@patronage/software-factory 1.0.0-alpha.27 → 1.0.0-alpha.29

package/dist/index.js

@@ -18,7 +18,7 @@ import { FACTORY_APP_BROKER_ORIGIN, FACTORY_APP_BROKER_PATH, FACTORY_CURSOR_OIDC
 import http from "node:http";
 import { pathToFileURL } from "node:url";
 //#region package.json
-var version = "1.0.0-alpha.27";
+var version = "1.0.0-alpha.29";
 //#endregion
 //#region src/cli-entry.ts
 /**
@@ -6576,10 +6576,48 @@ function verifyOutput(proof) {
 		title: `pr:verify ${value.outcome ?? "unknown"}`
 	};
 }
+/**
+* The refusals to name, preferring the attributed projection (#391) so each
+* line carries its demand code. `blockingReasons` is the fallback because the
+* throwing path in `pr:ready` publishes a proof that carries only that field.
+* The two projections hold the same refusals in the same order, so reading
+* either one tells the same story.
+*/
+const readyReasonLines = (value) => {
+	const named = value.blockedReasons ?? [];
+	if (named.length > 0) return named.map((reason) => ({
+		...reason.code === void 0 ? {} : { code: reason.code },
+		detail: reason.detail ?? "unrecorded"
+	}));
+	return (value.blockingReasons ?? []).map((reason) => ({ detail: typeof reason === "string" ? reason : "unrecorded" }));
+};
+const readyReasonBlock = (reasons) => {
+	return `\n\n${reasons.length === 1 ? "1 blocking reason:" : `${reasons.length} blocking reasons:`}\n\n${reasons.map((reason) => `- ${reason.code === void 0 ? "" : `**${reason.code}** — `}${reason.detail}`).join("\n")}`;
+};
+const readyIdentityField = (value) => value === void 0 || value.trim().length === 0 ? "unrecorded" : `\`${value}\``;
+/**
+* #1037: the review identity the proof already records, printed where the
+* merge decision is made. `pr:ready` recorded the review session, model, and
+* producer, and the authoring session it was checked against, but only the PR
+* body prose showed them — so a human merging from the checks page could not
+* see which model produced the review that admitted the candidate.
+*
+* This is recording made visible, not a control. The attended merge is the
+* control.
+*/
+const readyIdentityBlock = (value) => {
+	const runs = value.ledger?.reviewRuns ?? [];
+	if (runs.length === 0 && value.authoringSession === void 0) return "";
+	return `\n\nRecorded review identity:\n\n${[...runs.map((run) => {
+		const rung = run.rung === void 0 ? "" : ` at rung \`${run.rung}\``;
+		return `- ${run.kind ?? "review"}${rung}: session ${readyIdentityField(run.sessionId)} · model ${readyIdentityField(run.model)} · producer ${readyIdentityField(run.producer)}`;
+	}), `- authoring session: ${readyIdentityField(value.authoringSession)}`].join("\n")}`;
+};
 function readyOutput(proof) {
 	const value = proof;
+	const reasons = readyReasonLines(value);
 	return {
-		summary: `Schema v${value.schemaVersion}; readiness verdict **${value.status ?? "unknown"}**; ${value.blockingReasons?.length ?? 0} blocking reason(s); ledger head \`${value.ledger?.headSha ?? "unknown"}\`.`,
+		summary: `${`Schema v${value.schemaVersion}; readiness verdict **${value.status ?? "unknown"}**;${reasons.length === 0 ? " no blocking reasons;" : ""} ledger head \`${value.ledger?.headSha ?? "unknown"}\`.`}${reasons.length === 0 ? "" : readyReasonBlock(reasons)}${readyIdentityBlock(value)}`,
 		title: `pr:ready ${value.status ?? "unknown"}`
 	};
 }
@@ -7508,6 +7546,15 @@ const assertPrVerifyProofRules = (proof, context) => {
 * factory must adopt this release before HQ ingests its pr:verify proofs.
 */
 const SUPPORTED_PR_VERIFY_SCHEMA_VERSIONS = [4];
+const prVerifyTestFailureSchema = z.object({
+	file: z.string().min(1),
+	kind: z.enum([
+		"assertion",
+		"error",
+		"timeout"
+	]),
+	title: z.string().min(1)
+});
 const executedCommandSchema = z.object({
 	command: z.string().min(1),
 	counts: z.object({
@@ -7516,6 +7563,7 @@ const executedCommandSchema = z.object({
 	}).optional(),
 	durationMs: z.number().nonnegative(),
 	exitCode: z.number(),
+	failures: z.array(prVerifyTestFailureSchema).min(1).optional(),
 	name: z.string().min(1),
 	scope: z.enum([
 		"docs-only",
@@ -7797,6 +7845,13 @@ const verificationProofForReadiness = (state) => {
 const failedExecutedCommand = (proof) => {
 	return proof.executedCommands?.find((command) => command.exitCode !== 0) ?? proof.executedCommands?.at(-1);
 };
+const MAX_NAMED_TEST_FAILURES = 3;
+const formatFailedTests = (failures) => {
+	if (!failures || failures.length === 0) return "";
+	const named = failures.slice(0, MAX_NAMED_TEST_FAILURES).map((failure) => `${failure.file} > ${failure.title} (${failure.kind})`).join("; ");
+	const remaining = failures.length - MAX_NAMED_TEST_FAILURES;
+	return remaining > 0 ? ` on ${named}; and ${remaining} more failing test${remaining === 1 ? "" : "s"}` : ` on ${named}`;
+};
 const verificationProofBlockingReason = (state) => {
 	if (state.kind === "typed-missing") {
 		if (state.reason === "enoent") return `Typed pr:verify proof at ${state.path} does not exist; pr:verify has not run for this PR head. Run patronage-factory pr:verify.`;
@@ -7808,7 +7863,7 @@ const verificationProofBlockingReason = (state) => {
 	}
 	if (state.kind === "typed-aborted") {
 		const failed = failedExecutedCommand(state.proof);
-		if (failed) return `Typed pr:verify proof shows verification aborted at ${failed.name} (exit code ${failed.exitCode}); verification did not pass. Re-run patronage-factory pr:verify.`;
+		if (failed) return `Typed pr:verify proof shows verification aborted at ${failed.name} (exit code ${failed.exitCode})${formatFailedTests(failed.failures)}; verification did not pass. Re-run patronage-factory pr:verify.`;
 		return "Typed pr:verify proof shows verification aborted; verification did not pass. Re-run patronage-factory pr:verify.";
 	}
 };
@@ -8036,6 +8091,111 @@ function parseVitestCounts(stdout) {
 	if (testsMatch) counts.tests = Number(testsMatch.groups?.total ?? testsMatch.groups?.passed);
 	return counts;
 }
+const MAX_RECORDED_TEST_FAILURES = 50;
+const ANSI_ESCAPE_PATTERN = /\u001B\[[0-9;]*m/gu;
+/**
+* Vitest's per-failure header: `FAIL  <file> > <suite> > <test title>`. This
+* pattern claims only the `FAIL ` prefix; `splitVitestFailHeader` below reads
+* the rest, because a multi-project run puts a project label between `FAIL`
+* and the file and its shape depends on color support.
+*/
+const VITEST_FAIL_HEADER_PATTERN = /^\s*FAIL\s+(?<rest>\S.*)$/u;
+/** Vitest separates the file, each suite, and the test title with ` > `. */
+const VITEST_TITLE_SEPARATOR = " > ";
+/**
+* Splits a failure header into the failing file and the full test title.
+*
+* The file is the LAST whitespace-separated token before the first ` > `,
+* which is what makes this survive a multi-project run. Vitest's
+* `formatProjectName` writes the project label as `|name|` when color is
+* unsupported and as a color-boxed ` name ` when it is; after this module
+* strips the SGR codes both leave the label as its own token ahead of the
+* file, and both drop out here. The title keeps every suite name, so the
+* split is on the FIRST separator and never a later one.
+*
+* Answers `undefined` for a header that names no test.
+*/
+const splitVitestFailHeader = (rest) => {
+	const separatorIndex = rest.indexOf(VITEST_TITLE_SEPARATOR);
+	if (separatorIndex === -1) return;
+	const file = rest.slice(0, separatorIndex).trim().split(/\s+/u).at(-1);
+	const title = rest.slice(separatorIndex + 3).trim();
+	if (!file || title.length === 0) return;
+	return {
+		file,
+		title
+	};
+};
+const VITEST_TIMEOUT_PATTERN = /^\s*\S*Error:\s+Test timed out in /u;
+const VITEST_ASSERTION_PATTERN = /^\s*\S*AssertionError\b/u;
+/**
+* Reads the failure class off the error line under a failure header. Anything
+* that is neither the test-timeout error nor an assertion error — including a
+* line that is not error-shaped at all — classifies as `error` rather than
+* guessing at a narrower class.
+*/
+const classifyVitestFailure = (errorLine) => {
+	if (errorLine === void 0) return "error";
+	if (VITEST_TIMEOUT_PATTERN.test(errorLine)) return "timeout";
+	if (VITEST_ASSERTION_PATTERN.test(errorLine)) return "assertion";
+	return "error";
+};
+/**
+* Scrapes the failing tests out of a vitest run's console output (#1035).
+*
+* Callers pass BOTH captured streams: vitest writes its `Failed Tests`
+* section to stderr, so stdout alone carries no failure header.
+*
+* Deliberately line-shaped, the same class of scan as `parseVitestCounts`
+* above: it reads the `FAIL <file> > <title>` header and the error line that
+* follows it, and nothing else. It must never grow toward a parser of vitest's
+* report. Output it does not recognize yields an empty list, never a throw —
+* an unreadable report is a proof that records no failures, not a verification
+* run that crashes while writing why it failed.
+*/
+function parseVitestFailures(stdout) {
+	const lines = stdout.replace(ANSI_ESCAPE_PATTERN, "").split(/\r?\n/u);
+	const failures = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const [index, line] of lines.entries()) {
+		const header = line.match(VITEST_FAIL_HEADER_PATTERN);
+		if (!header?.groups?.rest) continue;
+		const split = splitVitestFailHeader(header.groups.rest);
+		if (!split) continue;
+		const { file, title } = split;
+		const key = `${file}\u0000${title}`;
+		if (seen.has(key)) continue;
+		seen.add(key);
+		const errorLine = lines.slice(index + 1, index + 3).find((candidate) => candidate.trim().length > 0);
+		failures.push({
+			file,
+			kind: classifyVitestFailure(errorLine),
+			title
+		});
+		if (failures.length >= MAX_RECORDED_TEST_FAILURES) break;
+	}
+	return failures;
+}
+/**
+* Reduces one captured verification run to the outcome the proof records.
+*
+* Which stream each scan reads is the load-bearing decision here. Vitest's
+* default reporter prints the run tree and the `Test Files` summary that
+* `parseVitestCounts` reads to stdout, but prints the whole `Failed Tests`
+* section — every `FAIL` header and every error line — through
+* `logger.error`, which is stderr. Scanning stdout alone for failures finds
+* none at all, so the failure scan reads both streams.
+*/
+function verificationOutcomeOf(result) {
+	const counts = parseVitestCounts(result.stdout);
+	const failures = result.exitCode === 0 ? [] : parseVitestFailures(`${result.stdout}\n${result.stderr}`);
+	return {
+		...counts ? { counts } : {},
+		durationMs: result.durationMs,
+		exitCode: result.exitCode,
+		...failures.length > 0 ? { failures } : {}
+	};
+}
 function defaultPrVerifyGit() {
 	return {
 		changedFiles,
@@ -8044,13 +8204,7 @@ function defaultPrVerifyGit() {
 		mergeBaseSha,
 		recognizeCatchUp: recognizeCatchUpCandidate,
 		runVerificationCommand(command, cwd, env) {
-			const result = runInheritedTee("bash", ["-lc", command], cwd, env);
-			const counts = parseVitestCounts(result.stdout);
-			return {
-				...counts ? { counts } : {},
-				durationMs: result.durationMs,
-				exitCode: result.exitCode
-			};
+			return verificationOutcomeOf(runInheritedTee("bash", ["-lc", command], cwd, env));
 		},
 		showFileAtRef,
 		stablePatchId: runStablePatchId,
@@ -8136,6 +8290,19 @@ function formatVerifyTimingSummary(proof) {
 	}
 	return lines.join("\n");
 }
+/**
+* The line `pr:verify` prints last when it aborts (#1035): where the record
+* is, which command failed, and — when the command reported them — which
+* tests failed and in what class. A timeout under machine load and a real
+* assertion look identical without this, so every red verify used to cost a
+* full visible rerun just to read a test title.
+*/
+function formatVerifyFailurePointer(proof, proofPath) {
+	const failed = proof.executedCommands?.find((command) => command.exitCode !== 0);
+	const lines = [failed ? `pr:verify aborted at ${failed.name} (exit code ${failed.exitCode}); record: ${proofPath}` : `pr:verify aborted; record: ${proofPath}`];
+	for (const failure of failed?.failures ?? []) lines.push(`  ${failure.kind}: ${failure.file} > ${failure.title}`);
+	return lines.join("\n");
+}
 function resolveMode({ classification, mode }) {
 	if (mode === "auto") {
 		if (classification === "docs/process-only") return "docs-only";
@@ -8299,6 +8466,7 @@ function runPrVerify(args, dependencies = {}) {
 		writeProofCopies(proof);
 		failureProofWritten = true;
 		if (executedCommands.length > 0) console.log(`\n${formatVerifyTimingSummary(proof)}`);
+		console.log(`\n${formatVerifyFailurePointer(proof, output)}`);
 		publishFactoryCheckSafely(publishCheckRun, {
 			conclusion: "failure",
 			cwd,
@@ -8321,7 +8489,8 @@ function runPrVerify(args, dependencies = {}) {
 				exitCode: result.exitCode,
 				name: command.name,
 				scope: command.scope,
-				...result.counts ? { counts: result.counts } : {}
+				...result.counts ? { counts: result.counts } : {},
+				...result.failures && result.failures.length > 0 ? { failures: result.failures } : {}
 			};
 			executedCommands.push(executedCommand);
 			if (result.exitCode !== 0) {
@@ -9706,6 +9875,7 @@ z.object({
 			"not-armed"
 		])
 	}).optional(),
+	authoringSession: z.string().min(1).optional(),
 	blockedReasons: blockedReasonsSchema.optional(),
 	blockingReasons: z.array(z.string()),
 	command: z.literal("patronage-factory pr:ready"),
@@ -14638,9 +14808,13 @@ const renderPrBodySections = ({ reviewProof, verifyProof }) => `${renderPrBodySe
 //#region src/pr-readiness/status-check-rollup.ts
 var status_check_rollup_exports = /* @__PURE__ */ __exportAll({
 	HOSTED_VERIFY_CHECK_NAME: () => HOSTED_VERIFY_CHECK_NAME$1,
+	HOSTED_VERIFY_DRAFT_CHECK_NAME: () => HOSTED_VERIFY_DRAFT_CHECK_NAME,
 	hostedVerifyCheckState: () => hostedVerifyCheckState,
+	isDraftHostedVerifyCheck: () => isDraftHostedVerifyCheck,
+	isExcludedFromAdmissionChecks: () => isExcludedFromAdmissionChecks,
 	isFactoryReadyCheck: () => isFactoryReadyCheck,
 	isHostedVerifyCheck: () => isHostedVerifyCheck,
+	isSupersededHostedVerifyCheck: () => isSupersededHostedVerifyCheck,
 	pendingCheckNames: () => pendingCheckNames,
 	statusCheckState: () => statusCheckState
 });
@@ -14683,6 +14857,39 @@ const HOSTED_VERIFY_CHECK_NAME$1 = "verify";
 */
 const isHostedVerifyCheck = (check) => check.name === "verify" && Boolean(check.workflowName);
 /**
+* The name the hosted summary job takes on a DRAFT head (#1045).
+*
+* The workflow renames that job so the pinned `verify` context does not exist
+* while the candidate is a draft. The generator that emits the workflow owns
+* the literal; this is the reader's copy of it, and
+* `software-factory-hq/alchemy/verify-workflow.test.ts` pins the two equal.
+*/
+const HOSTED_VERIFY_DRAFT_CHECK_NAME = `${HOSTED_VERIFY_CHECK_NAME$1} (draft)`;
+/**
+* Is this the draft-head summary run's residue?
+*
+* The draft run and the `ready_for_review` run land on the SAME head SHA, and
+* they post two different contexts — `verify (draft)` and `verify` — which
+* `effectiveChecks` keys separately and therefore never collapses. The Verify
+* workflow cancels an in-flight pull-request run when the next one starts, and
+* `ready_for_review` IS the next one, so undrafting typically cancels the
+* draft run mid-flight. That leaves a CANCELLED `verify (draft)` row sitting
+* next to a green `verify` on the admitted head.
+*
+* GitHub does not care: the branch ruleset pins `verify` alone. The factory's
+* own rollup read would: `CANCELLED` is a failed state, so the candidate's
+* `requiredChecks` would read `failed` forever and no push-free repair could
+* clear it. The draft run is a superseded generation of the summary job the
+* `verify` row already answers for, so admission does not judge it.
+*/
+const isDraftHostedVerifyCheck = (check) => check.name === HOSTED_VERIFY_DRAFT_CHECK_NAME && Boolean(check.workflowName);
+/**
+* The rollup rows an admission read must not judge: the factory's own branded
+* checks (it would be judging itself) and the draft-head summary residue
+* above.
+*/
+const isExcludedFromAdmissionChecks = (check) => isFactoryReadyCheck(check) || isDraftHostedVerifyCheck(check);
+/**
 * The hosted `verify` gate's state on this head, read by presence (#477).
 *
 * This is the one rollup question the rollup can answer honestly. Wave 2
@@ -14769,6 +14976,31 @@ const statusCheckState = (rollup, exclude) => {
 	if (currentChecks.some((check) => PENDING_STATES.has(progressState(check)))) return "pending";
 	return "unknown";
 };
+/**
+* Is this a hosted `verify` check run that GitHub started before `cutoffIso`?
+* (#1045)
+*
+* A caller that waits for `verify` on a head it just changed the state of —
+* `pr:publish` undrafting a candidate — must not accept the run that was
+* already there. #1034's history is the shape: a draft head carried a `verify`
+* that had run nothing, the wait saw it as terminal on its first attempt, and
+* readiness read `passed` about two minutes before the `ready_for_review` run
+* created its own check runs. The same shape is reachable from any superseded
+* `verify` generation still on the head.
+*
+* Fail CLOSED on an unreadable timestamp: a `verify` row that cannot be shown
+* to be newer than the cutoff is treated as superseded. The wait is bounded,
+* so the cost of that refusal is one timeout that falls through to the
+* caller's existing behaviour; the cost of failing open is the false green
+* this exists to remove.
+*/
+const isSupersededHostedVerifyCheck = (check, cutoffIso) => {
+	if (!isHostedVerifyCheck(check)) return false;
+	const startedMs = checkTimestampMs(check);
+	const cutoffMs = Date.parse(cutoffIso);
+	if (startedMs === void 0 || Number.isNaN(cutoffMs)) return true;
+	return startedMs < cutoffMs;
+};
 //#endregion
 //#region src/arm-auto-merge.ts
 /**
@@ -15605,6 +15837,43 @@ const requiredChecksEvaluation = (input) => {
 		outcomes
 	};
 };
+/**
+* REPAIR SITES 2 and 3 of 3 (#1045). #1048 makes the permitted set a type:
+* only a `RepairableDemand` blocker may carry a repair, so a fourth site on a
+* proof refusal fails `tsc`. The type keys on the demand, not on the state, so
+* it still permits a repair on a FAILED required check — the evaluator test
+* that turns every non-route-owned refusal on at once pins that half.
+*
+* Both hosted-check demands in `collectBlockers` are route-owned in exactly
+* two states, and in both the repair is the same one — wait for the NEXT
+* hosted run:
+*
+* 1. `requiredChecks === "pending"`: a run is in flight on this head.
+* 2. `draft === true`: the candidate is a draft, so the hosted verification
+*    workflow deliberately posts no `verify` context at all (#1045 — `core`
+*    and `docs` skip on a draft, and the summary job is renamed so the pinned
+*    context is ABSENT rather than a green or gray check that ran nothing).
+*    Absence is what `hostedVerifyCheck: "none"` reports, so without this
+*    repair a draft would raise a human blocker no human can clear, and
+*    `pr:ready` would publish a red check on every draft — the notification
+*    noise #1037 removed.
+*
+* Draft is route-owned by construction: `pr:publish` undrafts the candidate
+* itself, and the repair is literally named `await-post-undraft-checks`
+* because it is about the run the promotion triggers.
+*
+* A draft whose checks came back FAILED is deliberately excluded: a real red
+* is not a not-yet, and waiting for another run would not clear it. That stays
+* a human blocker, exactly as it is today.
+*/
+const awaitPostUndraftChecksRepair = (input) => {
+	if (!(input.requiredChecks === "pending" || input.draft && input.requiredChecks !== "failed")) return {};
+	return { repair: {
+		action: "Poll and retry until post-undraft GitHub checks settle or fail; a draft head and UNSTABLE/pending are transient route-owned states, not human blockers.",
+		code: "await-post-undraft-checks",
+		command: `gh pr checks ${input.pr} --watch`
+	} };
+};
 const collectBlockers = ({ correctnessRequired, correctnessStatus, correctnessUntyped, input, prVerifyStatus, verificationProof, securityRequired, securityStatus, securityUntyped }) => {
 	const blockers = [];
 	if (prVerifyStatus === "missing") blockers.push({
@@ -15652,22 +15921,21 @@ const collectBlockers = ({ correctnessRequired, correctnessStatus, correctnessUn
 		demand: DEMAND_KEYS.mergeState,
 		reason: `GitHub merge state is ${input.mergeStateStatus}/${input.mergeable}; expected CLEAN or review-only BLOCKED with MERGEABLE.`
 	});
+	const awaitPostUndraftChecks = awaitPostUndraftChecksRepair(input);
 	if ((input.hostedVerifyCheck ?? "none") === "none") blockers.push({
 		demand: DEMAND_KEYS.githubChecks,
-		reason: `GitHub has no ${HOSTED_VERIFY_CHECK_NAME$1} check run from its workflow producer on this head; the branch ruleset pins it as a required check and the status rollup does not report the shortfall.`
+		reason: `GitHub has no ${HOSTED_VERIFY_CHECK_NAME$1} check run from its workflow producer on this head; the branch ruleset pins it as a required check and the status rollup does not report the shortfall.`,
+		...awaitPostUndraftChecks
 	});
 	if (input.requiredChecks === "none" && input.classification !== "docs/process-only") blockers.push({
 		demand: DEMAND_KEYS.githubChecks,
-		reason: "GitHub has no current checks for a non-docs PR."
+		reason: "GitHub has no current checks for a non-docs PR.",
+		...awaitPostUndraftChecks
 	});
 	else if (input.requiredChecks !== "passed" && input.requiredChecks !== "none") blockers.push({
 		demand: DEMAND_KEYS.githubChecks,
 		reason: `${PENDING_CHECKS_BLOCKER_REASON_PREFIX} ${input.requiredChecks}; expected passed.`,
-		...input.requiredChecks === "pending" ? { repair: {
-			action: "Poll and retry until post-undraft GitHub checks settle or fail; UNSTABLE/pending is a transient route-owned state, not a human blocker.",
-			code: "await-post-undraft-checks",
-			command: `gh pr checks ${input.pr} --watch`
-		} } : {}
+		...awaitPostUndraftChecks
 	});
 	if (input.draft) {
 		const promotion = prUndraftFollowUp(input.pr);
@@ -15683,7 +15951,7 @@ const collectBlockers = ({ correctnessRequired, correctnessStatus, correctnessUn
 	}
 	return blockers;
 };
-const orderRepairs = (repairs) => repairs.toSorted((a, b) => READINESS_REPAIR_CODES.indexOf(a.code) - READINESS_REPAIR_CODES.indexOf(b.code));
+const orderRepairs = (repairs) => [...new Map(repairs.map((repair) => [repair.code, repair])).values()].toSorted((a, b) => READINESS_REPAIR_CODES.indexOf(a.code) - READINESS_REPAIR_CODES.indexOf(b.code));
 const verificationProofForInput = ({ input }) => {
 	if (input.verificationProof) return {
 		fullVerifiedHeadShas: input.docsOnlyVerifyBaselineHeadShas,
@@ -16668,6 +16936,7 @@ const prReadyProofSchema = z.object({
 			"not-armed"
 		])
 	}).optional(),
+	authoringSession: z.string().min(1).optional(),
 	blockedReasons: blockedReasonsSchema.optional(),
 	blockingReasons: z.array(z.string()),
 	command: z.literal("patronage-factory pr:ready"),
@@ -16994,7 +17263,7 @@ async function runPrReady(args, dependencies = {}) {
 			requiredChecks
 		});
 		const output = path.resolve(cwd, args.output ?? ".factory-memory/pr-ready.json");
-		const externalCheckState = statusCheckState(pr.statusCheckRollup, isFactoryReadyCheck);
+		const externalCheckState = statusCheckState(pr.statusCheckRollup, isExcludedFromAdmissionChecks);
 		const hostedVerifyCheck = hostedVerifyCheckState(pr.statusCheckRollup);
 		const effectiveMergeStateStatus = pr.mergeStateStatus === "UNSTABLE" && (externalCheckState === "passed" || externalCheckState === "pending" || externalCheckState === "none") ? "CLEAN" : pr.mergeStateStatus;
 		const mergeFreeze = armingMergeFreezeOutcome({
@@ -17056,6 +17325,7 @@ async function runPrReady(args, dependencies = {}) {
 		});
 		const undraftRepair = evaluation.repairs.find((repair) => repair.code === "undraft-pr");
 		const pendingExternalChecksOnly = externalCheckState === "pending" && evaluation.blockingReasons.length === 1;
+		const routeOwnedNotYetOnly = evaluation.status === "blocked" && evaluation.humanBlockingReasons.length === 0;
 		const boundary = waveDemand?.kind === "demanded" ? waveDemand.demand : void 0;
 		const arming = evaluation.status === "ready" && boundary?.autoMerge === true ? (dependencies.armAutoMerge ?? armAutoMerge)({
 			cwd,
@@ -17088,10 +17358,12 @@ async function runPrReady(args, dependencies = {}) {
 			...arming ? [armingNotice(arming)] : [],
 			...waveDemand?.notices ?? [],
 			...evaluation.status === "ready" && !boundary ? ["No boundary wave authorized this candidate, so nothing was armed: pr:ready admits it but schedules no merge. Re-run with --epic <issue> to resolve the wave demand and arm. That issue can be the work issue itself, carrying its own fence; do not file a second boundary issue for one candidate."] : [],
-			...evaluation.status === "ready" && boundary?.autoMerge === false ? [`This candidate is admitted but unscheduled: boundary wave ${boundary.wave} does not authorize machine merge. GitHub auto-merge remains disabled; use the attended merge operation authorized for this wave.`] : []
+			...evaluation.status === "ready" && boundary?.autoMerge === false ? [`This candidate is admitted but unscheduled: boundary wave ${boundary.wave} does not authorize machine merge. GitHub auto-merge remains disabled; use the attended merge operation authorized for this wave.`] : [],
+			...routeOwnedNotYetOnly ? [`No ${FACTORY_CHECK_NAMES["pr-ready"]} check run was published for ${pr.headRefOid}: every refusal on this run is route-owned and not yet cleared (${evaluation.repairs.map((repair) => repair.code).join(", ")}). An absent required check blocks the merge, so the silence admits nothing; a proof failure still publishes a red check. Clear the repair and re-run pr:ready to green the head.`] : []
 		];
 		const proof = {
 			...arming ? { arming } : {},
+			...authoringSession ? { authoringSession } : {},
 			...evaluation.blockedReasons.length > 0 ? { blockedReasons: evaluation.blockedReasons } : {},
 			blockingReasons: evaluation.blockingReasons,
 			command: "patronage-factory pr:ready",
@@ -17119,7 +17391,7 @@ async function runPrReady(args, dependencies = {}) {
 			sha: pr.headRefOid,
 			conclusion: CHECK_CONCLUSION_BY_READINESS_STATUS[proof.status]
 		};
-		const publishedFinalCheck = await (dependencies.publishFinalCheckRun ? dependencies.publishFinalCheckRun(finalCheckInput) : ensureFactoryCheckRunPublished(finalCheckInput, { onDiagnostic: (message) => process.stderr.write(message) }));
+		const publishedFinalCheck = routeOwnedNotYetOnly || await (dependencies.publishFinalCheckRun ? dependencies.publishFinalCheckRun(finalCheckInput) : ensureFactoryCheckRunPublished(finalCheckInput, { onDiagnostic: (message) => process.stderr.write(message) }));
 		finalCheckPublished = true;
 		if (!publishedFinalCheck) {
 			notices.push(`The ${FACTORY_CHECK_NAMES["pr-ready"]} check run was NOT confirmed for ${pr.headRefOid}, so GitHub is not serving this run's verdict as the settled state of the required check. Either the publication never landed there, or another run of that name is still unfinished on this head (#524) — an unfinished run blocks the merge whatever this run published, and publishing a newer one does not clear it. GitHub reports no rollup reason for either. Re-run pr:ready once the factory GitHub App can post; if it stays unconfirmed, look for a non-terminal ${FACTORY_CHECK_NAMES["pr-ready"]} run on ${pr.headRefOid}.`);
@@ -17504,10 +17776,20 @@ function emitLadderStageTrace({ cwd, evaluation, headSha, issue, patchId, profil
 }
 //#endregion
 //#region src/review-contract.ts
-const REVIEW_FOOTER_INSTRUCTIONS = `Do not print a machine-readable footer in your chat response. Instead, write your findings to the typed findings file at the path given in your dispatch/task instructions (the file pr:review reads via --findings <path>). The file must be valid JSON matching review-findings-file.ts's schema (schemaVersion 1):
+const SESSION_ID_RULE = `"sessionId" is this review session's own id. It must differ from the authoring session id the candidate was verified under (FACTORY_SESSION_ID): pr:review --findings refuses a findings file whose sessionId equals the authoring session.`;
+const authorityRule = (waveRung) => waveRung === void 0 ? `Emit schemaVersion 1 and omit "producer" and "rung": this candidate resolves no boundary-wave review rung. If your dispatch instructions do name a rung, emit schemaVersion 2 with that rung and with "producer" instead.` : `This candidate belongs to a boundary wave that demands the ${waveRung} review rung, so schemaVersion 2 is required. Record "rung": "${waveRung}" exactly as shown, and set "producer" to the engine and model that ran this review (for example "codex-cli/gpt-5.6-sol"). Findings without both fields are recorded without authority, and pr:publish then refuses with "no passing review at that authority".`;
+/**
+* The findings-file instructions for one candidate.
+*
+* `waveRung` is the review rung the candidate's boundary wave demands, when it
+* resolves one. It selects the findings schema version the gate will accept.
+*/
+const reviewFooterInstructions = (waveRung) => {
+	const schemaVersion = waveRung === void 0 ? 1 : 2;
+	return `Do not print a machine-readable footer in your chat response. Write your findings to the typed findings file at the path given in your dispatch/task instructions (the file pr:review reads via --findings <path>); that file is the verdict. The file must be valid JSON matching review-findings-file.ts's schema (schemaVersion ${schemaVersion}):
 {
-  "schemaVersion": 1,
-  "model": "<your model identifier>",
+  "schemaVersion": ${schemaVersion},
+${waveRung === void 0 ? "" : `  "producer": "<the engine and model that ran this review, for example codex-cli/gpt-5.6-sol>",\n  "rung": "${waveRung}",\n`}  "model": "<your model identifier>",
   "sessionId": "<this session's id>",
   "patchId": "<the stable patch-id from Review scope above>",
   "reviews": [
@@ -17520,10 +17802,13 @@ const REVIEW_FOOTER_INSTRUCTIONS = `Do not print a machine-readable footer in yo
     }
   ]
 }
+${authorityRule(waveRung)}
+${SESSION_ID_RULE}
 Use category "correctness", "safety", "coordination", or "maintainability"; set blockingAfterCap true for correctness, safety, or coordination findings. citedSpan must be the exact code text the finding is about, quoted verbatim from the diff (identity is derived from this, not from the title, so quote precisely). prescribedAction must be a concise, standalone statement of the required fix (identity is derived from this text too). If this finding is a restatement of a prior finding shown in the prior review ledger below, set supersedes to {"title": "<exact prior title>", "file": "<its file>"} instead of minting a new title for the same theme.`;
+};
 //#endregion
 //#region src/review-prompt.ts
-const reviewScope = ({ base, changedFiles: files, headSha, patchId, profile }) => `Review scope:
+const reviewScope = ({ base, changedFiles: files, headSha, patchId, profile, waveRung }) => `Review scope:
 - Repository: ${profile.repository.owner}/${profile.repository.name}
 - Base ref: ${base}
 - Head SHA: ${headSha}
@@ -17539,7 +17824,7 @@ Required constraints:
 - Do not request elevated or unsandboxed approvals.
 - When you flag a finding, report every other instance of the same class in this diff in the same response, and include a one-line coverage note.
 
-${REVIEW_FOOTER_INSTRUCTIONS}`;
+${reviewFooterInstructions(waveRung)}`;
 const MODE_FLOOR_FILES = {
 	correctness: "correctness.md",
 	security: "security/SKILL.md"
@@ -17613,7 +17898,7 @@ ${entries.map(priorLedgerEntryLine).join("\n")}
 
 Do not re-raise any of the findings above under a new title: they are already adjudicated (waived, filed as a follow-up, or fixed in this thread). If new evidence genuinely supersedes one of them, say so explicitly and name the exact prior finding (its title and file) that it supersedes, rather than minting an unrelated title for the same underlying theme.`
 });
-const assembleReviewPrompt = ({ base, changedFiles, cwd = process.cwd(), headSha, issueFocus, kind, patchId, priorLedgerEntries, profile }, dependencies = {}) => {
+const assembleReviewPrompt = ({ base, changedFiles, cwd = process.cwd(), headSha, issueFocus, kind, patchId, priorLedgerEntries, profile, waveRung }, dependencies = {}) => {
 	const priorLedger = priorLedgerEntries ? nonOpenLadderFindings(priorLedgerEntries) : [];
 	const optionalSegments = {
 		"coding-standards": codingStandardsSegment({
@@ -17633,7 +17918,8 @@ const assembleReviewPrompt = ({ base, changedFiles, cwd = process.cwd(), headSha
 			changedFiles,
 			headSha,
 			patchId,
-			profile
+			profile,
+			waveRung
 		}) },
 		{ text: modeFloorInstructions(kind, changedFiles) },
 		...REVIEW_PROMPT_SECTION_PROVENANCES.flatMap((provenance) => {
@@ -17658,7 +17944,8 @@ const ASSEMBLED_REVIEW_PROMPT_SCHEMA_VERSION = 1;
 const assembledReviewPromptKindSchema = z.object({
 	kind: z.enum(["correctness", "security"]),
 	prompt: z.string().min(1),
-	sections: z.array(reviewPromptSectionSchema)
+	sections: z.array(reviewPromptSectionSchema),
+	waveRung: z.enum(EVIDENCE_REVIEW_RUNGS).optional()
 });
 const assembledReviewPromptArtifactSchema = z.object({
 	headSha: z.string().regex(/^[0-9a-f]{40}$/u),
@@ -17687,6 +17974,51 @@ const defaultFetchIssueBody = ({ issue, owner, repo }) => runGhJson([
 	"--json",
 	"body"
 ]).body;
+const candidateWavePullRequestSchema = z.object({
+	baseRefName: z.string().min(1),
+	body: z.string(),
+	headRefName: z.string().min(1),
+	number: z.number().int().positive()
+});
+const defaultFetchWavePullRequest = (cwd) => runGhJsonAt([
+	"pr",
+	"view",
+	"--json",
+	"baseRefName,body,headRefName,number"
+], cwd);
+/**
+* The review rung this candidate's boundary wave demands (#1001).
+*
+* The assembled prompt tells the reviewer which findings schema the gate will
+* accept. A wave that demands a rung needs schemaVersion 2 with `producer` and
+* `rung`; the v1 shape is recorded without authority, and `pr:publish` then
+* refuses it with "no passing review at that authority".
+*
+* This is prompt enrichment and fails open, like the coding-standards read:
+* every unreadable step returns undefined and the prompt keeps the v1 shape.
+* It decides no authority — `pr:ready` resolves the same wave demand again and
+* is the stage that refuses on it.
+*/
+const assembleWaveRung = ({ args, cwd, dependencies, fetchIssueBody, fetchWavePullRequest, profile }) => {
+	if (args.epic === void 0) return;
+	try {
+		const pullRequest = candidateWavePullRequestSchema.parse(fetchWavePullRequest(cwd));
+		const demand = resolveWaveDemand({
+			baseRefName: pullRequest.baseRefName,
+			epic: args.epic,
+			...dependencies.fetchClosingPullRequests === void 0 ? {} : { fetchClosingPullRequests: dependencies.fetchClosingPullRequests },
+			fetchIssueBody,
+			headRefName: pullRequest.headRefName,
+			owner: profile.repository.owner,
+			pr: pullRequest.number,
+			prBody: pullRequest.body,
+			repo: profile.repository.name
+		});
+		return demand.kind === "demanded" ? demand.demand.review : void 0;
+	} catch {
+		return;
+	}
+};
 const assertReviewCycleInWindow = (cycle, maxCycles) => {
 	if (cycle < 1 || cycle > maxCycles) throw new Error(`--cycle must be between 1 and ${maxCycles}.`);
 };
@@ -17806,7 +18138,7 @@ const assembleGitDependencies = (git) => git.repositoryRoot !== void 0 && git.sh
 	repositoryRoot: git.repositoryRoot,
 	showFileAtRef: git.showFileAtRef
 } : void 0;
-const writeAssembledReviewPrompt = ({ args, cwd, fetchIssueBody, files, git, headSha, kinds, output, patchId, profile }) => {
+const writeAssembledReviewPrompt = ({ args, cwd, fetchIssueBody, files, git, headSha, kinds, output, patchId, profile, waveRung }) => {
 	const priorLedger = priorLedgerFor(priorLadderStateFor({
 		base: args.base,
 		cwd,
@@ -17826,12 +18158,14 @@ const writeAssembledReviewPrompt = ({ args, cwd, fetchIssueBody, files, git, hea
 			kind,
 			patchId,
 			priorLedgerEntries: priorLedger,
-			profile
+			profile,
+			...waveRung === void 0 ? {} : { waveRung }
 		}, assembleGit === void 0 ? {} : { git: assembleGit });
 		return {
 			kind,
 			prompt: assembled.prompt,
-			sections: assembled.sections
+			sections: assembled.sections,
+			...waveRung === void 0 ? {} : { waveRung }
 		};
 	});
 	const artifactPath = path.resolve(cwd, DEFAULT_ASSEMBLED_REVIEW_PROMPT_PATH);
@@ -17839,7 +18173,7 @@ const writeAssembledReviewPrompt = ({ args, cwd, fetchIssueBody, files, git, hea
 	writeProofJson({
 		headSha,
 		patchId,
-		reviews: existing.status === "ok" && existing.artifact.patchId === patchId && existing.artifact.headSha === headSha ? [...new Map([...existing.artifact.reviews, ...assembledReviews].map((review) => [review.kind, review])).values()] : assembledReviews,
+		reviews: existing.status === "ok" && existing.artifact.patchId === patchId && existing.artifact.headSha === headSha ? [...new Map([...existing.artifact.reviews.filter((review) => review.waveRung === waveRung), ...assembledReviews].map((review) => [review.kind, review])).values()] : assembledReviews,
 		schemaVersion: ASSEMBLED_REVIEW_PROMPT_SCHEMA_VERSION
 	}, artifactPath);
 	console.log(`pr:review assembled prompt written to ${artifactPath}`);
@@ -18068,17 +18402,26 @@ async function runPrReview(args, dependencies = {}) {
 			console.log(ASSEMBLE_FAITHFUL_MERGE_NOTICE);
 			return assembleProof();
 		}
+		const fetchIssueBody = dependencies.fetchIssueBody ?? defaultFetchIssueBody;
 		writeAssembledReviewPrompt({
 			args,
 			cwd,
-			fetchIssueBody: dependencies.fetchIssueBody ?? defaultFetchIssueBody,
+			fetchIssueBody,
 			files,
 			git,
 			headSha,
 			kinds,
 			output,
 			patchId,
-			profile
+			profile,
+			waveRung: assembleWaveRung({
+				args,
+				cwd,
+				dependencies,
+				fetchIssueBody,
+				fetchWavePullRequest: dependencies.fetchWavePullRequest ?? defaultFetchWavePullRequest,
+				profile
+			})
 		});
 		return assembleProof();
 	}
@@ -18212,6 +18555,7 @@ async function runPrReview(args, dependencies = {}) {
 }
 //#endregion
 //#region src/pr-publish.ts
+const defaultNow = () => /* @__PURE__ */ new Date();
 var PrPublishFollowUpError = class extends Error {
 	result;
 	constructor(result, cause) {
@@ -18543,7 +18887,8 @@ const PUBLISH_HOSTED_CHECKS_WAIT_MS = 15e3;
 * PR #983 measured the second half: `verify` finished first, readiness ran and
 * published red, and the head's status-HUD job was still in progress.
 *
-* The `patronage-factory/*` family is excluded through `isFactoryReadyCheck`,
+* The `patronage-factory/*` family and the draft-head summary residue are
+* excluded through `isExcludedFromAdmissionChecks` (#1045),
 * the predicate readiness itself uses to exclude its own writes from the
 * rollup gate. Waiting on it would deadlock: readiness is what completes those
 * runs, and a stranded non-terminal generation of one (#524) never finishes.
@@ -18555,7 +18900,7 @@ const PUBLISH_HOSTED_CHECKS_WAIT_MS = 15e3;
 * proceeds exactly as it does today. A moved head is reported, never absorbed:
 * the caller aborts the transaction on it.
 */
-async function awaitHostedChecksSettled({ expectedHeadSha, fetchPr, report = (message) => process.stderr.write(message), sleep = setTimeout$1 }) {
+async function awaitHostedChecksSettled({ expectedHeadSha, fetchPr, report = (message) => process.stderr.write(message), sleep = setTimeout$1, verifyNotBefore }) {
 	for (let attempts = 0;; attempts += 1) {
 		const pr = fetchPr();
 		if (!sameHeadSha(pr.headRefOid, expectedHeadSha)) return {
@@ -18563,9 +18908,10 @@ async function awaitHostedChecksSettled({ expectedHeadSha, fetchPr, report = (me
 			attempts,
 			status: "head-moved"
 		};
-		const verifyState = hostedVerifyCheckState(pr.statusCheckRollup);
+		const rollup = verifyNotBefore === void 0 ? pr.statusCheckRollup : pr.statusCheckRollup?.filter((check) => !isSupersededHostedVerifyCheck(check, verifyNotBefore));
+		const verifyState = hostedVerifyCheckState(rollup);
 		const verifySettled = verifyState !== "none" && verifyState !== "pending";
-		const pending = pendingCheckNames(pr.statusCheckRollup, isFactoryReadyCheck);
+		const pending = pendingCheckNames(rollup, isExcludedFromAdmissionChecks);
 		if (verifySettled && pending.length === 0) return {
 			attempts,
 			status: "settled",
@@ -18600,15 +18946,28 @@ const reevaluateReadiness = (args, dependencies) => (dependencies.runPrReady ??
 * invocation's verify and review proof describe the head it waited for. That
 * is the same reason the #348 await aborts on head movement.
 */
-const awaitHostedChecksBeforeReadiness = async ({ dependencies, expectedHeadSha, fetchPr }) => {
+const awaitHostedChecksBeforeReadiness = async ({ dependencies, expectedHeadSha, fetchPr, verifyNotBefore }) => {
 	const outcome = await awaitHostedChecksSettled({
 		expectedHeadSha,
 		fetchPr,
-		...dependencies.sleep === void 0 ? {} : { sleep: dependencies.sleep }
+		...dependencies.sleep === void 0 ? {} : { sleep: dependencies.sleep },
+		...verifyNotBefore === void 0 ? {} : { verifyNotBefore }
 	});
 	if (outcome.status === "head-moved") throw new PrPublishTransactionAbortedError(`awaited the head's hosted check runs for ${expectedHeadSha}, but the head moved to ${outcome.actualHeadSha} while waiting. Re-run pr:publish against the current head.`);
 	return outcome;
 };
+/**
+* The instant `pr:publish` measures `verify` staleness from (#1045). Read
+* before the promotion, so every check run that already existed on the head
+* sorts strictly before it.
+*/
+const promotionInstant = (dependencies) => (dependencies.now ?? defaultNow)().toISOString();
+/**
+* The staleness cutoff to hand the hosted-run await — present only when this
+* invocation actually promoted the candidate. Without a promotion there is no
+* draft-era `verify` to distrust, and the wait keeps today's behaviour.
+*/
+const promotionVerifyCutoff = (promotion, promotionStartedAt) => promotion.status === "succeeded" ? { verifyNotBefore: promotionStartedAt } : {};
 const requirePromotionHead = ({ actualHeadSha, expectedHeadSha, phase }) => {
 	if (!sameHeadSha(actualHeadSha, expectedHeadSha)) throw new PrPublishTransactionAbortedError(`${phase}: live PR head ${actualHeadSha} differs from the proved publish head ${expectedHeadSha}. Re-run pr:publish against the current head.`);
 };
@@ -18816,6 +19175,7 @@ async function runPrPublish(args, dependencies = {}) {
 		json: false,
 		report: false
 	};
+	const promotionStartedAt = promotionInstant(dependencies);
 	const promotion = await promoteDraftBeforeDemandEvaluation({
 		cwd,
 		expectedHeadSha: verifyProof.headSha,
@@ -18828,7 +19188,8 @@ async function runPrPublish(args, dependencies = {}) {
 	await awaitHostedChecksBeforeReadiness({
 		dependencies,
 		expectedHeadSha: verifyProof.headSha,
-		fetchPr
+		fetchPr,
+		...promotionVerifyCutoff(promotion, promotionStartedAt)
 	});
 	const initialProof = await reevaluateReadiness(readyEvalArgs, publishDependencies);
 	requirePromotedProofHead({
@@ -18980,7 +19341,7 @@ function assertForegroundGate({ gate, env = process.env }) {
 //#endregion
 //#region src/commands/pr-review.ts
 function createPrReviewCommand(output, action) {
-	return markCwdOptionDefault(new Command("pr:review").description("Assemble a factory-owned review prompt, or validate clean-session findings and write typed review proof").option("--base <ref>", "base branch or ref", "origin/main").option("--cwd <path>", "working directory to review", collectCwdOption).option("--cycle <number>", "review cycle number", positiveInteger$1("--cycle"), 1).option("--mode <mode>", "correctness, security, or all", "all").option("--assemble", "write the factory-owned review prompt for a clean session; do not validate findings").option("--findings <path>", "typed clean-session findings JSON file").option("--historical", "record findings that read an earlier commit on this branch: the cycle joins the ladder as prior history and renders no verdict of its own, so it never admits. It leaves the candidate's recorded verdict untouched. Use --dispositions for the findings its fixes answered").option("--dispositions <path>", "JSON file of ladder disposition declarations (waived / follow-up-filed / fixed-in-thread) for previously flagged findings").option("--issue <number>", "issue number recorded on the review ladder trace; --assemble also loads Review focus from this issue", positiveInteger$1("--issue")).option("--output <path>", "write proof JSON to a file").option("--profile <path>", "path to the project profile JSON file").option("--verify-proof <path>", "pr:verify proof JSON path").action(withGateTiming({
+	return markCwdOptionDefault(new Command("pr:review").description("Assemble a factory-owned review prompt, or validate clean-session findings and write typed review proof").option("--base <ref>", "base branch or ref", "origin/main").option("--cwd <path>", "working directory to review", collectCwdOption).option("--cycle <number>", "review cycle number", positiveInteger$1("--cycle"), 1).option("--mode <mode>", "correctness, security, or all", "all").option("--assemble", "write the factory-owned review prompt for a clean session; do not validate findings").option("--epic <number>", "issue carrying the factory-boundary manifest, which may be the work issue itself; --assemble then asks the reviewer for the findings schema the wave-demanded review rung accepts (#1001)", positiveInteger$1("--epic")).option("--findings <path>", "typed clean-session findings JSON file").option("--historical", "record findings that read an earlier commit on this branch: the cycle joins the ladder as prior history and renders no verdict of its own, so it never admits. It leaves the candidate's recorded verdict untouched. Use --dispositions for the findings its fixes answered").option("--dispositions <path>", "JSON file of ladder disposition declarations (waived / follow-up-filed / fixed-in-thread) for previously flagged findings").option("--issue <number>", "issue number recorded on the review ladder trace; --assemble also loads Review focus from this issue", positiveInteger$1("--issue")).option("--output <path>", "write proof JSON to a file").option("--profile <path>", "path to the project profile JSON file").option("--verify-proof <path>", "pr:verify proof JSON path").action(withGateTiming({
 		gate: "pr:review",
 		resolveCycle: (options) => options.cycle,
 		resolveLedgerRoot: (options) => resolveCwdOption(options.cwd),
@@ -18998,6 +19359,7 @@ function createPrReviewCommand(output, action) {
 			cwd: resolveCwdOption(options.cwd),
 			cycle: options.cycle,
 			dispositions: options.dispositions,
+			epic: options.epic,
 			findings: options.findings,
 			...options.historical === true ? { historical: true } : {},
 			issue: options.issue,