@patronage/software-factory 0.25.0 → 0.30.0-alpha.1

package/dist/index.js

@@ -18,7 +18,7 @@ import picomatch from "picomatch";
 import { promisify } from "node:util";
 import { parse } from "yaml";
 //#region package.json
-var version = "0.25.0";
+var version = "0.30.0-alpha.1";
 //#endregion
 //#region src/review-rungs.ts
 const EVIDENCE_REVIEW_RUNGS$1 = [
@@ -45,6 +45,7 @@ const FACTORY_BOUNDARY_FENCE_LANG = "factory-boundary";
 const BOUNDARY_CLOSEOUT_DEFAULT_RUNG = "oracle";
 const rungMeetsMinimum = (rung, minimum) => RUNG_ORDER[rung] >= RUNG_ORDER[minimum];
 const rungSchema = z.enum(EVIDENCE_REVIEW_RUNGS$1);
+const GITHUB_LOGIN_PATTERN = /^[A-Za-z\d](?:[A-Za-z\d]|-(?=[A-Za-z\d])){0,38}(?:\[[bB][oO][tT]\])?$/u;
 const waveSchema = z.object({
 	autoMerge: z.boolean().optional(),
 	issues: z.array(z.number().int().positive()).min(1),
@@ -54,7 +55,7 @@ const waveSchema = z.object({
 const boundaryManifestSchema = z.object({
 	boundary: z.string().min(1),
 	closeout: z.object({ review: rungSchema }).passthrough().optional(),
-	declaredBy: z.string().min(1),
+	declaredBy: z.string().regex(GITHUB_LOGIN_PATTERN, { message: "must be a GitHub login (letters, digits, single hyphens, max 39 chars), optionally suffixed with \"[bot]\" for a GitHub App identity — not an email address or display name" }),
 	prs: z.record(z.string().regex(/^[0-9]+$/u), z.string().min(1)).optional(),
 	schemaVersion: z.literal(1),
 	topology: z.enum([
@@ -132,16 +133,17 @@ const closeoutRungFor = (manifest) => manifest.closeout?.review ?? "oracle";
 //#region src/boundary-review-proof.ts
 var boundary_review_proof_exports = /* @__PURE__ */ __exportAll({
 	BOUNDARY_REVIEW_PROOF_KIND: () => BOUNDARY_REVIEW_PROOF_KIND$1,
+	boundaryReviewProofAuthorsSeen: () => boundaryReviewProofAuthorsSeen,
 	boundaryReviewProofSchema: () => boundaryReviewProofSchema$1,
 	selectBoundaryReviewProof: () => selectBoundaryReviewProof,
 	undispositionedBlockingFindings: () => undispositionedBlockingFindings
 });
 const BOUNDARY_REVIEW_PROOF_KIND$1 = "boundary-review-proof";
-const shaSchema$7 = z.string().regex(/^[0-9a-f]{7,40}$/u, { message: "must be a 7-40 char lowercase hex git SHA" });
+const shaSchema$5 = z.string().regex(/^[0-9a-f]{7,40}$/u, { message: "must be a 7-40 char lowercase hex git SHA" });
 const coveredSetEntrySchema$1 = z.object({
-	headSha: shaSchema$7.optional(),
+	headSha: shaSchema$5.optional(),
 	issue: z.number().int().positive().optional(),
-	mergedSha: shaSchema$7.optional(),
+	mergedSha: shaSchema$5.optional(),
 	pr: z.number().int().positive(),
 	state: z.enum(["merged", "open"]),
 	wave: z.string().min(1).optional()
@@ -186,12 +188,11 @@ const boundaryReviewProofSchema$1 = z.object({
 	}).passthrough().optional()
 }).passthrough();
 const FENCED_JSON_PATTERN = /```json[ \t]*\r?\n(?<inner>[\s\S]*?)```/gu;
-const selectBoundaryReviewProof = (comments, boundary, declaredBy) => {
-	let selected;
-	const declaredByLower = declaredBy.toLowerCase();
+const collectValidBoundaryReviewProofs = (comments, boundary) => {
+	const entries = [];
 	for (const comment of comments) {
 		const commentAuthor = comment.author.login;
-		if (!commentAuthor || commentAuthor.toLowerCase() !== declaredByLower) continue;
+		if (!commentAuthor) continue;
 		for (const match of comment.body.matchAll(FENCED_JSON_PATTERN)) {
 			const inner = match.groups?.inner ?? "";
 			let raw;
@@ -203,15 +204,34 @@ const selectBoundaryReviewProof = (comments, boundary, declaredBy) => {
 			if (typeof raw !== "object" || raw === null || raw.kind !== "boundary-review-proof") continue;
 			const parsed = boundaryReviewProofSchema$1.safeParse(raw);
 			if (!parsed.success || parsed.data.boundary !== boundary) continue;
-			selected = {
+			entries.push({
+				commentAuthor,
 				...comment.id === void 0 ? {} : { commentId: comment.id },
 				...comment.url === void 0 ? {} : { commentUrl: comment.url },
 				proof: parsed.data
-			};
+			});
 		}
 	}
+	return entries;
+};
+const selectBoundaryReviewProof = (comments, boundary, declaredBy) => {
+	let selected;
+	const declaredByLower = declaredBy.toLowerCase();
+	for (const entry of collectValidBoundaryReviewProofs(comments, boundary)) {
+		if (entry.commentAuthor.toLowerCase() !== declaredByLower) continue;
+		selected = {
+			...entry.commentId === void 0 ? {} : { commentId: entry.commentId },
+			...entry.commentUrl === void 0 ? {} : { commentUrl: entry.commentUrl },
+			proof: entry.proof
+		};
+	}
 	return selected;
 };
+const boundaryReviewProofAuthorsSeen = (comments, boundary) => {
+	const authors = /* @__PURE__ */ new Set();
+	for (const entry of collectValidBoundaryReviewProofs(comments, boundary)) authors.add(entry.commentAuthor);
+	return [...authors];
+};
 const undispositionedBlockingFindings = (proof) => proof.findings.filter((finding) => (finding.category !== "maintainability" || finding.blockingAfterCap === true) && finding.disposition === void 0).map((finding) => `boundary finding "${finding.title}" (category ${finding.category ?? "unknown"}) has no disposition; fix it or record waived / follow-up-filed`);
 //#endregion
 //#region src/comment-provenance.ts
@@ -692,7 +712,7 @@ function runInheritedTee(command, args, cwd, extraEnv = {}) {
 function currentHeadSha(cwd) {
 	return runCapture("git", ["rev-parse", "HEAD"], cwd).stdout.trim();
 }
-function showFileAtRef$1(cwd, ref, absolutePath) {
+function showFileAtRef(cwd, ref, absolutePath) {
 	const rel = path.relative(cwd, absolutePath);
 	const spec = rel.startsWith(".") ? rel : `./${rel}`;
 	try {
@@ -979,38 +999,23 @@ const DIFF_CLASSIFICATIONS$1 = [
 //#endregion
 //#region src/required-check-policy.ts
 const EVIDENCE_CHECK_TYPES$1 = ["review", "verify"];
-const requiredCheckScopeSchema$1 = z.object({
-	classifications: z.array(z.enum(DIFF_CLASSIFICATIONS$1)).min(1).optional(),
-	labels: z.array(z.string().min(1)).min(1).optional()
-}).strict().superRefine((scope, context) => {
-	if (scope.labels === void 0 && scope.classifications === void 0) context.addIssue({
-		code: "custom",
-		message: "requiredChecks scope must declare at least one condition (labels and/or classifications)."
-	});
-}).meta({ anyOf: [{ required: ["classifications"] }, { required: ["labels"] }] });
+const requiredCheckScopeSchema$1 = z.object({ classifications: z.array(z.enum(DIFF_CLASSIFICATIONS$1)).min(1) }).strict();
 const requiredCheckInScope = ({ context, scope }) => {
 	if (!scope) return {
 		inScope: true,
 		reason: "unconditional: no scope declared"
 	};
-	const held = [];
-	const failed = [];
-	if (scope.labels !== void 0) if (context.labels === void 0) held.push(`label set unavailable; fail closed (scoping labels [${scope.labels.join(", ")}] treated as held)`);
-	else {
-		const present = scope.labels.filter((label) => context.labels?.includes(label));
-		if (present.length > 0) held.push(`scoping label(s) present: ${present.join(", ")}`);
-		else failed.push(`none of the scoping labels are on the PR: ${scope.labels.join(", ")}`);
-	}
-	if (scope.classifications !== void 0) if (context.classification === void 0) held.push(`classification unavailable; fail closed (scoping classifications [${scope.classifications.join(", ")}] treated as in force)`);
-	else if (scope.classifications.includes(context.classification)) held.push(`classification "${context.classification}" is in scope`);
-	else failed.push(`classification "${context.classification}" is not one of: ${scope.classifications.join(", ")}`);
-	if (failed.length > 0) return {
-		inScope: false,
-		reason: `out of scope — ${failed.join("; ")}`
+	if (context.classification === void 0) return {
+		inScope: true,
+		reason: `classification unavailable; fail closed (scoping classifications [${scope.classifications.join(", ")}] treated as in force)`
 	};
-	return {
+	if (scope.classifications.includes(context.classification)) return {
 		inScope: true,
-		reason: `in scope — ${held.join("; ")}`
+		reason: `in scope — classification "${context.classification}" is in scope`
+	};
+	return {
+		inScope: false,
+		reason: `out of scope — classification "${context.classification}" is not one of: ${scope.classifications.join(", ")}`
 	};
 };
 //#endregion
@@ -3465,7 +3470,7 @@ const runCloseoutFsWorker = async (data, budgetMs) => {
 };
 const isIsolatedReadResult = (value) => value !== null && typeof value === "object" && value.status === "read";
 const deferProjectHqIngestIsolated = async (input) => {
-	const setupDeadline = performance.now() + 750;
+	const setupDeadline = performance.now() + timeoutFor({ env: process.env });
 	let profilePath;
 	try {
 		profilePath = input.profilePath ? path.resolve(input.cwd, input.profilePath) : defaultProfilePath(input.cwd);
@@ -3557,7 +3562,7 @@ const deferProjectHqIngestIsolated = async (input) => {
 		root: layout.root,
 		segments: layout.segments,
 		type: "persist"
-	}, HQ_JOURNAL_FLUSH_BUDGET_MS);
+	}, journalFlushBudgetFor({ env: process.env }));
 	return persisted !== null && typeof persisted === "object" && persisted.status === "persisted" ? "deferred" : "held";
 };
 async function deferProjectHqIngest(input, dependencies = {}) {
@@ -3615,6 +3620,13 @@ function assertCleanWorktreeForProof({ changedFiles, cwd, dirtyMessage, statusPo
 //#region src/demand-keys.ts
 /** The demands that exist at most once per candidate. */
 const DEMAND_KEYS = {
+	/**
+	* The boundary wave that authorizes this candidate's merge schedule (#477).
+	* In force exactly when GitHub already has auto-merge enabled: a live
+	* schedule with no wave demand resolved is an unauthorized merge waiting to
+	* happen.
+	*/
+	boundaryWave: "boundary-wave",
 	/** The PR is still a draft. */
 	draft: "draft",
 	/** The candidate is not the intended final human review point. */
@@ -3629,6 +3641,12 @@ const DEMAND_KEYS = {
 	mergeFreeze: "merge-freeze",
 	/** GitHub's mergeability / merge-state rollup. */
 	mergeState: "merge-state",
+	/**
+	* A native GitHub approval, demanded when the boundary wave in force does
+	* not authorize machine merge (#477). "Green = authorized to merge" is then
+	* a property of the branded required check itself.
+	*/
+	nativeApproval: "native-approval",
 	/** The PR body's required rendered sections. */
 	prBodySections: "pr-body-sections",
 	/** A current, head-bound, passing typed `pr:verify` proof. */
@@ -3659,7 +3677,7 @@ const percentEncode = (character) => {
 * demand nobody waived, and make HQ count two causes as one.
 *
 * Deterministic in both directions of use: the key a `pr:ready` proof records
-* is the key a `pr:merge-check` waiver matches.
+* is the key a `pr:ready` waiver matches.
 */
 const demandQualifier = (value) => value.replaceAll(/[^A-Za-z0-9._/-]/gu, percentEncode);
 /** The demand one profile-declared external required check makes. */
@@ -3743,7 +3761,7 @@ const demandKeySchema = z.string().refine((value) => {
 * reason codes must come from. A waiver store is durable operator evidence
 * written before today's vocabulary existed, so tightening its validation
 * would make an existing record parse as no waiver and let the next write drop
-* it. A waiver naming a key nobody resolves is already inert — `pr:merge-check`
+* it. A waiver naming a key nobody resolves is already inert — `pr:ready`
 * reports it as an unapplied waiver — so nothing is admitted by accepting it.
 */
 const waiverDemandKeySchema = z.string().regex(/^[a-z][a-z0-9-]*(?::[A-Za-z0-9._%/-]+)?$/u, "A demand key is a lowercase family, optionally qualified by its resolved value (e.g. review-rung:human).");
@@ -3818,10 +3836,10 @@ const resolveAuthoringSessionIds = ({ override, recorded }) => {
 //#region src/demand-waiver.ts
 const DEMAND_WAIVER_SCHEMA_VERSION$1 = 1;
 const DEFAULT_DEMAND_WAIVER_PATH = ".factory-memory/demand-waivers.json";
-const shaSchema$6 = z.string().regex(/^[0-9a-f]{40}$/u);
+const shaSchema$4 = z.string().regex(/^[0-9a-f]{40}$/u);
 const demandWaiverSchema = z.object({
 	candidate: z.object({
-		headSha: shaSchema$6,
+		headSha: shaSchema$4,
 		pr: z.number().int().positive()
 	}),
 	demand: waiverDemandKeySchema,
@@ -4673,66 +4691,7 @@ const boundaryCheckProofSchema = z.object({
 	}).optional(),
 	status: z.enum(["ready", "blocked"])
 });
-const mergeGuardIdentitySchema$1 = z.discriminatedUnion("kind", [
-	z.object({
-		headSha: z.string().regex(/^[0-9a-f]{40}$/u),
-		kind: z.literal("match")
-	}),
-	z.object({
-		kind: z.literal("diverged"),
-		liveHeadSha: z.string().regex(/^[0-9a-f]{40}$/u),
-		postProofCommits: z.array(z.object({
-			sha: z.string().min(1),
-			subject: z.string()
-		})).optional(),
-		proofHeadSha: z.string().regex(/^[0-9a-f]{40}$/u)
-	}),
-	z.object({
-		kind: z.literal("live-head-invalid"),
-		pr: z.number().int().positive(),
-		received: z.string()
-	}),
-	z.object({
-		errorDetail: z.string().optional(),
-		kind: z.literal("ready-proof-missing"),
-		readyProofPath: z.string().min(1)
-	}),
-	z.object({
-		kind: z.literal("ready-proof-pr-mismatch"),
-		proofPr: z.number().int().positive(),
-		requestedPr: z.number().int().positive()
-	}),
-	z.object({
-		blockingReasons: z.array(z.string()),
-		kind: z.literal("ready-proof-not-ready"),
-		status: z.string().min(1)
-	})
-]);
-z.object({
-	blockingReasons: z.array(z.string()),
-	command: z.literal("patronage-factory pr:merge-check"),
-	followUp: followUpActionSchema.optional(),
-	identity: mergeGuardIdentitySchema$1,
-	liveHeadSha: z.string().regex(/^[0-9a-f]{40}$/u).optional(),
-	notices: z.array(z.string()).optional(),
-	pr: z.number().int().positive(),
-	schemaVersion: z.literal(1),
-	status: z.enum(["pass", "fail"]),
-	waivedDemands: z.array(waivedDemandSchema).optional(),
-	worktreeHeldBranch: z.object({
-		branch: z.string().min(1),
-		worktreePath: z.string().min(1)
-	}).optional()
-});
-const requiredCheckScopeSchema = z.object({
-	classifications: z.array(z.enum(DIFF_CLASSIFICATIONS)).min(1).optional(),
-	labels: z.array(z.string().min(1)).min(1).optional()
-}).strict().superRefine((scope, context) => {
-	if (scope.labels === void 0 && scope.classifications === void 0) context.addIssue({
-		code: "custom",
-		message: "requiredChecks scope must declare at least one condition (labels and/or classifications)."
-	});
-});
+const requiredCheckScopeSchema = z.object({ classifications: z.array(z.enum(DIFF_CLASSIFICATIONS)).min(1) }).strict();
 const readinessRepairSchema$1 = z.object({
 	action: z.string().min(1),
 	code: z.enum([
@@ -4908,19 +4867,34 @@ const managedReadinessLedgerSchema$1 = z.object({
 	})
 });
 /**
-* The pr:ready proof versions a reader still accepts. `pr:ready` emits v2 only
-* (#391) — one current contract — but v1 events were spooled before the bump
-* and HQ must ingest them without degrading, so the wire schema parses both.
+* The pr:ready proof versions a reader still accepts. `pr:ready` emits v3 only
+* (#477) — one current contract — but v1 and v2 events were spooled before the
+* bumps and HQ must ingest them without degrading, so the wire schema parses
+* all three.
 */
-const SUPPORTED_PR_READY_SCHEMA_VERSIONS = [1, 2];
+const SUPPORTED_PR_READY_SCHEMA_VERSIONS = [
+	1,
+	2,
+	3
+];
 const prReadySchemaVersionSchema = z.number().refine((value) => SUPPORTED_PR_READY_SCHEMA_VERSIONS.includes(value), { message: `schemaVersion must be one of: ${SUPPORTED_PR_READY_SCHEMA_VERSIONS.join(", ")}` });
 z.object({
+	arming: z.object({
+		detail: z.string().min(1).optional(),
+		headSha: z.string().regex(/^[0-9a-f]{40}$/u),
+		outcome: z.enum([
+			"armed",
+			"merged",
+			"not-armed"
+		])
+	}).optional(),
 	blockedReasons: blockedReasonsSchema.optional(),
 	blockingReasons: z.array(z.string()),
 	command: z.literal("patronage-factory pr:ready"),
 	followUp: followUpActionSchema.optional(),
 	humanBlockingReasons: z.array(z.string()).default([]),
 	ledger: managedReadinessLedgerSchema$1,
+	notices: z.array(z.string().min(1)).optional(),
 	profileBlobSha: z.string().regex(/^[0-9a-f]{40}$/u).optional(),
 	profilePath: z.string().min(1).optional(),
 	repairs: z.array(readinessRepairSchema$1).default([]),
@@ -4930,7 +4904,8 @@ z.object({
 		"ready",
 		"blocked",
 		"slice-ready/not-final"
-	])
+	]),
+	waivedDemands: z.array(waivedDemandSchema).optional()
 }).superRefine((proof, context) => {
 	if (proof.schemaVersion < 2) {
 		if (proof.blockedReasons !== void 0) context.addIssue({
@@ -5093,8 +5068,11 @@ const defaultResolveRepo = (cwd) => runCapture("gh", [
 	"--jq",
 	".nameWithOwner"
 ], cwd).stdout.trim();
-const evaluateProofAgainstDemands = ({ computed, demandedRung, manifestHash, selected }) => {
-	if (!selected) return { blockingReasons: [`no boundary-review proof found on the epic issue; run the boundary review at the ${demandedRung} rung and post its fenced JSON proof comment — absence fails closed`] };
+const evaluateProofAgainstDemands = ({ authorsSeen, computed, declaredBy, demandedRung, manifestHash, selected }) => {
+	if (!selected) {
+		if (authorsSeen.length === 0) return { blockingReasons: [`no boundary-review proof found on the epic issue; run the boundary review at the ${demandedRung} rung and post its fenced JSON proof comment — absence fails closed`] };
+		return { blockingReasons: [`boundary-review proof block(s) found on the epic issue, but none authored by declaredBy "${declaredBy}" (authors seen: ${authorsSeen.join(", ")}); run the boundary review at the ${demandedRung} rung from that account, or correct declaredBy if it names the wrong one`] };
+	}
 	const { proof } = selected;
 	const blockingReasons = [];
 	if (proof.manifestHash.value !== manifestHash) blockingReasons.push(`boundary-review proof was minted against a different manifest (proof hash ${proof.manifestHash.value.slice(0, 12)}…, current ${manifestHash.slice(0, 12)}…); the manifest changed since review — re-run the boundary review`);
@@ -5116,9 +5094,12 @@ function runBoundaryCheck(args, dependencies = {}) {
 	if (parsed.ok) {
 		const demandedRung = closeoutRungFor(parsed.manifest);
 		const computed = computeCoveredSet(parsed.manifest, repo, github);
-		const selected = selectBoundaryReviewProof(github.fetchIssueComments(repo, args.epic), parsed.manifest.boundary, parsed.manifest.declaredBy);
+		const comments = github.fetchIssueComments(repo, args.epic);
+		const selected = selectBoundaryReviewProof(comments, parsed.manifest.boundary, parsed.manifest.declaredBy);
 		const { blockingReasons } = evaluateProofAgainstDemands({
+			authorsSeen: selected ? [] : boundaryReviewProofAuthorsSeen(comments, parsed.manifest.boundary),
 			computed,
+			declaredBy: parsed.manifest.declaredBy,
 			demandedRung,
 			manifestHash: parsed.manifestHash,
 			selected
@@ -7122,6 +7103,21 @@ const FACTORY_CHECK_NAMES = {
 	"pr-verify": "patronage-factory/pr-verify"
 };
 const hqLaneRefUrl = (base, repo, number) => `${base}/${encodeURIComponent(repo)}/${number}`;
+/**
+* Fire-and-forget publication for a check run that is a *mirror* of a local
+* verdict — swallowing the failure cannot change what the gate decided.
+*
+* Not every branded check is a mirror any more (#477). `patronage-factory/
+* pr-ready` is a source-pinned required check in the branch ruleset: a
+* swallowed failure there leaves a candidate armed, unmergeable, and — as epic
+* #473 wave 2 measured — with no rollup row saying why. So no `pr-ready`
+* publication comes through here at all: `pr:ready` publishes once, completed,
+* through {@link ensureFactoryCheckRunPublished}, whose result the caller
+* reads. It used to publish an in-progress run here while hosted checks
+* settled, on the reasoning that a missing in-progress check cannot green
+* anything — true, and beside the point, because a *present* one cannot be
+* un-blocked and nothing ever completed it (#526).
+*/
 function publishFactoryCheckSafely(publisher, input) {
 	try {
 		publisher?.(input);
@@ -7349,7 +7345,9 @@ const checkRunRequestBody = (input, detailsUrl) => {
 * means the credentials are wrong, and re-sending them cannot help.
 *
 * Throws the last error when every attempt fails; callers decide whether to
-* fall back or to swallow.
+* fall back or to swallow. Returns the created check run, whose `id` is the
+* only handle on *which* run this call produced — what the read-back below
+* requires the served run to be.
 */
 async function postFactoryCheckRun({ config, deadlineMs, dependencies, detailsUrl, input, remainingAttempts }) {
 	const { attempts, budgetMs, delayMs } = dependencies.retry ?? DEFAULT_CHECK_RUN_RETRY;
@@ -7360,7 +7358,7 @@ async function postFactoryCheckRun({ config, deadlineMs, dependencies, detailsUr
 	const timeoutMs = dependencies.timeoutMs ?? 5e3;
 	try {
 		const token = await installationToken(input, config, request, (dependencies.now ?? Date.now)(), timeoutMs);
-		await githubJson(request, `https://api.github.com/repos/${input.owner}/${input.repo}/check-runs`, {
+		return await githubJson(request, `https://api.github.com/repos/${input.owner}/${input.repo}/check-runs`, {
 			body: JSON.stringify(checkRunRequestBody(input, detailsUrl)),
 			headers: {
 				Authorization: `Bearer ${token}`,
@@ -7371,7 +7369,7 @@ async function postFactoryCheckRun({ config, deadlineMs, dependencies, detailsUr
 	} catch (error) {
 		if (remaining <= 1 || !isRetryableCheckRunFailure(error) || deadline !== void 0 && clock() + delayMs >= deadline) throw error;
 		await (dependencies.sleep ?? defaultSleep)(delayMs);
-		await postFactoryCheckRun({
+		return await postFactoryCheckRun({
 			config,
 			deadlineMs: deadline,
 			dependencies,
@@ -7408,6 +7406,177 @@ async function resolveDetailsUrlSafely(input, dependencies, onDiagnostic) {
 	}
 }
 /**
+* Read back every run GitHub serves for this check name on this head SHA.
+*
+* `filter=all`, not `filter=latest` (#524). `latest` was chosen here on the
+* rationale that it is the view the required-check rollup reads; that rationale
+* is false, measured on PR #523's head `77cf425`. Two `patronage-factory/
+* pr-ready` runs existed there — `91323051988` (`in_progress`, stranded by
+* older code) and `91323113996` (`completed`/`success`). `latest` served the
+* completed one, while the pull request's rollup reported *both*
+* (`PENDING` and `SUCCESS`) and `mergeStateStatus` stayed `BLOCKED`. So `latest`
+* can report a publication confirmed while the gate still blocks on a different
+* run of the same name — false confidence in exactly the direction this
+* read-back exists to eliminate. The set the gate evaluates is every run of the
+* name, which is what this asks for.
+*
+* Three pins keep the answer usable as proof:
+*
+* - `app_id` — the required check is source-pinned to the factory App, so a
+*   same-named run from another installed app (a GitHub Actions job named
+*   `patronage-factory/pr-ready` materializes under integration 15368) is not
+*   the pinned requirement. Left unpinned it could confirm a publication the
+*   pinned check never got, or refuse every genuine one. This is the same
+*   fail-closed rule `checkRunProducedByFactoryApp` applies to durable records
+*   below. A run served without any `app` id is refused rather than filtered
+*   out: dropping it fails closed for the newest-run clause but open for
+*   terminality, and an unfinished run of unknown provenance still blocks the
+*   gate.
+* - `per_page=100` with a required `total_count` that equals the page — a
+*   truncated page holds neither the whole set nor a defensible newest run, and
+*   `filter=all` returns strictly more runs than `latest` did, so this guard now
+*   carries more weight. Truncation is unconfirmed, not paginated: a busy head
+*   refuses rather than judging a publication against a page that silently
+*   omits the run blocking it. An absent or malformed count cannot establish
+*   completeness at all, so it refuses too.
+* - an unparsable or absent `started_at` — unorderable state is refused before
+*   selection rather than sorting to an extreme and being chosen.
+*
+* Ordering among what survives goes through the sequencing owner rather than a
+* second rule here.
+*/
+async function servedFactoryCheckRun(input, config, dependencies) {
+	const request = dependencies.fetch ?? fetch;
+	const timeoutMs = dependencies.timeoutMs ?? 5e3;
+	const token = await installationToken(input, config, request, (dependencies.now ?? Date.now)(), timeoutMs);
+	const query = new URLSearchParams({
+		app_id: String(config.appId),
+		check_name: FACTORY_CHECK_NAMES[input.gate],
+		filter: "all",
+		per_page: "100"
+	});
+	const served = await githubJson(request, `https://api.github.com/repos/${input.owner}/${input.repo}/commits/${input.sha}/check-runs?${query.toString()}`, {
+		headers: { Authorization: `Bearer ${token}` },
+		method: "GET"
+	}, timeoutMs);
+	const page = Array.isArray(served.check_runs) ? served.check_runs : [];
+	const totalCount = served.total_count;
+	if (!(typeof totalCount === "number" && Number.isSafeInteger(totalCount))) return {
+		kind: "unavailable",
+		reason: "the served page reports no usable total_count"
+	};
+	if (totalCount !== page.length) return {
+		kind: "unavailable",
+		reason: `${page.length} runs on the page against a total_count of ${totalCount}`
+	};
+	if (page.some((run) => (run.app?.id ?? null) === null)) return {
+		kind: "unavailable",
+		reason: "a served run has no app identity"
+	};
+	const runs = page.filter((run) => String(run.app?.id ?? "") === String(config.appId));
+	const orderable = runs.flatMap((run) => {
+		const orderMs = generationOrderMs(run.started_at);
+		return Number.isFinite(orderMs) ? [{
+			orderMs,
+			run
+		}] : [];
+	});
+	if (orderable.length !== runs.length) return {
+		kind: "unavailable",
+		reason: "a served run has no usable started_at"
+	};
+	const newest = selectNewestGeneration(orderable);
+	if (newest.kind === "ambiguous") return {
+		kind: "unavailable",
+		reason: `${newest.tied.length} served runs share the newest started_at`
+	};
+	if (newest.kind === "none") return {
+		kind: "unavailable",
+		reason: "no run is served for this name"
+	};
+	return {
+		kind: "newest",
+		run: newest.generation.run,
+		runs
+	};
+}
+/** Runs GitHub has not finished. A non-terminal run blocks its required check. */
+const unfinishedRuns = (runs) => runs.filter((run) => run.status !== "completed");
+/**
+* Whether the served run *is* the publication that was just posted: the same
+* run, in the status that was asked for, and — for a completed one — with the
+* conclusion that was asked for.
+*
+* Requiring the id is what separates "GitHub serves a run that looks like
+* mine" from "GitHub serves mine". An older identical success from a previous
+* invocation satisfies every field comparison while this POST is still
+* invisible, and confirming on it is exactly the assumed-vs-live trust this
+* read-back exists to end.
+*/
+const publishedRunIsServed = (input, createdId, served) => {
+	if (createdId === void 0 || served.id !== createdId) return false;
+	const status = input.status ?? "completed";
+	if (served.status !== status) return false;
+	return status !== "completed" || served.conclusion === input.conclusion;
+};
+/**
+* Whether the required check this publication targets is *satisfied* on the
+* head: the newest run of the name is this call's own, and no run of the name
+* survives unfinished.
+*
+* The second clause is what makes the answer the *gate's* answer rather than
+* one collapsed view of it (#524). A stranded `in_progress` run of a
+* required-check name blocks its pull request permanently and is not cleared by
+* publishing a newer completed run, so a confirmation that ignores it is a lie
+* in the one direction that matters. A publication that is itself non-terminal
+* therefore never confirms — correctly, since it cannot satisfy the check
+* either. No factory gate makes one for this name any more: `pr:ready`'s
+* in-progress writer, the last of them, is deleted (#526).
+*/
+const servedRunConfirmsPublication = (input, createdId, selection) => publishedRunIsServed(input, createdId, selection.run) && unfinishedRuns(selection.runs).length === 0;
+/**
+* Which of the two refusals happened, reported in the order an operator can act
+* on: this call's own publication first, then any *other* run holding the check
+* open. Once the first clause holds, this call's run is terminal, so everything
+* the second clause names belongs to something else.
+*/
+const unconfirmedDetail = (input, createdId, selection) => {
+	const served = selection.run;
+	if (!publishedRunIsServed(input, createdId, served)) return served.id === createdId ? `status ${served.status ?? "unknown"}${served.conclusion ? `, conclusion ${served.conclusion}` : ""}` : `run ${served.id ?? "unknown"} rather than the run ${createdId ?? "unknown"} this call created`;
+	return `${unfinishedRuns(selection.runs).map((run) => `run ${run.id ?? "unknown"} (${run.status ?? "unknown"})`).join(", ")} unfinished for this name alongside it — a non-terminal run blocks the required check whatever this call published, and publishing a newer one does not clear it`;
+};
+/**
+* Confirm the publication against what GitHub serves, and say plainly which of
+* the two events failed when it cannot.
+*
+* Only the read is wrapped. A token, timeout, or 5xx failure here is not a
+* failure to publish — the POST already succeeded and the check is probably
+* present — so it must not be reported through the "unable to republish"
+* register, which drives `pr:ready`'s "this run's verdict never reached the
+* required check" notice.
+*/
+async function confirmPublishedCheckRun({ config, createdId, dependencies, input, onDiagnostic }) {
+	const checkName = FACTORY_CHECK_NAMES[input.gate];
+	let selection;
+	try {
+		selection = await servedFactoryCheckRun(input, config, dependencies);
+	} catch (error) {
+		selection = {
+			kind: "unavailable",
+			reason: error instanceof Error ? error.message : String(error)
+		};
+	}
+	if (selection.kind === "unavailable") {
+		onDiagnostic?.(`${checkName}: the check run was accepted but could not be read back for ${input.sha.slice(0, 7)} (${selection.reason}), so the publication is not confirmed. The check itself may well be present.\n`);
+		return false;
+	}
+	if (!servedRunConfirmsPublication(input, createdId, selection)) {
+		onDiagnostic?.(`${checkName}: the check run was accepted but for ${input.sha.slice(0, 7)} GitHub serves ${unconfirmedDetail(input, createdId, selection)}, so the publication is not confirmed.\n`);
+		return false;
+	}
+	return true;
+}
+/**
 * Publish a factory check run and *wait* for it, so a caller that has just made
 * the head SHA visible on GitHub (pushed the branch, created the PR) can make
 * the proof reliably present for that SHA before it returns (#247).
@@ -7416,6 +7585,28 @@ async function resolveDetailsUrlSafely(input, dependencies, onDiagnostic) {
 * human-readable mirror, not a proof surface, so a caller that needs an
 * App-verified check run must be told plainly whether it got one. Returns
 * `true` only when the App-owned check run landed.
+*
+* "Landed" means GitHub serves it, not that the POST was accepted (#520). On
+* PR #519 the POST was accepted, `pr:ready` reported ready and armed, and the
+* source-pinned required check read `in_progress` across three runs — so GitHub
+* never scheduled the merge and emitted no rollup row saying why. Arming
+* already refuses to infer its outcome from the invocation and reads the pull
+* request back (`arm-auto-merge.ts`); publication now does the same.
+*
+* "Landed" is judged against every run of the name from the pinned App, not
+* against the one GitHub collapses to (#524): the newest must be *this* run, in
+* the status and conclusion that were published, and no run of the name may
+* still be unfinished. A surviving `in_progress` run blocks the required check
+* on its own, so confirming past it would report success on a pull request
+* GitHub will never merge. One read, no polling: an unconfirmed publication
+* returns `false`, which `pr:ready` already turns into a notice and an
+* idempotent re-dispatch.
+*
+* Confirmation is a point-in-time read, deliberately: a later publication for
+* the same name changes the answer — a completed one by becoming the newest, an
+* unfinished one by holding the check open beside this verdict rather than
+* replacing it — and every remaining writer publishes once, as the last thing
+* its invocation does. No retry, no poll, no re-confirm.
 */
 async function ensureFactoryCheckRunPublished(input, dependencies = {}) {
 	const { onDiagnostic } = dependencies;
@@ -7426,7 +7617,7 @@ async function ensureFactoryCheckRunPublished(input, dependencies = {}) {
 			return false;
 		}
 		const detailsUrl = await resolveDetailsUrlSafely(input, dependencies, onDiagnostic);
-		await postFactoryCheckRun({
+		const created = await postFactoryCheckRun({
 			config,
 			dependencies: {
 				retry: DURABLE_CHECK_RUN_RETRY,
@@ -7435,7 +7626,13 @@ async function ensureFactoryCheckRunPublished(input, dependencies = {}) {
 			detailsUrl,
 			input
 		});
-		return true;
+		return await confirmPublishedCheckRun({
+			config,
+			createdId: typeof created.id === "number" ? created.id : void 0,
+			dependencies,
+			input,
+			onDiagnostic
+		});
 	} catch (error) {
 		const message = error instanceof Error ? error.message : String(error);
 		onDiagnostic?.(`${FACTORY_CHECK_NAMES[input.gate]}: unable to republish check run: ${message}\n`);
@@ -10660,15 +10857,6 @@ function normalizeRepositoryIdentity(repository) {
 		owner: repository.owner.toLowerCase()
 	};
 }
-function normalizeRepositorySlug(slug) {
-	const segments = slug.split("/");
-	const [owner, name] = segments;
-	if (!(owner && name) || segments.length !== 2) return;
-	return repositorySlug(normalizeRepositoryIdentity({
-		name,
-		owner
-	}));
-}
 const GITHUB_HOSTNAME = "github.com";
 const SCP_GITHUB_REMOTE_PATTERN = /^(?:[^@\s]+@)?github\.com:(?<path>[^\s]+)$/iu;
 function githubRepositoryPath(remoteUrl) {
@@ -10739,6 +10927,37 @@ function resolveCandidateIdentity({ base, cwd, git }) {
 	};
 }
 /**
+* Resolve only the applicability patch id for one diff base — no head or
+* merge-base read, and no validation beyond what the supplied `stablePatchId`
+* itself returns. Some callers (verify-once applicability, review-identity
+* comparison) only ever consumed the patch id half of the triple; before the
+* owner-routing fix for #379/#466 they invoked `stablePatchId` directly and
+* got its return value unchanged. Routing them through
+* `resolveCandidateIdentity` instead would tax every such call with two reads
+* it never used and two new ways to throw (`currentHeadSha`, optional
+* `mergeBaseSha`), changing the failure surface without changing the value —
+* and `resolveCandidateIdentity`'s own 40-character object-id check would
+* reject a legitimate 64-character patch id from a SHA-256 repository, which
+* the original direct call never rejected. This is a narrower view over the
+* same owned machine — not a second primitive and not a new `CONTEXT.md`
+* entry.
+*
+* Takes the primitive itself, not a `git` object to read it off: the original
+* expression this replaces (`dependencies.git?.stablePatchId ?? stablePatchId`)
+* nullish-coalesces on the *property* and calls the winner *unbound* — no
+* receiver, ever. An object-shaped parameter would reintroduce both a
+* newly-thrown `undefined(...)` call when a seam supplies the property as
+* `undefined` (rather than omitting the whole `git`) and a receiver
+* (`git.stablePatchId(...)`) the original expression never had. A
+* function-shaped parameter can only be called unbound, and the caller
+* chooses the fallback the same way the original expression did — see
+* `defaultStablePatchId` above for where that fallback comes from when the
+* caller may not import `git.ts` directly.
+*/
+function resolveCandidatePatchId({ base, cwd, stablePatchId }) {
+	return stablePatchId(cwd, base);
+}
+/**
 * A per-invocation resolver: one identity per diff base, computed once.
 */
 function createCandidateIdentityResolver({ cwd, git }) {
@@ -10772,16 +10991,16 @@ var external_evidence_exports = /* @__PURE__ */ __exportAll({
 	requiredCheckScopeSchema: () => requiredCheckScopeSchema$1,
 	resolveAuthoringSessionIds: () => resolveAuthoringSessionIds
 });
-const shaSchema$5 = z.string().regex(/^[0-9a-f]{7,40}$/u, { message: "must be a 7-40 char lowercase hex git SHA" });
+const shaSchema$3 = z.string().regex(/^[0-9a-f]{7,40}$/u, { message: "must be a 7-40 char lowercase hex git SHA" });
 const evidenceEnvelopeSchema = z.object({
 	check: z.string().min(1),
 	checkType: z.enum(EVIDENCE_CHECK_TYPES$1),
 	findingsPointer: z.string().min(1).optional(),
-	headSha: shaSchema$5,
-	mergeBaseSha: shaSchema$5,
+	headSha: shaSchema$3,
+	mergeBaseSha: shaSchema$3,
 	model: z.string().min(1).optional(),
 	outcome: z.enum(["pass", "fail"]),
-	patchId: shaSchema$5,
+	patchId: shaSchema$3,
 	policyVersion: z.string().min(1).optional(),
 	producer: z.string().min(1),
 	requestId: z.string().min(1).optional(),
@@ -11965,7 +12184,7 @@ function runPrVerify(args, dependencies = {}) {
 //#endregion
 //#region src/demand-waive.ts
 const DEMAND_WAIVER_SCHEMA_VERSION = 1;
-const shaSchema$4 = z.string().regex(/^[0-9a-f]{40}$/u);
+const shaSchema$2 = z.string().regex(/^[0-9a-f]{40}$/u);
 const demandWaiverStorePath = (cwd, filePath) => path.resolve(cwd, filePath ?? ".factory-memory/demand-waivers.json");
 /** Every waiver recorded in this checkout; an absent or unreadable store is
 * no waivers, so a damaged file can only ever block, never permit. */
@@ -12015,7 +12234,7 @@ const requestRefusals = ({ demand, parsedDemand, rationale }) => [...parsedDeman
 * the authoring session read below describes a different candidate.
 */
 const candidateBindingRefusals = ({ headSha, pr, verifyProof }) => {
-	if (!headSha || !shaSchema$4.safeParse(headSha).success) return [`demand:waive could not resolve a pushed head SHA for PR #${pr}; a waiver binds to one candidate.`];
+	if (!headSha || !shaSchema$2.safeParse(headSha).success) return [`demand:waive could not resolve a pushed head SHA for PR #${pr}; a waiver binds to one candidate.`];
 	return verifyProof && verifyProof.headSha !== headSha ? [`The pr:verify proof in this checkout records head ${verifyProof.headSha}, not the pushed head ${headSha}; re-run pr:verify on the candidate before waiving one of its demands.`] : [];
 };
 /**
@@ -12213,12 +12432,52 @@ const resolveWaveDemand = ({ epic, fetchClosingPullRequests = defaultFetchClosin
 };
 /**
 * Whether recorded review evidence (and, for the human rung, live GitHub
-* approvals) satisfies the demanded review rung. One implementation for both
-* consumers: `pr:ready` evaluates it over the review proof it is folding, and
-* `pr:merge-check` revalidates it over the ready proof's recorded review runs.
+* approvals) satisfies the demanded review rung. `pr:ready` — the single
+* admission decision since #477/#479 — evaluates it over the review proof it
+* is folding.
+*/
+/**
+* The submission states that carry a verdict. A `COMMENTED` submission does
+* not supersede an earlier approval — that is GitHub's own rule, and the
+* reason this cannot be a plain "latest submission wins".
+*/
+const VERDICT_REVIEW_STATES = new Set([
+	"APPROVED",
+	"CHANGES_REQUESTED",
+	"DISMISSED"
+]);
+/**
+* Whether GitHub records a live human APPROVED review on this candidate.
+*
+* One predicate, two demands: the `human` review rung below, and the
+* native-approval demand a wave that does not authorize machine merge makes
+* at readiness (#477). A bot approval is not a human act.
+*
+* Latest-per-author, never "any submission ever" (#515 review): the fetch
+* returns the whole submission history, so a reviewer who approves and then
+* submits CHANGES_REQUESTED on the same head would otherwise keep satisfying
+* this predicate through their own standing rejection — the ruleset's
+* dismiss-stale-reviews-on-push never fires because the head has not moved.
+* This mirrors GitHub's `latestReviews` semantics.
 */
+const hasLiveHumanApproval = (reviews) => {
+	const latestByAuthor = /* @__PURE__ */ new Map();
+	for (const [index, review] of reviews.entries()) {
+		const login = review.author?.login;
+		if (!login || isBotLogin(login) || !VERDICT_REVIEW_STATES.has(review.state)) continue;
+		const parsed = Date.parse(review.submittedAt ?? "");
+		const at = Number.isNaN(parsed) ? void 0 : parsed;
+		const previous = latestByAuthor.get(login);
+		if (!previous || (at !== void 0 && previous.at !== void 0 ? at >= previous.at : index > previous.index)) latestByAuthor.set(login, {
+			at,
+			index,
+			state: review.state
+		});
+	}
+	return [...latestByAuthor.values()].some((latest) => latest.state === "APPROVED");
+};
 const demandedRungSatisfactionReasons = ({ demandedRung, liveHumanReviews, reviewRuns }) => {
-	if (demandedRung === "human") return liveHumanReviews.some((review) => review.state === "APPROVED" && Boolean(review.author?.login) && !isBotLogin(review.author?.login)) ? [] : ["Boundary wave requires the human rung, but GitHub has no live human APPROVED review."];
+	if (demandedRung === "human") return hasLiveHumanApproval(liveHumanReviews) ? [] : ["Boundary wave requires the human rung, but GitHub has no live human APPROVED review."];
 	return reviewRuns?.flatMap((review) => review.outcome === "passed" && review.rung !== void 0 ? [review.rung] : []).find((candidate) => rungMeetsMinimum(candidate, demandedRung)) ? [] : [`Boundary wave requires the ${demandedRung} rung, but the recorded review evidence has no passing review at that authority.`];
 };
 //#endregion
@@ -12690,7 +12949,7 @@ const selectReviewProof = ({ reviewProof }) => {
 	if (isExplicitReviewFailure(reviewProof) || isUntypedReviewProof(reviewProof)) return {};
 	return hasReviewProof(reviewProof) ? reviewProof : {};
 };
-const shaSchema$3 = z.string().regex(/^[0-9a-f]{40}$/u);
+const shaSchema$1 = z.string().regex(/^[0-9a-f]{40}$/u);
 const patchIdSchema = z.string().regex(/^[0-9a-f]{40,64}$/u);
 const reviewCycleStateSchema = z.object({
 	autoBlockingFindings: z.number().int().nonnegative(),
@@ -12785,7 +13044,7 @@ const readinessRepairSchema = z.object({
 	command: z.string().min(1)
 });
 const managedReadinessLedgerSchema = z.object({
-	baseSha: shaSchema$3,
+	baseSha: shaSchema$1,
 	blockingReasons: z.array(z.string()),
 	classification: z.enum([
 		"docs/process-only",
@@ -12836,17 +13095,17 @@ const managedReadinessLedgerSchema = z.object({
 	handledHumanComments: z.array(handledHumanCommentSchema).optional(),
 	/**
 	* The evaluated head SHA: the GitHub `pr.headRefOid` captured at pr:ready
-	* evaluation time, not a local git read. This is the identity anchor
-	* merge-time checks (pr:merge-check) compare against the live pushed HEAD
-	* with exact equality — a pure comparison, never a re-derivation.
+	* evaluation time, not a local git read. This is the identity anchor the
+	* branded `patronage-factory/pr-ready` check binds to — GitHub's required
+	* checks compare a new head's checks against exactly this SHA (#477).
 	*/
-	headSha: shaSchema$3,
+	headSha: shaSchema$1,
 	/**
 	* The merge base used to evaluate tree-scoped external evidence. Optional
 	* only for backwards-compatible parsing of readiness ledgers written before
 	* #732; a committed verify-type demand cannot pass the merge gate without it.
 	*/
-	mergeBaseSha: shaSchema$3.optional(),
+	mergeBaseSha: shaSchema$1.optional(),
 	patchId: patchIdSchema,
 	postReadinessHumanComments: z.array(postReadinessCommentSchema).optional(),
 	postReadinessHumanReviews: z.array(postReadinessCommentSchema).optional(),
@@ -12984,6 +13243,129 @@ const resolveReviewRequiredness = (input) => {
 	};
 };
 //#endregion
+//#region src/pr-readiness/status-check-rollup.ts
+var status_check_rollup_exports = /* @__PURE__ */ __exportAll({
+	HOSTED_VERIFY_CHECK_NAME: () => HOSTED_VERIFY_CHECK_NAME$1,
+	hostedVerifyCheckState: () => hostedVerifyCheckState,
+	isFactoryReadyCheck: () => isFactoryReadyCheck,
+	isHostedVerifyCheck: () => isHostedVerifyCheck,
+	statusCheckState: () => statusCheckState
+});
+const PASSED_STATES = new Set([
+	"SUCCESS",
+	"SKIPPED",
+	"NEUTRAL"
+]);
+const FAILED_STATES = new Set([
+	"FAILURE",
+	"ERROR",
+	"CANCELLED",
+	"TIMED_OUT",
+	"ACTION_REQUIRED"
+]);
+const PENDING_STATES = new Set([
+	"PENDING",
+	"QUEUED",
+	"IN_PROGRESS",
+	"EXPECTED"
+]);
+const isFactoryReadyCheck = (check) => check.context?.startsWith("patronage-factory/") === true || !check.workflowName && check.name?.startsWith("patronage-factory/") === true;
+/**
+* The hosted verification gate's context name — the branch ruleset's other
+* source-pinned required check, alongside `patronage-factory/pr-ready`. One
+* name across the fleet because one generator emits the workflow that posts
+* it (ADR 0016, 2026-07-31 amendment).
+*/
+const HOSTED_VERIFY_CHECK_NAME$1 = "verify";
+/**
+* Is this rollup entry the hosted `verify` gate, from the producer the
+* ruleset pins it to?
+*
+* `workflowName` is the producer signal the rollup actually carries: GitHub
+* Actions check runs name their workflow, App-posted check runs come back with
+* an empty one, and a user-token commit status arrives as a `context` with no
+* `name` at all. Epic #473 wave 2 measured that a same-named check from the
+* wrong writer is as inert as no check at all, so matching the name alone
+* would accept exactly the thing the pin rejects.
+*/
+const isHostedVerifyCheck = (check) => check.name === "verify" && Boolean(check.workflowName);
+/**
+* The hosted `verify` gate's state on this head, read by presence (#477).
+*
+* This is the one rollup question the rollup can answer honestly. Wave 2
+* measured that GitHub omits an *unsatisfied pinned requirement* from
+* `statusCheckRollup` entirely — there is no "expected" or "missing" row — so
+* a green rollup is not evidence of mergeability. What the rollup does report
+* faithfully is the checks that ran. Asking whether this specific check ran,
+* and passed, on this head turns the rollup's silence from a false green into
+* a named refusal: `"none"` means the pinned requirement is unsatisfied and
+* nothing else in the rollup would have said so.
+*/
+const hostedVerifyCheckState = (rollup) => statusCheckState(rollup, (check) => !isHostedVerifyCheck(check));
+const checkContext = (check) => {
+	if (check.workflowName && check.name) return `${check.workflowName} / ${check.name}`;
+	return check.context;
+};
+const checkTimestampMs = (check) => {
+	const value = check.startedAt ?? check.completedAt;
+	if (!value) return;
+	const timestamp = Date.parse(value);
+	return Number.isNaN(timestamp) ? void 0 : timestamp;
+};
+const effectiveChecks = (rollup) => {
+	const checksByContext = /* @__PURE__ */ new Map();
+	const unkeyed = [];
+	for (const [index, check] of rollup.entries()) {
+		const context = checkContext(check);
+		if (!context) {
+			unkeyed.push(check);
+			continue;
+		}
+		const checks = checksByContext.get(context) ?? [];
+		checks.push({
+			check,
+			index,
+			timestampMs: checkTimestampMs(check)
+		});
+		checksByContext.set(context, checks);
+	}
+	const currentChecks = [...unkeyed];
+	for (const checks of checksByContext.values()) {
+		const [firstCheck] = checks;
+		if (!firstCheck) continue;
+		if (checks.length === 1) {
+			currentChecks.push(firstCheck.check);
+			continue;
+		}
+		if (checks.some((check) => check.timestampMs === void 0)) {
+			currentChecks.push(...checks.map((check) => check.check));
+			continue;
+		}
+		let latest = firstCheck;
+		for (const candidate of checks.slice(1)) {
+			if (latest.timestampMs === void 0 || candidate.timestampMs === void 0) continue;
+			if (candidate.timestampMs > latest.timestampMs) {
+				latest = candidate;
+				continue;
+			}
+			if (candidate.timestampMs === latest.timestampMs && candidate.index > latest.index) latest = candidate;
+		}
+		currentChecks.push(latest.check);
+	}
+	return currentChecks;
+};
+const terminalState = (check) => check.conclusion ?? check.state ?? "";
+const progressState = (check) => check.status ?? check.state ?? "";
+const statusCheckState = (rollup, exclude) => {
+	const included = rollup?.filter((check) => !exclude?.(check));
+	if (!included || included.length === 0) return "none";
+	const currentChecks = effectiveChecks(included);
+	if (currentChecks.every((check) => PASSED_STATES.has(terminalState(check)))) return "passed";
+	if (currentChecks.some((check) => FAILED_STATES.has(terminalState(check)))) return "failed";
+	if (currentChecks.some((check) => PENDING_STATES.has(progressState(check)))) return "pending";
+	return "unknown";
+};
+//#endregion
 //#region src/pr-readiness/readiness-evaluation.ts
 var readiness_evaluation_exports = /* @__PURE__ */ __exportAll({
 	CORRECTNESS_UNTYPED_REVIEW_BLOCKER_REASON: () => CORRECTNESS_UNTYPED_REVIEW_BLOCKER_REASON,
@@ -13121,10 +13503,7 @@ const requiredChecksEvaluation = (input) => {
 		candidate,
 		envelopes: input.evidenceEnvelopes ?? [],
 		requiredChecks,
-		scopeContext: {
-			classification: input.classification,
-			labels: input.prLabels
-		}
+		scopeContext: { classification: input.classification }
 	});
 	const blockers = outcomes.flatMap((outcome) => outcome.reason ? [{
 		demand: requiredCheckDemand(outcome.name),
@@ -13188,6 +13567,10 @@ const collectBlockers = ({ correctnessRequired, correctnessStatus, correctnessUn
 		demand: DEMAND_KEYS.mergeState,
 		reason: `GitHub merge state is ${input.mergeStateStatus}/${input.mergeable}; expected CLEAN or review-only BLOCKED with MERGEABLE.`
 	});
+	if ((input.hostedVerifyCheck ?? "none") === "none") blockers.push({
+		demand: DEMAND_KEYS.githubChecks,
+		reason: `GitHub has no ${HOSTED_VERIFY_CHECK_NAME$1} check run from its workflow producer on this head; the branch ruleset pins it as a required check and the status rollup does not report the shortfall.`
+	});
 	if (input.requiredChecks === "none" && input.classification !== "docs/process-only") blockers.push({
 		demand: DEMAND_KEYS.githubChecks,
 		reason: "GitHub has no current checks for a non-docs PR."
@@ -13304,6 +13687,88 @@ const waveRungBlockers = (input) => {
 		reason
 	}));
 };
+const mergeFreezeBlockers = (input) => (input.mergeFreeze?.blockingReasons ?? []).map((reason) => ({
+	demand: DEMAND_KEYS.mergeFreeze,
+	reason
+}));
+/**
+* #477 (#515 review): a candidate GitHub is already scheduled to merge, with
+* no boundary wave in force to say it may be.
+*
+* Refusing to *arm* without a resolved wave was only half the fix. Arming
+* survives a push, and the durable head binding is the branded check — so a
+* later epicless run that greens the check re-satisfies the ruleset for a new
+* head and the still-enabled schedule fires, with no rung and no approval
+* evaluated, on a head whose approval the ruleset just dismissed. The branded
+* check cannot simply refuse to go green without `--epic`: it is required on
+* every pull request into the default branch, and most work carries no epic.
+* So the refusal is exactly as narrow as the danger — a live enablement is
+* present, and nothing authorized it.
+*/
+const armedWithoutBoundaryBlockers = (input) => {
+	if (!input.autoMergeEnabled || input.waveReviewDemand) return [];
+	return [{
+		demand: DEMAND_KEYS.boundaryWave,
+		reason: "GitHub already has auto-merge enabled on this pull request, but no boundary wave is in force to authorize it; re-run pr:ready --epic <issue> so the wave's review rung and machine-merge authority are evaluated before the branded check goes green."
+	}];
+};
+const nativeApprovalBlockers = (input) => {
+	const demanded = input.waveReviewDemand;
+	if (!demanded) return [];
+	if (demanded.autoMerge && demanded.review !== "human" || hasLiveHumanApproval(input.reviews ?? [])) return [];
+	return [{
+		demand: DEMAND_KEYS.nativeApproval,
+		reason: `Boundary wave ${demanded.wave} does not authorize machine merge; GitHub must record a human APPROVED review on this PR before the branded readiness check can go green.`
+	}];
+};
+/**
+* The demands an operator waiver can reach (#354, moved here from
+* `pr:merge-check` by #477). Exactly the set the merge-time site could waive:
+* the merge freeze, the profile's external required checks, and the boundary
+* wave's review rung — the demands the resolver puts *in force* for one
+* candidate.
+*
+* Everything else stays unwaivable, and relocating the consumption site does
+* not widen the operator's override. Structural refusals — candidate identity,
+* proof binding, an unreadable demand authority, wave membership — were never
+* waivable at merge time and are not waivable here; in `pr:ready` most of them
+* refuse by throwing before any blocker list exists. The evidence gates
+* readiness has always owned (verify, review modes, draft, human blockers) are
+* satisfied or not; a waiver is not a second way to pass them.
+*/
+const WAIVABLE_QUALIFIED_DEMAND_FAMILIES = ["required-check", "review-rung"];
+const isWaivableDemand = (demand) => demand === DEMAND_KEYS.mergeFreeze || WAIVABLE_QUALIFIED_DEMAND_FAMILIES.some((family) => demand.startsWith(`${family}:`));
+/**
+* Fold the operator's waivers through the blockers, one call per demand so
+* `demand-waiver.ts` stays the single authority on what a waiver means. A
+* waived demand keeps every refusal it made, verbatim, on the `WaivedDemand`
+* record — it is never rewritten as satisfied.
+*/
+const foldWaivers = ({ blockers, waivers }) => {
+	if (waivers.length === 0) return {
+		blockers,
+		waivedDemands: []
+	};
+	const reasonsByDemand = /* @__PURE__ */ new Map();
+	for (const blocker of blockers) {
+		if (!isWaivableDemand(blocker.demand)) continue;
+		reasonsByDemand.set(blocker.demand, [...reasonsByDemand.get(blocker.demand) ?? [], blocker.reason]);
+	}
+	const waivedDemands = [];
+	for (const [demand, reasons] of reasonsByDemand) {
+		const { waived } = applyDemandWaiver({
+			demand,
+			reasons,
+			waivers
+		});
+		if (waived) waivedDemands.push(waived);
+	}
+	const waivedKeys = new Set(waivedDemands.map((waived) => waived.demand));
+	return {
+		blockers: blockers.filter((blocker) => !waivedKeys.has(blocker.demand)),
+		waivedDemands
+	};
+};
 const previewDeployRequired = false;
 const evaluateReadiness = (input) => {
 	const bodyMetadata = readPrBodyMetadata(input.body);
@@ -13326,26 +13791,40 @@ const evaluateReadiness = (input) => {
 	});
 	const { docsOnlyVerifiedHeadSha, docsOnlyVerifyDeltaAccepted, prVerifyStatus, trivialVerifiedHeadSha, trivialVerifyDeltaAccepted, verifiedHeadSha } = verifyGate;
 	const requiredChecks = requiredChecksEvaluation(input);
-	const blockers = [
-		...collectBlockers({
-			correctnessRequired,
-			correctnessStatus,
-			correctnessUntyped,
-			input,
-			prVerifyStatus,
-			sectionReady: bodyMetadata.requiredSectionsPresent,
-			securityRequired,
-			securityStatus,
-			securityUntyped,
-			trivialWaiverPresent: bodyMetadata.trivialWaiverAccepted,
-			verificationProof: verifyGate.verification.verificationProof
-		}),
-		...requiredChecks.blockers,
-		...gateCapMismatchBlockers.map((blocker) => ({
-			demand: DEMAND_KEYS.reviewLadder,
-			reason: blocker.reason
-		})),
-		...waveRungBlockers(input)
+	const { blockers, waivedDemands } = foldWaivers({
+		blockers: [
+			...collectBlockers({
+				correctnessRequired,
+				correctnessStatus,
+				correctnessUntyped,
+				input,
+				prVerifyStatus,
+				sectionReady: bodyMetadata.requiredSectionsPresent,
+				securityRequired,
+				securityStatus,
+				securityUntyped,
+				trivialWaiverPresent: bodyMetadata.trivialWaiverAccepted,
+				verificationProof: verifyGate.verification.verificationProof
+			}),
+			...requiredChecks.blockers,
+			...gateCapMismatchBlockers.map((blocker) => ({
+				demand: DEMAND_KEYS.reviewLadder,
+				reason: blocker.reason
+			})),
+			...waveRungBlockers(input),
+			...nativeApprovalBlockers(input),
+			...armedWithoutBoundaryBlockers(input),
+			...mergeFreezeBlockers(input)
+		],
+		waivers: input.waivers ?? []
+	});
+	const notices = [
+		...input.mergeFreeze?.notices ?? [],
+		...waivedDemands.map(waivedDemandNotice),
+		...unusedWaiverNotices({
+			applied: waivedDemands,
+			waivers: input.waivers ?? []
+		})
 	];
 	const blockingReasons = blockers.map((blocker) => blocker.reason);
 	const humanBlockingReasons = blockers.flatMap((blocker) => blocker.repair ? [] : [blocker.reason]);
@@ -13442,8 +13921,16 @@ const evaluateReadiness = (input) => {
 		blockingReasons: finalBlockingReasons,
 		humanBlockingReasons,
 		ledger,
+		/**
+		* Facts a reader needs that are not refusals (#477): the settle-window
+		* arming notice, and every waived demand rendered so it can never read as
+		* a met one.
+		*/
+		notices,
 		repairs,
-		status: postReadiness.status(status)
+		status: postReadiness.status(status),
+		/** Demands that were in force, were NOT met, and the operator waived. */
+		waivedDemands
 	};
 };
 //#endregion
@@ -13599,10 +14086,7 @@ const requiredCheckChecks = ({ candidate, candidateError, cwd, profile, verifyPr
 		},
 		envelopes: loadEvidenceEnvelopes(cwd),
 		requiredChecks,
-		scopeContext: {
-			classification: candidate.classification,
-			labels: void 0
-		}
+		scopeContext: { classification: candidate.classification }
 	});
 	return outcomes.map((outcome) => ({
 		message: requiredCheckMessage(outcome),
@@ -14478,17 +14962,203 @@ const FollowUpActionSchema = z.object({
 	command: z.string()
 }).strict();
 //#endregion
+//#region src/pr-publish-transaction-error.ts
+/**
+* Publish's admission read is a bounded transaction (#348): undraft, await the
+* newest hosted run for this head, re-evaluate, and return the current
+* outcome. Neither abort path returns a verdict the command cannot currently
+* substantiate — an unsubstantiated verdict is this error, never a guess.
+*/
+var PrPublishTransactionAbortedError = class extends Error {
+	constructor(message) {
+		super(`pr:publish aborted: ${message}`);
+		this.name = "PrPublishTransactionAbortedError";
+	}
+};
+//#endregion
+//#region src/pr-readiness/pr-body-patch.ts
+const markerSlug = (heading) => heading.toLowerCase().replaceAll(/[^a-z0-9]+/gu, "-");
+const markerFor = (heading, edge) => `<!-- patronage-factory:${markerSlug(heading)}:${edge} -->`;
+const renderManagedPrBodyBlock = (heading, content) => `${markerFor(heading, "start")}\n${content.trim()}\n${markerFor(heading, "end")}`;
+const isLegacyFactoryOnlyContent = (heading, content) => {
+	const value = content.trim();
+	if (!value) return true;
+	if (heading === "Verification") return value === "Run `patronage-factory pr:verify` and attach the typed proof to `pr:ready --verify-proof`." || value.split("\n").filter(Boolean).every((line) => /^patronage-factory pr:verify(?: --(?:docs-only|trivial))? passed at head [0-9a-f]{40}$/u.test(line));
+	if (heading === "Review proof") return value === "Have a clean session write the typed findings file, then run `patronage-factory pr:review --mode all --findings <path> --output .factory-memory/pr-review.json` and attach the proof to `pr:ready --review-proof`." || value.split("\n").filter(Boolean).every((line) => /^- (?:correctness|security): (?:passed with no actionable findings|[a-z-]+ with \d+ finding\(s\)) at patch-id [0-9a-f]{40}$/u.test(line));
+	return heading === "How to review" && value === "Review the changed files and branded patronage-factory check runs.";
+};
+const patchExistingSection = (body, part) => {
+	const bounds = findSectionBounds(body, part.heading);
+	if (!bounds) return;
+	const rawContent = body.slice(bounds.contentStart, bounds.contentEnd);
+	const block = renderManagedPrBodyBlock(part.heading, part.content);
+	const startMarker = markerFor(part.heading, "start");
+	const endMarker = markerFor(part.heading, "end");
+	const markerStart = rawContent.indexOf(startMarker);
+	const markerEnd = rawContent.indexOf(endMarker);
+	const startCount = rawContent.split(startMarker).length - 1;
+	if (startCount !== rawContent.split(endMarker).length - 1 || startCount > 1 || startCount === 1 && markerEnd < markerStart) throw new Error(`Malformed patronage-factory managed markers in the ${part.heading} section.`);
+	if (startCount === 1) {
+		const absoluteStart = bounds.contentStart + markerStart;
+		const absoluteEnd = bounds.contentStart + markerEnd + endMarker.length;
+		return body.slice(0, absoluteStart) + block + body.slice(absoluteEnd);
+	}
+	if (isLegacyFactoryOnlyContent(part.heading, rawContent)) return `${body.slice(0, bounds.contentStart)}\n\n${block}\n\n${body.slice(bounds.contentEnd)}`;
+	const separator = rawContent.endsWith("\n\n") ? "" : "\n\n";
+	return `${body.slice(0, bounds.contentEnd)}${separator}${block}\n\n${body.slice(bounds.contentEnd)}`;
+};
+const patchPrBodySections = (body, parts) => {
+	let result = body;
+	const missing = [];
+	for (const part of parts) {
+		const patched = patchExistingSection(result, part);
+		if (patched === void 0) missing.push(part);
+		else result = patched;
+	}
+	for (const part of missing) {
+		const separator = result.length === 0 || result.endsWith("\n\n") ? "" : "\n\n";
+		result += `${separator}## ${part.heading}\n\n${renderManagedPrBodyBlock(part.heading, part.content)}\n`;
+	}
+	return result;
+};
+//#endregion
+//#region src/pr-readiness/pr-body-renderer.ts
+var pr_body_renderer_exports = /* @__PURE__ */ __exportAll({
+	PR_BODY_MANAGED_SECTIONS: () => MANAGED_SECTION_NAMES,
+	renderPrBodySectionParts: () => renderPrBodySectionParts,
+	renderPrBodySections: () => renderPrBodySections
+});
+const commandFor = (proof) => {
+	if (proof.mode === "docs-only") return "patronage-factory pr:verify --docs-only";
+	if (proof.mode === "trivial") return "patronage-factory pr:verify --trivial";
+	return "patronage-factory pr:verify";
+};
+const renderPrBodySectionParts = ({ reviewProof, verifyProof }) => {
+	const verification = verifyProof ? [...verifyProof.mode === "docs-only" ? verifyProof.baselineFullProofs?.map((proof) => `patronage-factory pr:verify passed at head ${proof.headSha}`) ?? [] : [], `${commandFor(verifyProof)} passed at head ${verifyProof.headSha}`].join("\n") : "Run `patronage-factory pr:verify` and attach the typed proof to `pr:ready --verify-proof`.";
+	const reviewRuns = reviewProof?.reviews.map((review) => {
+		const patch = reviewProof.patchId;
+		const result = review.outcome === "passed" ? "passed with no actionable findings" : `${review.outcome} with ${review.issuesFlagged} finding(s)`;
+		return `- ${review.kind}: ${result} at patch-id ${patch}`;
+	}).join("\n") ?? "Have a clean session write the typed findings file, then run `patronage-factory pr:review --mode all --findings <path> --output .factory-memory/pr-review.json` and attach the proof to `pr:ready --review-proof`.";
+	return [
+		{
+			content: verification,
+			heading: "Verification"
+		},
+		{
+			content: reviewRuns,
+			heading: "Review proof"
+		},
+		{
+			content: "Review the changed files and branded patronage-factory check runs.",
+			heading: "How to review"
+		}
+	];
+};
+const renderPrBodySections = ({ reviewProof, verifyProof }) => `${renderPrBodySectionParts({
+	reviewProof,
+	verifyProof
+}).map((part) => `## ${part.heading}\n\n${renderManagedPrBodyBlock(part.heading, part.content)}`).join("\n\n")}\n`;
+//#endregion
+//#region src/arm-auto-merge.ts
+/**
+* The read-back, parsed rather than asserted. `state` is read loosely so a
+* merged pull request is still recognised as merged even when the enablement
+* record is junk; the enablement itself must be a real timestamped record,
+* because that record IS the claim that a merge is scheduled.
+*/
+const readBackSchema = z.object({
+	autoMergeRequest: z.unknown().optional(),
+	state: z.string().optional()
+});
+const autoMergeEnablementSchema = z.object({ enabledAt: z.iso.datetime() });
+/**
+* The arming invocation, as a literal argv. Exported because it is also the
+* re-dispatch `pr:ready` records when the arming did not take effect: arming
+* is idempotent on an unchanged head (measured — re-arming leaves `enabledAt`
+* untouched), so running it again is safe.
+*/
+const armAutoMergeArgv = ({ headSha, owner, pr, repo }) => [
+	"gh",
+	"pr",
+	"merge",
+	String(pr),
+	"--repo",
+	`${owner}/${repo}`,
+	"--auto",
+	"--squash",
+	"--match-head-commit",
+	headSha
+];
+const defaultRun = (argv, cwd) => {
+	const [command = "gh", ...args] = argv;
+	runCapture(command, args, cwd);
+};
+const defaultReadState = ({ owner, pr, repo }) => runGhJson([
+	"pr",
+	"view",
+	String(pr),
+	"--repo",
+	`${owner}/${repo}`,
+	"--json",
+	"autoMergeRequest,state"
+]);
+/**
+* Arm native auto-merge for one candidate and report what GitHub actually did.
+*
+* `autoMergeRequest` survives the merge, so it is not on its own a
+* "still pending" signal; the discriminator pairs it with `state`.
+*/
+function armAutoMerge(input, dependencies = {}) {
+	const run = dependencies.run ?? defaultRun;
+	const readState = dependencies.readState ?? defaultReadState;
+	let invocationDetail;
+	try {
+		run(armAutoMergeArgv(input), input.cwd);
+	} catch (error) {
+		invocationDetail = error instanceof Error ? error.message : String(error);
+	}
+	let observed;
+	try {
+		observed = readBackSchema.parse(readState(input));
+	} catch (error) {
+		return {
+			detail: `Could not read the pull request back after arming, so the handoff is unproven: ${error instanceof Error ? error.message : String(error)}`,
+			headSha: input.headSha,
+			outcome: "not-armed"
+		};
+	}
+	if (observed.state === "MERGED") return {
+		detail: "The candidate was already mergeable, so the arming call merged it synchronously.",
+		headSha: input.headSha,
+		outcome: "merged"
+	};
+	const enablement = autoMergeEnablementSchema.safeParse(observed.autoMergeRequest);
+	if (observed.state === "OPEN" && enablement.success) return {
+		headSha: input.headSha,
+		outcome: "armed"
+	};
+	return {
+		detail: invocationDetail ?? `The arming call reported success but the pull request read back as ${observed.state ?? "an unknown state"} with no valid auto-merge enablement.`,
+		headSha: input.headSha,
+		outcome: "not-armed"
+	};
+}
+//#endregion
 //#region src/merge-freeze.ts
 const MERGE_FREEZE_CHECK_NAME = "patronage-factory/merge-freeze";
 const MERGE_FREEZE_APP_SLUG = "patronage-factory";
+const HOSTED_VERIFY_CHECK_NAME = "verify";
+const GITHUB_ACTIONS_APP_ID = 15368;
+const GITHUB_ACTIONS_APP_SLUG = "github-actions";
 const MERGE_FREEZE_SCHEMA_VERSION = 1;
 const CHECK_RUNS_PER_PAGE = 100;
 const CHECK_RUN_PAGE_LIMIT = 10;
-const shaSchema$2 = z.string().regex(/^[0-9a-f]{40}$/u);
+const shaSchema = z.string().regex(/^[0-9a-f]{40}$/u);
 const activeMergeFreezeStateSchema = z.object({
 	active: z.literal(true),
 	generationId: z.number().int().positive(),
-	headSha: shaSchema$2,
+	headSha: shaSchema,
 	outcome: z.enum(["active", "stale"]),
 	reason: z.string().min(1),
 	recordedAt: z.iso.datetime(),
@@ -14498,7 +15168,7 @@ const inactiveMergeFreezeStateSchema = z.object({
 	active: z.literal(false),
 	clearRationale: z.string().min(1).optional(),
 	generationId: z.number().int().positive(),
-	headSha: shaSchema$2,
+	headSha: shaSchema,
 	outcome: z.literal("inactive"),
 	reason: z.string().min(1),
 	recordedAt: z.iso.datetime(),
@@ -14522,7 +15192,7 @@ const mergeFreezeCheckRunListItemSchema = z.object({
 		"neutral",
 		"success"
 	]).nullable().optional(),
-	head_sha: shaSchema$2,
+	head_sha: shaSchema,
 	id: z.number().int().positive(),
 	name: z.literal(MERGE_FREEZE_CHECK_NAME),
 	output: z.object({ text: z.string().nullable().optional() }).optional(),
@@ -14542,395 +15212,200 @@ const completedMergeFreezeCheckRunSchema = mergeFreezeCheckRunListItemSchema.ext
 	output: z.object({ text: z.string().min(1) }),
 	status: z.literal("completed")
 });
-function createGitHubCheckRunMergeFreezeStore(api) {
-	return { read(input) {
-		const runs = z.object({ check_runs: z.array(z.unknown()) }).parse(api.list({
-			...input,
-			name: MERGE_FREEZE_CHECK_NAME
-		})).check_runs.map((run) => mergeFreezeCheckRunListItemSchema.parse(run));
-		if (runs.length === 0) throw new Error(`No ${MERGE_FREEZE_CHECK_NAME} check run exists for ${input.headSha}.`);
-		const selected = selectNewestGeneration(runs.map((run) => ({
-			orderMs: generationOrderMs(run.started_at),
-			run
-		})));
-		if (selected.kind === "ambiguous") throw new Error(`Newest ${MERGE_FREEZE_CHECK_NAME} generation is ambiguous: ${selected.tied.length} check runs share ${new Date(selected.orderMs).toISOString()}.`);
-		if (selected.kind === "none") throw new Error(`No ${MERGE_FREEZE_CHECK_NAME} check run exists for ${input.headSha}.`);
-		const newest = selected.generation.run;
-		if (newest.head_sha !== input.headSha) throw new Error(`Newest ${MERGE_FREEZE_CHECK_NAME} check run targets ${newest.head_sha}, expected ${input.headSha}.`);
-		if (newest.status !== "completed") return {
-			active: true,
-			generationId: newest.id,
+const hostedVerifyCheckRunSchema = z.object({
+	app: z.object({
+		id: z.literal(GITHUB_ACTIONS_APP_ID),
+		slug: z.literal(GITHUB_ACTIONS_APP_SLUG)
+	}),
+	head_sha: shaSchema,
+	id: z.number().int().positive(),
+	name: z.literal(HOSTED_VERIFY_CHECK_NAME),
+	started_at: z.iso.datetime().nullable(),
+	status: z.enum([
+		"completed",
+		"in_progress",
+		"queued"
+	])
+});
+const commitParentsSchema = z.object({
+	parents: z.array(z.object({ sha: shaSchema })),
+	sha: shaSchema
+});
+function selectListedMergeFreezeGeneration(listed, expectedHeadSha) {
+	const runs = z.object({ check_runs: z.array(z.unknown()) }).parse(listed).check_runs.map((run) => mergeFreezeCheckRunListItemSchema.parse(run));
+	if (runs.length === 0) return { kind: "missing" };
+	const selected = selectNewestGeneration(runs.map((run) => ({
+		orderMs: generationOrderMs(run.started_at),
+		run
+	})));
+	if (selected.kind === "ambiguous") return {
+		kind: "unreadable",
+		reason: `Newest ${MERGE_FREEZE_CHECK_NAME} generation is ambiguous: ${selected.tied.length} check runs share ${new Date(selected.orderMs).toISOString()}.`
+	};
+	if (selected.kind === "none") return { kind: "missing" };
+	const newest = selected.generation.run;
+	if (newest.head_sha !== expectedHeadSha) return {
+		kind: "unreadable",
+		reason: `Newest ${MERGE_FREEZE_CHECK_NAME} check run targets ${newest.head_sha}, expected ${expectedHeadSha}.`
+	};
+	if (newest.status !== "completed") return {
+		kind: "settling",
+		reason: `Authoritative merge freeze generation ${newest.id} is in progress.`,
+		running: {
 			headSha: newest.head_sha,
-			outcome: "active",
-			reason: `Authoritative merge freeze generation ${newest.id} is in progress.`,
-			recordedAt: (/* @__PURE__ */ new Date()).toISOString(),
-			schemaVersion: MERGE_FREEZE_SCHEMA_VERSION
-		};
-		const completed = completedMergeFreezeCheckRunSchema.parse(newest);
-		const state = mergeFreezeStateSchema.parse(JSON.parse(completed.output.text));
-		if (state.generationId !== completed.id || state.headSha !== completed.head_sha || state.outcome === "active" && completed.conclusion !== "failure" || state.outcome === "stale" && completed.conclusion !== "neutral" || !state.active && completed.conclusion !== "success") throw new Error(`Newest ${MERGE_FREEZE_CHECK_NAME} check run has inconsistent state.`);
-		return state;
-	} };
-}
-function createGitHubCheckRunMergeFreezeApi(dependencies = {}) {
-	return { list({ cwd, headSha, name, repository }) {
-		const checkRuns = [];
-		for (let page = 1; page <= CHECK_RUN_PAGE_LIMIT; page += 1) {
-			const response = z.object({ check_runs: z.array(z.unknown()) }).parse((dependencies.readJson ?? runGhJsonAt)(["api", `/repos/${repository.owner}/${repository.name}/commits/${headSha}/check-runs?check_name=${encodeURIComponent(name)}&filter=all&per_page=${CHECK_RUNS_PER_PAGE}&page=${page}`], cwd));
-			checkRuns.push(...response.check_runs);
-			if (response.check_runs.length < CHECK_RUNS_PER_PAGE) break;
-			if (page === CHECK_RUN_PAGE_LIMIT) throw new Error(`${MERGE_FREEZE_CHECK_NAME} check-run pagination limit was exhausted before GitHub returned a final page.`);
+			id: newest.id
 		}
-		return { check_runs: checkRuns };
-	} };
+	};
+	const completed = completedMergeFreezeCheckRunSchema.parse(newest);
+	const state = mergeFreezeStateSchema.parse(JSON.parse(completed.output.text));
+	if (state.generationId !== completed.id || state.headSha !== completed.head_sha || state.outcome === "active" && completed.conclusion !== "failure" || state.outcome === "stale" && completed.conclusion !== "neutral" || !state.active && completed.conclusion !== "success") return {
+		kind: "unreadable",
+		reason: `Newest ${MERGE_FREEZE_CHECK_NAME} check run has inconsistent state.`
+	};
+	return {
+		kind: "settled",
+		state
+	};
 }
-const githubMergeFreezeStore = createGitHubCheckRunMergeFreezeStore(createGitHubCheckRunMergeFreezeApi());
-function unavailableMergeFreeze(reason) {
+function unconfiguredMergeFreeze(input, detail) {
 	return {
-		active: true,
-		reason,
-		recordedAt: (/* @__PURE__ */ new Date(0)).toISOString(),
-		schemaVersion: MERGE_FREEZE_SCHEMA_VERSION
+		kind: "unreadable",
+		reason: `The ${MERGE_FREEZE_CHECK_NAME} writer is unconfigured or its settle window cannot be confirmed for base ${input.headSha}: ${detail} Generate the main-push verify workflow, configure FACTORY_GITHUB_APP_PRIVATE_KEY, and rerun pr:ready after the first App-owned freeze generation appears.`
+	};
+}
+function selectMissingMergeFreezeGenerationUnchecked(api, input) {
+	if (!api.parent) return unconfiguredMergeFreeze(input, "the authority cannot read the base commit's parent.");
+	const commit = commitParentsSchema.parse(api.parent(input));
+	if (commit.sha !== input.headSha) return unconfiguredMergeFreeze(input, `the history query returned ${commit.sha} instead of the requested base tip.`);
+	if (commit.parents.length !== 1) return unconfiguredMergeFreeze(input, `the base tip has ${commit.parents.length} parents rather than exactly one.`);
+	const parentSha = commit.parents[0]?.sha;
+	if (!parentSha) return unconfiguredMergeFreeze(input, "the base tip's immediate parent is unreadable.");
+	const parentGeneration = selectListedMergeFreezeGeneration(api.list({
+		...input,
+		headSha: parentSha,
+		name: MERGE_FREEZE_CHECK_NAME
+	}), parentSha);
+	if (parentGeneration.kind !== "settled") return unconfiguredMergeFreeze(input, `the immediate parent ${parentSha} has no settled App-owned freeze generation (${parentGeneration.kind}).`);
+	const verifyRuns = z.object({ check_runs: z.array(z.unknown()) }).parse(api.list({
+		...input,
+		name: HOSTED_VERIFY_CHECK_NAME
+	})).check_runs.map((run) => hostedVerifyCheckRunSchema.parse(run));
+	const completedVerify = verifyRuns.find((run) => run.status === "completed");
+	if (completedVerify) return unconfiguredMergeFreeze(input, `the current tip's source-pinned GitHub Actions ${HOSTED_VERIFY_CHECK_NAME} run ${completedVerify.id} already completed without producing a freeze generation.`);
+	const orderedVerifyRuns = verifyRuns.flatMap((run) => run.started_at ? [{
+		orderMs: generationOrderMs(run.started_at),
+		run
+	}] : []);
+	if (verifyRuns.length > 1 && orderedVerifyRuns.length !== verifyRuns.length) return unconfiguredMergeFreeze(input, `multiple pending source-pinned ${HOSTED_VERIFY_CHECK_NAME} runs cannot be ordered because at least one has no start time.`);
+	const selectedVerify = verifyRuns.length === 1 ? {
+		generation: { run: verifyRuns[0] },
+		kind: "selected"
+	} : selectNewestGeneration(orderedVerifyRuns);
+	if (selectedVerify.kind === "ambiguous") return unconfiguredMergeFreeze(input, `the newest source-pinned ${HOSTED_VERIFY_CHECK_NAME} generation is ambiguous.`);
+	if (selectedVerify.kind === "none") return unconfiguredMergeFreeze(input, `the current tip has no source-pinned GitHub Actions ${HOSTED_VERIFY_CHECK_NAME} run.`);
+	const verify = selectedVerify.generation.run;
+	if (verify.head_sha !== input.headSha) return unconfiguredMergeFreeze(input, `the newest source-pinned ${HOSTED_VERIFY_CHECK_NAME} run targets ${verify.head_sha}.`);
+	const refreshed = selectListedMergeFreezeGeneration(api.list({
+		...input,
+		name: MERGE_FREEZE_CHECK_NAME
+	}), input.headSha);
+	if (refreshed.kind !== "missing") return refreshed;
+	return {
+		kind: "settling",
+		reason: `No ${MERGE_FREEZE_CHECK_NAME} generation exists yet for ${input.headSha}; the immediate parent has a settled generation and source-pinned GitHub Actions ${HOSTED_VERIFY_CHECK_NAME} run ${verify.id} is ${verify.status}.`
 	};
 }
-function readSharedMergeFreeze(input, store) {
+function selectMissingMergeFreezeGeneration(api, input) {
 	try {
-		return mergeFreezeStateSchema.parse(store.read(input));
+		return selectMissingMergeFreezeGenerationUnchecked(api, input);
 	} catch (error) {
-		return unavailableMergeFreeze(`Authoritative GitHub merge freeze check-run state is unavailable or invalid: ${error instanceof Error ? error.message : String(error)}`);
+		return unconfiguredMergeFreeze(input, `the required GitHub history or check-run evidence is unreadable: ${error instanceof Error ? error.message : String(error)}.`);
 	}
 }
-function sharedMergeFreezeBlockingReasons(input, store) {
-	const freeze = readSharedMergeFreeze(input, store);
-	if (!freeze.active) return [];
-	return [`Merge freeze is active (${freeze.reason}). It clears automatically when the main-push verify workflow completes green after a fix-forward or revert; an operator may waive it for one candidate with patronage-factory demand:waive --pr <pr> --demand merge-freeze --rationale <why>.`];
+function selectMergeFreezeGeneration(api, input) {
+	const selected = selectListedMergeFreezeGeneration(api.list({
+		...input,
+		name: MERGE_FREEZE_CHECK_NAME
+	}), input.headSha);
+	if (selected.kind === "missing") return selectMissingMergeFreezeGeneration(api, input);
+	return selected;
 }
-//#endregion
-//#region src/merge-preflight/worktree-held-branch.ts
-var worktree_held_branch_exports = /* @__PURE__ */ __exportAll({
-	checkWorktreeHeldBranch: () => checkWorktreeHeldBranch,
-	findWorktreeHeldBranch: () => findWorktreeHeldBranch,
-	formatHeldBranchCloseoutSummary: () => formatHeldBranchCloseoutSummary,
-	listWorktreesPorcelain: () => listWorktreesPorcelain,
-	parseGitWorktreeList: () => parseGitWorktreeList,
-	resolveMergeOperationalNotices: () => resolveMergeOperationalNotices,
-	worktreeHeldBranchNotice: () => worktreeHeldBranchNotice
-});
-/**
-* Parses `git worktree list --porcelain` output. Entries are separated by
-* blank lines; each starts with `worktree <path>` and carries an optional
-* `branch refs/heads/<name>` attribute (detached worktrees have none).
-*/
-function parseGitWorktreeList(porcelain) {
-	const entries = [];
-	let current = {};
-	const flush = () => {
-		if (current.path !== void 0) entries.push({
-			path: current.path,
-			...current.branch === void 0 ? {} : { branch: current.branch }
-		});
-		current = {};
-	};
-	for (const line of porcelain.split(/\r?\n/u)) {
-		if (line === "") {
-			flush();
-			continue;
-		}
-		if (line.startsWith("worktree ")) {
-			flush();
-			current.path = line.slice(9);
-			continue;
+function createGitHubCheckRunMergeFreezeStore(api) {
+	const readGeneration = (input) => {
+		try {
+			return selectMergeFreezeGeneration(api, input);
+		} catch (error) {
+			return {
+				kind: "unreadable",
+				reason: error instanceof Error ? error.message : String(error)
+			};
 		}
-		if (line.startsWith("branch refs/heads/")) current.branch = line.slice(18);
-	}
-	flush();
-	return entries;
-}
-/**
-* Returns the worktree holding `branch`, or undefined when no local worktree
-* has it checked out (or the porcelain listing was unavailable).
-*/
-function findWorktreeHeldBranch({ branch, worktreeListPorcelain }) {
-	if (worktreeListPorcelain === void 0) return;
-	const held = parseGitWorktreeList(worktreeListPorcelain).find((entry) => entry.branch === branch);
-	return held === void 0 ? void 0 : {
-		branch,
-		worktreePath: held.path
 	};
-}
-function worktreeHeldBranchNotice(held) {
-	return `Branch '${held.branch}' is checked out in the local worktree at ${held.worktreePath}. The remote-only merge handoff leaves this worktree untouched and defers local branch cleanup to closeout.`;
-}
-/**
-* Single entry point for non-blocking merge preflight notices, mirroring
-* `resolveMergeGuardIdentity`/`mergeGuardBlockingReasons` in
-* merge-identity.ts: adding a notice kind never requires coordinated edits
-* in the command runner, and persisted notice strings cannot drift from the
-* structured detection result.
-*/
-function resolveMergeOperationalNotices({ headRefName, worktreeListPorcelain }) {
-	const heldBranch = headRefName === void 0 ? void 0 : findWorktreeHeldBranch({
-		branch: headRefName,
-		worktreeListPorcelain
-	});
-	return heldBranch === void 0 ? { notices: [] } : {
-		notices: [worktreeHeldBranchNotice(heldBranch)],
-		worktreeHeldBranch: heldBranch,
-		worktreeHeldBranches: [heldBranch]
+	return {
+		read(input) {
+			const generation = readGeneration(input);
+			if (generation.kind === "settled") return generation.state;
+			if (generation.kind === "settling" && generation.running) return {
+				active: true,
+				generationId: generation.running.id,
+				headSha: generation.running.headSha,
+				outcome: "active",
+				reason: generation.reason,
+				recordedAt: (/* @__PURE__ */ new Date()).toISOString(),
+				schemaVersion: MERGE_FREEZE_SCHEMA_VERSION
+			};
+			throw new Error(generation.reason);
+		},
+		readGeneration
 	};
 }
-/**
-* Shared `git worktree list --porcelain` reader for merge preflight and
-* closeout. Returns undefined when the directory is missing, not a git
-* repository, or git is unavailable — detection is best-effort and callers
-* report "skipped" rather than fabricating a result.
-*/
-function listWorktreesPorcelain(cwd) {
-	try {
-		return execFileSync("git", [
-			"worktree",
-			"list",
-			"--porcelain"
-		], {
-			cwd,
-			encoding: "utf-8",
-			stdio: [
-				"ignore",
-				"pipe",
-				"ignore"
-			]
-		});
-	} catch {
-		return;
-	}
+function createGitHubCheckRunMergeFreezeApi(dependencies = {}) {
+	return {
+		list({ cwd, headSha, name, repository }) {
+			const checkRuns = [];
+			for (let page = 1; page <= CHECK_RUN_PAGE_LIMIT; page += 1) {
+				const response = z.object({ check_runs: z.array(z.unknown()) }).parse((dependencies.readJson ?? runGhJsonAt)(["api", `/repos/${repository.owner}/${repository.name}/commits/${headSha}/check-runs?check_name=${encodeURIComponent(name)}&filter=all&per_page=${CHECK_RUNS_PER_PAGE}&page=${page}`], cwd));
+				checkRuns.push(...response.check_runs);
+				if (response.check_runs.length < CHECK_RUNS_PER_PAGE) break;
+				if (page === CHECK_RUN_PAGE_LIMIT) throw new Error(`${MERGE_FREEZE_CHECK_NAME} check-run pagination limit was exhausted before GitHub returned a final page.`);
+			}
+			return { check_runs: checkRuns };
+		},
+		parent({ cwd, headSha, repository }) {
+			return (dependencies.readJson ?? runGhJsonAt)(["api", `/repos/${repository.owner}/${repository.name}/commits/${headSha}`], cwd);
+		}
+	};
 }
+const githubMergeFreezeStore = createGitHubCheckRunMergeFreezeStore(createGitHubCheckRunMergeFreezeApi());
+/** The one refusal sentence, naming both exits, wherever the freeze refuses. */
+const activeMergeFreezeReason = (reason) => `Merge freeze is active (${reason}). It clears automatically when the main-push verify workflow completes green after a fix-forward or revert; an operator may waive it for one candidate with patronage-factory demand:waive --pr <pr> --demand merge-freeze --rationale <why>.`;
 /**
-* Closeout-side counterpart to the merge-preflight notice: the merge step
-* defers local branch cleanup to closeout, so closeout planning checks
-* whether the worker branch is still held by a worktree (#284).
+* The freeze read at arming time (#477, ADR 0016 as amended 2026-07-31).
+*
+* An **active** generation refuses arming and names both exits. **Unreadable**
+* authority refuses too — the identity and ordering predicates are unchanged,
+* so ambiguous, malformed, or foreign-App state still fails closed. A
+* **settling** generation arms with a notice only when the writer is observable:
+* either its generation is running, or the prior tip has a settled generation
+* while this tip's source-pinned hosted verify is running (#521). Epic #473
+* decision 5 deliberately trades the settle-window wait against the measured
+* rarity of a red main. A writerless or unprovable repository fails closed.
 */
-function checkWorktreeHeldBranch({ branch, worktreeListPorcelain }) {
-	if (branch === void 0 || worktreeListPorcelain === void 0) return { status: "skipped" };
-	const held = findWorktreeHeldBranch({
-		branch,
-		worktreeListPorcelain
-	});
-	return held === void 0 ? { status: "clean" } : {
-		held,
-		status: "held"
+function armingMergeFreezeOutcome(input, authority) {
+	const generation = authority.readGeneration(input);
+	if (generation.kind === "settling") return {
+		blockingReasons: [],
+		notices: [`Merge freeze generation for base ${input.headSha} is still settling (${generation.reason}); arming proceeds (ADR 0016, 2026-07-31 amendment). The main-push verify for that tip still refuses every later arming if it goes red.`]
 	};
-}
-/** One-line closeout summary, owned beside the detection logic. */
-function formatHeldBranchCloseoutSummary(check) {
-	if (check.status === "held" && check.held) return `Held branch: '${check.held.branch}' is still checked out in the worktree at ${check.held.worktreePath}. Finish the deferred merge cleanup: remove the worktree, then delete the local branch.`;
-	if (check.status === "clean") return "Held branch: none";
-	return "Held branch: not checked (no branch recorded or worktrees unlistable)";
-}
-//#endregion
-//#region src/pr-readiness/merge-identity.ts
-var merge_identity_exports = /* @__PURE__ */ __exportAll({
-	evaluateMergeIdentity: () => evaluateMergeIdentity,
-	mergeGuardBlockingReasons: () => mergeGuardBlockingReasons,
-	mergeGuardIdentitySchema: () => mergeGuardIdentitySchema,
-	resolveMergeGuardIdentity: () => resolveMergeGuardIdentity
-});
-const evaluateMergeIdentity = ({ liveHeadSha, postProofCommits, proofHeadSha }) => {
-	if (proofHeadSha === liveHeadSha) return {
-		headSha: liveHeadSha,
-		kind: "match"
+	if (generation.kind === "unreadable") return {
+		blockingReasons: [activeMergeFreezeReason(`Authoritative GitHub merge freeze check-run state is unavailable or invalid: ${generation.reason}`)],
+		notices: []
 	};
 	return {
-		kind: "diverged",
-		liveHeadSha,
-		...postProofCommits ? { postProofCommits } : {},
-		proofHeadSha
-	};
-};
-const mergeGuardIdentityFor = ({ commitsBetween, liveHeadSha, readyProof, readyProofError, readyProofPath, requestedPr }) => {
-	if (!readyProof) return {
-		kind: "ready-proof-missing",
-		...readyProofError === void 0 ? {} : { errorDetail: readyProofError instanceof Error ? readyProofError.message : String(readyProofError) },
-		readyProofPath
-	};
-	if (readyProof.ledger.pr !== requestedPr) return {
-		kind: "ready-proof-pr-mismatch",
-		proofPr: readyProof.ledger.pr,
-		requestedPr
-	};
-	if (readyProof.status !== "ready") return {
-		blockingReasons: readyProof.blockingReasons,
-		kind: "ready-proof-not-ready",
-		status: readyProof.status
-	};
-	const proofHeadSha = readyProof.ledger.headSha;
-	return evaluateMergeIdentity({
-		liveHeadSha,
-		...proofHeadSha === liveHeadSha ? {} : { postProofCommits: commitsBetween?.(proofHeadSha, liveHeadSha) },
-		proofHeadSha
-	});
-};
-/**
-* Single entry point that owns construction of every MergeGuardIdentity
-* kind, so adding or changing a kind never requires coordinated edits in the
-* command runner.
-*/
-const resolveMergeGuardIdentity = ({ commitsBetween, liveHead, pr, readyProof, readyProofError, readyProofPath }) => {
-	if ("invalidResponse" in liveHead) return {
-		kind: "live-head-invalid",
-		pr,
-		received: liveHead.invalidResponse
-	};
-	return mergeGuardIdentityFor({
-		commitsBetween,
-		liveHeadSha: liveHead.headSha,
-		readyProof,
-		readyProofError,
-		readyProofPath,
-		requestedPr: pr
-	});
-};
-const shaSchema$1 = z.string().regex(/^[0-9a-f]{40}$/u);
-const postProofCommitSchema = z.object({
-	sha: z.string().min(1),
-	subject: z.string()
-});
-const mergeGuardIdentitySchema = z.discriminatedUnion("kind", [
-	z.object({
-		headSha: shaSchema$1,
-		kind: z.literal("match")
-	}),
-	z.object({
-		kind: z.literal("diverged"),
-		liveHeadSha: shaSchema$1,
-		postProofCommits: z.array(postProofCommitSchema).optional(),
-		proofHeadSha: shaSchema$1
-	}),
-	z.object({
-		kind: z.literal("live-head-invalid"),
-		pr: z.number().int().positive(),
-		received: z.string()
-	}),
-	z.object({
-		errorDetail: z.string().optional(),
-		kind: z.literal("ready-proof-missing"),
-		readyProofPath: z.string().min(1)
-	}),
-	z.object({
-		kind: z.literal("ready-proof-pr-mismatch"),
-		proofPr: z.number().int().positive(),
-		requestedPr: z.number().int().positive()
-	}),
-	z.object({
-		blockingReasons: z.array(z.string()),
-		kind: z.literal("ready-proof-not-ready"),
-		status: z.string().min(1)
-	})
-]);
-const RERUN_INSTRUCTION = "Re-run patronage-factory pr:verify and pr:ready on the current pushed head, then re-check before merging.";
-const postProofCommitLines = (postProofCommits) => {
-	if (!postProofCommits) return "Unable to enumerate the post-proof commits locally; run `git fetch` and inspect the range before proceeding.";
-	if (postProofCommits.length === 0) return "No commits found between the proofed head and the pushed head, so branch history may have been rewritten (for example by a force push).";
-	return `Commits pushed after the proof: ${postProofCommits.map((commit) => `${commit.sha} (${commit.subject})`).join(", ")}.`;
-};
-const mergeGuardBlockingReasons = (identity) => {
-	switch (identity.kind) {
-		case "match": return [];
-		case "diverged": return [`Proof ledger headSha ${identity.proofHeadSha} does not match the pushed PR head ${identity.liveHeadSha}. ${postProofCommitLines(identity.postProofCommits)} ${RERUN_INSTRUCTION}`];
-		case "live-head-invalid": return [`GitHub did not return a valid 40-hex headRefOid for PR #${identity.pr} (got ${identity.received}). Refusing to compare proof identity; re-fetch the PR head and retry.`];
-		case "ready-proof-missing": return [`Typed pr:ready proof is missing or invalid at ${identity.readyProofPath}${identity.errorDetail ? ` (${identity.errorDetail})` : ""}; run patronage-factory pr:ready before merging.`];
-		case "ready-proof-pr-mismatch": return [`Typed pr:ready proof was evaluated for PR #${identity.proofPr}, not PR #${identity.requestedPr}; run patronage-factory pr:ready for this PR before merging.`];
-		case "ready-proof-not-ready": return [`Typed pr:ready proof status is ${identity.status}, not ready: ${identity.blockingReasons.join(" ") || "no blocking reasons recorded."}`];
-		default: return identity;
-	}
-};
-//#endregion
-//#region src/pr-readiness/status-check-rollup.ts
-var status_check_rollup_exports = /* @__PURE__ */ __exportAll({
-	isFactoryReadyCheck: () => isFactoryReadyCheck,
-	statusCheckState: () => statusCheckState
-});
-const PASSED_STATES = new Set([
-	"SUCCESS",
-	"SKIPPED",
-	"NEUTRAL"
-]);
-const FAILED_STATES = new Set([
-	"FAILURE",
-	"ERROR",
-	"CANCELLED",
-	"TIMED_OUT",
-	"ACTION_REQUIRED"
-]);
-const PENDING_STATES = new Set([
-	"PENDING",
-	"QUEUED",
-	"IN_PROGRESS",
-	"EXPECTED"
-]);
-const isFactoryReadyCheck = (check) => check.context?.startsWith("patronage-factory/") === true || !check.workflowName && check.name?.startsWith("patronage-factory/") === true;
-const checkContext = (check) => {
-	if (check.workflowName && check.name) return `${check.workflowName} / ${check.name}`;
-	return check.context;
-};
-const checkTimestampMs = (check) => {
-	const value = check.startedAt ?? check.completedAt;
-	if (!value) return;
-	const timestamp = Date.parse(value);
-	return Number.isNaN(timestamp) ? void 0 : timestamp;
-};
-const effectiveChecks = (rollup) => {
-	const checksByContext = /* @__PURE__ */ new Map();
-	const unkeyed = [];
-	for (const [index, check] of rollup.entries()) {
-		const context = checkContext(check);
-		if (!context) {
-			unkeyed.push(check);
-			continue;
-		}
-		const checks = checksByContext.get(context) ?? [];
-		checks.push({
-			check,
-			index,
-			timestampMs: checkTimestampMs(check)
-		});
-		checksByContext.set(context, checks);
-	}
-	const currentChecks = [...unkeyed];
-	for (const checks of checksByContext.values()) {
-		const [firstCheck] = checks;
-		if (!firstCheck) continue;
-		if (checks.length === 1) {
-			currentChecks.push(firstCheck.check);
-			continue;
-		}
-		if (checks.some((check) => check.timestampMs === void 0)) {
-			currentChecks.push(...checks.map((check) => check.check));
-			continue;
-		}
-		let latest = firstCheck;
-		for (const candidate of checks.slice(1)) {
-			if (latest.timestampMs === void 0 || candidate.timestampMs === void 0) continue;
-			if (candidate.timestampMs > latest.timestampMs) {
-				latest = candidate;
-				continue;
-			}
-			if (candidate.timestampMs === latest.timestampMs && candidate.index > latest.index) latest = candidate;
-		}
-		currentChecks.push(latest.check);
-	}
-	return currentChecks;
-};
-const terminalState = (check) => check.conclusion ?? check.state ?? "";
-const progressState = (check) => check.status ?? check.state ?? "";
-const statusCheckState = (rollup, exclude) => {
-	const included = rollup?.filter((check) => !exclude?.(check));
-	if (!included || included.length === 0) return "none";
-	const currentChecks = effectiveChecks(included);
-	if (currentChecks.every((check) => PASSED_STATES.has(terminalState(check)))) return "passed";
-	if (currentChecks.some((check) => FAILED_STATES.has(terminalState(check)))) return "failed";
-	if (currentChecks.some((check) => PENDING_STATES.has(progressState(check)))) return "pending";
-	return "unknown";
-};
+		blockingReasons: generation.state.active ? [activeMergeFreezeReason(generation.state.reason)] : [],
+		notices: []
+	};
+}
 //#endregion
 //#region src/pr-ready.ts
 const CHECK_CONCLUSION_BY_READINESS_STATUS = {
@@ -14938,7 +15413,6 @@ const CHECK_CONCLUSION_BY_READINESS_STATUS = {
 	ready: "success",
 	"slice-ready/not-final": "failure"
 };
-const DEFAULT_PR_READY_PROOF_PATH = ".factory-memory/pr-ready.json";
 function defaultPrReadyGit() {
 	return {
 		canResolveCommit,
@@ -14968,7 +15442,7 @@ function defaultPrReadyGit() {
 				], cwd).stdout.trim();
 			} catch {}
 		},
-		showFileAtRef: showFileAtRef$1,
+		showFileAtRef,
 		stablePatchId
 	};
 }
@@ -15016,22 +15490,33 @@ function defaultPrReadyGithub() {
 	};
 }
 const prReadyProofSchema = z.object({
+	arming: z.object({
+		detail: z.string().min(1).optional(),
+		headSha: z.string().regex(/^[0-9a-f]{40}$/u),
+		outcome: z.enum([
+			"armed",
+			"merged",
+			"not-armed"
+		])
+	}).optional(),
 	blockedReasons: blockedReasonsSchema.optional(),
 	blockingReasons: z.array(z.string()),
 	command: z.literal("patronage-factory pr:ready"),
 	followUp: FollowUpActionSchema.optional(),
 	humanBlockingReasons: z.array(z.string()).default([]),
 	ledger: managedReadinessLedgerSchema,
+	notices: z.array(z.string().min(1)).optional(),
 	profileBlobSha: z.string().regex(/^[0-9a-f]{40}$/u).optional(),
 	profilePath: z.string().min(1).optional(),
 	repairs: z.array(readinessRepairSchema).default([]),
 	repository: z.string().regex(/^[^/\s]+\/[^/\s]+$/u).optional(),
-	schemaVersion: z.literal(2),
+	schemaVersion: z.literal(3),
 	status: z.enum([
 		"ready",
 		"blocked",
 		"slice-ready/not-final"
-	])
+	]),
+	waivedDemands: z.array(waivedDemandSchema).optional()
 }).superRefine((proof, context) => {
 	for (const issue of blockedReasonIssues({
 		...proof,
@@ -15044,18 +15529,12 @@ function validatePrReadyProof(value) {
 function readPrReadyProof(filePath) {
 	return readProofFromPath(validatePrReadyProof, filePath);
 }
-const PR_READY_PROOF_DESCRIPTOR = {
-	defaultPath: DEFAULT_PR_READY_PROOF_PATH,
-	label: "pr:ready proof",
-	parse: validatePrReadyProof,
-	schemaVersion: 2
-};
 const PR_VIEW_JSON_FIELDS = [
+	"autoMergeRequest",
 	"baseRefName",
 	"body",
 	"headRefOid",
 	"isDraft",
-	"labels",
 	"mergeStateStatus",
 	"mergeable",
 	"number",
@@ -15267,7 +15746,7 @@ function policyProfileAtCommittedHead({ cwd, git, headSha, profilePath }) {
 		profile: committedProfile
 	};
 }
-function checkoutRelativeProfilePath$1(cwd, profilePath) {
+function checkoutRelativeProfilePath(cwd, profilePath) {
 	const relativePath = path.relative(cwd, profilePath);
 	if (relativePath.length === 0 || relativePath === ".." || relativePath.startsWith(`..${path.sep}`) || path.isAbsolute(relativePath)) throw new Error("The readiness profile must be inside the trusted checkout.");
 	return relativePath.split(path.sep).join("/");
@@ -15286,6 +15765,12 @@ function docsOnlyDeltaSinceReviewProof({ classification, cwd, git, profile, prof
 		targetHeadSha
 	});
 }
+/** How each arming outcome reads to a human, including the one that failed. */
+const armingNotice = (arming) => {
+	if (arming.outcome === "armed") return `Native auto-merge is armed for ${arming.headSha}; GitHub merges this candidate once both source-pinned required checks are green on that head.`;
+	if (arming.outcome === "merged") return `This candidate merged during the arming call: ${arming.detail ?? "GitHub found it already mergeable."}`;
+	return `Native auto-merge was NOT armed for ${arming.headSha}: ${arming.detail ?? "unknown reason"} Nothing will merge this candidate until the recorded follow-up runs.`;
+};
 async function runPrReady(args, dependencies = {}) {
 	const cwd = path.resolve(args.cwd ?? process.cwd());
 	const profilePath = readinessProfilePath(cwd, args.profilePath);
@@ -15301,19 +15786,6 @@ async function runPrReady(args, dependencies = {}) {
 		}),
 		sleep: dependencies.sleep
 	});
-	publishFactoryCheckSafely(dependencies.publishCheckRun, {
-		cwd,
-		gate: "pr-ready",
-		owner: repository.owner,
-		pr: args.pr,
-		proof: {
-			schemaVersion: 2,
-			status: "evaluating"
-		},
-		repo: repository.name,
-		sha: pr.headRefOid,
-		status: "in_progress"
-	});
 	let finalCheckPublished = false;
 	try {
 		const authoritativeBaseSha = authoritativePrBase({
@@ -15336,7 +15808,7 @@ async function runPrReady(args, dependencies = {}) {
 		});
 		const policyProfile = committedPolicy.profile;
 		if (repositorySlug(policyProfile.repository) !== checkoutRepositorySlug) throw new Error(`Committed readiness profile repository ${repositorySlug(policyProfile.repository)} does not match trusted checkout repository ${checkoutRepositorySlug}.`);
-		const committedProfilePath = checkoutRelativeProfilePath$1(cwd, profilePath);
+		const committedProfilePath = checkoutRelativeProfilePath(cwd, profilePath);
 		const verifyProofPath = path.resolve(cwd, args.verifyProof ?? ".factory-memory/pr-verify.json");
 		const reviewProofPath = path.resolve(cwd, args.reviewProof ?? ".factory-memory/pr-review.json");
 		const verifyProofRead = tryReadProof(readPrVerifyProof, verifyProofPath);
@@ -15404,9 +15876,21 @@ async function runPrReady(args, dependencies = {}) {
 			sha: pr.headRefOid
 		});
 		const externalCheckState = statusCheckState(pr.statusCheckRollup, isFactoryReadyCheck);
+		const hostedVerifyCheck = hostedVerifyCheckState(pr.statusCheckRollup);
 		const effectiveMergeStateStatus = pr.mergeStateStatus === "UNSTABLE" && (externalCheckState === "passed" || externalCheckState === "pending" || externalCheckState === "none") ? "CLEAN" : pr.mergeStateStatus;
+		const mergeFreeze = armingMergeFreezeOutcome({
+			cwd,
+			headSha: pr.baseRefOid,
+			repository
+		}, dependencies.mergeFreeze ?? githubMergeFreezeStore);
+		const candidateWaivers = selectWaiversForCandidate({
+			headSha: pr.headRefOid,
+			pr: args.pr,
+			waivers: readDemandWaivers(cwd)
+		});
 		const evaluation = evaluateReadiness({
 			...externalEvidence,
+			autoMergeEnabled: Boolean(pr.autoMergeRequest),
 			baseSha: pr.baseRefOid,
 			body: args.bodyForEvaluation ?? pr.body,
 			...handledCommentInputs,
@@ -15417,14 +15901,15 @@ async function runPrReady(args, dependencies = {}) {
 			docsOnlyVerifyBaselineHeadShas: verification.fullVerifiedHeadShas,
 			draft: pr.isDraft,
 			headSha: pr.headRefOid,
+			hostedVerifyCheck,
 			ladderPolicy,
 			localHeadSha,
 			mergeBaseSha: candidateIdentityForBase(authoritativeBaseSha).mergeBaseSha,
+			mergeFreeze,
 			mergeStateStatus: effectiveMergeStateStatus,
 			mergeable: pr.mergeable,
 			patchId,
 			pr: args.pr,
-			prLabels: pr.labels?.map((label) => label.name),
 			prTitle: pr.title,
 			requiredChecks: externalCheckState,
 			reviewModes: demands.reviewModes,
@@ -15432,7 +15917,9 @@ async function runPrReady(args, dependencies = {}) {
 			reviews: pr.reviews,
 			unresolvedReviewThreads: pr.unresolvedReviewThreads,
 			verificationProof: verification.verificationProof,
+			waivers: candidateWaivers,
 			...waveDemand?.demand ? { waveReviewDemand: {
+				autoMerge: waveDemand.demand.autoMerge,
 				review: waveDemand.demand.review,
 				wave: waveDemand.demand.wave
 			} } : {}
@@ -15443,16 +15930,26 @@ async function runPrReady(args, dependencies = {}) {
 		});
 		const undraftRepair = evaluation.repairs.find((repair) => repair.code === "undraft-pr");
 		const pendingExternalChecksOnly = externalCheckState === "pending" && evaluation.blockingReasons.length === 1;
-		let followUp;
-		if (evaluation.status === "ready") followUp = followUpFromArgv([
+		const boundary = waveDemand?.demand;
+		const arming = evaluation.status === "ready" && boundary ? (dependencies.armAutoMerge ?? armAutoMerge)({
+			cwd,
+			headSha: pr.headRefOid,
+			owner: repository.owner,
+			pr: args.pr,
+			repo: repository.name
+		}) : void 0;
+		const readyRedispatch = () => followUpFromArgv([
 			"patronage-factory",
-			"pr:merge-check",
+			"pr:ready",
 			"--pr",
 			String(args.pr),
 			"--profile",
 			committedProfilePath,
-			...args.output ? ["--ready-proof", args.output] : []
+			...args.epic === void 0 ? [] : ["--epic", String(args.epic)],
+			...args.output ? ["--output", args.output] : []
 		]);
+		let followUp;
+		if (evaluation.status === "ready") followUp = arming?.outcome === "not-armed" ? readyRedispatch() : void 0;
 		else if (undraftRepair && evaluation.humanBlockingReasons.length === 0) followUp = followUpFromArgv([
 			"gh",
 			"pr",
@@ -15460,32 +15957,29 @@ async function runPrReady(args, dependencies = {}) {
 			String(args.pr)
 		]);
 		else if (!pendingExternalChecksOnly) followUp = prVerifyFollowUp(authoringSession);
+		const notices = [
+			...evaluation.notices,
+			...arming ? [armingNotice(arming)] : [],
+			...evaluation.status === "ready" && !boundary ? ["No boundary wave authorized this candidate, so nothing was armed: pr:ready admits it but schedules no merge. Re-run with --epic <issue> to resolve the wave demand and arm."] : []
+		];
 		const proof = {
+			...arming ? { arming } : {},
 			...evaluation.blockedReasons.length > 0 ? { blockedReasons: evaluation.blockedReasons } : {},
 			blockingReasons: evaluation.blockingReasons,
 			command: "patronage-factory pr:ready",
 			...followUp ? { followUp } : {},
 			humanBlockingReasons: evaluation.humanBlockingReasons,
 			ledger: evaluation.ledger,
+			...notices.length > 0 ? { notices } : {},
 			profileBlobSha: committedPolicy.blobSha,
 			profilePath: committedProfilePath,
 			repairs: evaluation.repairs,
 			repository: checkoutRepositorySlug,
-			schemaVersion: 2,
-			status: evaluation.status
+			schemaVersion: 3,
+			status: evaluation.status,
+			...evaluation.waivedDemands.length > 0 ? { waivedDemands: evaluation.waivedDemands } : {}
 		};
-		writeProof(proof, output);
-		enqueueHqIngest({
-			cwd,
-			kind: "pr-ready-proof",
-			payload: proof,
-			payloadPath: output,
-			profile: policyProfile,
-			subject: { prNumber: args.pr }
-		}, dependencies.hq);
-		reportProof(proof, output, Boolean(args.json), args.report ?? true);
-		publishFactoryCheckSafely(dependencies.publishCheckRun, {
-			...pendingExternalChecksOnly ? { status: "in_progress" } : { conclusion: CHECK_CONCLUSION_BY_READINESS_STATUS[proof.status] },
+		const finalCheck = {
 			cwd,
 			gate: "pr-ready",
 			hqLaneBaseUrl: hqLaneRefBaseUrlFromProfile(policyProfile),
@@ -15494,14 +15988,34 @@ async function runPrReady(args, dependencies = {}) {
 			proof,
 			repo: repository.name,
 			sha: pr.headRefOid
+		};
+		const publishedFinalCheck = await (dependencies.publishFinalCheckRun ?? ensureFactoryCheckRunPublished)({
+			...finalCheck,
+			conclusion: CHECK_CONCLUSION_BY_READINESS_STATUS[proof.status]
 		});
 		finalCheckPublished = true;
+		if (!publishedFinalCheck) {
+			notices.push(`The ${FACTORY_CHECK_NAMES["pr-ready"]} check run was NOT confirmed for ${pr.headRefOid}, so GitHub is not serving this run's verdict as the settled state of the required check. Either the publication never landed there, or another run of that name is still unfinished on this head (#524) — an unfinished run blocks the merge whatever this run published, and publishing a newer one does not clear it. GitHub reports no rollup reason for either. Re-run pr:ready once the factory GitHub App can post; if it stays unconfirmed, look for a non-terminal ${FACTORY_CHECK_NAMES["pr-ready"]} run on ${pr.headRefOid}.`);
+			proof.notices = [...notices];
+			proof.followUp ??= readyRedispatch();
+		}
+		for (const notice of notices) console.warn(`pr:ready notice: ${notice}`);
+		writeProof(proof, output);
+		enqueueHqIngest({
+			cwd,
+			kind: "pr-ready-proof",
+			payload: proof,
+			payloadPath: output,
+			profile: policyProfile,
+			subject: { prNumber: args.pr }
+		}, dependencies.hq);
+		reportProof(proof, output, Boolean(args.json), args.report ?? true);
 		if (proof.status !== "ready" && (args.throwWhenBlocked ?? true)) throw new Error(`pr:ready blocked: ${proof.blockingReasons.join(" ")}`);
 		return proof;
 	} catch (error) {
 		if (!finalCheckPublished) {
 			const message = error instanceof Error ? error.message : String(error);
-			publishFactoryCheckSafely(dependencies.publishCheckRun, {
+			if (!await (dependencies.publishFinalCheckRun ?? ensureFactoryCheckRunPublished)({
 				conclusion: "failure",
 				cwd,
 				gate: "pr-ready",
@@ -15509,506 +16023,17 @@ async function runPrReady(args, dependencies = {}) {
 				pr: args.pr,
 				proof: {
 					blockingReasons: [message],
-					schemaVersion: 2,
+					schemaVersion: 3,
 					status: "blocked"
 				},
 				repo: repository.name,
 				sha: pr.headRefOid
-			});
+			})) console.warn(`pr:ready could not publish the failing ${FACTORY_CHECK_NAMES["pr-ready"]} check run for ${pr.headRefOid}; the required check is absent rather than red.`);
 		}
 		throw error;
 	}
 }
 //#endregion
-//#region src/pr-merge-check.ts
-const PR_MERGE_CHECK_SCHEMA_VERSION = 1;
-const shaSchema = z.string().regex(/^[0-9a-f]{40}$/u);
-const prMergeCheckProofSchema = z.object({
-	blockingReasons: z.array(z.string()),
-	boundary: z.object({
-		autoMerge: z.boolean(),
-		epic: z.number().int().positive(),
-		review: z.enum([
-			"independent-model",
-			"oracle",
-			"human"
-		]),
-		wave: z.string().min(1)
-	}).optional(),
-	command: z.literal("patronage-factory pr:merge-check"),
-	followUp: FollowUpActionSchema.optional(),
-	identity: mergeGuardIdentitySchema,
-	liveHeadSha: shaSchema.optional(),
-	notices: z.array(z.string()).optional(),
-	pr: z.number().int().positive(),
-	schemaVersion: z.literal(PR_MERGE_CHECK_SCHEMA_VERSION),
-	status: z.enum(["pass", "fail"]),
-	waivedDemands: z.array(waivedDemandSchema).optional(),
-	worktreeHeldBranch: z.object({
-		branch: z.string().min(1),
-		worktreePath: z.string().min(1)
-	}).optional(),
-	worktreeHeldBranches: z.array(z.object({
-		branch: z.string().min(1),
-		worktreePath: z.string().min(1)
-	})).optional()
-});
-function validatePrMergeCheckProof(value) {
-	return prMergeCheckProofSchema.parse(value);
-}
-function readPrMergeCheckProof(filePath) {
-	return readProofFromPath(validatePrMergeCheckProof, filePath);
-}
-function commitsBetween(cwd, fromSha, toSha) {
-	try {
-		return runCapture("git", [
-			"log",
-			"--format=%H%x09%s",
-			`${fromSha}..${toSha}`
-		], cwd).stdout.split("\n").filter(Boolean).map((line) => {
-			const [sha = "", ...subject] = line.split("	");
-			return {
-				sha,
-				subject: subject.join("	")
-			};
-		});
-	} catch {
-		return;
-	}
-}
-function fetchPullRequestHead({ cwd, owner, pr, repo }) {
-	const head = JSON.parse(runCapture("gh", [
-		"pr",
-		"view",
-		String(pr),
-		"--repo",
-		`${owner}/${repo}`,
-		"--json",
-		"baseRefName,headRefName,headRefOid,headRepository,headRepositoryOwner,labels,mergedAt"
-	], cwd).stdout);
-	const baseRefOid = runCapture("gh", [
-		"api",
-		`repos/${owner}/${repo}/pulls/${pr}`,
-		"--jq",
-		".base.sha"
-	], cwd).stdout.trim();
-	let remoteHeadRefExists;
-	const headOwner = head.headRepositoryOwner?.login;
-	const headRepo = head.headRepository?.name;
-	if (head.headRefName && headOwner && headRepo) try {
-		remoteHeadRefExists = JSON.parse(runCapture("gh", ["api", `repos/${headOwner}/${headRepo}/git/matching-refs/heads/${head.headRefName}`], cwd).stdout).some((entry) => entry.ref === `refs/heads/${head.headRefName}`);
-	} catch {}
-	return {
-		...head,
-		baseRefOid,
-		remoteHeadRefExists
-	};
-}
-const pullRequestHeadOidSchema = z.object({ headRefOid: shaSchema });
-const pullRequestHeadRefNameSchema = z.object({ headRefName: z.string().min(1) });
-const pullRequestLabelsSchema = z.object({ labels: z.array(z.object({ name: z.string().min(1) })) });
-const pullRequestBaseOidSchema = z.object({ baseRefOid: shaSchema });
-function showFileAtRef(cwd, ref, absolutePath) {
-	const relativePath = path.relative(cwd, absolutePath);
-	const refPath = relativePath.startsWith(".") ? relativePath : `./${relativePath}`;
-	try {
-		return runCapture("git", ["show", `${ref}:${refPath}`], cwd).stdout;
-	} catch {
-		return;
-	}
-}
-function objectIdAtRef(cwd, ref, absolutePath) {
-	const relativePath = path.relative(cwd, absolutePath);
-	try {
-		return runCapture("git", ["rev-parse", `${ref}:${relativePath}`], cwd).stdout.trim();
-	} catch {
-		return;
-	}
-}
-function profileAtRef({ cwd, git, profilePath, ref }) {
-	if (!ref) return;
-	const content = git.showFileAtRef(cwd, ref, profilePath);
-	return content ? tryParseProfileContent(content) : void 0;
-}
-function committedPolicyState({ cwd, git, liveHeadResponse, profilePath }) {
-	const parsedHead = pullRequestHeadOidSchema.safeParse(liveHeadResponse);
-	const parsedBase = pullRequestBaseOidSchema.safeParse(liveHeadResponse);
-	const parsedLabels = pullRequestLabelsSchema.safeParse(liveHeadResponse);
-	return {
-		committedProfile: profileAtRef({
-			cwd,
-			git,
-			profilePath,
-			ref: parsedHead.success ? parsedHead.data.headRefOid : void 0
-		}),
-		committedProfileBlobSha: parsedHead.success ? git.objectIdAtRef(cwd, parsedHead.data.headRefOid, profilePath) : void 0,
-		currentMergeBaseSha: parsedBase.success ? parsedBase.data.baseRefOid : void 0,
-		liveLabels: parsedLabels.success ? parsedLabels.data.labels.map((label) => label.name) : void 0
-	};
-}
-function checkoutRelativeProfilePath(cwd, profilePath) {
-	const relativePath = path.relative(cwd, profilePath);
-	if (relativePath.length === 0 || relativePath === ".." || relativePath.startsWith(`..${path.sep}`) || path.isAbsolute(relativePath)) throw new Error("The merge-check profile must be inside the trusted checkout.");
-	return relativePath.split(path.sep).join("/");
-}
-function proofBindingReasons({ committedProfile, committedProfileBlobSha, profilePath, readyProof, repository }) {
-	if (!readyProof) return [];
-	const checkoutSlug = repositorySlug(repository);
-	const reasons = [];
-	if (!readyProof.repository || normalizeRepositorySlug(readyProof.repository) !== checkoutSlug) reasons.push(`Readiness proof repository ${readyProof.repository ?? "missing"} does not match trusted checkout repository ${checkoutSlug}; re-run pr:ready in this checkout.`);
-	if (readyProof.profilePath !== profilePath) reasons.push(`Readiness proof profile path ${readyProof.profilePath ?? "missing"} does not match merge-check profile path ${profilePath}; re-run pr:ready with the same committed profile.`);
-	if (!readyProof.profileBlobSha || !committedProfileBlobSha || readyProof.profileBlobSha !== committedProfileBlobSha) reasons.push(`Readiness proof profile blob ${readyProof.profileBlobSha ?? "missing"} does not match committed profile blob ${committedProfileBlobSha ?? "unresolvable"}; re-run pr:ready from the committed PR head.`);
-	if (committedProfile && repositorySlug(committedProfile.repository) !== checkoutSlug) reasons.push(`Committed profile repository ${repositorySlug(committedProfile.repository)} does not match trusted checkout repository ${checkoutSlug}; merge is blocked.`);
-	return reasons;
-}
-function requiredCheckDemandGroups({ committedProfile, liveLabels, readyProof }) {
-	const ledger = readyProof?.ledger;
-	if (!committedProfile) return [{ reasons: ["Could not read the project profile from the committed PR candidate; merge-time requiredChecks policy must come from committed refs. Fetch the PR head, then re-run pr:merge-check."] }];
-	const recordedChecks = ledger?.externalChecks ?? [];
-	return (committedProfile.requiredChecks ?? []).map((requiredCheck) => ({
-		demand: requiredCheckDemand(requiredCheck.name),
-		reasons: requiredCheckDriftReasons({
-			classification: ledger?.classification,
-			liveLabels,
-			recordedChecks,
-			requiredCheck
-		})
-	}));
-}
-function requiredCheckDriftReasons({ classification, liveLabels, recordedChecks, requiredCheck }) {
-	const scopeDecision = requiredCheckInScope({
-		context: {
-			classification,
-			labels: liveLabels
-		},
-		scope: requiredCheck.scope
-	});
-	const recorded = recordedChecks.find((candidate) => candidate.name === requiredCheck.name && candidate.checkType === requiredCheck.checkType);
-	if (!recorded) return [`Committed required check "${requiredCheck.name}" is missing from the ready proof; re-run pr:ready from the committed PR head.`];
-	if (JSON.stringify(recorded.scope) !== JSON.stringify(requiredCheck.scope)) return [`Committed required check "${requiredCheck.name}" does not match the scope recorded by pr:ready; re-run pr:ready from the committed PR head.`];
-	if (!scopeDecision.inScope) return [];
-	if (requiredCheck.scope?.labels !== void 0 && liveLabels === void 0) return [`Could not read the live PR labels to re-check conditional required check "${requiredCheck.name}"; fail closed — re-run pr:ready.`];
-	if (recorded.status !== "satisfied") return [`Required check "${requiredCheck.name}" is in scope for the merge candidate but the ready proof recorded it "${recorded.status}"; re-run pr:ready.`];
-	return [];
-}
-function mergeCheckFollowUp(status, pr, identity, profilePath, repository, matchedHeadSha, mergeFreezeActive) {
-	if (status === "pass") {
-		if (!matchedHeadSha) throw new Error("Passing merge-check is missing its validated head SHA.");
-		return followUpFromArgv([
-			"gh",
-			"api",
-			"--method",
-			"PUT",
-			`repos/${repositorySlug(repository)}/pulls/${pr}/merge`,
-			"-f",
-			`sha=${matchedHeadSha}`,
-			"-f",
-			"merge_method=squash"
-		]);
-	}
-	if (mergeFreezeActive) return;
-	if (identity.kind === "diverged") return followUpFromArgv([
-		...prVerifyFollowUp().argv,
-		"--profile",
-		profilePath
-	]);
-	return followUpFromArgv([
-		"patronage-factory",
-		"pr:ready",
-		"--pr",
-		String(pr),
-		"--profile",
-		profilePath
-	]);
-}
-function validatedHeadSha(liveHead) {
-	return "headSha" in liveHead ? liveHead.headSha : void 0;
-}
-function runPrMergeCheck(args, dependencies = {}) {
-	const cwd = path.resolve(args.cwd ?? process.cwd());
-	const profilePath = args.profilePath ? path.resolve(cwd, args.profilePath) : defaultProfilePath(cwd);
-	const git = {
-		checkoutRepository,
-		commitsBetween,
-		objectIdAtRef,
-		showFileAtRef,
-		worktreeListPorcelain: listWorktreesPorcelain,
-		...dependencies.git
-	};
-	const readyProofPath = path.resolve(cwd, args.readyProof ?? ".factory-memory/pr-ready.json");
-	const readyProofRead = tryReadProof((p) => readProofFor(PR_READY_PROOF_DESCRIPTOR, cwd, p), readyProofPath);
-	const repository = git.checkoutRepository(cwd);
-	const relativeProfilePath = checkoutRelativeProfilePath(cwd, profilePath);
-	const github = dependencies.github ?? { fetchPullRequestHead };
-	const fetchIssueBody = github.fetchIssueBody ?? defaultFetchIssueBody;
-	const fetchClosingPullRequests = github.fetchClosingPullRequests ?? defaultFetchClosingPullRequests;
-	const fetchReviews = github.fetchPullRequestReviews ?? ((input) => fetchPullRequestReviews(`${input.owner}/${input.repo}`, input.pr));
-	const liveHeadResponse = github.fetchPullRequestHead({
-		cwd,
-		owner: repository.owner,
-		pr: args.pr,
-		repo: repository.name
-	});
-	const parsedLiveHead = pullRequestHeadOidSchema.safeParse(liveHeadResponse);
-	const parsedBase = pullRequestBaseOidSchema.safeParse(liveHeadResponse);
-	const liveHead = parsedLiveHead.success ? { headSha: parsedLiveHead.data.headRefOid } : { invalidResponse: JSON.stringify(liveHeadResponse) ?? "undefined" };
-	const liveHeadSha = validatedHeadSha(liveHead);
-	const parsedHeadRefName = pullRequestHeadRefNameSchema.safeParse(liveHeadResponse);
-	const identity = resolveMergeGuardIdentity({
-		commitsBetween: (fromSha, toSha) => git.commitsBetween(cwd, fromSha, toSha),
-		liveHead,
-		pr: args.pr,
-		readyProof: readyProofRead.proof,
-		readyProofError: readyProofRead.error,
-		readyProofPath
-	});
-	const policyState = committedPolicyState({
-		cwd,
-		git,
-		liveHeadResponse,
-		profilePath
-	});
-	const freezeReasons = parsedBase.success ? sharedMergeFreezeBlockingReasons({
-		cwd,
-		headSha: parsedBase.data.baseRefOid,
-		repository
-	}, dependencies.mergeFreeze ?? githubMergeFreezeStore) : ["Authoritative GitHub merge freeze check-run state is unavailable or invalid: GitHub did not return a valid current base tip."];
-	let boundary;
-	const waveMembershipReasons = [];
-	const rungDemandGroups = [];
-	if (args.epic !== void 0) {
-		const membership = resolveWaveDemand({
-			epic: args.epic,
-			fetchClosingPullRequests,
-			fetchIssueBody,
-			owner: repository.owner,
-			pr: args.pr,
-			repo: repository.name
-		});
-		waveMembershipReasons.push(...membership.reasons);
-		if (membership.demand) {
-			boundary = {
-				...membership.demand,
-				epic: args.epic
-			};
-			rungDemandGroups.push({
-				demand: reviewRungDemand(boundary.review),
-				reasons: demandedRungSatisfactionReasons({
-					demandedRung: boundary.review,
-					liveHumanReviews: boundary.review === "human" ? fetchReviews({
-						owner: repository.owner,
-						pr: args.pr,
-						repo: repository.name
-					}) : [],
-					reviewRuns: readyProofRead.proof?.ledger.reviewRuns
-				})
-			});
-		}
-	}
-	const candidateWaivers = selectWaiversForCandidate({
-		headSha: liveHeadSha,
-		pr: args.pr,
-		waivers: readDemandWaivers(cwd)
-	});
-	const demandOutcomes = [
-		{ reasons: mergeGuardBlockingReasons(identity) },
-		{ reasons: proofBindingReasons({
-			...policyState,
-			profilePath: relativeProfilePath,
-			readyProof: readyProofRead.proof,
-			repository
-		}) },
-		{
-			demand: DEMAND_KEYS.mergeFreeze,
-			reasons: freezeReasons
-		},
-		...requiredCheckDemandGroups({
-			...policyState,
-			readyProof: readyProofRead.proof
-		}),
-		{ reasons: waveMembershipReasons },
-		...rungDemandGroups
-	].map((group) => group.demand === void 0 ? { blockingReasons: group.reasons } : applyDemandWaiver({
-		demand: group.demand,
-		reasons: group.reasons,
-		waivers: candidateWaivers
-	}));
-	const blockingReasons = demandOutcomes.flatMap((outcome) => outcome.blockingReasons);
-	const waivedDemands = demandOutcomes.flatMap((outcome) => outcome.waived ? [outcome.waived] : []);
-	const worktreeListPorcelain = git.worktreeListPorcelain(cwd);
-	const headTopology = resolveMergeOperationalNotices({
-		headRefName: parsedHeadRefName.success ? parsedHeadRefName.data.headRefName : void 0,
-		worktreeListPorcelain
-	});
-	const defaultTopology = resolveMergeOperationalNotices({
-		headRefName: liveHeadResponse.baseRefName ?? policyState.committedProfile?.repository.defaultBranch,
-		worktreeListPorcelain
-	});
-	const { worktreeHeldBranch } = headTopology;
-	const worktreeHeldBranches = [...defaultTopology.worktreeHeldBranches ?? [], ...headTopology.worktreeHeldBranches ?? []].filter((held, index, all) => all.findIndex((candidate) => candidate.branch === held.branch) === index);
-	const notices = [
-		...worktreeHeldBranches.map(worktreeHeldBranchNotice),
-		...waivedDemands.map(waivedDemandNotice),
-		...unusedWaiverNotices({
-			applied: waivedDemands,
-			waivers: candidateWaivers
-		})
-	];
-	let cleanupNotice = "Merge handoff uses GitHub's remote API; remote branch state is unverified and cleanup is deferred to closeout.";
-	if (liveHeadResponse.mergedAt) cleanupNotice = `PR was already merged at ${liveHeadResponse.mergedAt}; no merge command is required. Local branch cleanup remains deferred to closeout.`;
-	else if (liveHeadResponse.remoteHeadRefExists === false) cleanupNotice = "The remote PR branch is already deleted. The remote-only merge handoff leaves only local worktree and branch cleanup for closeout.";
-	else if (liveHeadResponse.remoteHeadRefExists) cleanupNotice = "Merge handoff uses GitHub's remote API; remote and local branch deletion is deferred to closeout.";
-	notices.push(cleanupNotice);
-	if (args.epic === void 0) notices.push("No epic was supplied; merge-check permits a human handoff but emits no automated merge action.");
-	else if (boundary && !boundary.autoMerge) notices.push(`Boundary wave ${boundary.wave} does not authorize auto-merge; merge-check permits a human handoff but emits no automated merge action.`);
-	const status = blockingReasons.length === 0 ? "pass" : "fail";
-	const followUp = liveHeadResponse.mergedAt || status === "pass" && !boundary?.autoMerge ? void 0 : mergeCheckFollowUp(status, args.pr, identity, relativeProfilePath, repository, liveHeadSha, parsedBase.success && freezeReasons.length > 0);
-	const proof = {
-		blockingReasons,
-		...boundary ? { boundary: {
-			autoMerge: boundary.autoMerge,
-			epic: boundary.epic,
-			review: boundary.review,
-			wave: boundary.wave
-		} } : {},
-		command: "patronage-factory pr:merge-check",
-		...followUp ? { followUp } : {},
-		identity,
-		...liveHeadSha ? { liveHeadSha } : {},
-		...notices.length > 0 ? { notices } : {},
-		pr: args.pr,
-		schemaVersion: PR_MERGE_CHECK_SCHEMA_VERSION,
-		status,
-		...waivedDemands.length > 0 ? { waivedDemands } : {},
-		...worktreeHeldBranch ? { worktreeHeldBranch } : {},
-		...worktreeHeldBranches ? { worktreeHeldBranches } : {}
-	};
-	const output = path.resolve(cwd, args.output ?? ".factory-memory/pr-merge-check.json");
-	writeProofJson(proof, output);
-	console.log(`pr:merge-check proof written to ${output}`);
-	for (const notice of notices) console.warn(`pr:merge-check notice: ${notice}`);
-	if (args.json) console.log(JSON.stringify(proof, null, 2));
-	if (proof.status !== "pass") throw new Error(`pr:merge-check blocked: ${blockingReasons.join(" ")}`);
-	return proof;
-}
-//#endregion
-//#region src/commands/pr-merge-check.ts
-function createPrMergeCheckCommand(output, action = runPrMergeCheck) {
-	return new Command("pr:merge-check").description("Revalidate the ready candidate and emit a remote-only, worktree-safe merge handoff").requiredOption("--pr <number>", "pull request number", positiveInteger("--pr")).option("--cwd <path>", "working directory to evaluate", ".").option("--epic <number>", "epic issue containing the factory-boundary manifest", positiveInteger("--epic")).option("--json", "print the merge-check proof as JSON").option("--output <path>", "write proof JSON to a file").option("--profile <path>", "path to the project profile JSON file").option("--ready-proof <path>", "pr:ready proof JSON path").action(withGateTiming({
-		gate: "pr:merge-check",
-		resolveLedgerRoot: (options) => resolveCwdOption(options.cwd),
-		stderr: output.stderr
-	}, (options) => {
-		action({
-			cwd: resolveCwdOption(options.cwd),
-			epic: options.epic,
-			json: Boolean(options.json),
-			output: options.output,
-			pr: options.pr,
-			profilePath: options.profile,
-			readyProof: options.readyProof
-		});
-	}));
-}
-//#endregion
-//#region src/pr-publish-transaction-error.ts
-/**
-* Publish's admission read is a bounded transaction (#348): undraft, await the
-* newest hosted run for this head, re-evaluate, and return the current
-* outcome. Neither abort path returns a verdict the command cannot currently
-* substantiate — an unsubstantiated verdict is this error, never a guess.
-*/
-var PrPublishTransactionAbortedError = class extends Error {
-	constructor(message) {
-		super(`pr:publish aborted: ${message}`);
-		this.name = "PrPublishTransactionAbortedError";
-	}
-};
-//#endregion
-//#region src/pr-readiness/pr-body-patch.ts
-const markerSlug = (heading) => heading.toLowerCase().replaceAll(/[^a-z0-9]+/gu, "-");
-const markerFor = (heading, edge) => `<!-- patronage-factory:${markerSlug(heading)}:${edge} -->`;
-const renderManagedPrBodyBlock = (heading, content) => `${markerFor(heading, "start")}\n${content.trim()}\n${markerFor(heading, "end")}`;
-const isLegacyFactoryOnlyContent = (heading, content) => {
-	const value = content.trim();
-	if (!value) return true;
-	if (heading === "Verification") return value === "Run `patronage-factory pr:verify` and attach the typed proof to `pr:ready --verify-proof`." || value.split("\n").filter(Boolean).every((line) => /^patronage-factory pr:verify(?: --(?:docs-only|trivial))? passed at head [0-9a-f]{40}$/u.test(line));
-	if (heading === "Review proof") return value === "Have a clean session write the typed findings file, then run `patronage-factory pr:review --mode all --findings <path> --output .factory-memory/pr-review.json` and attach the proof to `pr:ready --review-proof`." || value.split("\n").filter(Boolean).every((line) => /^- (?:correctness|security): (?:passed with no actionable findings|[a-z-]+ with \d+ finding\(s\)) at patch-id [0-9a-f]{40}$/u.test(line));
-	return heading === "How to review" && value === "Review the changed files and branded patronage-factory check runs.";
-};
-const patchExistingSection = (body, part) => {
-	const bounds = findSectionBounds(body, part.heading);
-	if (!bounds) return;
-	const rawContent = body.slice(bounds.contentStart, bounds.contentEnd);
-	const block = renderManagedPrBodyBlock(part.heading, part.content);
-	const startMarker = markerFor(part.heading, "start");
-	const endMarker = markerFor(part.heading, "end");
-	const markerStart = rawContent.indexOf(startMarker);
-	const markerEnd = rawContent.indexOf(endMarker);
-	const startCount = rawContent.split(startMarker).length - 1;
-	if (startCount !== rawContent.split(endMarker).length - 1 || startCount > 1 || startCount === 1 && markerEnd < markerStart) throw new Error(`Malformed patronage-factory managed markers in the ${part.heading} section.`);
-	if (startCount === 1) {
-		const absoluteStart = bounds.contentStart + markerStart;
-		const absoluteEnd = bounds.contentStart + markerEnd + endMarker.length;
-		return body.slice(0, absoluteStart) + block + body.slice(absoluteEnd);
-	}
-	if (isLegacyFactoryOnlyContent(part.heading, rawContent)) return `${body.slice(0, bounds.contentStart)}\n\n${block}\n\n${body.slice(bounds.contentEnd)}`;
-	const separator = rawContent.endsWith("\n\n") ? "" : "\n\n";
-	return `${body.slice(0, bounds.contentEnd)}${separator}${block}\n\n${body.slice(bounds.contentEnd)}`;
-};
-const patchPrBodySections = (body, parts) => {
-	let result = body;
-	const missing = [];
-	for (const part of parts) {
-		const patched = patchExistingSection(result, part);
-		if (patched === void 0) missing.push(part);
-		else result = patched;
-	}
-	for (const part of missing) {
-		const separator = result.length === 0 || result.endsWith("\n\n") ? "" : "\n\n";
-		result += `${separator}## ${part.heading}\n\n${renderManagedPrBodyBlock(part.heading, part.content)}\n`;
-	}
-	return result;
-};
-//#endregion
-//#region src/pr-readiness/pr-body-renderer.ts
-var pr_body_renderer_exports = /* @__PURE__ */ __exportAll({
-	PR_BODY_MANAGED_SECTIONS: () => MANAGED_SECTION_NAMES,
-	renderPrBodySectionParts: () => renderPrBodySectionParts,
-	renderPrBodySections: () => renderPrBodySections
-});
-const commandFor = (proof) => {
-	if (proof.mode === "docs-only") return "patronage-factory pr:verify --docs-only";
-	if (proof.mode === "trivial") return "patronage-factory pr:verify --trivial";
-	return "patronage-factory pr:verify";
-};
-const renderPrBodySectionParts = ({ reviewProof, verifyProof }) => {
-	const verification = verifyProof ? [...verifyProof.mode === "docs-only" ? verifyProof.baselineFullProofs?.map((proof) => `patronage-factory pr:verify passed at head ${proof.headSha}`) ?? [] : [], `${commandFor(verifyProof)} passed at head ${verifyProof.headSha}`].join("\n") : "Run `patronage-factory pr:verify` and attach the typed proof to `pr:ready --verify-proof`.";
-	const reviewRuns = reviewProof?.reviews.map((review) => {
-		const patch = reviewProof.patchId;
-		const result = review.outcome === "passed" ? "passed with no actionable findings" : `${review.outcome} with ${review.issuesFlagged} finding(s)`;
-		return `- ${review.kind}: ${result} at patch-id ${patch}`;
-	}).join("\n") ?? "Have a clean session write the typed findings file, then run `patronage-factory pr:review --mode all --findings <path> --output .factory-memory/pr-review.json` and attach the proof to `pr:ready --review-proof`.";
-	return [
-		{
-			content: verification,
-			heading: "Verification"
-		},
-		{
-			content: reviewRuns,
-			heading: "Review proof"
-		},
-		{
-			content: "Review the changed files and branded patronage-factory check runs.",
-			heading: "How to review"
-		}
-	];
-};
-const renderPrBodySections = ({ reviewProof, verifyProof }) => `${renderPrBodySectionParts({
-	reviewProof,
-	verifyProof
-}).map((part) => `## ${part.heading}\n\n${renderManagedPrBodyBlock(part.heading, part.content)}`).join("\n\n")}\n`;
-//#endregion
 //#region src/pr-review-gate-trace.ts
 const eventTime = () => (/* @__PURE__ */ new Date()).toISOString();
 const buildReviewGateNotRequiredTraceEvent = ({ createdAt = eventTime(), identity, proof }) => ReviewGateTraceEventSchema.parse({
@@ -16429,6 +16454,7 @@ const summarizeHumanHandoff = (proof) => {
 	return {
 		humanActions: proof.status === "ready" ? [] : [...humanActions].toSorted((left, right) => left.localeCompare(right)),
 		routeOwnedRepairs,
+		scheduled: proof.status === "ready" && (proof.arming?.outcome === "armed" || proof.arming?.outcome === "merged") && proof.followUp === void 0,
 		status: proof.status
 	};
 };
@@ -16505,8 +16531,9 @@ const followUpSummaryLine = (outcome) => {
 	return "Follow-up: not requested.";
 };
 const verificationReuseSummaryLine = (reuse) => reuse.reused ? `Verification reused the existing pr:verify proof: ${reuse.reason}.` : `Verification ran pr:verify: ${reuse.reason}.`;
+const readySummaryLine = (handoff) => handoff.scheduled ? "pr:publish ready — the merge is on GitHub's schedule; no human actions owed." : "pr:publish admitted, not handed off — the candidate passed but nothing is scheduled to merge it. See the readiness proof's notices and follow-up.";
 const renderPublishSummary = (result) => {
-	const lines = result.handoff.status === "ready" ? ["pr:publish ready — no human actions owed before merge."] : [`pr:publish blocked (${result.handoff.status}). Human actions owed:`, ...result.handoff.humanActions.length === 0 ? ["- Route-owned repairs remain; see readiness proof repairs."] : result.handoff.humanActions.map((action) => `- ${action}`)];
+	const lines = result.handoff.status === "ready" ? [readySummaryLine(result.handoff)] : [`pr:publish blocked (${result.handoff.status}). Human actions owed:`, ...result.handoff.humanActions.length === 0 ? ["- Route-owned repairs remain; see readiness proof repairs."] : result.handoff.humanActions.map((action) => `- ${action}`)];
 	if (result.verificationReuse) lines.push(verificationReuseSummaryLine(result.verificationReuse));
 	lines.push(followUpSummaryLine(result.followUp));
 	const binding = result.verifyProofBinding ? verifyProofBindingSummaryLine(result.verifyProofBinding) : void 0;
@@ -16528,7 +16555,14 @@ async function ensureVerifyProof({ args, cwd, dependencies, headSha, verifyProof
 	let declineReason = "no pr:verify proof was available to reuse";
 	if (typeof headSha === "string") {
 		const applicability = resolveVerifyProofApplicability({
-			currentVerifyIdentityForBase: () => ({ patchId: (dependencies.git?.stablePatchId ?? stablePatchId)(cwd, args.base) }),
+			currentVerifyIdentityForBase: () => {
+				const selectedStablePatchId = dependencies.git?.stablePatchId ?? stablePatchId;
+				return { patchId: resolveCandidatePatchId({
+					base: args.base,
+					cwd,
+					stablePatchId: selectedStablePatchId
+				}) };
+			},
 			explicitProof: false,
 			files: (dependencies.git?.changedFiles ?? changedFiles)(cwd, args.base),
 			headSha,
@@ -16622,8 +16656,9 @@ async function ensureReviewProof({ args, cwd, dependencies, currentReviewIdentit
 *
 * Still best effort by construction: the sink never throws and never
 * substitutes the commit-status mirror, so a failed proof mirror cannot fail
-* the gate. The sink is injected by the CLI exactly like `publishCheckRun`, so
-* an absent sink means no republish and unit fixtures never reach GitHub.
+* the gate. The sink is injected by the CLI — it is the only check-run sink
+* publish injects now (#526) — so an absent sink means no republish and unit
+* fixtures never reach GitHub.
 */
 async function republishVerifyProofCheckRun({ cwd, dependencies, pr, profile, verified }) {
 	const { proof, verifiedHeadSha } = verified;
@@ -16696,6 +16731,19 @@ const planPublishFollowUp = ({ binding, followUp, proofHeadSha, verifiedHeadSha
 * pre-action verdict it holds no longer describes the candidate, full stop.
 */
 const isUndraftFollowUp = (action) => action.argv[0] === "gh" && action.argv[1] === "pr" && action.argv[2] === "ready";
+/**
+* Whether the settled follow-up was readiness re-dispatching itself (#477):
+* the arming did not take effect, or the branded check's publication was not
+* confirmed. Self-invalidating for the same reason the undraft repair is —
+* publish just performed the action, so the pre-action proof no longer
+* describes what is scheduled.
+*/
+const isReadyRedispatch = (action) => action.argv[0] === "patronage-factory" && action.argv[1] === "pr:ready";
+/**
+* The follow-ups publish must not report a pre-action verdict for, because
+* publish itself performed the action they name.
+*/
+const isSelfInvalidatingFollowUp = (action) => isUndraftFollowUp(action) || isReadyRedispatch(action);
 const PUBLISH_HOSTED_RUN_POLL_MS = 15e3;
 /**
 * Re-evaluate readiness for the same candidate (#348). Used both to capture
@@ -16763,10 +16811,17 @@ async function settleFollowUp({ action, cwd, factoryCliInvocation, onFailure, pl
 		status: "succeeded"
 	};
 }
-const currentReviewIdentityFor = ({ args, cwd, dependencies, headSha, verifyProof }) => ({
-	headSha: headSha ?? verifyProof.headSha,
-	patchId: (dependencies.git?.stablePatchId ?? stablePatchId)(cwd, args.base)
-});
+const currentReviewIdentityFor = ({ args, cwd, dependencies, headSha, verifyProof }) => {
+	const selectedStablePatchId = dependencies.git?.stablePatchId ?? stablePatchId;
+	return {
+		headSha: headSha ?? verifyProof.headSha,
+		patchId: resolveCandidatePatchId({
+			base: args.base,
+			cwd,
+			stablePatchId: selectedStablePatchId
+		})
+	};
+};
 async function runPrPublish(args, dependencies = {}) {
 	const cwd = path.resolve(args.cwd ?? process.cwd());
 	const factoryCliInvocation = prPublishCliInvocation(dependencies.factoryCliInvocation);
@@ -16887,7 +16942,7 @@ async function runPrPublish(args, dependencies = {}) {
 			}),
 			runFollowUp: dependencies.runFollowUp
 		});
-		if (followUp.status === "succeeded" && isUndraftFollowUp(initialProof.followUp)) currentProof = await reevaluateReadiness(readyEvalArgs, publishDependencies);
+		if (followUp.status === "succeeded" && isSelfInvalidatingFollowUp(initialProof.followUp)) currentProof = await reevaluateReadiness(readyEvalArgs, publishDependencies);
 	}
 	const proof = await awaitCurrentReadyVerdict({
 		args: readyEvalArgs,
@@ -16977,7 +17032,7 @@ function createPrReadyCommand(output, action) {
 			reviewProof: options.reviewProof,
 			verifyProof: options.verifyProof
 		};
-		await (action ? action(args) : runPrReady(args, { publishCheckRun: createFactoryCheckPublisher(output) }));
+		await (action ? action(args) : runPrReady(args));
 	}));
 }
 //#endregion
@@ -17112,8 +17167,8 @@ function checkWorktreeScratchFiles(worktreePath, listRootEntries = listWorktreeR
 }
 /**
 * Human-readable one-line summary of a scratch-file check, owned beside the
-* detection logic (mirroring worktreeHeldBranchNotice) so planner output,
-* docs, and future surfaces cannot drift apart.
+* detection logic so planner output, docs, and future surfaces cannot drift
+* apart.
 */
 function formatScratchFileCheckSummary(check) {
 	if (check.status === "flagged") return `Scratch files: flagged — ${check.files.join(", ")} in ${check.worktreePath ?? "worktree"}. PR-body scratch files belong in /tmp; remove these before archiving the worktree.`;
@@ -17306,11 +17361,7 @@ function createProgram(options = {}) {
 	};
 	const prPublishAction = options.actions?.prPublish ?? ((args) => runPrPublish(args, {
 		ensureVerifyCheckRun: ensureFactoryCheckRunPublished,
-		factoryCliInvocation,
-		publishCheckRun: createFactoryCheckPublisher({
-			stderr: output.stderr,
-			stdout: output.stderr
-		})
+		factoryCliInvocation
 	}));
 	const program = new Command();
 	program.name("patronage-factory").description("Shared Patronage software factory CLI").version(version);
@@ -17326,7 +17377,6 @@ function createProgram(options = {}) {
 	program.addCommand(createPrReviewCommand(output, options.actions?.prReview));
 	program.addCommand(createPrReadyCommand(output, options.actions?.prReady));
 	program.addCommand(createPrPublishCommand(output, prPublishAction));
-	program.addCommand(createPrMergeCheckCommand(output, options.actions?.prMergeCheck));
 	program.addCommand(createDemandWaiveCommand(output, options.actions?.demandWaive));
 	return program;
 }
@@ -17350,4 +17400,4 @@ if (isDirectCliExecution()) try {
 	process.exit(1);
 }
 //#endregion
-export { DEFAULT_DEMAND_WAIVER_PATH, DEFAULT_FACTORY_REPOSITORY, DemandWaiveRefusalError, EPIC_STRUCTURE_NODE_STATUSES, EPIC_STRUCTURE_SCHEMA_VERSION, EpicStructureValidationError, FactoryCliInvocationSchema, FollowUpActionSchema, MERGE_FREEZE_APP_SLUG, MERGE_FREEZE_CHECK_NAME, PrPublishFollowUpError, RETRO_ENVELOPE_SCHEMA_VERSION, RETRO_ENVELOPE_VALIDATORS, REVIEW_FOCUS_SECTION, SUPPORTED_RETRO_ENVELOPE_SCHEMA_VERSIONS, WorkerCheckoutGuardError, appendReviewLadderStageTraceEvent, appendWithTraceSinks, applyDemandWaiver, assembleReviewPrompt, assertWorkerCheckoutAllowed, authorizeDemandWaiver, blockingLadderFindings, boundary_manifest_exports as boundaryManifest, boundary_review_proof_exports as boundaryReviewProof, buildEpicStructureEvent, buildEpicStructurePayload, buildEvidenceEnvelope, buildRetroEnvelope, buildReviewGateNotRequiredTraceEvent, buildReviewLadderStageTraceEvent, comment_provenance_exports as commentProvenance, createLocalJsonlTraceSink, createProgram, doctorProjectProfile, epicStructureEventId, evaluateReviewLadder, evidenceEnvelopeFilename, findingKey, followUpFromArgv, inferFixedInThreadDispositions, isProductionHqUrl, isRetroEnvelopeWireComplete, loadProjectProfile, normalizeIssueComments, openLadderFindings, parseRetroEnvelope, planPublishFollowUp, worktree_held_branch_exports as prMergePreflight, pr_body_metadata_exports as prReadinessBodyMetadata, readiness_evaluation_exports as prReadinessEvaluation, external_evidence_exports as prReadinessExternalEvidence, merge_identity_exports as prReadinessMergeIdentity, post_readiness_comments_exports as prReadinessPostComments, pr_body_renderer_exports as prReadinessPrBodyRenderer, proof_identity_exports as prReadinessProofIdentity, review_proof_exports as prReadinessReviewProof, status_check_rollup_exports as prReadinessStatusChecks, verification_proof_exports as prReadinessVerificationProof, publishEpicStructure, readDemandWaivers, readPrMergeCheckProof, readPrReadyProof, readPrReviewProof, resolveFactoryRepository, resolveFindingBlocking, resolveReviewFindingCategory, resolveReviewFindingSeverity, resolveReviewLadderPolicy, resolveTraceWriteSinks, retroEnvelopeSchemaVersionOf, retroEnvelopeV1Schema, retroEpicReference, reviewCycleStateFor, reviewFocusFromIssueBody, reviewPromptSectionSchema, reviewPromptSectionsSchema, run, runBoundaryCheck, runDemandWaive, runEvidenceEmit, runPrMergeCheck, runPrPublish, runPrReady, runPrReview, runPrVerify, scanFactoryTraceDiagnostics, scanFactoryTraceEvents, selectWaiversForCandidate, staleRepeatLadderFindings, toFactoryTraceEnvelope, tryAppendReviewGateNotRequiredTraceEvent, tryAppendReviewLadderStageTraceEvent, validateBoundaryCheckProof, validateDagDocument, validateDemandWaiverStore, validateFactoryTraceEvent, validateMergeFreezeState, validatePrMergeCheckProof, validatePrReadyProof, validatePrReviewProof, validatePrVerifyProof, waivedDemandNotice, waivedDemandSchema, worktree_scratch_files_exports as worktreeScratchFiles };
+export { DEFAULT_DEMAND_WAIVER_PATH, DEFAULT_FACTORY_REPOSITORY, DemandWaiveRefusalError, EPIC_STRUCTURE_NODE_STATUSES, EPIC_STRUCTURE_SCHEMA_VERSION, EpicStructureValidationError, FactoryCliInvocationSchema, FollowUpActionSchema, MERGE_FREEZE_APP_SLUG, MERGE_FREEZE_CHECK_NAME, PrPublishFollowUpError, RETRO_ENVELOPE_SCHEMA_VERSION, RETRO_ENVELOPE_VALIDATORS, REVIEW_FOCUS_SECTION, SUPPORTED_RETRO_ENVELOPE_SCHEMA_VERSIONS, WorkerCheckoutGuardError, appendReviewLadderStageTraceEvent, appendWithTraceSinks, applyDemandWaiver, assembleReviewPrompt, assertWorkerCheckoutAllowed, authorizeDemandWaiver, blockingLadderFindings, boundary_manifest_exports as boundaryManifest, boundary_review_proof_exports as boundaryReviewProof, buildEpicStructureEvent, buildEpicStructurePayload, buildEvidenceEnvelope, buildRetroEnvelope, buildReviewGateNotRequiredTraceEvent, buildReviewLadderStageTraceEvent, comment_provenance_exports as commentProvenance, createLocalJsonlTraceSink, createProgram, doctorProjectProfile, epicStructureEventId, evaluateReviewLadder, evidenceEnvelopeFilename, findingKey, followUpFromArgv, inferFixedInThreadDispositions, isProductionHqUrl, isRetroEnvelopeWireComplete, loadProjectProfile, normalizeIssueComments, openLadderFindings, parseRetroEnvelope, planPublishFollowUp, pr_body_metadata_exports as prReadinessBodyMetadata, readiness_evaluation_exports as prReadinessEvaluation, external_evidence_exports as prReadinessExternalEvidence, post_readiness_comments_exports as prReadinessPostComments, pr_body_renderer_exports as prReadinessPrBodyRenderer, proof_identity_exports as prReadinessProofIdentity, review_proof_exports as prReadinessReviewProof, status_check_rollup_exports as prReadinessStatusChecks, verification_proof_exports as prReadinessVerificationProof, publishEpicStructure, readDemandWaivers, readPrReadyProof, readPrReviewProof, resolveFactoryRepository, resolveFindingBlocking, resolveReviewFindingCategory, resolveReviewFindingSeverity, resolveReviewLadderPolicy, resolveTraceWriteSinks, retroEnvelopeSchemaVersionOf, retroEnvelopeV1Schema, retroEpicReference, reviewCycleStateFor, reviewFocusFromIssueBody, reviewPromptSectionSchema, reviewPromptSectionsSchema, run, runBoundaryCheck, runDemandWaive, runEvidenceEmit, runPrPublish, runPrReady, runPrReview, runPrVerify, scanFactoryTraceDiagnostics, scanFactoryTraceEvents, selectWaiversForCandidate, staleRepeatLadderFindings, toFactoryTraceEnvelope, tryAppendReviewGateNotRequiredTraceEvent, tryAppendReviewLadderStageTraceEvent, validateBoundaryCheckProof, validateDagDocument, validateDemandWaiverStore, validateFactoryTraceEvent, validateMergeFreezeState, validatePrReadyProof, validatePrReviewProof, validatePrVerifyProof, waivedDemandNotice, waivedDemandSchema, worktree_scratch_files_exports as worktreeScratchFiles };