@patronage/software-factory 1.0.0-alpha.22 → 1.0.0-alpha.24

package/dist/index.d.ts

@@ -17,8 +17,8 @@ declare const boundaryManifestBaseSchema: z.ZodObject<{
   boundary: z.ZodString;
   closeout: z.ZodOptional<z.ZodObject<{
     review: z.ZodEnum<{
-      oracle: "oracle";
       "independent-model": "independent-model";
+      oracle: "oracle";
       human: "human";
     }>;
   }, z.core.$loose>>;
@@ -26,8 +26,8 @@ declare const boundaryManifestBaseSchema: z.ZodObject<{
   integrationBranch: z.ZodOptional<z.ZodString>;
   schemaVersion: z.ZodLiteral<1>;
   topology: z.ZodEnum<{
-    flagged: "flagged";
     "each-to-main": "each-to-main";
+    flagged: "flagged";
     stacked: "stacked";
     "each-to-epic": "each-to-epic";
   }>;
@@ -36,8 +36,8 @@ declare const boundaryManifestBaseSchema: z.ZodObject<{
     issues: z.ZodArray<z.ZodNumber>;
     name: z.ZodString;
     review: z.ZodEnum<{
-      oracle: "oracle";
       "independent-model": "independent-model";
+      oracle: "oracle";
       human: "human";
     }>;
   }, z.core.$loose>>;
@@ -46,8 +46,8 @@ declare const boundaryManifestSchema: z.ZodObject<{
   boundary: z.ZodString;
   closeout: z.ZodOptional<z.ZodObject<{
     review: z.ZodEnum<{
-      oracle: "oracle";
       "independent-model": "independent-model";
+      oracle: "oracle";
       human: "human";
     }>;
   }, z.core.$loose>>;
@@ -55,8 +55,8 @@ declare const boundaryManifestSchema: z.ZodObject<{
   integrationBranch: z.ZodOptional<z.ZodString>;
   schemaVersion: z.ZodLiteral<1>;
   topology: z.ZodEnum<{
-    flagged: "flagged";
     "each-to-main": "each-to-main";
+    flagged: "flagged";
     stacked: "stacked";
     "each-to-epic": "each-to-epic";
   }>;
@@ -65,8 +65,8 @@ declare const boundaryManifestSchema: z.ZodObject<{
     issues: z.ZodArray<z.ZodNumber>;
     name: z.ZodString;
     review: z.ZodEnum<{
-      oracle: "oracle";
       "independent-model": "independent-model";
+      oracle: "oracle";
       human: "human";
     }>;
   }, z.core.$loose>>;
@@ -151,8 +151,8 @@ declare const boundaryReviewProofBaseSchema: z.ZodObject<{
   }>;
   producer: z.ZodString;
   rung: z.ZodEnum<{
-    oracle: "oracle";
     "independent-model": "independent-model";
+    oracle: "oracle";
     human: "human";
   }>;
   schemaVersion: z.ZodLiteral<1>;
@@ -195,8 +195,8 @@ declare const boundaryReviewProofSchema: z.ZodObject<{
   }>;
   producer: z.ZodString;
   rung: z.ZodEnum<{
-    oracle: "oracle";
     "independent-model": "independent-model";
+    oracle: "oracle";
     human: "human";
   }>;
   schemaVersion: z.ZodLiteral<1>;
@@ -472,165 +472,529 @@ declare function sweepHqSpoolOrphans(input: {
   env?: NodeJS.ProcessEnv;
 }): Promise<HqSpoolOrphanSweep>;
 //#endregion
-//#region src/demand-waiver.d.ts
-declare const DEFAULT_DEMAND_WAIVER_PATH = ".factory-memory/demand-waivers.json";
-/** One recorded operator act: this demand, on this candidate, waived. */
-interface DemandWaiver {
-  candidate: {
-    headSha: string;
-    pr: number;
+//#region src/packages/review-prompt-sections/schema.d.ts
+declare const reviewPromptSectionSchema: z.ZodObject<{
+  provenance: z.ZodEnum<{
+    "coding-standards": "coding-standards";
+    "prior-review-ledger": "prior-review-ledger";
+    "issue-review-focus": "issue-review-focus";
+  }>;
+  source: z.ZodString;
+  text: z.ZodString;
+}, z.core.$strict>;
+type ReviewPromptSection = z.infer<typeof reviewPromptSectionSchema>;
+type ReviewPromptSectionProvenance = ReviewPromptSection["provenance"];
+declare const reviewPromptSectionsSchema: z.ZodArray<z.ZodObject<{
+  provenance: z.ZodEnum<{
+    "coding-standards": "coding-standards";
+    "prior-review-ledger": "prior-review-ledger";
+    "issue-review-focus": "issue-review-focus";
+  }>;
+  source: z.ZodString;
+  text: z.ZodString;
+}, z.core.$strict>>;
+//#endregion
+//#region src/review-ladder-policy.d.ts
+type ReviewFindingSeverity = "critical" | "high" | "medium" | "low" | "unknown";
+type ReviewFindingCategory = "correctness" | "safety" | "coordination" | "maintainability" | "unknown";
+declare const REVIEW_SEVERITIES: readonly ["critical", "high", "medium", "low", "unknown"];
+declare const resolveReviewFindingSeverity: (priority?: string) => ReviewFindingSeverity;
+declare const resolveReviewFindingCategory: (category?: string) => ReviewFindingCategory;
+declare const FINDING_DISPOSITIONS: readonly ["open", "fixed-in-thread", "follow-up-filed", "waived", "stale-repeat", "rerun-noise"];
+type FindingDisposition = (typeof FINDING_DISPOSITIONS)[number];
+interface ReviewFindingAttributes {
+  blockingAfterCap?: boolean;
+  category?: string;
+  citedSpan?: string;
+  file?: string;
+  prescribedAction?: string;
+  priority?: string;
+  supersedes?: {
+    file?: string;
+    title: string;
   };
-  demand: string;
-  /** The authenticated GitHub account that recorded the waiver. */
-  operator: string;
-  rationale: string;
-  recordedAt: string;
-  /** Optional audit metadata; never waiver authority. */
-  session?: string;
+  title: string;
 }
-interface DemandWaiverStore {
-  command: "patronage-factory demand:waive";
-  schemaVersion: 1;
-  waivers: DemandWaiver[];
+type BlockingResolvableFinding = Pick<ReviewFindingAttributes, "blockingAfterCap" | "category" | "priority">;
+declare const resolveFindingBlocking: (finding: BlockingResolvableFinding, disposition?: FindingDisposition) => boolean;
+interface ReviewLadderPolicy {
+  gate: {
+    cap: number;
+  };
+  interior: {
+    cap: number;
+  };
 }
-declare const validateDemandWaiverStore: (value: unknown) => DemandWaiverStore;
-/**
- * A demand that was in force, was NOT met, and was waived by the operator.
- *
- * `unmetReasons` is required and non-empty: every reason the demand refused is
- * carried through verbatim. There is no field on this record that could say
- * "satisfied", and no code path constructs one without a refusal to carry.
- */
-interface WaivedDemand {
-  demand: string;
-  operator: string;
-  rationale: string;
-  recordedAt: string;
-  session?: string;
-  /** The demand's refusals at evaluation time, preserved verbatim. */
-  unmetReasons: string[];
+declare const resolveReviewLadderPolicy: () => ReviewLadderPolicy;
+//#endregion
+//#region src/review-ladder-ledger.d.ts
+type LadderCycleStage = "interior" | "gate";
+interface LadderCycleRef {
+  cycle: number;
+  stage: LadderCycleStage;
 }
-declare const waivedDemandSchema: z.ZodType<WaivedDemand>;
-/** The waivers that bind one candidate: same PR, same head. */
-declare const selectWaiversForCandidate: ({
-  headSha,
-  pr,
-  waivers
-}: {
-  headSha: string | undefined;
-  pr: number;
-  waivers: readonly DemandWaiver[];
-}) => DemandWaiver[];
-interface DemandOutcome {
-  blockingReasons: string[];
-  waived?: WaivedDemand;
+type LadderFindingReport = ReviewFindingAttributes;
+type DeclarableFindingDisposition = Exclude<FindingDisposition, "open" | "stale-repeat" | "rerun-noise">;
+interface LadderDispositionDeclaration {
+  disposition: DeclarableFindingDisposition;
+  finding: {
+    file?: string;
+    title: string;
+  };
+  findingReport?: LadderFindingReport;
+  reference?: string;
 }
-/**
- * Fold one resolved demand's refusals through the operator's waivers.
- *
- * A satisfied demand (no refusals) stays satisfied and the waiver stays inert
- * — a waiver can only ever move a demand from *unmet-and-blocking* to
- * *unmet-and-waived*, never to met.
- */
-declare const applyDemandWaiver: ({
-  demand,
-  reasons,
-  waivers
-}: {
-  demand: string;
-  reasons: readonly string[];
-  waivers: readonly DemandWaiver[];
-}) => DemandOutcome;
-/** How a waived demand reads to a human. Never the word "satisfied". */
-declare const waivedDemandNotice: (waived: WaivedDemand) => string;
-interface DemandWaiverAuthorization {
-  operator: string;
-  session?: string;
+interface FindingLedgerEntry extends ReviewFindingAttributes {
+  disposition: FindingDisposition;
+  firstFlagged: LadderCycleRef;
+  flagCount: number;
+  key: string;
+  lastFlagged: LadderCycleRef;
+  priorDisposition?: FindingDisposition;
+  reference?: string;
+  reopenedCount: number;
+  staleRepeatCount: number;
 }
-type AuthorizeDemandWaiverResult = {
-  authorization: DemandWaiverAuthorization;
-  refusals?: undefined;
-} | {
-  authorization?: undefined;
-  refusals: string[];
-};
-/**
- * Operator identity, `declaredBy`-style: a named human account, recorded on
- * the waiver and enforced here. Session is optional audit metadata only: it is
- * not credential-backed, so its absence or equality never authorizes or
- * refuses an operator act.
- */
-declare const authorizeDemandWaiver: ({
-  authenticatedLogin,
-  session
-}: {
-  authenticatedLogin: string | undefined;
-  session: string | undefined;
-}) => AuthorizeDemandWaiverResult;
-//#endregion
-//#region src/blocked-reasons.d.ts
-declare const blockedReasonSchema: z.ZodObject<{
-  code: z.ZodString;
-  detail: z.ZodString;
-}, z.core.$strip>;
-type BlockedReason = z.infer<typeof blockedReasonSchema>;
+declare const findingKey: (finding: {
+  citedSpan?: string;
+  file?: string;
+  prescribedAction?: string;
+  title?: string;
+}) => string;
+declare const openLadderFindings: (ledger: FindingLedgerEntry[]) => FindingLedgerEntry[];
+declare const blockingLadderFindings: (ledger: FindingLedgerEntry[]) => FindingLedgerEntry[];
+declare const staleRepeatLadderFindings: (ledger: FindingLedgerEntry[]) => FindingLedgerEntry[];
+declare const inferFixedInThreadDispositions: (ledger: FindingLedgerEntry[], findings: readonly LadderFindingReport[], options?: {
+  sameHeadAsPriorCycle?: boolean;
+}) => LadderDispositionDeclaration[];
 //#endregion
-//#region src/arm-auto-merge.d.ts
-interface ArmAutoMergeInput {
-  cwd: string;
-  /** The validated PR head this arming is a compare-and-set against. */
-  headSha: string;
-  owner: string;
-  pr: number;
-  repo: string;
+//#region src/review-ladder.d.ts
+type ReviewLadderExecutedStage = "interior" | "gate";
+interface LadderSessionAttribution {
+  orchestrationMode?: "autonomous" | "manual";
+  resumedSession?: boolean;
+  runtime?: string;
+  sessionId?: string;
 }
-/**
- * What the PR actually did, read back after the call — never inferred from the
- * exit code. `not-armed` is a failure: the candidate is admitted but nothing
- * will merge it, so it carries the detail and `pr:ready` emits a re-dispatch.
- */
-interface ArmAutoMergeOutcome {
-  /** Why the arming did not take effect, or what the invocation reported. */
-  detail?: string;
-  headSha: string;
-  outcome: "armed" | "merged" | "not-armed";
+interface LadderUsageReport {
+  estimatedCostUsd?: number;
+  source?: string;
+  totalTokens?: number;
 }
-//#endregion
-//#region src/checkout-repository.d.ts
-interface CheckoutRepository {
-  name: string;
-  owner: string;
+interface ReviewLadderCycle {
+  dispositions?: LadderDispositionDeclaration[];
+  engine?: string;
+  findings: LadderFindingReport[];
+  identity?: {
+    headSha: string;
+    patchId: string;
+  };
+  model?: string;
+  correlatedRerun?: boolean;
+  session?: LadderSessionAttribution;
+  stage: LadderCycleStage;
+  usage?: LadderUsageReport;
 }
-//#endregion
-//#region src/follow-up.d.ts
-interface FactoryCliInvocation {
-  /** Runtime arguments ending with the factory CLI entry module. */
-  argvPrefix: string[];
-  executable: string;
+interface LadderInteriorCapTransition {
+  cap: number;
+  kind: "interior-cap-reached";
 }
-declare const FactoryCliInvocationSchema: z.ZodType<FactoryCliInvocation>;
-interface FollowUpAction {
-  /**
-   * Machine-safe argv-style array for the obvious next action, e.g.
-   * ["gh","pr","merge","513","--squash"]. Same shape and field name that
-   * `factory:delegate --print` emits, so an orchestrating agent can spawn the
-   * next command without reconstructing a shell string. argv[0] is the
-   * executable; the rest are literal, already-split arguments.
-   */
-  argv: string[];
-  /**
-   * Human-readable rendering of {@link argv} for logs and operators. Additive
-   * to argv, never a substitute for it — argv is the source of truth.
-   */
-  command: string;
+interface LadderGateCapTransition {
+  blockingFindings: string[];
+  cap: number;
+  kind: "gate-cap-exhausted";
+}
+type LadderForcedTransition = LadderGateCapTransition | LadderInteriorCapTransition;
+interface LadderRunInteriorCycleAction {
+  cycle: number;
+  kind: "run-interior-cycle";
+}
+type LadderGateNextAction = {
+  cycle: number;
+  kind: "run-gate-cycle";
+} | {
+  kind: "accept-nonblocking-findings";
+} | {
+  kind: "escalate-to-triage";
+} | {
+  kind: "ready-for-human";
+};
+type LadderPosition = {
+  forcedTransition?: LadderGateCapTransition;
+  nextAction: LadderGateNextAction;
+  stage: "gate";
+} | {
+  forcedTransition?: LadderInteriorCapTransition;
+  nextAction: {
+    kind: "advance-to-gate";
+  };
+  stage: "interior-complete";
+} | {
+  forcedTransition?: never;
+  nextAction: LadderRunInteriorCycleAction;
+  stage: "interior";
+};
+type LadderNextAction = LadderPosition["nextAction"];
+type ReviewLadderStage = LadderPosition["stage"];
+interface ReviewLadderStageEvent {
+  cycle: number;
+  cyclesToClean?: number;
+  engine?: string;
+  findingsSummary: {
+    blocking: number;
+    bySeverity: Record<ReviewFindingSeverity, number>;
+    flagged: number;
+    open: number;
+    staleRepeats: number;
+  };
+  forcedTransition?: LadderForcedTransition["kind"];
+  model?: string;
+  payloadVersion: 1;
+  session?: LadderSessionAttribution;
+  stage: ReviewLadderExecutedStage;
+  type: "review-ladder-stage";
+  usage?: LadderUsageReport;
+}
+interface LadderDiagnostic {
+  code: "interior-cycles-unrecorded";
+  message: string;
+}
+type ReviewLadderEvaluation = LadderPosition & {
+  cycleCounts: {
+    gate: number;
+    interior: number;
+  };
+  diagnostics: LadderDiagnostic[];
+  event?: ReviewLadderStageEvent;
+  ledger: FindingLedgerEntry[];
+  unmatchedDispositions: LadderDispositionDeclaration[];
+};
+interface EvaluateReviewLadderInput {
+  cycles: ReviewLadderCycle[];
+  policy: ReviewLadderPolicy;
+}
+declare const evaluateReviewLadder: ({
+  cycles,
+  policy
+}: EvaluateReviewLadderInput) => ReviewLadderEvaluation;
+//#endregion
+//#region src/pr-readiness/ladder-proof-state.d.ts
+interface PrReviewLadderState {
+  cycles: ReviewLadderCycle[];
+}
+interface OpenCycleState {
+  autoBlockingFindings: number;
+  blockingEntries: ReviewFindingAttributes[];
+  openEntries: ReviewFindingAttributes[];
+  staleRepeatFindings?: number;
+}
+interface ReviewLadderSummaryState {
+  cycleCounts: {
+    gate: number;
+    interior: number;
+  };
+  forcedTransition?: LadderForcedTransition["kind"];
+  nextAction: LadderNextAction["kind"];
+  stage: ReviewLadderStage;
+}
+interface ReviewLadderSnapshot {
+  cycleState: OpenCycleState;
+  evaluation: ReviewLadderEvaluation;
+  ledger: FindingLedgerEntry[];
+  policyGateCap: number;
+  summary: ReviewLadderSummaryState;
+}
+type ReviewEpochMode = {
+  kind: "ladder";
+  ladder: PrReviewLadderState;
+  snapshot?: ReviewLadderSnapshot;
+} | {
+  kind: "declared-window";
+};
+//#endregion
+//#region src/pr-readiness/review-proof-types.d.ts
+type PrReviewKind = "correctness" | "security";
+type PrReviewMode = PrReviewKind | "all";
+type PrReviewOutcome = "passed" | "failed" | "error";
+interface PrReviewStageResolution {
+  model: string;
+  sessionId: string;
+}
+//#endregion
+//#region src/pr-readiness/review-proof-shape.d.ts
+interface PrReviewFinding extends ReviewFindingAttributes {
+  body: string;
+  category?: ReviewFindingCategory;
+  line?: number;
+  protocolFinding?: true;
+}
+interface PrReviewResult {
+  kind: PrReviewKind;
+  startedAt: string;
+  endedAt: string;
+  durationMs: number;
+  model?: string;
+  producer?: string;
+  rung?: EvidenceReviewRung;
+  sessionId?: string;
+  outcome: PrReviewOutcome;
+  issuesFlagged: number;
+  summary: string;
+  findings: PrReviewFinding[];
+  typedVerdict?: boolean;
+  verdictSource?: "footer" | "recovered";
+  promptSections?: ReviewPromptSection[];
+}
+interface PrReviewProof {
+  schemaVersion: 2;
+  findingProvenanceVersion: 1;
+  base: string;
+  headSha: string;
+  patchId: string;
+  reviewCycle?: number;
+  maxReviewCycles?: number;
+  changedFiles: string[];
+  cleanedPaths: string[];
+  ladder?: PrReviewLadderState;
+  reviewRequirement?: {
+    reason: "no-applicable-mode" | "faithful-merge";
+    status: "not-required";
+  };
+  reviews: PrReviewResult[];
+}
+//#endregion
+//#region src/demand-waiver.d.ts
+declare const DEFAULT_DEMAND_WAIVER_PATH = ".factory-memory/demand-waivers.json";
+/** One recorded operator act: this demand, on this candidate, waived. */
+interface DemandWaiver {
+  candidate: {
+    headSha: string;
+    pr: number;
+  };
+  demand: string;
+  /** The authenticated GitHub account that recorded the waiver. */
+  operator: string;
+  rationale: string;
+  recordedAt: string;
+  /** Optional audit metadata; never waiver authority. */
+  session?: string;
+}
+interface DemandWaiverStore {
+  command: "patronage-factory demand:waive";
+  schemaVersion: 1;
+  waivers: DemandWaiver[];
+}
+declare const validateDemandWaiverStore: (value: unknown) => DemandWaiverStore;
+/**
+ * A demand that was in force, was NOT met, and was waived by the operator.
+ *
+ * `unmetReasons` is required and non-empty: every reason the demand refused is
+ * carried through verbatim. There is no field on this record that could say
+ * "satisfied", and no code path constructs one without a refusal to carry.
+ */
+interface WaivedDemand {
+  demand: string;
+  operator: string;
+  rationale: string;
+  recordedAt: string;
+  session?: string;
+  /** The demand's refusals at evaluation time, preserved verbatim. */
+  unmetReasons: string[];
+}
+declare const waivedDemandSchema: z.ZodType<WaivedDemand>;
+/** The waivers that bind one candidate: same PR, same head. */
+declare const selectWaiversForCandidate: ({
+  headSha,
+  pr,
+  waivers
+}: {
+  headSha: string | undefined;
+  pr: number;
+  waivers: readonly DemandWaiver[];
+}) => DemandWaiver[];
+interface DemandOutcome {
+  blockingReasons: string[];
+  waived?: WaivedDemand;
+}
+/**
+ * Fold one resolved demand's refusals through the operator's waivers.
+ *
+ * A satisfied demand (no refusals) stays satisfied and the waiver stays inert
+ * — a waiver can only ever move a demand from *unmet-and-blocking* to
+ * *unmet-and-waived*, never to met.
+ */
+declare const applyDemandWaiver: ({
+  demand,
+  reasons,
+  waivers
+}: {
+  demand: string;
+  reasons: readonly string[];
+  waivers: readonly DemandWaiver[];
+}) => DemandOutcome;
+/** How a waived demand reads to a human. Never the word "satisfied". */
+declare const waivedDemandNotice: (waived: WaivedDemand) => string;
+interface DemandWaiverAuthorization {
+  operator: string;
+  session?: string;
+}
+type AuthorizeDemandWaiverResult = {
+  authorization: DemandWaiverAuthorization;
+  refusals?: undefined;
+} | {
+  authorization?: undefined;
+  refusals: string[];
+};
+/**
+ * Operator identity, `declaredBy`-style: a named human account, recorded on
+ * the waiver and enforced here. Session is optional audit metadata only: it is
+ * not credential-backed, so its absence or equality never authorizes or
+ * refuses an operator act.
+ */
+declare const authorizeDemandWaiver: ({
+  authenticatedLogin,
+  session
+}: {
+  authenticatedLogin: string | undefined;
+  session: string | undefined;
+}) => AuthorizeDemandWaiverResult;
+//#endregion
+//#region src/blocked-reasons.d.ts
+declare const blockedReasonSchema: z.ZodObject<{
+  code: z.ZodString;
+  detail: z.ZodString;
+}, z.core.$strip>;
+type BlockedReason = z.infer<typeof blockedReasonSchema>;
+//#endregion
+//#region src/arm-auto-merge.d.ts
+interface ArmAutoMergeInput {
+  cwd: string;
+  /** The validated PR head this arming is a compare-and-set against. */
+  headSha: string;
+  owner: string;
+  pr: number;
+  repo: string;
 }
 /**
- * Build a {@link FollowUpAction} from a literal argv array. The `command`
- * string is derived from argv so the two never drift.
+ * What the PR actually did, read back after the call — never inferred from the
+ * exit code. `not-armed` is a failure: the candidate is admitted but nothing
+ * will merge it, so it carries the detail and `pr:ready` emits a re-dispatch.
  */
-declare const followUpFromArgv: (argv: string[]) => FollowUpAction;
-/** Canonical zod schema for the optional follow-up field on JSON outputs. */
-declare const FollowUpActionSchema: z.ZodType<FollowUpAction>;
+interface ArmAutoMergeOutcome {
+  /** Why the arming did not take effect, or what the invocation reported. */
+  detail?: string;
+  headSha: string;
+  outcome: "armed" | "merged" | "not-armed";
+}
+//#endregion
+//#region src/checkout-repository.d.ts
+interface CheckoutRepository {
+  name: string;
+  owner: string;
+}
+//#endregion
+//#region src/policy-resolution.d.ts
+/** How a gate resolved the review policy it evaluated a candidate under. */
+declare const policyResolutionSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+  basePolicyDigest: z.ZodString;
+  baseRefName: z.ZodString;
+  candidatePolicyDigest: z.ZodString;
+  effectiveDigest: z.ZodString;
+  policyBaseSha: z.ZodString;
+  reviewPolicyChanged: z.ZodBoolean;
+  status: z.ZodLiteral<"authoritative">;
+}, z.core.$strict>, z.ZodObject<{
+  baseRefName: z.ZodString;
+  reason: z.ZodString;
+  status: z.ZodLiteral<"unresolved">;
+}, z.core.$strict>], "status">;
+type PolicyResolution = z.infer<typeof policyResolutionSchema>;
+//#endregion
+//#region src/profile.d.ts
+declare const DEFAULT_FACTORY_REPOSITORY = "unknown/unknown";
+/** The one profile shape this build accepts (ADR 0023, #318, #351, #742). */
+declare const PROFILE_SCHEMA_VERSION = 6;
+declare const factoryProjectProfileSchema: z.ZodObject<{
+  $schema: z.ZodOptional<z.ZodString>;
+  extensions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+  hq: z.ZodOptional<z.ZodObject<{
+    enabled: z.ZodBoolean;
+    endpoint: z.ZodIntersection<z.ZodString, z.ZodString>;
+  }, z.core.$strict>>;
+  impact: z.ZodOptional<z.ZodObject<{
+    inert: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    targets: z.ZodArray<z.ZodObject<{
+      importers: z.ZodArray<z.ZodString>;
+      name: z.ZodString;
+      paths: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>>;
+  }, z.core.$strict>>;
+  lifecycleContract: z.ZodOptional<z.ZodObject<{
+    command: z.ZodString;
+    jobName: z.ZodOptional<z.ZodString>;
+  }, z.core.$strict>>;
+  repository: z.ZodObject<{
+    name: z.ZodString;
+    owner: z.ZodString;
+  }, z.core.$strict>;
+  requiredChecks: z.ZodOptional<z.ZodArray<z.ZodObject<{
+    name: z.ZodString;
+    scope: z.ZodOptional<z.ZodObject<{
+      classifications: z.ZodArray<z.ZodEnum<{
+        "docs/process-only": "docs/process-only";
+        "non-trivial": "non-trivial";
+      }>>;
+    }, z.core.$strict>>;
+  }, z.core.$strict>>>;
+  review: z.ZodOptional<z.ZodObject<{
+    conditional: z.ZodArray<z.ZodObject<{
+      paths: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>>;
+  }, z.core.$strict>>;
+  schemaVersion: z.ZodLiteral<6>;
+  verification: z.ZodObject<{
+    commands: z.ZodArray<z.ZodObject<{
+      command: z.ZodString;
+      description: z.ZodString;
+      impactTarget: z.ZodOptional<z.ZodString>;
+      name: z.ZodString;
+      requiredCheck: z.ZodOptional<z.ZodString>;
+      scope: z.ZodDefault<z.ZodEnum<{
+        trivial: "trivial";
+        "docs-only": "docs-only";
+        full: "full";
+      }>>;
+    }, z.core.$strip>>;
+  }, z.core.$strip>;
+}, z.core.$strict>;
+type FactoryProjectProfile = z.infer<typeof factoryProjectProfileSchema>;
+declare const resolveFactoryRepository: (profile?: Pick<FactoryProjectProfile, "repository"> | undefined) => string;
+interface LoadProjectProfileInput {
+  cwd?: string;
+  profilePath?: string;
+}
+interface LoadProjectProfileResult {
+  path: string;
+  profile: FactoryProjectProfile;
+}
+declare function loadProjectProfile(input?: LoadProjectProfileInput): LoadProjectProfileResult;
+//#endregion
+//#region src/catch-up-recognition-record.d.ts
+interface CatchUpRecognition {
+  /** The ref the candidate targets, as the recognizing command resolved it. */
+  baseRef: string;
+  /** The live target tip at recognition time; the head's first parent. */
+  baseTipSha: string;
+  /** The head's second parent: the admitted base-side content merged in. */
+  mergedParentSha: string;
+  /**
+   * The tree `git merge-tree --write-tree` produced for the two parents. It
+   * equals the head's own tree; that equality is the faithfulness proof.
+   */
+  mergedTreeSha: string;
+  /** The ref that proves the second parent is admitted content. */
+  upstreamRef: string;
+}
 //#endregion
 //#region src/diff-classification.d.ts
 declare const DIFF_CLASSIFICATIONS: readonly ["docs/process-only", "trivial", "non-trivial"];
@@ -650,7 +1014,7 @@ declare const impactStampSchema: z.ZodObject<{
   }>;
   inertPaths: z.ZodDefault<z.ZodArray<z.ZodString>>;
   reasons: z.ZodArray<z.ZodString>;
-  stampVersion: z.ZodLiteral<3>;
+  stampVersion: z.ZodLiteral<4>;
   targets: z.ZodArray<z.ZodObject<{
     basis: z.ZodString;
     impact: z.ZodEnum<{
@@ -658,6 +1022,7 @@ declare const impactStampSchema: z.ZodObject<{
       "not-affected": "not-affected";
     }>;
     name: z.ZodString;
+    subscribedPaths: z.ZodArray<z.ZodString>;
   }, z.core.$strip>>;
   unsubscribedPaths: z.ZodArray<z.ZodString>;
 }, z.core.$strip>;
@@ -708,74 +1073,89 @@ declare const impactStampScopeDecision: ({
   targetName: string;
 }) => ImpactScopeDecision;
 //#endregion
-//#region src/profile.d.ts
-declare const DEFAULT_FACTORY_REPOSITORY = "unknown/unknown";
-/** The one profile shape this build accepts (ADR 0023, #318, #351, #742). */
-declare const PROFILE_SCHEMA_VERSION = 6;
-declare const factoryProjectProfileSchema: z.ZodObject<{
-  $schema: z.ZodOptional<z.ZodString>;
-  extensions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-  hq: z.ZodOptional<z.ZodObject<{
-    enabled: z.ZodBoolean;
-    endpoint: z.ZodIntersection<z.ZodString, z.ZodString>;
-  }, z.core.$strict>>;
-  impact: z.ZodOptional<z.ZodObject<{
-    inert: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    targets: z.ZodArray<z.ZodObject<{
-      importers: z.ZodArray<z.ZodString>;
-      name: z.ZodString;
-      paths: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    }, z.core.$strict>>;
-  }, z.core.$strict>>;
-  lifecycleContract: z.ZodOptional<z.ZodObject<{
-    command: z.ZodString;
-    jobName: z.ZodOptional<z.ZodString>;
-  }, z.core.$strict>>;
-  repository: z.ZodObject<{
-    name: z.ZodString;
-    owner: z.ZodString;
-  }, z.core.$strict>;
-  requiredChecks: z.ZodOptional<z.ZodArray<z.ZodObject<{
-    name: z.ZodString;
-    scope: z.ZodOptional<z.ZodObject<{
-      classifications: z.ZodArray<z.ZodEnum<{
-        "docs/process-only": "docs/process-only";
-        "non-trivial": "non-trivial";
-      }>>;
-    }, z.core.$strict>>;
-  }, z.core.$strict>>>;
-  review: z.ZodOptional<z.ZodObject<{
-    conditional: z.ZodArray<z.ZodObject<{
-      paths: z.ZodArray<z.ZodString>;
-    }, z.core.$strict>>;
-  }, z.core.$strict>>;
-  schemaVersion: z.ZodLiteral<6>;
-  verification: z.ZodObject<{
-    commands: z.ZodArray<z.ZodObject<{
-      command: z.ZodString;
-      description: z.ZodString;
-      impactTarget: z.ZodOptional<z.ZodString>;
-      name: z.ZodString;
-      requiredCheck: z.ZodOptional<z.ZodString>;
-      scope: z.ZodDefault<z.ZodEnum<{
-        trivial: "trivial";
-        "docs-only": "docs-only";
-        full: "full";
-      }>>;
-    }, z.core.$strip>>;
-  }, z.core.$strip>;
+//#region src/required-check-policy.d.ts
+declare const EVIDENCE_CHECK_TYPES: readonly ["review", "verify"];
+type EvidenceCheckType = (typeof EVIDENCE_CHECK_TYPES)[number];
+declare const requiredCheckScopeSchema: z.ZodObject<{
+  classifications: z.ZodArray<z.ZodEnum<{
+    "docs/process-only": "docs/process-only";
+    trivial: "trivial";
+    "non-trivial": "non-trivial";
+  }>>;
 }, z.core.$strict>;
-type FactoryProjectProfile = z.infer<typeof factoryProjectProfileSchema>;
-declare const resolveFactoryRepository: (profile?: Pick<FactoryProjectProfile, "repository"> | undefined) => string;
-interface LoadProjectProfileInput {
-  cwd?: string;
-  profilePath?: string;
+type RequiredCheckScope = z.infer<typeof requiredCheckScopeSchema>;
+interface RequiredCheckScopeContext {
+  catchUpRecognition?: CatchUpRecognition;
+  classification: DiffClassification | undefined;
+  impactStamp?: ImpactStamp;
 }
-interface LoadProjectProfileResult {
-  path: string;
-  profile: FactoryProjectProfile;
+interface ScopeDecision {
+  inScope: boolean;
+  reason: string;
+}
+declare const requiredCheckInScope: ({
+  context,
+  scope
+}: {
+  context: RequiredCheckScopeContext;
+  scope?: RequiredCheckScope;
+}) => ScopeDecision;
+interface RequiredCheck {
+  name: string;
+  checkType: EvidenceCheckType;
+  scope?: RequiredCheckScope;
+}
+//#endregion
+//#region src/demand-resolution.d.ts
+/**
+ * The two GitHub reads that make the base policy authoritative: the live tip of
+ * a branch, and one file's content at an exact commit. Injectable so tests can
+ * state what the authority says; an absent implementation is the real read, so
+ * an unstated authority is a refusal rather than a silent pass.
+ */
+interface BaseReviewPolicyAuthority {
+  branchTipSha: (input: {
+    branch: string;
+    cwd: string;
+    repository: CheckoutRepository;
+  }) => string;
+  profileContentAtRef: (input: {
+    cwd: string;
+    profilePath: string;
+    ref: string;
+    repository: CheckoutRepository;
+  }) => string;
 }
-declare function loadProjectProfile(input?: LoadProjectProfileInput): LoadProjectProfileResult;
+//#endregion
+//#region src/follow-up.d.ts
+interface FactoryCliInvocation {
+  /** Runtime arguments ending with the factory CLI entry module. */
+  argvPrefix: string[];
+  executable: string;
+}
+declare const FactoryCliInvocationSchema: z.ZodType<FactoryCliInvocation>;
+interface FollowUpAction {
+  /**
+   * Machine-safe argv-style array for the obvious next action, e.g.
+   * ["gh","pr","merge","513","--squash"]. Same shape and field name that
+   * `factory:delegate --print` emits, so an orchestrating agent can spawn the
+   * next command without reconstructing a shell string. argv[0] is the
+   * executable; the rest are literal, already-split arguments.
+   */
+  argv: string[];
+  /**
+   * Human-readable rendering of {@link argv} for logs and operators. Additive
+   * to argv, never a substitute for it — argv is the source of truth.
+   */
+  command: string;
+}
+/**
+ * Build a {@link FollowUpAction} from a literal argv array. The `command`
+ * string is derived from argv so the two never drift.
+ */
+declare const followUpFromArgv: (argv: string[]) => FollowUpAction;
+/** Canonical zod schema for the optional follow-up field on JSON outputs. */
+declare const FollowUpActionSchema: z.ZodType<FollowUpAction>;
 //#endregion
 //#region src/pr-verify-mode.d.ts
 /**
@@ -929,8 +1309,8 @@ declare const mergeFreezeStateSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
   generationId: z.ZodNumber;
   headSha: z.ZodString;
   outcome: z.ZodEnum<{
-    active: "active";
     stale: "stale";
+    active: "active";
   }>;
   reason: z.ZodString;
   recordedAt: z.ZodISODateTime;
@@ -942,357 +1322,112 @@ declare const mergeFreezeStateSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
   headSha: z.ZodString;
   outcome: z.ZodLiteral<"inactive">;
   reason: z.ZodString;
-  recordedAt: z.ZodISODateTime;
-  schemaVersion: z.ZodLiteral<1>;
-}, z.core.$strip>], "active">;
-type MergeFreezeState = z.infer<typeof mergeFreezeStateSchema>;
-/**
- * The write side of this contract lives in the generated merge-target push
- * Verify workflow (#356, ADR 0016 as amended; #429): it is the ONLY producer of
- * `patronage-factory/merge-freeze` generations. Its emitted `output.text`
- * payload must parse under this exact reader schema, which is what the
- * workflow's own tests assert through this export.
- */
-declare function validateMergeFreezeState(value: unknown): MergeFreezeState;
-interface MergeFreezeStoreInput {
-  cwd: string;
-  headSha: string;
-  repository: CheckoutRepository;
-}
-interface MergeFreezeStore {
-  read: (input: MergeFreezeStoreInput) => unknown;
-}
-/**
- * The freeze generation as a readiness decision needs to see it (#477).
- *
- * `read` above collapses three different situations into one refusal, because
- * merge time treated all of them as "do not merge". Readiness distinguishes
- * them: a settled generation is the writer's verdict, a **settling** one is the
- * window between a merge landing and its merge-target Verify completing (a
- * running generation, or a missing generation proven by the immediately prior
- * settled tip plus a current source-pinned verify run), and an **unreadable**
- * one is ambiguous, malformed, foreign-App, or unavailable state. Same
- * selection, same pinned App, same `started_at` ordering — only the reporting
- * is finer.
- */
-type MergeFreezeGeneration = {
-  kind: "settled";
-  state: MergeFreezeState;
-} | {
-  kind: "settling";
-  reason: string;
-  running?: {
-    headSha: string;
-    id: number;
-  };
-} | {
-  kind: "unreadable";
-  reason: string;
-};
-/** A merge-freeze reader that can also report the settle window (#477). */
-interface MergeFreezeAuthority extends MergeFreezeStore {
-  readGeneration: (input: MergeFreezeStoreInput) => MergeFreezeGeneration;
-}
-//#endregion
-//#region src/pr-proof-io.d.ts
-interface ProofDescriptor<T> {
-  label: string;
-  defaultPath: string;
-  schemaVersion: number;
-  parse: (raw: unknown) => T;
-}
-//#endregion
-//#region src/packages/review-prompt-sections/schema.d.ts
-declare const reviewPromptSectionSchema: z.ZodObject<{
-  provenance: z.ZodEnum<{
-    "prior-review-ledger": "prior-review-ledger";
-    "issue-review-focus": "issue-review-focus";
-  }>;
-  source: z.ZodString;
-  text: z.ZodString;
-}, z.core.$strict>;
-type ReviewPromptSection = z.infer<typeof reviewPromptSectionSchema>;
-type ReviewPromptSectionProvenance = ReviewPromptSection["provenance"];
-declare const reviewPromptSectionsSchema: z.ZodArray<z.ZodObject<{
-  provenance: z.ZodEnum<{
-    "prior-review-ledger": "prior-review-ledger";
-    "issue-review-focus": "issue-review-focus";
-  }>;
-  source: z.ZodString;
-  text: z.ZodString;
-}, z.core.$strict>>;
-//#endregion
-//#region src/review-ladder-policy.d.ts
-type ReviewFindingSeverity = "critical" | "high" | "medium" | "low" | "unknown";
-type ReviewFindingCategory = "correctness" | "safety" | "coordination" | "maintainability" | "unknown";
-declare const REVIEW_SEVERITIES: readonly ["critical", "high", "medium", "low", "unknown"];
-declare const resolveReviewFindingSeverity: (priority?: string) => ReviewFindingSeverity;
-declare const resolveReviewFindingCategory: (category?: string) => ReviewFindingCategory;
-declare const FINDING_DISPOSITIONS: readonly ["open", "fixed-in-thread", "follow-up-filed", "waived", "stale-repeat", "rerun-noise"];
-type FindingDisposition = (typeof FINDING_DISPOSITIONS)[number];
-interface ReviewFindingAttributes {
-  blockingAfterCap?: boolean;
-  category?: string;
-  citedSpan?: string;
-  file?: string;
-  prescribedAction?: string;
-  priority?: string;
-  supersedes?: {
-    file?: string;
-    title: string;
-  };
-  title: string;
-}
-type BlockingResolvableFinding = Pick<ReviewFindingAttributes, "blockingAfterCap" | "category" | "priority">;
-declare const resolveFindingBlocking: (finding: BlockingResolvableFinding, disposition?: FindingDisposition) => boolean;
-interface ReviewLadderPolicy {
-  gate: {
-    cap: number;
-  };
-  interior: {
-    cap: number;
-  };
-}
-declare const resolveReviewLadderPolicy: () => ReviewLadderPolicy;
-//#endregion
-//#region src/review-ladder-ledger.d.ts
-type LadderCycleStage = "interior" | "gate";
-interface LadderCycleRef {
-  cycle: number;
-  stage: LadderCycleStage;
-}
-type LadderFindingReport = ReviewFindingAttributes;
-type DeclarableFindingDisposition = Exclude<FindingDisposition, "open" | "stale-repeat" | "rerun-noise">;
-interface LadderDispositionDeclaration {
-  disposition: DeclarableFindingDisposition;
-  finding: {
-    file?: string;
-    title: string;
-  };
-  findingReport?: LadderFindingReport;
-  reference?: string;
-}
-interface FindingLedgerEntry extends ReviewFindingAttributes {
-  disposition: FindingDisposition;
-  firstFlagged: LadderCycleRef;
-  flagCount: number;
-  key: string;
-  lastFlagged: LadderCycleRef;
-  priorDisposition?: FindingDisposition;
-  reference?: string;
-  reopenedCount: number;
-  staleRepeatCount: number;
-}
-declare const findingKey: (finding: {
-  citedSpan?: string;
-  file?: string;
-  prescribedAction?: string;
-  title?: string;
-}) => string;
-declare const openLadderFindings: (ledger: FindingLedgerEntry[]) => FindingLedgerEntry[];
-declare const blockingLadderFindings: (ledger: FindingLedgerEntry[]) => FindingLedgerEntry[];
-declare const staleRepeatLadderFindings: (ledger: FindingLedgerEntry[]) => FindingLedgerEntry[];
-declare const inferFixedInThreadDispositions: (ledger: FindingLedgerEntry[], findings: readonly LadderFindingReport[], options?: {
-  sameHeadAsPriorCycle?: boolean;
-}) => LadderDispositionDeclaration[];
-//#endregion
-//#region src/review-ladder.d.ts
-type ReviewLadderExecutedStage = "interior" | "gate";
-interface LadderSessionAttribution {
-  orchestrationMode?: "autonomous" | "manual";
-  resumedSession?: boolean;
-  runtime?: string;
-  sessionId?: string;
-}
-interface LadderUsageReport {
-  estimatedCostUsd?: number;
-  source?: string;
-  totalTokens?: number;
-}
-interface ReviewLadderCycle {
-  dispositions?: LadderDispositionDeclaration[];
-  engine?: string;
-  findings: LadderFindingReport[];
-  identity?: {
-    headSha: string;
-    patchId: string;
-  };
-  model?: string;
-  correlatedRerun?: boolean;
-  session?: LadderSessionAttribution;
-  stage: LadderCycleStage;
-  usage?: LadderUsageReport;
-}
-interface LadderInteriorCapTransition {
-  cap: number;
-  kind: "interior-cap-reached";
-}
-interface LadderGateCapTransition {
-  blockingFindings: string[];
-  cap: number;
-  kind: "gate-cap-exhausted";
-}
-type LadderForcedTransition = LadderGateCapTransition | LadderInteriorCapTransition;
-interface LadderRunInteriorCycleAction {
-  cycle: number;
-  kind: "run-interior-cycle";
-}
-type LadderGateNextAction = {
-  cycle: number;
-  kind: "run-gate-cycle";
-} | {
-  kind: "accept-nonblocking-findings";
-} | {
-  kind: "escalate-to-triage";
-} | {
-  kind: "ready-for-human";
-};
-type LadderPosition = {
-  forcedTransition?: LadderGateCapTransition;
-  nextAction: LadderGateNextAction;
-  stage: "gate";
-} | {
-  forcedTransition?: LadderInteriorCapTransition;
-  nextAction: {
-    kind: "advance-to-gate";
-  };
-  stage: "interior-complete";
-} | {
-  forcedTransition?: never;
-  nextAction: LadderRunInteriorCycleAction;
-  stage: "interior";
-};
-type LadderNextAction = LadderPosition["nextAction"];
-type ReviewLadderStage = LadderPosition["stage"];
-interface ReviewLadderStageEvent {
-  cycle: number;
-  cyclesToClean?: number;
-  engine?: string;
-  findingsSummary: {
-    blocking: number;
-    bySeverity: Record<ReviewFindingSeverity, number>;
-    flagged: number;
-    open: number;
-    staleRepeats: number;
-  };
-  forcedTransition?: LadderForcedTransition["kind"];
-  model?: string;
-  payloadVersion: 1;
-  session?: LadderSessionAttribution;
-  stage: ReviewLadderExecutedStage;
-  type: "review-ladder-stage";
-  usage?: LadderUsageReport;
-}
-interface LadderDiagnostic {
-  code: "interior-cycles-unrecorded";
-  message: string;
-}
-type ReviewLadderEvaluation = LadderPosition & {
-  cycleCounts: {
-    gate: number;
-    interior: number;
-  };
-  diagnostics: LadderDiagnostic[];
-  event?: ReviewLadderStageEvent;
-  ledger: FindingLedgerEntry[];
-  unmatchedDispositions: LadderDispositionDeclaration[];
-};
-interface EvaluateReviewLadderInput {
-  cycles: ReviewLadderCycle[];
-  policy: ReviewLadderPolicy;
-}
-declare const evaluateReviewLadder: ({
-  cycles,
-  policy
-}: EvaluateReviewLadderInput) => ReviewLadderEvaluation;
-//#endregion
-//#region src/pr-readiness/ladder-proof-state.d.ts
-interface PrReviewLadderState {
-  cycles: ReviewLadderCycle[];
+  recordedAt: z.ZodISODateTime;
+  schemaVersion: z.ZodLiteral<1>;
+}, z.core.$strip>], "active">;
+type MergeFreezeState = z.infer<typeof mergeFreezeStateSchema>;
+/**
+ * The write side of this contract lives in the generated merge-target push
+ * Verify workflow (#356, ADR 0016 as amended; #429): it is the ONLY producer of
+ * `patronage-factory/merge-freeze` generations. Its emitted `output.text`
+ * payload must parse under this exact reader schema, which is what the
+ * workflow's own tests assert through this export.
+ */
+declare function validateMergeFreezeState(value: unknown): MergeFreezeState;
+interface MergeFreezeStoreInput {
+  cwd: string;
+  headSha: string;
+  repository: CheckoutRepository;
 }
-interface OpenCycleState {
-  autoBlockingFindings: number;
-  blockingEntries: ReviewFindingAttributes[];
-  openEntries: ReviewFindingAttributes[];
-  staleRepeatFindings?: number;
+interface MergeFreezeStore {
+  read: (input: MergeFreezeStoreInput) => unknown;
 }
-interface ReviewLadderSummaryState {
-  cycleCounts: {
-    gate: number;
-    interior: number;
-  };
-  forcedTransition?: LadderForcedTransition["kind"];
-  nextAction: LadderNextAction["kind"];
-  stage: ReviewLadderStage;
+/**
+ * The run identity that proves a generation is settling because it is running.
+ */
+interface RunningMergeFreezeWitness {
+  /** The base tip the running generation was created on. */
+  headSha: string;
+  /** The running `patronage-factory/merge-freeze` check-run id. */
+  runId: number;
 }
-interface ReviewLadderSnapshot {
-  cycleState: OpenCycleState;
-  evaluation: ReviewLadderEvaluation;
-  ledger: FindingLedgerEntry[];
-  policyGateCap: number;
-  summary: ReviewLadderSummaryState;
+/**
+ * The evidence that a generation is settling because it is still owed (#521).
+ */
+interface AwaitedMergeFreezeWitness {
+  /** The base tip whose generation is awaited. */
+  headSha: string;
+  /** The immediate parent whose settled generation proves the writer runs. */
+  parentSha: string;
+  /** The source-pinned hosted verify run that owes the generation. */
+  verifyRunId: number;
+  /** That run's status. A completed run owes nothing, so it is not settling. */
+  verifyStatus: "in_progress" | "queued";
 }
-type ReviewEpochMode = {
-  kind: "ladder";
-  ladder: PrReviewLadderState;
-  snapshot?: ReviewLadderSnapshot;
+/**
+ * The two settling phases, each with the witness that proves it (#890).
+ *
+ * `phase` replaces an optional `running` field that made one situation two:
+ * the field's presence, not the situation, decided how readers behaved. Each
+ * phase now carries exactly the witness its own rule needs.
+ */
+type SettlingMergeFreezeGeneration = {
+  kind: "settling";
+  phase: "running-generation";
+  reason: string;
+  witness: RunningMergeFreezeWitness;
 } | {
-  kind: "declared-window";
+  kind: "settling";
+  phase: "awaiting-generation";
+  reason: string;
+  witness: AwaitedMergeFreezeWitness;
 };
-//#endregion
-//#region src/pr-readiness/review-proof-types.d.ts
-type PrReviewKind = "correctness" | "security";
-type PrReviewMode = PrReviewKind | "all";
-type PrReviewOutcome = "passed" | "failed" | "error";
-interface PrReviewStageResolution {
-  model: string;
-  sessionId: string;
-}
-//#endregion
-//#region src/pr-readiness/review-proof-shape.d.ts
-interface PrReviewFinding extends ReviewFindingAttributes {
-  body: string;
-  category?: ReviewFindingCategory;
-  line?: number;
-  protocolFinding?: true;
+/**
+ * The freeze generation as a readiness decision needs to see it (#477).
+ *
+ * `read` below collapses every situation short of a verdict into one refusal,
+ * because merge time treats all of them as "do not merge". Readiness
+ * distinguishes them: a settled generation is the writer's verdict, a
+ * **settling** one is the window between a merge landing and its merge-target
+ * Verify completing, and an **unreadable** one is ambiguous, malformed,
+ * foreign-App, or unavailable state. Same selection, same pinned App, same
+ * `started_at` ordering — only the reporting is finer.
+ */
+type MergeFreezeGeneration = {
+  kind: "settled";
+  state: MergeFreezeState;
+} | SettlingMergeFreezeGeneration | {
+  kind: "unreadable";
+  reason: string;
+};
+/** A merge-freeze reader that can also report the settle window (#477). */
+interface MergeFreezeAuthority extends MergeFreezeStore {
+  readGeneration: (input: MergeFreezeStoreInput) => MergeFreezeGeneration;
 }
-interface PrReviewResult {
-  kind: PrReviewKind;
-  startedAt: string;
-  endedAt: string;
-  durationMs: number;
-  model?: string;
-  producer?: string;
-  rung?: EvidenceReviewRung;
-  sessionId?: string;
-  outcome: PrReviewOutcome;
-  issuesFlagged: number;
-  summary: string;
-  findings: PrReviewFinding[];
-  typedVerdict?: boolean;
-  verdictSource?: "footer" | "recovered";
-  promptSections?: ReviewPromptSection[];
+interface GitHubCheckRunMergeFreezeApi {
+  list: (input: MergeFreezeStoreInput & {
+    name: string;
+  }) => unknown;
+  parent?: (input: MergeFreezeStoreInput) => unknown;
 }
-interface PrReviewProof {
-  schemaVersion: 2;
-  findingProvenanceVersion: 1;
-  base: string;
-  headSha: string;
-  patchId: string;
-  reviewCycle?: number;
-  maxReviewCycles?: number;
-  changedFiles: string[];
-  cleanedPaths: string[];
-  ladder?: PrReviewLadderState;
-  reviewRequirement?: {
-    reason: "no-applicable-mode" | "faithful-merge";
-    status: "not-required";
-  };
-  reviews: PrReviewResult[];
+declare function createGitHubCheckRunMergeFreezeStore(api: GitHubCheckRunMergeFreezeApi): MergeFreezeAuthority;
+//#endregion
+//#region src/pr-proof-io.d.ts
+interface ProofDescriptor<T> {
+  label: string;
+  defaultPath: string;
+  schemaVersion: number;
+  parse: (raw: unknown) => T;
 }
 //#endregion
 //#region src/pr-readiness/readiness-ledger.d.ts
-declare const SCHEMA_VERSION = 1;
+/**
+ * Ledger schema version 2 (#894): `verification` is a tagged union on
+ * `prVerify` and `externalChecks` no longer echoes `inScope`. Version 1
+ * ledgers are not read — the pre-1.0 posture keeps one shape per contract, so
+ * there is no compat reader here.
+ */
+declare const SCHEMA_VERSION = 2;
 declare const READINESS_REPAIR_CODES: readonly ["undraft-pr", "await-post-undraft-checks"];
 declare const readinessRepairSchema: z.ZodObject<{
   action: z.ZodString;
@@ -1315,7 +1450,6 @@ declare const managedReadinessLedgerSchema: z.ZodObject<{
       review: "review";
       verify: "verify";
     }>;
-    inScope: z.ZodBoolean;
     name: z.ZodString;
     reason: z.ZodOptional<z.ZodString>;
     scope: z.ZodOptional<z.ZodObject<{
@@ -1338,9 +1472,9 @@ declare const managedReadinessLedgerSchema: z.ZodObject<{
     mergeable: z.ZodString;
     requiredChecks: z.ZodEnum<{
       unknown: "unknown";
-      pending: "pending";
       passed: "passed";
       failed: "failed";
+      pending: "pending";
       none: "none";
     }>;
     reviewDecision: z.ZodOptional<z.ZodNullable<z.ZodString>>;
@@ -1406,8 +1540,8 @@ declare const managedReadinessLedgerSchema: z.ZodObject<{
       "run-interior-cycle": "run-interior-cycle";
     }>;
     stage: z.ZodEnum<{
-      interior: "interior";
       gate: "gate";
+      interior: "interior";
       "interior-complete": "interior-complete";
     }>;
   }, z.core.$strip>>;
@@ -1425,8 +1559,8 @@ declare const managedReadinessLedgerSchema: z.ZodObject<{
       status: z.ZodEnum<{
         blocked: "blocked";
         "not-required": "not-required";
-        stale: "stale";
         current: "current";
+        stale: "stale";
         missing: "missing";
       }>;
     }, z.core.$strip>;
@@ -1437,26 +1571,35 @@ declare const managedReadinessLedgerSchema: z.ZodObject<{
       status: z.ZodEnum<{
         blocked: "blocked";
         "not-required": "not-required";
-        stale: "stale";
         current: "current";
+        stale: "stale";
         missing: "missing";
       }>;
     }, z.core.$strip>>;
   }, z.core.$strip>;
-  schemaVersion: z.ZodLiteral<1>;
-  verification: z.ZodObject<{
+  schemaVersion: z.ZodLiteral<2>;
+  verification: z.ZodDiscriminatedUnion<[z.ZodObject<{
     command: z.ZodLiteral<"patronage-factory pr:verify">;
-    docsOnlyDeltaAccepted: z.ZodOptional<z.ZodBoolean>;
-    docsOnlyVerifiedHeadSha: z.ZodOptional<z.ZodString>;
-    prVerify: z.ZodEnum<{
-      stale: "stale";
-      passed: "passed";
-      missing: "missing";
-    }>;
-    trivialDeltaAccepted: z.ZodOptional<z.ZodBoolean>;
-    trivialVerifiedHeadSha: z.ZodOptional<z.ZodString>;
+    prVerify: z.ZodLiteral<"missing">;
+  }, z.core.$strict>, z.ZodObject<{
+    command: z.ZodLiteral<"patronage-factory pr:verify">;
+    prVerify: z.ZodLiteral<"stale">;
+    verifiedHeadSha: z.ZodString;
+  }, z.core.$strict>, z.ZodObject<{
+    command: z.ZodLiteral<"patronage-factory pr:verify">;
+    prVerify: z.ZodLiteral<"passed-via-head">;
+    verifiedHeadSha: z.ZodString;
+  }, z.core.$strict>, z.ZodObject<{
+    command: z.ZodLiteral<"patronage-factory pr:verify">;
+    docsOnlyVerifiedHeadSha: z.ZodString;
+    prVerify: z.ZodLiteral<"docs-only-delta">;
     verifiedHeadSha: z.ZodOptional<z.ZodString>;
-  }, z.core.$strip>;
+  }, z.core.$strict>, z.ZodObject<{
+    command: z.ZodLiteral<"patronage-factory pr:verify">;
+    prVerify: z.ZodLiteral<"trivial-delta">;
+    trivialVerifiedHeadSha: z.ZodString;
+    verifiedHeadSha: z.ZodOptional<z.ZodString>;
+  }, z.core.$strict>], "prVerify">;
 }, z.core.$strip>;
 type ReadinessRepair = z.infer<typeof readinessRepairSchema>;
 type ReadinessStatus = "ready" | "blocked";
@@ -1547,23 +1690,6 @@ interface UpsertFactoryPrStatusCommentResult {
 }
 declare function upsertFactoryPrStatusComment(input: UpsertFactoryPrStatusCommentInput, dependencies?: UpsertFactoryPrStatusCommentDependencies): Promise<UpsertFactoryPrStatusCommentResult>;
 //#endregion
-//#region src/catch-up-recognition-record.d.ts
-interface CatchUpRecognition {
-  /** The ref the candidate targets, as the recognizing command resolved it. */
-  baseRef: string;
-  /** The live target tip at recognition time; the head's first parent. */
-  baseTipSha: string;
-  /** The head's second parent: the admitted base-side content merged in. */
-  mergedParentSha: string;
-  /**
-   * The tree `git merge-tree --write-tree` produced for the two parents. It
-   * equals the head's own tree; that equality is the faithfulness proof.
-   */
-  mergedTreeSha: string;
-  /** The ref that proves the second parent is admitted content. */
-  upstreamRef: string;
-}
-//#endregion
 //#region src/pr-verify-proof-contract.d.ts
 declare const SUPPORTED_PR_VERIFY_SCHEMA_VERSIONS: readonly [1, 2, 3, 4];
 type PrVerifySchemaVersion = (typeof SUPPORTED_PR_VERIFY_SCHEMA_VERSIONS)[number];
@@ -2073,6 +2199,14 @@ interface GitHubPullRequest {
   body: string;
   headRefName?: string;
   headRefOid: string;
+  /**
+   * Whether the head branch lives in a different repository from the base
+   * (#922). Required, not optional, for the reason `autoMergeRequest` is: the
+   * trusted checkout names ONE repository, and for a fork PR that is not the
+   * base repository. An implementation that omitted the field would silently
+   * resolve base policy from whichever repository the checkout points at.
+   */
+  isCrossRepository: boolean;
   isDraft: boolean;
   mergeStateStatus: string;
   mergeable: string;
@@ -2132,6 +2266,13 @@ interface PrReadyProof {
    * waived demand reads to a human. Absent when there are none.
    */
   notices?: string[];
+  /**
+   * The policy identity readiness resolved review demand under (#922): the
+   * base ref, its live tip, and the digests of the base, candidate, and merged
+   * review policies. Optional on the wire and additive — this is a new record
+   * on an unchanged contract, so no schema version moves.
+   */
+  policyResolution?: PolicyResolution;
   /** Committed profile blob evaluated by readiness. Required for merge. */
   profileBlobSha?: string;
   /** Checkout-relative committed profile path evaluated by readiness. */
@@ -2155,6 +2296,13 @@ interface PrReadyDependencies {
    * call plus the read-back that says what actually happened.
    */
   armAutoMerge?: (input: ArmAutoMergeInput) => ArmAutoMergeOutcome;
+  /**
+   * Reads the authoritative base review policy (#922): the profile committed at
+   * the live tip of the PR's own base ref. Defaults to the real GitHub reads,
+   * so an unstated authority refuses rather than falling back to candidate
+   * policy — unreadable authority is never absent authority.
+   */
+  basePolicy?: BaseReviewPolicyAuthority;
   github?: {
     fetchClosingPullRequests?: (input: {
       issue: number;
@@ -2220,39 +2368,6 @@ declare function validatePrReadyProof(value: unknown): PrReadyProof;
 declare function readPrReadyProof(filePath: string): PrReadyProof;
 declare function runPrReady(args: PrReadyArgs, dependencies?: PrReadyDependencies): Promise<PrReadyProof>;
 //#endregion
-//#region src/required-check-policy.d.ts
-declare const EVIDENCE_CHECK_TYPES: readonly ["review", "verify"];
-type EvidenceCheckType = (typeof EVIDENCE_CHECK_TYPES)[number];
-declare const requiredCheckScopeSchema: z.ZodObject<{
-  classifications: z.ZodArray<z.ZodEnum<{
-    "docs/process-only": "docs/process-only";
-    trivial: "trivial";
-    "non-trivial": "non-trivial";
-  }>>;
-}, z.core.$strict>;
-type RequiredCheckScope = z.infer<typeof requiredCheckScopeSchema>;
-interface RequiredCheckScopeContext {
-  catchUpRecognition?: CatchUpRecognition;
-  classification: DiffClassification | undefined;
-  impactStamp?: ImpactStamp;
-}
-interface ScopeDecision {
-  inScope: boolean;
-  reason: string;
-}
-declare const requiredCheckInScope: ({
-  context,
-  scope
-}: {
-  context: RequiredCheckScopeContext;
-  scope?: RequiredCheckScope;
-}) => ScopeDecision;
-interface RequiredCheck {
-  name: string;
-  checkType: EvidenceCheckType;
-  scope?: RequiredCheckScope;
-}
-//#endregion
 //#region src/factory-session.d.ts
 declare const resolveAuthoringSessionIds: ({
   override,
@@ -2284,8 +2399,8 @@ declare const evidenceEnvelopeBaseSchema: z.ZodObject<{
   producer: z.ZodString;
   requestId: z.ZodOptional<z.ZodString>;
   rung: z.ZodOptional<z.ZodEnum<{
-    oracle: "oracle";
     "independent-model": "independent-model";
+    oracle: "oracle";
     human: "human";
   }>>;
   schemaVersion: z.ZodLiteral<1>;
@@ -2311,8 +2426,8 @@ declare const evidenceEnvelopeSchema: z.ZodObject<{
   producer: z.ZodString;
   requestId: z.ZodOptional<z.ZodString>;
   rung: z.ZodOptional<z.ZodEnum<{
-    oracle: "oracle";
     "independent-model": "independent-model";
+    oracle: "oracle";
     human: "human";
   }>>;
   schemaVersion: z.ZodLiteral<1>;
@@ -2392,7 +2507,6 @@ interface RequiredCheckOutcome {
   name: string;
   checkType: EvidenceCheckType;
   status: "satisfied" | "unmet" | "out-of-scope";
-  inScope: boolean;
   scopeReason: string;
   scope?: RequiredCheckScope;
   reason?: string;
@@ -2417,8 +2531,8 @@ declare const REVIEW_STATUS_VALUES: readonly ["not-required", "current", "stale"
 declare const reviewStatusSchema: z.ZodEnum<{
   blocked: "blocked";
   "not-required": "not-required";
-  stale: "stale";
   current: "current";
+  stale: "stale";
   missing: "missing";
 }>;
 type ReviewStatus = z.infer<typeof reviewStatusSchema>;
@@ -2533,8 +2647,8 @@ declare const boundaryCheckProofSchema: z.ZodObject<{
     wave: z.ZodString;
   }, z.core.$strip>>;
   demandedRung: z.ZodOptional<z.ZodEnum<{
-    oracle: "oracle";
     "independent-model": "independent-model";
+    oracle: "oracle";
     human: "human";
   }>>;
   epicIssue: z.ZodNumber;
@@ -2549,8 +2663,8 @@ declare const boundaryCheckProofSchema: z.ZodObject<{
     commentUrl: z.ZodOptional<z.ZodString>;
     producer: z.ZodString;
     rung: z.ZodEnum<{
-      oracle: "oracle";
       "independent-model": "independent-model";
+      oracle: "oracle";
       human: "human";
     }>;
     sessionId: z.ZodOptional<z.ZodString>;
@@ -2566,8 +2680,8 @@ declare const boundaryCheckProofSchema: z.ZodObject<{
     value: z.ZodString;
   }, z.core.$strip>>;
   status: z.ZodEnum<{
-    blocked: "blocked";
     ready: "ready";
+    blocked: "blocked";
   }>;
 }, z.core.$strip>;
 type BoundaryCheckProofRecord = z.infer<typeof boundaryCheckProofSchema>;
@@ -2688,6 +2802,7 @@ type CatchUpRecognizer = (input: {
 //#endregion
 //#region src/pr-review.d.ts
 interface PrReviewArgs extends LoadProjectProfileInput {
+  assemble?: boolean;
   base: string;
   cycle: number;
   dispositions?: string;
@@ -2702,10 +2817,18 @@ interface PrReviewGitDependencies {
   currentHeadSha: (cwd: string) => string;
   isAncestor: (cwd: string, ancestor: string, descendant: string) => boolean;
   recognizeCatchUp?: CatchUpRecognizer;
+  repositoryRoot?: (cwd: string) => string;
+  showFileAtRef?: (cwd: string, ref: string, absolutePath: string) => string | undefined;
   stablePatchId: (cwd: string, base: string) => string;
   statusPorcelain: (cwd: string) => string;
 }
+interface PrReviewIssueBodyInput {
+  issue: number;
+  owner: string;
+  repo: string;
+}
 interface PrReviewDependencies {
+  fetchIssueBody?: (input: PrReviewIssueBodyInput) => string;
   git?: PrReviewGitDependencies;
   hq?: HqIngestDependencies;
 }
@@ -3025,11 +3148,11 @@ declare const LegacyWorkerCloseoutStatusTraceEventSchema: z.ZodObject<{
   threadId: z.ZodOptional<z.ZodString>;
   workerId: z.ZodOptional<z.ZodString>;
   archiveStatus: z.ZodOptional<z.ZodEnum<{
+    pending: "pending";
     unavailable: "unavailable";
     archived: "archived";
     skipped: "skipped";
     "not-applicable": "not-applicable";
-    pending: "pending";
   }>>;
   closeoutReason: z.ZodOptional<z.ZodString>;
   eventType: z.ZodLiteral<"worker-closeout-lessons">;
@@ -3202,8 +3325,8 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
     sessionId: z.ZodOptional<z.ZodString>;
   }, z.core.$strict>>;
   stage: z.ZodEnum<{
-    interior: "interior";
     gate: "gate";
+    interior: "interior";
   }>;
   usage: z.ZodOptional<z.ZodObject<{
     estimatedCostUsd: z.ZodOptional<z.ZodNumber>;
@@ -3255,8 +3378,8 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
     sessionId: z.ZodOptional<z.ZodString>;
   }, z.core.$strict>>;
   stage: z.ZodEnum<{
-    interior: "interior";
     gate: "gate";
+    interior: "interior";
   }>;
   usage: z.ZodOptional<z.ZodObject<{
     estimatedCostUsd: z.ZodOptional<z.ZodNumber>;
@@ -3299,8 +3422,8 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
       sessionId: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>>;
     stage: z.ZodEnum<{
-      interior: "interior";
       gate: "gate";
+      interior: "interior";
     }>;
     usage: z.ZodOptional<z.ZodObject<{
       estimatedCostUsd: z.ZodOptional<z.ZodNumber>;
@@ -3330,7 +3453,7 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
     staleRepeats: number;
   };
   observedAt: string;
-  stage: "interior" | "gate";
+  stage: "gate" | "interior";
   issue?: number | undefined;
   pr?: number | undefined;
   threadId?: string | undefined;
@@ -3423,11 +3546,11 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
   threadId: z.ZodOptional<z.ZodString>;
   workerId: z.ZodOptional<z.ZodString>;
   archiveStatus: z.ZodOptional<z.ZodEnum<{
+    pending: "pending";
     unavailable: "unavailable";
     archived: "archived";
     skipped: "skipped";
     "not-applicable": "not-applicable";
-    pending: "pending";
   }>>;
   closeoutReason: z.ZodOptional<z.ZodString>;
   eventType: z.ZodLiteral<"worker-closeout-lessons">;
@@ -3464,11 +3587,11 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
   }, z.core.$strict>], "lessonStatus">;
   readonly 2: z.ZodObject<{
     archiveStatus: z.ZodOptional<z.ZodEnum<{
+      pending: "pending";
       unavailable: "unavailable";
       archived: "archived";
       skipped: "skipped";
       "not-applicable": "not-applicable";
-      pending: "pending";
     }>>;
     closeoutReason: z.ZodOptional<z.ZodString>;
     lessonStatus: z.ZodOptional<z.ZodEnum<{
@@ -3606,8 +3729,8 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
     model: z.ZodString;
     tier: z.ZodEnum<{
       review: "review";
-      delegate: "delegate";
       oracle: "oracle";
+      delegate: "delegate";
       workhorse: "workhorse";
       scout: "scout";
     }>;
@@ -3615,8 +3738,8 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
   startedAt: z.ZodString;
   tier: z.ZodEnum<{
     review: "review";
-    delegate: "delegate";
     oracle: "oracle";
+    delegate: "delegate";
     workhorse: "workhorse";
     scout: "scout";
   }>;
@@ -3685,8 +3808,8 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
     model: z.ZodString;
     tier: z.ZodEnum<{
       review: "review";
-      delegate: "delegate";
       oracle: "oracle";
+      delegate: "delegate";
       workhorse: "workhorse";
       scout: "scout";
     }>;
@@ -3694,8 +3817,8 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
   startedAt: z.ZodString;
   tier: z.ZodEnum<{
     review: "review";
-    delegate: "delegate";
     oracle: "oracle";
+    delegate: "delegate";
     workhorse: "workhorse";
     scout: "scout";
   }>;
@@ -3755,8 +3878,8 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
       model: z.ZodString;
       tier: z.ZodEnum<{
         review: "review";
-        delegate: "delegate";
         oracle: "oracle";
+        delegate: "delegate";
         workhorse: "workhorse";
         scout: "scout";
       }>;
@@ -3764,8 +3887,8 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
     startedAt: z.ZodString;
     tier: z.ZodEnum<{
       review: "review";
-      delegate: "delegate";
       oracle: "oracle";
+      delegate: "delegate";
       workhorse: "workhorse";
       scout: "scout";
     }>;
@@ -3814,11 +3937,11 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
     engine: string;
     layerSource: "committedDefault" | "operatorSession" | "userConfig";
     model: string;
-    tier: "review" | "delegate" | "oracle" | "workhorse" | "scout";
+    tier: "review" | "oracle" | "delegate" | "workhorse" | "scout";
     fallbackTier?: "delegate" | undefined;
   };
   startedAt: string;
-  tier: "review" | "delegate" | "oracle" | "workhorse" | "scout";
+  tier: "review" | "oracle" | "delegate" | "workhorse" | "scout";
   tokenUsage: {
     source: "cursor-csv" | "codex-json" | "cursor-json" | "claude-json";
     status: "available";
@@ -4140,7 +4263,7 @@ declare const evaluateReadiness: (input: EvaluationInput) => {
       draft: boolean;
       mergeStateStatus: string;
       mergeable: string;
-      requiredChecks: "unknown" | "pending" | "passed" | "failed" | "none";
+      requiredChecks: "unknown" | "passed" | "failed" | "pending" | "none";
       unresolvedReviewThreads: number;
       reviewDecision?: string | null | undefined;
     };
@@ -4155,30 +4278,42 @@ declare const evaluateReadiness: (input: EvaluationInput) => {
     reviews: {
       correctness: {
         required: boolean;
-        status: "blocked" | "not-required" | "stale" | "current" | "missing";
+        status: "blocked" | "not-required" | "current" | "stale" | "missing";
         reviewedHeadSha?: string | undefined;
         reviewedPatchId?: string | undefined;
       };
       security?: {
         required: boolean;
-        status: "blocked" | "not-required" | "stale" | "current" | "missing";
+        status: "blocked" | "not-required" | "current" | "stale" | "missing";
         reviewedHeadSha?: string | undefined;
         reviewedPatchId?: string | undefined;
       } | undefined;
     };
-    schemaVersion: 1;
+    schemaVersion: 2;
     verification: {
       command: "patronage-factory pr:verify";
-      prVerify: "stale" | "passed" | "missing";
-      docsOnlyDeltaAccepted?: boolean | undefined;
-      docsOnlyVerifiedHeadSha?: string | undefined;
-      trivialDeltaAccepted?: boolean | undefined;
-      trivialVerifiedHeadSha?: string | undefined;
+      prVerify: "missing";
+    } | {
+      command: "patronage-factory pr:verify";
+      prVerify: "stale";
+      verifiedHeadSha: string;
+    } | {
+      command: "patronage-factory pr:verify";
+      prVerify: "passed-via-head";
+      verifiedHeadSha: string;
+    } | {
+      command: "patronage-factory pr:verify";
+      docsOnlyVerifiedHeadSha: string;
+      prVerify: "docs-only-delta";
+      verifiedHeadSha?: string | undefined;
+    } | {
+      command: "patronage-factory pr:verify";
+      prVerify: "trivial-delta";
+      trivialVerifiedHeadSha: string;
       verifiedHeadSha?: string | undefined;
     };
     externalChecks?: {
       checkType: "review" | "verify";
-      inScope: boolean;
       name: string;
       scopeReason: string;
       status: "satisfied" | "unmet" | "out-of-scope";
@@ -4212,7 +4347,7 @@ declare const evaluateReadiness: (input: EvaluationInput) => {
         interior: number;
       };
       nextAction: "run-gate-cycle" | "accept-nonblocking-findings" | "escalate-to-triage" | "ready-for-human" | "advance-to-gate" | "run-interior-cycle";
-      stage: "interior" | "gate" | "interior-complete";
+      stage: "gate" | "interior" | "interior-complete";
       forcedTransition?: "gate-cap-exhausted" | "interior-cap-reached" | undefined;
     } | undefined;
     reviewRuns?: PrReviewResult[] | undefined;
@@ -4469,6 +4604,7 @@ declare const reviewFocusFromIssueBody: (body: string) => string | undefined;
 interface AssembleReviewPromptInput {
   base: string;
   changedFiles: string[];
+  cwd?: string;
   headSha: string;
   issueFocus?: IssueReviewFocus;
   kind: PrReviewKind;
@@ -4476,6 +4612,13 @@ interface AssembleReviewPromptInput {
   priorLedgerEntries?: FindingLedgerEntry[];
   profile: FactoryProjectProfile;
 }
+interface AssembleReviewPromptGitDependencies {
+  repositoryRoot: (cwd: string) => string;
+  showFileAtRef: (cwd: string, ref: string, absolutePath: string) => string | undefined;
+}
+interface AssembleReviewPromptDependencies {
+  git?: AssembleReviewPromptGitDependencies;
+}
 interface AssembledReviewPrompt {
   prompt: string;
   sections: ReviewPromptSection[];
@@ -4483,13 +4626,14 @@ interface AssembledReviewPrompt {
 declare const assembleReviewPrompt: ({
   base,
   changedFiles,
+  cwd,
   headSha,
   issueFocus,
   kind,
   patchId,
   priorLedgerEntries,
   profile
-}: AssembleReviewPromptInput) => AssembledReviewPrompt;
+}: AssembleReviewPromptInput, dependencies?: AssembleReviewPromptDependencies) => AssembledReviewPrompt;
 //#endregion
 //#region src/review-ladder-trace.d.ts
 interface ReviewLadderTraceIdentity {
@@ -4676,4 +4820,4 @@ interface CreateProgramOptions {
 declare function createProgram(options?: CreateProgramOptions): Command;
 declare function run(argv?: string[]): Promise<void>;
 //#endregion
-export { type AppendFactoryTraceEventResult, type AssembledReviewPrompt, type BatteryCommandDisposition, type BatteryDisposition, type BoundaryCheckArgs, type BoundaryCheckDependencies, type BoundaryCheckProofRecord, type BuildEpicStructureEventInput, type CloudflareAccessServiceToken, type CompletedFactoryCheckSnapshot, CreateProgramOptions, DEFAULT_DEMAND_WAIVER_PATH, DEFAULT_FACTORY_REPOSITORY, DEFAULT_ROOT_SHARED_GLOBS, type DagDocument, type DemandWaiveArgs, type DemandWaiveDependencies, DemandWaiveRefusalError, type DemandWaiver, type DemandWaiverStore, EMPTY_TREE_OBJECT_HASH, EPIC_STRUCTURE_NODE_STATUSES, EPIC_STRUCTURE_SCHEMA_VERSION, type EpicStructureEvent, type EpicStructureGraphPayload, type EpicStructureNodeStatus, EpicStructureValidationError, type EvidenceEmitArgs, type EvidenceEmitDependencies, type EvidenceEmitResult, FACTORY_BASE_REF_ENV, FACTORY_CHANGED_FILES_ENV, FACTORY_CHANGED_FILES_FILE_ENV, type FactoryCliInvocation, FactoryCliInvocationSchema, type FactoryPrStatusCheckName, type FactoryPrStatusSources, type FactoryProjectProfile, type FactoryTraceDiagnostic, type FactoryTraceEnvelope, type FactoryTraceEvent, type FindingDisposition, type FindingLedgerEntry, type FollowUpAction, FollowUpActionSchema, type ImpactScopeDecision, type ImpactScopeSurface, type IssueReviewFocus, type LadderDispositionDeclaration, MERGE_FREEZE_APP_SLUG, MERGE_FREEZE_CHECK_NAME, type MergeFreezeState, type PlanFactoryPrStatusHudInput, type PrPublishArgs, type PrPublishDependencies, PrPublishFollowUpError, type PrPublishFollowUpOutcome, type PrPublishHandoff, type PrPublishResult, type PrReadyArgs, type PrReadyProof, type PresentFactoryPrStatusHudDependencies, type PresentFactoryPrStatusHudInput, type PreviewDisposition, type PreviewLifecyclePlan, type PreviewTargetPlan, type PublishEpicStructureArgs, type PublishEpicStructureResult, type PublishFollowUpPlan, REVIEW_FOCUS_SECTION, type ReadFactoryPrStatusSourcesDependencies, type ReadFactoryPrStatusSourcesInput, type RefreshFactoryPrStatusHudInput, type RenderFactoryPrStatusHudInput, type ReviewGateNotRequiredProof, type ReviewGateTraceIdentity, type ReviewLadderCycle, type ReviewLadderEvaluation, type ReviewLadderPolicy, type ReviewLadderStageEvent, type ReviewLadderTraceIdentity, type ReviewPromptSection, type ReviewPromptSectionProvenance, type ScanFactoryTraceDiagnosticsOptions, type ScanFactoryTraceOptions, type ScanFactoryTraceResult, type ScopedOutCommand, type TraceMirrorDiagnostic, type TraceSink, type TraceWriteResult, type TraceWriteSinks, type VerificationBatteryPlan, type VerificationReuse, type VerificationRunContext, type VerificationRunContextInput, type WaivedDemand, WorkerCheckoutGuardError, type WorkerCloseoutLessonsTraceEvent, appendReviewLadderStageTraceEvent, appendWithTraceSinks, applyDemandWaiver, assembleReviewPrompt, assertFactoryPrStatusIdentity, assertWorkerCheckoutAllowed, authorizeDemandWaiver, batteryScopeSummaryLines, blockingLadderFindings, boundary_manifest_d_exports as boundaryManifest, boundary_review_proof_d_exports as boundaryReviewProof, buildEpicStructureEvent, buildEpicStructurePayload, buildEvidenceEnvelope, buildReviewGateNotRequiredTraceEvent, buildReviewLadderStageTraceEvent, comment_provenance_d_exports as commentProvenance, createLocalJsonlTraceSink, createProgram, createVerificationRunContext, doctorProjectProfile, epicStructureEventId, evaluateReviewLadder, evidenceEnvelopeFilename, findingKey, followUpFromArgv, impactStampScopeDecision, inferFixedInThreadDispositions, isProductionHqUrl, loadProjectProfile, normalizeIssueComments, openLadderFindings, planFactoryPrStatusHud, planPreviewLifecycle, planPublishFollowUp, planVerificationBattery, readiness_evaluation_d_exports as prReadinessEvaluation, external_evidence_d_exports as prReadinessExternalEvidence, pr_body_renderer_d_exports as prReadinessPrBodyRenderer, proof_identity_d_exports as prReadinessProofIdentity, review_proof_d_exports as prReadinessReviewProof, status_check_rollup_d_exports as prReadinessStatusChecks, verification_proof_d_exports as prReadinessVerificationProof, presentFactoryPrStatusHud, previewLifecycleTargets, publishEpicStructure, readDemandWaivers, readFactoryPrStatusSources, readPrReadyProof, readPrReviewProof, refreshFactoryPrStatusHud, refreshFactoryPrStatusHudSafely, renderFactoryPrStatusHud, resolveFactoryRepository, resolveFindingBlocking, resolveReviewFindingCategory, resolveReviewFindingSeverity, resolveReviewLadderPolicy, resolveTraceWriteSinks, reviewCycleStateFor, reviewFocusFromIssueBody, reviewPromptSectionSchema, reviewPromptSectionsSchema, run, runBoundaryCheck, runDemandWaive, runEvidenceEmit, runPrPublish, runPrReady, runPrReview, runPrVerify, scanFactoryTraceDiagnostics, scanFactoryTraceEvents, selectWaiversForCandidate, staleRepeatLadderFindings, toFactoryTraceEnvelope, tryAppendReviewGateNotRequiredTraceEvent, tryAppendReviewLadderStageTraceEvent, validateBoundaryCheckProof, validateDagDocument, validateDemandWaiverStore, validateFactoryTraceEvent, validateMergeFreezeState, validatePrReadyProof, validatePrReviewProof, validatePrVerifyProof, validatePreviewLifecyclePlan, waivedDemandNotice, waivedDemandSchema, worktree_scratch_files_d_exports as worktreeScratchFiles };
+export { type AppendFactoryTraceEventResult, type AssembledReviewPrompt, type BatteryCommandDisposition, type BatteryDisposition, type BoundaryCheckArgs, type BoundaryCheckDependencies, type BoundaryCheckProofRecord, type BuildEpicStructureEventInput, type CloudflareAccessServiceToken, type CompletedFactoryCheckSnapshot, CreateProgramOptions, DEFAULT_DEMAND_WAIVER_PATH, DEFAULT_FACTORY_REPOSITORY, DEFAULT_ROOT_SHARED_GLOBS, type DagDocument, type DemandWaiveArgs, type DemandWaiveDependencies, DemandWaiveRefusalError, type DemandWaiver, type DemandWaiverStore, EMPTY_TREE_OBJECT_HASH, EPIC_STRUCTURE_NODE_STATUSES, EPIC_STRUCTURE_SCHEMA_VERSION, type EpicStructureEvent, type EpicStructureGraphPayload, type EpicStructureNodeStatus, EpicStructureValidationError, type EvidenceEmitArgs, type EvidenceEmitDependencies, type EvidenceEmitResult, FACTORY_BASE_REF_ENV, FACTORY_CHANGED_FILES_ENV, FACTORY_CHANGED_FILES_FILE_ENV, type FactoryCliInvocation, FactoryCliInvocationSchema, type FactoryPrStatusCheckName, type FactoryPrStatusSources, type FactoryProjectProfile, type FactoryTraceDiagnostic, type FactoryTraceEnvelope, type FactoryTraceEvent, type FindingDisposition, type FindingLedgerEntry, type FollowUpAction, FollowUpActionSchema, type GitHubCheckRunMergeFreezeApi, type ImpactScopeDecision, type ImpactScopeSurface, type IssueReviewFocus, type LadderDispositionDeclaration, MERGE_FREEZE_APP_SLUG, MERGE_FREEZE_CHECK_NAME, type MergeFreezeAuthority, type MergeFreezeGeneration, type MergeFreezeState, type MergeFreezeStoreInput, type PlanFactoryPrStatusHudInput, type PrPublishArgs, type PrPublishDependencies, PrPublishFollowUpError, type PrPublishFollowUpOutcome, type PrPublishHandoff, type PrPublishResult, type PrReadyArgs, type PrReadyProof, type PresentFactoryPrStatusHudDependencies, type PresentFactoryPrStatusHudInput, type PreviewDisposition, type PreviewLifecyclePlan, type PreviewTargetPlan, type PublishEpicStructureArgs, type PublishEpicStructureResult, type PublishFollowUpPlan, REVIEW_FOCUS_SECTION, type ReadFactoryPrStatusSourcesDependencies, type ReadFactoryPrStatusSourcesInput, type RefreshFactoryPrStatusHudInput, type RenderFactoryPrStatusHudInput, type ReviewGateNotRequiredProof, type ReviewGateTraceIdentity, type ReviewLadderCycle, type ReviewLadderEvaluation, type ReviewLadderPolicy, type ReviewLadderStageEvent, type ReviewLadderTraceIdentity, type ReviewPromptSection, type ReviewPromptSectionProvenance, type ScanFactoryTraceDiagnosticsOptions, type ScanFactoryTraceOptions, type ScanFactoryTraceResult, type ScopedOutCommand, type TraceMirrorDiagnostic, type TraceSink, type TraceWriteResult, type TraceWriteSinks, type VerificationBatteryPlan, type VerificationReuse, type VerificationRunContext, type VerificationRunContextInput, type WaivedDemand, WorkerCheckoutGuardError, type WorkerCloseoutLessonsTraceEvent, appendReviewLadderStageTraceEvent, appendWithTraceSinks, applyDemandWaiver, assembleReviewPrompt, assertFactoryPrStatusIdentity, assertWorkerCheckoutAllowed, authorizeDemandWaiver, batteryScopeSummaryLines, blockingLadderFindings, boundary_manifest_d_exports as boundaryManifest, boundary_review_proof_d_exports as boundaryReviewProof, buildEpicStructureEvent, buildEpicStructurePayload, buildEvidenceEnvelope, buildReviewGateNotRequiredTraceEvent, buildReviewLadderStageTraceEvent, comment_provenance_d_exports as commentProvenance, createGitHubCheckRunMergeFreezeStore, createLocalJsonlTraceSink, createProgram, createVerificationRunContext, doctorProjectProfile, epicStructureEventId, evaluateReviewLadder, evidenceEnvelopeFilename, findingKey, followUpFromArgv, impactStampScopeDecision, inferFixedInThreadDispositions, isProductionHqUrl, loadProjectProfile, normalizeIssueComments, openLadderFindings, planFactoryPrStatusHud, planPreviewLifecycle, planPublishFollowUp, planVerificationBattery, readiness_evaluation_d_exports as prReadinessEvaluation, external_evidence_d_exports as prReadinessExternalEvidence, pr_body_renderer_d_exports as prReadinessPrBodyRenderer, proof_identity_d_exports as prReadinessProofIdentity, review_proof_d_exports as prReadinessReviewProof, status_check_rollup_d_exports as prReadinessStatusChecks, verification_proof_d_exports as prReadinessVerificationProof, presentFactoryPrStatusHud, previewLifecycleTargets, publishEpicStructure, readDemandWaivers, readFactoryPrStatusSources, readPrReadyProof, readPrReviewProof, refreshFactoryPrStatusHud, refreshFactoryPrStatusHudSafely, renderFactoryPrStatusHud, resolveFactoryRepository, resolveFindingBlocking, resolveReviewFindingCategory, resolveReviewFindingSeverity, resolveReviewLadderPolicy, resolveTraceWriteSinks, reviewCycleStateFor, reviewFocusFromIssueBody, reviewPromptSectionSchema, reviewPromptSectionsSchema, run, runBoundaryCheck, runDemandWaive, runEvidenceEmit, runPrPublish, runPrReady, runPrReview, runPrVerify, scanFactoryTraceDiagnostics, scanFactoryTraceEvents, selectWaiversForCandidate, staleRepeatLadderFindings, toFactoryTraceEnvelope, tryAppendReviewGateNotRequiredTraceEvent, tryAppendReviewLadderStageTraceEvent, validateBoundaryCheckProof, validateDagDocument, validateDemandWaiverStore, validateFactoryTraceEvent, validateMergeFreezeState, validatePrReadyProof, validatePrReviewProof, validatePrVerifyProof, validatePreviewLifecyclePlan, waivedDemandNotice, waivedDemandSchema, worktree_scratch_files_d_exports as worktreeScratchFiles };