@patronage/software-factory 1.0.0-alpha.20 → 1.0.0-alpha.22

package/README.md

@@ -66,7 +66,7 @@ Generated production workflows may call `psf production:impact --before <sha> --
 
 Generated pull-request workflows may call `psf candidate:impact --base <sha> --head <sha> --github-output <path>` to route Candidate verification surfaces. The command evaluates the same profile impact declarations and pnpm dependency graph from the exact base/head identity, diffed from their merge base; it is the candidate-named sibling of `production:impact` and replaces repository-owned path filters, never adds a second matcher. The `head` commit must be the checked-out `HEAD`, and both commits must be reachable (`fetch-depth: 0`). Every doubt path — unreadable identity, malformed or unsupported graph data, an unowned profile change, a working-tree profile that differs from the head commit, or classifier refusal — fails closed and leaves every declared target demanded. `production:impact` keeps its merge-push `before`/`after` contract unchanged.
 
-For factory workflow, install the four canonical skills from the repository:
+For factory workflow, install the four canonical skills as the `patronage-software-factory` host plugin (Claude Code, Codex, or Cursor; see [`skills/README.md`](../skills/README.md)). Cloud agents that cannot load host plugins fall back to:
 
 ```bash
 npx skills add https://github.com/patronage/software-factory -g --all

package/dist/index.d.ts

@@ -229,6 +229,8 @@ interface BoundaryPullRequestRef {
   headRefOid?: string;
   headRefName?: string;
   mergeCommitOid?: string;
+  /** GitHub's merge timestamp; the merge-ordering fact topology reads (#821). */
+  mergedAt?: string;
   number: number;
   state: "OPEN" | "CLOSED" | "MERGED";
 }
@@ -1283,7 +1285,7 @@ interface PrReviewProof {
   cleanedPaths: string[];
   ladder?: PrReviewLadderState;
   reviewRequirement?: {
-    reason: "no-applicable-mode";
+    reason: "no-applicable-mode" | "faithful-merge";
     status: "not-required";
   };
   reviews: PrReviewResult[];
@@ -1421,9 +1423,9 @@ declare const managedReadinessLedgerSchema: z.ZodObject<{
       reviewedHeadSha: z.ZodOptional<z.ZodString>;
       reviewedPatchId: z.ZodOptional<z.ZodString>;
       status: z.ZodEnum<{
+        blocked: "blocked";
         "not-required": "not-required";
         stale: "stale";
-        blocked: "blocked";
         current: "current";
         missing: "missing";
       }>;
@@ -1433,9 +1435,9 @@ declare const managedReadinessLedgerSchema: z.ZodObject<{
       reviewedHeadSha: z.ZodOptional<z.ZodString>;
       reviewedPatchId: z.ZodOptional<z.ZodString>;
       status: z.ZodEnum<{
+        blocked: "blocked";
         "not-required": "not-required";
         stale: "stale";
-        blocked: "blocked";
         current: "current";
         missing: "missing";
       }>;
@@ -1545,6 +1547,23 @@ interface UpsertFactoryPrStatusCommentResult {
 }
 declare function upsertFactoryPrStatusComment(input: UpsertFactoryPrStatusCommentInput, dependencies?: UpsertFactoryPrStatusCommentDependencies): Promise<UpsertFactoryPrStatusCommentResult>;
 //#endregion
+//#region src/catch-up-recognition-record.d.ts
+interface CatchUpRecognition {
+  /** The ref the candidate targets, as the recognizing command resolved it. */
+  baseRef: string;
+  /** The live target tip at recognition time; the head's first parent. */
+  baseTipSha: string;
+  /** The head's second parent: the admitted base-side content merged in. */
+  mergedParentSha: string;
+  /**
+   * The tree `git merge-tree --write-tree` produced for the two parents. It
+   * equals the head's own tree; that equality is the faithfulness proof.
+   */
+  mergedTreeSha: string;
+  /** The ref that proves the second parent is admitted content. */
+  upstreamRef: string;
+}
+//#endregion
 //#region src/pr-verify-proof-contract.d.ts
 declare const SUPPORTED_PR_VERIFY_SCHEMA_VERSIONS: readonly [1, 2, 3, 4];
 type PrVerifySchemaVersion = (typeof SUPPORTED_PR_VERIFY_SCHEMA_VERSIONS)[number];
@@ -1611,6 +1630,7 @@ interface PrVerifyProof {
     projectKey: string;
     repository: string;
   }[];
+  catchUpRecognition?: CatchUpRecognition;
   changedFiles: string[];
   classification: DiffClassification;
   classificationReasons: string[];
@@ -1635,7 +1655,7 @@ interface PrVerifyProof {
 type PrVerifyBaselineFullProof = NonNullable<PrVerifyProof["baselineFullProofs"]>[number];
 declare function validatePrVerifyProof(value: unknown): PrVerifyProof;
 declare namespace verification_proof_d_exports {
-  export { PrVerifyBaselineFullProof, PrVerifyCommandResult, PrVerifyExecutedCommand, PrVerifyNotDemandedRecord, PrVerifyNotRequiredCommand, PrVerifyProof, PrVerifySchemaVersion, ResolvedPrVerifyMode, SUPPORTED_PR_VERIFY_SCHEMA_VERSIONS, VerificationHeadShas, VerificationProofState, VerifiedHeadShas, prVerifyFullHeadShasForDiff, prVerifyProofHeadShas, readPrVerifyProof, resolveVerifyProofApplicability, trustedImpactStamp, validatePrVerifyProof, verificationProofApplicabilityFor, verificationProofBlockingReason, verificationProofForReadiness, verificationProofStateFor, verifyProofIdentityMatches, verifyProofPassed };
+  export { PrVerifyBaselineFullProof, PrVerifyCommandResult, PrVerifyExecutedCommand, PrVerifyNotDemandedRecord, PrVerifyNotRequiredCommand, PrVerifyProof, PrVerifySchemaVersion, ResolvedPrVerifyMode, SUPPORTED_PR_VERIFY_SCHEMA_VERSIONS, VerificationHeadShas, VerificationProofState, VerifiedHeadShas, prVerifyFullHeadShasForDiff, prVerifyProofHeadShas, readPrVerifyProof, resolveVerifyProofApplicability, trustedCatchUpRecognition, trustedImpactStamp, validatePrVerifyProof, verificationProofApplicabilityFor, verificationProofBlockingReason, verificationProofForReadiness, verificationProofStateFor, verifyProofIdentityMatches, verifyProofPassed };
 }
 interface VerifiedHeadShas {
   docsOnlyVerifiedHeadShas: string[];
@@ -1680,6 +1700,24 @@ declare const trustedImpactStamp: ({
   };
   proof: PrVerifyProof | undefined;
 }) => ImpactStamp | undefined;
+/**
+ * #833: the recorded catch-up recognition, consumed ONLY when it is
+ * identity-bound to the current candidate under exactly the rules
+ * `trustedImpactStamp` applies — the proof passed, is v4+, and its recorded
+ * headSha AND patchId both name this candidate. The recognition withdraws
+ * review and preview demands, so it earns the same strict double binding and
+ * the same fail-closed answer (`undefined`) on every other state.
+ */
+declare const trustedCatchUpRecognition: ({
+  candidate,
+  proof
+}: {
+  candidate: {
+    headSha: string;
+    patchId: string;
+  };
+  proof: PrVerifyProof | undefined;
+}) => CatchUpRecognition | undefined;
 declare const prVerifyFullHeadShasForDiff: ({
   docsOnlyDeltaAcceptedSince,
   files,
@@ -2194,6 +2232,7 @@ declare const requiredCheckScopeSchema: z.ZodObject<{
 }, z.core.$strict>;
 type RequiredCheckScope = z.infer<typeof requiredCheckScopeSchema>;
 interface RequiredCheckScopeContext {
+  catchUpRecognition?: CatchUpRecognition;
   classification: DiffClassification | undefined;
   impactStamp?: ImpactStamp;
 }
@@ -2376,9 +2415,9 @@ declare const loadEvidenceEnvelopes: (cwd: string) => LoadedEvidenceEnvelope[];
 //#region src/review-proof-applicability.d.ts
 declare const REVIEW_STATUS_VALUES: readonly ["not-required", "current", "stale", "missing", "blocked"];
 declare const reviewStatusSchema: z.ZodEnum<{
+  blocked: "blocked";
   "not-required": "not-required";
   stale: "stale";
-  blocked: "blocked";
   current: "current";
   missing: "missing";
 }>;
@@ -2527,8 +2566,8 @@ declare const boundaryCheckProofSchema: z.ZodObject<{
     value: z.ZodString;
   }, z.core.$strip>>;
   status: z.ZodEnum<{
-    ready: "ready";
     blocked: "blocked";
+    ready: "ready";
   }>;
 }, z.core.$strip>;
 type BoundaryCheckProofRecord = z.infer<typeof boundaryCheckProofSchema>;
@@ -2543,6 +2582,14 @@ interface BoundaryCheckGithub {
 interface BoundaryCheckArgs {
   cwd?: string;
   epic: number;
+  /**
+   * Closeout-final mode (#853): a manifest-declared issue whose closing-PR
+   * set is empty is a blocking reason, not a notice. Off by default so the
+   * interior boundary review (run before the terminal release PR exists,
+   * e.g. epic #842's own review of #844) keeps working; the epic closeout
+   * step turns this on as the last check before factory:closeout.
+   */
+  final?: boolean;
   json?: boolean;
   output?: string;
   repo?: string;
@@ -2626,6 +2673,19 @@ type HqFlushResult = (HqFlushOrphans & {
   status: "flushed";
 });
 //#endregion
+//#region src/catch-up-recognition.d.ts
+type CatchUpRecognitionResult = {
+  recognition: CatchUpRecognition;
+  recognized: true;
+} | {
+  reasons: string[];
+  recognized: false;
+};
+type CatchUpRecognizer = (input: {
+  base: string;
+  cwd: string;
+}) => CatchUpRecognitionResult;
+//#endregion
 //#region src/pr-review.d.ts
 interface PrReviewArgs extends LoadProjectProfileInput {
   base: string;
@@ -2641,6 +2701,7 @@ interface PrReviewGitDependencies {
   changedFiles: (cwd: string, base: string) => string[];
   currentHeadSha: (cwd: string) => string;
   isAncestor: (cwd: string, ancestor: string, descendant: string) => boolean;
+  recognizeCatchUp?: CatchUpRecognizer;
   stablePatchId: (cwd: string, base: string) => string;
   statusPorcelain: (cwd: string) => string;
 }
@@ -2680,6 +2741,7 @@ interface PrVerifyGitDependencies {
   currentHeadSha: (cwd: string) => string;
   emptyTreeHash: (cwd: string) => string;
   mergeBaseSha: (cwd: string, base: string) => string;
+  recognizeCatchUp?: CatchUpRecognizer;
   runVerificationCommand: (command: string, cwd: string, env: Record<string, string>) => VerificationCommandOutcome;
   showFileAtRef?: (cwd: string, ref: string, absolutePath: string) => string | undefined;
   statusPorcelain: (cwd: string) => string;
@@ -3034,6 +3096,7 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
   patchId: z.ZodString;
   reason: z.ZodEnum<{
     "no-applicable-mode": "no-applicable-mode";
+    "faithful-merge": "faithful-merge";
   }>;
   reviewCycle: z.ZodNumber;
 }, z.core.$strict>, readonly [z.ZodObject<{
@@ -3056,6 +3119,7 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
   patchId: z.ZodString;
   reason: z.ZodEnum<{
     "no-applicable-mode": "no-applicable-mode";
+    "faithful-merge": "faithful-merge";
   }>;
   reviewCycle: z.ZodNumber;
 }, z.core.$strict>], {
@@ -3069,6 +3133,7 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
     patchId: z.ZodString;
     reason: z.ZodEnum<{
       "no-applicable-mode": "no-applicable-mode";
+      "faithful-merge": "faithful-merge";
     }>;
     reviewCycle: z.ZodNumber;
   }, z.core.$strict>;
@@ -3086,7 +3151,7 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
   observedAt: string;
   outcome: "not-required";
   patchId: string;
-  reason: "no-applicable-mode";
+  reason: "no-applicable-mode" | "faithful-merge";
   reviewCycle: number;
   issue?: number | undefined;
   pr?: number | undefined;
@@ -4090,13 +4155,13 @@ declare const evaluateReadiness: (input: EvaluationInput) => {
     reviews: {
       correctness: {
         required: boolean;
-        status: "not-required" | "stale" | "blocked" | "current" | "missing";
+        status: "blocked" | "not-required" | "stale" | "current" | "missing";
         reviewedHeadSha?: string | undefined;
         reviewedPatchId?: string | undefined;
       };
       security?: {
         required: boolean;
-        status: "not-required" | "stale" | "blocked" | "current" | "missing";
+        status: "blocked" | "not-required" | "stale" | "current" | "missing";
         reviewedHeadSha?: string | undefined;
         reviewedPatchId?: string | undefined;
       } | undefined;

package/dist/index.js

@@ -17,7 +17,7 @@ import { parse } from "yaml";
 import { FACTORY_PROOF_GATE_APP_ID, FACTORY_PROOF_GATE_STEP_NAME, GitHubApiError, mintInstallationToken, previewProofInventory, productionImpactTargetOutput, readVitestProfileDocument } from "@patronage/factory-ci";
 import { promisify } from "node:util";
 //#region package.json
-var version = "1.0.0-alpha.20";
+var version = "1.0.0-alpha.22";
 //#endregion
 //#region src/review-rungs.ts
 const EVIDENCE_REVIEW_RUNGS$1 = [
@@ -159,23 +159,48 @@ const DEFAULT_TERMINAL_BASE = "main";
 * Derive the membership graph from the manifest's declared issues and their
 * live closing links. A PR observed under several issues keeps one
 * membership per issue; nothing is collapsed here and nothing is refused.
+*
+* A PR that closed without merging contributes NO closing link (#821): it
+* carried nothing into the boundary, so it is not a member and cannot fail
+* one. The dropped link is recorded on the issue. Closeout blocks by default
+* only on that flavor: an issue whose carriers all closed without merging. A
+* declared issue that never had any closing link is reported as a notice,
+* not a blocking reason — except under boundary:check --final, which blocks
+* on that flavor too (#853).
 */
 const buildBoundaryMembershipGraph = (manifest, fetchClosingPullRequests) => {
 	const memberships = [];
 	const unlinkedIssues = [];
+	const closedWithoutMergeLinks = [];
 	for (const wave of manifest.waves) for (const issue of wave.issues) {
 		const refs = fetchClosingPullRequests(issue);
-		if (refs.length === 0) unlinkedIssues.push({
+		const live = [];
+		const closedWithoutMerge = [];
+		for (const ref of refs) {
+			if (ref.state === "CLOSED") {
+				closedWithoutMerge.push(ref.number);
+				closedWithoutMergeLinks.push({
+					issue,
+					pr: ref.number,
+					wave: wave.name
+				});
+				continue;
+			}
+			live.push(ref);
+		}
+		if (live.length === 0) unlinkedIssues.push({
+			...closedWithoutMerge.length > 0 ? { closedWithoutMerge } : {},
 			issue,
 			wave: wave.name
 		});
-		for (const ref of refs) memberships.push({
+		for (const ref of live) memberships.push({
 			issue,
 			ref,
 			wave
 		});
 	}
 	return {
+		closedWithoutMergeLinks,
 		memberships,
 		unlinkedIssues
 	};
@@ -208,7 +233,8 @@ const membershipWaveDemand = (graph, pr) => {
 * validation; a repeated PR number is not evidence the memberships agree.
 */
 const coveredSetProjection = (graph) => {
-	const notices = graph.unlinkedIssues.map(({ issue, wave }) => `issue #${issue} (wave ${wave}) has no linked closing PR yet`);
+	const notices = graph.unlinkedIssues.map(({ closedWithoutMerge, issue, wave }) => closedWithoutMerge === void 0 ? `issue #${issue} (wave ${wave}) has no linked closing PR yet` : `issue #${issue} (wave ${wave}) has no live closing PR; its only closing link(s) ${closedWithoutMerge.map((pr) => `PR #${pr}`).join(", ")} closed without merging`);
+	for (const pr of new Set(graph.closedWithoutMergeLinks.map((l) => l.pr))) notices.push(`PR #${pr} is closed without merge; it contributes nothing to the covered set`);
 	const entries = [];
 	const pullRequests = [];
 	for (const { issue, ref, wave } of graph.memberships) {
@@ -235,7 +261,6 @@ const coveredSetProjection = (graph) => {
 			else notices.push(`PR #${ref.number} is open but GitHub reports no head SHA; excluded from the covered set`);
 			continue;
 		}
-		notices.push(`PR #${ref.number} is closed without merge; it contributes nothing to the covered set`);
 	}
 	return {
 		entries: entries.toSorted((a, b) => a.pr - b.pr || a.issue - b.issue),
@@ -392,6 +417,14 @@ const eachToEpicBranch = (manifest) => manifest.topology === "each-to-epic" ? ma
 * Validate only the current member during admission. This deliberately does
 * not inspect sibling membership or require the terminal PR: an epic branch
 * is assembled one admitted interior candidate at a time.
+*
+* A declared member that targets the terminal base is admitted from any head
+* (#821). At admission the candidate has not merged, so merge ordering — the
+* fact that separates the terminal from a post-terminal release member —
+* does not exist yet. Closeout owns that judgment, where the whole graph is
+* visible: it still requires exactly one terminal from the integration
+* branch, and it still refuses a main-targeting member that did not merge
+* after that terminal.
 */
 const pullRequestTopologyReasons = ({ manifest, pullRequest, terminalBase = DEFAULT_TERMINAL_BASE }) => {
 	const integrationBranch = eachToEpicBranch(manifest);
@@ -399,29 +432,67 @@ const pullRequestTopologyReasons = ({ manifest, pullRequest, terminalBase = DEFA
 	const { baseRefName, headRefName, number } = pullRequest;
 	if (!headRefName) return [`PR #${number} has no live head branch name; each-to-epic admission fails closed until GitHub reports the member's headRefName.`];
 	if (baseRefName === integrationBranch && headRefName !== integrationBranch) return [];
-	if (baseRefName === terminalBase && headRefName === integrationBranch) return [];
-	return [`PR #${number} contradicts each-to-epic topology: live head/base ${headRefName ?? "(unknown)"} -> ${baseRefName ?? "(unknown)"}; expected an interior member targeting ${integrationBranch}, or the terminal ${integrationBranch} -> ${terminalBase} PR.`];
+	if (baseRefName === terminalBase) return [];
+	return [`PR #${number} contradicts each-to-epic topology: live head/base ${headRefName ?? "(unknown)"} -> ${baseRefName ?? "(unknown)"}; expected an interior member targeting ${integrationBranch}, or a member targeting ${terminalBase} (the terminal, or a post-terminal release member).`];
+};
+const mergedAtMs = (pullRequest) => {
+	if (pullRequest.mergedAt === void 0) return;
+	const parsed = Date.parse(pullRequest.mergedAt);
+	return Number.isNaN(parsed) ? void 0 : parsed;
 };
 /**
-* Validate the complete declared member set at boundary closeout. Callers
-* supply only issue-linked PRs and unlinked manifest-fallback PRs; branch
-* names classify those authoritative members' roles but never discover
-* membership.
+* Judge a declared member that targets the terminal base from a branch other
+* than the integration branch. It is admitted as a post-terminal release
+* member (#821) exactly when it merged strictly after the one terminal PR:
+* an already-merged integration branch cannot receive later work, so a
+* ratified release slice has nowhere else to target. Every fact this needs is
+* membership plus merge ordering; nothing is declared in the manifest.
 */
-const boundaryTopologyReasons = ({ manifest, pullRequests, terminalBase = DEFAULT_TERMINAL_BASE }) => {
-	const integrationBranch = eachToEpicBranch(manifest);
-	if (!integrationBranch) return [];
-	const reasons = [];
+const postTerminalReleaseReasons = ({ candidate, integrationBranch, terminal, terminalBase }) => {
+	const label = `PR #${candidate.number} targets ${terminalBase} from ${candidate.headRefName ?? "(unknown)"}`;
+	if (!terminal) return [`${label}; each-to-epic accepts that only as a post-terminal release member, and no terminal ${integrationBranch} -> ${terminalBase} PR was found.`];
+	if (candidate.state !== "MERGED") return [`${label} and is not merged (state ${candidate.state ?? "unknown"}); a post-terminal release member must be merged after terminal PR #${terminal.number}.`];
+	const candidateMergedAt = mergedAtMs(candidate);
+	const terminalMergedAt = mergedAtMs(terminal);
+	if (candidateMergedAt === void 0 || terminalMergedAt === void 0) return [`${label}; merge ordering against terminal PR #${terminal.number} cannot be established because GitHub reports no usable merge timestamp for ${candidateMergedAt === void 0 ? `PR #${candidate.number}` : `PR #${terminal.number}`}.`];
+	if (candidateMergedAt <= terminalMergedAt) return [`${label} but merged at ${candidate.mergedAt}, not after terminal PR #${terminal.number} (merged ${terminal.mergedAt}); each-to-epic admits a ${terminalBase}-targeting member from another head only as a post-terminal release member.`];
+	return [];
+};
+const contradicts = (previous, observation) => previous.baseRefName !== observation.baseRefName || previous.headRefName !== observation.headRefName || previous.state !== observation.state || previous.mergedAt !== observation.mergedAt;
+/**
+* Collapse the repeated observations of one PR. A PR declared under several
+* issues is observed once per issue; identical observations collapse, and any
+* disagreement about that PR's live facts fails closed instead of letting
+* manifest order pick a winner.
+*/
+const collapseObservations = (pullRequests) => {
 	const byNumber = /* @__PURE__ */ new Map();
+	const reasons = [];
 	for (const pullRequest of pullRequests) {
 		const previous = byNumber.get(pullRequest.number);
-		if (previous && (previous.baseRefName !== pullRequest.baseRefName || previous.headRefName !== pullRequest.headRefName)) {
-			reasons.push(`PR #${pullRequest.number} has contradictory live branch data across its declared memberships.`);
+		if (previous && contradicts(previous, pullRequest)) {
+			reasons.push(`PR #${pullRequest.number} has contradictory live data across its declared memberships.`);
 			continue;
 		}
 		byNumber.set(pullRequest.number, pullRequest);
 	}
+	return {
+		byNumber,
+		reasons
+	};
+};
+/**
+* Validate the complete declared member set at boundary closeout. Callers
+* supply only issue-linked PRs and unlinked manifest-fallback PRs; branch
+* names classify those authoritative members' roles but never discover
+* membership.
+*/
+const boundaryTopologyReasons = ({ manifest, pullRequests, terminalBase = DEFAULT_TERMINAL_BASE }) => {
+	const integrationBranch = eachToEpicBranch(manifest);
+	if (!integrationBranch) return [];
+	const { byNumber, reasons } = collapseObservations(pullRequests);
 	const terminalPullRequests = [];
+	const releaseCandidates = [];
 	for (const pullRequest of byNumber.values()) {
 		if (!pullRequest.headRefName) {
 			reasons.push(`PR #${pullRequest.number} has no live head branch name; each-to-epic closeout fails closed until GitHub reports headRefName.`);
@@ -437,16 +508,26 @@ const boundaryTopologyReasons = ({ manifest, pullRequests, terminalBase = DEFAUL
 			continue;
 		}
 		if (pullRequest.baseRefName === terminalBase) {
-			if (pullRequest.headRefName !== integrationBranch) {
-				reasons.push(`PR #${pullRequest.number} targets ${terminalBase} from ${pullRequest.headRefName ?? "(unknown)"}; the each-to-epic terminal must originate from declared integrationBranch ${integrationBranch}.`);
-				continue;
-			}
-			terminalPullRequests.push(pullRequest.number);
+			if (pullRequest.headRefName === integrationBranch) terminalPullRequests.push(pullRequest);
+			else releaseCandidates.push(pullRequest);
 			continue;
 		}
 		reasons.push(`PR #${pullRequest.number} targets ${pullRequest.baseRefName ?? "(unknown)"}; every each-to-epic interior member must target declared integrationBranch ${integrationBranch}.`);
 	}
 	if (terminalPullRequests.length !== 1) reasons.push(`each-to-epic requires exactly one terminal member PR from ${integrationBranch} to ${terminalBase}; found ${terminalPullRequests.length}.`);
+	const [terminal] = terminalPullRequests;
+	const admittedReleaseMembers = [];
+	for (const candidate of releaseCandidates) {
+		const candidateReasons = postTerminalReleaseReasons({
+			candidate,
+			integrationBranch,
+			terminal: terminalPullRequests.length === 1 ? terminal : void 0,
+			terminalBase
+		});
+		if (candidateReasons.length === 0) admittedReleaseMembers.push(candidate);
+		reasons.push(...candidateReasons);
+	}
+	if (admittedReleaseMembers.length > 1) reasons.push(`each-to-epic admits at most one post-terminal release member targeting ${terminalBase}; found ${admittedReleaseMembers.length}: ${admittedReleaseMembers.map((member) => `PR #${member.number}`).join(", ")}.`);
 	return reasons;
 };
 //#endregion
@@ -1017,6 +1098,72 @@ function isAncestor(cwd, ancestor, descendant) {
 	if (result.status === 1) return false;
 	return false;
 }
+/** The head commit's parent shas, in order. Empty on a root commit. */
+function commitParents(cwd, ref) {
+	return runCapture("git", [
+		"rev-list",
+		"--parents",
+		"-n",
+		"1",
+		ref
+	], cwd).stdout.trim().split(/\s+/u).slice(1);
+}
+/** The tree object a commit-ish points at. */
+function treeShaOf(cwd, ref) {
+	return runCapture("git", ["rev-parse", `${ref}^{tree}`], cwd).stdout.trim();
+}
+/**
+* Run the real merge machinery without touching the worktree
+* (`git merge-tree --write-tree`). Exit 0 is a clean merge, exit 1 is a
+* conflicted one; both write a tree. Any other outcome (old git, bad refs)
+* returns `undefined` so the caller fails closed.
+*/
+function mergeTreeWriteTree(cwd, firstParent, secondParent) {
+	const result = spawnSync("git", [
+		"merge-tree",
+		"--write-tree",
+		"--no-messages",
+		firstParent,
+		secondParent
+	], {
+		cwd,
+		encoding: "utf-8",
+		env: gitEnv(),
+		stdio: [
+			"ignore",
+			"pipe",
+			"pipe"
+		]
+	});
+	if (result.error || result.status !== 0 && result.status !== 1) return;
+	const [treeSha] = result.stdout.trim().split("\n");
+	if (!treeSha || !/^[0-9a-f]{40,64}$/u.test(treeSha)) return;
+	return {
+		conflicted: result.status === 1,
+		treeSha
+	};
+}
+/**
+* The remote-tracking ref of the repository's default branch (e.g.
+* `refs/remotes/origin/main`), read from the local `origin/HEAD` symref.
+* `undefined` when the symref is unset; `git remote set-head origin --auto`
+* records it.
+*/
+function remoteDefaultBranchRef(cwd) {
+	const result = spawnSync("git", ["symbolic-ref", "refs/remotes/origin/HEAD"], {
+		cwd,
+		encoding: "utf-8",
+		env: gitEnv(),
+		stdio: [
+			"ignore",
+			"pipe",
+			"pipe"
+		]
+	});
+	if (result.error || result.status !== 0) return;
+	const ref = result.stdout.trim();
+	return ref.length > 0 ? ref : void 0;
+}
 //#endregion
 //#region src/github-issue-comments.ts
 const isCommentPage = (value) => Array.isArray(value[0]);
@@ -3778,6 +3925,16 @@ const authorizeDemandWaiver = ({ authenticatedLogin, session }) => {
 	} };
 };
 //#endregion
+//#region src/catch-up-recognition-record.ts
+const objectShaSchema = z.string().regex(/^[0-9a-f]{40}$/u);
+const catchUpRecognitionSchema = z.object({
+	baseRef: z.string().min(1),
+	baseTipSha: objectShaSchema,
+	mergedParentSha: objectShaSchema,
+	mergedTreeSha: objectShaSchema,
+	upstreamRef: z.string().min(1)
+}).strict();
+//#endregion
 //#region src/impact-stamp.ts
 const LOCKFILE_PATH = "pnpm-lock.yaml";
 const SUPPORTED_LOCKFILE_VERSION = "9.0";
@@ -4491,6 +4648,11 @@ const assertPrVerifyProofRules = (proof, context) => {
 		message: "notRequiredCommands is a schemaVersion>=4 field; a v1–v3 pr:verify proof must not carry it.",
 		path: ["notRequiredCommands"]
 	});
+	if (proof.schemaVersion < 4 && proof.catchUpRecognition !== void 0) context.addIssue({
+		code: "custom",
+		message: "catchUpRecognition is a schemaVersion>=4 field; a v1–v3 pr:verify proof must not carry it.",
+		path: ["catchUpRecognition"]
+	});
 	if (proof.schemaVersion < 4 && proof.notDemandedRecords !== void 0) context.addIssue({
 		code: "custom",
 		message: "notDemandedRecords is a schemaVersion>=4 field; a v1–v3 pr:verify proof must not carry it.",
@@ -4549,6 +4711,7 @@ const prVerifyProofSchema = z.object({
 		projectKey: z.string().min(1),
 		repository: z.string().min(1)
 	})).optional(),
+	catchUpRecognition: catchUpRecognitionSchema.optional(),
 	changedFiles: z.array(z.string()),
 	classification: z.enum([
 		"docs/process-only",
@@ -4863,7 +5026,7 @@ z.object({
 	patchId: z.string().regex(/^[0-9a-f]{40,64}$/u),
 	reviewCycle: z.number().int().positive().optional(),
 	reviewRequirement: z.object({
-		reason: z.enum(["no-applicable-mode"]),
+		reason: z.enum(["no-applicable-mode", "faithful-merge"]),
 		status: z.literal("not-required")
 	}).strict().optional(),
 	reviews: z.array(prReviewResultSchema$1),
@@ -5183,7 +5346,7 @@ const CLOSING_PRS_QUERY = `query($owner: String!, $repo: String!, $issue: Int!)
   repository(owner: $owner, name: $repo) {
     issue(number: $issue) {
       closedByPullRequestsReferences(first: 50, includeClosedPrs: true) {
-        nodes { number state baseRefName headRefName headRefOid mergeCommit { oid } }
+        nodes { number state baseRefName headRefName headRefOid mergedAt mergeCommit { oid } }
       }
     }
   }
@@ -5215,6 +5378,7 @@ const defaultBoundaryCheckGithub = () => ({
 			...node.headRefOid ? { headRefOid: node.headRefOid } : {},
 			...node.headRefName ? { headRefName: node.headRefName } : {},
 			...node.mergeCommit?.oid ? { mergeCommitOid: node.mergeCommit.oid } : {},
+			...node.mergedAt ? { mergedAt: node.mergedAt } : {},
 			number: node.number,
 			state: node.state
 		}));
@@ -5263,7 +5427,8 @@ function runBoundaryCheck(args, dependencies = {}) {
 	let record;
 	if (parsed.ok) {
 		const demandedRung = closeoutRungFor(parsed.manifest);
-		const computed = coveredSetProjection(buildBoundaryMembershipGraph(parsed.manifest, (issue) => github.fetchClosingPullRequests(repo, issue)));
+		const graph = buildBoundaryMembershipGraph(parsed.manifest, (issue) => github.fetchClosingPullRequests(repo, issue));
+		const computed = coveredSetProjection(graph);
 		const comments = github.fetchIssueComments(repo, args.epic);
 		const selected = selectBoundaryReviewProof(comments, parsed.manifest.boundary, parsed.manifest.declaredBy);
 		const { blockingReasons } = evaluateProofAgainstDemands({
@@ -5274,10 +5439,13 @@ function runBoundaryCheck(args, dependencies = {}) {
 			manifestHash: parsed.manifestHash,
 			selected
 		});
+		const uncoveredIssueReasons = graph.unlinkedIssues.flatMap((entry) => entry.closedWithoutMerge === void 0 ? [] : [`issue #${entry.issue} (wave ${entry.wave}) is uncovered: its only closing link(s) ${entry.closedWithoutMerge.map((pr) => `PR #${pr}`).join(", ")} closed without merging`]);
+		const finalUncoveredIssueReasons = args.final ? graph.unlinkedIssues.flatMap((entry) => entry.closedWithoutMerge === void 0 ? [`issue #${entry.issue} (wave ${entry.wave}) has no linked closing PR; --final requires every declared issue to be covered before closeout`] : []) : [];
 		blockingReasons.unshift(...boundaryTopologyReasons({
 			manifest: parsed.manifest,
 			pullRequests: computed.pullRequests
-		}));
+		}), ...uncoveredIssueReasons, ...finalUncoveredIssueReasons);
+		const specHashNotices = selected?.proof.specHash !== void 0 && selected.proof.specHash.value !== specHash ? [`boundary-review proof spec sha256 ${selected.proof.specHash.value} does not match current epic spec sha256 ${specHash}; use the specHash from the blocked boundary:check record instead of hashing shell-rendered output`] : [];
 		record = {
 			blockingReasons,
 			boundary: parsed.manifest.boundary,
@@ -5289,7 +5457,7 @@ function runBoundaryCheck(args, dependencies = {}) {
 				algo: "sha256",
 				value: parsed.manifestHash
 			},
-			notices: computed.notices,
+			notices: [...computed.notices, ...specHashNotices],
 			repo,
 			...selected ? { reviewProof: {
 				...selected.commentId === void 0 ? {} : { commentId: selected.commentId },
@@ -6038,7 +6206,7 @@ const renderReport = (record) => {
 	return `${lines.join("\n")}\n`;
 };
 function createBoundaryCheckCommand(output, action) {
-	return markCwdOptionDefault(new Command("boundary:check").description("Boundary readiness gate (T8): require a membership-fresh boundary-review proof at the declared closeout rung. Blocks closeout/enablement, never merge.").requiredOption("--epic <number>", "issue number carrying the factory-boundary manifest, which may be the work issue itself (#789)", positiveInteger$1("--epic")).option("--repo <owner/name>", "GitHub repository (default: resolved from --cwd)").option("--cwd <path>", "repository working directory", collectCwdOption).option("--output <path>", "write an additional proof copy to this path").option("--profile <path>", "path to the project profile JSON file").option("--json", "print the full proof record as JSON").action(withGateTiming({
+	return markCwdOptionDefault(new Command("boundary:check").description("Boundary readiness gate (T8): require a membership-fresh boundary-review proof at the declared closeout rung. Blocks closeout/enablement, never merge.").requiredOption("--epic <number>", "issue number carrying the factory-boundary manifest, which may be the work issue itself (#789)", positiveInteger$1("--epic")).option("--repo <owner/name>", "GitHub repository (default: resolved from --cwd)").option("--cwd <path>", "repository working directory", collectCwdOption).option("--output <path>", "write an additional proof copy to this path").option("--profile <path>", "path to the project profile JSON file").option("--json", "print the full proof record as JSON").option("--final", "closeout-final mode (#853): a declared issue with no closing PR blocks instead of only noticing. Run as the last check before factory:closeout.").action(withGateTiming({
 		gate: "boundary:check",
 		resolveLedgerRoot: (options) => resolveCwdOption(options.cwd),
 		stderr: output.stderr
@@ -6048,7 +6216,8 @@ function createBoundaryCheckCommand(output, action) {
 			epic: options.epic,
 			...options.repo ? { repo: options.repo } : {},
 			...options.output ? { output: options.output } : {},
-			...options.json ? { json: true } : {}
+			...options.json ? { json: true } : {},
+			...options.final ? { final: true } : {}
 		};
 		const record = action ? action(args) : runBoundaryCheck(args);
 		output.stdout.write(options.json ? `${JSON.stringify(record, null, 2)}\n` : renderReport(record));
@@ -7279,7 +7448,7 @@ const ReviewGateTracePayloadShape = z.object({
 	observedAt: isoTimestamp,
 	outcome: z.literal("not-required"),
 	patchId: z.string().regex(/^[0-9a-f]{40,64}$/u),
-	reason: z.enum(["no-applicable-mode"]),
+	reason: z.enum(["no-applicable-mode", "faithful-merge"]),
 	reviewCycle: positiveInteger
 }).strict();
 const ReviewGateTracePayloadSchema = ReviewGateTracePayloadShape;
@@ -8638,6 +8807,46 @@ function createCandidateIdentityResolver({ cwd, git }) {
 	};
 }
 //#endregion
+//#region src/catch-up-recognition.ts
+const refused = (reason) => ({
+	reasons: [reason],
+	recognized: false
+});
+const recognizeCatchUpCandidate = ({ base, cwd }) => {
+	try {
+		if (statusPorcelain(cwd) !== "") return refused("catch-up recognition refused: the worktree is dirty, so the committed head is not the candidate content.");
+		const parents = commitParents(cwd, "HEAD");
+		if (parents.length !== 2) return refused(`catch-up recognition refused: HEAD has ${parents.length} parent(s); a catch-up head is a merge commit with exactly two.`);
+		const [firstParent, secondParent] = parents;
+		const baseTipSha = runCapture("git", [
+			"rev-parse",
+			"--verify",
+			`${base}^{commit}`
+		], cwd).stdout.trim();
+		if (firstParent !== baseTipSha) return refused(`catch-up recognition refused: the head's first parent ${firstParent} is not the live target tip ${baseTipSha} (${base}); re-merge onto the current tip and re-run.`);
+		const upstreamRef = remoteDefaultBranchRef(cwd);
+		if (upstreamRef === void 0) return refused("catch-up recognition refused: origin/HEAD is unset, so the second parent's provenance cannot be proved; run `git remote set-head origin --auto` and re-run.");
+		if (!isAncestor(cwd, secondParent, upstreamRef)) return refused(`catch-up recognition refused: the head's second parent ${secondParent} is not an ancestor of ${upstreamRef}, so its content is not provably admitted.`);
+		const mergeTree = mergeTreeWriteTree(cwd, firstParent, secondParent);
+		if (mergeTree === void 0) return refused("catch-up recognition refused: `git merge-tree --write-tree` did not produce a tree (git older than 2.38, or unreadable parents).");
+		if (mergeTree.conflicted) return refused("catch-up recognition refused: merging the two parents conflicts, so the head carries manual resolutions; a conflicted catch-up is a full candidate.");
+		const headTreeSha = treeShaOf(cwd, "HEAD");
+		if (headTreeSha !== mergeTree.treeSha) return refused(`catch-up recognition refused: the head tree ${headTreeSha} differs from the faithful merge tree ${mergeTree.treeSha}, so the merge carries content beyond its two parents.`);
+		return {
+			recognition: {
+				baseRef: base,
+				baseTipSha,
+				mergedParentSha: secondParent,
+				mergedTreeSha: mergeTree.treeSha,
+				upstreamRef
+			},
+			recognized: true
+		};
+	} catch (error) {
+		return refused(`catch-up recognition refused: ${error instanceof Error ? error.message : String(error)}`);
+	}
+};
+//#endregion
 //#region src/evidence-freshness.ts
 const patchIdMatches = (recorded, candidate) => Boolean(recorded.patchId) && recorded.patchId === candidate.patchId;
 const headShaMatches = (recorded, candidate) => Boolean(recorded.headSha && candidate.headSha && sameHeadSha(candidate.headSha, recorded.headSha));
@@ -8927,6 +9136,14 @@ const evaluateRequiredChecks = ({ authoringSessionIds, candidate, envelopes, req
 			scopeReason: release.reason,
 			status: "out-of-scope"
 		};
+		if (scopeContext.catchUpRecognition && !boundFailureObserved) return {
+			checkType: check.checkType,
+			inScope: false,
+			name: check.name,
+			...check.scope ? { scope: check.scope } : {},
+			scopeReason: `catch-up recognition released: the head is a faithful merge of ${scopeContext.catchUpRecognition.baseTipSha} and admitted base-side content (#833)`,
+			status: "out-of-scope"
+		};
 		return {
 			...evaluateInScopeCheck({
 				authoringSessionIds,
@@ -9904,6 +10121,7 @@ var verification_proof_exports = /* @__PURE__ */ __exportAll({
 	prVerifyProofHeadShas: () => prVerifyProofHeadShas,
 	readPrVerifyProof: () => readPrVerifyProof,
 	resolveVerifyProofApplicability: () => resolveVerifyProofApplicability,
+	trustedCatchUpRecognition: () => trustedCatchUpRecognition,
 	trustedImpactStamp: () => trustedImpactStamp,
 	validatePrVerifyProof: () => validatePrVerifyProof,
 	verificationProofApplicabilityFor: () => verificationProofApplicabilityFor,
@@ -9973,6 +10191,24 @@ const trustedImpactStamp = ({ candidate, proof }) => {
 	});
 	return headBound && patchBound ? proof.impactStamp : void 0;
 };
+/**
+* #833: the recorded catch-up recognition, consumed ONLY when it is
+* identity-bound to the current candidate under exactly the rules
+* `trustedImpactStamp` applies — the proof passed, is v4+, and its recorded
+* headSha AND patchId both name this candidate. The recognition withdraws
+* review and preview demands, so it earns the same strict double binding and
+* the same fail-closed answer (`undefined`) on every other state.
+*/
+const trustedCatchUpRecognition = ({ candidate, proof }) => {
+	if (!proof || !verifyProofPassed(proof) || proof.schemaVersion < 4) return;
+	const headBound = sameHeadSha(candidate.headSha, proof.headSha);
+	const patchBound = evidenceFresh({
+		candidate: { patchId: candidate.patchId },
+		recorded: { patchId: proof.patchId },
+		rule: "patch-id"
+	});
+	return headBound && patchBound ? proof.catchUpRecognition : void 0;
+};
 const prVerifyFullHeadShasForDiff = ({ docsOnlyDeltaAcceptedSince, files, proof }) => {
 	if (!verifyProofPassed(proof)) return [];
 	if (proof.mode === "full") return sameFileList(proof.changedFiles, files) ? [proof.headSha] : [];
@@ -10254,6 +10490,7 @@ function defaultPrVerifyGit() {
 		currentHeadSha,
 		emptyTreeHash,
 		mergeBaseSha,
+		recognizeCatchUp: recognizeCatchUpCandidate,
 		runVerificationCommand(command, cwd, env) {
 			const result = runInheritedTee("bash", ["-lc", command], cwd, env);
 			const counts = parseVitestCounts(result.stdout);
@@ -10293,11 +10530,12 @@ function baselineFullProofsForDocsOnly({ previousProof, profilePath, projectKey,
 		seedFilter: matchesProfile
 	});
 }
-function buildPrVerifyProof({ authoringSession, base, baselineFullProofs, classification, commands, endedAt, executedCommands, files, headSha, impactStamp, mode, mergeBaseSha: proofMergeBaseSha, notRequiredCommands, outcome, patchId, profilePath, projectKey, repository, startedAt }) {
+function buildPrVerifyProof({ authoringSession, base, baselineFullProofs, catchUpRecognition, classification, commands, endedAt, executedCommands, files, headSha, impactStamp, mode, mergeBaseSha: proofMergeBaseSha, notRequiredCommands, outcome, patchId, profilePath, projectKey, repository, startedAt }) {
 	return {
 		authoringSession,
 		base,
 		...baselineFullProofs ? { baselineFullProofs } : {},
+		...catchUpRecognition ? { catchUpRecognition } : {},
 		changedFiles: files,
 		classification: classification.classification,
 		classificationReasons: classification.reasons,
@@ -10380,6 +10618,11 @@ function runPrVerify(args, dependencies = {}) {
 		cwd,
 		git
 	});
+	const catchUpRecognitionResult = (git.recognizeCatchUp ?? recognizeCatchUpCandidate)({
+		base: args.base,
+		cwd
+	});
+	const catchUpRecognition = catchUpRecognitionResult.recognized ? catchUpRecognitionResult.recognition : void 0;
 	const readLockfileAtRef = git.showFileAtRef ?? showFileAtRef;
 	let impactStamp;
 	try {
@@ -10425,6 +10668,7 @@ function runPrVerify(args, dependencies = {}) {
 	console.log(`classification: ${classification.classification}`);
 	for (const line of context.runSummaryLines()) console.log(line);
 	for (const line of impactStampSummaryLines(impactStamp)) console.log(line);
+	if (catchUpRecognition) console.log(`catch-up recognition (#833): faithful merge of ${catchUpRecognition.baseTipSha} (${catchUpRecognition.baseRef}) and ${catchUpRecognition.mergedParentSha} (admitted via ${catchUpRecognition.upstreamRef}); verification mode and battery scoping are unchanged.`);
 	const vetoedTargets = boundFailingCheckNames({
 		candidate: {
 			headSha,
@@ -10461,6 +10705,7 @@ function runPrVerify(args, dependencies = {}) {
 	const proofContext = {
 		authoringSession,
 		base: args.base,
+		...catchUpRecognition ? { catchUpRecognition } : {},
 		classification,
 		commands,
 		files,
@@ -10856,7 +11101,7 @@ const closingPullRequestsQuery = `query($owner: String!, $repo: String!, $issue:
   repository(owner: $owner, name: $repo) {
     issue(number: $issue) {
       closedByPullRequestsReferences(first: 50, includeClosedPrs: true) {
-        nodes { number }
+        nodes { number state }
       }
     }
   }
@@ -11818,7 +12063,7 @@ const prReviewProofSchema = z.object({
 	patchId: z.string().regex(/^[0-9a-f]{40,64}$/u),
 	reviewCycle: z.number().int().positive().optional(),
 	reviewRequirement: z.object({
-		reason: z.enum(["no-applicable-mode"]),
+		reason: z.enum(["no-applicable-mode", "faithful-merge"]),
 		status: z.literal("not-required")
 	}).strict().optional(),
 	reviews: z.array(prReviewResultSchema),
@@ -14006,6 +14251,21 @@ const addSecurityBlockingReasons = ({ blockers, securityRequired, securityStatus
 		reason: "Security review proof ran and explicitly failed (open blocking findings or errored run); resolve or disposition the findings and re-run pr:review."
 	});
 };
+/**
+* #833: the trusted catch-up recognition for this evaluation's candidate —
+* `trustedCatchUpRecognition` over the same passed verify proof the impact
+* stamp is read from, fail closed to `undefined` on every other state.
+*/
+const recognitionForCandidate = (input) => {
+	const { verificationProof } = input;
+	return trustedCatchUpRecognition({
+		candidate: {
+			headSha: input.headSha,
+			patchId: input.patchId
+		},
+		proof: verificationProof && "proof" in verificationProof ? verificationProof.proof : void 0
+	});
+};
 const requiredChecksEvaluation = (input) => {
 	const requiredChecks = input.externalRequiredChecks ?? [];
 	if (requiredChecks.length === 0) return {
@@ -14018,6 +14278,7 @@ const requiredChecksEvaluation = (input) => {
 		patchId: input.patchId
 	};
 	const { verificationProof } = input;
+	const catchUpRecognition = recognitionForCandidate(input);
 	const impactStamp = trustedImpactStamp({
 		candidate: {
 			headSha: input.headSha,
@@ -14031,6 +14292,7 @@ const requiredChecksEvaluation = (input) => {
 		envelopes: input.evidenceEnvelopes ?? [],
 		requiredChecks,
 		scopeContext: {
+			...catchUpRecognition ? { catchUpRecognition } : {},
 			classification: input.classification,
 			...impactStamp ? { impactStamp } : {}
 		}
@@ -14243,7 +14505,8 @@ const foldWaivers = ({ blockers, waivers }) => {
 	};
 };
 const evaluateReadiness = (input) => {
-	const reviewModes = input.reviewModes ?? ["correctness"];
+	const catchUpRecognition = recognitionForCandidate(input);
+	const reviewModes = catchUpRecognition ? [] : input.reviewModes ?? ["correctness"];
 	const epoch = reviewEpochModeFor(input.reviewProof ?? {}, input.ladderPolicy);
 	const verifyGate = verifyGateFor({ input });
 	const { correctnessProof, correctnessRequired, correctnessStatus, correctnessUntyped, gateCapMismatchBlockers, reviewCycleState, reviewTerminalState, reviewLadder, securityProof, securityRequired, securityStatus, securityUntyped } = resolveReviewRequiredness({
@@ -14281,6 +14544,7 @@ const evaluateReadiness = (input) => {
 		waivers: input.waivers ?? []
 	});
 	const notices = [
+		...catchUpRecognition ? [`Catch-up recognition (#833): the head is a faithful merge of target tip ${catchUpRecognition.baseTipSha} and admitted base-side content (${catchUpRecognition.upstreamRef}); review modes and impact-demanded envelopes are not demanded for this candidate.`] : [],
 		...input.mergeFreeze?.notices ?? [],
 		...waivedDemands.map(waivedDemandNotice),
 		...unusedWaiverNotices({
@@ -15774,6 +16038,7 @@ const defaultPrReviewGit = () => ({
 	changedFiles,
 	currentHeadSha,
 	isAncestor,
+	recognizeCatchUp: recognizeCatchUpCandidate,
 	stablePatchId: runStablePatchId,
 	statusPorcelain
 });
@@ -15908,11 +16173,7 @@ async function runPrReview(args, dependencies = {}) {
 	const startedAt = /* @__PURE__ */ new Date();
 	const findingsFile = args.findings ? parseReviewFindingsFile(args.findings, cwd) : void 0;
 	const kinds = enabledKinds(profile, args.mode, files, findingsFile?.reviews.map((review) => review.kind) ?? []);
-	if (kinds.length === 0) {
-		const reviewRequirement = {
-			reason: "no-applicable-mode",
-			status: "not-required"
-		};
+	const mintNotRequiredProof = (reviewRequirement) => {
 		const proof = emptyProof({
 			base: args.base,
 			cycle: args.cycle,
@@ -15940,8 +16201,21 @@ async function runPrReview(args, dependencies = {}) {
 			repoRoot: cwd
 		});
 		return proof;
+	};
+	if (kinds.length === 0) return mintNotRequiredProof({
+		reason: "no-applicable-mode",
+		status: "not-required"
+	});
+	if (!findingsFile) {
+		if ((git.recognizeCatchUp ?? recognizeCatchUpCandidate)({
+			base: args.base,
+			cwd
+		}).recognized) return mintNotRequiredProof({
+			reason: "faithful-merge",
+			status: "not-required"
+		});
+		throw new Error("--findings <path> is required when review kinds are enabled.");
 	}
-	if (!findingsFile) throw new Error("--findings <path> is required when review kinds are enabled.");
 	if (!evidenceFresh({
 		candidate: {
 			headSha,

package/dist/schemas.d.ts

@@ -268,7 +268,7 @@ interface PrReviewProof {
   cleanedPaths: string[];
   ladder?: PrReviewLadderState;
   reviewRequirement?: {
-    reason: "no-applicable-mode";
+    reason: "no-applicable-mode" | "faithful-merge";
     status: "not-required";
   };
   reviews: PrReviewResult[];
@@ -443,6 +443,23 @@ type ReadinessRepair = z.infer<typeof readinessRepairSchema>;
 type ReadinessStatus = "ready" | "blocked";
 type ManagedReadinessLedger = z.infer<typeof managedReadinessLedgerSchema>;
 //#endregion
+//#region src/catch-up-recognition-record.d.ts
+interface CatchUpRecognition {
+  /** The ref the candidate targets, as the recognizing command resolved it. */
+  baseRef: string;
+  /** The live target tip at recognition time; the head's first parent. */
+  baseTipSha: string;
+  /** The head's second parent: the admitted base-side content merged in. */
+  mergedParentSha: string;
+  /**
+   * The tree `git merge-tree --write-tree` produced for the two parents. It
+   * equals the head's own tree; that equality is the faithfulness proof.
+   */
+  mergedTreeSha: string;
+  /** The ref that proves the second parent is admitted content. */
+  upstreamRef: string;
+}
+//#endregion
 //#region src/pr-verify-proof-contract.d.ts
 declare const SUPPORTED_PR_VERIFY_SCHEMA_VERSIONS: readonly [1, 2, 3, 4];
 type PrVerifySchemaVersion = (typeof SUPPORTED_PR_VERIFY_SCHEMA_VERSIONS)[number];
@@ -509,6 +526,7 @@ interface PrVerifyProof {
     projectKey: string;
     repository: string;
   }[];
+  catchUpRecognition?: CatchUpRecognition;
   changedFiles: string[];
   classification: DiffClassification;
   classificationReasons: string[];
@@ -541,6 +559,7 @@ declare const prVerifyProofSchema: z.ZodObject<{
     projectKey: z.ZodString;
     repository: z.ZodString;
   }, z.core.$strip>>>;
+  catchUpRecognition: z.ZodOptional<z.ZodType<CatchUpRecognition, unknown, z.core.$ZodTypeInternals<CatchUpRecognition, unknown>>>;
   changedFiles: z.ZodArray<z.ZodString>;
   classification: z.ZodEnum<{
     "docs/process-only": "docs/process-only";
@@ -827,6 +846,7 @@ declare const prReviewProofSchema: z.ZodObject<{
   reviewRequirement: z.ZodOptional<z.ZodObject<{
     reason: z.ZodEnum<{
       "no-applicable-mode": "no-applicable-mode";
+      "faithful-merge": "faithful-merge";
     }>;
     status: z.ZodLiteral<"not-required">;
   }, z.core.$strict>>;

package/dist/schemas.js

@@ -228,6 +228,16 @@ const waivedDemandSchema = z.object({
 	session: z.string().trim().min(1).optional(),
 	unmetReasons: z.array(z.string().min(1)).min(1)
 });
+//#endregion
+//#region src/catch-up-recognition-record.ts
+const objectShaSchema = z.string().regex(/^[0-9a-f]{40}$/u);
+const catchUpRecognitionSchema = z.object({
+	baseRef: z.string().min(1),
+	baseTipSha: objectShaSchema,
+	mergedParentSha: objectShaSchema,
+	mergedTreeSha: objectShaSchema,
+	upstreamRef: z.string().min(1)
+}).strict();
 const impactStampTargetSchema = z.object({
 	basis: z.string().min(1),
 	impact: z.enum(["affected", "not-affected"]),
@@ -515,6 +525,11 @@ const assertPrVerifyProofRules = (proof, context) => {
 		message: "notRequiredCommands is a schemaVersion>=4 field; a v1–v3 pr:verify proof must not carry it.",
 		path: ["notRequiredCommands"]
 	});
+	if (proof.schemaVersion < 4 && proof.catchUpRecognition !== void 0) context.addIssue({
+		code: "custom",
+		message: "catchUpRecognition is a schemaVersion>=4 field; a v1–v3 pr:verify proof must not carry it.",
+		path: ["catchUpRecognition"]
+	});
 	if (proof.schemaVersion < 4 && proof.notDemandedRecords !== void 0) context.addIssue({
 		code: "custom",
 		message: "notDemandedRecords is a schemaVersion>=4 field; a v1–v3 pr:verify proof must not carry it.",
@@ -573,6 +588,7 @@ const prVerifyProofSchema = z.object({
 		projectKey: z.string().min(1),
 		repository: z.string().min(1)
 	})).optional(),
+	catchUpRecognition: catchUpRecognitionSchema.optional(),
 	changedFiles: z.array(z.string()),
 	classification: z.enum([
 		"docs/process-only",
@@ -888,7 +904,7 @@ const prReviewProofSchema = z.object({
 	patchId: z.string().regex(/^[0-9a-f]{40,64}$/u),
 	reviewCycle: z.number().int().positive().optional(),
 	reviewRequirement: z.object({
-		reason: z.enum(["no-applicable-mode"]),
+		reason: z.enum(["no-applicable-mode", "faithful-merge"]),
 		status: z.literal("not-required")
 	}).strict().optional(),
 	reviews: z.array(prReviewResultSchema),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@patronage/software-factory",
-  "version": "1.0.0-alpha.20",
+  "version": "1.0.0-alpha.22",
   "description": "Shared Patronage software factory CLI and project-profile validation tools",
   "license": "MIT",
   "repository": {
@@ -37,7 +37,7 @@
     "picomatch": "^4.0.5",
     "yaml": "^2.9.0",
     "zod": "4.4.3",
-    "@patronage/factory-ci": "1.0.0-alpha.20"
+    "@patronage/factory-ci": "1.0.0-alpha.22"
   },
   "devDependencies": {
     "@types/node": "24.13.3",
@@ -46,14 +46,13 @@
     "dependency-cruiser": "18.1.0",
     "knip": "6.27.0",
     "oxfmt": "0.59.0",
-    "oxlint": "1.74.0",
+    "oxlint": "1.76.0",
     "oxlint-tsgolint": "7.0.2001",
     "tsdown": "0.21.10",
     "tsx": "4.23.1",
     "typescript": "5.9.3",
-    "ultracite": "7.9.4",
-    "vitest": "4.1.10",
-    "vitest-evals": "0.14.0"
+    "ultracite": "7.10.5",
+    "vitest": "4.1.10"
   },
   "engines": {
     "node": "^24.0.0"
@@ -70,10 +69,6 @@
     "precoverage": "bash ../scripts/ensure-worktree-bootstrap.sh",
     "coverage": "vitest run --coverage",
     "docs:reference": "tsx scripts/update-command-reference.ts",
-    "eval:review": "tsx evals/review-prompts/track-b/reviewRunner.ts",
-    "eval:review:report": "tsx evals/review-prompts/track-b/reviewReport.ts",
-    "eval:review:rescore": "tsx evals/review-prompts/track-b/rescore.ts",
-    "eval:review:run": "vitest run --config evals/review-prompts/vitest.eval.config.ts",
     "pack:smoke": "bash scripts/pack-smoke.sh",
     "profile:schema": "tsx scripts/generate-profile-schema.ts",
     "pretest": "bash ../scripts/ensure-worktree-bootstrap.sh",