@patronage/software-factory 0.25.0 → 0.30.0-beta.1

package/dist/index.d.ts

@@ -26,7 +26,7 @@ interface GithubIssueComment {
 }
 declare const normalizeIssueComments: (value: GithubIssueCommentApi[] | GithubIssueCommentApi[][]) => GithubIssueComment[];
 declare namespace boundary_review_proof_d_exports {
-  export { BOUNDARY_REVIEW_PROOF_KIND, BoundaryReviewProof, BoundaryReviewProofComment, boundaryReviewProofSchema, selectBoundaryReviewProof, undispositionedBlockingFindings };
+  export { BOUNDARY_REVIEW_PROOF_KIND, BoundaryReviewProof, BoundaryReviewProofComment, boundaryReviewProofAuthorsSeen, boundaryReviewProofSchema, selectBoundaryReviewProof, undispositionedBlockingFindings };
 }
 declare const BOUNDARY_REVIEW_PROOF_KIND = "boundary-review-proof";
 declare const boundaryReviewProofBaseSchema: z.ZodObject<{
@@ -124,6 +124,7 @@ interface BoundaryReviewProofComment {
   commentUrl?: string;
 }
 declare const selectBoundaryReviewProof: (comments: GithubIssueComment[], boundary: string, declaredBy: string) => BoundaryReviewProofComment | undefined;
+declare const boundaryReviewProofAuthorsSeen: (comments: GithubIssueComment[], boundary: string) => string[];
 declare const undispositionedBlockingFindings: (proof: BoundaryReviewProof) => string[];
 //#endregion
 //#region src/hq-ingest-sink.d.ts
@@ -370,8 +371,8 @@ interface DemandWaiver {
   operator: string;
   rationale: string;
   recordedAt: string;
-  /** The operator session the waiver was recorded in. */
-  session: string;
+  /** Optional audit metadata; never waiver authority. */
+  session?: string;
 }
 interface DemandWaiverStore {
   command: "patronage-factory demand:waive";
@@ -391,7 +392,7 @@ interface WaivedDemand {
   operator: string;
   rationale: string;
   recordedAt: string;
-  session: string;
+  session?: string;
   /** The demand's refusals at evaluation time, preserved verbatim. */
   unmetReasons: string[];
 }
@@ -430,7 +431,7 @@ declare const applyDemandWaiver: ({
 declare const waivedDemandNotice: (waived: WaivedDemand) => string;
 interface DemandWaiverAuthorization {
   operator: string;
-  session: string;
+  session?: string;
 }
 type AuthorizeDemandWaiverResult = {
   authorization: DemandWaiverAuthorization;
@@ -441,16 +442,15 @@ type AuthorizeDemandWaiverResult = {
 };
 /**
  * Operator identity, `declaredBy`-style: a named human account, recorded on
- * the waiver and enforced here — plus session distinctness from the candidate
- * the waiver applies to. Every refusal is named; nothing falls open.
+ * the waiver and enforced here. Session is optional audit metadata only: it is
+ * not credential-backed, so its absence or equality never authorizes or
+ * refuses an operator act.
  */
 declare const authorizeDemandWaiver: ({
   authenticatedLogin,
-  authoringSession,
   session
 }: {
   authenticatedLogin: string | undefined;
-  authoringSession: string | undefined;
   session: string | undefined;
 }) => AuthorizeDemandWaiverResult;
 //#endregion
@@ -461,6 +461,27 @@ declare const blockedReasonSchema: z.ZodObject<{
 }, z.core.$strip>;
 type BlockedReason = z.infer<typeof blockedReasonSchema>;
 //#endregion
+//#region src/arm-auto-merge.d.ts
+interface ArmAutoMergeInput {
+  cwd: string;
+  /** The validated PR head this arming is a compare-and-set against. */
+  headSha: string;
+  owner: string;
+  pr: number;
+  repo: string;
+}
+/**
+ * What the PR actually did, read back after the call — never inferred from the
+ * exit code. `not-armed` is a failure: the candidate is admitted but nothing
+ * will merge it, so it carries the detail and `pr:ready` emits a re-dispatch.
+ */
+interface ArmAutoMergeOutcome {
+  /** Why the arming did not take effect, or what the invocation reported. */
+  detail?: string;
+  headSha: string;
+  outcome: "armed" | "merged" | "not-armed";
+}
+//#endregion
 //#region src/checkout-repository.d.ts
 interface CheckoutRepository {
   name: string;
@@ -497,235 +518,9 @@ declare const followUpFromArgv: (argv: string[]) => FollowUpAction;
 /** Canonical zod schema for the optional follow-up field on JSON outputs. */
 declare const FollowUpActionSchema: z.ZodType<FollowUpAction>;
 //#endregion
-//#region src/github-client.d.ts
-interface GithubPullRequestReview {
-  author: {
-    login?: string;
-  };
-  body: string;
-  /** GraphQL `PullRequestReview.lastEditedAt` — REST's `/pulls/reviews` has no equivalent (#843). */
-  lastEditedAt?: string;
-  state: string;
-  submittedAt?: string;
-  url: string;
-}
-//#endregion
-//#region src/merge-freeze.d.ts
-declare const MERGE_FREEZE_CHECK_NAME = "patronage-factory/merge-freeze";
-declare const MERGE_FREEZE_APP_SLUG = "patronage-factory";
-declare const mergeFreezeStateSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
-  active: z.ZodLiteral<true>;
-  generationId: z.ZodNumber;
-  headSha: z.ZodString;
-  outcome: z.ZodEnum<{
-    active: "active";
-    stale: "stale";
-  }>;
-  reason: z.ZodString;
-  recordedAt: z.ZodISODateTime;
-  schemaVersion: z.ZodLiteral<1>;
-}, z.core.$strip>, z.ZodObject<{
-  active: z.ZodLiteral<false>;
-  clearRationale: z.ZodOptional<z.ZodString>;
-  generationId: z.ZodNumber;
-  headSha: z.ZodString;
-  outcome: z.ZodLiteral<"inactive">;
-  reason: z.ZodString;
-  recordedAt: z.ZodISODateTime;
-  schemaVersion: z.ZodLiteral<1>;
-}, z.core.$strip>], "active">;
-type MergeFreezeState = z.infer<typeof mergeFreezeStateSchema>;
-/**
- * The write side of this contract lives in the generated main-push verify
- * workflow (#356, ADR 0016 as amended): it is the ONLY producer of
- * `patronage-factory/merge-freeze` generations. Its emitted `output.text`
- * payload must parse under this exact reader schema, which is what the
- * workflow's own tests assert through this export.
- */
-declare function validateMergeFreezeState(value: unknown): MergeFreezeState;
-interface MergeFreezeStoreInput {
-  cwd: string;
-  headSha: string;
-  repository: CheckoutRepository;
-}
-interface MergeFreezeStore {
-  read: (input: MergeFreezeStoreInput) => unknown;
-}
-declare namespace worktree_held_branch_d_exports {
-  export { MergeOperationalNotices, WorktreeHeldBranch, WorktreeHeldBranchCheck, WorktreeListEntry, checkWorktreeHeldBranch, findWorktreeHeldBranch, formatHeldBranchCloseoutSummary, listWorktreesPorcelain, parseGitWorktreeList, resolveMergeOperationalNotices, worktreeHeldBranchNotice };
-}
-/**
- * Detects when a PR head branch is checked out in a local git worktree.
- *
- * `gh pr merge --delete-branch` fails when the local branch is held by a
- * worktree (git refuses to delete a checked-out branch), which previously
- * broke the auto-merge lane mid-merge (patronage/internal#284). The merge
- * preflight surfaces this as an actionable notice — not a hard fail — so the
- * operator merges without `--delete-branch` (or prunes the worktree first)
- * and defers local branch cleanup to closeout.
- */
-interface WorktreeHeldBranch {
-  branch: string;
-  worktreePath: string;
-}
-interface WorktreeListEntry {
-  branch?: string;
-  path: string;
-}
-/**
- * Parses `git worktree list --porcelain` output. Entries are separated by
- * blank lines; each starts with `worktree <path>` and carries an optional
- * `branch refs/heads/<name>` attribute (detached worktrees have none).
- */
-declare function parseGitWorktreeList(porcelain: string): WorktreeListEntry[];
-/**
- * Returns the worktree holding `branch`, or undefined when no local worktree
- * has it checked out (or the porcelain listing was unavailable).
- */
-declare function findWorktreeHeldBranch({
-  branch,
-  worktreeListPorcelain
-}: {
-  branch: string;
-  worktreeListPorcelain: string | undefined;
-}): undefined | WorktreeHeldBranch;
-declare function worktreeHeldBranchNotice(held: WorktreeHeldBranch): string;
-interface MergeOperationalNotices {
-  notices: string[];
-  worktreeHeldBranch?: WorktreeHeldBranch;
-  worktreeHeldBranches?: WorktreeHeldBranch[];
-}
-/**
- * Single entry point for non-blocking merge preflight notices, mirroring
- * `resolveMergeGuardIdentity`/`mergeGuardBlockingReasons` in
- * merge-identity.ts: adding a notice kind never requires coordinated edits
- * in the command runner, and persisted notice strings cannot drift from the
- * structured detection result.
- */
-declare function resolveMergeOperationalNotices({
-  headRefName,
-  worktreeListPorcelain
-}: {
-  headRefName: string | undefined;
-  worktreeListPorcelain: string | undefined;
-}): MergeOperationalNotices;
-/**
- * Shared `git worktree list --porcelain` reader for merge preflight and
- * closeout. Returns undefined when the directory is missing, not a git
- * repository, or git is unavailable — detection is best-effort and callers
- * report "skipped" rather than fabricating a result.
- */
-declare function listWorktreesPorcelain(cwd: string): string | undefined;
-interface WorktreeHeldBranchCheck {
-  held?: WorktreeHeldBranch;
-  /** "skipped" means no branch was recorded or worktrees were unlistable. */
-  status: "clean" | "held" | "skipped";
-}
-/**
- * Closeout-side counterpart to the merge-preflight notice: the merge step
- * defers local branch cleanup to closeout, so closeout planning checks
- * whether the worker branch is still held by a worktree (#284).
- */
-declare function checkWorktreeHeldBranch({
-  branch,
-  worktreeListPorcelain
-}: {
-  branch: string | undefined;
-  worktreeListPorcelain: string | undefined;
-}): WorktreeHeldBranchCheck;
-/** One-line closeout summary, owned beside the detection logic. */
-declare function formatHeldBranchCloseoutSummary(check: WorktreeHeldBranchCheck): string;
-declare namespace merge_identity_d_exports {
-  export { LiveHeadInput, MergeGuardIdentity, MergeIdentityResult, PostProofCommit, ReadyProofForMergeIdentity, evaluateMergeIdentity, mergeGuardBlockingReasons, mergeGuardIdentitySchema, resolveMergeGuardIdentity };
-}
-interface PostProofCommit {
-  sha: string;
-  subject: string;
-}
-/**
- * The slice of the pr:ready proof the merge guard actually consumes, so this
- * module does not depend on the parent proof envelope. `PrReadyProof` is
- * structurally assignable to this type.
- */
-interface ReadyProofForMergeIdentity {
-  blockingReasons: string[];
-  ledger: {
-    /**
-     * The evaluated head SHA recorded by pr:ready: `pr.headRefOid` captured
-     * at evaluation time. The merge guard compares it to the live pushed
-     * HEAD with exact equality.
-     */
-    headSha: string;
-    pr: number;
-  };
-  status: string;
-}
-type MergeIdentityResult = {
-  kind: "match";
-  headSha: string;
-} | {
-  kind: "diverged";
-  liveHeadSha: string;
-  postProofCommits?: PostProofCommit[];
-  proofHeadSha: string;
-};
-type MergeGuardIdentity = MergeIdentityResult | {
-  kind: "live-head-invalid";
-  pr: number;
-  received: string;
-} | {
-  kind: "ready-proof-missing";
-  errorDetail?: string;
-  readyProofPath: string;
-} | {
-  kind: "ready-proof-pr-mismatch";
-  proofPr: number;
-  requestedPr: number;
-} | {
-  kind: "ready-proof-not-ready";
-  blockingReasons: string[];
-  status: string;
-};
-declare const evaluateMergeIdentity: ({
-  liveHeadSha,
-  postProofCommits,
-  proofHeadSha
-}: {
-  liveHeadSha: string;
-  postProofCommits?: PostProofCommit[];
-  proofHeadSha: string;
-}) => MergeIdentityResult;
-/**
- * The live PR head as fetched from GitHub: either a validated 40-hex SHA or
- * the raw (stringified) response that failed validation.
- */
-type LiveHeadInput = {
-  headSha: string;
-} | {
-  invalidResponse: string;
-};
-/**
- * Single entry point that owns construction of every MergeGuardIdentity
- * kind, so adding or changing a kind never requires coordinated edits in the
- * command runner.
- */
-declare const resolveMergeGuardIdentity: ({
-  commitsBetween,
-  liveHead,
-  pr,
-  readyProof,
-  readyProofError,
-  readyProofPath
-}: {
-  commitsBetween?: (fromSha: string, toSha: string) => PostProofCommit[] | undefined;
-  liveHead: LiveHeadInput;
-  pr: number;
-  readyProof: ReadyProofForMergeIdentity | undefined;
-  readyProofError?: unknown;
-  readyProofPath: string;
-}) => MergeGuardIdentity;
-declare const mergeGuardIdentitySchema: z.ZodType<MergeGuardIdentity>;
-declare const mergeGuardBlockingReasons: (identity: MergeGuardIdentity) => string[];
+//#region src/diff-classification.d.ts
+declare const DIFF_CLASSIFICATIONS: readonly ["docs/process-only", "trivial", "non-trivial"];
+type DiffClassification = (typeof DIFF_CLASSIFICATIONS)[number];
 //#endregion
 //#region src/profile.d.ts
 declare const DEFAULT_FACTORY_REPOSITORY = "unknown/unknown";
@@ -762,12 +557,11 @@ declare const factoryProjectProfileSchema: z.ZodObject<{
     }>;
     name: z.ZodString;
     scope: z.ZodOptional<z.ZodObject<{
-      classifications: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+      classifications: z.ZodArray<z.ZodEnum<{
         trivial: "trivial";
         "docs/process-only": "docs/process-only";
         "non-trivial": "non-trivial";
-      }>>>;
-      labels: z.ZodOptional<z.ZodArray<z.ZodString>>;
+      }>>;
     }, z.core.$strict>>;
   }, z.core.$strict>>>;
   review: z.ZodObject<{
@@ -779,16 +573,10 @@ declare const factoryProjectProfileSchema: z.ZodObject<{
       paths: z.ZodArray<z.ZodString>;
     }, z.core.$strict>>>;
     defaultMaxCycles: z.ZodNumber;
-    ladder: z.ZodOptional<z.ZodObject<{
-      gate: z.ZodOptional<z.ZodObject<{
-        cap: z.ZodNumber;
-      }, z.core.$strict>>;
-    }, z.core.$strict>>;
     modes: z.ZodArray<z.ZodEnum<{
       correctness: "correctness";
       security: "security";
     }>>;
-    standingChecklist: z.ZodOptional<z.ZodArray<z.ZodString>>;
   }, z.core.$strict>;
   schemaVersion: z.ZodLiteral<4>;
   verification: z.ZodObject<{
@@ -817,138 +605,6 @@ interface LoadProjectProfileResult {
 }
 declare function loadProjectProfile(input?: LoadProjectProfileInput): LoadProjectProfileResult;
 //#endregion
-//#region src/review-rungs.d.ts
-declare const EVIDENCE_REVIEW_RUNGS: readonly ["independent-model", "oracle", "human"];
-type EvidenceReviewRung = (typeof EVIDENCE_REVIEW_RUNGS)[number];
-//#endregion
-//#region src/pr-merge-check.d.ts
-interface PrMergeCheckArgs extends LoadProjectProfileInput {
-  epic?: number;
-  json?: boolean;
-  output?: string;
-  pr: number;
-  readyProof?: string;
-}
-interface PrMergeCheckProof {
-  schemaVersion: 1;
-  blockingReasons: string[];
-  boundary?: {
-    autoMerge: boolean;
-    epic: number;
-    review: EvidenceReviewRung;
-    wave: string;
-  };
-  command: "patronage-factory pr:merge-check";
-  /**
-   * Machine-safe arg array for the obvious next action (#523): on `pass`, the
-   * remote-only GitHub merge API invocation for this PR; on `fail`, the re-run that clears the
-   * block (`pr:ready`, or `pr:verify` then `pr:ready` after a head
-   * divergence). Same `argv` shape `factory:delegate --print` emits. Optional
-   * and purely additive — existing consumers ignore it.
-   */
-  followUp?: FollowUpAction;
-  identity: MergeGuardIdentity;
-  /**
-   * The pushed PR head SHA fetched from GitHub at check time. Absent only
-   * when GitHub returned no usable 40-hex head (identity kind
-   * "live-head-invalid"), which is itself a fail-closed blocking state.
-   */
-  liveHeadSha?: string;
-  /**
-   * Actionable operational notices that do not block the merge, e.g. a PR
-   * head branch held by a local worktree, which makes
-   * `gh pr merge --delete-branch` fail (patronage/internal#284).
-   */
-  notices?: string[];
-  pr: number;
-  status: "pass" | "fail";
-  /**
-   * Demands that were in force, were NOT met, and were waived by the operator
-   * (#354). Each entry carries the demand's refusals verbatim, so a waived
-   * demand can never read as a met one; the merge proceeds on the recorded
-   * operator act, not on evidence.
-   */
-  waivedDemands?: WaivedDemand[];
-  /** Present when the PR head branch is checked out in a local worktree. */
-  worktreeHeldBranch?: WorktreeHeldBranch;
-  /** All merge-relevant branches held by local worktrees (head and default). */
-  worktreeHeldBranches?: WorktreeHeldBranch[];
-}
-interface PrMergeCheckGitDependencies {
-  checkoutRepository: (cwd: string) => CheckoutRepository;
-  commitsBetween: (cwd: string, fromSha: string, toSha: string) => PostProofCommit[] | undefined;
-  worktreeListPorcelain: (cwd: string) => string | undefined;
-  showFileAtRef: (cwd: string, ref: string, absolutePath: string) => string | undefined;
-  objectIdAtRef: (cwd: string, ref: string, absolutePath: string) => string | undefined;
-}
-interface PrMergeCheckDependencies {
-  git?: Partial<PrMergeCheckGitDependencies>;
-  github?: {
-    fetchClosingPullRequests?: (input: {
-      issue: number;
-      owner: string;
-      repo: string;
-    }) => {
-      number: number;
-    }[];
-    fetchIssueBody?: (input: {
-      issue: number;
-      owner: string;
-      repo: string;
-    }) => string;
-    fetchPullRequestHead: (input: {
-      cwd: string;
-      owner: string;
-      pr: number;
-      repo: string;
-    }) => {
-      headRefName?: string;
-      headRefOid: string;
-      baseRefName?: string;
-      baseRefOid?: string;
-      mergedAt?: string | null;
-      remoteHeadRefExists?: boolean;
-      labels?: {
-        name: string;
-      }[];
-    };
-    fetchPullRequestReviews?: (input: {
-      owner: string;
-      pr: number;
-      repo: string;
-    }) => GithubPullRequestReview[];
-  };
-  mergeFreeze?: MergeFreezeStore;
-}
-declare function validatePrMergeCheckProof(value: unknown): PrMergeCheckProof;
-declare function readPrMergeCheckProof(filePath: string): PrMergeCheckProof;
-declare function runPrMergeCheck(args: PrMergeCheckArgs, dependencies?: PrMergeCheckDependencies): PrMergeCheckProof;
-//#endregion
-//#region src/pr-readiness/handled-human-comments.d.ts
-declare const HANDLED_COMMENTS_PAYLOAD_KIND: "handled-human-comments";
-/**
- * Authenticated producer of the durable handled set. Recorded on the readiness
- * ledger; unverifiable producers are ignored on read (fail closed).
- */
-type HandledCommentsProducerMode = "app" | "commit-status";
-interface HandledCommentsProducer {
-  /** App id (stringified) or GitHub login, depending on mode. */
-  identity: string;
-  mode: HandledCommentsProducerMode;
-}
-interface HandledCommentsCheckPayload {
-  clearedAt?: string;
-  handledCommentUrls: string[];
-  kind: typeof HANDLED_COMMENTS_PAYLOAD_KIND;
-  pr: number;
-  schemaVersion: 1;
-  sessionId?: string;
-}
-//#endregion
-//#region src/diff-classification.d.ts
-declare const DIFF_CLASSIFICATIONS: readonly ["docs/process-only", "trivial", "non-trivial"];
-type DiffClassification = (typeof DIFF_CLASSIFICATIONS)[number];
-//#endregion
 //#region src/pr-verify-mode.d.ts
 /**
  * The verification mode `pr:verify` resolved for a run.
@@ -1074,17 +730,104 @@ interface CheckRunDependencies {
  * human-readable mirror, not a proof surface, so a caller that needs an
  * App-verified check run must be told plainly whether it got one. Returns
  * `true` only when the App-owned check run landed.
+ *
+ * "Landed" means GitHub serves it, not that the POST was accepted (#520). On
+ * PR #519 the POST was accepted, `pr:ready` reported ready and armed, and the
+ * source-pinned required check read `in_progress` across three runs — so GitHub
+ * never scheduled the merge and emitted no rollup row saying why. Arming
+ * already refuses to infer its outcome from the invocation and reads the pull
+ * request back (`arm-auto-merge.ts`); publication now does the same.
+ *
+ * "Landed" is judged against every run of the name from the pinned App, not
+ * against the one GitHub collapses to (#524): the newest must be *this* run, in
+ * the status and conclusion that were published, and no run of the name may
+ * still be unfinished. A surviving `in_progress` run blocks the required check
+ * on its own, so confirming past it would report success on a pull request
+ * GitHub will never merge. One read, no polling: an unconfirmed publication
+ * returns `false`, which `pr:ready` already turns into a notice and an
+ * idempotent re-dispatch.
+ *
+ * Confirmation is a point-in-time read, deliberately: a later publication for
+ * the same name changes the answer — a completed one by becoming the newest, an
+ * unfinished one by holding the check open beside this verdict rather than
+ * replacing it — and every remaining writer publishes once, as the last thing
+ * its invocation does. No retry, no poll, no re-confirm.
  */
 declare function ensureFactoryCheckRunPublished(input: PublishFactoryCheckInput, dependencies?: CheckRunDependencies & {
   onDiagnostic?: (message: string) => void;
 }): Promise<boolean>;
-interface PublishHandledCommentsCheckInput {
+//#endregion
+//#region src/merge-freeze.d.ts
+declare const MERGE_FREEZE_CHECK_NAME = "patronage-factory/merge-freeze";
+declare const MERGE_FREEZE_APP_SLUG = "patronage-factory";
+declare const mergeFreezeStateSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+  active: z.ZodLiteral<true>;
+  generationId: z.ZodNumber;
+  headSha: z.ZodString;
+  outcome: z.ZodEnum<{
+    active: "active";
+    stale: "stale";
+  }>;
+  reason: z.ZodString;
+  recordedAt: z.ZodISODateTime;
+  schemaVersion: z.ZodLiteral<1>;
+}, z.core.$strip>, z.ZodObject<{
+  active: z.ZodLiteral<false>;
+  clearRationale: z.ZodOptional<z.ZodString>;
+  generationId: z.ZodNumber;
+  headSha: z.ZodString;
+  outcome: z.ZodLiteral<"inactive">;
+  reason: z.ZodString;
+  recordedAt: z.ZodISODateTime;
+  schemaVersion: z.ZodLiteral<1>;
+}, z.core.$strip>], "active">;
+type MergeFreezeState = z.infer<typeof mergeFreezeStateSchema>;
+/**
+ * The write side of this contract lives in the generated main-push verify
+ * workflow (#356, ADR 0016 as amended): it is the ONLY producer of
+ * `patronage-factory/merge-freeze` generations. Its emitted `output.text`
+ * payload must parse under this exact reader schema, which is what the
+ * workflow's own tests assert through this export.
+ */
+declare function validateMergeFreezeState(value: unknown): MergeFreezeState;
+interface MergeFreezeStoreInput {
   cwd: string;
-  owner: string;
-  payload: HandledCommentsCheckPayload;
-  pr: number;
-  repo: string;
-  sha: string;
+  headSha: string;
+  repository: CheckoutRepository;
+}
+interface MergeFreezeStore {
+  read: (input: MergeFreezeStoreInput) => unknown;
+}
+/**
+ * The freeze generation as a readiness decision needs to see it (#477).
+ *
+ * `read` above collapses three different situations into one refusal, because
+ * merge time treated all of them as "do not merge". Readiness distinguishes
+ * them: a settled generation is the writer's verdict, a **settling** one is the
+ * window between a merge landing and its main-push verify completing (a
+ * running generation, or a missing generation proven by the immediately prior
+ * settled tip plus a current source-pinned verify run), and an **unreadable**
+ * one is ambiguous, malformed, foreign-App, or unavailable state. Same
+ * selection, same pinned App, same `started_at` ordering — only the reporting
+ * is finer.
+ */
+type MergeFreezeGeneration = {
+  kind: "settled";
+  state: MergeFreezeState;
+} | {
+  kind: "settling";
+  reason: string;
+  running?: {
+    headSha: string;
+    id: number;
+  };
+} | {
+  kind: "unreadable";
+  reason: string;
+};
+/** A merge-freeze reader that can also report the settle window (#477). */
+interface MergeFreezeAuthority extends MergeFreezeStore {
+  readGeneration: (input: MergeFreezeStoreInput) => MergeFreezeGeneration;
 }
 //#endregion
 //#region src/pr-proof-io.d.ts
@@ -1099,7 +842,6 @@ interface ProofDescriptor<T> {
 declare const reviewPromptSectionSchema: z.ZodObject<{
   provenance: z.ZodEnum<{
     "prior-review-ledger": "prior-review-ledger";
-    "profile-standing-checklist": "profile-standing-checklist";
     "issue-review-focus": "issue-review-focus";
   }>;
   source: z.ZodString;
@@ -1110,7 +852,6 @@ type ReviewPromptSectionProvenance = ReviewPromptSection["provenance"];
 declare const reviewPromptSectionsSchema: z.ZodArray<z.ZodObject<{
   provenance: z.ZodEnum<{
     "prior-review-ledger": "prior-review-ledger";
-    "profile-standing-checklist": "profile-standing-checklist";
     "issue-review-focus": "issue-review-focus";
   }>;
   source: z.ZodString;
@@ -1150,6 +891,10 @@ interface ReviewLadderPolicy {
 }
 declare const resolveReviewLadderPolicy: (profile: Pick<FactoryProjectProfile, "review">) => ReviewLadderPolicy;
 //#endregion
+//#region src/review-rungs.d.ts
+declare const EVIDENCE_REVIEW_RUNGS: readonly ["independent-model", "oracle", "human"];
+type EvidenceReviewRung = (typeof EVIDENCE_REVIEW_RUNGS)[number];
+//#endregion
 //#region src/review-ladder-ledger.d.ts
 type LadderCycleStage = "interior" | "gate";
 interface LadderCycleRef {
@@ -1388,33 +1133,11 @@ interface PrReviewProof {
 //#endregion
 //#region src/pr-readiness/readiness-ledger.d.ts
 declare const SCHEMA_VERSION = 1;
-declare const previewDeploySchema: z.ZodObject<{
-  adminUrl: z.ZodOptional<z.ZodString>;
-  apiHealthUrl: z.ZodOptional<z.ZodString>;
-  headSha: z.ZodOptional<z.ZodString>;
-  localPreviewProof: z.ZodOptional<z.ZodUnknown>;
-  localProofPath: z.ZodOptional<z.ZodString>;
-  proofSource: z.ZodOptional<z.ZodEnum<{
-    "github-actions": "github-actions";
-    "local-self-certified": "local-self-certified";
-  }>>;
-  publicUrl: z.ZodOptional<z.ZodString>;
-  seedStatus: z.ZodEnum<{
-    unknown: "unknown";
-    skipped: "skipped";
-    passed: "passed";
-    failed: "failed";
-  }>;
-  stage: z.ZodOptional<z.ZodString>;
-  timingsMs: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodOptional<z.ZodNumber>>>;
-  workflowRunUrl: z.ZodOptional<z.ZodString>;
-}, z.core.$strip>;
-declare const READINESS_REPAIR_CODES: readonly ["undraft-pr", "render-pr-body-sections", "await-post-undraft-checks"];
+declare const READINESS_REPAIR_CODES: readonly ["undraft-pr", "await-post-undraft-checks"];
 declare const readinessRepairSchema: z.ZodObject<{
   action: z.ZodString;
   code: z.ZodEnum<{
     "undraft-pr": "undraft-pr";
-    "render-pr-body-sections": "render-pr-body-sections";
     "await-post-undraft-checks": "await-post-undraft-checks";
   }>;
   command: z.ZodString;
@@ -1436,12 +1159,11 @@ declare const managedReadinessLedgerSchema: z.ZodObject<{
     name: z.ZodString;
     reason: z.ZodOptional<z.ZodString>;
     scope: z.ZodOptional<z.ZodObject<{
-      classifications: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+      classifications: z.ZodArray<z.ZodEnum<{
         trivial: "trivial";
         "docs/process-only": "docs/process-only";
         "non-trivial": "non-trivial";
-      }>>>;
-      labels: z.ZodOptional<z.ZodArray<z.ZodString>>;
+      }>>;
     }, z.core.$strict>>;
     scopeReason: z.ZodString;
     status: z.ZodEnum<{
@@ -1450,80 +1172,28 @@ declare const managedReadinessLedgerSchema: z.ZodObject<{
       "out-of-scope": "out-of-scope";
     }>;
   }, z.core.$strip>>>;
-  finalReviewPoint: z.ZodBoolean;
   github: z.ZodObject<{
-    currentWithBase: z.ZodBoolean;
     draft: z.ZodBoolean;
     mergeStateStatus: z.ZodString;
     mergeable: z.ZodString;
     requiredChecks: z.ZodEnum<{
       unknown: "unknown";
-      pending: "pending";
       passed: "passed";
       failed: "failed";
+      pending: "pending";
       none: "none";
     }>;
+    reviewDecision: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     unresolvedReviewThreads: z.ZodNumber;
   }, z.core.$strip>;
-  handledCommentsProducer: z.ZodOptional<z.ZodObject<{
-    identity: z.ZodString;
-    mode: z.ZodEnum<{
-      app: "app";
-      "commit-status": "commit-status";
-    }>;
-  }, z.core.$strip>>;
-  handledHumanComments: z.ZodOptional<z.ZodArray<z.ZodObject<{
-    clearedAt: z.ZodOptional<z.ZodString>;
-    sessionId: z.ZodOptional<z.ZodString>;
-    source: z.ZodEnum<{
-      "check-run": "check-run";
-      cli: "cli";
-    }>;
-    url: z.ZodString;
-  }, z.core.$strip>>>;
   headSha: z.ZodString;
   mergeBaseSha: z.ZodOptional<z.ZodString>;
   patchId: z.ZodString;
-  postReadinessHumanComments: z.ZodOptional<z.ZodArray<z.ZodObject<{
-    author: z.ZodString;
-    createdAt: z.ZodString;
-    summary: z.ZodString;
-    url: z.ZodString;
-  }, z.core.$strip>>>;
-  postReadinessHumanReviews: z.ZodOptional<z.ZodArray<z.ZodObject<{
-    author: z.ZodString;
-    createdAt: z.ZodString;
-    summary: z.ZodString;
-    url: z.ZodString;
-  }, z.core.$strip>>>;
   pr: z.ZodNumber;
-  previewDeploy: z.ZodOptional<z.ZodObject<{
-    adminUrl: z.ZodOptional<z.ZodString>;
-    apiHealthUrl: z.ZodOptional<z.ZodString>;
-    headSha: z.ZodOptional<z.ZodString>;
-    localPreviewProof: z.ZodOptional<z.ZodUnknown>;
-    localProofPath: z.ZodOptional<z.ZodString>;
-    proofSource: z.ZodOptional<z.ZodEnum<{
-      "github-actions": "github-actions";
-      "local-self-certified": "local-self-certified";
-    }>>;
-    publicUrl: z.ZodOptional<z.ZodString>;
-    seedStatus: z.ZodEnum<{
-      unknown: "unknown";
-      skipped: "skipped";
-      passed: "passed";
-      failed: "failed";
-    }>;
-    stage: z.ZodOptional<z.ZodString>;
-    timingsMs: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodOptional<z.ZodNumber>>>;
-    workflowRunUrl: z.ZodOptional<z.ZodString>;
-  }, z.core.$strip>>;
-  previewDeployRequired: z.ZodBoolean;
   repairs: z.ZodDefault<z.ZodArray<z.ZodObject<{
     action: z.ZodString;
     code: z.ZodEnum<{
       "undraft-pr": "undraft-pr";
-      "render-pr-body-sections": "render-pr-body-sections";
       "await-post-undraft-checks": "await-post-undraft-checks";
     }>;
     command: z.ZodString;
@@ -1589,39 +1259,31 @@ declare const managedReadinessLedgerSchema: z.ZodObject<{
   }>>;
   reviews: z.ZodObject<{
     correctness: z.ZodObject<{
-      docsOnlyDeltaAccepted: z.ZodOptional<z.ZodBoolean>;
       required: z.ZodBoolean;
       reviewedHeadSha: z.ZodOptional<z.ZodString>;
       reviewedPatchId: z.ZodOptional<z.ZodString>;
       status: z.ZodEnum<{
         blocked: "blocked";
-        "not-required": "not-required";
         stale: "stale";
+        "not-required": "not-required";
         current: "current";
         missing: "missing";
       }>;
     }, z.core.$strip>;
     security: z.ZodOptional<z.ZodObject<{
-      docsOnlyDeltaAccepted: z.ZodOptional<z.ZodBoolean>;
       required: z.ZodBoolean;
       reviewedHeadSha: z.ZodOptional<z.ZodString>;
       reviewedPatchId: z.ZodOptional<z.ZodString>;
       status: z.ZodEnum<{
         blocked: "blocked";
-        "not-required": "not-required";
         stale: "stale";
+        "not-required": "not-required";
         current: "current";
         missing: "missing";
       }>;
     }, z.core.$strip>>;
   }, z.core.$strip>;
   schemaVersion: z.ZodLiteral<1>;
-  stackRole: z.ZodEnum<{
-    slice: "slice";
-    single: "single";
-    rollup: "rollup";
-    "merge-gate prerequisite": "merge-gate prerequisite";
-  }>;
   verification: z.ZodObject<{
     command: z.ZodLiteral<"patronage-factory pr:verify">;
     docsOnlyDeltaAccepted: z.ZodOptional<z.ZodBoolean>;
@@ -1636,14 +1298,12 @@ declare const managedReadinessLedgerSchema: z.ZodObject<{
     verifiedHeadSha: z.ZodOptional<z.ZodString>;
   }, z.core.$strip>;
 }, z.core.$strip>;
-type PreviewDeployProof = z.infer<typeof previewDeploySchema>;
-type PreviewSeedStatus = PreviewDeployProof["seedStatus"];
 type ReadinessRepair = z.infer<typeof readinessRepairSchema>;
-type ReadinessStatus = "ready" | "blocked" | "slice-ready/not-final";
+type ReadinessStatus = "ready" | "blocked";
 type ManagedReadinessLedger = z.infer<typeof managedReadinessLedgerSchema>;
 declare function validateManagedReadinessLedger(value: unknown): ManagedReadinessLedger;
 declare namespace status_check_rollup_d_exports {
-  export { CheckState, StatusCheckRollup, isFactoryReadyCheck, statusCheckState };
+  export { CheckState, HOSTED_VERIFY_CHECK_NAME, StatusCheckRollup, hostedVerifyCheckState, isFactoryReadyCheck, isHostedVerifyCheck, statusCheckState };
 }
 type CheckState = "passed" | "failed" | "pending" | "none" | "unknown";
 interface StatusCheckRollup {
@@ -1658,15 +1318,45 @@ interface StatusCheckRollup {
   workflowName?: string;
 }
 declare const isFactoryReadyCheck: (check: StatusCheckRollup) => boolean;
+/**
+ * The hosted verification gate's context name — the branch ruleset's other
+ * source-pinned required check, alongside `patronage-factory/pr-ready`. One
+ * name across the fleet because one generator emits the workflow that posts
+ * it (ADR 0016, 2026-07-31 amendment).
+ */
+declare const HOSTED_VERIFY_CHECK_NAME = "verify";
+/**
+ * Is this rollup entry the hosted `verify` gate, from the producer the
+ * ruleset pins it to?
+ *
+ * `workflowName` is the producer signal the rollup actually carries: GitHub
+ * Actions check runs name their workflow, App-posted check runs come back with
+ * an empty one, and a user-token commit status arrives as a `context` with no
+ * `name` at all. Epic #473 wave 2 measured that a same-named check from the
+ * wrong writer is as inert as no check at all, so matching the name alone
+ * would accept exactly the thing the pin rejects.
+ */
+declare const isHostedVerifyCheck: (check: StatusCheckRollup) => boolean;
+/**
+ * The hosted `verify` gate's state on this head, read by presence (#477).
+ *
+ * This is the one rollup question the rollup can answer honestly. Wave 2
+ * measured that GitHub omits an *unsatisfied pinned requirement* from
+ * `statusCheckRollup` entirely — there is no "expected" or "missing" row — so
+ * a green rollup is not evidence of mergeability. What the rollup does report
+ * faithfully is the checks that ran. Asking whether this specific check ran,
+ * and passed, on this head turns the rollup's silence from a false green into
+ * a named refusal: `"none"` means the pinned requirement is unsatisfied and
+ * nothing else in the rollup would have said so.
+ */
+declare const hostedVerifyCheckState: (rollup: StatusCheckRollup[] | undefined) => CheckState;
 declare const statusCheckState: (rollup: StatusCheckRollup[] | undefined, exclude?: (check: StatusCheckRollup) => boolean) => CheckState;
 //#endregion
 //#region src/pr-ready.d.ts
 interface PrReadyArgs extends LoadProjectProfileInput {
   authoringSessionIds?: string[];
   base: string;
-  bodyForEvaluation?: string;
   epic?: number;
-  handledCommentUrls?: string[];
   json?: boolean;
   output?: string;
   report?: boolean;
@@ -1676,44 +1366,50 @@ interface PrReadyArgs extends LoadProjectProfileInput {
   verifyProof?: string;
 }
 interface GitHubPullRequest {
+  /**
+   * GitHub's live auto-merge enablement, or `null` when nothing is scheduled.
+   *
+   * Required, not optional (#515 review). `gh pr view --json autoMergeRequest`
+   * always returns the key — explicitly `null` when nothing is scheduled — and
+   * errors loudly on a field name it does not know, so there is no shape where
+   * the real CLI omits it. But `fetchPullRequest` is injectable, and an
+   * implementation that left the field out would silently disable the
+   * `boundary-wave` refusal that stops an epicless run from greening a
+   * candidate GitHub is already scheduled to merge. Requiring it makes the
+   * compiler enforce what `gh` already promises.
+   */
+  autoMergeRequest: {
+    enabledAt?: string;
+  } | null;
   baseRefName: string;
   baseRefOid: string;
   body: string;
-  comments: {
-    author?: {
-      login?: string;
-    };
-    body: string;
-    createdAt?: string;
-    id?: string | number;
-    updatedAt?: string;
-    url?: string;
-  }[];
   headRefOid: string;
   isDraft: boolean;
-  labels?: {
-    name: string;
-  }[];
   mergeStateStatus: string;
   mergeable: string;
   number: number;
-  reviews?: {
-    author?: {
-      login?: string;
-    };
-    body?: string;
-    lastEditedAt?: string;
-    state: string;
-    submittedAt?: string;
-    url?: string;
-  }[];
+  reviewDecision: string | null;
   statusCheckRollup?: StatusCheckRollup[];
   title: string;
   unresolvedReviewThreads: number;
   url: string;
 }
 interface PrReadyProof {
-  schemaVersion: 2;
+  schemaVersion: 3;
+  /**
+   * What GitHub actually did when this run armed native auto-merge (#477).
+   * Present exactly when a ready wave authorizes machine merge and arming ran;
+   * read back from the PR rather than inferred from the invocation, because `gh pr merge
+   * --auto` arms, merges, or does nothing with the same exit code and the same
+   * empty output. `not-armed` means the candidate is admitted but nothing will
+   * merge it, and `followUp` carries the re-dispatch.
+   */
+  arming?: {
+    detail?: string;
+    headSha: string;
+    outcome: "armed" | "merged" | "not-armed";
+  };
   /**
    * Why this run blocked, one entry per refusing demand (#391): `code` is the
    * demand key from the resolver's vocabulary, `detail` the one-sentence
@@ -1726,11 +1422,12 @@ interface PrReadyProof {
   humanBlockingReasons: string[];
   command: "patronage-factory pr:ready";
   /**
-   * Machine-safe arg array for the obvious next action (#523): when `ready`,
-   * the `pr:merge-check` that must precede a merge; otherwise the `pr:verify`
-   * re-run that the blocking reasons name (re-verify the head, then re-run
-   * pr:ready). Same `argv` shape `factory:delegate --print` emits. Optional
-   * and purely additive.
+   * Machine-safe arg array for the obvious next action (#523): when `ready`
+   * but arming did not take effect, a `pr:ready` re-dispatch (idempotent on
+   * an unchanged head); otherwise the `gh pr ready` undraft repair or the
+   * `pr:verify` re-run that the blocking reasons name (re-verify the head,
+   * then re-run pr:ready). Same `argv` shape `factory:delegate --print`
+   * emits. Optional and purely additive.
    */
   followUp?: FollowUpAction;
   /**
@@ -1740,6 +1437,13 @@ interface PrReadyProof {
    * pushed HEAD, not a re-derivation. See the ledger schema.
    */
   ledger: ManagedReadinessLedger;
+  /**
+   * Actionable facts that did not block (#477): a settling merge-freeze
+   * generation that permitted readiness and any authorized arming with a
+   * notice, an admitted-but-unscheduled false boundary wave, and how each
+   * waived demand reads to a human. Absent when there are none.
+   */
+  notices?: string[];
   /** Committed profile blob evaluated by readiness. Required for merge. */
   profileBlobSha?: string;
   /** Checkout-relative committed profile path evaluated by readiness. */
@@ -1748,9 +1452,21 @@ interface PrReadyProof {
   /** Trusted checkout repository used for all GitHub reads and writes. */
   repository?: string;
   status: ReadinessStatus;
+  /**
+   * Demands that were in force, were NOT met, and were waived by the operator
+   * (#354, moved here from the merge-time proof by #477). Each entry carries
+   * the demand's refusals verbatim, so a waived demand can never read as a met
+   * one; readiness proceeds on the recorded operator act, not on evidence.
+   */
+  waivedDemands?: WaivedDemand[];
 }
-type PublishHandledCommentsResult = HandledCommentsProducer | Promise<HandledCommentsProducer | undefined> | undefined;
 interface PrReadyDependencies {
+  /**
+   * Arms GitHub native auto-merge only for a passing boundary wave that
+   * authorizes machine merge (#477). Defaults to the real `gh pr merge --auto`
+   * call plus the read-back that says what actually happened.
+   */
+  armAutoMerge?: (input: ArmAutoMergeInput) => ArmAutoMergeOutcome;
   github?: {
     fetchClosingPullRequests?: (input: {
       issue: number;
@@ -1764,33 +1480,36 @@ interface PrReadyDependencies {
       owner: string;
       repo: string;
     }) => string;
-    fetchHandledComments?: (input: {
-      owner: string;
-      pr: number;
-      repo: string;
-    }) => {
-      producer?: HandledCommentsProducer;
-      urls: string[];
-    }; /** @deprecated Prefer fetchHandledComments (includes producer identity). */
-    fetchHandledCommentUrls?: (input: {
-      owner: string;
-      pr: number;
-      repo: string;
-    }) => string[];
     fetchPullRequest: (input: {
       owner: string;
       repo: string;
       pr: number;
     }) => GitHubPullRequest;
-    publishHandledCommentsCheck?: (input: PublishHandledCommentsCheckInput) => PublishHandledCommentsResult;
   };
   git?: PrReadyGitDependencies;
   hq?: HqIngestDependencies;
-  publishCheckRun?: (input: PublishFactoryCheckInput) => void;
+  /**
+   * The authoritative merge-freeze reader (#477). Defaults to the pinned-App
+   * GitHub check-run authority — readiness is a control, so an absent
+   * dependency must not mean an unread freeze.
+   */
+  mergeFreeze?: Pick<MergeFreezeAuthority, "readGeneration">;
+  /**
+   * Awaited publication of the branded check, which is a source-pinned
+   * required check rather than a mirror (#477). Returns true only when the
+   * App-owned run landed. Defaults to `ensureFactoryCheckRunPublished`.
+   *
+   * `pr:ready` has no other publication seam, and this one cannot express a
+   * non-terminal run (#526): `status` is omitted from the input, so every run
+   * readiness creates is completed with a conclusion. A `pr:ready` invocation
+   * therefore cannot leave a run holding the source-pinned required check
+   * open, which is a permanent block on the pull request (#524).
+   */
+  publishFinalCheckRun?: (input: Omit<PublishFactoryCheckInput, "status"> & {
+    conclusion: "failure" | "success";
+  }) => Promise<boolean> | boolean;
   /** Injectable delay for the UNKNOWN-mergeable brief poll (tests). */
   sleep?: (ms: number) => Promise<void>;
-  /** Injectable clock for CLI handled-comment provenance (tests). */
-  now?: () => Date;
 }
 interface PrReadyGitDependencies {
   canResolveCommit: (cwd: string, sha: string) => boolean;
@@ -1811,16 +1530,14 @@ declare function runPrReady(args: PrReadyArgs, dependencies?: PrReadyDependencie
 declare const EVIDENCE_CHECK_TYPES: readonly ["review", "verify"];
 type EvidenceCheckType = (typeof EVIDENCE_CHECK_TYPES)[number];
 declare const requiredCheckScopeSchema: z.ZodObject<{
-  classifications: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+  classifications: z.ZodArray<z.ZodEnum<{
     trivial: "trivial";
     "docs/process-only": "docs/process-only";
     "non-trivial": "non-trivial";
-  }>>>;
-  labels: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  }>>;
 }, z.core.$strict>;
 type RequiredCheckScope = z.infer<typeof requiredCheckScopeSchema>;
 interface RequiredCheckScopeContext {
-  labels: string[] | undefined;
   classification: DiffClassification | undefined;
 }
 interface ScopeDecision {
@@ -1983,8 +1700,8 @@ declare const loadEvidenceEnvelopes: (cwd: string) => LoadedEvidenceEnvelope[];
 declare const REVIEW_STATUS_VALUES: readonly ["not-required", "current", "stale", "missing", "blocked"];
 declare const reviewStatusSchema: z.ZodEnum<{
   blocked: "blocked";
-  "not-required": "not-required";
   stale: "stale";
+  "not-required": "not-required";
   current: "current";
   missing: "missing";
 }>;
@@ -2342,11 +2059,6 @@ declare const retroEnvelopeV1Schema: z.ZodObject<{
   }, z.core.$strict>;
   kind: z.ZodLiteral<"retro-envelope">;
   outcome: z.ZodOptional<z.ZodObject<{
-    mergeCheck: z.ZodOptional<z.ZodEnum<{
-      pass: "pass";
-      fail: "fail";
-      "not-run": "not-run";
-    }>>;
     status: z.ZodEnum<{
       success: "success";
       fail: "fail";
@@ -2571,9 +2283,6 @@ declare const runDemandWaive: (args: DemandWaiveArgs, dependencies?: DemandWaive
 //#region src/commands/demand-waive.d.ts
 type DemandWaiveAction = (args: DemandWaiveArgs) => DemandWaiver;
 //#endregion
-//#region src/commands/pr-merge-check.d.ts
-type PrMergeCheckAction = (args: PrMergeCheckArgs) => PrMergeCheckProof;
-//#endregion
 //#region src/hq-credentials.d.ts
 /**
  * Why a reference did not resolve. Each value names a different remedy, and
@@ -2703,6 +2412,15 @@ type FollowUpRunner = (followUp: FollowUpAction, cwd: string) => Promise<void> |
 interface PrPublishHandoff {
   humanActions: string[];
   routeOwnedRepairs: ReadinessRepair[];
+  /**
+   * Whether the merge is actually on GitHub's schedule (#477, #515 review).
+   * An admitted candidate is not a handed-off one: `pr:ready` arms only when a
+   * boundary wave authorized it, and the arming can fail to take effect. A
+   * readiness status of `ready` says the candidate passed, never that anything
+   * will merge it — only an auto-merge-authorized boundary wave can schedule
+   * one — so publish reads this before claiming nothing is owed.
+   */
+  scheduled: boolean;
   status: PrReadyProof["status"];
 }
 type PrPublishFollowUpOutcome = {
@@ -2930,11 +2648,11 @@ declare const LegacyWorkerCloseoutStatusTraceEventSchema: z.ZodObject<{
   threadId: z.ZodOptional<z.ZodString>;
   workerId: z.ZodOptional<z.ZodString>;
   archiveStatus: z.ZodOptional<z.ZodEnum<{
+    pending: "pending";
     unavailable: "unavailable";
     archived: "archived";
     skipped: "skipped";
     "not-applicable": "not-applicable";
-    pending: "pending";
   }>>;
   closeoutReason: z.ZodOptional<z.ZodString>;
   eventType: z.ZodLiteral<"worker-closeout-lessons">;
@@ -3325,11 +3043,11 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
   threadId: z.ZodOptional<z.ZodString>;
   workerId: z.ZodOptional<z.ZodString>;
   archiveStatus: z.ZodOptional<z.ZodEnum<{
+    pending: "pending";
     unavailable: "unavailable";
     archived: "archived";
     skipped: "skipped";
     "not-applicable": "not-applicable";
-    pending: "pending";
   }>>;
   closeoutReason: z.ZodOptional<z.ZodString>;
   eventType: z.ZodLiteral<"worker-closeout-lessons">;
@@ -3366,11 +3084,11 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
   }, z.core.$strict>], "lessonStatus">;
   readonly 2: z.ZodObject<{
     archiveStatus: z.ZodOptional<z.ZodEnum<{
+      pending: "pending";
       unavailable: "unavailable";
       archived: "archived";
       skipped: "skipped";
       "not-applicable": "not-applicable";
-      pending: "pending";
     }>>;
     closeoutReason: z.ZodOptional<z.ZodString>;
     lessonStatus: z.ZodOptional<z.ZodEnum<{
@@ -3857,7 +3575,7 @@ declare const scanFactoryTraceDiagnostics: ({
 //#endregion
 //#region src/interior-telemetry/gate-timing.d.ts
 declare const GATE_TIMING_SCHEMA_VERSION = 1;
-type FactoryGateName = "boundary:check" | "factory:closeout" | "pr:merge-check" | "pr:ready" | "pr:review" | "pr:verify";
+type FactoryGateName = "boundary:check" | "factory:closeout" | "pr:ready" | "pr:review" | "pr:verify";
 type GateTimingOutcome = "fail" | "pass";
 interface GateTimingRecord {
   agentRunId: string;
@@ -4042,119 +3760,10 @@ type WorktreeRootLister = (worktreePath: string) => string[] | undefined;
 declare function checkWorktreeScratchFiles(worktreePath?: string, listRootEntries?: WorktreeRootLister): WorktreeScratchFileCheck;
 /**
  * Human-readable one-line summary of a scratch-file check, owned beside the
- * detection logic (mirroring worktreeHeldBranchNotice) so planner output,
- * docs, and future surfaces cannot drift apart.
+ * detection logic so planner output, docs, and future surfaces cannot drift
+ * apart.
  */
 declare function formatScratchFileCheckSummary(check: WorktreeScratchFileCheck): string;
-declare namespace pr_body_metadata_d_exports {
-  export { PrBodyMetadata, StackRole, readPrBodyMetadata };
-}
-type StackRole = "single" | "slice" | "rollup" | "merge-gate prerequisite";
-interface PrBodyMetadata {
-  requiredSectionsPresent: boolean;
-  stackRole: StackRole;
-  finalReviewPoint: boolean;
-  trivialWaiverAccepted: boolean;
-}
-declare const readPrBodyMetadata: (body: string) => PrBodyMetadata;
-declare namespace post_readiness_comments_d_exports {
-  export { BLOCKING_REVIEW_STATE, HandledCommentEntry, PostReadinessHumanComment, PrReadinessComment, PrReadinessReview, activePostReadinessHumanComments, activePostReadinessHumanReviews, isBotLogin, postReadinessHumanCommentReason, postReadinessHumanReviewReason, selectPostReadinessHumanComments };
-}
-interface PrReadinessComment {
-  author?: {
-    login?: string;
-  };
-  body: string;
-  createdAt?: string;
-  id?: string | number;
-  updatedAt?: string;
-  url?: string;
-}
-interface PrReadinessReview {
-  author?: {
-    login?: string;
-  };
-  body?: string;
-  /** GraphQL `PullRequestReview.lastEditedAt` — the body-edit signal used to re-arm a cleared review (#843). */
-  lastEditedAt?: string;
-  state: string;
-  submittedAt?: string;
-  url?: string;
-}
-interface PostReadinessHumanComment {
-  author: string;
-  createdAt: string;
-  summary: string;
-  url: string;
-}
-declare const BLOCKING_REVIEW_STATE = "CHANGES_REQUESTED";
-interface HandledCommentEntry {
-  clearedAt?: string;
-  url: string;
-}
-/**
- * Active human blocking comments: all non-bot human PR comments minus the
- * explicitly-handled URL set. No review-timestamp recency gate — an unhandled
- * blocker blocks regardless of later review runs (#819 cycle 3). A handled
- * comment that is EDITED after it was cleared re-arms (#825a).
- */
-declare const selectPostReadinessHumanComments: ({
-  comments,
-  handledComments
-}: {
-  comments: PrReadinessComment[];
-  handledComments?: HandledCommentEntry[];
-}) => PostReadinessHumanComment[];
-/**
- * Active human blockers are recomputed from live GitHub comments each run
- * (#819). The prior local readiness proof is not a carry source —
- * `.factory-memory/` is gitignored and vanishes on clean checkout. Clearing
- * persists only via the durable handled set (factory check-run
- * `patronage-factory/handled-comments`) plus explicit `--handled-comment`.
- */
-declare const activePostReadinessHumanComments: ({
-  comments,
-  handledComments
-}: {
-  comments: PrReadinessComment[];
-  handledComments?: HandledCommentEntry[];
-}) => PostReadinessHumanComment[];
-/**
- * Active CHANGES_REQUESTED PR review submissions (#825b): a top-level review
- * body carries no inline thread, so without this scan it is the only human
- * channel auto-merge would sail over — unwatched by both the issue-comment
- * scan and the unresolved-review-thread count. Shares the handled-set /
- * re-arm rules with comments so an operator can clear a stale request the
- * same way (`--handled-comment <review-url>`). The clear-comparison uses
- * `lastEditedAt` when present so a body edit after a clear re-arms the
- * blocker the same way an edited comment does — resubmission is not the
- * only edit signal GitHub exposes (#843).
- */
-declare const activePostReadinessHumanReviews: ({
-  handledComments,
-  reviews
-}: {
-  handledComments?: HandledCommentEntry[];
-  reviews: PrReadinessReview[];
-}) => PostReadinessHumanComment[];
-declare const postReadinessHumanCommentReason: ({
-  comment,
-  pr,
-  prTitle
-}: {
-  comment: PostReadinessHumanComment;
-  pr: number;
-  prTitle?: string;
-}) => string;
-declare const postReadinessHumanReviewReason: ({
-  pr,
-  prTitle,
-  review
-}: {
-  pr: number;
-  prTitle?: string;
-  review: PostReadinessHumanComment;
-}) => string;
 //#endregion
 //#region src/pr-readiness/pr-body-sections.d.ts
 declare const MANAGED_SECTION_NAMES: readonly ["Verification", "Review proof", "How to review"];
@@ -4271,29 +3880,27 @@ interface WaveReviewDemand {
   wave: string;
 }
 declare namespace readiness_evaluation_d_exports {
-  export { CORRECTNESS_UNTYPED_REVIEW_BLOCKER_REASON, DRAFT_BLOCKER_REASON, EvaluationInput, ManagedReadinessLedger, PENDING_CHECKS_BLOCKER_REASON_PREFIX, PreviewDeployProof, PreviewSeedStatus, READINESS_REPAIR_CODES, RENDER_PR_BODY_SECTIONS_BLOCKER_REASON, ReadinessRepair, ReadinessStatus, SCHEMA_VERSION, SECURITY_UNTYPED_REVIEW_BLOCKER_REASON, evaluateReadiness, managedReadinessLedgerSchema, readinessExitCode, readinessRepairSchema, validateManagedReadinessLedger };
+  export { CORRECTNESS_UNTYPED_REVIEW_BLOCKER_REASON, DRAFT_BLOCKER_REASON, EvaluationInput, ManagedReadinessLedger, PENDING_CHECKS_BLOCKER_REASON_PREFIX, READINESS_REPAIR_CODES, ReadinessRepair, ReadinessStatus, SCHEMA_VERSION, SECURITY_UNTYPED_REVIEW_BLOCKER_REASON, evaluateReadiness, managedReadinessLedgerSchema, readinessExitCode, readinessRepairSchema, validateManagedReadinessLedger };
 }
 declare const CORRECTNESS_UNTYPED_REVIEW_BLOCKER_REASON = "Correctness review proof is not a head-bound typed findings verdict; re-run pr:review with a valid findings file.";
 declare const SECURITY_UNTYPED_REVIEW_BLOCKER_REASON = "Security review proof is not a head-bound typed findings verdict; re-run pr:review with a valid findings file.";
 declare const DRAFT_BLOCKER_REASON = "PR is still marked draft.";
-declare const RENDER_PR_BODY_SECTIONS_BLOCKER_REASON = "PR body must include Verification, Review proof, and How to review sections.";
 declare const PENDING_CHECKS_BLOCKER_REASON_PREFIX = "Required/current checks are";
 declare const readinessExitCode: (status: ReadinessStatus) => 1 | 0;
 interface EvaluationInput {
   pr: number;
   prTitle?: string;
-  body: string;
   headSha: string;
   localHeadSha?: string;
   baseSha: string;
   patchId: string;
   classification: DiffClassification;
-  comments?: PrReadinessComment[];
-  reviews?: PrReadinessReview[];
+  reviewDecision: string | null;
   unresolvedReviewThreads: number;
   requiredChecks: CheckState;
+  hostedVerifyCheck?: CheckState;
+  autoMergeEnabled?: boolean;
   draft: boolean;
-  currentWithBase: boolean;
   mergeable: string;
   mergeStateStatus: string;
   ladderPolicy?: ReviewLadderPolicy;
@@ -4301,22 +3908,17 @@ interface EvaluationInput {
   reviewProof?: PrReviewProof;
   verificationProof?: VerificationProofState;
   docsOnlyVerifyBaselineHeadShas?: string[];
-  docsOnlySinceReviewProof?: boolean;
   externalRequiredChecks?: RequiredCheck[];
   evidenceEnvelopes?: LoadedEvidenceEnvelope[];
   mergeBaseSha?: string;
   authoringSessionIds?: string[];
-  prLabels?: string[];
   priorLedger?: Pick<ManagedReadinessLedger, "reviewRuns">;
-  handledCommentUrls?: string[];
-  checkRunHandledCommentUrls?: string[];
-  handledCommentsProducer?: {
-    identity: string;
-    mode: "app" | "commit-status";
+  waveReviewDemand?: Pick<WaveReviewDemand, "autoMerge" | "review" | "wave">;
+  mergeFreeze?: {
+    blockingReasons: string[];
+    notices: string[];
   };
-  handledCommentSessionId?: string;
-  handledCommentClearedAt?: string;
-  waveReviewDemand?: Pick<WaveReviewDemand, "review" | "wave">;
+  waivers?: DemandWaiver[];
 }
 declare const evaluateReadiness: (input: EvaluationInput) => {
   blockedReasons: {
@@ -4329,42 +3931,37 @@ declare const evaluateReadiness: (input: EvaluationInput) => {
     baseSha: string;
     blockingReasons: string[];
     classification: "trivial" | "docs/process-only" | "non-trivial";
-    finalReviewPoint: boolean;
     github: {
-      currentWithBase: boolean;
       draft: boolean;
       mergeStateStatus: string;
       mergeable: string;
-      requiredChecks: "unknown" | "pending" | "passed" | "failed" | "none";
+      requiredChecks: "unknown" | "passed" | "failed" | "pending" | "none";
       unresolvedReviewThreads: number;
+      reviewDecision?: string | null | undefined;
     };
     headSha: string;
     patchId: string;
     pr: number;
-    previewDeployRequired: boolean;
     repairs: {
       action: string;
-      code: "undraft-pr" | "render-pr-body-sections" | "await-post-undraft-checks";
+      code: "undraft-pr" | "await-post-undraft-checks";
       command: string;
     }[];
     reviews: {
       correctness: {
         required: boolean;
-        status: "blocked" | "not-required" | "stale" | "current" | "missing";
-        docsOnlyDeltaAccepted?: boolean | undefined;
+        status: "blocked" | "stale" | "not-required" | "current" | "missing";
         reviewedHeadSha?: string | undefined;
         reviewedPatchId?: string | undefined;
       };
       security?: {
         required: boolean;
-        status: "blocked" | "not-required" | "stale" | "current" | "missing";
-        docsOnlyDeltaAccepted?: boolean | undefined;
+        status: "blocked" | "stale" | "not-required" | "current" | "missing";
         reviewedHeadSha?: string | undefined;
         reviewedPatchId?: string | undefined;
       } | undefined;
     };
     schemaVersion: 1;
-    stackRole: "slice" | "single" | "rollup" | "merge-gate prerequisite";
     verification: {
       command: "patronage-factory pr:verify";
       prVerify: "stale" | "passed" | "missing";
@@ -4382,46 +3979,10 @@ declare const evaluateReadiness: (input: EvaluationInput) => {
       status: "satisfied" | "unmet" | "out-of-scope";
       reason?: string | undefined;
       scope?: {
-        classifications?: ("trivial" | "docs/process-only" | "non-trivial")[] | undefined;
-        labels?: string[] | undefined;
+        classifications: ("trivial" | "docs/process-only" | "non-trivial")[];
       } | undefined;
     }[] | undefined;
-    handledCommentsProducer?: {
-      identity: string;
-      mode: "app" | "commit-status";
-    } | undefined;
-    handledHumanComments?: {
-      source: "check-run" | "cli";
-      url: string;
-      clearedAt?: string | undefined;
-      sessionId?: string | undefined;
-    }[] | undefined;
     mergeBaseSha?: string | undefined;
-    postReadinessHumanComments?: {
-      author: string;
-      createdAt: string;
-      summary: string;
-      url: string;
-    }[] | undefined;
-    postReadinessHumanReviews?: {
-      author: string;
-      createdAt: string;
-      summary: string;
-      url: string;
-    }[] | undefined;
-    previewDeploy?: {
-      seedStatus: "unknown" | "skipped" | "passed" | "failed";
-      adminUrl?: string | undefined;
-      apiHealthUrl?: string | undefined;
-      headSha?: string | undefined;
-      localPreviewProof?: unknown;
-      localProofPath?: string | undefined;
-      proofSource?: "github-actions" | "local-self-certified" | undefined;
-      publicUrl?: string | undefined;
-      stage?: string | undefined;
-      timingsMs?: Record<string, number | undefined> | undefined;
-      workflowRunUrl?: string | undefined;
-    } | undefined;
     reviewCycleState?: {
       autoBlockingFindings: number;
       countsBySeverity: {
@@ -4452,12 +4013,19 @@ declare const evaluateReadiness: (input: EvaluationInput) => {
     reviewRuns?: PrReviewResult[] | undefined;
     reviewTerminalState?: "blocked" | "accepted-with-findings" | "clean" | undefined;
   };
+  /**
+   * Facts a reader needs that are not refusals (#477): the settle-window
+   * arming notice, and every waived demand rendered so it can never read as
+   * a met one.
+   */
+  notices: string[];
   repairs: {
     action: string;
-    code: "undraft-pr" | "render-pr-body-sections" | "await-post-undraft-checks";
+    code: "undraft-pr" | "await-post-undraft-checks";
     command: string;
   }[];
-  status: ReadinessStatus;
+  status: ReadinessStatus; /** Demands that were in force, were NOT met, and the operator waived. */
+  waivedDemands: WaivedDemand[];
 };
 //#endregion
 //#region src/evidence-emit.d.ts
@@ -4711,7 +4279,6 @@ interface AssembleReviewPromptInput {
   patchId: string;
   priorLedgerEntries?: FindingLedgerEntry[];
   profile: FactoryProjectProfile;
-  standingChecklist?: readonly string[];
 }
 interface AssembledReviewPrompt {
   prompt: string;
@@ -4725,8 +4292,7 @@ declare const assembleReviewPrompt: ({
   kind,
   patchId,
   priorLedgerEntries,
-  profile,
-  standingChecklist
+  profile
 }: AssembleReviewPromptInput) => AssembledReviewPrompt;
 //#endregion
 //#region src/review-ladder-trace.d.ts
@@ -4798,7 +4364,6 @@ interface CreateProgramOptions {
   actions?: {
     boundaryCheck?: BoundaryCheckAction;
     demandWaive?: DemandWaiveAction;
-    prMergeCheck?: PrMergeCheckAction;
     prPublish?: PrPublishAction;
     prReady?: PrReadyAction;
     prReview?: PrReviewAction;
@@ -4809,4 +4374,4 @@ interface CreateProgramOptions {
 declare function createProgram(options?: CreateProgramOptions): Command;
 declare function run(argv?: string[]): Promise<void>;
 //#endregion
-export { type AppendFactoryTraceEventResult, type AssembledReviewPrompt, type BoundaryCheckArgs, type BoundaryCheckDependencies, type BoundaryCheckProofRecord, type BuildEpicStructureEventInput, type BuildRetroEnvelopeInput, type CloudflareAccessServiceToken, CreateProgramOptions, DEFAULT_DEMAND_WAIVER_PATH, DEFAULT_FACTORY_REPOSITORY, type DagDocument, type DemandWaiveArgs, type DemandWaiveDependencies, DemandWaiveRefusalError, type DemandWaiver, type DemandWaiverStore, EPIC_STRUCTURE_NODE_STATUSES, EPIC_STRUCTURE_SCHEMA_VERSION, type EpicStructureEvent, type EpicStructureGraphPayload, type EpicStructureNodeStatus, EpicStructureValidationError, type EvidenceEmitArgs, type EvidenceEmitDependencies, type EvidenceEmitResult, type FactoryCliInvocation, FactoryCliInvocationSchema, type FactoryProjectProfile, type FactoryTraceDiagnostic, type FactoryTraceEnvelope, type FactoryTraceEvent, type FindingDisposition, type FindingLedgerEntry, type FollowUpAction, FollowUpActionSchema, type IssueReviewFocus, type LadderDispositionDeclaration, MERGE_FREEZE_APP_SLUG, MERGE_FREEZE_CHECK_NAME, type MergeFreezeState, type ParsedRetroEnvelope, type PrPublishArgs, type PrPublishDependencies, PrPublishFollowUpError, type PrPublishFollowUpOutcome, type PrPublishHandoff, type PrPublishResult, type PrReadyArgs, type PrReadyProof, type PublishEpicStructureArgs, type PublishEpicStructureResult, type PublishFollowUpPlan, RETRO_ENVELOPE_SCHEMA_VERSION, RETRO_ENVELOPE_VALIDATORS, REVIEW_FOCUS_SECTION, type RetroEnvelope, type ReviewGateNotRequiredProof, type ReviewGateTraceIdentity, type ReviewLadderCycle, type ReviewLadderEvaluation, type ReviewLadderPolicy, type ReviewLadderStageEvent, type ReviewLadderTraceIdentity, type ReviewPromptSection, type ReviewPromptSectionProvenance, SUPPORTED_RETRO_ENVELOPE_SCHEMA_VERSIONS, type ScanFactoryTraceDiagnosticsOptions, type ScanFactoryTraceOptions, type ScanFactoryTraceResult, type TraceMirrorDiagnostic, type TraceSink, type TraceWriteResult, type TraceWriteSinks, type VerificationReuse, type WaivedDemand, WorkerCheckoutGuardError, type WorkerCloseoutLessonsTraceEvent, appendReviewLadderStageTraceEvent, appendWithTraceSinks, applyDemandWaiver, assembleReviewPrompt, assertWorkerCheckoutAllowed, authorizeDemandWaiver, blockingLadderFindings, boundary_manifest_d_exports as boundaryManifest, boundary_review_proof_d_exports as boundaryReviewProof, buildEpicStructureEvent, buildEpicStructurePayload, buildEvidenceEnvelope, buildRetroEnvelope, buildReviewGateNotRequiredTraceEvent, buildReviewLadderStageTraceEvent, comment_provenance_d_exports as commentProvenance, createLocalJsonlTraceSink, createProgram, doctorProjectProfile, epicStructureEventId, evaluateReviewLadder, evidenceEnvelopeFilename, findingKey, followUpFromArgv, inferFixedInThreadDispositions, isProductionHqUrl, isRetroEnvelopeWireComplete, loadProjectProfile, normalizeIssueComments, openLadderFindings, parseRetroEnvelope, planPublishFollowUp, worktree_held_branch_d_exports as prMergePreflight, pr_body_metadata_d_exports as prReadinessBodyMetadata, readiness_evaluation_d_exports as prReadinessEvaluation, external_evidence_d_exports as prReadinessExternalEvidence, merge_identity_d_exports as prReadinessMergeIdentity, post_readiness_comments_d_exports as prReadinessPostComments, pr_body_renderer_d_exports as prReadinessPrBodyRenderer, proof_identity_d_exports as prReadinessProofIdentity, review_proof_d_exports as prReadinessReviewProof, status_check_rollup_d_exports as prReadinessStatusChecks, verification_proof_d_exports as prReadinessVerificationProof, publishEpicStructure, readDemandWaivers, readPrMergeCheckProof, readPrReadyProof, readPrReviewProof, resolveFactoryRepository, resolveFindingBlocking, resolveReviewFindingCategory, resolveReviewFindingSeverity, resolveReviewLadderPolicy, resolveTraceWriteSinks, retroEnvelopeSchemaVersionOf, retroEnvelopeV1Schema, retroEpicReference, reviewCycleStateFor, reviewFocusFromIssueBody, reviewPromptSectionSchema, reviewPromptSectionsSchema, run, runBoundaryCheck, runDemandWaive, runEvidenceEmit, runPrMergeCheck, runPrPublish, runPrReady, runPrReview, runPrVerify, scanFactoryTraceDiagnostics, scanFactoryTraceEvents, selectWaiversForCandidate, staleRepeatLadderFindings, toFactoryTraceEnvelope, tryAppendReviewGateNotRequiredTraceEvent, tryAppendReviewLadderStageTraceEvent, validateBoundaryCheckProof, validateDagDocument, validateDemandWaiverStore, validateFactoryTraceEvent, validateMergeFreezeState, validatePrMergeCheckProof, validatePrReadyProof, validatePrReviewProof, validatePrVerifyProof, waivedDemandNotice, waivedDemandSchema, worktree_scratch_files_d_exports as worktreeScratchFiles };
+export { type AppendFactoryTraceEventResult, type AssembledReviewPrompt, type BoundaryCheckArgs, type BoundaryCheckDependencies, type BoundaryCheckProofRecord, type BuildEpicStructureEventInput, type BuildRetroEnvelopeInput, type CloudflareAccessServiceToken, CreateProgramOptions, DEFAULT_DEMAND_WAIVER_PATH, DEFAULT_FACTORY_REPOSITORY, type DagDocument, type DemandWaiveArgs, type DemandWaiveDependencies, DemandWaiveRefusalError, type DemandWaiver, type DemandWaiverStore, EPIC_STRUCTURE_NODE_STATUSES, EPIC_STRUCTURE_SCHEMA_VERSION, type EpicStructureEvent, type EpicStructureGraphPayload, type EpicStructureNodeStatus, EpicStructureValidationError, type EvidenceEmitArgs, type EvidenceEmitDependencies, type EvidenceEmitResult, type FactoryCliInvocation, FactoryCliInvocationSchema, type FactoryProjectProfile, type FactoryTraceDiagnostic, type FactoryTraceEnvelope, type FactoryTraceEvent, type FindingDisposition, type FindingLedgerEntry, type FollowUpAction, FollowUpActionSchema, type IssueReviewFocus, type LadderDispositionDeclaration, MERGE_FREEZE_APP_SLUG, MERGE_FREEZE_CHECK_NAME, type MergeFreezeState, type ParsedRetroEnvelope, type PrPublishArgs, type PrPublishDependencies, PrPublishFollowUpError, type PrPublishFollowUpOutcome, type PrPublishHandoff, type PrPublishResult, type PrReadyArgs, type PrReadyProof, type PublishEpicStructureArgs, type PublishEpicStructureResult, type PublishFollowUpPlan, RETRO_ENVELOPE_SCHEMA_VERSION, RETRO_ENVELOPE_VALIDATORS, REVIEW_FOCUS_SECTION, type RetroEnvelope, type ReviewGateNotRequiredProof, type ReviewGateTraceIdentity, type ReviewLadderCycle, type ReviewLadderEvaluation, type ReviewLadderPolicy, type ReviewLadderStageEvent, type ReviewLadderTraceIdentity, type ReviewPromptSection, type ReviewPromptSectionProvenance, SUPPORTED_RETRO_ENVELOPE_SCHEMA_VERSIONS, type ScanFactoryTraceDiagnosticsOptions, type ScanFactoryTraceOptions, type ScanFactoryTraceResult, type TraceMirrorDiagnostic, type TraceSink, type TraceWriteResult, type TraceWriteSinks, type VerificationReuse, type WaivedDemand, WorkerCheckoutGuardError, type WorkerCloseoutLessonsTraceEvent, appendReviewLadderStageTraceEvent, appendWithTraceSinks, applyDemandWaiver, assembleReviewPrompt, assertWorkerCheckoutAllowed, authorizeDemandWaiver, blockingLadderFindings, boundary_manifest_d_exports as boundaryManifest, boundary_review_proof_d_exports as boundaryReviewProof, buildEpicStructureEvent, buildEpicStructurePayload, buildEvidenceEnvelope, buildRetroEnvelope, buildReviewGateNotRequiredTraceEvent, buildReviewLadderStageTraceEvent, comment_provenance_d_exports as commentProvenance, createLocalJsonlTraceSink, createProgram, doctorProjectProfile, epicStructureEventId, evaluateReviewLadder, evidenceEnvelopeFilename, findingKey, followUpFromArgv, inferFixedInThreadDispositions, isProductionHqUrl, isRetroEnvelopeWireComplete, loadProjectProfile, normalizeIssueComments, openLadderFindings, parseRetroEnvelope, planPublishFollowUp, readiness_evaluation_d_exports as prReadinessEvaluation, external_evidence_d_exports as prReadinessExternalEvidence, pr_body_renderer_d_exports as prReadinessPrBodyRenderer, proof_identity_d_exports as prReadinessProofIdentity, review_proof_d_exports as prReadinessReviewProof, status_check_rollup_d_exports as prReadinessStatusChecks, verification_proof_d_exports as prReadinessVerificationProof, publishEpicStructure, readDemandWaivers, readPrReadyProof, readPrReviewProof, resolveFactoryRepository, resolveFindingBlocking, resolveReviewFindingCategory, resolveReviewFindingSeverity, resolveReviewLadderPolicy, resolveTraceWriteSinks, retroEnvelopeSchemaVersionOf, retroEnvelopeV1Schema, retroEpicReference, reviewCycleStateFor, reviewFocusFromIssueBody, reviewPromptSectionSchema, reviewPromptSectionsSchema, run, runBoundaryCheck, runDemandWaive, runEvidenceEmit, runPrPublish, runPrReady, runPrReview, runPrVerify, scanFactoryTraceDiagnostics, scanFactoryTraceEvents, selectWaiversForCandidate, staleRepeatLadderFindings, toFactoryTraceEnvelope, tryAppendReviewGateNotRequiredTraceEvent, tryAppendReviewLadderStageTraceEvent, validateBoundaryCheckProof, validateDagDocument, validateDemandWaiverStore, validateFactoryTraceEvent, validateMergeFreezeState, validatePrReadyProof, validatePrReviewProof, validatePrVerifyProof, waivedDemandNotice, waivedDemandSchema, worktree_scratch_files_d_exports as worktreeScratchFiles };