@patronage/software-factory 1.0.0-alpha.28 → 1.0.0-alpha.29

package/dist/index.d.ts

@@ -1360,8 +1360,8 @@ declare const mergeFreezeStateSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
   generationId: z.ZodNumber;
   headSha: z.ZodString;
   outcome: z.ZodEnum<{
-    stale: "stale";
     active: "active";
+    stale: "stale";
   }>;
   reason: z.ZodString;
   recordedAt: z.ZodISODateTime;
@@ -1609,9 +1609,9 @@ declare const managedReadinessLedgerSchema: z.ZodObject<{
       reviewedPatchId: z.ZodOptional<z.ZodString>;
       status: z.ZodEnum<{
         "not-required": "not-required";
+        stale: "stale";
         blocked: "blocked";
         current: "current";
-        stale: "stale";
         missing: "missing";
       }>;
     }, z.core.$strip>;
@@ -1621,9 +1621,9 @@ declare const managedReadinessLedgerSchema: z.ZodObject<{
       reviewedPatchId: z.ZodOptional<z.ZodString>;
       status: z.ZodEnum<{
         "not-required": "not-required";
+        stale: "stale";
         blocked: "blocked";
         current: "current";
-        stale: "stale";
         missing: "missing";
       }>;
     }, z.core.$strip>>;
@@ -1657,7 +1657,7 @@ type ReadinessStatus = "ready" | "blocked";
 type ManagedReadinessLedger = z.infer<typeof managedReadinessLedgerSchema>;
 declare function validateManagedReadinessLedger(value: unknown): ManagedReadinessLedger;
 declare namespace status_check_rollup_d_exports {
-  export { CheckState, HOSTED_VERIFY_CHECK_NAME, StatusCheckRollup, hostedVerifyCheckState, isFactoryReadyCheck, isHostedVerifyCheck, pendingCheckNames, statusCheckState };
+  export { CheckState, HOSTED_VERIFY_CHECK_NAME, HOSTED_VERIFY_DRAFT_CHECK_NAME, StatusCheckRollup, hostedVerifyCheckState, isDraftHostedVerifyCheck, isExcludedFromAdmissionChecks, isFactoryReadyCheck, isHostedVerifyCheck, isSupersededHostedVerifyCheck, pendingCheckNames, statusCheckState };
 }
 type CheckState = "passed" | "failed" | "pending" | "none" | "unknown";
 interface StatusCheckRollup {
@@ -1691,6 +1691,39 @@ declare const HOSTED_VERIFY_CHECK_NAME = "verify";
  * would accept exactly the thing the pin rejects.
  */
 declare const isHostedVerifyCheck: (check: StatusCheckRollup) => boolean;
+/**
+ * The name the hosted summary job takes on a DRAFT head (#1045).
+ *
+ * The workflow renames that job so the pinned `verify` context does not exist
+ * while the candidate is a draft. The generator that emits the workflow owns
+ * the literal; this is the reader's copy of it, and
+ * `software-factory-hq/alchemy/verify-workflow.test.ts` pins the two equal.
+ */
+declare const HOSTED_VERIFY_DRAFT_CHECK_NAME = "verify (draft)";
+/**
+ * Is this the draft-head summary run's residue?
+ *
+ * The draft run and the `ready_for_review` run land on the SAME head SHA, and
+ * they post two different contexts — `verify (draft)` and `verify` — which
+ * `effectiveChecks` keys separately and therefore never collapses. The Verify
+ * workflow cancels an in-flight pull-request run when the next one starts, and
+ * `ready_for_review` IS the next one, so undrafting typically cancels the
+ * draft run mid-flight. That leaves a CANCELLED `verify (draft)` row sitting
+ * next to a green `verify` on the admitted head.
+ *
+ * GitHub does not care: the branch ruleset pins `verify` alone. The factory's
+ * own rollup read would: `CANCELLED` is a failed state, so the candidate's
+ * `requiredChecks` would read `failed` forever and no push-free repair could
+ * clear it. The draft run is a superseded generation of the summary job the
+ * `verify` row already answers for, so admission does not judge it.
+ */
+declare const isDraftHostedVerifyCheck: (check: StatusCheckRollup) => boolean;
+/**
+ * The rollup rows an admission read must not judge: the factory's own branded
+ * checks (it would be judging itself) and the draft-head summary residue
+ * above.
+ */
+declare const isExcludedFromAdmissionChecks: (check: StatusCheckRollup) => boolean;
 /**
  * The hosted `verify` gate's state on this head, read by presence (#477).
  *
@@ -1716,6 +1749,25 @@ declare const hostedVerifyCheckState: (rollup: StatusCheckRollup[] | undefined)
  */
 declare const pendingCheckNames: (rollup: StatusCheckRollup[] | undefined, exclude?: (check: StatusCheckRollup) => boolean) => string[];
 declare const statusCheckState: (rollup: StatusCheckRollup[] | undefined, exclude?: (check: StatusCheckRollup) => boolean) => CheckState;
+/**
+ * Is this a hosted `verify` check run that GitHub started before `cutoffIso`?
+ * (#1045)
+ *
+ * A caller that waits for `verify` on a head it just changed the state of —
+ * `pr:publish` undrafting a candidate — must not accept the run that was
+ * already there. #1034's history is the shape: a draft head carried a `verify`
+ * that had run nothing, the wait saw it as terminal on its first attempt, and
+ * readiness read `passed` about two minutes before the `ready_for_review` run
+ * created its own check runs. The same shape is reachable from any superseded
+ * `verify` generation still on the head.
+ *
+ * Fail CLOSED on an unreadable timestamp: a `verify` row that cannot be shown
+ * to be newer than the cutoff is treated as superseded. The wait is bounded,
+ * so the cost of that refusal is one timeout that falls through to the
+ * caller's existing behaviour; the cost of failing open is the false green
+ * this exists to remove.
+ */
+declare const isSupersededHostedVerifyCheck: (check: StatusCheckRollup, cutoffIso: string) => boolean;
 //#endregion
 //#region src/github-client.d.ts
 /** Read a branch tip from GitHub rather than a checkout's cached remote ref. */
@@ -1782,6 +1834,33 @@ interface PrVerifyCommandResult {
   name: string;
   scope: "docs-only" | "trivial" | "full";
 }
+/**
+ * One failing test a verification command reported (#1035).
+ *
+ * The proof keeps the failing test's IDENTITY and its failure CLASS, and
+ * nothing else. That is enough to decide retry-or-fix — a `timeout` under
+ * machine load is a flake, an `assertion` is a real break — without rerunning
+ * the aggregate to read a title off the console.
+ *
+ * It deliberately keeps no raw output tail and no error message body. This
+ * payload is transmitted to HQ ingest, and arbitrary command output can carry
+ * secrets (an echoed environment, a connection string inside a stack frame). A
+ * file path, a test title, and a closed `kind` enum cannot. The cost is the
+ * assertion diff and the stack frames: they help you FIX a failure, and the
+ * operator still reads them from the run's own console output.
+ */
+interface PrVerifyTestFailure {
+  /** The test file the reporter named, as the reporter wrote it. */
+  file: string;
+  /**
+   * The failure class. `timeout` is the test-timeout error vitest raises at
+   * its own ceiling; `assertion` is a failed expectation; `error` is every
+   * other thrown failure.
+   */
+  kind: "assertion" | "error" | "timeout";
+  /** The full test title, suite names included, as the reporter wrote it. */
+  title: string;
+}
 interface PrVerifyExecutedCommand {
   command: string;
   counts?: {
@@ -1790,6 +1869,12 @@ interface PrVerifyExecutedCommand {
   };
   durationMs: number;
   exitCode: number;
+  /**
+   * The failing tests this command reported (#1035). Present only when the
+   * command produced parseable failures, so a passing command's record is
+   * byte-identical to the one it wrote before this field existed.
+   */
+  failures?: PrVerifyTestFailure[];
   name: string;
   scope: "docs-only" | "trivial" | "full";
 }
@@ -1864,7 +1949,7 @@ interface PrVerifyProof {
 type PrVerifyBaselineFullProof = NonNullable<PrVerifyProof["baselineFullProofs"]>[number];
 declare function validatePrVerifyProof(value: unknown): PrVerifyProof;
 declare namespace verification_proof_d_exports {
-  export { PrVerifyBaselineFullProof, PrVerifyCommandResult, PrVerifyExecutedCommand, PrVerifyNotDemandedRecord, PrVerifyNotRequiredCommand, PrVerifyProof, PrVerifySchemaVersion, ResolvedPrVerifyMode, SUPPORTED_PR_VERIFY_SCHEMA_VERSIONS, VerificationHeadShas, VerificationProofState, VerifiedHeadShas, prVerifyFullHeadShasForDiff, prVerifyProofHeadShas, readPrVerifyProof, resolveVerifyProofApplicability, trustedCatchUpRecognition, trustedImpactStamp, validatePrVerifyProof, verificationProofApplicabilityFor, verificationProofBlockingReason, verificationProofForReadiness, verificationProofStateFor, verifyProofIdentityMatches, verifyProofPassed };
+  export { PrVerifyBaselineFullProof, PrVerifyCommandResult, PrVerifyExecutedCommand, PrVerifyNotDemandedRecord, PrVerifyNotRequiredCommand, PrVerifyProof, PrVerifySchemaVersion, PrVerifyTestFailure, ResolvedPrVerifyMode, SUPPORTED_PR_VERIFY_SCHEMA_VERSIONS, VerificationHeadShas, VerificationProofState, VerifiedHeadShas, prVerifyFullHeadShasForDiff, prVerifyProofHeadShas, readPrVerifyProof, resolveVerifyProofApplicability, trustedCatchUpRecognition, trustedImpactStamp, validatePrVerifyProof, verificationProofApplicabilityFor, verificationProofBlockingReason, verificationProofForReadiness, verificationProofStateFor, verifyProofIdentityMatches, verifyProofPassed };
 }
 interface VerifiedHeadShas {
   docsOnlyVerifiedHeadShas: string[];
@@ -2334,6 +2419,14 @@ interface PrReadyProof {
     headSha: string;
     outcome: "armed" | "merged" | "not-armed";
   };
+  /**
+   * The authoring session readiness resolved for the review-independence
+   * cross-check (#1037). Recorded so the branded check can print it beside the
+   * review session, model, and producer the ledger already carries — the four
+   * identities a human weighs at merge time. Additive and optional: proofs
+   * written before it carry no field, so no schema version moves.
+   */
+  authoringSession?: string;
   /**
    * Why this run blocked, one entry per refusing demand (#391): `code` is the
    * demand key from the resolver's vocabulary, `detail` the one-sentence
@@ -2639,9 +2732,9 @@ declare const loadEvidenceEnvelopes: (cwd: string) => LoadedEvidenceEnvelope[];
 declare const REVIEW_STATUS_VALUES: readonly ["not-required", "current", "stale", "missing", "blocked"];
 declare const reviewStatusSchema: z.ZodEnum<{
   "not-required": "not-required";
+  stale: "stale";
   blocked: "blocked";
   current: "current";
-  stale: "stale";
   missing: "missing";
 }>;
 type ReviewStatus = z.infer<typeof reviewStatusSchema>;
@@ -3014,6 +3107,8 @@ interface VerificationCommandOutcome {
   };
   durationMs: number;
   exitCode: number;
+  /** The failing tests scraped from this command's output (#1035). */
+  failures?: PrVerifyTestFailure[];
 }
 interface PrVerifyArgs extends LoadProjectProfileInput {
   authoringSession?: string;
@@ -3150,6 +3245,12 @@ interface PrPublishDependencies extends PrReadyDependencies {
     cwd: string;
   }) => Promise<HqFlushResult>;
   runPrVerify?: (args: PrVerifyArgs) => Promise<PrVerifyProof>;
+  /**
+   * Injectable clock for the promotion instant the hosted-run await measures
+   * `verify` staleness against (#1045; tests only — production reads the real
+   * clock).
+   */
+  now?: () => Date;
   /**
    * Injectable delay for the bounded hosted-run await (#348; tests only —
    * production always waits the real interval).
@@ -3885,8 +3986,8 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
   interiorCycle: z.ZodOptional<z.ZodNumber>;
   observedAt: z.ZodString;
   purpose: z.ZodEnum<{
-    review: "review";
     code: "code";
+    review: "review";
   }>;
   slotResolution: z.ZodObject<{
     effort: z.ZodEnum<{
@@ -3964,8 +4065,8 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
   interiorCycle: z.ZodOptional<z.ZodNumber>;
   observedAt: z.ZodString;
   purpose: z.ZodEnum<{
-    review: "review";
     code: "code";
+    review: "review";
   }>;
   slotResolution: z.ZodObject<{
     effort: z.ZodEnum<{
@@ -4034,8 +4135,8 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
     interiorCycle: z.ZodOptional<z.ZodNumber>;
     observedAt: z.ZodString;
     purpose: z.ZodEnum<{
-      review: "review";
       code: "code";
+      review: "review";
     }>;
     slotResolution: z.ZodObject<{
       effort: z.ZodEnum<{
@@ -4107,7 +4208,7 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
   exitCode: number | null;
   harness: string;
   observedAt: string;
-  purpose: "review" | "code";
+  purpose: "code" | "review";
   slotResolution: {
     effort: "high" | "low" | "medium" | "xhigh";
     engine: string;
@@ -4461,13 +4562,13 @@ declare const evaluateReadiness: (input: EvaluationInput) => {
     reviews: {
       correctness: {
         required: boolean;
-        status: "not-required" | "blocked" | "current" | "stale" | "missing";
+        status: "not-required" | "stale" | "blocked" | "current" | "missing";
         reviewedHeadSha?: string | undefined;
         reviewedPatchId?: string | undefined;
       };
       security?: {
         required: boolean;
-        status: "not-required" | "blocked" | "current" | "stale" | "missing";
+        status: "not-required" | "stale" | "blocked" | "current" | "missing";
         reviewedHeadSha?: string | undefined;
         reviewedPatchId?: string | undefined;
       } | undefined;

package/dist/index.js

@@ -18,7 +18,7 @@ import { FACTORY_APP_BROKER_ORIGIN, FACTORY_APP_BROKER_PATH, FACTORY_CURSOR_OIDC
 import http from "node:http";
 import { pathToFileURL } from "node:url";
 //#region package.json
-var version = "1.0.0-alpha.28";
+var version = "1.0.0-alpha.29";
 //#endregion
 //#region src/cli-entry.ts
 /**
@@ -6576,10 +6576,48 @@ function verifyOutput(proof) {
 		title: `pr:verify ${value.outcome ?? "unknown"}`
 	};
 }
+/**
+* The refusals to name, preferring the attributed projection (#391) so each
+* line carries its demand code. `blockingReasons` is the fallback because the
+* throwing path in `pr:ready` publishes a proof that carries only that field.
+* The two projections hold the same refusals in the same order, so reading
+* either one tells the same story.
+*/
+const readyReasonLines = (value) => {
+	const named = value.blockedReasons ?? [];
+	if (named.length > 0) return named.map((reason) => ({
+		...reason.code === void 0 ? {} : { code: reason.code },
+		detail: reason.detail ?? "unrecorded"
+	}));
+	return (value.blockingReasons ?? []).map((reason) => ({ detail: typeof reason === "string" ? reason : "unrecorded" }));
+};
+const readyReasonBlock = (reasons) => {
+	return `\n\n${reasons.length === 1 ? "1 blocking reason:" : `${reasons.length} blocking reasons:`}\n\n${reasons.map((reason) => `- ${reason.code === void 0 ? "" : `**${reason.code}** — `}${reason.detail}`).join("\n")}`;
+};
+const readyIdentityField = (value) => value === void 0 || value.trim().length === 0 ? "unrecorded" : `\`${value}\``;
+/**
+* #1037: the review identity the proof already records, printed where the
+* merge decision is made. `pr:ready` recorded the review session, model, and
+* producer, and the authoring session it was checked against, but only the PR
+* body prose showed them — so a human merging from the checks page could not
+* see which model produced the review that admitted the candidate.
+*
+* This is recording made visible, not a control. The attended merge is the
+* control.
+*/
+const readyIdentityBlock = (value) => {
+	const runs = value.ledger?.reviewRuns ?? [];
+	if (runs.length === 0 && value.authoringSession === void 0) return "";
+	return `\n\nRecorded review identity:\n\n${[...runs.map((run) => {
+		const rung = run.rung === void 0 ? "" : ` at rung \`${run.rung}\``;
+		return `- ${run.kind ?? "review"}${rung}: session ${readyIdentityField(run.sessionId)} · model ${readyIdentityField(run.model)} · producer ${readyIdentityField(run.producer)}`;
+	}), `- authoring session: ${readyIdentityField(value.authoringSession)}`].join("\n")}`;
+};
 function readyOutput(proof) {
 	const value = proof;
+	const reasons = readyReasonLines(value);
 	return {
-		summary: `Schema v${value.schemaVersion}; readiness verdict **${value.status ?? "unknown"}**; ${value.blockingReasons?.length ?? 0} blocking reason(s); ledger head \`${value.ledger?.headSha ?? "unknown"}\`.`,
+		summary: `${`Schema v${value.schemaVersion}; readiness verdict **${value.status ?? "unknown"}**;${reasons.length === 0 ? " no blocking reasons;" : ""} ledger head \`${value.ledger?.headSha ?? "unknown"}\`.`}${reasons.length === 0 ? "" : readyReasonBlock(reasons)}${readyIdentityBlock(value)}`,
 		title: `pr:ready ${value.status ?? "unknown"}`
 	};
 }
@@ -7508,6 +7546,15 @@ const assertPrVerifyProofRules = (proof, context) => {
 * factory must adopt this release before HQ ingests its pr:verify proofs.
 */
 const SUPPORTED_PR_VERIFY_SCHEMA_VERSIONS = [4];
+const prVerifyTestFailureSchema = z.object({
+	file: z.string().min(1),
+	kind: z.enum([
+		"assertion",
+		"error",
+		"timeout"
+	]),
+	title: z.string().min(1)
+});
 const executedCommandSchema = z.object({
 	command: z.string().min(1),
 	counts: z.object({
@@ -7516,6 +7563,7 @@ const executedCommandSchema = z.object({
 	}).optional(),
 	durationMs: z.number().nonnegative(),
 	exitCode: z.number(),
+	failures: z.array(prVerifyTestFailureSchema).min(1).optional(),
 	name: z.string().min(1),
 	scope: z.enum([
 		"docs-only",
@@ -7797,6 +7845,13 @@ const verificationProofForReadiness = (state) => {
 const failedExecutedCommand = (proof) => {
 	return proof.executedCommands?.find((command) => command.exitCode !== 0) ?? proof.executedCommands?.at(-1);
 };
+const MAX_NAMED_TEST_FAILURES = 3;
+const formatFailedTests = (failures) => {
+	if (!failures || failures.length === 0) return "";
+	const named = failures.slice(0, MAX_NAMED_TEST_FAILURES).map((failure) => `${failure.file} > ${failure.title} (${failure.kind})`).join("; ");
+	const remaining = failures.length - MAX_NAMED_TEST_FAILURES;
+	return remaining > 0 ? ` on ${named}; and ${remaining} more failing test${remaining === 1 ? "" : "s"}` : ` on ${named}`;
+};
 const verificationProofBlockingReason = (state) => {
 	if (state.kind === "typed-missing") {
 		if (state.reason === "enoent") return `Typed pr:verify proof at ${state.path} does not exist; pr:verify has not run for this PR head. Run patronage-factory pr:verify.`;
@@ -7808,7 +7863,7 @@ const verificationProofBlockingReason = (state) => {
 	}
 	if (state.kind === "typed-aborted") {
 		const failed = failedExecutedCommand(state.proof);
-		if (failed) return `Typed pr:verify proof shows verification aborted at ${failed.name} (exit code ${failed.exitCode}); verification did not pass. Re-run patronage-factory pr:verify.`;
+		if (failed) return `Typed pr:verify proof shows verification aborted at ${failed.name} (exit code ${failed.exitCode})${formatFailedTests(failed.failures)}; verification did not pass. Re-run patronage-factory pr:verify.`;
 		return "Typed pr:verify proof shows verification aborted; verification did not pass. Re-run patronage-factory pr:verify.";
 	}
 };
@@ -8036,6 +8091,111 @@ function parseVitestCounts(stdout) {
 	if (testsMatch) counts.tests = Number(testsMatch.groups?.total ?? testsMatch.groups?.passed);
 	return counts;
 }
+const MAX_RECORDED_TEST_FAILURES = 50;
+const ANSI_ESCAPE_PATTERN = /\u001B\[[0-9;]*m/gu;
+/**
+* Vitest's per-failure header: `FAIL  <file> > <suite> > <test title>`. This
+* pattern claims only the `FAIL ` prefix; `splitVitestFailHeader` below reads
+* the rest, because a multi-project run puts a project label between `FAIL`
+* and the file and its shape depends on color support.
+*/
+const VITEST_FAIL_HEADER_PATTERN = /^\s*FAIL\s+(?<rest>\S.*)$/u;
+/** Vitest separates the file, each suite, and the test title with ` > `. */
+const VITEST_TITLE_SEPARATOR = " > ";
+/**
+* Splits a failure header into the failing file and the full test title.
+*
+* The file is the LAST whitespace-separated token before the first ` > `,
+* which is what makes this survive a multi-project run. Vitest's
+* `formatProjectName` writes the project label as `|name|` when color is
+* unsupported and as a color-boxed ` name ` when it is; after this module
+* strips the SGR codes both leave the label as its own token ahead of the
+* file, and both drop out here. The title keeps every suite name, so the
+* split is on the FIRST separator and never a later one.
+*
+* Answers `undefined` for a header that names no test.
+*/
+const splitVitestFailHeader = (rest) => {
+	const separatorIndex = rest.indexOf(VITEST_TITLE_SEPARATOR);
+	if (separatorIndex === -1) return;
+	const file = rest.slice(0, separatorIndex).trim().split(/\s+/u).at(-1);
+	const title = rest.slice(separatorIndex + 3).trim();
+	if (!file || title.length === 0) return;
+	return {
+		file,
+		title
+	};
+};
+const VITEST_TIMEOUT_PATTERN = /^\s*\S*Error:\s+Test timed out in /u;
+const VITEST_ASSERTION_PATTERN = /^\s*\S*AssertionError\b/u;
+/**
+* Reads the failure class off the error line under a failure header. Anything
+* that is neither the test-timeout error nor an assertion error — including a
+* line that is not error-shaped at all — classifies as `error` rather than
+* guessing at a narrower class.
+*/
+const classifyVitestFailure = (errorLine) => {
+	if (errorLine === void 0) return "error";
+	if (VITEST_TIMEOUT_PATTERN.test(errorLine)) return "timeout";
+	if (VITEST_ASSERTION_PATTERN.test(errorLine)) return "assertion";
+	return "error";
+};
+/**
+* Scrapes the failing tests out of a vitest run's console output (#1035).
+*
+* Callers pass BOTH captured streams: vitest writes its `Failed Tests`
+* section to stderr, so stdout alone carries no failure header.
+*
+* Deliberately line-shaped, the same class of scan as `parseVitestCounts`
+* above: it reads the `FAIL <file> > <title>` header and the error line that
+* follows it, and nothing else. It must never grow toward a parser of vitest's
+* report. Output it does not recognize yields an empty list, never a throw —
+* an unreadable report is a proof that records no failures, not a verification
+* run that crashes while writing why it failed.
+*/
+function parseVitestFailures(stdout) {
+	const lines = stdout.replace(ANSI_ESCAPE_PATTERN, "").split(/\r?\n/u);
+	const failures = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const [index, line] of lines.entries()) {
+		const header = line.match(VITEST_FAIL_HEADER_PATTERN);
+		if (!header?.groups?.rest) continue;
+		const split = splitVitestFailHeader(header.groups.rest);
+		if (!split) continue;
+		const { file, title } = split;
+		const key = `${file}\u0000${title}`;
+		if (seen.has(key)) continue;
+		seen.add(key);
+		const errorLine = lines.slice(index + 1, index + 3).find((candidate) => candidate.trim().length > 0);
+		failures.push({
+			file,
+			kind: classifyVitestFailure(errorLine),
+			title
+		});
+		if (failures.length >= MAX_RECORDED_TEST_FAILURES) break;
+	}
+	return failures;
+}
+/**
+* Reduces one captured verification run to the outcome the proof records.
+*
+* Which stream each scan reads is the load-bearing decision here. Vitest's
+* default reporter prints the run tree and the `Test Files` summary that
+* `parseVitestCounts` reads to stdout, but prints the whole `Failed Tests`
+* section — every `FAIL` header and every error line — through
+* `logger.error`, which is stderr. Scanning stdout alone for failures finds
+* none at all, so the failure scan reads both streams.
+*/
+function verificationOutcomeOf(result) {
+	const counts = parseVitestCounts(result.stdout);
+	const failures = result.exitCode === 0 ? [] : parseVitestFailures(`${result.stdout}\n${result.stderr}`);
+	return {
+		...counts ? { counts } : {},
+		durationMs: result.durationMs,
+		exitCode: result.exitCode,
+		...failures.length > 0 ? { failures } : {}
+	};
+}
 function defaultPrVerifyGit() {
 	return {
 		changedFiles,
@@ -8044,13 +8204,7 @@ function defaultPrVerifyGit() {
 		mergeBaseSha,
 		recognizeCatchUp: recognizeCatchUpCandidate,
 		runVerificationCommand(command, cwd, env) {
-			const result = runInheritedTee("bash", ["-lc", command], cwd, env);
-			const counts = parseVitestCounts(result.stdout);
-			return {
-				...counts ? { counts } : {},
-				durationMs: result.durationMs,
-				exitCode: result.exitCode
-			};
+			return verificationOutcomeOf(runInheritedTee("bash", ["-lc", command], cwd, env));
 		},
 		showFileAtRef,
 		stablePatchId: runStablePatchId,
@@ -8136,6 +8290,19 @@ function formatVerifyTimingSummary(proof) {
 	}
 	return lines.join("\n");
 }
+/**
+* The line `pr:verify` prints last when it aborts (#1035): where the record
+* is, which command failed, and — when the command reported them — which
+* tests failed and in what class. A timeout under machine load and a real
+* assertion look identical without this, so every red verify used to cost a
+* full visible rerun just to read a test title.
+*/
+function formatVerifyFailurePointer(proof, proofPath) {
+	const failed = proof.executedCommands?.find((command) => command.exitCode !== 0);
+	const lines = [failed ? `pr:verify aborted at ${failed.name} (exit code ${failed.exitCode}); record: ${proofPath}` : `pr:verify aborted; record: ${proofPath}`];
+	for (const failure of failed?.failures ?? []) lines.push(`  ${failure.kind}: ${failure.file} > ${failure.title}`);
+	return lines.join("\n");
+}
 function resolveMode({ classification, mode }) {
 	if (mode === "auto") {
 		if (classification === "docs/process-only") return "docs-only";
@@ -8299,6 +8466,7 @@ function runPrVerify(args, dependencies = {}) {
 		writeProofCopies(proof);
 		failureProofWritten = true;
 		if (executedCommands.length > 0) console.log(`\n${formatVerifyTimingSummary(proof)}`);
+		console.log(`\n${formatVerifyFailurePointer(proof, output)}`);
 		publishFactoryCheckSafely(publishCheckRun, {
 			conclusion: "failure",
 			cwd,
@@ -8321,7 +8489,8 @@ function runPrVerify(args, dependencies = {}) {
 				exitCode: result.exitCode,
 				name: command.name,
 				scope: command.scope,
-				...result.counts ? { counts: result.counts } : {}
+				...result.counts ? { counts: result.counts } : {},
+				...result.failures && result.failures.length > 0 ? { failures: result.failures } : {}
 			};
 			executedCommands.push(executedCommand);
 			if (result.exitCode !== 0) {
@@ -9706,6 +9875,7 @@ z.object({
 			"not-armed"
 		])
 	}).optional(),
+	authoringSession: z.string().min(1).optional(),
 	blockedReasons: blockedReasonsSchema.optional(),
 	blockingReasons: z.array(z.string()),
 	command: z.literal("patronage-factory pr:ready"),
@@ -14638,9 +14808,13 @@ const renderPrBodySections = ({ reviewProof, verifyProof }) => `${renderPrBodySe
 //#region src/pr-readiness/status-check-rollup.ts
 var status_check_rollup_exports = /* @__PURE__ */ __exportAll({
 	HOSTED_VERIFY_CHECK_NAME: () => HOSTED_VERIFY_CHECK_NAME$1,
+	HOSTED_VERIFY_DRAFT_CHECK_NAME: () => HOSTED_VERIFY_DRAFT_CHECK_NAME,
 	hostedVerifyCheckState: () => hostedVerifyCheckState,
+	isDraftHostedVerifyCheck: () => isDraftHostedVerifyCheck,
+	isExcludedFromAdmissionChecks: () => isExcludedFromAdmissionChecks,
 	isFactoryReadyCheck: () => isFactoryReadyCheck,
 	isHostedVerifyCheck: () => isHostedVerifyCheck,
+	isSupersededHostedVerifyCheck: () => isSupersededHostedVerifyCheck,
 	pendingCheckNames: () => pendingCheckNames,
 	statusCheckState: () => statusCheckState
 });
@@ -14683,6 +14857,39 @@ const HOSTED_VERIFY_CHECK_NAME$1 = "verify";
 */
 const isHostedVerifyCheck = (check) => check.name === "verify" && Boolean(check.workflowName);
 /**
+* The name the hosted summary job takes on a DRAFT head (#1045).
+*
+* The workflow renames that job so the pinned `verify` context does not exist
+* while the candidate is a draft. The generator that emits the workflow owns
+* the literal; this is the reader's copy of it, and
+* `software-factory-hq/alchemy/verify-workflow.test.ts` pins the two equal.
+*/
+const HOSTED_VERIFY_DRAFT_CHECK_NAME = `${HOSTED_VERIFY_CHECK_NAME$1} (draft)`;
+/**
+* Is this the draft-head summary run's residue?
+*
+* The draft run and the `ready_for_review` run land on the SAME head SHA, and
+* they post two different contexts — `verify (draft)` and `verify` — which
+* `effectiveChecks` keys separately and therefore never collapses. The Verify
+* workflow cancels an in-flight pull-request run when the next one starts, and
+* `ready_for_review` IS the next one, so undrafting typically cancels the
+* draft run mid-flight. That leaves a CANCELLED `verify (draft)` row sitting
+* next to a green `verify` on the admitted head.
+*
+* GitHub does not care: the branch ruleset pins `verify` alone. The factory's
+* own rollup read would: `CANCELLED` is a failed state, so the candidate's
+* `requiredChecks` would read `failed` forever and no push-free repair could
+* clear it. The draft run is a superseded generation of the summary job the
+* `verify` row already answers for, so admission does not judge it.
+*/
+const isDraftHostedVerifyCheck = (check) => check.name === HOSTED_VERIFY_DRAFT_CHECK_NAME && Boolean(check.workflowName);
+/**
+* The rollup rows an admission read must not judge: the factory's own branded
+* checks (it would be judging itself) and the draft-head summary residue
+* above.
+*/
+const isExcludedFromAdmissionChecks = (check) => isFactoryReadyCheck(check) || isDraftHostedVerifyCheck(check);
+/**
 * The hosted `verify` gate's state on this head, read by presence (#477).
 *
 * This is the one rollup question the rollup can answer honestly. Wave 2
@@ -14769,6 +14976,31 @@ const statusCheckState = (rollup, exclude) => {
 	if (currentChecks.some((check) => PENDING_STATES.has(progressState(check)))) return "pending";
 	return "unknown";
 };
+/**
+* Is this a hosted `verify` check run that GitHub started before `cutoffIso`?
+* (#1045)
+*
+* A caller that waits for `verify` on a head it just changed the state of —
+* `pr:publish` undrafting a candidate — must not accept the run that was
+* already there. #1034's history is the shape: a draft head carried a `verify`
+* that had run nothing, the wait saw it as terminal on its first attempt, and
+* readiness read `passed` about two minutes before the `ready_for_review` run
+* created its own check runs. The same shape is reachable from any superseded
+* `verify` generation still on the head.
+*
+* Fail CLOSED on an unreadable timestamp: a `verify` row that cannot be shown
+* to be newer than the cutoff is treated as superseded. The wait is bounded,
+* so the cost of that refusal is one timeout that falls through to the
+* caller's existing behaviour; the cost of failing open is the false green
+* this exists to remove.
+*/
+const isSupersededHostedVerifyCheck = (check, cutoffIso) => {
+	if (!isHostedVerifyCheck(check)) return false;
+	const startedMs = checkTimestampMs(check);
+	const cutoffMs = Date.parse(cutoffIso);
+	if (startedMs === void 0 || Number.isNaN(cutoffMs)) return true;
+	return startedMs < cutoffMs;
+};
 //#endregion
 //#region src/arm-auto-merge.ts
 /**
@@ -15605,6 +15837,43 @@ const requiredChecksEvaluation = (input) => {
 		outcomes
 	};
 };
+/**
+* REPAIR SITES 2 and 3 of 3 (#1045). #1048 makes the permitted set a type:
+* only a `RepairableDemand` blocker may carry a repair, so a fourth site on a
+* proof refusal fails `tsc`. The type keys on the demand, not on the state, so
+* it still permits a repair on a FAILED required check — the evaluator test
+* that turns every non-route-owned refusal on at once pins that half.
+*
+* Both hosted-check demands in `collectBlockers` are route-owned in exactly
+* two states, and in both the repair is the same one — wait for the NEXT
+* hosted run:
+*
+* 1. `requiredChecks === "pending"`: a run is in flight on this head.
+* 2. `draft === true`: the candidate is a draft, so the hosted verification
+*    workflow deliberately posts no `verify` context at all (#1045 — `core`
+*    and `docs` skip on a draft, and the summary job is renamed so the pinned
+*    context is ABSENT rather than a green or gray check that ran nothing).
+*    Absence is what `hostedVerifyCheck: "none"` reports, so without this
+*    repair a draft would raise a human blocker no human can clear, and
+*    `pr:ready` would publish a red check on every draft — the notification
+*    noise #1037 removed.
+*
+* Draft is route-owned by construction: `pr:publish` undrafts the candidate
+* itself, and the repair is literally named `await-post-undraft-checks`
+* because it is about the run the promotion triggers.
+*
+* A draft whose checks came back FAILED is deliberately excluded: a real red
+* is not a not-yet, and waiting for another run would not clear it. That stays
+* a human blocker, exactly as it is today.
+*/
+const awaitPostUndraftChecksRepair = (input) => {
+	if (!(input.requiredChecks === "pending" || input.draft && input.requiredChecks !== "failed")) return {};
+	return { repair: {
+		action: "Poll and retry until post-undraft GitHub checks settle or fail; a draft head and UNSTABLE/pending are transient route-owned states, not human blockers.",
+		code: "await-post-undraft-checks",
+		command: `gh pr checks ${input.pr} --watch`
+	} };
+};
 const collectBlockers = ({ correctnessRequired, correctnessStatus, correctnessUntyped, input, prVerifyStatus, verificationProof, securityRequired, securityStatus, securityUntyped }) => {
 	const blockers = [];
 	if (prVerifyStatus === "missing") blockers.push({
@@ -15652,22 +15921,21 @@ const collectBlockers = ({ correctnessRequired, correctnessStatus, correctnessUn
 		demand: DEMAND_KEYS.mergeState,
 		reason: `GitHub merge state is ${input.mergeStateStatus}/${input.mergeable}; expected CLEAN or review-only BLOCKED with MERGEABLE.`
 	});
+	const awaitPostUndraftChecks = awaitPostUndraftChecksRepair(input);
 	if ((input.hostedVerifyCheck ?? "none") === "none") blockers.push({
 		demand: DEMAND_KEYS.githubChecks,
-		reason: `GitHub has no ${HOSTED_VERIFY_CHECK_NAME$1} check run from its workflow producer on this head; the branch ruleset pins it as a required check and the status rollup does not report the shortfall.`
+		reason: `GitHub has no ${HOSTED_VERIFY_CHECK_NAME$1} check run from its workflow producer on this head; the branch ruleset pins it as a required check and the status rollup does not report the shortfall.`,
+		...awaitPostUndraftChecks
 	});
 	if (input.requiredChecks === "none" && input.classification !== "docs/process-only") blockers.push({
 		demand: DEMAND_KEYS.githubChecks,
-		reason: "GitHub has no current checks for a non-docs PR."
+		reason: "GitHub has no current checks for a non-docs PR.",
+		...awaitPostUndraftChecks
 	});
 	else if (input.requiredChecks !== "passed" && input.requiredChecks !== "none") blockers.push({
 		demand: DEMAND_KEYS.githubChecks,
 		reason: `${PENDING_CHECKS_BLOCKER_REASON_PREFIX} ${input.requiredChecks}; expected passed.`,
-		...input.requiredChecks === "pending" ? { repair: {
-			action: "Poll and retry until post-undraft GitHub checks settle or fail; UNSTABLE/pending is a transient route-owned state, not a human blocker.",
-			code: "await-post-undraft-checks",
-			command: `gh pr checks ${input.pr} --watch`
-		} } : {}
+		...awaitPostUndraftChecks
 	});
 	if (input.draft) {
 		const promotion = prUndraftFollowUp(input.pr);
@@ -15683,7 +15951,7 @@ const collectBlockers = ({ correctnessRequired, correctnessStatus, correctnessUn
 	}
 	return blockers;
 };
-const orderRepairs = (repairs) => repairs.toSorted((a, b) => READINESS_REPAIR_CODES.indexOf(a.code) - READINESS_REPAIR_CODES.indexOf(b.code));
+const orderRepairs = (repairs) => [...new Map(repairs.map((repair) => [repair.code, repair])).values()].toSorted((a, b) => READINESS_REPAIR_CODES.indexOf(a.code) - READINESS_REPAIR_CODES.indexOf(b.code));
 const verificationProofForInput = ({ input }) => {
 	if (input.verificationProof) return {
 		fullVerifiedHeadShas: input.docsOnlyVerifyBaselineHeadShas,
@@ -16668,6 +16936,7 @@ const prReadyProofSchema = z.object({
 			"not-armed"
 		])
 	}).optional(),
+	authoringSession: z.string().min(1).optional(),
 	blockedReasons: blockedReasonsSchema.optional(),
 	blockingReasons: z.array(z.string()),
 	command: z.literal("patronage-factory pr:ready"),
@@ -16994,7 +17263,7 @@ async function runPrReady(args, dependencies = {}) {
 			requiredChecks
 		});
 		const output = path.resolve(cwd, args.output ?? ".factory-memory/pr-ready.json");
-		const externalCheckState = statusCheckState(pr.statusCheckRollup, isFactoryReadyCheck);
+		const externalCheckState = statusCheckState(pr.statusCheckRollup, isExcludedFromAdmissionChecks);
 		const hostedVerifyCheck = hostedVerifyCheckState(pr.statusCheckRollup);
 		const effectiveMergeStateStatus = pr.mergeStateStatus === "UNSTABLE" && (externalCheckState === "passed" || externalCheckState === "pending" || externalCheckState === "none") ? "CLEAN" : pr.mergeStateStatus;
 		const mergeFreeze = armingMergeFreezeOutcome({
@@ -17056,6 +17325,7 @@ async function runPrReady(args, dependencies = {}) {
 		});
 		const undraftRepair = evaluation.repairs.find((repair) => repair.code === "undraft-pr");
 		const pendingExternalChecksOnly = externalCheckState === "pending" && evaluation.blockingReasons.length === 1;
+		const routeOwnedNotYetOnly = evaluation.status === "blocked" && evaluation.humanBlockingReasons.length === 0;
 		const boundary = waveDemand?.kind === "demanded" ? waveDemand.demand : void 0;
 		const arming = evaluation.status === "ready" && boundary?.autoMerge === true ? (dependencies.armAutoMerge ?? armAutoMerge)({
 			cwd,
@@ -17088,10 +17358,12 @@ async function runPrReady(args, dependencies = {}) {
 			...arming ? [armingNotice(arming)] : [],
 			...waveDemand?.notices ?? [],
 			...evaluation.status === "ready" && !boundary ? ["No boundary wave authorized this candidate, so nothing was armed: pr:ready admits it but schedules no merge. Re-run with --epic <issue> to resolve the wave demand and arm. That issue can be the work issue itself, carrying its own fence; do not file a second boundary issue for one candidate."] : [],
-			...evaluation.status === "ready" && boundary?.autoMerge === false ? [`This candidate is admitted but unscheduled: boundary wave ${boundary.wave} does not authorize machine merge. GitHub auto-merge remains disabled; use the attended merge operation authorized for this wave.`] : []
+			...evaluation.status === "ready" && boundary?.autoMerge === false ? [`This candidate is admitted but unscheduled: boundary wave ${boundary.wave} does not authorize machine merge. GitHub auto-merge remains disabled; use the attended merge operation authorized for this wave.`] : [],
+			...routeOwnedNotYetOnly ? [`No ${FACTORY_CHECK_NAMES["pr-ready"]} check run was published for ${pr.headRefOid}: every refusal on this run is route-owned and not yet cleared (${evaluation.repairs.map((repair) => repair.code).join(", ")}). An absent required check blocks the merge, so the silence admits nothing; a proof failure still publishes a red check. Clear the repair and re-run pr:ready to green the head.`] : []
 		];
 		const proof = {
 			...arming ? { arming } : {},
+			...authoringSession ? { authoringSession } : {},
 			...evaluation.blockedReasons.length > 0 ? { blockedReasons: evaluation.blockedReasons } : {},
 			blockingReasons: evaluation.blockingReasons,
 			command: "patronage-factory pr:ready",
@@ -17119,7 +17391,7 @@ async function runPrReady(args, dependencies = {}) {
 			sha: pr.headRefOid,
 			conclusion: CHECK_CONCLUSION_BY_READINESS_STATUS[proof.status]
 		};
-		const publishedFinalCheck = await (dependencies.publishFinalCheckRun ? dependencies.publishFinalCheckRun(finalCheckInput) : ensureFactoryCheckRunPublished(finalCheckInput, { onDiagnostic: (message) => process.stderr.write(message) }));
+		const publishedFinalCheck = routeOwnedNotYetOnly || await (dependencies.publishFinalCheckRun ? dependencies.publishFinalCheckRun(finalCheckInput) : ensureFactoryCheckRunPublished(finalCheckInput, { onDiagnostic: (message) => process.stderr.write(message) }));
 		finalCheckPublished = true;
 		if (!publishedFinalCheck) {
 			notices.push(`The ${FACTORY_CHECK_NAMES["pr-ready"]} check run was NOT confirmed for ${pr.headRefOid}, so GitHub is not serving this run's verdict as the settled state of the required check. Either the publication never landed there, or another run of that name is still unfinished on this head (#524) — an unfinished run blocks the merge whatever this run published, and publishing a newer one does not clear it. GitHub reports no rollup reason for either. Re-run pr:ready once the factory GitHub App can post; if it stays unconfirmed, look for a non-terminal ${FACTORY_CHECK_NAMES["pr-ready"]} run on ${pr.headRefOid}.`);
@@ -17514,7 +17786,7 @@ const authorityRule = (waveRung) => waveRung === void 0 ? `Emit schemaVersion 1
 */
 const reviewFooterInstructions = (waveRung) => {
 	const schemaVersion = waveRung === void 0 ? 1 : 2;
-	return `Do not print a machine-readable footer in your chat response. Instead, write your findings to the typed findings file at the path given in your dispatch/task instructions (the file pr:review reads via --findings <path>). The file must be valid JSON matching review-findings-file.ts's schema (schemaVersion ${schemaVersion}):
+	return `Do not print a machine-readable footer in your chat response. Write your findings to the typed findings file at the path given in your dispatch/task instructions (the file pr:review reads via --findings <path>); that file is the verdict. The file must be valid JSON matching review-findings-file.ts's schema (schemaVersion ${schemaVersion}):
 {
   "schemaVersion": ${schemaVersion},
 ${waveRung === void 0 ? "" : `  "producer": "<the engine and model that ran this review, for example codex-cli/gpt-5.6-sol>",\n  "rung": "${waveRung}",\n`}  "model": "<your model identifier>",
@@ -18283,6 +18555,7 @@ async function runPrReview(args, dependencies = {}) {
 }
 //#endregion
 //#region src/pr-publish.ts
+const defaultNow = () => /* @__PURE__ */ new Date();
 var PrPublishFollowUpError = class extends Error {
 	result;
 	constructor(result, cause) {
@@ -18614,7 +18887,8 @@ const PUBLISH_HOSTED_CHECKS_WAIT_MS = 15e3;
 * PR #983 measured the second half: `verify` finished first, readiness ran and
 * published red, and the head's status-HUD job was still in progress.
 *
-* The `patronage-factory/*` family is excluded through `isFactoryReadyCheck`,
+* The `patronage-factory/*` family and the draft-head summary residue are
+* excluded through `isExcludedFromAdmissionChecks` (#1045),
 * the predicate readiness itself uses to exclude its own writes from the
 * rollup gate. Waiting on it would deadlock: readiness is what completes those
 * runs, and a stranded non-terminal generation of one (#524) never finishes.
@@ -18626,7 +18900,7 @@ const PUBLISH_HOSTED_CHECKS_WAIT_MS = 15e3;
 * proceeds exactly as it does today. A moved head is reported, never absorbed:
 * the caller aborts the transaction on it.
 */
-async function awaitHostedChecksSettled({ expectedHeadSha, fetchPr, report = (message) => process.stderr.write(message), sleep = setTimeout$1 }) {
+async function awaitHostedChecksSettled({ expectedHeadSha, fetchPr, report = (message) => process.stderr.write(message), sleep = setTimeout$1, verifyNotBefore }) {
 	for (let attempts = 0;; attempts += 1) {
 		const pr = fetchPr();
 		if (!sameHeadSha(pr.headRefOid, expectedHeadSha)) return {
@@ -18634,9 +18908,10 @@ async function awaitHostedChecksSettled({ expectedHeadSha, fetchPr, report = (me
 			attempts,
 			status: "head-moved"
 		};
-		const verifyState = hostedVerifyCheckState(pr.statusCheckRollup);
+		const rollup = verifyNotBefore === void 0 ? pr.statusCheckRollup : pr.statusCheckRollup?.filter((check) => !isSupersededHostedVerifyCheck(check, verifyNotBefore));
+		const verifyState = hostedVerifyCheckState(rollup);
 		const verifySettled = verifyState !== "none" && verifyState !== "pending";
-		const pending = pendingCheckNames(pr.statusCheckRollup, isFactoryReadyCheck);
+		const pending = pendingCheckNames(rollup, isExcludedFromAdmissionChecks);
 		if (verifySettled && pending.length === 0) return {
 			attempts,
 			status: "settled",
@@ -18671,15 +18946,28 @@ const reevaluateReadiness = (args, dependencies) => (dependencies.runPrReady ??
 * invocation's verify and review proof describe the head it waited for. That
 * is the same reason the #348 await aborts on head movement.
 */
-const awaitHostedChecksBeforeReadiness = async ({ dependencies, expectedHeadSha, fetchPr }) => {
+const awaitHostedChecksBeforeReadiness = async ({ dependencies, expectedHeadSha, fetchPr, verifyNotBefore }) => {
 	const outcome = await awaitHostedChecksSettled({
 		expectedHeadSha,
 		fetchPr,
-		...dependencies.sleep === void 0 ? {} : { sleep: dependencies.sleep }
+		...dependencies.sleep === void 0 ? {} : { sleep: dependencies.sleep },
+		...verifyNotBefore === void 0 ? {} : { verifyNotBefore }
 	});
 	if (outcome.status === "head-moved") throw new PrPublishTransactionAbortedError(`awaited the head's hosted check runs for ${expectedHeadSha}, but the head moved to ${outcome.actualHeadSha} while waiting. Re-run pr:publish against the current head.`);
 	return outcome;
 };
+/**
+* The instant `pr:publish` measures `verify` staleness from (#1045). Read
+* before the promotion, so every check run that already existed on the head
+* sorts strictly before it.
+*/
+const promotionInstant = (dependencies) => (dependencies.now ?? defaultNow)().toISOString();
+/**
+* The staleness cutoff to hand the hosted-run await — present only when this
+* invocation actually promoted the candidate. Without a promotion there is no
+* draft-era `verify` to distrust, and the wait keeps today's behaviour.
+*/
+const promotionVerifyCutoff = (promotion, promotionStartedAt) => promotion.status === "succeeded" ? { verifyNotBefore: promotionStartedAt } : {};
 const requirePromotionHead = ({ actualHeadSha, expectedHeadSha, phase }) => {
 	if (!sameHeadSha(actualHeadSha, expectedHeadSha)) throw new PrPublishTransactionAbortedError(`${phase}: live PR head ${actualHeadSha} differs from the proved publish head ${expectedHeadSha}. Re-run pr:publish against the current head.`);
 };
@@ -18887,6 +19175,7 @@ async function runPrPublish(args, dependencies = {}) {
 		json: false,
 		report: false
 	};
+	const promotionStartedAt = promotionInstant(dependencies);
 	const promotion = await promoteDraftBeforeDemandEvaluation({
 		cwd,
 		expectedHeadSha: verifyProof.headSha,
@@ -18899,7 +19188,8 @@ async function runPrPublish(args, dependencies = {}) {
 	await awaitHostedChecksBeforeReadiness({
 		dependencies,
 		expectedHeadSha: verifyProof.headSha,
-		fetchPr
+		fetchPr,
+		...promotionVerifyCutoff(promotion, promotionStartedAt)
 	});
 	const initialProof = await reevaluateReadiness(readyEvalArgs, publishDependencies);
 	requirePromotedProofHead({

package/dist/schemas.d.ts

@@ -531,6 +531,33 @@ interface PrVerifyCommandResult {
   name: string;
   scope: "docs-only" | "trivial" | "full";
 }
+/**
+ * One failing test a verification command reported (#1035).
+ *
+ * The proof keeps the failing test's IDENTITY and its failure CLASS, and
+ * nothing else. That is enough to decide retry-or-fix — a `timeout` under
+ * machine load is a flake, an `assertion` is a real break — without rerunning
+ * the aggregate to read a title off the console.
+ *
+ * It deliberately keeps no raw output tail and no error message body. This
+ * payload is transmitted to HQ ingest, and arbitrary command output can carry
+ * secrets (an echoed environment, a connection string inside a stack frame). A
+ * file path, a test title, and a closed `kind` enum cannot. The cost is the
+ * assertion diff and the stack frames: they help you FIX a failure, and the
+ * operator still reads them from the run's own console output.
+ */
+interface PrVerifyTestFailure {
+  /** The test file the reporter named, as the reporter wrote it. */
+  file: string;
+  /**
+   * The failure class. `timeout` is the test-timeout error vitest raises at
+   * its own ceiling; `assertion` is a failed expectation; `error` is every
+   * other thrown failure.
+   */
+  kind: "assertion" | "error" | "timeout";
+  /** The full test title, suite names included, as the reporter wrote it. */
+  title: string;
+}
 interface PrVerifyExecutedCommand {
   command: string;
   counts?: {
@@ -539,6 +566,12 @@ interface PrVerifyExecutedCommand {
   };
   durationMs: number;
   exitCode: number;
+  /**
+   * The failing tests this command reported (#1035). Present only when the
+   * command produced parseable failures, so a passing command's record is
+   * byte-identical to the one it wrote before this field existed.
+   */
+  failures?: PrVerifyTestFailure[];
   name: string;
   scope: "docs-only" | "trivial" | "full";
 }
@@ -640,6 +673,15 @@ declare const prVerifyProofSchema: z.ZodObject<{
     }, z.core.$strip>>;
     durationMs: z.ZodNumber;
     exitCode: z.ZodNumber;
+    failures: z.ZodOptional<z.ZodArray<z.ZodObject<{
+      file: z.ZodString;
+      kind: z.ZodEnum<{
+        error: "error";
+        assertion: "assertion";
+        timeout: "timeout";
+      }>;
+      title: z.ZodString;
+    }, z.core.$strip>>>;
     name: z.ZodString;
     scope: z.ZodEnum<{
       trivial: "trivial";
@@ -734,6 +776,14 @@ interface PrReadyProof {
     headSha: string;
     outcome: "armed" | "merged" | "not-armed";
   };
+  /**
+   * The authoring session readiness resolved for the review-independence
+   * cross-check (#1037). Recorded so the branded check can print it beside the
+   * review session, model, and producer the ledger already carries — the four
+   * identities a human weighs at merge time. Additive and optional: proofs
+   * written before it carry no field, so no schema version moves.
+   */
+  authoringSession?: string;
   /**
    * Why this run blocked, one entry per refusing demand (#391): `code` is the
    * demand key from the resolver's vocabulary, `detail` the one-sentence
@@ -1014,6 +1064,7 @@ declare const prReadyProofSchema: z.ZodObject<{
       "not-armed": "not-armed";
     }>;
   }, z.core.$strip>>;
+  authoringSession: z.ZodOptional<z.ZodString>;
   blockedReasons: z.ZodOptional<z.ZodArray<z.ZodObject<{
     code: z.ZodString;
     detail: z.ZodString;

package/dist/schemas.js

@@ -1171,6 +1171,15 @@ const assertPrVerifyProofRules = (proof, context) => {
 * factory must adopt this release before HQ ingests its pr:verify proofs.
 */
 const SUPPORTED_PR_VERIFY_SCHEMA_VERSIONS = [4];
+const prVerifyTestFailureSchema = z.object({
+	file: z.string().min(1),
+	kind: z.enum([
+		"assertion",
+		"error",
+		"timeout"
+	]),
+	title: z.string().min(1)
+});
 const executedCommandSchema = z.object({
 	command: z.string().min(1),
 	counts: z.object({
@@ -1179,6 +1188,7 @@ const executedCommandSchema = z.object({
 	}).optional(),
 	durationMs: z.number().nonnegative(),
 	exitCode: z.number(),
+	failures: z.array(prVerifyTestFailureSchema).min(1).optional(),
 	name: z.string().min(1),
 	scope: z.enum([
 		"docs-only",
@@ -1614,6 +1624,7 @@ const prReadyProofSchema = z.object({
 			"not-armed"
 		])
 	}).optional(),
+	authoringSession: z.string().min(1).optional(),
 	blockedReasons: blockedReasonsSchema.optional(),
 	blockingReasons: z.array(z.string()),
 	command: z.literal("patronage-factory pr:ready"),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@patronage/software-factory",
-  "version": "1.0.0-alpha.28",
+  "version": "1.0.0-alpha.29",
   "description": "Shared Patronage software factory CLI and project-profile validation tools",
   "license": "MIT",
   "repository": {
@@ -37,7 +37,7 @@
     "picomatch": "^4.0.5",
     "yaml": "^2.9.0",
     "zod": "4.4.3",
-    "@patronage/factory-ci": "1.0.0-alpha.28"
+    "@patronage/factory-ci": "1.0.0-alpha.29"
   },
   "devDependencies": {
     "@types/node": "24.13.3",