer-side `epic-structure` v1 emitter (epic #132, lane #135).
-*
-* `psf epic:publish-structure` reads a planner's ephemeral `dag.yml` (never
-* committed — see epic #132 / ADR 0018), validates the graph fail-closed, and
-* POSTs an `epic-structure` v1 event to HQ's `/api/ingest` boundary. This
-* module is the pure core: parse-to-IR validation, the wire mapping, and the
-* deterministic content-addressed eventId. All I/O (stdin/file read, fetch)
-* lives in the command wrapper.
-*
-* WIRE PARITY (do not fork the schema): the emitted payload is the exact shape
-* HQ's `EpicGraphSchema` accepts (`software-factory-hq/src/contracts/
-* epic-schemas.ts`) and is built by hand the same way `seed-dev.ts` builds it
-* — no re-declared zod twin. HQ's `epic-structure-parity.test.ts` imports
-* {@link buildEpicStructureEvent} and runs its output through the real
-* `EpicGraphSchema`, so any drift (field, enum, bound, strictness) fails CI.
-*
-* The `dag.yml` schema itself is documented with the epic skill (lane #137);
-* this module is the executable contract, not a second source of truth.
-*/
-const EPIC_STRUCTURE_SCHEMA_VERSION = 1;
-/**
-* DAG-node PLANNING statuses — the planning-plane vocabulary a planner authors
-* on a `dag.yml` node. Carried forward by ADR 0018 §4 and defined by the epic
-* skill (`reference/epic-artifacts.md`) and both `CONTEXT.md` glossaries.
-*
-* A DAG node is a unit of *plan*; an HQ lane is a unit of *runtime execution*.
-* These are two planes with two vocabularies and must not be conflated — the
-* producer validates and emits ONLY planning statuses:
-*
-*   - `open`              authored, not yet done
-*   - `closed`            done (a PR merged, or otherwise resolved)
-*   - `satisfied-on-main` already true on main without a dedicated PR
-*   - `parked`            real node, scope still moving — relabeled off
-*                         `ready-for-agent`, never closed
-*
-* HQ's `DagNodeSchema` (`software-factory-hq/src/contracts/epic-schemas.ts`)
-* accepts this planning vocabulary on ingest AND overlays a runtime LANE status
-* onto a node once a lane is linked (`syncNodesWithLanes` /
-* `projectEpicMembership`) — the overlay is HQ-internal; the producer never
-* emits a lane status. HQ's `epic-structure-parity.test.ts` fails CI if the
-* producer emits any status HQ won't accept.
+		return { candidate: {
+			classification: verifyProof && evidenceFresh({
+				candidate: { patchId },
+				recorded: { patchId: verifyProof.patchId },
+				rule: "patch-id"
+			}) ? verifyProof.classification : void 0,
+			files,
+			headSha,
+			mergeBaseSha: mergeBaseSha$1,
+			patchId
+		} };
+	} catch (error) {
+		return { error: errorMessage$1(error) };
+	}
+};
+/**
+* Authoring-session identity. Not modelled by readiness: `pr:verify` enforces
+* it unconditionally at the command layer (v0.13.2 on) and records it on the
+* proof, so it can only fail at verification runtime — which is exactly the
+* late discovery #292 exists to remove.
 */
-const EPIC_STRUCTURE_NODE_STATUSES = [
-	"open",
-	"closed",
-	"satisfied-on-main",
-	"parked"
-];
+const authoringSessionCheck = (env) => {
+	const discovered = discoverFactorySessionId(env);
+	return discovered ? {
+		message: `Authoring session resolves from FACTORY_SESSION_ID (${discovered}); pr:verify records it on the proof.`,
+		name: "admission:authoring-session",
+		status: "ok"
+	} : {
+		message: "FACTORY_SESSION_ID is unset, so pr:verify requires --authoring-session <id>; without one it fails at verification runtime, and any review-type evidence stays unconfirmable (fail closed).",
+		name: "admission:authoring-session",
+		status: "warning"
+	};
+};
 /**
-* Fail-closed validation error carrying every offending node/edge diagnostic.
+* Verification proof at the current head. The verdict comes from the single
+* shared verify-once applicability entry point (#692 / ADR 0016), and a refusal
+* is rendered with readiness's own blocking reason — never a second opinion.
 */
-var EpicStructureValidationError = class extends Error {
-	diagnostics;
-	constructor(diagnostics) {
-		super(`epic:publish-structure refused: dag graph is invalid\n${diagnostics.map((line) => `  - ${line}`).join("\n")}`);
-		this.name = "EpicStructureValidationError";
-		this.diagnostics = diagnostics;
-	}
+const verifyProofCheck = ({ candidate, candidateError, preread, verifyProofPath }) => {
+	if (!candidate) return {
+		message: `Verification proof state is unknown: no git candidate is resolvable here (${candidateError ?? "unknown error"}).`,
+		name: "admission:verify-proof",
+		status: "warning"
+	};
+	const { verificationProof } = resolveVerifyProofApplicability({
+		currentVerifyIdentityForBase: () => ({ patchId: candidate.patchId }),
+		explicitProof: false,
+		files: candidate.files,
+		headSha: candidate.headSha,
+		preread,
+		proofPath: verifyProofPath
+	});
+	if (verificationProof.kind === "typed") return {
+		message: `Applicable ${verificationProof.proof.mode} pr:verify proof for head ${candidate.headSha} (verified at ${verificationProof.proof.headSha}); pr:publish will reuse it.`,
+		name: "admission:verify-proof",
+		status: "ok"
+	};
+	return {
+		message: verificationProofBlockingReason(verificationProof) ?? "No applicable pr:verify proof covers this candidate.",
+		name: "admission:verify-proof",
+		status: "warning"
+	};
 };
-const isPlainObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-const nonEmptyString = (value) => typeof value === "string" && value.trim().length > 0;
-const isPositiveInteger = (value) => typeof value === "number" && Number.isInteger(value) && value > 0;
-const slugify = (value) => value.trim().toLowerCase().replaceAll(/[^a-z0-9]+/gu, "-").replaceAll(/^-+|-+$/gu, "") || "epic";
-const laneIdFor = (repo, issue) => `lane-${repo}-issue-${issue}`;
-const validateNodes = (rawNodes, diagnostics) => {
-	const nodes = [];
-	const slugs = /* @__PURE__ */ new Set();
-	for (const [index, raw] of rawNodes.entries()) {
-		if (!isPlainObject(raw)) {
-			diagnostics.push(`node[${index}]: expected a mapping`);
-			continue;
-		}
-		const label = nonEmptyString(raw.slug) ? `"${raw.slug}"` : `node[${index}]`;
-		if (!nonEmptyString(raw.slug)) diagnostics.push(`node[${index}]: missing required \`slug\``);
-		else if (slugs.has(raw.slug)) diagnostics.push(`node ${label}: duplicate slug`);
-		else slugs.add(raw.slug);
-		if (!nonEmptyString(raw.title)) diagnostics.push(`node ${label}: missing required \`title\``);
-		const external = raw.external === true;
-		if (!external && !isPositiveInteger(raw.issue)) diagnostics.push(`node ${label}: \`issue\` number is required — non-external nodes must carry a minted issue (this runs post-ratification); set \`external: true\` to exempt an adoption/upstream node`);
-		let status = "open";
-		if (raw.status === void 0) status = "open";
-		else if (EPIC_STRUCTURE_NODE_STATUSES.includes(raw.status)) status = raw.status;
-		else diagnostics.push(`node ${label}: \`status\` must be one of ${EPIC_STRUCTURE_NODE_STATUSES.join(", ")} (DAG-node planning statuses, not HQ lane statuses)`);
-		if (raw.laneId !== void 0 && !nonEmptyString(raw.laneId)) diagnostics.push(`node ${label}: \`laneId\` must be a non-empty string`);
-		nodes.push({
-			external,
-			...isPositiveInteger(raw.issue) ? { issue: raw.issue } : {},
-			...nonEmptyString(raw.laneId) ? { laneId: raw.laneId } : {},
-			slug: nonEmptyString(raw.slug) ? raw.slug : `node[${index}]`,
-			status,
-			title: nonEmptyString(raw.title) ? raw.title : ""
-		});
-	}
+/**
+* Independent review proof. Requiredness comes from the profile-resolved review
+* modes; currency and acceptance come from the same identity and
+* terminal-state helpers `pr:publish` uses.
+*/
+const reviewProofCheck = ({ candidate, candidateError, profile, proof, reviewModes }) => {
+	const name = "admission:review-proof";
+	if (!candidate) return {
+		message: `Review proof state is unknown: no git candidate is resolvable here (${candidateError ?? "unknown error"}).`,
+		name,
+		status: "warning"
+	};
+	if (reviewModes.length === 0) return {
+		message: "Independent review is not required: no profile review mode applies to the changed files.",
+		name,
+		status: "ok"
+	};
+	const status = reviewStatus({
+		headSha: candidate.headSha,
+		patchId: candidate.patchId,
+		required: true,
+		reviewedHeadSha: proof?.headSha,
+		reviewedPatchId: proof?.patchId
+	});
+	const terminal = proof ? resolveReviewTerminalStateAcrossReviewsForPolicy(proof, resolveReviewLadderPolicy(profile)) : void 0;
+	const accepted = status === "current" && (terminal === "clean" || terminal === "accepted-with-findings");
 	return {
-		nodes,
-		slugs
+		message: accepted ? `pr:review proof is current for this candidate (${terminal}) across ${reviewModes.join(", ")}.` : `pr:review proof is ${status}${terminal ? ` (${terminal})` : ""}; ${reviewModes.join(", ")} review(s) are required. Have an independent clean session write findings and pass them to pr:publish --findings <path>.`,
+		name,
+		status: accepted ? "ok" : "warning"
 	};
 };
-const validateEdges = (rawEdges, slugs, diagnostics) => {
-	const edges = [];
-	for (const [index, raw] of rawEdges.entries()) {
-		if (!isPlainObject(raw)) {
-			diagnostics.push(`edge[${index}]: expected a mapping`);
-			continue;
-		}
-		if (raw.type !== "depends-on") continue;
-		if (!nonEmptyString(raw.from) || !nonEmptyString(raw.to)) {
-			diagnostics.push(`edge[${index}]: depends-on edge requires string \`from\` and \`to\``);
-			continue;
-		}
-		if (!slugs.has(raw.from)) diagnostics.push(`edge ${raw.from} -> ${raw.to}: \`from\` references unknown slug "${raw.from}"`);
-		if (!slugs.has(raw.to)) diagnostics.push(`edge ${raw.from} -> ${raw.to}: \`to\` references unknown slug "${raw.to}"`);
-		if (raw.from === raw.to) diagnostics.push(`edge ${raw.from} -> ${raw.to}: self-dependency (cycle)`);
-		edges.push({
-			from: raw.from,
-			to: raw.to
-		});
-	}
-	return edges;
+/**
+* PR-body sections. Readiness owns the requirement and its wording; publish
+* owns satisfying it by patching the managed sections from the two proofs, so
+* this is named rather than evaluated — the body is a live GitHub fact a
+* read-only local pass cannot see.
+*/
+const prBodySectionsCheck = () => ({
+	message: `${RENDER_PR_BODY_SECTIONS_BLOCKER_REASON} pr:publish patches those managed sections from the pr:verify and pr:review proofs.`,
+	name: "admission:pr-body-sections",
+	status: "ok"
+});
+const requiredCheckMessage = (outcome) => {
+	if (outcome.status === "out-of-scope") return `Not demanded for this candidate: ${outcome.scopeReason}.`;
+	if (outcome.status === "satisfied") return `Satisfied by a ${outcome.checkType}-type evidence envelope${outcome.matchedPath ? ` (${outcome.matchedPath})` : ""}.`;
+	return outcome.reason ?? `Required ${outcome.checkType} check has no passing, current evidence envelope.`;
 };
 /**
-* Detects a dependency cycle over the depends-on edges and returns the offending
-* cycle path (`a -> b -> a`) if one exists, else undefined. Only edges whose
-* endpoints both resolve to known slugs are walked, so unknown-slug diagnostics
-* are reported independently and never masquerade as cycles.
+* Profile-declared external required checks — the evidence-envelope demands,
+* including a preview-deploy proof when the profile declares one. Evaluated by
+* readiness's own `evaluateRequiredChecks`, so scoping, freshness and
+* independence stay exactly one implementation.
 */
-const findCycle = (slugs, edges) => {
-	const adjacency = /* @__PURE__ */ new Map();
-	for (const { from, to } of edges) if (slugs.has(from) && slugs.has(to)) {
-		const list = adjacency.get(from) ?? [];
-		list.push(to);
-		adjacency.set(from, list);
-	}
-	const UNVISITED = 0;
-	const IN_STACK = 1;
-	const DONE = 2;
-	const state = /* @__PURE__ */ new Map();
-	const stack = [];
-	const walk = (node) => {
-		state.set(node, IN_STACK);
-		stack.push(node);
-		for (const next of adjacency.get(node) ?? []) {
-			const marker = state.get(next) ?? UNVISITED;
-			if (marker === IN_STACK) {
-				const start = stack.indexOf(next);
-				return [...stack.slice(start), next];
-			}
-			if (marker === UNVISITED) {
-				const found = walk(next);
-				if (found) return found;
-			}
+const requiredCheckChecks = ({ candidate, candidateError, cwd, profile, verifyProof }) => {
+	const requiredChecks = profile.requiredChecks ?? [];
+	if (requiredChecks.length === 0) return [{
+		message: "Profile declares no requiredChecks; no external evidence envelope (including a preview-deploy proof) is demanded.",
+		name: "admission:required-checks",
+		status: "ok"
+	}];
+	if (!candidate) return [{
+		message: `${requiredChecks.length} profile requiredCheck(s) are declared but cannot be evaluated: no git candidate is resolvable here (${candidateError ?? "unknown error"}).`,
+		name: "admission:required-checks",
+		status: "warning"
+	}];
+	const { outcomes } = evaluateRequiredChecks({
+		authoringSessionIds: resolveAuthoringSessionIds({ recorded: verifyProof?.authoringSession }),
+		candidate: {
+			headSha: candidate.headSha,
+			mergeBaseSha: candidate.mergeBaseSha,
+			patchId: candidate.patchId
+		},
+		envelopes: loadEvidenceEnvelopes(cwd),
+		requiredChecks,
+		scopeContext: {
+			classification: candidate.classification,
+			labels: void 0
 		}
-		stack.pop();
-		state.set(node, DONE);
-	};
-	for (const slug of slugs) if ((state.get(slug) ?? UNVISITED) === UNVISITED) {
-		const found = walk(slug);
-		if (found) return found;
-	}
+	});
+	return outcomes.map((outcome) => ({
+		message: requiredCheckMessage(outcome),
+		name: `admission:required-check:${outcome.name}`,
+		status: outcome.status === "unmet" ? "warning" : "ok"
+	}));
+};
+/**
+* The full admission checklist for the current repository and candidate, in the
+* order the requirements bind: identity, verification proof, review proof,
+* PR-body sections, external evidence demands. The factory GitHub App
+* requirement is reported by the doctor `github-app` check, which states the
+* consequence of its absence.
+*/
+const admissionPreflightChecks = ({ base = "origin/main", cwd, env = process.env, hqIngestCredentials, profile, reviewProofPath = DEFAULT_PR_REVIEW_PROOF_PATH, verifyProofPath = DEFAULT_PR_VERIFY_PROOF_PATH }) => {
+	const resolvedVerifyProofPath = path.resolve(cwd, verifyProofPath);
+	const preread = tryReadProof(readPrVerifyProof, resolvedVerifyProofPath);
+	const resolved = resolveCandidate({
+		base,
+		cwd,
+		verifyProof: preread.proof
+	});
+	const candidate = "candidate" in resolved ? resolved.candidate : void 0;
+	const candidateError = "error" in resolved ? resolved.error : void 0;
+	const reviewProof = readOptionalProofFor(PR_REVIEW_PROOF_DESCRIPTOR, cwd, reviewProofPath);
+	return [
+		authoringSessionCheck(env),
+		verifyProofCheck({
+			candidate,
+			candidateError,
+			preread,
+			verifyProofPath: resolvedVerifyProofPath
+		}),
+		reviewProofCheck({
+			candidate,
+			candidateError,
+			profile,
+			proof: reviewProof,
+			reviewModes: candidate ? resolveApplicableReviewModes(profile, candidate.files) : profile.review.modes
+		}),
+		prBodySectionsCheck(),
+		...requiredCheckChecks({
+			candidate,
+			candidateError,
+			cwd,
+			profile,
+			verifyProof: preread.proof
+		}),
+		hqIngestCredentialCheck({
+			env,
+			...hqIngestCredentials === void 0 ? {} : { references: hqIngestCredentials }
+		})
+	];
 };
-const resolveEpicId = (epic) => {
-	if (typeof epic === "number") return String(epic);
-	if (nonEmptyString(epic)) return epic.trim();
+//#endregion
+//#region src/doctor-hq-checks.ts
+const HQ_SPOOL_CHECK_NAME = "hq-spool";
+const HQ_RETRO_READBACK_CHECK_NAME = "hq-retro-readback";
+const TRUSTED_LOCAL_NOTE = "This resolves HQ Access credentials the same way `psf hq:flush` and `psf pr:publish` do; both require a trusted local session.";
+const FLUSH_REMEDY = "Run `psf hq:flush` to drain them.";
+/** One sentence per orphaned location, with the `--dir` recovery it needs. */
+const describeOrphans = (orphans) => {
+	const described = orphans.map((orphan) => `${orphan.directory} (${orphan.unlistable > 0 && orphan.pending === 0 ? "could not be inspected" : `${orphan.pending} event(s)`})`).join(", ");
+	return ` ${orphans.length} spool location(s) hold this repository's evidence under an earlier key it no longer resolves to — a key-format change strands evidence there where no drain looks: ${described}. Drain each with \`psf hq:flush --dir <path>\`.`;
 };
 /**
-* Validates a dag document fail-closed. Throws {@link
-* EpicStructureValidationError} with a diagnostic per offending node/edge.
+* Red when HQ evidence is waiting for this repository: its own spool or legacy
+* journal, or a sibling location written under an earlier key of its own that
+* it no longer resolves to (#420). Another repository's spool under the shared
+* root is that repository's business, never this check's (#446).
+*
+* Reuses `countHqSpoolWork` (#414) — the same read-only, credential-free
+* inspection `hq:flush` itself consults before ever resolving a secret — so
+* doctor and the flush command can never disagree about what "empty" means.
+*
+* The orphan sweep is the half that makes the check honest. Both readers of
+* the spool resolve exactly one key, so evidence written under an older one is
+* invisible to a drain and, before this, to doctor: the failure epic #389 was
+* chartered to end is evidence that is neither delivered nor visibly stranded.
+* An orphan holding pending events is red for the same reason the repo-keyed
+* spool is.
 */
-const validateDagDocument = (input) => {
-	const doc = input.document;
-	const diagnostics = [];
-	if (!isPlainObject(doc)) throw new EpicStructureValidationError(["dag document must be a YAML/JSON mapping with `epic` and `nodes`"]);
-	const epicId = resolveEpicId(doc.epic);
-	if (epicId === void 0) diagnostics.push("dag document requires a top-level `epic` id");
-	const repo = input.repo ?? (nonEmptyString(doc.repo) ? doc.repo.trim() : void 0);
-	if (repo === void 0) diagnostics.push("repo is required — pass `--repo <name>` or set `repo:` in the dag document (needed for the epic record and lane-id derivation)");
-	const rawNodes = Array.isArray(doc.nodes) ? doc.nodes : void 0;
-	if (rawNodes === void 0 || rawNodes.length === 0) diagnostics.push("dag document requires a non-empty `nodes` array");
-	const { nodes, slugs } = validateNodes(rawNodes ?? [], diagnostics);
-	const edges = validateEdges(Array.isArray(doc.edges) ? doc.edges : [], slugs, diagnostics);
-	const cycle = findCycle(slugs, edges);
-	if (cycle) diagnostics.push(`dependency cycle detected: ${cycle.join(" -> ")}`);
-	if (diagnostics.length > 0 || epicId === void 0 || repo === void 0) throw new EpicStructureValidationError(diagnostics);
+async function hqSpoolDoctorCheck(input, dependencies = {}) {
+	const countSpool = dependencies.countSpool ?? countHqSpoolWork;
+	const sweepOrphans = dependencies.sweepOrphans ?? sweepHqSpoolOrphans;
+	const [counted, swept] = await Promise.all([countSpool({
+		cwd: input.cwd,
+		repository: input.repository
+	}, { env: input.env }), sweepOrphans({ repository: input.repository }, { env: input.env })]);
+	const orphanNote = swept.orphans.length === 0 ? "" : describeOrphans(swept.orphans);
+	if (counted.pending === 0 && counted.unlistable === 0 && swept.orphans.length === 0) return {
+		message: "HQ spool and journal are empty; no evidence is waiting to be drained.",
+		name: HQ_SPOOL_CHECK_NAME,
+		status: "ok"
+	};
+	const locationsNote = counted.spools.length > 0 ? ` Locations: ${counted.spools.join(", ")}.` : "";
+	const oldestNote = counted.oldestQueuedAt === void 0 ? "" : ` Oldest entry queued ${counted.oldestQueuedAt}.`;
+	if (counted.pending > 0) return {
+		message: `${counted.pending} HQ event(s) are spooled locally.${oldestNote}${locationsNote} ${FLUSH_REMEDY}${orphanNote}`,
+		name: HQ_SPOOL_CHECK_NAME,
+		status: "error"
+	};
+	if (counted.unlistable > 0) return {
+		message: `${counted.unlistable} spool location(s) exist but could not be listed within budget, so this cannot be reported as empty.${locationsNote} ${FLUSH_REMEDY}${orphanNote}`,
+		name: HQ_SPOOL_CHECK_NAME,
+		status: "error"
+	};
 	return {
-		boundary: slugify(input.boundary ?? (nonEmptyString(doc.boundary) ? doc.boundary : `epic-${epicId}`)),
-		edges,
-		epicId,
-		name: input.name ?? (nonEmptyString(doc.name) ? doc.name.trim() : `Epic ${epicId}`),
-		nodes,
-		repo
+		message: `This repository's HQ spool is empty, but stranded evidence is waiting under the spool root ${swept.root}.${orphanNote}`,
+		name: HQ_SPOOL_CHECK_NAME,
+		status: "error"
 	};
+}
+const readJsonFiles = async (dir, readFileImpl) => {
+	let names;
+	try {
+		names = await readdir(dir);
+	} catch {
+		return [];
+	}
+	const jsonNames = names.filter((name) => name.endsWith(".json"));
+	const files = [];
+	for (const name of jsonNames) try {
+		const contents = await readFileImpl(path.join(dir, name), "utf-8");
+		files.push({
+			contents,
+			name
+		});
+	} catch {}
+	return files;
 };
 /**
-* Builds the wire payload with deterministic ordering (nodes by slug, edges by
-* from then to) so re-emission of the same graph is byte-stable regardless of
-* the planner's source ordering — the basis for the content-addressed eventId.
+* How many closeout artifacts one check verifies, newest first. A bound keeps
+* doctor from turning a long-lived repository's closeout history into a burst
+* of HQ requests; anything past it downgrades the verdict to `warning` and is
+* named in the message, because a cap that only shows up in prose reads as
+* full coverage to every caller that reads the status.
 */
-const buildEpicStructurePayload = (dag) => {
-	const nodes = dag.nodes.map((node) => {
-		const laneId = node.laneId ?? (node.issue === void 0 ? void 0 : laneIdFor(dag.repo, node.issue));
+const MAX_VERIFIED_EPICS = 10;
+/** Every parseable closeout artifact, newest `generatedAt` first. */
+const findCloseoutArtifacts = async (dir, readFileImpl) => {
+	const files = await readJsonFiles(dir, readFileImpl);
+	const artifacts = [];
+	for (const file of files) try {
+		const parsed = JSON.parse(file.contents);
+		if (typeof parsed.epic !== "string" || typeof parsed.generatedAt !== "string") continue;
+		artifacts.push({
+			epic: parsed.epic,
+			generatedAt: parsed.generatedAt
+		});
+	} catch {}
+	return artifacts.toSorted((left, right) => left.generatedAt < right.generatedAt ? 1 : -1);
+};
+const DEFAULT_READBACK_TIMEOUT_MS = 5e3;
+/**
+* Reads back whether `epic`'s retro envelope landed in HQ, through the
+* epic-keyed route #423 provides (`GET /api/ingest/retro-envelope?epic=…`).
+* Unlike the eventId-keyed receipt route (#260), this never depends on a
+* locally remembered event id, so it answers for epics closed long before
+* this session — including every epic closed before this check existed.
+*/
+const fetchEpicRetroReadback = async (endpointOrigin, epic, credentials, fetchImpl, timeoutMs) => {
+	const url = new URL("/api/ingest/retro-envelope", endpointOrigin);
+	url.searchParams.set("epic", epic);
+	const controller = new AbortController();
+	const timer = setTimeout(() => controller.abort(), timeoutMs);
+	try {
+		const response = await fetchImpl(url.toString(), buildCloudflareAccessRequestInit(credentials, {
+			method: "GET",
+			signal: controller.signal
+		}));
+		if (!response.ok) return {
+			detail: `HTTP ${response.status}`,
+			status: "unreachable"
+		};
 		return {
-			epicId: dag.epicId,
-			...laneId === void 0 ? {} : { laneId },
-			slug: node.slug,
-			status: node.status,
-			title: node.title
+			readback: await response.json(),
+			status: "ok"
 		};
-	}).toSorted((a, b) => a.slug.localeCompare(b.slug));
-	return {
-		edges: dag.edges.map((edge) => ({
-			epicId: dag.epicId,
-			from: edge.from,
-			to: edge.to,
-			type: "depends-on"
-		})).toSorted((a, b) => a.from.localeCompare(b.from) || a.to.localeCompare(b.to)),
-		epics: [{
-			id: dag.epicId,
-			name: dag.name,
-			repo: dag.repo
-		}],
-		nodes
-	};
-};
-/** Stable, key-sorted JSON for content hashing (values already ordered). */
-const stableStringify = (value) => {
-	if (Array.isArray(value)) return `[${value.map(stableStringify).join(",")}]`;
-	if (isPlainObject(value)) return `{${Object.keys(value).toSorted().map((key) => `${JSON.stringify(key)}:${stableStringify(value[key])}`).join(",")}}`;
-	return JSON.stringify(value ?? null);
+	} catch (error) {
+		return {
+			detail: error instanceof Error ? error.message : String(error),
+			status: "unreachable"
+		};
+	} finally {
+		clearTimeout(timer);
+	}
 };
 /**
-* Deterministic eventId = `epic-structure-<boundary>-<sha256(payload)[0:16]>`.
-* Re-emitting identical graph content yields the same eventId (HQ dedups →
-* 200/duplicate); an amendment changes the content hash → a new eventId that
-* supersedes the prior structure wholesale (HQ keeps the latest). This mirrors
-* seed-dev's fixed-eventId idempotency, content-addressed instead of literal.
+* Reads back each epic in turn and sorts it into confirmed, missing, or
+* unreachable. A degraded envelope counts as missing: the lookup is by epic,
+* and either way the epic has no trusted retro record.
 */
-const epicStructureEventId = (boundary, payload) => `epic-structure-${slugify(boundary)}-${createHash("sha256").update(stableStringify(payload)).digest("hex").slice(0, 16)}`;
+const readBackEachEpic = async (artifacts, endpoint, credentials, dependencies) => {
+	const tally = {
+		confirmed: [],
+		missing: [],
+		unreachable: []
+	};
+	for (const artifact of artifacts) {
+		const result = await fetchEpicRetroReadback(endpoint, artifact.epic, credentials, dependencies.fetch ?? fetch, dependencies.timeoutMs ?? DEFAULT_READBACK_TIMEOUT_MS);
+		if (result.status === "unreachable") tally.unreachable.push(`${artifact.epic} (${result.detail})`);
+		else if (!result.readback.found || result.readback.degraded === true) tally.missing.push(artifact.epic);
+		else tally.confirmed.push(artifact.epic);
+	}
+	return tally;
+};
 /**
-* Validates and builds the full `epic-structure` v1 ingest event, ready to POST
-* to `/api/ingest`. Throws {@link EpicStructureValidationError} fail-closed.
+* For each closed epic with a local closeout artifact, confirms its retro
+* envelope actually reached HQ — read through the epic-keyed
+* route #423 provides, using the same gate-sink service token `hq:flush`
+* uses.
+*
+* Epic-keyed rather than eventId-keyed (#423): `retro_envelopes.epic_ref` is a
+* durable key that survives the spool entry's own deletion, so this verifies
+* epics closed at any point in the past — not only ones closed after this
+* check started running. No local sidecar of any kind is consulted.
+*
+* Unreachable HQ (network failure, timeout, a non-2xx response) is a warn:
+* inconclusive, not proof of absence. A confirmed-missing envelope is red.
+* Absent local artifacts or unresolvable credentials are each reported
+* precisely rather than folded into one generic status. The check can only
+* report `ok` on a positive `found: true` response from HQ — never on the
+* absence of a negative signal. That rule is why absent local artifacts warn
+* rather than pass (#437): the artifact directory is worktree-local, so
+* "nothing to verify" is a statement about this checkout, not about HQ.
+*
+* Artifacts are verified newest first, not only the newest one — an older
+* epic's missing envelope must not be masked by a later successful closeout.
+* Coverage is bounded at `MAX_VERIFIED_EPICS` (10) so a long closeout history
+* cannot turn one diagnostic into a burst of HQ requests. When the bound
+* leaves an artifact unverified the verdict is `warning`, not `ok` with a
+* footnote (#446): the same rule as absent artifacts, since an unchecked epic
+* is an absence of evidence too.
+* Credentials go only to an origin the operator authorized in
+* `hqAllowedOrigins`, the same refusal `hq:flush` and the emit sink make for
+* the same token, and that refusal comes before any reference is resolved.
 */
-const buildEpicStructureEvent = (input) => {
-	const dag = validateDagDocument(input);
-	const payload = buildEpicStructurePayload(dag);
+async function hqRetroReadbackDoctorCheck(input, dependencies = {}) {
+	const readFileImpl = dependencies.readFile ?? readFile;
+	if (input.endpoint === void 0) return {
+		message: "HQ ingest is disabled (or unconfigured) in this project's profile; nothing to verify remotely.",
+		name: HQ_RETRO_READBACK_CHECK_NAME,
+		status: "ok"
+	};
+	const endpointOrigin = new URL(input.endpoint).origin;
+	if (!(tryUserConfig({ env: input.env })?.config.hqAllowedOrigins ?? []).includes(endpointOrigin)) return {
+		message: `Skipping the HQ retro-envelope read-back: endpoint origin ${endpointOrigin} is not authorized by hqAllowedOrigins in the operator user config, and this check sends the gate-sink service token. Authorize the origin to verify read-back.`,
+		name: HQ_RETRO_READBACK_CHECK_NAME,
+		status: "warning"
+	};
+	const closeoutsDir = input.closeoutsDir ?? path.join(input.cwd, ".factory-memory/closeouts");
+	const artifacts = await findCloseoutArtifacts(closeoutsDir, readFileImpl);
+	if (artifacts.length === 0) return {
+		message: `No local closeout artifacts under ${closeoutsDir}, so HQ read-back could not be verified. This is not a pass: the artifacts are worktree-local, so a fresh checkout has none. Run this check from a worktree that ran \`factory:closeout\`, or verify the epic in HQ directly.`,
+		name: HQ_RETRO_READBACK_CHECK_NAME,
+		status: "warning"
+	};
+	const verified = artifacts.slice(0, MAX_VERIFIED_EPICS);
+	const unverifiedNote = artifacts.length > verified.length ? ` (${artifacts.length - verified.length} older epic(s) not checked; this check verifies the ${MAX_VERIFIED_EPICS} most recent)` : "";
+	const resolution = resolveHqCredentials({
+		env: input.env,
+		...input.references === void 0 ? {} : { references: input.references },
+		...dependencies.resolve === void 0 ? {} : { resolve: dependencies.resolve }
+	});
+	if (resolution.status !== "resolved") return {
+		message: `Skipping the HQ retro-envelope read-back for epic ${verified[0]?.epic}: ${describeHqCredentialFailure(resolution)} ${TRUSTED_LOCAL_NOTE}`,
+		name: HQ_RETRO_READBACK_CHECK_NAME,
+		status: "warning"
+	};
+	const { confirmed, missing, unreachable } = await readBackEachEpic(verified, input.endpoint, resolution.credentials, dependencies);
+	if (missing.length > 0) return {
+		message: `Epic(s) ${missing.join(", ")} have no trusted retro record in HQ. Run \`psf hq:flush\` if the envelope is still spooled, or re-run factory:closeout, then check again. An envelope HQ stored as degraded reports the same way: the lookup is by epic, and ingest records the epic reference only for an envelope it could parse.${unverifiedNote}`,
+		name: HQ_RETRO_READBACK_CHECK_NAME,
+		status: "error"
+	};
+	if (unreachable.length > 0) return {
+		message: `HQ was unreachable while verifying epic(s) ${unreachable.join("; ")}. Treating as unverified, not missing.${confirmed.length > 0 ? ` Confirmed present: ${confirmed.join(", ")}.` : ""}${unverifiedNote}`,
+		name: HQ_RETRO_READBACK_CHECK_NAME,
+		status: "warning"
+	};
+	return {
+		message: `Retro envelope(s) for epic(s) ${confirmed.join(", ")} are confirmed present in HQ.${unverifiedNote}`,
+		name: HQ_RETRO_READBACK_CHECK_NAME,
+		status: unverifiedNote === "" ? "ok" : "warning"
+	};
+}
+//#endregion
+//#region src/doctor.ts
+async function doctorProjectProfile(input = {}) {
+	const { path, profile } = loadProjectProfile(input);
+	const env = input.env ?? process.env;
+	const cwd = input.cwd ?? process.cwd();
+	const userConfig = resolveDoctorUserConfig(env, input.userConfig);
+	const [hqSpoolCheck, hqRetroReadbackCheck] = await Promise.all([hqSpoolDoctorCheck({
+		cwd,
+		env,
+		repository: {
+			owner: profile.repository.owner,
+			repo: profile.repository.name
+		}
+	}, input.hqSpoolDependencies), hqRetroReadbackDoctorCheck({
+		cwd,
+		...profile.hq?.enabled ? { endpoint: profile.hq.endpoint } : {},
+		env,
+		...userConfig.loaded?.config.hqIngestCredentials === void 0 ? {} : { references: userConfig.loaded.config.hqIngestCredentials }
+	}, input.hqRetroReadbackDependencies)]);
+	const checks = [
+		...buildProfileChecks(profile, cwd, {
+			env,
+			userConfig: userConfig.loaded?.config,
+			userConfigCheck: userConfig.check
+		}),
+		hqSpoolCheck,
+		hqRetroReadbackCheck,
+		...input.preflight ? admissionPreflightChecks({
+			base: input.base,
+			cwd,
+			env,
+			...userConfig.loaded?.config.hqIngestCredentials === void 0 ? {} : { hqIngestCredentials: userConfig.loaded.config.hqIngestCredentials },
+			profile,
+			profilePath: path
+		}) : []
+	];
+	return {
+		checks,
+		ok: checks.every((check) => check.status !== "error"),
+		profilePath: path,
+		projectKey: profile.project.key,
+		repository: {
+			defaultBranch: profile.repository.defaultBranch,
+			name: profile.repository.name,
+			owner: profile.repository.owner
+		},
+		schemaVersion: profile.schemaVersion
+	};
+}
+function resolveDoctorUserConfig(env, provided) {
+	const configPath = provided?.path ?? defaultUserConfigPath(env);
+	if (provided === void 0 && !existsSync(configPath)) return { check: {
+		message: `User config not found at ${configPath}; no optional operator credentials or HQ origins are configured.`,
+		name: "user-config",
+		status: "warning"
+	} };
+	try {
+		const loaded = provided ?? loadUserConfig({
+			configPath,
+			env
+		});
+		const ignoredDefaultHarness = loaded.ignoredKeys?.includes("defaultHarness") ?? false;
+		return {
+			check: {
+				message: ignoredDefaultHarness ? `defaultHarness is ignored; remove it from ${loaded.path}. The factory does not select an agent runtime.` : `Loaded schema version ${loaded.config.schemaVersion} user config from ${loaded.path}.`,
+				name: "user-config",
+				status: ignoredDefaultHarness ? "warning" : "ok"
+			},
+			loaded
+		};
+	} catch (error) {
+		return { check: {
+			message: error instanceof Error ? error.message : String(error),
+			name: "user-config",
+			status: "error"
+		} };
+	}
+}
+function buildProfileChecks(profile, cwd, userConfigInput) {
+	return [
+		{
+			message: `Loaded schema version ${profile.schemaVersion} profile for ${profile.project.key}.`,
+			name: "profile",
+			status: "ok"
+		},
+		{
+			message: `${profile.repository.owner}/${profile.repository.name} uses ${profile.repository.defaultBranch}.`,
+			name: "repository",
+			status: "ok"
+		},
+		{
+			message: `${profile.verification.commands.length} verification commands configured.`,
+			name: "verification",
+			status: "ok"
+		},
+		requiredEnvironmentCheck(profile, userConfigInput.env),
+		{
+			message: `${profile.review.modes.join(", ")} review modes configured with ${profile.review.defaultMaxCycles} cycle cap.${profile.review.standingChecklist && profile.review.standingChecklist.length > 0 ? ` Standing review checklist: ${profile.review.standingChecklist.length} line(s).` : ""}`,
+			name: "review-policy",
+			status: "ok"
+		},
+		reviewLadderCheck(profile),
+		userConfigInput.userConfigCheck,
+		githubAppCheck(userConfigInput.userConfig),
+		gitRemoteCheck(profile, cwd)
+	];
+}
+function requiredEnvironmentCheck(profile, env) {
+	const required = profile.env?.required ?? [];
+	const unset = required.filter((name) => !env[name]);
+	if (unset.length > 0) return {
+		message: `Required environment variables are unset: ${unset.join(", ")}.`,
+		name: "environment",
+		status: "error"
+	};
+	return {
+		message: required.length === 0 ? "No required environment variables declared." : `${required.length} required environment variable name(s) are set.`,
+		name: "environment",
+		status: "ok"
+	};
+}
+function githubAppCheck(userConfig) {
+	const app = userConfig?.githubApp;
+	if (!app) return {
+		message: "Patronage Factory GitHub App credentials are not configured; gate publishing will use user-token commit statuses with Details links. Proof bindings cannot publish, so hosted required checks cannot be satisfied by local proof and must go green by their own means.",
+		name: "github-app",
+		status: "warning"
+	};
+	if (!existsSync(app.privateKeyPath)) return {
+		message: `Patronage Factory GitHub App id ${app.appId} is configured, but private key ${app.privateKeyPath} was not found.`,
+		name: "github-app",
+		status: "warning"
+	};
 	return {
-		eventId: epicStructureEventId(dag.boundary, payload),
-		kind: "epic-structure",
-		observedAt: input.observedAt ?? (/* @__PURE__ */ new Date()).toISOString(),
-		payload,
-		schemaVersion: 1
+		message: `Patronage Factory GitHub App id ${app.appId} is configured${app.installationId ? ` for installation ${app.installationId}` : " with repository installation discovery"}.`,
+		name: "github-app",
+		status: "ok"
 	};
-};
-/** The prod HQ worker is reachable at `hq.patronage.com` and its frozen
-* `-v1.*.workers.dev` alias. Emitting there without an Access service token is
-* fail-closed. */
-const isProductionHqUrl = (url) => url.includes("hq.patronage.com") || /-v1\.[^/]*\.workers\.dev/iu.test(url);
-/**
-* POSTs the event to HQ ingest. Fail-closed: a production URL without a
-* Cloudflare Access service token is refused before any request; a 401/403 is
-* surfaced with actionable guidance; any non-2xx throws.
-*/
-const publishEpicStructure = async (args) => {
-	if (!args.accessServiceToken && isProductionHqUrl(args.url)) throw new Error(`epic:publish-structure refusing to publish to production ${args.url} without a Cloudflare Access service token: set CF-Access-Client-Id and CF-Access-Client-Secret`);
-	const doFetch = args.fetchImpl ?? globalThis.fetch;
-	const requestInit = args.accessServiceToken ? buildCloudflareAccessRequestInit(args.accessServiceToken, {
-		body: JSON.stringify(args.event),
-		headers: { "content-type": "application/json" },
-		method: "POST"
-	}) : {
-		body: JSON.stringify(args.event),
-		headers: { "content-type": "application/json" },
-		method: "POST"
+}
+function reviewLadderCheck(profile) {
+	const policy = resolveReviewLadderPolicy(profile);
+	return {
+		message: `Review ladder ${profile.review.ladder ? "configured" : "defaulted"}: gate cap ${policy.gate.cap}.`,
+		name: "review-ladder",
+		status: "ok"
+	};
+}
+function gitRemoteCheck(profile, cwd) {
+	const origin = readGitOrigin(cwd);
+	if (!origin) return {
+		message: "No git origin remote was available for this working directory.",
+		name: "git-origin",
+		status: "warning"
+	};
+	if (repositoryUrlMatches(origin, profile)) return {
+		message: `Git origin matches ${profile.repository.owner}/${profile.repository.name}.`,
+		name: "git-origin",
+		status: "ok"
 	};
-	let response;
-	try {
-		const normalizedUrl = args.url.replace(/\/+$/u, "");
-		response = await doFetch(normalizedUrl.endsWith("/api/ingest") ? normalizedUrl : `${normalizedUrl}/api/ingest`, requestInit);
-	} catch {
-		throw new Error(`epic:publish-structure could not reach HQ ingest at ${args.url}: request failed. Check the endpoint and network; redirects are refused to protect Cloudflare Access credentials.`);
-	}
-	const text = await response.text();
-	if (response.status === 401 || response.status === 403) throw new Error(`epic:publish-structure rejected by Cloudflare Access or HQ ingest (${response.status}): set valid CF-Access-Client-Id and CF-Access-Client-Secret service-token inputs. Response: ${text}`);
-	if (response.status < 200 || response.status >= 300) throw new Error(`epic:publish-structure failed: HQ ingest returned ${response.status} ${text}`);
-	let duplicate = false;
-	try {
-		duplicate = JSON.parse(text).duplicate === true;
-	} catch {
-		duplicate = response.status === 200;
-	}
 	return {
-		duplicate,
-		eventId: args.event.eventId,
-		status: response.status
+		message: `Git origin ${origin} does not match ${profile.repository.owner}/${profile.repository.name}.`,
+		name: "git-origin",
+		status: "warning"
 	};
-};
-//#endregion
-//#region src/commands/epic-publish-structure.ts
-const STDIN = "-";
-const readSource = (source) => {
-	const fd = source === STDIN ? 0 : source;
-	try {
-		return readFileSync(fd, "utf-8");
-	} catch (error) {
-		const cause = error instanceof Error ? error.message : String(error);
-		throw new Error(`epic:publish-structure could not read ${source === STDIN ? "stdin" : source} (${cause})`, { cause: error });
-	}
-};
-const parseDocument = (raw, source) => {
-	if (raw.trim() === "") throw new Error(`epic:publish-structure received empty input from ${source === STDIN ? "stdin" : source}`);
+}
+function readGitOrigin(cwd) {
 	try {
-		return parse(raw);
-	} catch (error) {
-		const cause = error instanceof Error ? error.message : String(error);
-		throw new Error(`epic:publish-structure could not parse YAML: ${cause}`, { cause: error });
+		return execFileSync("git", [
+			"remote",
+			"get-url",
+			"origin"
+		], {
+			cwd,
+			encoding: "utf-8",
+			stdio: [
+				"ignore",
+				"pipe",
+				"ignore"
+			]
+		}).trim();
+	} catch {
+		return null;
 	}
-};
-const buildEvent = (source, options) => {
-	return buildEpicStructureEvent({
-		document: parseDocument(readSource(source), source),
-		...options.boundary ? { boundary: options.boundary } : {},
-		...options.name ? { name: options.name } : {},
-		...options.repo ? { repo: options.repo } : {}
-	});
-};
-function createEpicPublishStructureCommand(output, deps = {}) {
-	const env = deps.env ?? process.env;
-	return new Command("epic:publish-structure").description("Emit-only: read a planner's ephemeral dag.yml (or - for stdin), validate the graph fail-closed (YAML parses, required fields, edges reference known slugs, acyclic, issue numbers on every non-external node), and POST an epic-structure v1 event to HQ ingest. Idempotent by a content-addressed eventId (re-emission of an amendment supersedes the prior structure). Production auth uses the CF-Access-Client-Id and CF-Access-Client-Secret environment inputs. URL: --url or HQ_INGEST_URL. The dag.yml schema is documented with the epic skill (#137).").argument("[source]", "path to dag.yml, or - for stdin", STDIN).option("--url <url>", "HQ ingest base URL (default: HQ_INGEST_URL env). The command POSTs to <url>/api/ingest").option("--boundary <slug>", "boundary slug for the eventId namespace (default: dag `boundary:`, else `epic-<id>`)").option("--repo <name>", "repository name for the epic record and lane-id derivation (default: dag `repo:`)").option("--name <title>", "epic display name (default: dag `name:`)").option("--dry-run", "validate and build the event, print it, and exit without POSTing").option("--json", "print the built event / publish result as JSON").action(async (source, options) => {
-		const event = buildEvent(source, options);
-		if (options.dryRun) {
-			output.stdout.write(options.json ? `${JSON.stringify(event, null, 2)}\n` : `epic:publish-structure OK (dry-run) — eventId ${event.eventId}, ${event.payload.nodes.length} node(s), ${event.payload.edges.length} edge(s)\n`);
-			return;
-		}
-		const url = options.url ?? env.HQ_INGEST_URL;
-		if (!url) throw new Error("epic:publish-structure requires an HQ ingest URL: pass --url or set HQ_INGEST_URL");
-		const clientId = env[CF_ACCESS_CLIENT_ID_ENV];
-		const clientSecret = env[CF_ACCESS_CLIENT_SECRET_ENV];
-		const result = await publishEpicStructure({
-			...clientId && clientSecret ? { accessServiceToken: {
-				clientId,
-				clientSecret
-			} } : {},
-			event,
-			fetchImpl: deps.fetchImpl,
-			url
+}
+function repositoryUrlMatches(origin, profile) {
+	const normalized = origin.replace(/\.git$/u, "");
+	const repoPath = `${profile.repository.owner}/${profile.repository.name}`;
+	return normalized.endsWith(`github.com:${repoPath}`) || normalized.endsWith(`github.com/${repoPath}`) || normalized.endsWith(repoPath);
+}
+//#endregion
+//#region src/commands/doctor.ts
+function createDoctorCommand(output) {
+	return new Command("doctor").description("Validate a project profile without mutating GitHub or local files").option("--base <ref>", "base branch or ref for --preflight", "origin/main").option("--cwd <path>", "working directory to validate", ".").option("--json", "print the doctor report as JSON").option("--preflight", "also list the pre-checkable admission requirements for the current candidate (read-only; never blocks); findings-file shape and wave membership have no read-only pre-check").option("--profile <path>", "path to the project profile JSON file").action(async (options) => {
+		const report = await doctorProjectProfile({
+			base: options.base,
+			cwd: resolveCwdOption(options.cwd),
+			preflight: options.preflight,
+			profilePath: options.profile
 		});
-		output.stdout.write(options.json ? `${JSON.stringify(result, null, 2)}\n` : `epic:publish-structure ${result.duplicate ? "no-op (duplicate)" : "accepted"} — eventId ${result.eventId} [HTTP ${result.status}]\n`);
+		if (options.json) output.stdout.write(`${JSON.stringify(report, null, 2)}\n`);
+		else output.stdout.write(formatHumanReport(report));
+		if (!report.ok) process.exitCode = 1;
 	});
 }
+function formatHumanReport(report) {
+	return [
+		`Profile: ${report.projectKey} (schema ${report.schemaVersion})`,
+		`Repository: ${report.repository.owner}/${report.repository.name} default ${report.repository.defaultBranch}`,
+		`Path: ${report.profilePath}`,
+		"",
+		...report.checks.map((check) => `[${check.status}] ${check.name}: ${check.message}`),
+		""
+	].join("\n");
+}
 //#endregion
 //#region src/commands/evidence-emit.ts
 const readStdin = () => {
@@ -12790,6 +14277,168 @@ function createGuardCommand(output) {
 	return guard;
 }
 //#endregion
+//#region src/hq-flush.ts
+/**
+* Spools holding this repository's evidence under an earlier key of its own
+* (#420) — a question the drain itself cannot answer, because it resolves
+* exactly one key. Another repository's spool under the shared root is not
+* swept: it is that repository's ordinary work, not this one's orphan (#446).
+* An explicit `--dir` run is already the operator pointing at one
+* location on purpose, so it sweeps nothing. No credential is involved: this
+* is a directory listing.
+*/
+const orphanSpools = async (args, repository, env, sweep) => {
+	if (args.dir && args.dir.length > 0) return [];
+	return (await sweep({ repository }, { env })).orphans;
+};
+/**
+* Loads the profile, and — when it will not load — says how to drain anyway
+* (#421).
+*
+* A worktree on an old branch carries that branch's committed profile, which
+* may predate the current schema. Validation fails closed before the spool is
+* ever read, so the evidence sitting in that worktree is undrainable by the
+* command documented to drain it, at exactly the moment the worktree is most
+* likely to be deleted. Failing closed is correct and stays; the profile is
+* this command's source for the repository identity and the authorized HQ
+* origin, and neither may come from an unvalidated file.
+*
+* What was missing is the remedy. `--profile` already solves this — point it
+* at a checkout whose profile is current — and the failure text is where an
+* operator holding stranded evidence is standing when they need to know that.
+*
+* The remedy is attached to every load failure, not only the stale-schema one,
+* and the copy stays failure-agnostic for that reason: a missing file and
+* malformed JSON strand evidence the same way and take the same way out.
+* Narrating the old-branch story on all of them would explain the wrong
+* problem to two thirds of the operators who read it.
+*/
+const loadFlushProfile = (args) => {
+	try {
+		return loadProjectProfile({
+			cwd: args.cwd,
+			profilePath: args.profilePath
+		});
+	} catch (error) {
+		const message = error instanceof Error ? error.message : String(error);
+		throw new Error(`${message}\n\nhq:flush reads the profile only to learn this repository's identity and its authorized HQ origin, and it will not take either from a profile it cannot load. Evidence spooled here is still drainable: rerun with --profile pointing at a checkout whose profile loads, for example \`psf hq:flush --cwd ${args.cwd} --profile <working-checkout>/software-factory.profile.json\`.`, { cause: error });
+	}
+};
+/** Drains this repository's spooled HQ evidence and reports every event. */
+async function runHqFlush(args, dependencies = {}) {
+	const env = dependencies.env ?? process.env;
+	const { profile } = loadFlushProfile(args);
+	if (!profile.hq?.enabled) return {
+		orphans: [],
+		reason: "the project profile does not enable HQ ingest",
+		retained: 0,
+		status: "skipped"
+	};
+	const repository = {
+		owner: profile.repository.owner,
+		repo: profile.repository.name
+	};
+	const explicitDirectories = args.dir && args.dir.length > 0 ? { explicitDirectories: args.dir } : {};
+	const pending = await (dependencies.countSpool ?? countHqSpoolWork)({
+		cwd: args.cwd,
+		...explicitDirectories,
+		repository
+	}, { env });
+	const retained = pending.pending + pending.unlistable;
+	const orphans = await orphanSpools(args, repository, env, dependencies.sweepOrphans ?? sweepHqSpoolOrphans);
+	const userConfig = tryUserConfig({ env });
+	const allowedOrigins = userConfig?.config.hqAllowedOrigins ?? [];
+	const endpointOrigin = new URL(profile.hq.endpoint).origin;
+	if (!allowedOrigins.includes(endpointOrigin)) return {
+		orphans,
+		reason: `endpoint origin ${endpointOrigin} is not authorized by hqAllowedOrigins in the operator user config`,
+		retained,
+		status: "skipped"
+	};
+	if (retained === 0) return {
+		delivered: 0,
+		duplicate: 0,
+		endpoint: endpointOrigin,
+		incomplete: false,
+		orphans,
+		outcomes: [],
+		rejected: 0,
+		remaining: 0,
+		spools: pending.spools,
+		status: "flushed",
+		undeliverable: 0,
+		unreachable: 0,
+		unreachableFiles: 0
+	};
+	const resolution = resolveHqCredentials({
+		env,
+		...userConfig?.config.hqIngestCredentials === void 0 ? {} : { references: userConfig.config.hqIngestCredentials },
+		...dependencies.resolveSecret === void 0 ? {} : { resolve: dependencies.resolveSecret }
+	});
+	if (resolution.status !== "resolved") return {
+		orphans,
+		reason: `${describeHqCredentialFailure(resolution)} Nothing was drained; ${retained} event(s) remain spooled.`,
+		retained,
+		status: "skipped"
+	};
+	return {
+		...await (dependencies.flush ?? flushHqSpool)({
+			clientId: resolution.credentials.clientId,
+			clientSecret: resolution.credentials.clientSecret,
+			cwd: args.cwd,
+			endpoint: profile.hq.endpoint,
+			...explicitDirectories,
+			repository
+		}, {
+			env,
+			...dependencies.fetch ? { fetch: dependencies.fetch } : {}
+		}),
+		endpoint: endpointOrigin,
+		orphans,
+		status: "flushed"
+	};
+}
+const outcomeLine = (outcome) => `[${outcome.status}] ${outcome.kind} ${outcome.eventId}${outcome.detail === void 0 ? "" : ` — ${outcome.detail}`}`;
+const orphanLine = (orphan) => `ORPHAN SPOOL: ${orphan.directory} — ${orphan.unlistable > 0 && orphan.pending === 0 ? "could not be inspected" : `${orphan.pending} event(s)`}${orphan.oldestQueuedAt === void 0 ? "" : `, oldest ${orphan.oldestQueuedAt}`}`;
+/**
+* Orphan lines, plus the recovery instruction. This run did not drain these
+* locations and does not claim to have: the operator decides, with `--dir`.
+*/
+const orphanLines = (orphans) => orphans.length === 0 ? [] : [...orphans.map(orphanLine), `${orphans.length} spool location(s) hold this repository's evidence under an earlier key it no longer resolves to; drain each with \`psf hq:flush --dir <path>\`.`];
+/** Human rendering. Nothing here can contain a credential value. */
+function renderHqFlush(result) {
+	if (result.status === "skipped") return `${[`hq:flush skipped: ${result.reason}`, ...orphanLines(result.orphans)].join("\n")}\n`;
+	return `${[
+		`hq:flush ${result.endpoint}`,
+		...result.spools.length === 0 ? ["no spool directory found"] : result.spools.map((spool) => `spool: ${spool}`),
+		...result.outcomes.map(outcomeLine),
+		`delivered ${result.delivered}, duplicate ${result.duplicate}, rejected ${result.rejected}, undeliverable ${result.undeliverable}, unreachable ${result.unreachable}, migrated ${result.outcomes.filter((outcome) => outcome.status === "migrated").length}`,
+		...result.undeliverable > 0 ? [`${result.undeliverable} event(s) can never be delivered and were dispositioned in place, renamed with \`.undeliverable\` and left readable; they no longer count as work waiting.`] : [],
+		result.incomplete ? `INCOMPLETE: ${result.remaining} event(s) still spooled; the drain did not finish. Run hq:flush again.` : `spool drained: ${result.remaining} event(s) remain (rejections stay until HQ accepts them)`,
+		...orphanLines(result.orphans)
+	].join("\n")}\n`;
+}
+const hqFlushExitCode = (result) => {
+	if (result.status === "skipped") return result.retained > 0 ? 2 : 0;
+	if (result.unreachableFiles > 0) return 1;
+	return result.incomplete ? 2 : 0;
+};
+//#endregion
+//#region src/commands/hq-flush.ts
+function createHqFlushCommand(output, action = runHqFlush) {
+	return new Command("hq:flush").description("Drain this repository's spooled HQ evidence and report every event; exits 1 when transport failed and 2 when the drain did not finish").option("--cwd <path>", "working directory to evaluate", ".").option("--dir <path>", "drain an explicit spool directory instead of the default locations; repeatable", (value, previous = []) => [...previous, value]).option("--json", "print the flush result as JSON").option("--profile <path>", "path to the project profile JSON file").action(async (options) => {
+		const result = await action({
+			cwd: resolveCwdOption(options.cwd),
+			...options.dir ? { dir: options.dir } : {},
+			json: Boolean(options.json),
+			...options.profile ? { profilePath: options.profile } : {}
+		});
+		output.stdout.write(options.json ? `${JSON.stringify(result, null, 2)}\n` : renderHqFlush(result));
+		const exitCode = hqFlushExitCode(result);
+		if (exitCode !== 0) process.exitCode = exitCode;
+	});
+}
+//#endregion
 //#region src/follow-up.ts
 const FACTORY_CLI_EXECUTABLE = "patronage-factory";
 const FactoryCliInvocationSchema = z.object({
@@ -13323,13 +14972,18 @@ function defaultPrReadyGit() {
 		stablePatchId
 	};
 }
+/**
+* The base is the live PR's own base SHA, read per attempt (#365). An explicit
+* `--base` is an assertion to check, never the source of truth: it is refused
+* when it disagrees, so a stale value cannot silently redirect the diff.
+*/
 function authoritativePrBase({ args, cwd, git, pr }) {
 	if (args.base.length === 0) {
-		if (!git.canResolveCommit(cwd, pr.baseRefOid)) throw new Error(`The authoritative PR base ${pr.baseRefOid} is not available locally; fetch the PR base and rerun pr:ready.`);
+		if (!git.canResolveCommit(cwd, pr.baseRefOid)) throw new Error(`The authoritative PR base ${pr.baseRefOid} is not available locally; fetch the PR base and rerun.`);
 		return pr.baseRefOid;
 	}
 	const requestedBaseSha = git.resolveCommitSha(cwd, args.base);
-	if (!requestedBaseSha || !sameHeadSha(requestedBaseSha, pr.baseRefOid)) throw new Error(`pr:ready --base ${args.base} does not resolve to the authoritative PR base ${pr.baseRefOid}; fetch the base and rerun with --base ${pr.baseRefOid}.`);
+	if (!requestedBaseSha || !sameHeadSha(requestedBaseSha, pr.baseRefOid)) throw new Error(`--base ${args.base} does not resolve to the authoritative PR base ${pr.baseRefOid}; omit --base to derive it, or fetch the base and rerun.`);
 	return pr.baseRefOid;
 }
 const MERGEABLE_UNKNOWN_POLL_MS = 2e3;
@@ -13362,6 +15016,7 @@ function defaultPrReadyGithub() {
 	};
 }
 const prReadyProofSchema = z.object({
+	blockedReasons: blockedReasonsSchema.optional(),
 	blockingReasons: z.array(z.string()),
 	command: z.literal("patronage-factory pr:ready"),
 	followUp: FollowUpActionSchema.optional(),
@@ -13371,12 +15026,17 @@ const prReadyProofSchema = z.object({
 	profilePath: z.string().min(1).optional(),
 	repairs: z.array(readinessRepairSchema).default([]),
 	repository: z.string().regex(/^[^/\s]+\/[^/\s]+$/u).optional(),
-	schemaVersion: z.literal(1),
+	schemaVersion: z.literal(2),
 	status: z.enum([
 		"ready",
 		"blocked",
 		"slice-ready/not-final"
 	])
+}).superRefine((proof, context) => {
+	for (const issue of blockedReasonIssues({
+		...proof,
+		finalReviewPoint: proof.ledger.finalReviewPoint
+	})) context.addIssue(issue);
 });
 function validatePrReadyProof(value) {
 	return prReadyProofSchema.parse(value);
@@ -13388,7 +15048,7 @@ const PR_READY_PROOF_DESCRIPTOR = {
 	defaultPath: DEFAULT_PR_READY_PROOF_PATH,
 	label: "pr:ready proof",
 	parse: validatePrReadyProof,
-	schemaVersion: 1
+	schemaVersion: 2
 };
 const PR_VIEW_JSON_FIELDS = [
 	"baseRefName",
@@ -13491,7 +15151,7 @@ function readOptionalReviewProof(cwd, proofPath) {
 	return readOptionalProofFor(PR_REVIEW_PROOF_DESCRIPTOR, cwd, proofPath);
 }
 function writeProof(proof, output) {
-	writeProofJson(proof, output);
+	writeProofJson(validatePrReadyProof(proof), output);
 }
 const reportProof = (proof, output, json, report) => {
 	if (!report) return;
@@ -13647,7 +15307,7 @@ async function runPrReady(args, dependencies = {}) {
 		owner: repository.owner,
 		pr: args.pr,
 		proof: {
-			schemaVersion: 1,
+			schemaVersion: 2,
 			status: "evaluating"
 		},
 		repo: repository.name,
@@ -13801,6 +15461,7 @@ async function runPrReady(args, dependencies = {}) {
 		]);
 		else if (!pendingExternalChecksOnly) followUp = prVerifyFollowUp(authoringSession);
 		const proof = {
+			...evaluation.blockedReasons.length > 0 ? { blockedReasons: evaluation.blockedReasons } : {},
 			blockingReasons: evaluation.blockingReasons,
 			command: "patronage-factory pr:ready",
 			...followUp ? { followUp } : {},
@@ -13810,7 +15471,7 @@ async function runPrReady(args, dependencies = {}) {
 			profilePath: committedProfilePath,
 			repairs: evaluation.repairs,
 			repository: checkoutRepositorySlug,
-			schemaVersion: 1,
+			schemaVersion: 2,
 			status: evaluation.status
 		};
 		writeProof(proof, output);
@@ -13848,7 +15509,7 @@ async function runPrReady(args, dependencies = {}) {
 				pr: args.pr,
 				proof: {
 					blockingReasons: [message],
-					schemaVersion: 1,
+					schemaVersion: 2,
 					status: "blocked"
 				},
 				repo: repository.name,
@@ -14005,7 +15666,7 @@ function requiredCheckDemandGroups({ committedProfile, liveLabels, readyProof })
 	if (!committedProfile) return [{ reasons: ["Could not read the project profile from the committed PR candidate; merge-time requiredChecks policy must come from committed refs. Fetch the PR head, then re-run pr:merge-check."] }];
 	const recordedChecks = ledger?.externalChecks ?? [];
 	return (committedProfile.requiredChecks ?? []).map((requiredCheck) => ({
-		demand: `required-check:${requiredCheck.name}`,
+		demand: requiredCheckDemand(requiredCheck.name),
 		reasons: requiredCheckDriftReasons({
 			classification: ledger?.classification,
 			liveLabels,
@@ -14131,7 +15792,7 @@ function runPrMergeCheck(args, dependencies = {}) {
 				epic: args.epic
 			};
 			rungDemandGroups.push({
-				demand: `review-rung:${boundary.review}`,
+				demand: reviewRungDemand(boundary.review),
 				reasons: demandedRungSatisfactionReasons({
 					demandedRung: boundary.review,
 					liveHumanReviews: boundary.review === "human" ? fetchReviews({
@@ -14158,7 +15819,7 @@ function runPrMergeCheck(args, dependencies = {}) {
 			repository
 		}) },
 		{
-			demand: "merge-freeze",
+			demand: DEMAND_KEYS.mergeFreeze,
 			reasons: freezeReasons
 		},
 		...requiredCheckDemandGroups({
@@ -15127,11 +16788,25 @@ async function runPrPublish(args, dependencies = {}) {
 		...defaultPrReadyGithub(),
 		editPullRequestBody
 	};
+	const fetchPr = () => github.fetchPullRequest({
+		owner: profile.repository.owner,
+		pr: prNumber,
+		repo: profile.repository.name
+	});
+	const publishArgs = {
+		...args,
+		base: authoritativePrBase({
+			args,
+			cwd,
+			git: dependencies.git ?? defaultPrReadyGit(),
+			pr: fetchPr()
+		})
+	};
 	const verifyProofPath = path.resolve(cwd, args.verifyProof ?? ".factory-memory/pr-verify.json");
 	const reviewProofPath = path.resolve(cwd, args.reviewProof ?? ".factory-memory/pr-review.json");
 	const headSha = (dependencies.git?.currentHeadSha ?? currentHeadSha)(cwd);
 	const verified = await ensureVerifyProof({
-		args,
+		args: publishArgs,
 		cwd,
 		dependencies,
 		headSha,
@@ -15146,9 +16821,9 @@ async function runPrPublish(args, dependencies = {}) {
 		verified
 	});
 	const reviewProof = await ensureReviewProof({
-		args,
+		args: publishArgs,
 		currentReviewIdentity: currentReviewIdentityFor({
-			args,
+			args: publishArgs,
 			cwd,
 			dependencies,
 			headSha,
@@ -15159,11 +16834,7 @@ async function runPrPublish(args, dependencies = {}) {
 		profile,
 		reviewProofPath
 	});
-	const pr = github.fetchPullRequest({
-		owner: profile.repository.owner,
-		pr: prNumber,
-		repo: profile.repository.name
-	});
+	const pr = fetchPr();
 	const parts = renderPrBodySectionParts({
 		reviewProof,
 		verifyProof: verifyProof && verifyProofPassed(verifyProof) ? verifyProof : void 0
@@ -15234,15 +16905,43 @@ async function runPrPublish(args, dependencies = {}) {
 	};
 	if (args.json) console.log(JSON.stringify(result, null, 2));
 	else console.log(renderPublishSummary(result));
+	await deliverSpooledEvidence({
+		awaitPending: dependencies.awaitPendingIngest,
+		cwd,
+		flush: dependencies.flushHqSpool,
+		profilePath: args.profilePath
+	});
 	return result;
 }
+/**
+* Deliver whatever HQ evidence this lane spooled, at the moment the operator
+* is handing the work off (#390). Publish resolves credentials the same
+* explicit way `hq:flush` does, so a lane with no credentials in its
+* environment still gets its proofs to HQ.
+*
+* Bounded, reported, never gating: every failure mode here is a stderr line.
+* HQ is a view, so no delivery outcome may reach publish's verdict or exit
+* status.
+*/
+async function deliverSpooledEvidence({ awaitPending, cwd, flush, profilePath }) {
+	try {
+		await (awaitPending ?? awaitPendingHqIngest)();
+		const result = await (flush ?? ((args) => runHqFlush({
+			cwd: args.cwd,
+			...profilePath === void 0 ? {} : { profilePath }
+		})))({ cwd });
+		if (result.status === "skipped" || result.outcomes.length > 0 || result.orphans.length > 0 || hqFlushExitCode(result) !== 0) process.stderr.write(renderHqFlush(result));
+	} catch (error) {
+		process.stderr.write(`hq:flush advisory drain failed: ${error instanceof Error ? error.message : String(error)}\n`);
+	}
+}
 //#endregion
 //#region src/commands/pr-publish.ts
 function createPrPublishCommand(_output, action = runPrPublish) {
-	return new Command("pr:publish").description("Compose supplied proof into a ready-for-human handoff; never launches review").option("--pr <number>", "pull request number", positiveInteger("--pr")).option("--base <ref>", "base branch or ref", "origin/main").option("--authoring-session <id>", "known authoring session identity for verification retries").option("--cwd <path>", "working directory to evaluate", ".").option("--epic <number>", "epic issue containing the factory-boundary manifest; the composed readiness evaluation then applies the wave-demanded review rung (#351)", positiveInteger("--epic")).option("--findings <path>", "clean-session findings to validate when no current review proof is available").option("--json", "print the publish result as JSON").option("--output <path>", "write readiness proof JSON to a file").option("--profile <path>", "path to the project profile JSON file").option("--review-proof <path>", "pr:review proof JSON path").option("--verify-proof <path>", "pr:verify proof JSON path").action(async (options) => {
+	return new Command("pr:publish").description("Compose supplied proof into a ready-for-human handoff; never launches review").option("--pr <number>", "pull request number", positiveInteger("--pr")).option("--base <ref>", "explicit base branch or ref override").option("--authoring-session <id>", "known authoring session identity for verification retries").option("--cwd <path>", "working directory to evaluate", ".").option("--epic <number>", "epic issue containing the factory-boundary manifest; the composed readiness evaluation then applies the wave-demanded review rung (#351)", positiveInteger("--epic")).option("--findings <path>", "clean-session findings to validate when no current review proof is available").option("--json", "print the publish result as JSON").option("--output <path>", "write readiness proof JSON to a file").option("--profile <path>", "path to the project profile JSON file").option("--review-proof <path>", "pr:review proof JSON path").option("--verify-proof <path>", "pr:verify proof JSON path").action(async (options) => {
 		await action({
 			authoringSessionIds: options.authoringSession ? [options.authoringSession] : void 0,
-			base: options.base,
+			base: options.base ?? "",
 			cwd: resolveCwdOption(options.cwd),
 			epic: options.epic,
 			findings: options.findings,
@@ -15619,6 +17318,7 @@ function createProgram(options = {}) {
 	program.addCommand(createConfigCommand(output));
 	program.addCommand(createGuardCommand(output));
 	program.addCommand(createEvidenceEmitCommand(output));
+	program.addCommand(createHqFlushCommand(output));
 	program.addCommand(createBoundaryCheckCommand(output, options.actions?.boundaryCheck));
 	program.addCommand(createPrVerifyCommand(output));
 	program.addCommand(createCloseoutCommand(output));