@patronage/software-factory 0.30.0 → 1.0.0-alpha.0

package/dist/index.js

@@ -14,10 +14,10 @@ import { setImmediate } from "node:timers";
 import { setImmediate as setImmediate$1, setTimeout as setTimeout$1 } from "node:timers/promises";
 import { Worker } from "node:worker_threads";
 import picomatch from "picomatch";
-import { promisify } from "node:util";
 import { parse } from "yaml";
+import { promisify } from "node:util";
 //#region package.json
-var version = "0.30.0";
+var version = "1.0.0-alpha.0";
 //#endregion
 //#region src/review-rungs.ts
 const EVIDENCE_REVIEW_RUNGS$1 = [
@@ -944,6 +944,7 @@ const globSchema = z.string().min(1).refine(isValidGlob, "must be a valid glob")
 const commandSchema = z.object({
 	command: z.string().min(1),
 	description: z.string().min(1),
+	impactTarget: z.string().min(1).optional(),
 	name: z.string().min(1),
 	requiredCheck: z.string().min(1).optional(),
 	scope: z.enum([
@@ -969,10 +970,22 @@ const requiredCheckSchema = z.object({
 	name: z.string().min(1),
 	scope: requiredCheckScopeSchema$1.optional()
 }).strict();
+const impactTargetSchema = z.object({
+	importers: z.array(z.string().min(1)).min(1),
+	name: z.string().min(1)
+}).strict();
+const impactConfigSchema = z.object({ targets: z.array(impactTargetSchema).min(1).superRefine((targets, context) => {
+	const names = targets.map((target) => target.name);
+	if (new Set(names).size !== names.length) context.addIssue({
+		code: "custom",
+		message: "impact.targets entries must have distinct names."
+	});
+}) }).strict();
 const factoryProjectProfileSchema = z.object({
 	$schema: z.string().min(1).optional(),
 	extensions: z.record(z.string(), z.unknown()).optional(),
 	hq: hqIngestConfigSchema.optional(),
+	impact: impactConfigSchema.optional(),
 	proof: z.object({ classificationPolicy: z.object({
 		docsOnly: z.array(globSchema).default([]),
 		trivial: z.array(globSchema).default([])
@@ -1006,6 +1019,30 @@ const factoryProjectProfileSchema = z.object({
 		});
 		commandNames.add(command.name);
 	}
+	const impactTargetNames = new Set((profile.impact?.targets ?? []).map((target) => target.name));
+	for (const [commandIndex, command] of profile.verification.commands.entries()) {
+		if (command.impactTarget === void 0) continue;
+		if (!impactTargetNames.has(command.impactTarget)) context.addIssue({
+			code: "custom",
+			message: `Verification command impactTarget "${command.impactTarget}" does not name a declared impact.targets entry.`,
+			path: [
+				"verification",
+				"commands",
+				commandIndex,
+				"impactTarget"
+			]
+		});
+		if (command.requiredCheck !== void 0 && command.requiredCheck !== command.impactTarget) context.addIssue({
+			code: "custom",
+			message: `Verification command "${command.name}" maps requiredCheck "${command.requiredCheck}" but scopes on impactTarget "${command.impactTarget}"; a scoped command's evidence demand and impact target must be the same name.`,
+			path: [
+				"verification",
+				"commands",
+				commandIndex,
+				"impactTarget"
+			]
+		});
+	}
 	const requiredChecks = new Map((profile.requiredChecks ?? []).map((check) => [check.name, check]));
 	const mappedChecks = /* @__PURE__ */ new Set();
 	for (const [commandIndex, command] of profile.verification.commands.entries()) {
@@ -1036,7 +1073,7 @@ const factoryProjectProfileSchema = z.object({
 		mappedChecks.add(command.requiredCheck);
 	}
 }).meta({ description: PROFILE_JSON_SCHEMA_DESCRIPTION });
-const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const isRecord$1 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 const stringList = (value) => Array.isArray(value) ? value.filter((entry) => typeof entry === "string") : [];
 const quoteList = (values) => JSON.stringify(values);
 const namesExistingFile = (root, entry) => {
@@ -1085,13 +1122,13 @@ const migratedPolicyLines = (policy, root) => {
 */
 function v2MigrationLines(input, root) {
 	const lines = [];
-	const proof = isRecord(input.proof) ? input.proof : void 0;
-	if (proof && isRecord(proof.classificationPolicy)) lines.push(...migratedPolicyLines(proof.classificationPolicy, root));
-	const commands = isRecord(input.verification) ? input.verification.commands : void 0;
+	const proof = isRecord$1(input.proof) ? input.proof : void 0;
+	if (proof && isRecord$1(proof.classificationPolicy)) lines.push(...migratedPolicyLines(proof.classificationPolicy, root));
+	const commands = isRecord$1(input.verification) ? input.verification.commands : void 0;
 	if (Array.isArray(commands)) {
-		for (const [index, command] of commands.entries()) if (isRecord(command) && command.scope === "always") lines.push(`verification.commands[${index}].scope "always" -> "docs-only"`);
+		for (const [index, command] of commands.entries()) if (isRecord$1(command) && command.scope === "always") lines.push(`verification.commands[${index}].scope "always" -> "docs-only"`);
 	}
-	if (isRecord(input.hq) && typeof input.hq.endpoint === "string") try {
+	if (isRecord$1(input.hq) && typeof input.hq.endpoint === "string") try {
 		const url = new URL(input.hq.endpoint);
 		if (url.href !== `${url.origin}/` && url.href !== url.origin) lines.push(`hq.endpoint ${JSON.stringify(input.hq.endpoint)} -> ${JSON.stringify(url.origin)}`);
 	} catch {}
@@ -1103,25 +1140,25 @@ function hasCorrectnessOnlyReview(review) {
 }
 const v4MigrationLines = (input) => {
 	const lines = [];
-	if (isRecord(input.project) && "key" in input.project) lines.push("project.key -> removed; current proof writers derive projectKey from repository.name");
-	if (isRecord(input.repository) && "defaultBranch" in input.repository) lines.push("repository.defaultBranch -> removed; commands resolve the live base from Git/GitHub or an explicit --base");
-	if (isRecord(input.env) && "required" in input.env) lines.push("env.required -> removed; the command that needs an environment value owns its fail-closed diagnostic");
-	if (isRecord(input.review)) {
+	if (isRecord$1(input.project) && "key" in input.project) lines.push("project.key -> removed; current proof writers derive projectKey from repository.name");
+	if (isRecord$1(input.repository) && "defaultBranch" in input.repository) lines.push("repository.defaultBranch -> removed; commands resolve the live base from Git/GitHub or an explicit --base");
+	if (isRecord$1(input.env) && "required" in input.env) lines.push("env.required -> removed; the command that needs an environment value owns its fail-closed diagnostic");
+	if (isRecord$1(input.review)) {
 		const isCorrectnessOnlyReview = hasCorrectnessOnlyReview(input.review);
 		if ("defaultMaxCycles" in input.review) lines.push("review.defaultMaxCycles -> removed; the factory review cap is 5");
 		if ("modes" in input.review) lines.push("review.modes -> removed; correctness is always required");
 		if (isCorrectnessOnlyReview) lines.push("review -> removed; a correctness-only review has no v5 configuration, so delete the object");
 		if (Array.isArray(input.review.conditional)) {
-			for (const [index, conditional] of input.review.conditional.entries()) if (isRecord(conditional) && "modes" in conditional) lines.push(`review.conditional[${index}].modes -> removed; each retained conditional path list demands security review`);
+			for (const [index, conditional] of input.review.conditional.entries()) if (isRecord$1(conditional) && "modes" in conditional) lines.push(`review.conditional[${index}].modes -> removed; each retained conditional path list demands security review`);
 		}
 	}
 	if (Array.isArray(input.requiredChecks)) {
-		for (const [index, check] of input.requiredChecks.entries()) if (isRecord(check) && "checkType" in check) lines.push(`requiredChecks[${index}].checkType -> removed; external required checks are verify-type`);
+		for (const [index, check] of input.requiredChecks.entries()) if (isRecord$1(check) && "checkType" in check) lines.push(`requiredChecks[${index}].checkType -> removed; external required checks are verify-type`);
 	}
 	return lines;
 };
 function legacyProfileMigration(input, root) {
-	if (!(isRecord(input) && typeof input.schemaVersion === "number" && LEGACY_PROFILE_SCHEMA_VERSIONS.includes(input.schemaVersion))) return;
+	if (!(isRecord$1(input) && typeof input.schemaVersion === "number" && LEGACY_PROFILE_SCHEMA_VERSIONS.includes(input.schemaVersion))) return;
 	const foundVersion = input.schemaVersion;
 	const lines = [`schemaVersion ${foundVersion} -> 5`];
 	if (foundVersion === 2) lines.push(...v2MigrationLines(input, root));
@@ -3792,6 +3829,623 @@ const authorizeDemandWaiver = ({ authenticatedLogin, session }) => {
 		...normalizedSession && normalizedSession !== "unknown" ? { session: normalizedSession } : {}
 	} };
 };
+//#endregion
+//#region src/impact-stamp.ts
+const LOCKFILE_PATH = "pnpm-lock.yaml";
+const SUPPORTED_LOCKFILE_VERSION = "9.0";
+const impactStampTargetSchema = z.object({
+	basis: z.string().min(1),
+	impact: z.enum(["affected", "not-affected"]),
+	name: z.string().min(1)
+});
+/**
+* The recorded stamp. `targets` satisfies the completeness invariant: every
+* target the profile declares is present, each with its exact basis — never
+* silently absent. `basis: "conservative"` means an unmodelled or unprovable
+* input widened every target to full impact.
+*/
+const impactStampSchema = z.object({
+	basis: z.enum(["lockfile-scoped", "conservative"]),
+	reasons: z.array(z.string()),
+	stampVersion: z.literal(1),
+	targets: z.array(impactStampTargetSchema).superRefine((targets, context) => {
+		const names = targets.map((target) => target.name);
+		if (new Set(names).size !== names.length) context.addIssue({
+			code: "custom",
+			message: "impact stamp targets must have distinct names."
+		});
+	})
+});
+/**
+* A configuration contradiction between the profile's impact declarations and
+* the repository's actual lockfile — e.g. a declared importer root that
+* matches no importer on either side of the delta. Controls fail loudly (ADR
+* 0024): this error must ABORT the run, never degrade to a stamp, because a
+* profile typo would otherwise silently mis-scope every future candidate.
+* Data/runtime failures (unreadable, unparseable, malformed lockfiles, reader
+* throws) are the opposite case and stay on the conservative-stamp path.
+*/
+var ImpactStampConfigError = class extends Error {
+	name = "ImpactStampConfigError";
+};
+const CONSERVATIVE_TARGET_BASIS = "conservative: impact not provable; full impact assumed";
+/**
+* The surfaces that consume the stamp. One classification, consumed
+* everywhere (#430): every surface routes through
+* {@link impactStampScopeDecision}, so no surface can be more trusting than
+* another, and no surface re-derives path rules of its own. The value only
+* selects the wording of the conservative floor a refusal falls back to.
+*/
+const IMPACT_SCOPE_SURFACES = {
+	demand: "full demand floor",
+	"preview-lifecycle": "full preview-lifecycle floor",
+	"verification-battery": "full verification-battery floor"
+};
+/**
+* Whether a trusted stamp RELEASES one target-scoped unit of work — an
+* external proof demand (#542 wave 2), a verification-battery command, or a
+* preview (Alchemy) lifecycle stack (#430 wave 3).
+*
+* The only release path is a `lockfile-scoped` stamp of exactly this build's
+* stamp version whose target entry for exactly this name is provably
+* `not-affected`. Every other input — no trusted stamp, an unknown stamp
+* version, a conservative stamp, a name the stamp does not classify, or an
+* `affected` verdict — keeps today's full-work floor. Work only ever gets
+* released, never added or satisfied: this function can withdraw a demand, it
+* can never certify one.
+*
+* Identity binding is the CALLER's precondition: pass only a stamp computed
+* for, or read from a pr:verify proof bound to, the current candidate (see
+* `trustedImpactStamp` in `pr-readiness/verification-proof.ts`); pass
+* `undefined` otherwise.
+*/
+const impactStampScopeDecision = ({ stamp, surface, targetName }) => {
+	const floor = IMPACT_SCOPE_SURFACES[surface];
+	if (stamp === void 0) return {
+		reason: `no trusted identity-bound impact stamp covers this candidate; ${floor}`,
+		scoped: false
+	};
+	if (stamp.stampVersion !== 1) return {
+		reason: `impact stamp version ${String(stamp.stampVersion)} is not this build's version 1; ${floor}`,
+		scoped: false
+	};
+	if (stamp.basis !== "lockfile-scoped") return {
+		reason: `impact stamp is conservative (full impact assumed); ${floor}`,
+		scoped: false
+	};
+	const matches = stamp.targets.filter((candidate) => candidate.name === targetName);
+	if (matches.length > 1) return {
+		reason: `impact stamp is self-contradictory: ${matches.length} rows classify a target named "${targetName}"; ${floor}`,
+		scoped: false
+	};
+	const [target] = matches;
+	if (target === void 0) return {
+		reason: `impact stamp does not classify a target named "${targetName}"; ${floor}`,
+		scoped: false
+	};
+	if (target.impact !== "not-affected") return {
+		reason: `impact stamp records target "${targetName}" as affected (${target.basis})`,
+		scoped: false
+	};
+	return {
+		reason: `impact stamp released: target "${targetName}" is provably not affected by this candidate's delta (${target.basis})`,
+		scoped: true
+	};
+};
+const impactStampDemandRelease = ({ checkName, stamp }) => {
+	const decision = impactStampScopeDecision({
+		stamp,
+		surface: "demand",
+		targetName: checkName
+	});
+	return {
+		reason: decision.reason,
+		released: decision.scoped
+	};
+};
+/**
+* The full-impact stamp: every declared target `affected`. This is the floor
+* every doubt path lands on, and the stamp a producer must fall back to if
+* stamp computation itself fails for any reason.
+*/
+const conservativeImpactStamp = (targets, reasons) => ({
+	basis: "conservative",
+	reasons,
+	stampVersion: 1,
+	targets: targets.map((target) => ({
+		basis: CONSERVATIVE_TARGET_BASIS,
+		impact: "affected",
+		name: target.name
+	}))
+});
+const conservativeStamp = conservativeImpactStamp;
+const DEPENDENCY_FIELDS = [
+	"dependencies",
+	"devDependencies",
+	"optionalDependencies"
+];
+const importerDependencySchema = z.looseObject({
+	specifier: z.string().optional(),
+	version: z.string()
+});
+const importerSectionSchema = z.looseObject({
+	dependencies: z.record(z.string(), importerDependencySchema).optional(),
+	devDependencies: z.record(z.string(), importerDependencySchema).optional(),
+	optionalDependencies: z.record(z.string(), importerDependencySchema).optional()
+});
+const snapshotSectionSchema = z.looseObject({
+	dependencies: z.record(z.string(), z.string()).optional(),
+	devDependencies: z.record(z.string(), z.string()).optional(),
+	optionalDependencies: z.record(z.string(), z.string()).optional()
+});
+const pnpmLockfileSchema = z.looseObject({
+	importers: z.record(z.string(), importerSectionSchema),
+	lockfileVersion: z.unknown().optional(),
+	packages: z.record(z.string(), z.unknown()).optional(),
+	snapshots: z.record(z.string(), snapshotSectionSchema).optional()
+});
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const canonical = (value) => {
+	if (Array.isArray(value)) return value.map(canonical);
+	if (isRecord(value)) return Object.fromEntries(Object.keys(value).toSorted().map((key) => [key, canonical(value[key])]));
+	return value;
+};
+const stableStringify$1 = (value) => JSON.stringify(canonical(value));
+const parseLockfile = (content) => {
+	try {
+		const parsed = parse(content);
+		if (!isRecord(parsed)) return;
+		const validated = pnpmLockfileSchema.safeParse(parsed);
+		return validated.success ? validated.data : void 0;
+	} catch {
+		return;
+	}
+};
+const nonGraphSections = ({ importers: _importers, packages: _packages, snapshots: _snapshots, ...rest }) => rest;
+const changedSectionKeys = (before, after) => {
+	return [...new Set([...Object.keys(before ?? {}), ...Object.keys(after ?? {})])].filter((key) => stableStringify$1(before?.[key]) !== stableStringify$1(after?.[key]));
+};
+const linkTarget = (importerPath, version) => {
+	if (!version.startsWith("link:")) return;
+	const raw = version.slice(5);
+	const joined = importerPath === "." ? raw : `${importerPath}/${raw}`;
+	const resolved = [];
+	for (const segment of joined.split("/")) {
+		if (segment === "" || segment === ".") continue;
+		if (segment === "..") {
+			resolved.pop();
+			continue;
+		}
+		resolved.push(segment);
+	}
+	return resolved.length === 0 ? "." : resolved.join("/");
+};
+const importerMatchesTarget = (importerPath, importerRoots) => importerRoots.some((root) => importerPath === root || importerPath.startsWith(`${root}/`));
+const workspaceClosure = (lockfile, importerRoots) => {
+	const closure = new Set(["."]);
+	const queue = Object.keys(lockfile.importers ?? {}).filter((importerPath) => importerMatchesTarget(importerPath, importerRoots));
+	while (queue.length > 0) {
+		const importerPath = queue.pop();
+		if (importerPath === void 0 || closure.has(importerPath)) continue;
+		closure.add(importerPath);
+		const section = lockfile.importers?.[importerPath];
+		for (const field of DEPENDENCY_FIELDS) for (const dependency of Object.values(section?.[field] ?? {})) {
+			const target = dependency.version === void 0 ? void 0 : linkTarget(importerPath, dependency.version);
+			if (target !== void 0 && lockfile.importers?.[target]) queue.push(target);
+		}
+	}
+	return closure;
+};
+const pushReference = (lockfile, queue, name, value) => {
+	if (value.startsWith("link:")) return;
+	queue.push(`${name}@${value}`);
+	if (lockfile.snapshots?.[value]) queue.push(value);
+};
+const snapshotClosure = (lockfile, importerPaths) => {
+	const keys = /* @__PURE__ */ new Set();
+	const queue = [];
+	for (const importerPath of importerPaths) {
+		const section = lockfile.importers?.[importerPath];
+		for (const field of DEPENDENCY_FIELDS) for (const [name, dependency] of Object.entries(section?.[field] ?? {})) if (dependency.version !== void 0) pushReference(lockfile, queue, name, dependency.version);
+	}
+	while (queue.length > 0) {
+		const key = queue.pop();
+		if (key === void 0 || keys.has(key)) continue;
+		keys.add(key);
+		const snapshot = lockfile.snapshots?.[key];
+		for (const field of DEPENDENCY_FIELDS) for (const [name, version] of Object.entries(snapshot?.[field] ?? {})) pushReference(lockfile, queue, name, version);
+	}
+	return keys;
+};
+const withoutPeerSuffix = (key) => key.split("(")[0] ?? key;
+const supportedLockfileVersion = (lockfile) => String(lockfile.lockfileVersion) === SUPPORTED_LOCKFILE_VERSION;
+const targetImpactForLockfileDelta = (target, delta) => {
+	const closures = delta.sides.map((lockfile) => ({
+		importers: workspaceClosure(lockfile, target.importers),
+		lockfile
+	}));
+	const changedImporter = delta.changedImporters.find((importerPath) => closures.some((side) => side.importers.has(importerPath)));
+	if (changedImporter !== void 0) return {
+		basis: `changed importer "${changedImporter}" is in this target's workspace closure`,
+		impact: "affected",
+		name: target.name
+	};
+	const resolved = new Set(closures.flatMap((side) => [...snapshotClosure(side.lockfile, side.importers)]));
+	const resolvedBare = new Set([...resolved].map(withoutPeerSuffix));
+	const changedKey = delta.changedSnapshots.find((key) => resolved.has(key)) ?? delta.changedPackages.find((key) => resolved.has(key) || resolvedBare.has(key));
+	if (changedKey !== void 0) return {
+		basis: `changed graph key "${changedKey}" is resolved by this target's importer closure`,
+		impact: "affected",
+		name: target.name
+	};
+	return {
+		basis: `no changed importer or resolved graph key reaches importers [${target.importers.join(", ")}]`,
+		impact: "not-affected",
+		name: target.name
+	};
+};
+/**
+* Compute the impact stamp for one candidate: every declared target recorded
+* as affected/not-affected with its exact basis. `not-affected` is only ever
+* returned for a provably-scoped pnpm-lock.yaml (v9) delta; every other input
+* — non-lockfile changed files, an empty diff, a missing, unparseable, or
+* structurally malformed lockfile side, an unsupported lockfile version, or a
+* delta outside the importers/packages/snapshots graph sections — widens to
+* full impact.
+*
+* Total by contract: this function never throws. Any unexpected failure in
+* reading, parsing, or traversal is itself a doubt path and returns the
+* conservative stamp, so a producer can never be aborted by stamp
+* computation.
+*/
+const computeImpactStamp = (input) => {
+	const targets = input.profile.impact?.targets ?? [];
+	try {
+		return computeImpactStampOrThrow(input, targets);
+	} catch (error) {
+		if (error instanceof ImpactStampConfigError) throw error;
+		return conservativeStamp(targets, [`impact stamp computation failed (${error instanceof Error ? error.message : String(error)}); fail closed to full impact`]);
+	}
+};
+const readLockfileSides = (readLockfile) => {
+	let base;
+	let head;
+	try {
+		base = readLockfile("base");
+		head = readLockfile("head");
+	} catch (error) {
+		return {
+			error,
+			kind: "threw"
+		};
+	}
+	if (base === void 0 || head === void 0) return {
+		kind: "unreadable",
+		side: base === void 0 ? "base" : "head"
+	};
+	const baseLock = parseLockfile(base);
+	const headLock = parseLockfile(head);
+	if (!(baseLock && headLock)) return {
+		kind: "unparseable",
+		side: baseLock ? "head" : "base"
+	};
+	if (![baseLock, headLock].every(supportedLockfileVersion)) return { kind: "unsupported-version" };
+	return {
+		kind: "ok",
+		parsed: [baseLock, headLock]
+	};
+};
+/**
+* Every declared importer root must exist somewhere in the delta: a root
+* matching no importer on EITHER side is a profile typo, and scoping from it
+* would leave only the implicit root importer in that target's closure —
+* silently classifying real changes `not-affected` forever. That is a
+* configuration contradiction, so it fails loudly instead of degrading. A root
+* present on ONE side only is legitimate (this very delta adds or removes the
+* importer) and scopes normally.
+*
+* Checked on EVERY computation whose lockfile sides are readable, not only on
+* the lockfile-only deltas that can actually scope. The check answers a
+* question about the PROFILE, which does not depend on what this candidate
+* changed; running it only where scoping happens would leave a typo latent
+* through every code PR and first surface it on the cheap lockfile-only PR
+* this machinery exists to speed up.
+*/
+const assertDeclaredImporterRoots = (targets, sides) => {
+	for (const target of targets) for (const root of target.importers) if (!sides.some((lockfile) => Object.keys(lockfile.importers).some((importerPath) => importerMatchesTarget(importerPath, [root])))) throw new ImpactStampConfigError(`impact target "${target.name}" declares importer root "${root}", but no importer under that root exists in pnpm-lock.yaml on either side of the delta; fix the profile's impact.targets declaration`);
+};
+const computeImpactStampOrThrow = ({ changedFiles, readLockfile }, targets) => {
+	if (targets.length === 0) return {
+		basis: "conservative",
+		reasons: ["no impact targets declared in the profile; every surface keeps full demand"],
+		stampVersion: 1,
+		targets: []
+	};
+	const sides = readLockfileSides(readLockfile);
+	if (sides.kind === "ok") assertDeclaredImporterRoots(targets, sides.parsed);
+	if (changedFiles.length === 0) return conservativeStamp(targets, ["no changed files detected; full impact assumed"]);
+	const unmodelledFiles = changedFiles.filter((file) => file !== LOCKFILE_PATH);
+	if (unmodelledFiles.length > 0) return conservativeStamp(targets, [`changed files outside the lockfile classifier's model (${unmodelledFiles.toSorted().join(", ")}); full impact assumed`]);
+	if (sides.kind === "threw") throw sides.error;
+	if (sides.kind === "unreadable") return conservativeStamp(targets, [`pnpm-lock.yaml is unreadable at the ${sides.side} side; fail closed to full impact`]);
+	if (sides.kind === "unparseable") return conservativeStamp(targets, [`pnpm-lock.yaml is unparseable or structurally malformed at the ${sides.side} side; fail closed to full impact`]);
+	if (sides.kind === "unsupported-version") return conservativeStamp(targets, [`pnpm-lock.yaml is not lockfileVersion ${SUPPORTED_LOCKFILE_VERSION}; only pnpm v9 lockfiles are modelled; fail closed to full impact`]);
+	const [baseLock, headLock] = sides.parsed;
+	if (stableStringify$1(nonGraphSections(baseLock)) !== stableStringify$1(nonGraphSections(headLock))) return conservativeStamp(targets, ["pnpm-lock.yaml delta touches sections outside importers/packages/snapshots (e.g. settings, overrides, patchedDependencies); fail closed to full impact"]);
+	const delta = {
+		changedImporters: changedSectionKeys(baseLock.importers, headLock.importers),
+		changedPackages: changedSectionKeys(baseLock.packages, headLock.packages),
+		changedSnapshots: changedSectionKeys(baseLock.snapshots, headLock.snapshots),
+		sides: [baseLock, headLock]
+	};
+	return {
+		basis: "lockfile-scoped",
+		reasons: ["pnpm-lock.yaml is the only changed file; impact scoped by importer/snapshot graph analysis"],
+		stampVersion: 1,
+		targets: targets.map((target) => targetImpactForLockfileDelta(target, delta))
+	};
+};
+//#endregion
+//#region src/verification-battery.ts
+const UNCONDITIONAL_BASIS = "unconditional: the profile declares no impactTarget for this command";
+/**
+* The `vetoedTargets` contract, enforced at RUNTIME as well as at the type
+* level. TypeScript makes the parameter required for callers it compiles;
+* `new Set(undefined)` is a perfectly good empty set, so an untyped JavaScript
+* caller that omits it would otherwise scope exactly as if it had inspected
+* the envelopes and found nothing — the silent state requiring the parameter
+* exists to eliminate.
+*
+* A malformed CALL is API misuse, not data doubt: it fails loudly (ADR 0024)
+* rather than degrading to the conservative floor, because a producer that
+* never resolved the veto set has a bug its author must see.
+*/
+const assertVetoedTargets = (vetoedTargets, caller) => {
+	if (!Array.isArray(vetoedTargets)) throw new TypeError(`${caller} requires vetoedTargets: the target names with a current, candidate-bound FAILING envelope. Resolve it with boundFailingCheckNames and pass the result; pass [] to mean "inspected the envelopes and found no bound failure". It has no default because omitting it would silently scope work whose standing demand nothing on this head could meet.`);
+};
+/**
+* Plan one verification battery against the candidate's impact stamp.
+*
+* Pure and total: it makes a decision, it never reads a proof, a profile file,
+* or the filesystem, and no INPUT can make it throw — every doubt path is a
+* decision, not an exception. A malformed CALL is the one exception to that,
+* and deliberately so: omitting `vetoedTargets` is API misuse rather than data
+* doubt, and it throws (see {@link assertVetoedTargets}).
+*
+* `stamp` must already be trusted by
+* the caller — inside `pr:verify` that is the stamp just computed for this
+* candidate's own identity triple; anywhere else it is `trustedImpactStamp`'s
+* output or `undefined`.
+*/
+const planVerificationBattery = ({ commands, stamp, vetoedTargets }) => {
+	assertVetoedTargets(vetoedTargets, "planVerificationBattery");
+	const vetoed = new Set(vetoedTargets);
+	const dispositions = [];
+	const execute = [];
+	const notRequired = [];
+	for (const command of commands) {
+		const { impactTarget, name } = command;
+		if (impactTarget === void 0) {
+			dispositions.push({
+				basis: UNCONDITIONAL_BASIS,
+				disposition: "executed",
+				name
+			});
+			execute.push(command);
+			continue;
+		}
+		const decision = impactStampScopeDecision({
+			stamp,
+			surface: "verification-battery",
+			targetName: impactTarget
+		});
+		const vetoedHere = decision.scoped && vetoed.has(impactTarget);
+		const basis = vetoedHere ? `veto: a current envelope bound to this candidate records target "${impactTarget}" as FAILING, so the stamp's release is withheld (${decision.reason})` : decision.reason;
+		const scoped = decision.scoped && !vetoedHere;
+		dispositions.push({
+			basis,
+			disposition: scoped ? "not-required" : "executed",
+			impactTarget,
+			name
+		});
+		if (scoped) notRequired.push({
+			basis,
+			impactTarget,
+			name
+		});
+		else execute.push(command);
+	}
+	return {
+		dispositions,
+		execute,
+		notRequired
+	};
+};
+/**
+* The completeness invariant as an enforceable control (ADR 0024: controls
+* fail loudly), shared by both pr:verify proof schemas so they cannot drift.
+*
+* Four rules:
+*  1. A withheld command names one the resolved mode actually selected.
+*  2. A command is never recorded as both executed and not-required.
+*  3. Withheld commands are distinct — a duplicated disposition would let one
+*     name carry two different bases.
+*  4. On a PASSED proof, every selected command has a disposition: silence is
+*     not a disposition, and "absent from both lists" is exactly the silent
+*     skip this epic forbids.
+*
+* Rule 4 is scoped to `outcome: "passed"` because an ABORTED proof legitimately
+* records partial execution — the run stopped at the failing command. It is
+* also scoped to schemaVersion >= 4: `executedCommands` postdates v1–v3, so a
+* legacy proof that never recorded it is not making a false completeness claim.
+*
+* The check is one-directional on purpose. Every SELECTED command must be
+* accounted for, but `executedCommands` may legitimately carry MORE than the
+* profile selected — full mode appends the `workspace:install-resolves` probe,
+* which is real work no profile declares.
+*/
+const assertBatteryCompleteness = (proof, context) => {
+	const selected = proof.verificationCommands.map((command) => command.name);
+	const selectedSet = new Set(selected);
+	const executed = new Set((proof.executedCommands ?? []).map((command) => command.name));
+	const notRequired = proof.notRequiredCommands ?? [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const [index, entry] of notRequired.entries()) {
+		if (!selectedSet.has(entry.name)) context.addIssue({
+			code: "custom",
+			message: `notRequiredCommands entry "${entry.name}" is not one of this proof's verificationCommands.`,
+			path: [
+				"notRequiredCommands",
+				index,
+				"name"
+			]
+		});
+		if (executed.has(entry.name)) context.addIssue({
+			code: "custom",
+			message: `Command "${entry.name}" is recorded both as executed and as not-required.`,
+			path: [
+				"notRequiredCommands",
+				index,
+				"name"
+			]
+		});
+		if (seen.has(entry.name)) context.addIssue({
+			code: "custom",
+			message: `notRequiredCommands records "${entry.name}" more than once.`,
+			path: [
+				"notRequiredCommands",
+				index,
+				"name"
+			]
+		});
+		seen.add(entry.name);
+	}
+	if (proof.outcome !== "passed" || proof.schemaVersion < 4) return;
+	const disposed = new Set([...executed, ...seen]);
+	const undisposed = selected.filter((name) => !disposed.has(name));
+	if (undisposed.length > 0) context.addIssue({
+		code: "custom",
+		message: `A passed pr:verify proof must give every selected verification command a disposition; [${undisposed.join(", ")}] appear in verificationCommands but in neither executedCommands nor notRequiredCommands.`,
+		path: ["executedCommands"]
+	});
+};
+/**
+* The stamp-authorization control: a passed v4 proof may only claim a command
+* was NOT REQUIRED if its own recorded stamp says so.
+*
+* `assertBatteryCompleteness` proves the two lists partition the selected
+* commands — that no command is silently absent. It does not prove the
+* withholding was EARNED. Without this rule a proof could name every expensive
+* command in `notRequiredCommands`, carry no stamp at all (or a conservative
+* one), and still read as full verification: the omission would be recorded,
+* accounted for, and completely unauthorized.
+*
+* Two things have to hold, and the first is what keeps the second honest:
+*
+*  1. COHERENCE. The entry's `impactTarget` must equal the `impactTarget` the
+*     proof records for that same command in `verificationCommands`. The entry
+*     does not get to nominate its own target; the proof's command→target
+*     mapping (written by `pr:verify` from the loaded profile) does. Without
+*     this, authorization validates a self-reported field and a crafted proof
+*     can withhold an affected command while pointing at an unrelated released
+*     target.
+*  2. AUTHORIZATION. That recorded target must be one the proof's own stamp
+*     provably released.
+*
+* The proof is one artifact and a determined forger controls all of it; this
+* is internal-coherence belt-and-braces in the same trust domain as the
+* version guards, and write-time truth stays `pr:verify`'s job.
+*
+* The authorizing evidence is the proof's OWN `impactStamp` — the same stamp
+* `pr:verify` computed for this candidate's identity triple and recorded here,
+* so authorization is bound to the same identities the proof binds. The
+* predicate is the shared {@link impactStampScopeDecision}, not a second
+* reading of the stamp: an entry is authorized exactly when the stamp would
+* have released that target's command in the first place (lockfile-scoped
+* basis, this build's stamp version, exactly one row for the target,
+* `not-affected`). A conservative stamp, an unknown version, a
+* self-contradictory stamp, an unclassified name, or an `affected` verdict all
+* fail the same way scoping itself would.
+*
+* Scoped to `outcome: "passed"` and schemaVersion >= 4 for the same reasons as
+* the completeness rule: an aborted run records partial execution, and a
+* legacy proof predates both fields, so neither is making a false completeness
+* claim.
+*/
+const assertNotRequiredStampAuthorization = (proof, context) => {
+	const notRequired = proof.notRequiredCommands ?? [];
+	if (proof.outcome !== "passed" || proof.schemaVersion < 4 || notRequired.length === 0) return;
+	const { impactStamp } = proof;
+	if (impactStamp === void 0) {
+		context.addIssue({
+			code: "custom",
+			message: `A passed pr:verify proof that withholds verification commands must record the impact stamp that authorized the withholding; [${notRequired.map((entry) => entry.name).join(", ")}] are recorded not-required by a proof carrying no impactStamp.`,
+			path: ["impactStamp"]
+		});
+		return;
+	}
+	const recordedTargets = new Map(proof.verificationCommands.map((command) => [command.name, command.impactTarget]));
+	for (const [index, entry] of notRequired.entries()) {
+		const recorded = recordedTargets.get(entry.name);
+		if (recorded !== entry.impactTarget) {
+			context.addIssue({
+				code: "custom",
+				message: recorded === void 0 ? `notRequiredCommands entry "${entry.name}" claims impactTarget "${entry.impactTarget}", but this proof records no impactTarget for that command; only a command the profile scopes can be withheld.` : `notRequiredCommands entry "${entry.name}" claims impactTarget "${entry.impactTarget}", but this proof records impactTarget "${recorded}" for that command.`,
+				path: [
+					"notRequiredCommands",
+					index,
+					"impactTarget"
+				]
+			});
+			continue;
+		}
+		const decision = impactStampScopeDecision({
+			stamp: impactStamp,
+			surface: "verification-battery",
+			targetName: entry.impactTarget
+		});
+		if (!decision.scoped) context.addIssue({
+			code: "custom",
+			message: `notRequiredCommands entry "${entry.name}" is not authorized by this proof's impactStamp: ${decision.reason}.`,
+			path: [
+				"notRequiredCommands",
+				index,
+				"impactTarget"
+			]
+		});
+	}
+};
+/** Console lines naming every withheld command and why. Never silent. */
+const batteryScopeSummaryLines = (plan) => {
+	if (plan.notRequired.length === 0) return [];
+	return ["Verification battery scoped by the impact stamp (not-required):", ...plan.notRequired.map((entry) => `- ${entry.name} (${entry.impactTarget}): ${entry.basis}`)];
+};
+//#endregion
+//#region src/pr-verify-proof-rules.ts
+const assertPrVerifyProofRules = (proof, context) => {
+	if (proof.schemaVersion >= 4 && proof.authoringSession === void 0) context.addIssue({
+		code: "custom",
+		message: "schemaVersion 4 pr:verify proof requires authoringSession (the recorded authoring identity, or the `unknown` sentinel).",
+		path: ["authoringSession"]
+	});
+	if (proof.schemaVersion < 4 && proof.authoringSession !== void 0) context.addIssue({
+		code: "custom",
+		message: "authoringSession is a schemaVersion>=4 field; a v1–v3 pr:verify proof must not carry it.",
+		path: ["authoringSession"]
+	});
+	if (proof.schemaVersion < 4 && proof.impactStamp !== void 0) context.addIssue({
+		code: "custom",
+		message: "impactStamp is a schemaVersion>=4 field; a v1–v3 pr:verify proof must not carry it.",
+		path: ["impactStamp"]
+	});
+	if (proof.schemaVersion < 4 && proof.notRequiredCommands !== void 0) context.addIssue({
+		code: "custom",
+		message: "notRequiredCommands is a schemaVersion>=4 field; a v1–v3 pr:verify proof must not carry it.",
+		path: ["notRequiredCommands"]
+	});
+	assertBatteryCompleteness(proof, context);
+	assertNotRequiredStampAuthorization(proof, context);
+};
 const LEGACY_CLOSEOUT_SCHEMA_VERSION = 3;
 const MAX_CLOSEOUT_ROWS = 1e3;
 const IdentifierSchema = z.string().min(1).max(500);
@@ -4297,6 +4951,11 @@ const executedCommandSchema$1 = z.object({
 		"full"
 	])
 });
+const notRequiredCommandSchema$1 = z.object({
+	basis: z.string().min(1),
+	impactTarget: z.string().min(1),
+	name: z.string().min(1)
+});
 const prVerifySchemaVersionSchema$1 = z.number().refine((value) => SUPPORTED_PR_VERIFY_SCHEMA_VERSIONS$1.includes(value), { message: `schemaVersion must be one of: ${SUPPORTED_PR_VERIFY_SCHEMA_VERSIONS$1.join(", ")}` });
 z.object({
 	authoringSession: z.string().trim().min(1).optional(),
@@ -4317,12 +4976,14 @@ z.object({
 	endedAt: z.iso.datetime(),
 	executedCommands: z.array(executedCommandSchema$1).optional(),
 	headSha: z.string().regex(/^[0-9a-f]{40}$/u),
+	impactStamp: impactStampSchema.optional(),
 	mergeBaseSha: z.string().regex(/^[0-9a-f]{40}$/u).optional(),
 	mode: z.enum([
 		"docs-only",
 		"trivial",
 		"full"
 	]),
+	notRequiredCommands: z.array(notRequiredCommandSchema$1).min(1).optional(),
 	outcome: z.enum(["aborted", "passed"]).optional(),
 	patchId: z.string().regex(/^[0-9a-f]{40}$/u).optional(),
 	profilePath: z.string().min(1),
@@ -4333,6 +4994,7 @@ z.object({
 	verificationCommands: z.array(z.object({
 		command: z.string().min(1),
 		description: z.string().min(1),
+		impactTarget: z.string().min(1).optional(),
 		name: z.string().min(1),
 		scope: z.enum([
 			"always",
@@ -4341,18 +5003,7 @@ z.object({
 			"full"
 		])
 	}))
-}).superRefine((proof, context) => {
-	if (proof.schemaVersion >= 4 && proof.authoringSession === void 0) context.addIssue({
-		code: "custom",
-		message: "schemaVersion 4 pr:verify proof requires authoringSession (the recorded authoring identity, or the `unknown` sentinel).",
-		path: ["authoringSession"]
-	});
-	if (proof.schemaVersion < 4 && proof.authoringSession !== void 0) context.addIssue({
-		code: "custom",
-		message: "authoringSession is a schemaVersion>=4 field; a v1–v3 pr:verify proof must not carry it.",
-		path: ["authoringSession"]
-	});
-});
+}).superRefine(assertPrVerifyProofRules);
 const PR_REVIEW_FINDING_PROVENANCE_VERSION$1 = 1;
 const nonBlankString$3 = z.string().refine((value) => value.trim().length > 0, { message: "must not be blank" });
 const parseableDateString$1 = z.string().refine((value) => Number.isFinite(Date.parse(value)), { message: "must be a parseable date string" });
@@ -9403,6 +10054,7 @@ var external_evidence_exports = /* @__PURE__ */ __exportAll({
 	EVIDENCE_DIR: () => EVIDENCE_DIR,
 	EVIDENCE_ENVELOPE_SCHEMA_VERSION: () => 1,
 	EVIDENCE_REVIEW_RUNGS: () => EVIDENCE_REVIEW_RUNGS$1,
+	boundFailingCheckNames: () => boundFailingCheckNames,
 	evaluateRequiredChecks: () => evaluateRequiredChecks,
 	evidenceBindingFresh: () => evidenceBindingFresh,
 	evidenceEnvelopeSchema: () => evidenceEnvelopeSchema,
@@ -9491,6 +10143,41 @@ const evidenceReviewIndependence = ({ authoringSessionIds, envelope }) => {
 	};
 	return { independent: true };
 };
+/**
+* The VETO predicate: does a current envelope, bound to exactly this
+* candidate, record a FAILING outcome for this check?
+*
+* An inferred graph verdict never silences a direct observation (ADR 0024:
+* controls fail loudly). Wave 2 uses this to withhold a demand release; wave 3
+* (#430) uses the same predicate — via {@link boundFailingCheckNames} — to
+* withhold battery and preview-lifecycle scoping. It is ONE matcher on
+* purpose: two vetoes that matched differently could withhold a demand while
+* releasing the work that would satisfy it, leaving a demand nothing on this
+* head can ever meet.
+*/
+const envelopeRecordsBoundFailure = ({ candidate, check, envelope }) => envelope.check === check.name && envelope.checkType === check.checkType && envelope.outcome === "fail" && evidenceBindingFresh({
+	candidate,
+	envelope
+});
+/**
+* Every check name with a current, candidate-bound FAILING envelope on disk.
+*
+* The wave-3 scoping veto input. Callers pass the resolved set to
+* `planVerificationBattery` / `planPreviewLifecycle`, which stay pure — the
+* planners decide, they never read the filesystem.
+*
+* `checkType` is the caller's, not a guess: schema-v5 requiredChecks are
+* verify-only (`resolveProfileRequiredChecks`), so a scoping caller passes
+* `"verify"` and matches exactly the pair wave 2 evaluates.
+*/
+const boundFailingCheckNames = ({ candidate, checkType, envelopes }) => [...new Set(envelopes.flatMap((loaded) => loaded.ok && envelopeRecordsBoundFailure({
+	candidate,
+	check: {
+		checkType,
+		name: loaded.envelope.check
+	},
+	envelope: loaded.envelope
+}) ? [loaded.envelope.check] : []))];
 const bindingRefusalReason = (name) => `Required check "${name}" has no passing, current envelope bound to the candidate delta (patchId).`;
 /**
 * The `evidence:emit` invocation that would satisfy a specific demanded check.
@@ -9618,6 +10305,23 @@ const evaluateRequiredChecks = ({ authoringSessionIds, candidate, envelopes, req
 			scopeReason: scopeDecision.reason,
 			status: "out-of-scope"
 		};
+		const release = impactStampDemandRelease({
+			checkName: check.name,
+			stamp: scopeContext.impactStamp
+		});
+		const boundFailureObserved = parsed.some((loaded) => envelopeRecordsBoundFailure({
+			candidate,
+			check,
+			envelope: loaded.envelope
+		}));
+		if (release.released && !boundFailureObserved) return {
+			checkType: check.checkType,
+			inScope: false,
+			name: check.name,
+			...check.scope ? { scope: check.scope } : {},
+			scopeReason: release.reason,
+			status: "out-of-scope"
+		};
 		return {
 			...evaluateInScopeCheck({
 				authoringSessionIds,
@@ -9790,6 +10494,7 @@ var verification_proof_exports = /* @__PURE__ */ __exportAll({
 	prVerifyProofHeadShas: () => prVerifyProofHeadShas,
 	readPrVerifyProof: () => readPrVerifyProof,
 	resolveVerifyProofApplicability: () => resolveVerifyProofApplicability,
+	trustedImpactStamp: () => trustedImpactStamp,
 	validatePrVerifyProof: () => validatePrVerifyProof,
 	verificationProofApplicabilityFor: () => verificationProofApplicabilityFor,
 	verificationProofBlockingReason: () => verificationProofBlockingReason,
@@ -9820,6 +10525,11 @@ const executedCommandSchema = z.object({
 		"full"
 	])
 });
+const notRequiredCommandSchema = z.object({
+	basis: z.string().min(1),
+	impactTarget: z.string().min(1),
+	name: z.string().min(1)
+});
 const prVerifySchemaVersionSchema = z.number().refine((value) => SUPPORTED_PR_VERIFY_SCHEMA_VERSIONS.includes(value), { message: `schemaVersion must be one of: ${SUPPORTED_PR_VERIFY_SCHEMA_VERSIONS.join(", ")}` });
 const prVerifyProofSchema = z.object({
 	authoringSession: z.string().trim().min(1).optional(),
@@ -9844,12 +10554,14 @@ const prVerifyProofSchema = z.object({
 	endedAt: z.iso.datetime(),
 	executedCommands: z.array(executedCommandSchema).optional(),
 	headSha: z.string().regex(/^[0-9a-f]{40}$/u),
+	impactStamp: impactStampSchema.optional(),
 	mergeBaseSha: z.string().regex(/^[0-9a-f]{40}$/u).optional(),
 	mode: z.enum([
 		"docs-only",
 		"trivial",
 		"full"
 	]),
+	notRequiredCommands: z.array(notRequiredCommandSchema).min(1).optional(),
 	outcome: z.enum(["aborted", "passed"]).optional(),
 	patchId: z.string().regex(/^[0-9a-f]{40}$/u).optional(),
 	profilePath: z.string().min(1),
@@ -9860,6 +10572,7 @@ const prVerifyProofSchema = z.object({
 	verificationCommands: z.array(z.object({
 		command: z.string().min(1),
 		description: z.string().min(1),
+		impactTarget: z.string().min(1).optional(),
 		name: z.string().min(1),
 		scope: z.enum([
 			"always",
@@ -9868,18 +10581,7 @@ const prVerifyProofSchema = z.object({
 			"full"
 		])
 	}))
-}).superRefine((proof, context) => {
-	if (proof.schemaVersion >= 4 && proof.authoringSession === void 0) context.addIssue({
-		code: "custom",
-		message: "schemaVersion 4 pr:verify proof requires authoringSession (the recorded authoring identity, or the `unknown` sentinel).",
-		path: ["authoringSession"]
-	});
-	if (proof.schemaVersion < 4 && proof.authoringSession !== void 0) context.addIssue({
-		code: "custom",
-		message: "authoringSession is a schemaVersion>=4 field; a v1–v3 pr:verify proof must not carry it.",
-		path: ["authoringSession"]
-	});
-});
+}).superRefine(assertPrVerifyProofRules);
 function validatePrVerifyProof(value) {
 	return prVerifyProofSchema.parse(value);
 }
@@ -9920,6 +10622,29 @@ const verifyProofIdentityMatches = ({ currentIdentity, proof }) => Boolean(proof
 	recorded: { patchId: proof.patchId },
 	rule: "patch-id"
 }));
+/**
+* Wave-2 consumption (#542): the recorded impact stamp, released for demand
+* resolution ONLY when it is identity-bound to the current candidate — the
+* proof passed, and its recorded headSha AND patchId both name exactly this
+* candidate (the same identities the proof already binds). Everything else —
+* no proof, an aborted run, a stale head, a moved patch id, a pre-stamp proof
+* — returns `undefined`, and the consumer keeps today's full-demand floor.
+*
+* Deliberately stricter than verify-once applicability (which tolerates a
+* head-only or patch-id-only match): a stamp narrows external demands, so it
+* is trusted only on an exact double binding, fail closed.
+*/
+const trustedImpactStamp = ({ candidate, proof }) => {
+	if (!proof || !verifyProofPassed(proof)) return;
+	if (proof.schemaVersion < 4) return;
+	const headBound = sameHeadSha(candidate.headSha, proof.headSha);
+	const patchBound = evidenceFresh({
+		candidate: { patchId: candidate.patchId },
+		recorded: { patchId: proof.patchId },
+		rule: "patch-id"
+	});
+	return headBound && patchBound ? proof.impactStamp : void 0;
+};
 const prVerifyFullHeadShasForDiff = ({ docsOnlyDeltaAcceptedSince, files, proof }) => {
 	if (!verifyProofPassed(proof)) return [];
 	if (proof.mode === "full") return sameFileList(proof.changedFiles, files) ? [proof.headSha] : [];
@@ -10287,6 +11012,7 @@ function defaultPrVerifyGit() {
 				exitCode: result.exitCode
 			};
 		},
+		showFileAtRef,
 		stablePatchId: runStablePatchId,
 		statusPorcelain
 	};
@@ -10316,7 +11042,7 @@ function baselineFullProofsForDocsOnly({ previousProof, profilePath, projectKey,
 		seedFilter: matchesProfile
 	});
 }
-function buildPrVerifyProof({ authoringSession, base, baselineFullProofs, classification, commands, endedAt, executedCommands, files, headSha, mode, mergeBaseSha: proofMergeBaseSha, outcome, patchId, profilePath, projectKey, repository, startedAt }) {
+function buildPrVerifyProof({ authoringSession, base, baselineFullProofs, classification, commands, endedAt, executedCommands, files, headSha, impactStamp, mode, mergeBaseSha: proofMergeBaseSha, notRequiredCommands, outcome, patchId, profilePath, projectKey, repository, startedAt }) {
 	return {
 		authoringSession,
 		base,
@@ -10329,8 +11055,10 @@ function buildPrVerifyProof({ authoringSession, base, baselineFullProofs, classi
 		endedAt: endedAt.toISOString(),
 		executedCommands,
 		headSha,
+		impactStamp,
 		mergeBaseSha: proofMergeBaseSha,
 		mode,
+		...notRequiredCommands.length > 0 ? { notRequiredCommands } : {},
 		outcome,
 		patchId,
 		profilePath,
@@ -10375,9 +11103,10 @@ function resolveMode({ classification, mode }) {
 	return mode;
 }
 function commandsForMode(profile, mode) {
-	return profile.verification.commands.filter((command) => commandAppliesToMode(command, mode)).map(({ command, description, name, scope }) => ({
+	return profile.verification.commands.filter((command) => commandAppliesToMode(command, mode)).map(({ command, description, impactTarget, name, scope }) => ({
 		command,
 		description,
+		...impactTarget === void 0 ? {} : { impactTarget },
 		name,
 		scope
 	}));
@@ -10432,6 +11161,35 @@ function runPrVerify(args, dependencies = {}) {
 		cwd,
 		git
 	});
+	const readLockfileAtRef = git.showFileAtRef ?? showFileAtRef;
+	let impactStamp;
+	try {
+		impactStamp = computeImpactStamp({
+			changedFiles: files,
+			profile,
+			readLockfile: (side) => readLockfileAtRef(cwd, side === "base" ? proofMergeBaseSha : headSha, path.resolve(cwd, LOCKFILE_PATH))
+		});
+	} catch (error) {
+		if (error instanceof ImpactStampConfigError) throw error;
+		impactStamp = conservativeImpactStamp(profile.impact?.targets ?? [], [`impact stamp computation failed (${error instanceof Error ? error.message : String(error)}); fail closed to full impact`]);
+	}
+	const vetoedTargets = boundFailingCheckNames({
+		candidate: {
+			headSha,
+			mergeBaseSha: proofMergeBaseSha,
+			patchId
+		},
+		checkType: "verify",
+		envelopes: loadEvidenceEnvelopes(cwd)
+	});
+	const battery = planVerificationBattery({
+		commands: selectedProfileCommands,
+		stamp: impactStamp,
+		vetoedTargets
+	});
+	const notRequiredCommands = battery.notRequired;
+	const scopedOutNames = new Set(notRequiredCommands.map(({ name }) => name));
+	for (const line of batteryScopeSummaryLines(battery)) console.log(line);
 	const repository = `${profile.repository.owner}/${profile.repository.name}`;
 	let gateState = "failure";
 	const { env: verificationEnv, cleanup } = context.buildEnv();
@@ -10455,8 +11213,10 @@ function runPrVerify(args, dependencies = {}) {
 		commands,
 		files,
 		headSha,
+		impactStamp,
 		mergeBaseSha: proofMergeBaseSha,
 		mode: resolvedMode,
+		notRequiredCommands,
 		patchId,
 		profilePath,
 		projectKey: profile.repository.name,
@@ -10488,6 +11248,7 @@ function runPrVerify(args, dependencies = {}) {
 	};
 	try {
 		for (const command of commands) {
+			if (scopedOutNames.has(command.name)) continue;
 			console.log(`\n> ${command.name}: ${command.command}`);
 			const result = git.runVerificationCommand(command.command, cwd, verificationEnv);
 			const executedCommand = {
@@ -10554,6 +11315,7 @@ function runPrVerify(args, dependencies = {}) {
 		});
 		for (const command of selectedProfileCommands) {
 			if (!command.requiredCheck) continue;
+			if (scopedOutNames.has(command.name)) continue;
 			runEvidenceEmit({
 				base: args.base,
 				check: command.requiredCheck,
@@ -11235,6 +11997,13 @@ const requiredCheckChecks = ({ candidate, candidateError, cwd, profile, verifyPr
 		name: "admission:required-checks",
 		status: "warning"
 	}];
+	const impactStamp = trustedImpactStamp({
+		candidate: {
+			headSha: candidate.headSha,
+			patchId: candidate.patchId
+		},
+		proof: verifyProof
+	});
 	const { outcomes } = evaluateRequiredChecks({
 		authoringSessionIds: resolveAuthoringSessionIds({ recorded: verifyProof?.authoringSession }),
 		candidate: {
@@ -11244,7 +12013,10 @@ const requiredCheckChecks = ({ candidate, candidateError, cwd, profile, verifyPr
 		},
 		envelopes: loadEvidenceEnvelopes(cwd),
 		requiredChecks,
-		scopeContext: { classification: candidate.classification }
+		scopeContext: {
+			classification: candidate.classification,
+			...impactStamp ? { impactStamp } : {}
+		}
 	});
 	return outcomes.map((outcome) => ({
 		message: requiredCheckMessage(outcome),
@@ -12638,8 +13410,8 @@ const inactiveMergeFreezeStateSchema = z.object({
 });
 const mergeFreezeStateSchema = z.discriminatedUnion("active", [activeMergeFreezeStateSchema, inactiveMergeFreezeStateSchema]);
 /**
-* The write side of this contract lives in the generated main-push verify
-* workflow (#356, ADR 0016 as amended): it is the ONLY producer of
+* The write side of this contract lives in the generated merge-target push
+* Verify workflow (#356, ADR 0016 as amended; #429): it is the ONLY producer of
 * `patronage-factory/merge-freeze` generations. Its emitted `output.text`
 * payload must parse under this exact reader schema, which is what the
 * workflow's own tests assert through this export.
@@ -12732,7 +13504,7 @@ function selectListedMergeFreezeGeneration(listed, expectedHeadSha) {
 function unconfiguredMergeFreeze(input, detail) {
 	return {
 		kind: "unreadable",
-		reason: `The ${MERGE_FREEZE_CHECK_NAME} writer is unconfigured or its settle window cannot be confirmed for base ${input.headSha}: ${detail} Generate the main-push verify workflow, configure FACTORY_GITHUB_APP_PRIVATE_KEY, and rerun pr:ready after the first App-owned freeze generation appears.`
+		reason: `The ${MERGE_FREEZE_CHECK_NAME} writer is unconfigured or its settle window cannot be confirmed for base ${input.headSha}: ${detail} Generate the merge-target push Verify workflow, configure FACTORY_GITHUB_APP_PRIVATE_KEY, and rerun pr:ready after the first App-owned freeze generation appears on this base branch.`
 	};
 }
 function selectMissingMergeFreezeGenerationUnchecked(api, input) {
@@ -12839,8 +13611,38 @@ function createGitHubCheckRunMergeFreezeApi(dependencies = {}) {
 	};
 }
 const githubMergeFreezeStore = createGitHubCheckRunMergeFreezeStore(createGitHubCheckRunMergeFreezeApi());
-/** The one refusal sentence, naming both exits, wherever the freeze refuses. */
-const activeMergeFreezeReason = (reason) => `Merge freeze is active (${reason}). It clears automatically when the main-push verify workflow completes green after a fix-forward or revert; an operator may waive it for one candidate with patronage-factory demand:waive --pr <pr> --demand merge-freeze --rationale <why>.`;
+/**
+* The one refusal sentence, naming both exits, wherever the freeze refuses.
+*
+* Deliberately base-tip-scoped rather than main-scoped (#429). Since the writer
+* completes a generation on every factory merge target, the freeze this reader
+* found lives on the tip it was asked about — `main` for a main-targeting
+* candidate, the epic branch for an epic-targeting one — and only a later green
+* Verify push to THAT branch writes a newer inactive generation. The writer's
+* own recovery text, quoted verbatim in `reason`, names the branch; this
+* wrapper must not contradict it by naming a different one.
+*/
+const activeMergeFreezeReason = (reason) => `Merge freeze is active (${reason}). The generation is the one on this candidate's own base tip, so it clears automatically when a later Verify push to that base branch completes green after a fix-forward or revert; an operator may waive it for one candidate with patronage-factory demand:waive --pr <pr> --demand merge-freeze --rationale <why>.`;
+/**
+* The refusal for unreadable authority, which is NOT the active-freeze
+* sentence (#429 review cycles 2 and 3).
+*
+* Both refusals are equally fail-closed, but their recovery is not the same
+* act, and — the cycle-3 correction — "unreadable" is not one situation either.
+* It covers a repository with no writer at all, an unreachable Checks API, and
+* a defective *selected* generation: ambiguous newest runs, a malformed
+* payload, state inconsistent with its own conclusion. The first two are exited
+* by making the authority readable; the last is exited by a newer valid
+* App-owned generation winning the `started_at` selection, which a later Verify
+* push to the base branch normally produces.
+*
+* So this message states both paths without asserting which one applies. The
+* detail string it quotes is what distinguishes them, and the operator can read
+* it. Two categorical claims have already been wrong here — "clears when the
+* main-push verify completes green" (cycle 1) and "no Verify push clears this"
+* (cycle 2) — both from a refusal that spoke for states it could not see.
+*/
+const unreadableMergeFreezeReason = (headSha, detail) => `Merge freeze refuses this candidate: the authoritative ${MERGE_FREEZE_CHECK_NAME} state for its base tip ${headSha} could not be read (${detail}). Which recovery applies is what that detail says: restore readability where the authority is missing or unreachable — the merge-target push Verify workflow generated, its writer App credentials configured, GitHub's Checks API reachable with read access — and/or let a fresh valid App-owned generation supersede a defective one, which a later Verify push to this base branch normally produces. Then rerun pr:ready. An operator may waive it for one candidate with patronage-factory demand:waive --pr <pr> --demand merge-freeze --rationale <why>.`;
 /**
 * The freeze read during readiness, before any authorized arming (#477,
 * ADR 0016 as amended 2026-07-31/2026-08-01).
@@ -12852,17 +13654,17 @@ const activeMergeFreezeReason = (reason) => `Merge freeze is active (${reason}).
 * notice only when the writer is observable: either its generation is running,
 * or the prior tip has a settled generation while this tip's source-pinned
 * hosted verify is running (#521). Epic #473 decision 5 deliberately trades
-* the settle-window wait against the measured rarity of a red main. A
+* the settle-window wait against the measured rarity of a red merge target. A
 * writerless or unprovable repository fails closed.
 */
 function armingMergeFreezeOutcome(input, authority) {
 	const generation = authority.readGeneration(input);
 	if (generation.kind === "settling") return {
 		blockingReasons: [],
-		notices: [`Merge freeze generation for base ${input.headSha} is still settling (${generation.reason}); readiness proceeds (ADR 0016, 2026-07-31/2026-08-01 amendments). If this wave authorizes machine merge, arming follows the admission decision. The main-push verify for that tip still refuses every later readiness decision if it goes red.`]
+		notices: [`Merge freeze generation for base ${input.headSha} is still settling (${generation.reason}); readiness proceeds (ADR 0016, 2026-07-31/2026-08-01 amendments). If this wave authorizes machine merge, arming follows the admission decision. The Verify run for that tip still refuses every later readiness decision against this base branch if it goes red.`]
 	};
 	if (generation.kind === "unreadable") return {
-		blockingReasons: [activeMergeFreezeReason(`Authoritative GitHub merge freeze check-run state is unavailable or invalid: ${generation.reason}`)],
+		blockingReasons: [unreadableMergeFreezeReason(input.headSha, `Authoritative GitHub merge freeze check-run state is unavailable or invalid: ${generation.reason}`)],
 		notices: []
 	};
 	return {
@@ -13354,12 +14156,23 @@ const requiredChecksEvaluation = (input) => {
 		mergeBaseSha: input.mergeBaseSha ?? input.baseSha,
 		patchId: input.patchId
 	};
+	const { verificationProof } = input;
+	const impactStamp = trustedImpactStamp({
+		candidate: {
+			headSha: input.headSha,
+			patchId: input.patchId
+		},
+		proof: verificationProof && "proof" in verificationProof ? verificationProof.proof : void 0
+	});
 	const { blockingReasons, outcomes } = evaluateRequiredChecks({
 		authoringSessionIds: input.authoringSessionIds ?? [],
 		candidate,
 		envelopes: input.evidenceEnvelopes ?? [],
 		requiredChecks,
-		scopeContext: { classification: input.classification }
+		scopeContext: {
+			classification: input.classification,
+			...impactStamp ? { impactStamp } : {}
+		}
 	});
 	const blockers = outcomes.flatMap((outcome) => outcome.reason ? [{
 		demand: requiredCheckDemand(outcome.name),
@@ -15490,6 +16303,60 @@ const assembleReviewPrompt = ({ base, changedFiles, headSha, issueFocus, kind, p
 	};
 };
 //#endregion
+//#region src/preview-lifecycle.ts
+/**
+* The declared preview stacks: impact targets that are ALSO declared required
+* checks — i.e. targets whose proof is produced externally, which is exactly
+* what a preview producer is.
+*
+* Deriving the list from the two existing declarations rather than adding a
+* third is what makes lifecycle and demand unable to disagree: the stacks this
+* plan can withhold are precisely the demands wave 2 can release, so a stack
+* can never be skipped while its proof stays demanded.
+*/
+const previewLifecycleTargets = (profile) => {
+	const demanded = new Set((profile.requiredChecks ?? []).map(({ name }) => name));
+	return (profile.impact?.targets ?? []).map(({ name }) => name).filter((name) => demanded.has(name));
+};
+/**
+* Plan the preview lifecycle for one candidate.
+*
+* Trust is resolved here through the SAME identity gate demand release uses
+* (`trustedImpactStamp`): the proof must have passed and must bind both the
+* candidate's headSha and its patchId. A stale, aborted, absent, or
+* differently-bound proof yields no stamp, and every declared stack is planned
+* for deploy. Total over its INPUTS — no proof, stamp, or profile can make it
+* throw. A malformed CALL is the deliberate exception: omitting
+* `vetoedTargets` is API misuse, not data doubt, and throws.
+*/
+const planPreviewLifecycle = ({ candidate, profile, proof, vetoedTargets }) => {
+	assertVetoedTargets(vetoedTargets, "planPreviewLifecycle");
+	const stamp = trustedImpactStamp({
+		candidate,
+		proof
+	});
+	const vetoed = new Set(vetoedTargets);
+	const targets = previewLifecycleTargets(profile).map((name) => {
+		const decision = impactStampScopeDecision({
+			stamp,
+			surface: "preview-lifecycle",
+			targetName: name
+		});
+		const vetoedHere = decision.scoped && vetoed.has(name);
+		return {
+			basis: vetoedHere ? `veto: a current envelope bound to this candidate records stack "${name}" as FAILING, so the stamp's release is withheld (${decision.reason})` : decision.reason,
+			disposition: decision.scoped && !vetoedHere ? "not-required" : "deploy",
+			name
+		};
+	});
+	return {
+		deploy: targets.filter((target) => target.disposition === "deploy").map((target) => target.name),
+		notRequired: targets.filter((target) => target.disposition === "not-required"),
+		stampTrusted: stamp !== void 0,
+		targets
+	};
+};
+//#endregion
 //#region src/index.ts
 function createProgram(options = {}) {
 	const factoryCliInvocation = options.factoryCliInvocation ? FactoryCliInvocationSchema.parse(options.factoryCliInvocation) : defaultFactoryCliInvocation(import.meta.filename);
@@ -15537,4 +16404,4 @@ if (isDirectCliExecution()) try {
 	process.exit(1);
 }
 //#endregion
-export { DEFAULT_DEMAND_WAIVER_PATH, DEFAULT_FACTORY_REPOSITORY, DemandWaiveRefusalError, EPIC_STRUCTURE_NODE_STATUSES, EPIC_STRUCTURE_SCHEMA_VERSION, EpicStructureValidationError, FactoryCliInvocationSchema, FollowUpActionSchema, MERGE_FREEZE_APP_SLUG, MERGE_FREEZE_CHECK_NAME, PrPublishFollowUpError, RETRO_ENVELOPE_SCHEMA_VERSION, RETRO_ENVELOPE_VALIDATORS, REVIEW_FOCUS_SECTION, SUPPORTED_RETRO_ENVELOPE_SCHEMA_VERSIONS, WorkerCheckoutGuardError, appendReviewLadderStageTraceEvent, appendWithTraceSinks, applyDemandWaiver, assembleReviewPrompt, assertWorkerCheckoutAllowed, authorizeDemandWaiver, blockingLadderFindings, boundary_manifest_exports as boundaryManifest, boundary_review_proof_exports as boundaryReviewProof, buildEpicStructureEvent, buildEpicStructurePayload, buildEvidenceEnvelope, buildRetroEnvelope, buildReviewGateNotRequiredTraceEvent, buildReviewLadderStageTraceEvent, comment_provenance_exports as commentProvenance, createLocalJsonlTraceSink, createProgram, doctorProjectProfile, epicStructureEventId, evaluateReviewLadder, evidenceEnvelopeFilename, findingKey, followUpFromArgv, inferFixedInThreadDispositions, isProductionHqUrl, isRetroEnvelopeWireComplete, loadProjectProfile, normalizeIssueComments, openLadderFindings, parseRetroEnvelope, planPublishFollowUp, readiness_evaluation_exports as prReadinessEvaluation, external_evidence_exports as prReadinessExternalEvidence, pr_body_renderer_exports as prReadinessPrBodyRenderer, proof_identity_exports as prReadinessProofIdentity, review_proof_exports as prReadinessReviewProof, status_check_rollup_exports as prReadinessStatusChecks, verification_proof_exports as prReadinessVerificationProof, publishEpicStructure, readDemandWaivers, readPrReadyProof, readPrReviewProof, resolveFactoryRepository, resolveFindingBlocking, resolveReviewFindingCategory, resolveReviewFindingSeverity, resolveReviewLadderPolicy, resolveTraceWriteSinks, retroEnvelopeSchemaVersionOf, retroEnvelopeV1Schema, retroEpicReference, reviewCycleStateFor, reviewFocusFromIssueBody, reviewPromptSectionSchema, reviewPromptSectionsSchema, run, runBoundaryCheck, runDemandWaive, runEvidenceEmit, runPrPublish, runPrReady, runPrReview, runPrVerify, scanFactoryTraceDiagnostics, scanFactoryTraceEvents, selectWaiversForCandidate, staleRepeatLadderFindings, toFactoryTraceEnvelope, tryAppendReviewGateNotRequiredTraceEvent, tryAppendReviewLadderStageTraceEvent, validateBoundaryCheckProof, validateDagDocument, validateDemandWaiverStore, validateFactoryTraceEvent, validateMergeFreezeState, validatePrReadyProof, validatePrReviewProof, validatePrVerifyProof, waivedDemandNotice, waivedDemandSchema, worktree_scratch_files_exports as worktreeScratchFiles };
+export { DEFAULT_DEMAND_WAIVER_PATH, DEFAULT_FACTORY_REPOSITORY, DemandWaiveRefusalError, EPIC_STRUCTURE_NODE_STATUSES, EPIC_STRUCTURE_SCHEMA_VERSION, EpicStructureValidationError, FactoryCliInvocationSchema, FollowUpActionSchema, MERGE_FREEZE_APP_SLUG, MERGE_FREEZE_CHECK_NAME, PrPublishFollowUpError, RETRO_ENVELOPE_SCHEMA_VERSION, RETRO_ENVELOPE_VALIDATORS, REVIEW_FOCUS_SECTION, SUPPORTED_RETRO_ENVELOPE_SCHEMA_VERSIONS, WorkerCheckoutGuardError, appendReviewLadderStageTraceEvent, appendWithTraceSinks, applyDemandWaiver, assembleReviewPrompt, assertWorkerCheckoutAllowed, authorizeDemandWaiver, batteryScopeSummaryLines, blockingLadderFindings, boundary_manifest_exports as boundaryManifest, boundary_review_proof_exports as boundaryReviewProof, buildEpicStructureEvent, buildEpicStructurePayload, buildEvidenceEnvelope, buildRetroEnvelope, buildReviewGateNotRequiredTraceEvent, buildReviewLadderStageTraceEvent, comment_provenance_exports as commentProvenance, createLocalJsonlTraceSink, createProgram, doctorProjectProfile, epicStructureEventId, evaluateReviewLadder, evidenceEnvelopeFilename, findingKey, followUpFromArgv, impactStampScopeDecision, inferFixedInThreadDispositions, isProductionHqUrl, isRetroEnvelopeWireComplete, loadProjectProfile, normalizeIssueComments, openLadderFindings, parseRetroEnvelope, planPreviewLifecycle, planPublishFollowUp, planVerificationBattery, readiness_evaluation_exports as prReadinessEvaluation, external_evidence_exports as prReadinessExternalEvidence, pr_body_renderer_exports as prReadinessPrBodyRenderer, proof_identity_exports as prReadinessProofIdentity, review_proof_exports as prReadinessReviewProof, status_check_rollup_exports as prReadinessStatusChecks, verification_proof_exports as prReadinessVerificationProof, previewLifecycleTargets, publishEpicStructure, readDemandWaivers, readPrReadyProof, readPrReviewProof, resolveFactoryRepository, resolveFindingBlocking, resolveReviewFindingCategory, resolveReviewFindingSeverity, resolveReviewLadderPolicy, resolveTraceWriteSinks, retroEnvelopeSchemaVersionOf, retroEnvelopeV1Schema, retroEpicReference, reviewCycleStateFor, reviewFocusFromIssueBody, reviewPromptSectionSchema, reviewPromptSectionsSchema, run, runBoundaryCheck, runDemandWaive, runEvidenceEmit, runPrPublish, runPrReady, runPrReview, runPrVerify, scanFactoryTraceDiagnostics, scanFactoryTraceEvents, selectWaiversForCandidate, staleRepeatLadderFindings, toFactoryTraceEnvelope, tryAppendReviewGateNotRequiredTraceEvent, tryAppendReviewLadderStageTraceEvent, validateBoundaryCheckProof, validateDagDocument, validateDemandWaiverStore, validateFactoryTraceEvent, validateMergeFreezeState, validatePrReadyProof, validatePrReviewProof, validatePrVerifyProof, waivedDemandNotice, waivedDemandSchema, worktree_scratch_files_exports as worktreeScratchFiles };