@patronage/software-factory 1.0.0-alpha.3 → 1.0.0-alpha.30

package/dist/index.d.ts

@@ -1,8 +1,98 @@
-import { existsSync, readFileSync, rmSync } from "node:fs";
 import { Command } from "commander";
 import { z } from "zod";
-import { readFile } from "node:fs/promises";
+import { existsSync, readFileSync, rmSync } from "node:fs";
+import { PreviewProofRegistration } from "@patronage/factory-ci";
 
+//#region src/review-rungs.d.ts
+declare const EVIDENCE_REVIEW_RUNGS: readonly ["independent-model", "oracle", "human"];
+type EvidenceReviewRung = (typeof EVIDENCE_REVIEW_RUNGS)[number];
+declare namespace boundary_manifest_d_exports {
+  export { BOUNDARY_CLOSEOUT_DEFAULT_RUNG, BOUNDARY_MANIFEST_SCHEMA_VERSION, BoundaryManifest, BoundaryManifestExtraction, BoundaryManifestParse, FACTORY_BOUNDARY_FENCE_LANG, boundaryManifestSchema, closeoutRungFor, extractBoundaryManifestBlock, manifestContentHash, parseBoundaryManifest, rungMeetsMinimum, specContentHash };
+}
+declare const FACTORY_BOUNDARY_FENCE_LANG = "factory-boundary";
+declare const BOUNDARY_MANIFEST_SCHEMA_VERSION = 1;
+declare const BOUNDARY_CLOSEOUT_DEFAULT_RUNG: EvidenceReviewRung;
+declare const rungMeetsMinimum: (rung: EvidenceReviewRung, minimum: EvidenceReviewRung) => boolean;
+declare const boundaryManifestBaseSchema: z.ZodObject<{
+  boundary: z.ZodString;
+  closeout: z.ZodOptional<z.ZodObject<{
+    review: z.ZodEnum<{
+      oracle: "oracle";
+      "independent-model": "independent-model";
+      human: "human";
+    }>;
+  }, z.core.$loose>>;
+  declaredBy: z.ZodString;
+  integrationBranch: z.ZodOptional<z.ZodString>;
+  schemaVersion: z.ZodLiteral<1>;
+  topology: z.ZodEnum<{
+    flagged: "flagged";
+    "each-to-main": "each-to-main";
+    stacked: "stacked";
+    "each-to-epic": "each-to-epic";
+  }>;
+  waves: z.ZodArray<z.ZodObject<{
+    autoMerge: z.ZodOptional<z.ZodBoolean>;
+    issues: z.ZodArray<z.ZodNumber>;
+    name: z.ZodString;
+    review: z.ZodEnum<{
+      oracle: "oracle";
+      "independent-model": "independent-model";
+      human: "human";
+    }>;
+  }, z.core.$loose>>;
+}, z.core.$loose>;
+declare const boundaryManifestSchema: z.ZodObject<{
+  boundary: z.ZodString;
+  closeout: z.ZodOptional<z.ZodObject<{
+    review: z.ZodEnum<{
+      oracle: "oracle";
+      "independent-model": "independent-model";
+      human: "human";
+    }>;
+  }, z.core.$loose>>;
+  declaredBy: z.ZodString;
+  integrationBranch: z.ZodOptional<z.ZodString>;
+  schemaVersion: z.ZodLiteral<1>;
+  topology: z.ZodEnum<{
+    flagged: "flagged";
+    "each-to-main": "each-to-main";
+    stacked: "stacked";
+    "each-to-epic": "each-to-epic";
+  }>;
+  waves: z.ZodArray<z.ZodObject<{
+    autoMerge: z.ZodOptional<z.ZodBoolean>;
+    issues: z.ZodArray<z.ZodNumber>;
+    name: z.ZodString;
+    review: z.ZodEnum<{
+      oracle: "oracle";
+      "independent-model": "independent-model";
+      human: "human";
+    }>;
+  }, z.core.$loose>>;
+}, z.core.$loose>;
+type BoundaryManifest = z.infer<typeof boundaryManifestBaseSchema>;
+type BoundaryManifestExtraction = {
+  ok: true;
+  blockText: string;
+} | {
+  ok: false;
+  error: string;
+};
+declare const extractBoundaryManifestBlock: (issueBody: string) => BoundaryManifestExtraction;
+declare const manifestContentHash: (blockText: string) => string;
+declare const specContentHash: (issueBody: string) => string;
+type BoundaryManifestParse = {
+  ok: true;
+  manifest: BoundaryManifest;
+  manifestHash: string;
+} | {
+  ok: false;
+  error: string;
+};
+declare const parseBoundaryManifest: (issueBody: string) => BoundaryManifestParse;
+declare const closeoutRungFor: (manifest: BoundaryManifest) => EvidenceReviewRung;
+//#endregion
 //#region src/github-issue-comments.d.ts
 interface GithubIssueCommentApi {
   body: string;
@@ -127,6 +217,120 @@ declare const selectBoundaryReviewProof: (comments: GithubIssueComment[], bounda
 declare const boundaryReviewProofAuthorsSeen: (comments: GithubIssueComment[], boundary: string) => string[];
 declare const undispositionedBlockingFindings: (proof: BoundaryReviewProof) => string[];
 //#endregion
+//#region src/boundary-membership-graph.d.ts
+/** The boundary-manifest wave demand that applies to one pull request. */
+interface WaveReviewDemand {
+  autoMerge: boolean;
+  review: EvidenceReviewRung;
+  wave: string;
+}
+interface BoundaryPullRequestRef {
+  baseRefName?: string;
+  headRefOid?: string;
+  headRefName?: string;
+  mergeCommitOid?: string;
+  /** GitHub's merge timestamp; the merge-ordering fact topology reads (#821). */
+  mergedAt?: string;
+  number: number;
+  state: "OPEN" | "CLOSED" | "MERGED";
+}
+//#endregion
+//#region src/demand-waiver.d.ts
+declare const DEFAULT_DEMAND_WAIVER_PATH = ".factory-memory/demand-waivers.json";
+/** One recorded operator act: this demand, on this candidate, waived. */
+interface DemandWaiver {
+  candidate: {
+    headSha: string;
+    pr: number;
+  };
+  demand: string;
+  /** The authenticated GitHub account that recorded the waiver. */
+  operator: string;
+  rationale: string;
+  recordedAt: string;
+  /** Optional audit metadata; never waiver authority. */
+  session?: string;
+}
+interface DemandWaiverStore {
+  command: "patronage-factory demand:waive";
+  schemaVersion: 1;
+  waivers: DemandWaiver[];
+}
+declare const validateDemandWaiverStore: (value: unknown) => DemandWaiverStore;
+/**
+ * A demand that was in force, was NOT met, and was waived by the operator.
+ *
+ * `unmetReasons` is required and non-empty: every reason the demand refused is
+ * carried through verbatim. There is no field on this record that could say
+ * "satisfied", and no code path constructs one without a refusal to carry.
+ */
+interface WaivedDemand {
+  demand: string;
+  operator: string;
+  rationale: string;
+  recordedAt: string;
+  session?: string;
+  /** The demand's refusals at evaluation time, preserved verbatim. */
+  unmetReasons: string[];
+}
+declare const waivedDemandSchema: z.ZodType<WaivedDemand>;
+/** The waivers that bind one candidate: same PR, same head. */
+declare const selectWaiversForCandidate: ({
+  headSha,
+  pr,
+  waivers
+}: {
+  headSha: string | undefined;
+  pr: number;
+  waivers: readonly DemandWaiver[];
+}) => DemandWaiver[];
+interface DemandOutcome {
+  blockingReasons: string[];
+  waived?: WaivedDemand;
+}
+/**
+ * Fold one resolved demand's refusals through the operator's waivers.
+ *
+ * A satisfied demand (no refusals) stays satisfied and the waiver stays inert
+ * — a waiver can only ever move a demand from *unmet-and-blocking* to
+ * *unmet-and-waived*, never to met.
+ */
+declare const applyDemandWaiver: ({
+  demand,
+  reasons,
+  waivers
+}: {
+  demand: string;
+  reasons: readonly string[];
+  waivers: readonly DemandWaiver[];
+}) => DemandOutcome;
+/** How a waived demand reads to a human. Never the word "satisfied". */
+declare const waivedDemandNotice: (waived: WaivedDemand) => string;
+interface DemandWaiverAuthorization {
+  operator: string;
+  session?: string;
+}
+type AuthorizeDemandWaiverResult = {
+  authorization: DemandWaiverAuthorization;
+  refusals?: undefined;
+} | {
+  authorization?: undefined;
+  refusals: string[];
+};
+/**
+ * Operator identity, `declaredBy`-style: a named human account, recorded on
+ * the waiver and enforced here. Session is optional audit metadata only: it is
+ * not credential-backed, so its absence or equality never authorizes or
+ * refuses an operator act.
+ */
+declare const authorizeDemandWaiver: ({
+  authenticatedLogin,
+  session
+}: {
+  authenticatedLogin: string | undefined;
+  session: string | undefined;
+}) => AuthorizeDemandWaiverResult;
+//#endregion
 //#region src/hq-ingest-sink.d.ts
 interface HqIngestDependencies {
   /**
@@ -145,8 +349,6 @@ interface HqIngestDependencies {
    * `timeoutMs`: see the note there.
    */
   journalFlushBudgetMs?: number;
-  /** @deprecated Legacy sidecars are now streamed directly; retained for API compatibility. */
-  sidecarReclaimMs?: number;
   /**
    * Setup budget for callers that own the process lifetime — honored AS GIVEN,
    * above the `DEFAULT_HQ_INGEST_TIMEOUT_MS` ceiling that clamps `timeoutMs`.
@@ -182,14 +384,17 @@ interface HqSpoolEntryOutcome {
   detail?: string;
   eventId: string;
   kind: string;
+  /**
+   * `true` when HQ refused the content as schema-invalid (HTTP 422, #739).
+   * The same bytes get the same verdict on every retry under the current
+   * ingest schema, so retrying without a schema change cannot succeed.
+   * Distinct from `undeliverable`: an HQ schema fix can still admit these
+   * bytes, so eviction is an operator decision (`hq:flush --evict-permanent`),
+   * never automatic.
+   */
+  permanent?: boolean;
   spool: string;
   /**
-   * `migrated` belongs to the legacy JSONL journal only: the row was moved
-   * into the current spool without being delivered. The spool pass that runs
-   * after it in the same drain supersedes that line with a real outcome when
-   * it gets to the row; a `migrated` line that survives the run means the row
-   * is still waiting.
-   *
    * `undeliverable` is the one terminal verdict (#445). Every other status
    * describes a moment: HQ was unreachable, HQ refused this content today, the
    * row moved. Retrying is meaningful for all of them. A wrong-origin entry is
@@ -198,15 +403,20 @@ interface HqSpoolEntryOutcome {
    * run. Leaving it spooled asks the operator to retry something that provably
    * cannot succeed, and the count it inflates is the one doctor goes red on.
    */
-  status: "delivered" | "duplicate" | "migrated" | "rejected" | "undeliverable" | "unreachable";
+  status: "delivered" | "duplicate" | "rejected" | "undeliverable" | "unreachable";
 }
 interface HqSpoolFlushInput {
   clientId: string;
   clientSecret: string;
-  /** Repository root whose legacy `.factory-memory` spool is also drained. */
-  cwd: string;
   /** The profile's HQ origin; entries recorded against another are refused. */
   endpoint: string;
+  /**
+   * Disposition schema-permanent rejections (HTTP 422) in place with the
+   * `.undeliverable` suffix instead of retaining them (#739). Operator
+   * opt-in: a later HQ schema fix can still admit the same bytes, so the
+   * drain never evicts on its own.
+   */
+  evictPermanentRejections?: boolean;
   /** Operator-named spool directories; replaces the default two locations. */
   explicitDirectories?: string[];
   repository: HqSpoolRepository;
@@ -239,13 +449,13 @@ interface HqSpoolFlushSummary {
 interface HqSpoolWorkCount {
   /**
    * The earliest moment learned across pending spool files (their own write
-   * time) and legacy journal rows (their own `failedAt`). Absent only when
+   * time). Absent only when
    * `pending` is `0`, or when every timestamp source was unreadable within
    * budget — an estimate for doctor's remediation message (#394), never a
    * precise audit trail.
    */
   oldestQueuedAt?: string;
-  /** Spooled events and replayable journals waiting in the locations below. */
+  /** Spooled events waiting in the locations below. */
   pending: number;
   /** Locations that exist and hold spooled work. */
   spools: string[];
@@ -266,7 +476,7 @@ interface HqSpoolWorkCount {
  * same locations `flushHqSpool` drains are inspected here, read-only: no
  * directory is created, nothing is secured, and nothing is delivered.
  */
-declare function countHqSpoolWork(input: Pick<HqSpoolFlushInput, "cwd" | "explicitDirectories" | "repository">, dependencies?: {
+declare function countHqSpoolWork(input: Pick<HqSpoolFlushInput, "explicitDirectories" | "repository">, dependencies?: {
   budgetMs?: number;
   env?: NodeJS.ProcessEnv;
 }): Promise<HqSpoolWorkCount>;
@@ -275,7 +485,7 @@ interface HqSpoolOrphan {
   /** The `hq-retry-spool` directory itself, ready to pass to `--dir`. */
   directory: string;
   oldestQueuedAt?: string;
-  /** Spooled events and journal rows waiting there. */
+  /** Spooled events waiting there. */
   pending: number;
   /**
    * The location exists but could not be listed. As everywhere else in this
@@ -358,101 +568,270 @@ declare function sweepHqSpoolOrphans(input: {
   env?: NodeJS.ProcessEnv;
 }): Promise<HqSpoolOrphanSweep>;
 //#endregion
-//#region src/demand-waiver.d.ts
-declare const DEFAULT_DEMAND_WAIVER_PATH = ".factory-memory/demand-waivers.json";
-/** One recorded operator act: this demand, on this candidate, waived. */
-interface DemandWaiver {
-  candidate: {
-    headSha: string;
-    pr: number;
+//#region src/packages/review-prompt-sections/schema.d.ts
+declare const reviewPromptSectionSchema: z.ZodObject<{
+  provenance: z.ZodEnum<{
+    "coding-standards": "coding-standards";
+    "prior-review-ledger": "prior-review-ledger";
+    "issue-review-focus": "issue-review-focus";
+  }>;
+  source: z.ZodString;
+  text: z.ZodString;
+}, z.core.$strict>;
+type ReviewPromptSection = z.infer<typeof reviewPromptSectionSchema>;
+type ReviewPromptSectionProvenance = ReviewPromptSection["provenance"];
+declare const reviewPromptSectionsSchema: z.ZodArray<z.ZodObject<{
+  provenance: z.ZodEnum<{
+    "coding-standards": "coding-standards";
+    "prior-review-ledger": "prior-review-ledger";
+    "issue-review-focus": "issue-review-focus";
+  }>;
+  source: z.ZodString;
+  text: z.ZodString;
+}, z.core.$strict>>;
+//#endregion
+//#region src/policy-resolution.d.ts
+/** How a gate resolved the review policy it evaluated a candidate under. */
+declare const policyResolutionSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+  basePolicyDigest: z.ZodString;
+  baseRefName: z.ZodString;
+  candidatePolicyDigest: z.ZodString;
+  effectiveDigest: z.ZodString;
+  policyBaseSha: z.ZodString;
+  reviewPolicyChanged: z.ZodBoolean;
+  status: z.ZodLiteral<"authoritative">;
+}, z.core.$strict>, z.ZodObject<{
+  baseRefName: z.ZodString;
+  reason: z.ZodString;
+  status: z.ZodLiteral<"unresolved">;
+}, z.core.$strict>], "status">;
+type PolicyResolution = z.infer<typeof policyResolutionSchema>;
+//#endregion
+//#region src/review-ladder-policy.d.ts
+type ReviewFindingSeverity = "critical" | "high" | "medium" | "low" | "unknown";
+type ReviewFindingCategory = "correctness" | "safety" | "coordination" | "maintainability" | "unknown";
+declare const REVIEW_SEVERITIES: readonly ["critical", "high", "medium", "low", "unknown"];
+declare const FINDING_DISPOSITIONS: readonly ["open", "fixed-in-thread", "follow-up-filed", "waived", "stale-repeat", "rerun-noise"];
+type FindingDisposition = (typeof FINDING_DISPOSITIONS)[number];
+interface ReviewFindingAttributes {
+  blockingAfterCap?: boolean;
+  category?: string;
+  citedSpan?: string;
+  file?: string;
+  prescribedAction?: string;
+  priority?: string;
+  supersedes?: {
+    file?: string;
+    title: string;
   };
-  demand: string;
-  /** The authenticated GitHub account that recorded the waiver. */
-  operator: string;
-  rationale: string;
-  recordedAt: string;
-  /** Optional audit metadata; never waiver authority. */
-  session?: string;
+  title: string;
 }
-interface DemandWaiverStore {
-  command: "patronage-factory demand:waive";
-  schemaVersion: 1;
-  waivers: DemandWaiver[];
+interface ReviewLadderPolicy {
+  gate: {
+    cap: number;
+  };
 }
-declare const validateDemandWaiverStore: (value: unknown) => DemandWaiverStore;
-/**
- * A demand that was in force, was NOT met, and was waived by the operator.
- *
- * `unmetReasons` is required and non-empty: every reason the demand refused is
- * carried through verbatim. There is no field on this record that could say
- * "satisfied", and no code path constructs one without a refusal to carry.
- */
-interface WaivedDemand {
-  demand: string;
-  operator: string;
-  rationale: string;
-  recordedAt: string;
-  session?: string;
-  /** The demand's refusals at evaluation time, preserved verbatim. */
-  unmetReasons: string[];
+//#endregion
+//#region src/review-ladder-ledger.d.ts
+type LadderCycleStage = "interior" | "gate";
+interface LadderCycleRef {
+  cycle: number;
+  stage: LadderCycleStage;
 }
-declare const waivedDemandSchema: z.ZodType<WaivedDemand>;
-/** The waivers that bind one candidate: same PR, same head. */
-declare const selectWaiversForCandidate: ({
-  headSha,
-  pr,
-  waivers
-}: {
-  headSha: string | undefined;
-  pr: number;
-  waivers: readonly DemandWaiver[];
-}) => DemandWaiver[];
-interface DemandOutcome {
-  blockingReasons: string[];
-  waived?: WaivedDemand;
+type LadderFindingReport = ReviewFindingAttributes;
+type DeclarableFindingDisposition = Exclude<FindingDisposition, "open" | "stale-repeat" | "rerun-noise">;
+interface LadderDispositionDeclaration {
+  disposition: DeclarableFindingDisposition;
+  finding: {
+    file?: string;
+    title: string;
+  };
+  findingReport?: LadderFindingReport;
+  reference?: string;
 }
-/**
- * Fold one resolved demand's refusals through the operator's waivers.
- *
- * A satisfied demand (no refusals) stays satisfied and the waiver stays inert
- * — a waiver can only ever move a demand from *unmet-and-blocking* to
- * *unmet-and-waived*, never to met.
- */
-declare const applyDemandWaiver: ({
-  demand,
-  reasons,
-  waivers
-}: {
-  demand: string;
-  reasons: readonly string[];
-  waivers: readonly DemandWaiver[];
-}) => DemandOutcome;
-/** How a waived demand reads to a human. Never the word "satisfied". */
-declare const waivedDemandNotice: (waived: WaivedDemand) => string;
-interface DemandWaiverAuthorization {
-  operator: string;
-  session?: string;
+interface FindingLedgerEntry extends ReviewFindingAttributes {
+  disposition: FindingDisposition;
+  firstFlagged: LadderCycleRef;
+  flagCount: number;
+  key: string;
+  lastFlagged: LadderCycleRef;
+  priorDisposition?: FindingDisposition;
+  reference?: string;
+  reopenedCount: number;
+  staleRepeatCount: number;
 }
-type AuthorizeDemandWaiverResult = {
-  authorization: DemandWaiverAuthorization;
-  refusals?: undefined;
+//#endregion
+//#region src/review-ladder.d.ts
+type ReviewLadderExecutedStage = "interior" | "gate";
+interface LadderSessionAttribution {
+  orchestrationMode?: "autonomous" | "manual";
+  resumedSession?: boolean;
+  runtime?: string;
+  sessionId?: string;
+}
+interface LadderUsageReport {
+  estimatedCostUsd?: number;
+  source?: string;
+  totalTokens?: number;
+}
+interface ReviewLadderCycle {
+  dispositions?: LadderDispositionDeclaration[];
+  engine?: string;
+  findings: LadderFindingReport[];
+  identity?: {
+    headSha: string;
+    patchId: string;
+  };
+  historical?: true;
+  model?: string;
+  correlatedRerun?: boolean;
+  session?: LadderSessionAttribution;
+  stage: LadderCycleStage;
+  usage?: LadderUsageReport;
+}
+type LadderNextActionKind = "run-interior-cycle" | "advance-to-gate" | "run-gate-cycle" | "accept-nonblocking-findings" | "escalate-to-triage" | "ready-for-human";
+type ReviewLadderStage = "interior" | "interior-complete" | "gate";
+type LadderForcedTransitionKind = "gate-cap-exhausted" | "interior-cap-reached";
+interface LadderForcedTransition {
+  blockingFindings: string[];
+  cap: number;
+  kind: Extract<LadderForcedTransitionKind, "gate-cap-exhausted">;
+}
+type LadderNextAction = {
+  cycle: number;
+  kind: Extract<LadderNextActionKind, "run-gate-cycle">;
 } | {
-  authorization?: undefined;
-  refusals: string[];
+  kind: Extract<LadderNextActionKind, "accept-nonblocking-findings">;
+} | {
+  kind: Extract<LadderNextActionKind, "escalate-to-triage">;
+} | {
+  kind: Extract<LadderNextActionKind, "ready-for-human">;
 };
-/**
- * Operator identity, `declaredBy`-style: a named human account, recorded on
- * the waiver and enforced here. Session is optional audit metadata only: it is
- * not credential-backed, so its absence or equality never authorizes or
- * refuses an operator act.
- */
-declare const authorizeDemandWaiver: ({
-  authenticatedLogin,
-  session
-}: {
-  authenticatedLogin: string | undefined;
-  session: string | undefined;
-}) => AuthorizeDemandWaiverResult;
+interface LadderPosition {
+  forcedTransition?: LadderForcedTransition;
+  nextAction: LadderNextAction;
+  stage: Extract<ReviewLadderStage, "gate">;
+}
+interface ReviewLadderStageEvent {
+  cycle: number;
+  cyclesToClean?: number;
+  engine?: string;
+  findingsSummary: {
+    blocking: number;
+    bySeverity: Record<ReviewFindingSeverity, number>;
+    flagged: number;
+    open: number;
+    staleRepeats: number;
+  };
+  forcedTransition?: LadderForcedTransition["kind"];
+  model?: string;
+  payloadVersion: 1;
+  session?: LadderSessionAttribution;
+  stage: ReviewLadderExecutedStage;
+  type: "review-ladder-stage";
+  usage?: LadderUsageReport;
+}
+type ReviewLadderEvaluation = LadderPosition & {
+  cycleCounts: {
+    gate: number;
+    interior: number;
+  };
+  event?: ReviewLadderStageEvent;
+  ledger: FindingLedgerEntry[];
+  unmatchedDispositions: LadderDispositionDeclaration[];
+};
+//#endregion
+//#region src/pr-readiness/ladder-proof-state.d.ts
+interface PrReviewLadderState {
+  cycles: ReviewLadderCycle[];
+}
+interface OpenCycleState {
+  autoBlockingFindings: number;
+  blockingEntries: ReviewFindingAttributes[];
+  openEntries: ReviewFindingAttributes[];
+  staleRepeatFindings?: number;
+}
+interface ReviewLadderSummaryState {
+  cycleCounts: {
+    gate: number;
+    interior: number;
+  };
+  forcedTransition?: LadderForcedTransitionKind;
+  nextAction: LadderNextActionKind;
+  stage: ReviewLadderStage;
+}
+interface ReviewLadderSnapshot {
+  cycleState: OpenCycleState;
+  evaluation: ReviewLadderEvaluation;
+  ledger: FindingLedgerEntry[];
+  policyGateCap: number;
+  summary: ReviewLadderSummaryState;
+}
+type ReviewEpochMode = {
+  kind: "ladder";
+  ladder: PrReviewLadderState;
+  snapshot?: ReviewLadderSnapshot;
+} | {
+  kind: "declared-window";
+};
+//#endregion
+//#region src/pr-readiness/review-proof-types.d.ts
+type PrReviewKind = "correctness" | "security";
+type PrReviewMode = PrReviewKind | "all";
+type PrReviewOutcome = "passed" | "failed" | "error";
+interface PrReviewStageResolution {
+  model: string;
+  sessionId: string;
+}
+//#endregion
+//#region src/pr-readiness/review-proof-shape.d.ts
+interface PrReviewFinding extends ReviewFindingAttributes {
+  body: string;
+  category?: ReviewFindingCategory;
+  line?: number;
+  protocolFinding?: true;
+}
+interface PrReviewResult {
+  kind: PrReviewKind;
+  startedAt: string;
+  endedAt: string;
+  durationMs: number;
+  model?: string;
+  producer?: string;
+  rung?: EvidenceReviewRung;
+  sessionId?: string;
+  outcome: PrReviewOutcome;
+  issuesFlagged: number;
+  summary: string;
+  findings: PrReviewFinding[];
+  typedVerdict?: boolean;
+  verdictSource?: "footer" | "recovered";
+  promptSections?: ReviewPromptSection[];
+}
+interface PrReviewProof {
+  schemaVersion: 2;
+  findingProvenanceVersion: 1;
+  base: string;
+  headSha: string;
+  patchId: string;
+  reviewCycle?: number;
+  maxReviewCycles?: number;
+  changedFiles: string[];
+  cleanedPaths: string[];
+  ladder?: PrReviewLadderState;
+  /**
+   * The policy identity this review run resolved its demanded kinds under
+   * (#922 Slice B). Optional: a run that could not reach the authority records
+   * the refusal instead, and `pr:ready` decides what an unresolved or
+   * disagreeing identity means for admission.
+   */
+  policyResolution?: PolicyResolution;
+  reviewRequirement?: {
+    reason: "no-applicable-mode" | "faithful-merge";
+    status: "not-required";
+  };
+  reviews: PrReviewResult[];
+}
 //#endregion
 //#region src/blocked-reasons.d.ts
 declare const blockedReasonSchema: z.ZodObject<{
@@ -488,44 +867,10 @@ interface CheckoutRepository {
   owner: string;
 }
 //#endregion
-//#region src/follow-up.d.ts
-interface FactoryCliInvocation {
-  /** Runtime arguments ending with the factory CLI entry module. */
-  argvPrefix: string[];
-  executable: string;
-}
-declare const FactoryCliInvocationSchema: z.ZodType<FactoryCliInvocation>;
-interface FollowUpAction {
-  /**
-   * Machine-safe argv-style array for the obvious next action, e.g.
-   * ["gh","pr","merge","513","--squash"]. Same shape and field name that
-   * `factory:delegate --print` emits, so an orchestrating agent can spawn the
-   * next command without reconstructing a shell string. argv[0] is the
-   * executable; the rest are literal, already-split arguments.
-   */
-  argv: string[];
-  /**
-   * Human-readable rendering of {@link argv} for logs and operators. Additive
-   * to argv, never a substitute for it — argv is the source of truth.
-   */
-  command: string;
-}
-/**
- * Build a {@link FollowUpAction} from a literal argv array. The `command`
- * string is derived from argv so the two never drift.
- */
-declare const followUpFromArgv: (argv: string[]) => FollowUpAction;
-/** Canonical zod schema for the optional follow-up field on JSON outputs. */
-declare const FollowUpActionSchema: z.ZodType<FollowUpAction>;
-//#endregion
-//#region src/diff-classification.d.ts
-declare const DIFF_CLASSIFICATIONS: readonly ["docs/process-only", "trivial", "non-trivial"];
-type DiffClassification = (typeof DIFF_CLASSIFICATIONS)[number];
-//#endregion
 //#region src/profile.d.ts
 declare const DEFAULT_FACTORY_REPOSITORY = "unknown/unknown";
-/** The one profile shape this build accepts (ADR 0023, #318, #351). */
-declare const PROFILE_SCHEMA_VERSION = 5;
+/** The one profile shape this build accepts (ADR 0023, #318, #351, #742). */
+declare const PROFILE_SCHEMA_VERSION = 6;
 declare const factoryProjectProfileSchema: z.ZodObject<{
   $schema: z.ZodOptional<z.ZodString>;
   extensions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
@@ -534,18 +879,17 @@ declare const factoryProjectProfileSchema: z.ZodObject<{
     endpoint: z.ZodIntersection<z.ZodString, z.ZodString>;
   }, z.core.$strict>>;
   impact: z.ZodOptional<z.ZodObject<{
+    inert: z.ZodOptional<z.ZodArray<z.ZodString>>;
     targets: z.ZodArray<z.ZodObject<{
       importers: z.ZodArray<z.ZodString>;
       name: z.ZodString;
       paths: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strict>>;
   }, z.core.$strict>>;
-  proof: z.ZodObject<{
-    classificationPolicy: z.ZodObject<{
-      docsOnly: z.ZodDefault<z.ZodArray<z.ZodString>>;
-      trivial: z.ZodDefault<z.ZodArray<z.ZodString>>;
-    }, z.core.$strict>;
-  }, z.core.$strict>;
+  lifecycleContract: z.ZodOptional<z.ZodObject<{
+    command: z.ZodString;
+    jobName: z.ZodOptional<z.ZodString>;
+  }, z.core.$strict>>;
   repository: z.ZodObject<{
     name: z.ZodString;
     owner: z.ZodString;
@@ -554,7 +898,6 @@ declare const factoryProjectProfileSchema: z.ZodObject<{
     name: z.ZodString;
     scope: z.ZodOptional<z.ZodObject<{
       classifications: z.ZodArray<z.ZodEnum<{
-        trivial: "trivial";
         "docs/process-only": "docs/process-only";
         "non-trivial": "non-trivial";
       }>>;
@@ -565,7 +908,7 @@ declare const factoryProjectProfileSchema: z.ZodObject<{
       paths: z.ZodArray<z.ZodString>;
     }, z.core.$strict>>;
   }, z.core.$strict>>;
-  schemaVersion: z.ZodLiteral<5>;
+  schemaVersion: z.ZodLiteral<6>;
   verification: z.ZodObject<{
     commands: z.ZodArray<z.ZodObject<{
       command: z.ZodString;
@@ -593,6 +936,257 @@ interface LoadProjectProfileResult {
 }
 declare function loadProjectProfile(input?: LoadProjectProfileInput): LoadProjectProfileResult;
 //#endregion
+//#region src/catch-up-recognition-record.d.ts
+interface CatchUpRecognition {
+  /** The ref the candidate targets, as the recognizing command resolved it. */
+  baseRef: string;
+  /** The live target tip at recognition time; the head's first parent. */
+  baseTipSha: string;
+  /** The head's second parent: the admitted base-side content merged in. */
+  mergedParentSha: string;
+  /**
+   * The tree `git merge-tree --write-tree` produced for the two parents. It
+   * equals the head's own tree; that equality is the faithfulness proof.
+   */
+  mergedTreeSha: string;
+  /** The ref that proves the second parent is admitted content. */
+  upstreamRef: string;
+}
+//#endregion
+//#region src/diff-classification.d.ts
+declare const DIFF_CLASSIFICATIONS: readonly ["docs/process-only", "trivial", "non-trivial"];
+type DiffClassification = (typeof DIFF_CLASSIFICATIONS)[number];
+//#endregion
+//#region src/impact-stamp.d.ts
+/**
+ * The recorded stamp. `targets` satisfies the completeness invariant: every
+ * target the profile declares is present, each with its exact basis — never
+ * silently absent. `basis: "conservative"` means an unmodelled or unprovable
+ * input widened every target to full impact.
+ */
+declare const impactStampSchema: z.ZodObject<{
+  basis: z.ZodEnum<{
+    "target-scoped": "target-scoped";
+    conservative: "conservative";
+  }>;
+  inertPaths: z.ZodDefault<z.ZodArray<z.ZodString>>;
+  reasons: z.ZodArray<z.ZodString>;
+  stampVersion: z.ZodLiteral<4>;
+  targets: z.ZodArray<z.ZodObject<{
+    basis: z.ZodString;
+    impact: z.ZodEnum<{
+      affected: "affected";
+      "not-affected": "not-affected";
+    }>;
+    name: z.ZodString;
+    subscribedPaths: z.ZodArray<z.ZodString>;
+  }, z.core.$strip>>;
+  unsubscribedPaths: z.ZodArray<z.ZodString>;
+}, z.core.$strip>;
+type ImpactStamp = z.infer<typeof impactStampSchema>;
+/**
+ * The surfaces that consume the stamp. One classification, consumed
+ * everywhere (#430): every surface routes through
+ * {@link impactStampScopeDecision}, so no surface can be more trusting than
+ * another, and no surface re-derives path rules of its own. The value only
+ * selects the wording of the conservative floor a refusal falls back to.
+ */
+declare const IMPACT_SCOPE_SURFACES: {
+  readonly demand: "full demand floor";
+  readonly "preview-lifecycle": "full preview-lifecycle floor";
+  readonly "verification-battery": "full verification-battery floor";
+};
+type ImpactScopeSurface = keyof typeof IMPACT_SCOPE_SURFACES;
+interface ImpactScopeDecision {
+  reason: string;
+  /** True ⇒ this target's work is provably unreachable and may be released. */
+  scoped: boolean;
+}
+/**
+ * Whether a trusted stamp RELEASES one target-scoped unit of work — an
+ * external proof demand (#542 wave 2), a verification-battery command, or a
+ * preview (Alchemy) lifecycle stack (#430 wave 3).
+ *
+ * The only release path is a `target-scoped` stamp of exactly this build's
+ * stamp version whose target entry for exactly this name is provably
+ * `not-affected`. Every other input — no trusted stamp, an unknown stamp
+ * version, a conservative stamp, a name the stamp does not classify, or an
+ * `affected` verdict — keeps today's full-work floor. Work only ever gets
+ * released, never added or satisfied: this function can withdraw a demand, it
+ * can never certify one.
+ *
+ * Identity binding is the CALLER's precondition: pass only a stamp computed
+ * for, or read from a pr:verify proof bound to, the current candidate (see
+ * `trustedImpactStamp` in `pr-readiness/verification-proof.ts`); pass
+ * `undefined` otherwise.
+ */
+declare const impactStampScopeDecision: ({
+  stamp,
+  surface,
+  targetName
+}: {
+  stamp: ImpactStamp | undefined;
+  surface: ImpactScopeSurface;
+  targetName: string;
+}) => ImpactScopeDecision;
+//#endregion
+//#region src/required-check-policy.d.ts
+declare const EVIDENCE_CHECK_TYPES: readonly ["review", "verify"];
+type EvidenceCheckType = (typeof EVIDENCE_CHECK_TYPES)[number];
+declare const requiredCheckScopeSchema: z.ZodObject<{
+  classifications: z.ZodArray<z.ZodEnum<{
+    "docs/process-only": "docs/process-only";
+    trivial: "trivial";
+    "non-trivial": "non-trivial";
+  }>>;
+}, z.core.$strict>;
+type RequiredCheckScope = z.infer<typeof requiredCheckScopeSchema>;
+interface RequiredCheckScopeContext {
+  catchUpRecognition?: CatchUpRecognition;
+  classification: DiffClassification | undefined;
+  impactStamp?: ImpactStamp;
+}
+interface ScopeDecision {
+  inScope: boolean;
+  reason: string;
+}
+declare const requiredCheckInScope: ({
+  context,
+  scope
+}: {
+  context: RequiredCheckScopeContext;
+  scope?: RequiredCheckScope;
+}) => ScopeDecision;
+interface RequiredCheck {
+  name: string;
+  checkType: EvidenceCheckType;
+  scope?: RequiredCheckScope;
+}
+//#endregion
+//#region src/demand-resolution.d.ts
+/**
+ * The two GitHub reads that make the base policy authoritative: the live tip of
+ * a branch, and one file's content at an exact commit. Injectable so tests can
+ * state what the authority says; an absent implementation is the real read, so
+ * an unstated authority is a refusal rather than a silent pass.
+ */
+interface BaseReviewPolicyAuthority {
+  branchTipSha: (input: {
+    branch: string;
+    cwd: string;
+    repository: CheckoutRepository;
+  }) => string;
+  profileContentAtRef: (input: {
+    cwd: string;
+    profilePath: string;
+    ref: string;
+    repository: CheckoutRepository;
+  }) => string;
+}
+/**
+ * The pull request whose base ref is the authority, as the resolving stage
+ * knows it (#922 Slice B).
+ *
+ * `pr:ready` is handed a PR number and reads the record; `pr:verify` and
+ * `pr:review` run in the authoring checkout and look the PR up from the branch,
+ * which can legitimately find nothing. `isCrossRepository` stays `unknown` for
+ * the reason the reader below states: an unstated fork answer is not a "no".
+ */
+interface CandidatePullRequestPolicyContext {
+  baseRefName: string;
+  isCrossRepository: unknown;
+}
+/** What a stage found when it looked for the pull request that owns this branch. */
+type CandidatePullRequestLookup = {
+  pullRequest: CandidatePullRequestPolicyContext;
+  status: "found";
+} | {
+  reason: string;
+  status: "unavailable";
+};
+//#endregion
+//#region src/follow-up.d.ts
+interface FactoryCliInvocation {
+  /** Runtime arguments ending with the factory CLI entry module. */
+  argvPrefix: string[];
+  executable: string;
+}
+declare const FactoryCliInvocationSchema: z.ZodType<FactoryCliInvocation>;
+interface FollowUpAction {
+  /**
+   * Machine-safe argv-style array for the obvious next action, e.g.
+   * ["gh","pr","merge","513","--squash"]. Same shape and field name that
+   * `factory:delegate --print` emits, so an orchestrating agent can spawn the
+   * next command without reconstructing a shell string. argv[0] is the
+   * executable; the rest are literal, already-split arguments.
+   */
+  argv: string[];
+  /**
+   * Human-readable rendering of {@link argv} for logs and operators. Additive
+   * to argv, never a substitute for it — argv is the source of truth.
+   */
+  command: string;
+}
+/**
+ * Build a {@link FollowUpAction} from a literal argv array. The `command`
+ * string is derived from argv so the two never drift.
+ */
+declare const followUpFromArgv: (argv: string[]) => FollowUpAction;
+/** Canonical zod schema for the optional follow-up field on JSON outputs. */
+declare const FollowUpActionSchema: z.ZodType<FollowUpAction>;
+//#endregion
+//#region src/user-config.d.ts
+declare const githubAppConfigSchema: z.ZodObject<{
+  appId: z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>;
+  installationId: z.ZodOptional<z.ZodNumber>;
+  privateKeyPath: z.ZodString;
+}, z.core.$strip>;
+type GithubAppConfig = z.infer<typeof githubAppConfigSchema>;
+declare const factoryUserConfigSchema: z.ZodObject<{
+  githubApp: z.ZodOptional<z.ZodObject<{
+    appId: z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>;
+    installationId: z.ZodOptional<z.ZodNumber>;
+    privateKeyPath: z.ZodString;
+  }, z.core.$strip>>;
+  hqAllowedOrigins: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  hqIngestCredentials: z.ZodOptional<z.ZodObject<{
+    clientIdRef: z.ZodString;
+    clientSecretRef: z.ZodString;
+  }, z.core.$strip>>;
+  schemaVersion: z.ZodLiteral<2>;
+}, z.core.$strip>;
+type FactoryUserConfig = z.infer<typeof factoryUserConfigSchema>;
+interface LoadUserConfigResult {
+  path: string;
+  config: FactoryUserConfig;
+  ignoredKeys?: string[];
+}
+//#endregion
+//#region src/github-app-access.d.ts
+interface FactoryAppAccessDependencies {
+  env?: NodeJS.ProcessEnv;
+  existsSync?: (path: string) => boolean;
+  exchangeBroker?: (input: {
+    fetch?: typeof fetch;
+    oidc: string;
+    owner: string;
+    repo: string;
+    timeoutMs?: number;
+    url?: string;
+  }) => Promise<string>;
+  fetch?: typeof fetch;
+  githubApp?: GithubAppConfig;
+  mintCursorOidc?: (input: {
+    audience?: string;
+    socketPath?: string;
+    timeoutMs?: number;
+  }) => Promise<string>;
+  now?: () => number;
+  timeoutMs?: number;
+  token?: string;
+  transportAttempts?: number;
+}
+//#endregion
 //#region src/pr-verify-mode.d.ts
 /**
  * The verification mode `pr:verify` resolved for a run.
@@ -629,38 +1223,9 @@ interface PostCommitStatusInput {
 }
 type PostCommitStatus = (input: PostCommitStatusInput) => void;
 //#endregion
-//#region src/user-config.d.ts
-declare const githubAppConfigSchema: z.ZodObject<{
-  appId: z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>;
-  installationId: z.ZodOptional<z.ZodNumber>;
-  privateKeyPath: z.ZodString;
-}, z.core.$strip>;
-type GithubAppConfig = z.infer<typeof githubAppConfigSchema>;
-declare const factoryUserConfigSchema: z.ZodObject<{
-  githubApp: z.ZodOptional<z.ZodObject<{
-    appId: z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>;
-    installationId: z.ZodOptional<z.ZodNumber>;
-    privateKeyPath: z.ZodString;
-  }, z.core.$strip>>;
-  hqAllowedOrigins: z.ZodOptional<z.ZodArray<z.ZodString>>;
-  hqIngestCredentials: z.ZodOptional<z.ZodObject<{
-    clientIdRef: z.ZodString;
-    clientSecretRef: z.ZodString;
-  }, z.core.$strip>>;
-  schemaVersion: z.ZodLiteral<2>;
-}, z.core.$strip>;
-type FactoryUserConfig = z.infer<typeof factoryUserConfigSchema>;
-interface LoadUserConfigResult {
-  path: string;
-  config: FactoryUserConfig;
-  ignoredKeys?: string[];
-}
-//#endregion
 //#region src/github-check-runs.d.ts
 declare const FACTORY_CHECK_NAMES: {
-  readonly boundary: "patronage-factory/boundary";
   readonly "pr-ready": "patronage-factory/pr-ready";
-  readonly "pr-review": "patronage-factory/pr-review";
   readonly "pr-verify": "patronage-factory/pr-verify";
 };
 type FactoryCheckGate = keyof typeof FACTORY_CHECK_NAMES;
@@ -675,12 +1240,6 @@ interface PublishFactoryCheckInput {
    * `hqLaneRefBaseUrlFromProfile` — the same source as the HQ gate sink.
    */
   hqLaneBaseUrl?: string;
-  /**
-   * Explicit issue/PR number for the HQ lane ref, used when the check run is not
-   * PR-scoped (e.g. an epic boundary check keyed by its epic issue). Falls back
-   * to `pr`, then to the checkout's PR, when omitted.
-   */
-  laneRefNumber?: number;
   owner: string;
   pr?: number;
   proof: unknown;
@@ -688,10 +1247,7 @@ interface PublishFactoryCheckInput {
   sha: string;
   status?: "completed" | "in_progress";
 }
-interface CheckRunDependencies {
-  fetch?: typeof fetch;
-  githubApp?: GithubAppConfig;
-  now?: () => number;
+interface CheckRunDependencies extends FactoryAppAccessDependencies {
   postCommitStatus?: PostCommitStatus;
   resolveDetailsUrl?: (input: PublishFactoryCheckInput) => Promise<string> | string;
   /**
@@ -706,18 +1262,18 @@ interface CheckRunDependencies {
   };
   /** Injectable delay for the bounded retry (tests only). */
   sleep?: (ms: number) => Promise<void>;
-  /** Overrides GITHUB_PUBLISH_TIMEOUT_MS for the App fetch calls (tests only). */
-  timeoutMs?: number;
 }
 /**
  * Publish a factory check run and *wait* for it, so a caller that has just made
  * the head SHA visible on GitHub (pushed the branch, created the PR) can make
  * the proof reliably present for that SHA before it returns (#247).
  *
- * Never throws and never posts a commit-status fallback: the commit status is a
- * human-readable mirror, not a proof surface, so a caller that needs an
- * App-verified check run must be told plainly whether it got one. Returns
- * `true` only when the App-owned check run landed.
+ * Never posts a commit-status fallback: the commit status is a human-readable
+ * mirror, not a proof surface, so a caller that needs an App-verified check
+ * run must be told plainly whether it got one. Returns `true` only when the
+ * App-owned check run landed. Throws when Factory App access is fail-closed
+ * (missing mint or Cursor OIDC exchange, #949): `pr:ready` must not notice
+ * that miss and exit 0. An optional-App skip still returns `false`.
  *
  * "Landed" means GitHub serves it, not that the POST was accepted (#520). On
  * PR #519 the POST was accepted, `pr:ready` reported ready and armed, and the
@@ -753,8 +1309,8 @@ declare const mergeFreezeStateSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
   generationId: z.ZodNumber;
   headSha: z.ZodString;
   outcome: z.ZodEnum<{
-    active: "active";
     stale: "stale";
+    active: "active";
   }>;
   reason: z.ZodString;
   recordedAt: z.ZodISODateTime;
@@ -786,30 +1342,61 @@ interface MergeFreezeStoreInput {
 interface MergeFreezeStore {
   read: (input: MergeFreezeStoreInput) => unknown;
 }
+/**
+ * The run identity that proves a generation is settling because it is running.
+ */
+interface RunningMergeFreezeWitness {
+  /** The base tip the running generation was created on. */
+  headSha: string;
+  /** The running `patronage-factory/merge-freeze` check-run id. */
+  runId: number;
+}
+/**
+ * The evidence that a generation is settling because it is still owed (#521).
+ */
+interface AwaitedMergeFreezeWitness {
+  /** The base tip whose generation is awaited. */
+  headSha: string;
+  /** The immediate parent whose settled generation proves the writer runs. */
+  parentSha: string;
+  /** The source-pinned hosted verify run that owes the generation. */
+  verifyRunId: number;
+  /** That run's status. A completed run owes nothing, so it is not settling. */
+  verifyStatus: "in_progress" | "queued";
+}
+/**
+ * The two settling phases, each with the witness that proves it (#890).
+ *
+ * `phase` replaces an optional `running` field that made one situation two:
+ * the field's presence, not the situation, decided how readers behaved. Each
+ * phase now carries exactly the witness its own rule needs.
+ */
+type SettlingMergeFreezeGeneration = {
+  kind: "settling";
+  phase: "running-generation";
+  reason: string;
+  witness: RunningMergeFreezeWitness;
+} | {
+  kind: "settling";
+  phase: "awaiting-generation";
+  reason: string;
+  witness: AwaitedMergeFreezeWitness;
+};
 /**
  * The freeze generation as a readiness decision needs to see it (#477).
  *
- * `read` above collapses three different situations into one refusal, because
- * merge time treated all of them as "do not merge". Readiness distinguishes
- * them: a settled generation is the writer's verdict, a **settling** one is the
- * window between a merge landing and its merge-target Verify completing (a
- * running generation, or a missing generation proven by the immediately prior
- * settled tip plus a current source-pinned verify run), and an **unreadable**
- * one is ambiguous, malformed, foreign-App, or unavailable state. Same
- * selection, same pinned App, same `started_at` ordering — only the reporting
- * is finer.
+ * `read` below collapses every situation short of a verdict into one refusal,
+ * because merge time treats all of them as "do not merge". Readiness
+ * distinguishes them: a settled generation is the writer's verdict, a
+ * **settling** one is the window between a merge landing and its merge-target
+ * Verify completing, and an **unreadable** one is ambiguous, malformed,
+ * foreign-App, or unavailable state. Same selection, same pinned App, same
+ * `started_at` ordering — only the reporting is finer.
  */
 type MergeFreezeGeneration = {
   kind: "settled";
   state: MergeFreezeState;
-} | {
-  kind: "settling";
-  reason: string;
-  running?: {
-    headSha: string;
-    id: number;
-  };
-} | {
+} | SettlingMergeFreezeGeneration | {
   kind: "unreadable";
   reason: string;
 };
@@ -817,6 +1404,13 @@ type MergeFreezeGeneration = {
 interface MergeFreezeAuthority extends MergeFreezeStore {
   readGeneration: (input: MergeFreezeStoreInput) => MergeFreezeGeneration;
 }
+interface GitHubCheckRunMergeFreezeApi {
+  list: (input: MergeFreezeStoreInput & {
+    name: string;
+  }) => unknown;
+  parent?: (input: MergeFreezeStoreInput) => unknown;
+}
+declare function createGitHubCheckRunMergeFreezeStore(api: GitHubCheckRunMergeFreezeApi): MergeFreezeAuthority;
 //#endregion
 //#region src/pr-proof-io.d.ts
 interface ProofDescriptor<T> {
@@ -826,553 +1420,929 @@ interface ProofDescriptor<T> {
   parse: (raw: unknown) => T;
 }
 //#endregion
-//#region src/packages/review-prompt-sections/schema.d.ts
-declare const reviewPromptSectionSchema: z.ZodObject<{
-  provenance: z.ZodEnum<{
-    "prior-review-ledger": "prior-review-ledger";
-    "issue-review-focus": "issue-review-focus";
+//#region src/pr-readiness/readiness-ledger.d.ts
+/**
+ * Ledger schema version 2 (#894): `verification` is a tagged union on
+ * `prVerify` and `externalChecks` no longer echoes `inScope`. Version 1
+ * ledgers are not read — the pre-1.0 posture keeps one shape per contract, so
+ * there is no compat reader here.
+ */
+declare const SCHEMA_VERSION = 2;
+declare const READINESS_REPAIR_CODES: readonly ["undraft-pr", "await-post-undraft-checks"];
+declare const readinessRepairSchema: z.ZodObject<{
+  action: z.ZodString;
+  code: z.ZodEnum<{
+    "undraft-pr": "undraft-pr";
+    "await-post-undraft-checks": "await-post-undraft-checks";
   }>;
-  source: z.ZodString;
-  text: z.ZodString;
-}, z.core.$strict>;
-type ReviewPromptSection = z.infer<typeof reviewPromptSectionSchema>;
-type ReviewPromptSectionProvenance = ReviewPromptSection["provenance"];
-declare const reviewPromptSectionsSchema: z.ZodArray<z.ZodObject<{
-  provenance: z.ZodEnum<{
-    "prior-review-ledger": "prior-review-ledger";
-    "issue-review-focus": "issue-review-focus";
+  command: z.ZodString;
+}, z.core.$strip>;
+declare const managedReadinessLedgerSchema: z.ZodObject<{
+  baseSha: z.ZodString;
+  blockingReasons: z.ZodArray<z.ZodString>;
+  classification: z.ZodEnum<{
+    "docs/process-only": "docs/process-only";
+    trivial: "trivial";
+    "non-trivial": "non-trivial";
   }>;
-  source: z.ZodString;
-  text: z.ZodString;
-}, z.core.$strict>>;
-//#endregion
-//#region src/review-ladder-policy.d.ts
-type ReviewFindingSeverity = "critical" | "high" | "medium" | "low" | "unknown";
-type ReviewFindingCategory = "correctness" | "safety" | "coordination" | "maintainability" | "unknown";
-declare const REVIEW_SEVERITIES: readonly ["critical", "high", "medium", "low", "unknown"];
-declare const resolveReviewFindingSeverity: (priority?: string) => ReviewFindingSeverity;
-declare const resolveReviewFindingCategory: (category?: string) => ReviewFindingCategory;
-declare const FINDING_DISPOSITIONS: readonly ["open", "fixed-in-thread", "follow-up-filed", "waived", "stale-repeat", "rerun-noise"];
-type FindingDisposition = (typeof FINDING_DISPOSITIONS)[number];
-interface ReviewFindingAttributes {
-  blockingAfterCap?: boolean;
-  category?: string;
-  citedSpan?: string;
-  file?: string;
-  prescribedAction?: string;
-  priority?: string;
-  supersedes?: {
-    file?: string;
-    title: string;
-  };
-  title: string;
+  externalChecks: z.ZodOptional<z.ZodArray<z.ZodObject<{
+    checkType: z.ZodEnum<{
+      review: "review";
+      verify: "verify";
+    }>;
+    name: z.ZodString;
+    reason: z.ZodOptional<z.ZodString>;
+    scope: z.ZodOptional<z.ZodObject<{
+      classifications: z.ZodArray<z.ZodEnum<{
+        "docs/process-only": "docs/process-only";
+        trivial: "trivial";
+        "non-trivial": "non-trivial";
+      }>>;
+    }, z.core.$strict>>;
+    scopeReason: z.ZodString;
+    status: z.ZodEnum<{
+      satisfied: "satisfied";
+      unmet: "unmet";
+      "out-of-scope": "out-of-scope";
+    }>;
+  }, z.core.$strip>>>;
+  github: z.ZodObject<{
+    draft: z.ZodBoolean;
+    mergeStateStatus: z.ZodString;
+    mergeable: z.ZodString;
+    requiredChecks: z.ZodEnum<{
+      unknown: "unknown";
+      pending: "pending";
+      passed: "passed";
+      failed: "failed";
+      none: "none";
+    }>;
+    reviewDecision: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    unresolvedReviewThreads: z.ZodNumber;
+  }, z.core.$strip>;
+  headSha: z.ZodString;
+  mergeBaseSha: z.ZodOptional<z.ZodString>;
+  patchId: z.ZodString;
+  pr: z.ZodNumber;
+  repairs: z.ZodDefault<z.ZodArray<z.ZodObject<{
+    action: z.ZodString;
+    code: z.ZodEnum<{
+      "undraft-pr": "undraft-pr";
+      "await-post-undraft-checks": "await-post-undraft-checks";
+    }>;
+    command: z.ZodString;
+  }, z.core.$strip>>>;
+  reviewCycleState: z.ZodOptional<z.ZodObject<{
+    autoBlockingFindings: z.ZodNumber;
+    countsBySeverity: z.ZodObject<{
+      critical: z.ZodNumber;
+      high: z.ZodNumber;
+      low: z.ZodNumber;
+      medium: z.ZodNumber;
+      unknown: z.ZodNumber;
+    }, z.core.$strip>;
+    highestBlockingSeverity: z.ZodOptional<z.ZodEnum<{
+      unknown: "unknown";
+      critical: "critical";
+      high: "high";
+      low: "low";
+      medium: "medium";
+    }>>;
+    highestOpenSeverity: z.ZodOptional<z.ZodEnum<{
+      unknown: "unknown";
+      critical: "critical";
+      high: "high";
+      low: "low";
+      medium: "medium";
+    }>>;
+    maxReviewCycles: z.ZodOptional<z.ZodNumber>;
+    nonBlockingFindings: z.ZodNumber;
+    openFindings: z.ZodNumber;
+    reviewCycle: z.ZodOptional<z.ZodNumber>;
+    staleRepeatFindings: z.ZodOptional<z.ZodNumber>;
+    windowExhausted: z.ZodBoolean;
+  }, z.core.$strip>>;
+  reviewLadder: z.ZodOptional<z.ZodObject<{
+    cycleCounts: z.ZodObject<{
+      gate: z.ZodNumber;
+      interior: z.ZodNumber;
+    }, z.core.$strip>;
+    forcedTransition: z.ZodOptional<z.ZodEnum<{
+      "gate-cap-exhausted": "gate-cap-exhausted";
+      "interior-cap-reached": "interior-cap-reached";
+    }>>;
+    nextAction: z.ZodEnum<{
+      "run-interior-cycle": "run-interior-cycle";
+      "advance-to-gate": "advance-to-gate";
+      "run-gate-cycle": "run-gate-cycle";
+      "accept-nonblocking-findings": "accept-nonblocking-findings";
+      "escalate-to-triage": "escalate-to-triage";
+      "ready-for-human": "ready-for-human";
+    }>;
+    stage: z.ZodEnum<{
+      interior: "interior";
+      gate: "gate";
+      "interior-complete": "interior-complete";
+    }>;
+  }, z.core.$strip>>;
+  reviewRuns: z.ZodOptional<z.ZodArray<z.ZodType<PrReviewResult, unknown, z.core.$ZodTypeInternals<PrReviewResult, unknown>>>>;
+  reviewTerminalState: z.ZodOptional<z.ZodEnum<{
+    blocked: "blocked";
+    "accepted-with-findings": "accepted-with-findings";
+    clean: "clean";
+  }>>;
+  reviews: z.ZodObject<{
+    correctness: z.ZodObject<{
+      required: z.ZodBoolean;
+      reviewedHeadSha: z.ZodOptional<z.ZodString>;
+      reviewedPatchId: z.ZodOptional<z.ZodString>;
+      status: z.ZodEnum<{
+        "not-required": "not-required";
+        blocked: "blocked";
+        current: "current";
+        stale: "stale";
+        missing: "missing";
+      }>;
+    }, z.core.$strip>;
+    security: z.ZodOptional<z.ZodObject<{
+      required: z.ZodBoolean;
+      reviewedHeadSha: z.ZodOptional<z.ZodString>;
+      reviewedPatchId: z.ZodOptional<z.ZodString>;
+      status: z.ZodEnum<{
+        "not-required": "not-required";
+        blocked: "blocked";
+        current: "current";
+        stale: "stale";
+        missing: "missing";
+      }>;
+    }, z.core.$strip>>;
+  }, z.core.$strip>;
+  schemaVersion: z.ZodLiteral<2>;
+  verification: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    command: z.ZodLiteral<"patronage-factory pr:verify">;
+    prVerify: z.ZodLiteral<"missing">;
+  }, z.core.$strict>, z.ZodObject<{
+    command: z.ZodLiteral<"patronage-factory pr:verify">;
+    prVerify: z.ZodLiteral<"stale">;
+    verifiedHeadSha: z.ZodString;
+  }, z.core.$strict>, z.ZodObject<{
+    command: z.ZodLiteral<"patronage-factory pr:verify">;
+    prVerify: z.ZodLiteral<"passed-via-head">;
+    verifiedHeadSha: z.ZodString;
+  }, z.core.$strict>, z.ZodObject<{
+    command: z.ZodLiteral<"patronage-factory pr:verify">;
+    docsOnlyVerifiedHeadSha: z.ZodString;
+    prVerify: z.ZodLiteral<"docs-only-delta">;
+    verifiedHeadSha: z.ZodOptional<z.ZodString>;
+  }, z.core.$strict>, z.ZodObject<{
+    command: z.ZodLiteral<"patronage-factory pr:verify">;
+    prVerify: z.ZodLiteral<"trivial-delta">;
+    trivialVerifiedHeadSha: z.ZodString;
+    verifiedHeadSha: z.ZodOptional<z.ZodString>;
+  }, z.core.$strict>], "prVerify">;
+}, z.core.$strip>;
+type ReadinessRepair = z.infer<typeof readinessRepairSchema>;
+type ReadinessStatus = "ready" | "blocked";
+type ManagedReadinessLedger = z.infer<typeof managedReadinessLedgerSchema>;
+declare function validateManagedReadinessLedger(value: unknown): ManagedReadinessLedger;
+declare namespace status_check_rollup_d_exports {
+  export { CheckState, HOSTED_VERIFY_CHECK_NAME, HOSTED_VERIFY_DRAFT_CHECK_NAME, StatusCheckRollup, hostedVerifyCheckState, isDraftHostedVerifyCheck, isExcludedFromAdmissionChecks, isFactoryReadyCheck, isHostedVerifyCheck, isSupersededHostedVerifyCheck, pendingCheckNames, statusCheckState };
 }
-type BlockingResolvableFinding = Pick<ReviewFindingAttributes, "blockingAfterCap" | "category" | "priority">;
-declare const resolveFindingBlocking: (finding: BlockingResolvableFinding, disposition?: FindingDisposition) => boolean;
-interface ReviewLadderPolicy {
-  gate: {
-    cap: number;
-  };
-  interior: {
-    cap: number;
-  };
+type CheckState = "passed" | "failed" | "pending" | "none" | "unknown";
+interface StatusCheckRollup {
+  __typename?: string;
+  completedAt?: string;
+  conclusion?: string;
+  context?: string;
+  name?: string;
+  startedAt?: string;
+  state?: string;
+  status?: string;
+  workflowName?: string;
 }
-declare const resolveReviewLadderPolicy: () => ReviewLadderPolicy;
-//#endregion
-//#region src/review-rungs.d.ts
-declare const EVIDENCE_REVIEW_RUNGS: readonly ["independent-model", "oracle", "human"];
-type EvidenceReviewRung = (typeof EVIDENCE_REVIEW_RUNGS)[number];
-//#endregion
-//#region src/review-ladder-ledger.d.ts
-type LadderCycleStage = "interior" | "gate";
-interface LadderCycleRef {
-  cycle: number;
-  stage: LadderCycleStage;
-}
-type LadderFindingReport = ReviewFindingAttributes;
-type DeclarableFindingDisposition = Exclude<FindingDisposition, "open" | "stale-repeat" | "rerun-noise">;
-interface LadderDispositionDeclaration {
-  disposition: DeclarableFindingDisposition;
-  finding: {
-    file?: string;
-    title: string;
-  };
-  findingReport?: LadderFindingReport;
-  reference?: string;
+declare const isFactoryReadyCheck: (check: StatusCheckRollup) => boolean;
+/**
+ * The hosted verification gate's context name — the branch ruleset's other
+ * source-pinned required check, alongside `patronage-factory/pr-ready`. One
+ * name across the fleet because one generator emits the workflow that posts
+ * it (ADR 0016, 2026-07-31 amendment).
+ */
+declare const HOSTED_VERIFY_CHECK_NAME = "verify";
+/**
+ * Is this rollup entry the hosted `verify` gate, from the producer the
+ * ruleset pins it to?
+ *
+ * `workflowName` is the producer signal the rollup actually carries: GitHub
+ * Actions check runs name their workflow, App-posted check runs come back with
+ * an empty one, and a user-token commit status arrives as a `context` with no
+ * `name` at all. Epic #473 wave 2 measured that a same-named check from the
+ * wrong writer is as inert as no check at all, so matching the name alone
+ * would accept exactly the thing the pin rejects.
+ */
+declare const isHostedVerifyCheck: (check: StatusCheckRollup) => boolean;
+/**
+ * The name the hosted summary job takes on a DRAFT head (#1045).
+ *
+ * The workflow renames that job so the pinned `verify` context does not exist
+ * while the candidate is a draft. The generator that emits the workflow owns
+ * the literal; this is the reader's copy of it, and
+ * `software-factory-hq/alchemy/verify-workflow.test.ts` pins the two equal.
+ */
+declare const HOSTED_VERIFY_DRAFT_CHECK_NAME = "verify (draft)";
+/**
+ * Is this the draft-head summary run's residue?
+ *
+ * The draft run and the `ready_for_review` run land on the SAME head SHA, and
+ * they post two different contexts — `verify (draft)` and `verify` — which
+ * `effectiveChecks` keys separately and therefore never collapses. The Verify
+ * workflow cancels an in-flight pull-request run when the next one starts, and
+ * `ready_for_review` IS the next one, so undrafting typically cancels the
+ * draft run mid-flight. That leaves a CANCELLED `verify (draft)` row sitting
+ * next to a green `verify` on the admitted head.
+ *
+ * GitHub does not care: the branch ruleset pins `verify` alone. The factory's
+ * own rollup read would: `CANCELLED` is a failed state, so the candidate's
+ * `requiredChecks` would read `failed` forever and no push-free repair could
+ * clear it. The draft run is a superseded generation of the summary job the
+ * `verify` row already answers for, so admission does not judge it.
+ */
+declare const isDraftHostedVerifyCheck: (check: StatusCheckRollup) => boolean;
+/**
+ * The rollup rows an admission read must not judge: the factory's own branded
+ * checks (it would be judging itself) and the draft-head summary residue
+ * above.
+ */
+declare const isExcludedFromAdmissionChecks: (check: StatusCheckRollup) => boolean;
+/**
+ * The hosted `verify` gate's state on this head, read by presence (#477).
+ *
+ * This is the one rollup question the rollup can answer honestly. Wave 2
+ * measured that GitHub omits an *unsatisfied pinned requirement* from
+ * `statusCheckRollup` entirely — there is no "expected" or "missing" row — so
+ * a green rollup is not evidence of mergeability. What the rollup does report
+ * faithfully is the checks that ran. Asking whether this specific check ran,
+ * and passed, on this head turns the rollup's silence from a false green into
+ * a named refusal: `"none"` means the pinned requirement is unsatisfied and
+ * nothing else in the rollup would have said so.
+ */
+declare const hostedVerifyCheckState: (rollup: StatusCheckRollup[] | undefined) => CheckState;
+/**
+ * The names of the runs `statusCheckState` would count as pending, in the
+ * order the rollup reports them.
+ *
+ * Same reader, same collapsing of superseded generations — this only says
+ * *which* runs hold the head open, so a caller that waits on them can name
+ * them. A run with no context and no name is reported as `unnamed check`
+ * rather than dropped: a wait must not look settled because one row was
+ * unprintable.
+ */
+declare const pendingCheckNames: (rollup: StatusCheckRollup[] | undefined, exclude?: (check: StatusCheckRollup) => boolean) => string[];
+declare const statusCheckState: (rollup: StatusCheckRollup[] | undefined, exclude?: (check: StatusCheckRollup) => boolean) => CheckState;
+/**
+ * Is this a hosted `verify` check run that GitHub started before `cutoffIso`?
+ * (#1045)
+ *
+ * A caller that waits for `verify` on a head it just changed the state of —
+ * `pr:publish` undrafting a candidate — must not accept the run that was
+ * already there. #1034's history is the shape: a draft head carried a `verify`
+ * that had run nothing, the wait saw it as terminal on its first attempt, and
+ * readiness read `passed` about two minutes before the `ready_for_review` run
+ * created its own check runs. The same shape is reachable from any superseded
+ * `verify` generation still on the head.
+ *
+ * Fail CLOSED on an unreadable timestamp: a `verify` row that cannot be shown
+ * to be newer than the cutoff is treated as superseded. The wait is bounded,
+ * so the cost of that refusal is one timeout that falls through to the
+ * caller's existing behaviour; the cost of failing open is the false green
+ * this exists to remove.
+ */
+declare const isSupersededHostedVerifyCheck: (check: StatusCheckRollup, cutoffIso: string) => boolean;
+//#endregion
+//#region src/github-client.d.ts
+/** Read a branch tip from GitHub rather than a checkout's cached remote ref. */
+declare const fetchGitHubBranchTipSha: (repository: CheckoutRepository, branch: string, cwd: string) => string;
+//#endregion
+//#region src/github-app-client.d.ts
+interface FactoryAppRequest {
+  body?: unknown;
+  headers?: Readonly<Record<string, string>>;
+  method: "DELETE" | "GET" | "PATCH" | "POST";
+  owner: string;
+  path: string;
+  repo: string;
 }
-interface FindingLedgerEntry extends ReviewFindingAttributes {
-  disposition: FindingDisposition;
-  firstFlagged: LadderCycleRef;
-  flagCount: number;
-  key: string;
-  lastFlagged: LadderCycleRef;
-  priorDisposition?: FindingDisposition;
-  reference?: string;
-  reopenedCount: number;
-  staleRepeatCount: number;
+interface FactoryAppExchange<T = unknown> {
+  readonly etag?: string;
+  readonly json: T;
+  readonly status: number;
 }
-declare const findingKey: (finding: {
-  citedSpan?: string;
-  file?: string;
-  prescribedAction?: string;
-  title?: string;
-}) => string;
-declare const openLadderFindings: (ledger: FindingLedgerEntry[]) => FindingLedgerEntry[];
-declare const blockingLadderFindings: (ledger: FindingLedgerEntry[]) => FindingLedgerEntry[];
-declare const staleRepeatLadderFindings: (ledger: FindingLedgerEntry[]) => FindingLedgerEntry[];
-declare const inferFixedInThreadDispositions: (ledger: FindingLedgerEntry[], findings: readonly LadderFindingReport[], options?: {
-  sameHeadAsPriorCycle?: boolean;
-}) => LadderDispositionDeclaration[];
 //#endregion
-//#region src/review-ladder.d.ts
-type ReviewLadderExecutedStage = "interior" | "gate";
-interface LadderSessionAttribution {
-  orchestrationMode?: "autonomous" | "manual";
-  resumedSession?: boolean;
-  runtime?: string;
-  sessionId?: string;
-}
-interface LadderUsageReport {
-  estimatedCostUsd?: number;
-  source?: string;
-  totalTokens?: number;
+//#region src/github-pr-status-comment.d.ts
+interface UpsertFactoryPrStatusCommentInput {
+  body: string;
+  /** ISO instant at which this presentation was observed. */
+  observedAt?: string;
+  owner: string;
+  pr: number;
+  repo: string;
 }
-interface ReviewLadderCycle {
-  dispositions?: LadderDispositionDeclaration[];
-  engine?: string;
-  findings: LadderFindingReport[];
-  identity?: {
-    headSha: string;
-    patchId: string;
-  };
-  model?: string;
-  correlatedRerun?: boolean;
-  session?: LadderSessionAttribution;
-  stage: LadderCycleStage;
-  usage?: LadderUsageReport;
+interface UpsertFactoryPrStatusCommentDependencies {
+  request?: (input: FactoryAppRequest) => Promise<FactoryAppExchange>;
+  requestJson?: (input: FactoryAppRequest) => Promise<unknown>;
 }
-interface LadderInteriorCapTransition {
-  cap: number;
-  kind: "interior-cap-reached";
+interface UpsertFactoryPrStatusCommentResult {
+  action: "created" | "updated";
+  commentId: number;
+  url: string;
 }
-interface LadderGateCapTransition {
-  blockingFindings: string[];
-  cap: number;
-  kind: "gate-cap-exhausted";
+declare function upsertFactoryPrStatusComment(input: UpsertFactoryPrStatusCommentInput, dependencies?: UpsertFactoryPrStatusCommentDependencies): Promise<UpsertFactoryPrStatusCommentResult>;
+//#endregion
+//#region src/pr-verify-proof-contract.d.ts
+/**
+ * The pr:verify proof versions a reader accepts: the current one only (#920
+ * item 1). #917 narrowed the pr:ready reader the same way. A pr:verify proof
+ * is per-candidate and short-lived — it is rewritten on every head — so no
+ * stored v1–v3 proof can outlive the release that drops it. Pre-1.0 posture
+ * applies: one current contract, no compat reader. A consumer on an older
+ * factory must adopt this release before HQ ingests its pr:verify proofs.
+ */
+declare const SUPPORTED_PR_VERIFY_SCHEMA_VERSIONS: readonly [4];
+type PrVerifySchemaVersion = (typeof SUPPORTED_PR_VERIFY_SCHEMA_VERSIONS)[number];
+interface PrVerifyCommandResult {
+  command: string;
+  description: string;
+  /**
+   * Epic #550 wave 3 (#430): the profile's declared impact target for this
+   * command, recorded from v4 on. It is the proof's own command→target
+   * mapping: a `notRequiredCommands` entry must name the target recorded HERE
+   * for the same command, so a withholding cannot point at whichever released
+   * target happens to be convenient. Absent for a command the profile does
+   * not scope.
+   */
+  impactTarget?: string;
+  name: string;
+  scope: "docs-only" | "trivial" | "full";
 }
-type LadderForcedTransition = LadderGateCapTransition | LadderInteriorCapTransition;
-interface LadderRunInteriorCycleAction {
-  cycle: number;
-  kind: "run-interior-cycle";
+/**
+ * One failing test a verification command reported (#1035).
+ *
+ * The proof keeps the failing test's IDENTITY and its failure CLASS, and
+ * nothing else. That is enough to decide retry-or-fix — a `timeout` under
+ * machine load is a flake, an `assertion` is a real break — without rerunning
+ * the aggregate to read a title off the console.
+ *
+ * It deliberately keeps no raw output tail and no error message body. This
+ * payload is transmitted to HQ ingest, and arbitrary command output can carry
+ * secrets (an echoed environment, a connection string inside a stack frame). A
+ * file path, a test title, and a closed `kind` enum cannot. The cost is the
+ * assertion diff and the stack frames: they help you FIX a failure, and the
+ * operator still reads them from the run's own console output.
+ */
+interface PrVerifyTestFailure {
+  /** The test file the reporter named, as the reporter wrote it. */
+  file: string;
+  /**
+   * The failure class. `timeout` is the test-timeout error vitest raises at
+   * its own ceiling; `assertion` is a failed expectation; `error` is every
+   * other thrown failure.
+   */
+  kind: "assertion" | "error" | "timeout";
+  /** The full test title, suite names included, as the reporter wrote it. */
+  title: string;
 }
-type LadderGateNextAction = {
-  cycle: number;
-  kind: "run-gate-cycle";
-} | {
-  kind: "accept-nonblocking-findings";
-} | {
-  kind: "escalate-to-triage";
-} | {
-  kind: "ready-for-human";
-};
-type LadderPosition = {
-  forcedTransition?: LadderGateCapTransition;
-  nextAction: LadderGateNextAction;
-  stage: "gate";
-} | {
-  forcedTransition?: LadderInteriorCapTransition;
-  nextAction: {
-    kind: "advance-to-gate";
-  };
-  stage: "interior-complete";
-} | {
-  forcedTransition?: never;
-  nextAction: LadderRunInteriorCycleAction;
-  stage: "interior";
-};
-type LadderNextAction = LadderPosition["nextAction"];
-type ReviewLadderStage = LadderPosition["stage"];
-interface ReviewLadderStageEvent {
-  cycle: number;
-  cyclesToClean?: number;
-  engine?: string;
-  findingsSummary: {
-    blocking: number;
-    bySeverity: Record<ReviewFindingSeverity, number>;
-    flagged: number;
-    open: number;
-    staleRepeats: number;
+interface PrVerifyExecutedCommand {
+  command: string;
+  counts?: {
+    testFiles?: number;
+    tests?: number;
   };
-  forcedTransition?: LadderForcedTransition["kind"];
-  model?: string;
-  payloadVersion: 1;
-  session?: LadderSessionAttribution;
-  stage: ReviewLadderExecutedStage;
-  type: "review-ladder-stage";
-  usage?: LadderUsageReport;
+  durationMs: number;
+  exitCode: number;
+  /**
+   * The failing tests this command reported (#1035). Present only when the
+   * command produced parseable failures, so a passing command's record is
+   * byte-identical to the one it wrote before this field existed.
+   */
+  failures?: PrVerifyTestFailure[];
+  name: string;
+  scope: "docs-only" | "trivial" | "full";
 }
-interface LadderDiagnostic {
-  code: "interior-cycles-unrecorded";
-  message: string;
+/**
+ * Epic #550 wave 3 (#430): a verification command the impact stamp proved this
+ * candidate cannot reach, so the battery did not run it.
+ *
+ * The completeness invariant lives in the pairing: `verificationCommands`
+ * records every command the resolved mode selected, `executedCommands` records
+ * what ran, and this list records the rest WITH the stamp's own basis. A
+ * withheld stack is therefore never silently absent from the proof — it is
+ * present, named, and explained.
+ */
+interface PrVerifyNotRequiredCommand {
+  basis: string;
+  impactTarget: string;
+  name: string;
 }
-type ReviewLadderEvaluation = LadderPosition & {
-  cycleCounts: {
-    gate: number;
-    interior: number;
-  };
-  diagnostics: LadderDiagnostic[];
-  event?: ReviewLadderStageEvent;
-  ledger: FindingLedgerEntry[];
-  unmatchedDispositions: LadderDispositionDeclaration[];
-};
-interface EvaluateReviewLadderInput {
-  cycles: ReviewLadderCycle[];
-  policy: ReviewLadderPolicy;
+/**
+ * Epic #758 (#762): a consumer package a stamp-scoped selection skipped, and
+ * why. Bound to the proof's stamp identity — refused when the proof records no
+ * stamp. The factory does not write this list; consumers do.
+ */
+interface PrVerifyNotDemandedRecord {
+  basis: string;
+  name: string;
 }
-declare const evaluateReviewLadder: ({
-  cycles,
-  policy
-}: EvaluateReviewLadderInput) => ReviewLadderEvaluation;
-//#endregion
-//#region src/pr-readiness/ladder-proof-state.d.ts
-interface PrReviewLadderState {
-  cycles: ReviewLadderCycle[];
+interface PrVerifyProof {
+  schemaVersion: PrVerifySchemaVersion;
+  authoringSession: string;
+  base: string;
+  baselineFullProofs?: {
+    base: string;
+    changedFiles: string[];
+    headSha: string;
+    profilePath: string;
+    projectKey: string;
+    repository: string;
+  }[];
+  catchUpRecognition?: CatchUpRecognition;
+  changedFiles: string[];
+  classification: DiffClassification;
+  classificationReasons: string[];
+  command: "patronage-factory pr:verify";
+  durationMs: number;
+  endedAt: string;
+  executedCommands?: PrVerifyExecutedCommand[];
+  headSha: string;
+  impactStamp?: ImpactStamp;
+  mode: ResolvedPrVerifyMode;
+  mergeBaseSha?: string;
+  notDemandedRecords?: PrVerifyNotDemandedRecord[];
+  notRequiredCommands?: PrVerifyNotRequiredCommand[];
+  outcome?: "aborted" | "passed";
+  patchId?: string;
+  /**
+   * The review policy identity this verification run resolved (#922 Slice B).
+   *
+   * Verification demands no review mode of its own. It records the identity so
+   * `pr:ready` can see whether the stage that produced this proof judged the
+   * candidate under the same policy readiness resolves. Optional, and normally
+   * `unresolved` on the first run of a branch: a candidate is verified before
+   * it has a pull request, and there is no authority to read without one.
+   */
+  policyResolution?: PolicyResolution;
+  profilePath: string;
+  projectKey: string;
+  repository: string;
+  startedAt: string;
+  verificationCommands: PrVerifyCommandResult[];
 }
-interface OpenCycleState {
-  autoBlockingFindings: number;
-  blockingEntries: ReviewFindingAttributes[];
-  openEntries: ReviewFindingAttributes[];
-  staleRepeatFindings?: number;
+type PrVerifyBaselineFullProof = NonNullable<PrVerifyProof["baselineFullProofs"]>[number];
+declare function validatePrVerifyProof(value: unknown): PrVerifyProof;
+declare namespace verification_proof_d_exports {
+  export { PrVerifyBaselineFullProof, PrVerifyCommandResult, PrVerifyExecutedCommand, PrVerifyNotDemandedRecord, PrVerifyNotRequiredCommand, PrVerifyProof, PrVerifySchemaVersion, PrVerifyTestFailure, ResolvedPrVerifyMode, SUPPORTED_PR_VERIFY_SCHEMA_VERSIONS, VerificationHeadShas, VerificationProofState, VerifiedHeadShas, prVerifyFullHeadShasForDiff, prVerifyProofHeadShas, readPrVerifyProof, resolveVerifyProofApplicability, trustedCatchUpRecognition, trustedImpactStamp, validatePrVerifyProof, verificationProofApplicabilityFor, verificationProofBlockingReason, verificationProofForReadiness, verificationProofStateFor, verifyProofIdentityMatches, verifyProofPassed };
 }
-interface ReviewLadderSummaryState {
-  cycleCounts: {
-    gate: number;
-    interior: number;
-  };
-  forcedTransition?: LadderForcedTransition["kind"];
-  nextAction: LadderNextAction["kind"];
-  stage: ReviewLadderStage;
-}
-interface ReviewLadderSnapshot {
-  cycleState: OpenCycleState;
-  evaluation: ReviewLadderEvaluation;
-  ledger: FindingLedgerEntry[];
-  policyGateCap: number;
-  summary: ReviewLadderSummaryState;
+interface VerifiedHeadShas {
+  docsOnlyVerifiedHeadShas: string[];
+  trivialVerifiedHeadShas: string[];
+  verifiedHeadShas: string[];
 }
-type ReviewEpochMode = {
-  kind: "ladder";
-  ladder: PrReviewLadderState;
-  snapshot?: ReviewLadderSnapshot;
+type VerificationHeadShas = {
+  explicitFailure: true;
+} | VerifiedHeadShas;
+declare function readPrVerifyProof(filePath: string): PrVerifyProof;
+declare const verifyProofPassed: (proof: PrVerifyProof) => boolean;
+declare const prVerifyProofHeadShas: (proof: PrVerifyProof | undefined, creditedHeadSha?: string) => VerifiedHeadShas;
+declare const verifyProofIdentityMatches: ({
+  currentIdentity,
+  proof
+}: {
+  currentIdentity?: {
+    patchId: string;
+    mergeBaseSha?: string;
+  };
+  proof?: PrVerifyProof;
+}) => boolean;
+/**
+ * Wave-2 consumption (#542): the recorded impact stamp, released for demand
+ * resolution ONLY when it is identity-bound to the current candidate — the
+ * proof passed, and its recorded headSha AND patchId both name exactly this
+ * candidate (the same identities the proof already binds). Everything else —
+ * no proof, an aborted run, a stale head, a moved patch id, a pre-stamp proof
+ * — returns `undefined`, and the consumer keeps today's full-demand floor.
+ *
+ * Deliberately stricter than verify-once applicability (which tolerates a
+ * head-only or patch-id-only match): a stamp narrows external demands, so it
+ * is trusted only on an exact double binding, fail closed.
+ */
+declare const trustedImpactStamp: ({
+  candidate,
+  proof
+}: {
+  candidate: {
+    headSha: string;
+    patchId: string;
+  };
+  proof: PrVerifyProof | undefined;
+}) => ImpactStamp | undefined;
+/**
+ * #833: the recorded catch-up recognition, consumed ONLY when it is
+ * identity-bound to the current candidate under exactly the rules
+ * `trustedImpactStamp` applies — the proof passed, and its recorded
+ * headSha AND patchId both name this candidate. The recognition withdraws
+ * review and preview demands, so it earns the same strict double binding and
+ * the same fail-closed answer (`undefined`) on every other state.
+ */
+declare const trustedCatchUpRecognition: ({
+  candidate,
+  proof
+}: {
+  candidate: {
+    headSha: string;
+    patchId: string;
+  };
+  proof: PrVerifyProof | undefined;
+}) => CatchUpRecognition | undefined;
+declare const prVerifyFullHeadShasForDiff: ({
+  docsOnlyDeltaAcceptedSince,
+  files,
+  proof
+}: {
+  docsOnlyDeltaAcceptedSince?: (baselineHeadSha: string) => boolean;
+  files: string[];
+  proof: PrVerifyProof;
+}) => string[];
+type VerificationProofState = {
+  kind: "typed-aborted";
+  proof: PrVerifyProof;
 } | {
-  kind: "declared-window";
+  kind: "typed-missing";
+  path: string;
+  reason: "enoent" | "invalid";
+  message?: string;
+} | {
+  kind: "typed";
+  headShas: VerifiedHeadShas;
+  proof: PrVerifyProof;
+} | {
+  kind: "typed-diff-mismatch";
+  mode: ResolvedPrVerifyMode;
 };
+declare const verificationProofStateFor: ({
+  proof,
+  proofMatchesCurrentDiff,
+  proofPath
+}: {
+  proof?: PrVerifyProof;
+  proofMatchesCurrentDiff?: boolean;
+  proofPath?: string;
+}) => VerificationProofState;
+declare const verificationProofApplicabilityFor: ({
+  docsOnlyDeltaAcceptedSince,
+  explicitProof,
+  files,
+  headSha,
+  currentIdentity,
+  proof,
+  proofPath,
+  proofReadError
+}: {
+  docsOnlyDeltaAcceptedSince?: (baselineHeadSha: string) => boolean;
+  explicitProof: boolean;
+  files: string[];
+  headSha: string;
+  currentIdentity?: {
+    patchId: string;
+    mergeBaseSha?: string;
+  };
+  proof?: PrVerifyProof;
+  proofPath?: string;
+  proofReadError?: unknown;
+}) => {
+  fullVerifiedHeadShas: never[];
+  verificationProof: VerificationProofState;
+} | {
+  fullVerifiedHeadShas: string[];
+  verificationProof: {
+    headShas: VerifiedHeadShas;
+    kind: "typed";
+    proof: PrVerifyProof;
+  };
+};
+declare const resolveVerifyProofApplicability: ({
+  proofPath,
+  explicitProof,
+  docsOnlyDeltaAcceptedSince,
+  files,
+  headSha,
+  currentVerifyIdentityForBase,
+  preread
+}: {
+  proofPath: string;
+  explicitProof: boolean;
+  docsOnlyDeltaAcceptedSince?: (baselineHeadSha: string) => boolean;
+  files: string[];
+  headSha: string;
+  currentVerifyIdentityForBase?: (base: string) => {
+    patchId: string;
+    mergeBaseSha?: string;
+  };
+  preread?: {
+    proof?: PrVerifyProof;
+    error?: unknown;
+  };
+}) => {
+  fullVerifiedHeadShas: never[];
+  verificationProof: VerificationProofState;
+} | {
+  fullVerifiedHeadShas: string[];
+  verificationProof: {
+    headShas: VerifiedHeadShas;
+    kind: "typed";
+    proof: PrVerifyProof;
+  };
+};
+declare const verificationProofForReadiness: (state: VerificationProofState) => VerificationHeadShas;
+declare const verificationProofBlockingReason: (state: VerificationProofState) => string | undefined;
 //#endregion
-//#region src/pr-readiness/review-proof-types.d.ts
-type PrReviewKind = "correctness" | "security";
-type PrReviewMode = PrReviewKind | "all";
-type PrReviewOutcome = "passed" | "failed" | "error";
-interface PrReviewStageResolution {
-  model: string;
-  sessionId: string;
-}
-//#endregion
-//#region src/pr-readiness/review-proof-shape.d.ts
-interface PrReviewFinding extends ReviewFindingAttributes {
-  body: string;
-  category?: ReviewFindingCategory;
-  line?: number;
-  protocolFinding?: true;
+//#region src/preview-lifecycle.d.ts
+type PreviewDisposition = "deploy" | "not-required";
+interface PreviewTargetPlan {
+  basis: string;
+  disposition: PreviewDisposition;
+  name: string;
 }
-interface PrReviewResult {
-  kind: PrReviewKind;
-  startedAt: string;
-  endedAt: string;
-  durationMs: number;
-  model?: string;
-  producer?: string;
-  rung?: EvidenceReviewRung;
-  sessionId?: string;
-  outcome: PrReviewOutcome;
-  issuesFlagged: number;
-  summary: string;
-  findings: PrReviewFinding[];
-  typedVerdict?: boolean;
-  verdictSource?: "footer" | "recovered";
-  promptSections?: ReviewPromptSection[];
+interface PreviewLifecyclePlan {
+  /** The declared preview stacks to deploy, in declaration order. */
+  deploy: string[];
+  /** The withheld stacks, in declaration order. */
+  notRequired: PreviewTargetPlan[];
+  /** Whether a trusted, identity-bound stamp was available at all. */
+  stampTrusted: boolean;
+  /** Every declared preview target with its disposition, in declaration order. */
+  targets: PreviewTargetPlan[];
 }
-interface PrReviewProof {
-  schemaVersion: 2;
-  findingProvenanceVersion: 1;
-  base: string;
-  headSha: string;
-  patchId: string;
-  reviewCycle?: number;
-  maxReviewCycles?: number;
-  changedFiles: string[];
-  cleanedPaths: string[];
-  ladder?: PrReviewLadderState;
-  reviewRequirement?: {
-    reason: "no-applicable-mode";
-    status: "not-required";
+/** Validate a serialized plan without deriving or changing its dispositions. */
+declare const validatePreviewLifecyclePlan: (value: unknown) => PreviewLifecyclePlan;
+/**
+ * Structural subset of the profile: the impact declarations plus the external
+ * demand list. Structural rather than a `Pick` so this module does not import
+ * `profile.ts`.
+ */
+interface PreviewLifecycleProfile {
+  impact?: {
+    targets: {
+      name: string;
+    }[];
   };
-  reviews: PrReviewResult[];
+  requiredChecks?: {
+    name: string;
+  }[];
 }
-//#endregion
-//#region src/pr-readiness/readiness-ledger.d.ts
-declare const SCHEMA_VERSION = 1;
-declare const READINESS_REPAIR_CODES: readonly ["undraft-pr", "await-post-undraft-checks"];
-declare const readinessRepairSchema: z.ZodObject<{
-  action: z.ZodString;
-  code: z.ZodEnum<{
-    "undraft-pr": "undraft-pr";
-    "await-post-undraft-checks": "await-post-undraft-checks";
-  }>;
-  command: z.ZodString;
-}, z.core.$strip>;
-declare const managedReadinessLedgerSchema: z.ZodObject<{
-  baseSha: z.ZodString;
-  blockingReasons: z.ZodArray<z.ZodString>;
-  classification: z.ZodEnum<{
-    trivial: "trivial";
-    "docs/process-only": "docs/process-only";
-    "non-trivial": "non-trivial";
-  }>;
-  externalChecks: z.ZodOptional<z.ZodArray<z.ZodObject<{
-    checkType: z.ZodEnum<{
-      review: "review";
-      verify: "verify";
-    }>;
-    inScope: z.ZodBoolean;
-    name: z.ZodString;
-    reason: z.ZodOptional<z.ZodString>;
-    scope: z.ZodOptional<z.ZodObject<{
-      classifications: z.ZodArray<z.ZodEnum<{
-        trivial: "trivial";
-        "docs/process-only": "docs/process-only";
-        "non-trivial": "non-trivial";
-      }>>;
-    }, z.core.$strict>>;
-    scopeReason: z.ZodString;
-    status: z.ZodEnum<{
-      satisfied: "satisfied";
-      unmet: "unmet";
-      "out-of-scope": "out-of-scope";
-    }>;
-  }, z.core.$strip>>>;
-  github: z.ZodObject<{
-    draft: z.ZodBoolean;
-    mergeStateStatus: z.ZodString;
-    mergeable: z.ZodString;
-    requiredChecks: z.ZodEnum<{
-      unknown: "unknown";
-      pending: "pending";
-      passed: "passed";
-      failed: "failed";
-      none: "none";
-    }>;
-    reviewDecision: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-    unresolvedReviewThreads: z.ZodNumber;
-  }, z.core.$strip>;
-  headSha: z.ZodString;
-  mergeBaseSha: z.ZodOptional<z.ZodString>;
-  patchId: z.ZodString;
-  pr: z.ZodNumber;
-  repairs: z.ZodDefault<z.ZodArray<z.ZodObject<{
-    action: z.ZodString;
-    code: z.ZodEnum<{
-      "undraft-pr": "undraft-pr";
-      "await-post-undraft-checks": "await-post-undraft-checks";
-    }>;
-    command: z.ZodString;
-  }, z.core.$strip>>>;
-  reviewCycleState: z.ZodOptional<z.ZodObject<{
-    autoBlockingFindings: z.ZodNumber;
-    countsBySeverity: z.ZodObject<{
-      critical: z.ZodNumber;
-      high: z.ZodNumber;
-      low: z.ZodNumber;
-      medium: z.ZodNumber;
-      unknown: z.ZodNumber;
-    }, z.core.$strip>;
-    highestBlockingSeverity: z.ZodOptional<z.ZodEnum<{
-      unknown: "unknown";
-      critical: "critical";
-      high: "high";
-      low: "low";
-      medium: "medium";
-    }>>;
-    highestOpenSeverity: z.ZodOptional<z.ZodEnum<{
-      unknown: "unknown";
-      critical: "critical";
-      high: "high";
-      low: "low";
-      medium: "medium";
-    }>>;
-    maxReviewCycles: z.ZodOptional<z.ZodNumber>;
-    nonBlockingFindings: z.ZodNumber;
-    openFindings: z.ZodNumber;
-    reviewCycle: z.ZodOptional<z.ZodNumber>;
-    staleRepeatFindings: z.ZodOptional<z.ZodNumber>;
-    windowExhausted: z.ZodBoolean;
-  }, z.core.$strip>>;
-  reviewLadder: z.ZodOptional<z.ZodObject<{
-    cycleCounts: z.ZodObject<{
-      gate: z.ZodNumber;
-      interior: z.ZodNumber;
-    }, z.core.$strip>;
-    forcedTransition: z.ZodOptional<z.ZodEnum<{
-      "gate-cap-exhausted": "gate-cap-exhausted";
-      "interior-cap-reached": "interior-cap-reached";
-    }>>;
-    nextAction: z.ZodEnum<{
-      "run-gate-cycle": "run-gate-cycle";
-      "accept-nonblocking-findings": "accept-nonblocking-findings";
-      "escalate-to-triage": "escalate-to-triage";
-      "ready-for-human": "ready-for-human";
-      "advance-to-gate": "advance-to-gate";
-      "run-interior-cycle": "run-interior-cycle";
-    }>;
-    stage: z.ZodEnum<{
-      gate: "gate";
-      interior: "interior";
-      "interior-complete": "interior-complete";
-    }>;
-  }, z.core.$strip>>;
-  reviewRuns: z.ZodOptional<z.ZodArray<z.ZodType<PrReviewResult, unknown, z.core.$ZodTypeInternals<PrReviewResult, unknown>>>>;
-  reviewTerminalState: z.ZodOptional<z.ZodEnum<{
-    blocked: "blocked";
-    "accepted-with-findings": "accepted-with-findings";
-    clean: "clean";
-  }>>;
-  reviews: z.ZodObject<{
-    correctness: z.ZodObject<{
-      required: z.ZodBoolean;
-      reviewedHeadSha: z.ZodOptional<z.ZodString>;
-      reviewedPatchId: z.ZodOptional<z.ZodString>;
-      status: z.ZodEnum<{
-        blocked: "blocked";
-        stale: "stale";
-        "not-required": "not-required";
-        current: "current";
-        missing: "missing";
-      }>;
-    }, z.core.$strip>;
-    security: z.ZodOptional<z.ZodObject<{
-      required: z.ZodBoolean;
-      reviewedHeadSha: z.ZodOptional<z.ZodString>;
-      reviewedPatchId: z.ZodOptional<z.ZodString>;
-      status: z.ZodEnum<{
-        blocked: "blocked";
-        stale: "stale";
-        "not-required": "not-required";
-        current: "current";
-        missing: "missing";
-      }>;
-    }, z.core.$strip>>;
-  }, z.core.$strip>;
-  schemaVersion: z.ZodLiteral<1>;
-  verification: z.ZodObject<{
-    command: z.ZodLiteral<"patronage-factory pr:verify">;
-    docsOnlyDeltaAccepted: z.ZodOptional<z.ZodBoolean>;
-    docsOnlyVerifiedHeadSha: z.ZodOptional<z.ZodString>;
-    prVerify: z.ZodEnum<{
-      stale: "stale";
-      passed: "passed";
-      missing: "missing";
-    }>;
-    trivialDeltaAccepted: z.ZodOptional<z.ZodBoolean>;
-    trivialVerifiedHeadSha: z.ZodOptional<z.ZodString>;
-    verifiedHeadSha: z.ZodOptional<z.ZodString>;
-  }, z.core.$strip>;
-}, z.core.$strip>;
-type ReadinessRepair = z.infer<typeof readinessRepairSchema>;
-type ReadinessStatus = "ready" | "blocked";
-type ManagedReadinessLedger = z.infer<typeof managedReadinessLedgerSchema>;
-declare function validateManagedReadinessLedger(value: unknown): ManagedReadinessLedger;
-declare namespace status_check_rollup_d_exports {
-  export { CheckState, HOSTED_VERIFY_CHECK_NAME, StatusCheckRollup, hostedVerifyCheckState, isFactoryReadyCheck, isHostedVerifyCheck, statusCheckState };
-}
-type CheckState = "passed" | "failed" | "pending" | "none" | "unknown";
-interface StatusCheckRollup {
-  __typename?: string;
-  completedAt?: string;
-  conclusion?: string;
-  context?: string;
-  name?: string;
-  startedAt?: string;
-  state?: string;
-  status?: string;
-  workflowName?: string;
-}
-declare const isFactoryReadyCheck: (check: StatusCheckRollup) => boolean;
-/**
- * The hosted verification gate's context name — the branch ruleset's other
- * source-pinned required check, alongside `patronage-factory/pr-ready`. One
- * name across the fleet because one generator emits the workflow that posts
- * it (ADR 0016, 2026-07-31 amendment).
- */
-declare const HOSTED_VERIFY_CHECK_NAME = "verify";
 /**
- * Is this rollup entry the hosted `verify` gate, from the producer the
- * ruleset pins it to?
+ * The declared preview stacks: impact targets that are ALSO declared required
+ * checks — i.e. targets whose proof is produced externally, which is exactly
+ * what a preview producer is.
  *
- * `workflowName` is the producer signal the rollup actually carries: GitHub
- * Actions check runs name their workflow, App-posted check runs come back with
- * an empty one, and a user-token commit status arrives as a `context` with no
- * `name` at all. Epic #473 wave 2 measured that a same-named check from the
- * wrong writer is as inert as no check at all, so matching the name alone
- * would accept exactly the thing the pin rejects.
+ * Deriving the list from the two existing declarations rather than adding a
+ * third is what makes lifecycle and demand unable to disagree: the stacks this
+ * plan can withhold are precisely the demands wave 2 can release, so a stack
+ * can never be skipped while its proof stays demanded.
  */
-declare const isHostedVerifyCheck: (check: StatusCheckRollup) => boolean;
+declare const previewLifecycleTargets: (profile: PreviewLifecycleProfile) => string[];
 /**
- * The hosted `verify` gate's state on this head, read by presence (#477).
+ * Plan the preview lifecycle for one candidate.
  *
- * This is the one rollup question the rollup can answer honestly. Wave 2
- * measured that GitHub omits an *unsatisfied pinned requirement* from
- * `statusCheckRollup` entirely — there is no "expected" or "missing" row — so
- * a green rollup is not evidence of mergeability. What the rollup does report
- * faithfully is the checks that ran. Asking whether this specific check ran,
- * and passed, on this head turns the rollup's silence from a false green into
- * a named refusal: `"none"` means the pinned requirement is unsatisfied and
- * nothing else in the rollup would have said so.
+ * Trust is resolved here through the SAME identity gate demand release uses
+ * (`trustedImpactStamp`): the proof must have passed and must bind both the
+ * candidate's headSha and its patchId. A stale, aborted, absent, or
+ * differently-bound proof yields no stamp, and every declared stack is planned
+ * for deploy. Total over its INPUTS — no proof, stamp, or profile can make it
+ * throw. A malformed CALL is the deliberate exception: omitting
+ * `vetoedTargets` is API misuse, not data doubt, and throws.
  */
-declare const hostedVerifyCheckState: (rollup: StatusCheckRollup[] | undefined) => CheckState;
-declare const statusCheckState: (rollup: StatusCheckRollup[] | undefined, exclude?: (check: StatusCheckRollup) => boolean) => CheckState;
-//#endregion
-//#region src/pr-ready.d.ts
-interface PrReadyArgs extends LoadProjectProfileInput {
-  authoringSessionIds?: string[];
-  base: string;
-  epic?: number;
-  json?: boolean;
-  output?: string;
-  report?: boolean;
-  pr: number;
-  reviewProof?: string;
-  throwWhenBlocked?: boolean;
-  verifyProof?: string;
-}
-interface GitHubPullRequest {
+declare const planPreviewLifecycle: ({
+  candidate,
+  profile,
+  proof,
+  vetoedTargets
+}: {
+  candidate: {
+    headSha: string;
+    patchId: string;
+  };
+  profile: PreviewLifecycleProfile;
+  proof: PrVerifyProof | undefined;
   /**
-   * GitHub's live auto-merge enablement, or `null` when nothing is scheduled.
+   * Stack names with a current, candidate-bound FAILING envelope. Scoping is
+   * withheld for these whatever the stamp says — the same veto demand release
+   * applies, and for the same reason: a withheld stack is a stack that can
+   * never re-emit the envelope its standing demand needs. Callers hold the
+   * checkout context, so they resolve the set with `boundFailingCheckNames`
+   * and pass it in; this module stays pure.
    *
-   * Required, not optional (#515 review). `gh pr view --json autoMergeRequest`
-   * always returns the key — explicitly `null` when nothing is scheduled — and
-   * errors loudly on a field name it does not know, so there is no shape where
-   * the real CLI omits it. But `fetchPullRequest` is injectable, and an
-   * implementation that left the field out would silently disable the
-   * `boundary-wave` refusal that stops an epicless run from greening a
-   * candidate GitHub is already scheduled to merge. Requiring it makes the
-   * compiler enforce what `gh` already promises.
+   * REQUIRED, with no default, on purpose: a defaulted `[]` reads the same
+   * whether the caller inspected the envelopes or never looked, and this seam
+   * exists precisely for EXTERNAL preview producers — the callers most likely
+   * to skip the lookup. Pass the result of `boundFailingCheckNames`; pass `[]`
+   * only to mean "inspected the envelopes and found no bound failure".
+   *
+   * Deliberately visible to `api:check` as a breaking signature change
+   * (pre-1.0, no external callers yet).
    */
-  autoMergeRequest: {
+  vetoedTargets: readonly string[];
+}) => PreviewLifecyclePlan;
+//#endregion
+//#region src/pr-status-hud.d.ts
+type FactoryPrStatusCheckName = "patronage-factory/merge-freeze" | "patronage-factory/pr-ready" | "patronage-factory/pr-verify";
+interface CompletedFactoryCheckSnapshot {
+  readonly completedAt: string;
+  readonly conclusion: string;
+  readonly detailsUrl?: string;
+  readonly headSha: string;
+  readonly name: FactoryPrStatusCheckName;
+}
+interface FailedPreviewSnapshot {
+  readonly completedAt: string;
+  readonly conclusion: string;
+  readonly detailsUrl?: string;
+  readonly headSha: string;
+  readonly name: string;
+}
+interface FactoryPrStatusSources {
+  /** Live PR base ref name observed with the sources. Identity, not a SHA. */
+  readonly baseRefName?: string;
+  readonly baseSha: string;
+  readonly checks: Readonly<Partial<Record<FactoryPrStatusCheckName, CompletedFactoryCheckSnapshot>>>;
+  readonly previewFailures?: Readonly<Partial<Record<string, FailedPreviewSnapshot>>>;
+  readonly previewRegistrations: readonly PreviewProofRegistration[];
+}
+interface RenderFactoryPrStatusHudInput extends FactoryPrStatusSources {
+  readonly headSha: string;
+  readonly plan: PreviewLifecyclePlan;
+  readonly planHeadSha: string;
+  readonly pr: number;
+  /** ISO instant at which the presentation sources were observed. */
+  readonly renderedAt: string;
+}
+interface PresentFactoryPrStatusHudInput {
+  readonly headSha: string;
+  readonly owner: string;
+  readonly plan: PreviewLifecyclePlan;
+  readonly planHeadSha: string;
+  readonly pr: number;
+  readonly renderedAt?: string;
+  readonly repo: string;
+}
+interface PresentFactoryPrStatusHudDependencies {
+  /**
+   * Read only `previewProofInventory.list` registrations and completed,
+   * Factory-App-owned check snapshots. PR comment bodies are not an evidence
+   * source and are deliberately absent from this contract.
+   */
+  readonly readSources: (input: {
+    headSha: string;
+    owner: string;
+    pr: number;
+    previewTargets?: readonly string[];
+    repo: string;
+  }) => Promise<FactoryPrStatusSources>;
+  /**
+   * Recheck the pulls identity immediately before mutating the sticky HUD.
+   * Happy path reads `/pulls/:n` only; git-ref is fetched to decorate a
+   * head-moved error, not as a second identity endpoint.
+   */
+  readonly assertCurrentIdentity: (input: {
+    baseRefName?: string; /** Retained for rendering/callers; identity compares base ref name. */
+    baseSha?: string;
+    headSha: string;
+    owner: string;
+    pr: number;
+    repo: string;
+  }) => Promise<void>;
+  readonly upsert?: typeof upsertFactoryPrStatusComment;
+}
+interface ReadFactoryPrStatusSourcesInput {
+  readonly headSha: string;
+  /**
+   * Contents-read token for `previewProofInventory.list` and the live
+   * `git/ref/heads/<base>` tip. Both need `contents: read`; the Factory App
+   * token has none, so pass a workflow `GITHUB_TOKEN` (#825, #908). The
+   * inventory list falls back to `token`. The base tip has no HTTP fallback:
+   * without this token it is read through `gh`.
+   */
+  readonly inventoryToken?: string;
+  readonly owner: string;
+  readonly pr: number;
+  /**
+   * Demanded preview stack names from the lifecycle plan. Used only to look up
+   * a completed unsuccessful check run when inventory has no registration.
+   */
+  readonly previewTargets?: readonly string[];
+  readonly repo: string;
+  /** Factory App installation token, normally minted by the presentation job. */
+  readonly token: string;
+}
+interface ReadFactoryPrStatusSourcesDependencies {
+  readonly fetch?: typeof fetch;
+  /**
+   * Local base-tip reader used when no `inventoryToken` exists. Defaults to
+   * the `gh`-backed reader `pr:ready` already uses.
+   */
+  readonly fetchBranchTipSha?: typeof fetchGitHubBranchTipSha;
+  readonly listPreviewRegistrations?: (input: {
+    owner: string;
+    pr: number;
+    repo: string;
+    token: string;
+  }) => Promise<readonly PreviewProofRegistration[]>;
+  readonly timeoutMs?: number;
+}
+declare function renderFactoryPrStatusHud(input: RenderFactoryPrStatusHudInput): string;
+declare function presentFactoryPrStatusHud(input: PresentFactoryPrStatusHudInput, dependencies: PresentFactoryPrStatusHudDependencies): Promise<UpsertFactoryPrStatusCommentResult>;
+declare function assertFactoryPrStatusIdentity(input: ReadFactoryPrStatusSourcesInput & {
+  readonly baseRefName?: string; /** Retained for rendering/callers; identity compares base ref name. */
+  readonly baseSha?: string;
+}, dependencies?: ReadFactoryPrStatusSourcesDependencies): Promise<void>;
+declare function readFactoryPrStatusSources(input: ReadFactoryPrStatusSourcesInput, dependencies?: ReadFactoryPrStatusSourcesDependencies): Promise<FactoryPrStatusSources>;
+interface PlanFactoryPrStatusHudInput {
+  readonly cwd: string;
+  readonly headSha: string;
+  readonly mergeBaseSha?: string;
+  readonly patchId?: string;
+  readonly profilePath?: string;
+}
+/**
+ * Consume `planPreviewLifecycle` for the current checkout. No second plan is
+ * invented: dispositions are Ready/Skipped from `deploy` vs `not-required`.
+ * Candidate identity is never copied from the proof. Absent independent
+ * identity or an unbound verify proof is the planner's conservative path.
+ */
+declare function planFactoryPrStatusHud(input: PlanFactoryPrStatusHudInput): PreviewLifecyclePlan;
+interface RefreshFactoryPrStatusHudInput {
+  readonly cwd: string;
+  readonly headSha: string;
+  /**
+   * Workflow `GITHUB_TOKEN` with `contents: read` for the live git-ref and
+   * preview inventory. The Factory App token cannot read those (#825, #908).
+   */
+  readonly inventoryToken?: string;
+  readonly mergeBaseSha?: string;
+  readonly owner: string;
+  readonly patchId?: string;
+  readonly pr: number;
+  readonly profilePath?: string;
+  readonly repo: string;
+  readonly token?: string;
+}
+/** Plan from the checkout and present the App-owned HUD. */
+declare function refreshFactoryPrStatusHud(input: RefreshFactoryPrStatusHudInput): Promise<UpsertFactoryPrStatusCommentResult>;
+/**
+ * Presentation must not fail an admission gate. Used after pr:ready publishes
+ * its check so the table is not stuck at first-write.
+ */
+declare function refreshFactoryPrStatusHudSafely(input: RefreshFactoryPrStatusHudInput, onNotice?: (message: string) => void): Promise<void>;
+//#endregion
+//#region src/pr-ready.d.ts
+interface PrReadyArgs extends LoadProjectProfileInput {
+  authoringSessionIds?: string[];
+  base: string;
+  epic?: number;
+  json?: boolean;
+  output?: string;
+  report?: boolean;
+  pr: number;
+  reviewProof?: string;
+  throwWhenBlocked?: boolean;
+  verifyProof?: string;
+}
+interface GitHubPullRequest {
+  /**
+   * GitHub's live auto-merge enablement, or `null` when nothing is scheduled.
+   *
+   * Required, not optional (#515 review). `gh pr view --json autoMergeRequest`
+   * always returns the key — explicitly `null` when nothing is scheduled — and
+   * errors loudly on a field name it does not know, so there is no shape where
+   * the real CLI omits it. But `fetchPullRequest` is injectable, and an
+   * implementation that left the field out would silently disable the
+   * `boundary-wave` refusal that stops an epicless run from greening a
+   * candidate GitHub is already scheduled to merge. Requiring it makes the
+   * compiler enforce what `gh` already promises.
+   */
+  autoMergeRequest: {
     enabledAt?: string;
   } | null;
   baseRefName: string;
   baseRefOid: string;
   body: string;
+  headRefName?: string;
   headRefOid: string;
+  /**
+   * Whether the head branch lives in a different repository from the base
+   * (#922). Required, not optional, for the reason `autoMergeRequest` is: the
+   * trusted checkout names ONE repository, and for a fork PR that is not the
+   * base repository. An implementation that omitted the field would silently
+   * resolve base policy from whichever repository the checkout points at.
+   */
+  isCrossRepository: boolean;
   isDraft: boolean;
   mergeStateStatus: string;
   mergeable: string;
@@ -1398,6 +2368,14 @@ interface PrReadyProof {
     headSha: string;
     outcome: "armed" | "merged" | "not-armed";
   };
+  /**
+   * The authoring session readiness resolved for the review-independence
+   * cross-check (#1037). Recorded so the branded check can print it beside the
+   * review session, model, and producer the ledger already carries — the four
+   * identities a human weighs at merge time. Additive and optional: proofs
+   * written before it carry no field, so no schema version moves.
+   */
+  authoringSession?: string;
   /**
    * Why this run blocked, one entry per refusing demand (#391): `code` is the
    * demand key from the resolver's vocabulary, `detail` the one-sentence
@@ -1432,6 +2410,13 @@ interface PrReadyProof {
    * waived demand reads to a human. Absent when there are none.
    */
   notices?: string[];
+  /**
+   * The policy identity readiness resolved review demand under (#922): the
+   * base ref, its live tip, and the digests of the base, candidate, and merged
+   * review policies. Optional on the wire and additive — this is a new record
+   * on an unchanged contract, so no schema version moves.
+   */
+  policyResolution?: PolicyResolution;
   /** Committed profile blob evaluated by readiness. Required for merge. */
   profileBlobSha?: string;
   /** Checkout-relative committed profile path evaluated by readiness. */
@@ -1455,6 +2440,13 @@ interface PrReadyDependencies {
    * call plus the read-back that says what actually happened.
    */
   armAutoMerge?: (input: ArmAutoMergeInput) => ArmAutoMergeOutcome;
+  /**
+   * Reads the authoritative base review policy (#922): the profile committed at
+   * the live tip of the PR's own base ref. Defaults to the real GitHub reads,
+   * so an unstated authority refuses rather than falling back to candidate
+   * policy — unreadable authority is never absent authority.
+   */
+  basePolicy?: BaseReviewPolicyAuthority;
   github?: {
     fetchClosingPullRequests?: (input: {
       issue: number;
@@ -1496,6 +2488,12 @@ interface PrReadyDependencies {
   publishFinalCheckRun?: (input: Omit<PublishFactoryCheckInput, "status"> & {
     conclusion: "failure" | "success";
   }) => Promise<boolean> | boolean;
+  /**
+   * Re-present the App-owned HUD after this run's ready check is published
+   * so the table is not stuck at first-write. Defaults to a safe refresh
+   * that never fails the gate.
+   */
+  presentStatusHud?: (input: RefreshFactoryPrStatusHudInput) => Promise<void> | void;
   /** Injectable delay for the UNKNOWN-mergeable brief poll (tests). */
   sleep?: (ms: number) => Promise<void>;
 }
@@ -1503,9 +2501,16 @@ interface PrReadyGitDependencies {
   canResolveCommit: (cwd: string, sha: string) => boolean;
   changedFiles: (cwd: string, base: string, headSha?: string) => string[];
   checkoutRepository: (cwd: string) => CheckoutRepository;
+  /**
+   * Bring `refs/heads/<baseRefName>` into the checkout so the live tip
+   * `pr.baseRefOid` can resolve. Optional so fixtures that already resolve
+   * every SHA can omit it.
+   */
+  fetchOriginRef?: (cwd: string, refName: string) => void;
   currentHeadSha: (cwd: string) => string;
   mergeBaseSha: (cwd: string, base: string) => string;
-  objectIdAtRef: (cwd: string, ref: string, absolutePath: string) => string | undefined;
+  /** `repositoryRelativePath` is repository-relative, never cwd-relative. */
+  objectIdAtRef: (cwd: string, ref: string, repositoryRelativePath: string) => string | undefined;
   resolveCommitSha: (cwd: string, ref: string) => string | undefined;
   showFileAtRef: (cwd: string, ref: string, absolutePath: string) => string | undefined;
   stablePatchId: (cwd: string, base: string) => string;
@@ -1514,108 +2519,6 @@ declare function validatePrReadyProof(value: unknown): PrReadyProof;
 declare function readPrReadyProof(filePath: string): PrReadyProof;
 declare function runPrReady(args: PrReadyArgs, dependencies?: PrReadyDependencies): Promise<PrReadyProof>;
 //#endregion
-//#region src/impact-stamp.d.ts
-/**
- * The recorded stamp. `targets` satisfies the completeness invariant: every
- * target the profile declares is present, each with its exact basis — never
- * silently absent. `basis: "conservative"` means an unmodelled or unprovable
- * input widened every target to full impact.
- */
-declare const impactStampSchema: z.ZodObject<{
-  basis: z.ZodEnum<{
-    "target-scoped": "target-scoped";
-    conservative: "conservative";
-  }>;
-  reasons: z.ZodArray<z.ZodString>;
-  stampVersion: z.ZodLiteral<2>;
-  targets: z.ZodArray<z.ZodObject<{
-    basis: z.ZodString;
-    impact: z.ZodEnum<{
-      affected: "affected";
-      "not-affected": "not-affected";
-    }>;
-    name: z.ZodString;
-  }, z.core.$strip>>;
-}, z.core.$strip>;
-type ImpactStamp = z.infer<typeof impactStampSchema>;
-/**
- * The surfaces that consume the stamp. One classification, consumed
- * everywhere (#430): every surface routes through
- * {@link impactStampScopeDecision}, so no surface can be more trusting than
- * another, and no surface re-derives path rules of its own. The value only
- * selects the wording of the conservative floor a refusal falls back to.
- */
-declare const IMPACT_SCOPE_SURFACES: {
-  readonly demand: "full demand floor";
-  readonly "preview-lifecycle": "full preview-lifecycle floor";
-  readonly "verification-battery": "full verification-battery floor";
-};
-type ImpactScopeSurface = keyof typeof IMPACT_SCOPE_SURFACES;
-interface ImpactScopeDecision {
-  reason: string;
-  /** True ⇒ this target's work is provably unreachable and may be released. */
-  scoped: boolean;
-}
-/**
- * Whether a trusted stamp RELEASES one target-scoped unit of work — an
- * external proof demand (#542 wave 2), a verification-battery command, or a
- * preview (Alchemy) lifecycle stack (#430 wave 3).
- *
- * The only release path is a `target-scoped` stamp of exactly this build's
- * stamp version whose target entry for exactly this name is provably
- * `not-affected`. Every other input — no trusted stamp, an unknown stamp
- * version, a conservative stamp, a name the stamp does not classify, or an
- * `affected` verdict — keeps today's full-work floor. Work only ever gets
- * released, never added or satisfied: this function can withdraw a demand, it
- * can never certify one.
- *
- * Identity binding is the CALLER's precondition: pass only a stamp computed
- * for, or read from a pr:verify proof bound to, the current candidate (see
- * `trustedImpactStamp` in `pr-readiness/verification-proof.ts`); pass
- * `undefined` otherwise.
- */
-declare const impactStampScopeDecision: ({
-  stamp,
-  surface,
-  targetName
-}: {
-  stamp: ImpactStamp | undefined;
-  surface: ImpactScopeSurface;
-  targetName: string;
-}) => ImpactScopeDecision;
-//#endregion
-//#region src/required-check-policy.d.ts
-declare const EVIDENCE_CHECK_TYPES: readonly ["review", "verify"];
-type EvidenceCheckType = (typeof EVIDENCE_CHECK_TYPES)[number];
-declare const requiredCheckScopeSchema: z.ZodObject<{
-  classifications: z.ZodArray<z.ZodEnum<{
-    trivial: "trivial";
-    "docs/process-only": "docs/process-only";
-    "non-trivial": "non-trivial";
-  }>>;
-}, z.core.$strict>;
-type RequiredCheckScope = z.infer<typeof requiredCheckScopeSchema>;
-interface RequiredCheckScopeContext {
-  classification: DiffClassification | undefined;
-  impactStamp?: ImpactStamp;
-}
-interface ScopeDecision {
-  inScope: boolean;
-  reason: string;
-}
-declare const requiredCheckInScope: ({
-  context,
-  scope
-}: {
-  context: RequiredCheckScopeContext;
-  scope?: RequiredCheckScope;
-}) => ScopeDecision;
-interface RequiredCheck {
-  name: string;
-  checkType: EvidenceCheckType;
-  scope?: RequiredCheckScope;
-}
-//#endregion
 //#region src/factory-session.d.ts
 declare const resolveAuthoringSessionIds: ({
   override,
@@ -1697,587 +2600,186 @@ interface EvidenceCandidateIdentity {
   mergeBaseSha: string;
 }
 declare const evidenceBindingFresh: ({
-  candidate,
-  envelope
-}: {
-  candidate: EvidenceCandidateIdentity;
-  envelope: EvidenceEnvelope;
-}) => boolean;
-interface IndependenceResult {
-  independent: boolean;
-  reason?: "no-session" | "unknown-authoring-identity" | "same-session";
-}
-declare const evidenceReviewIndependence: ({
-  authoringSessionIds,
-  envelope
-}: {
-  authoringSessionIds: string[];
-  envelope: EvidenceEnvelope;
-}) => IndependenceResult;
-type LoadedEvidenceEnvelope = {
-  ok: true;
-  envelope: EvidenceEnvelope;
-  path: string;
-} | {
-  check?: string;
-  error: string;
-  ok: false;
-  path: string;
-};
-/**
- * Every check name with a current, candidate-bound FAILING envelope on disk.
- *
- * The wave-3 scoping veto input. Callers pass the resolved set to
- * `planVerificationBattery` / `planPreviewLifecycle`, which stay pure — the
- * planners decide, they never read the filesystem.
- *
- * `checkType` is the caller's, not a guess: schema-v5 requiredChecks are
- * verify-only (`resolveProfileRequiredChecks`), so a scoping caller passes
- * `"verify"` and matches exactly the pair wave 2 evaluates.
- */
-declare const boundFailingCheckNames: ({
-  candidate,
-  checkType,
-  envelopes
-}: {
-  candidate: EvidenceCandidateIdentity;
-  checkType: EvidenceCheckType;
-  envelopes: LoadedEvidenceEnvelope[];
-}) => string[];
-interface RequiredCheckEvaluationInput {
-  authoringSessionIds: string[];
-  candidate: EvidenceCandidateIdentity;
-  envelopes: LoadedEvidenceEnvelope[];
-  requiredChecks: RequiredCheck[];
-  scopeContext: RequiredCheckScopeContext;
-}
-interface RequiredCheckOutcome {
-  name: string;
-  checkType: EvidenceCheckType;
-  status: "satisfied" | "unmet" | "out-of-scope";
-  inScope: boolean;
-  scopeReason: string;
-  scope?: RequiredCheckScope;
-  reason?: string;
-  matchedPath?: string;
-}
-interface RequiredCheckEvaluation {
-  outcomes: RequiredCheckOutcome[];
-  blockingReasons: string[];
-}
-declare const evaluateRequiredChecks: ({
-  authoringSessionIds,
-  candidate,
-  envelopes,
-  requiredChecks,
-  scopeContext
-}: RequiredCheckEvaluationInput) => RequiredCheckEvaluation;
-declare const EVIDENCE_DIR = ".factory-memory/evidence";
-declare const loadEvidenceEnvelopes: (cwd: string) => LoadedEvidenceEnvelope[];
-//#endregion
-//#region src/review-proof-applicability.d.ts
-declare const REVIEW_STATUS_VALUES: readonly ["not-required", "current", "stale", "missing", "blocked"];
-declare const reviewStatusSchema: z.ZodEnum<{
-  blocked: "blocked";
-  stale: "stale";
-  "not-required": "not-required";
-  current: "current";
-  missing: "missing";
-}>;
-type ReviewStatus = z.infer<typeof reviewStatusSchema>;
-interface CurrentReviewIdentity {
-  headSha: string;
-  patchId: string;
-}
-declare const reviewStatus: ({
-  blocked,
-  required,
-  reviewedHeadSha,
-  reviewedPatchId,
-  headSha,
-  patchId
-}: CurrentReviewIdentity & {
-  blocked?: boolean;
-  required: boolean;
-  reviewedHeadSha?: string;
-  reviewedPatchId?: string;
-}) => ReviewStatus;
-declare namespace proof_identity_d_exports {
-  export { CurrentReviewIdentity, REVIEW_STATUS_VALUES, ReviewProofClaim, ReviewStatus, explicitFailureIdentity, isExplicitReviewFailure, isUntypedReviewProof, reviewStatus, reviewStatusSchema, selectReviewProof };
-}
-type ReviewProofClaim = {
-  reviewedHeadSha?: string;
-  reviewedPatchId?: string;
-  untypedVerdict?: boolean;
-} | {
-  explicitFailure: true;
-  reviewedHeadSha?: string;
-  reviewedPatchId?: string;
-  untypedVerdict?: boolean;
-};
-declare const isExplicitReviewFailure: (proof: ReviewProofClaim) => proof is {
-  explicitFailure: true;
-  reviewedHeadSha?: string;
-  reviewedPatchId?: string;
-  untypedVerdict?: boolean;
-};
-declare const isUntypedReviewProof: (proof: ReviewProofClaim) => proof is {
-  untypedVerdict: true;
-  reviewedHeadSha?: string;
-  reviewedPatchId?: string;
-};
-declare const explicitFailureIdentity: (proof: ReviewProofClaim) => {
-  reviewedHeadSha?: string;
-  reviewedPatchId?: string;
-};
-declare const selectReviewProof: ({
-  reviewProof
-}: {
-  reviewProof: ReviewProofClaim;
-}) => {
-  reviewedHeadSha?: string;
-  reviewedPatchId?: string;
-  untypedVerdict?: boolean;
-};
-//#endregion
-//#region src/pr-readiness/review-epoch.d.ts
-interface ReviewCycleState {
-  autoBlockingFindings: number;
-  countsBySeverity: Record<ReviewFindingSeverity, number>;
-  highestBlockingSeverity?: ReviewFindingSeverity;
-  highestOpenSeverity?: ReviewFindingSeverity;
-  maxReviewCycles?: number;
-  nonBlockingFindings: number;
-  openFindings: number;
-  reviewCycle?: number;
-  staleRepeatFindings?: number;
-  windowExhausted: boolean;
-}
-declare const reviewCycleStateFor: (proof: Pick<PrReviewProof, "ladder" | "reviewCycle" | "maxReviewCycles" | "reviews">, policy?: ReviewLadderPolicy, adjudicatedLedger?: FindingLedgerEntry[]) => ReviewCycleState;
-type ReviewAcceptance = "accepted-after-cap" | "accepted-clean" | "accepted-through-ladder" | "blocked";
-declare const resolveReviewAcceptance: (proof: PrReviewProof, review: PrReviewResult, policy: ReviewLadderPolicy | undefined) => ReviewAcceptance;
-type ReviewTerminalState = "accepted-with-findings" | "blocked" | "clean";
-declare const resolveReviewTerminalStateForEpoch: (proof: PrReviewProof, review: PrReviewResult, epoch: ReviewEpochMode, adjudicatedLedger?: FindingLedgerEntry[]) => ReviewTerminalState;
-declare const resolveReviewTerminalState: (proof: PrReviewProof, review: PrReviewResult, policy: ReviewLadderPolicy | undefined) => ReviewTerminalState;
-declare const resolveReviewTerminalStateAcrossReviews: (proof: PrReviewProof, epoch: ReviewEpochMode, adjudicatedLedger?: FindingLedgerEntry[]) => ReviewTerminalState | undefined;
-declare const resolveReviewTerminalStateAcrossReviewsForPolicy: (proof: PrReviewProof, policy: ReviewLadderPolicy) => ReviewTerminalState | undefined;
-declare const reviewProofFor: (proof: PrReviewProof | undefined, kind: PrReviewKind, policy: ReviewLadderPolicy | undefined, current?: {
-  patchId: string;
-}) => ReviewProofClaim;
-declare namespace review_proof_d_exports {
-  export { DEFAULT_PR_REVIEW_MAX_CYCLES, DEFAULT_PR_REVIEW_PROOF_PATH, PR_REVIEW_FINAL_READINESS_NOTICE, PR_REVIEW_FINDING_PROVENANCE_VERSION, PR_REVIEW_PROOF_DESCRIPTOR, PR_REVIEW_SCHEMA_VERSION, PrReviewFinding, PrReviewKind, PrReviewLadderState, PrReviewMode, PrReviewOutcome, PrReviewProof, PrReviewResult, PrReviewStageResolution, REVIEW_SEVERITIES, ReviewAcceptance, ReviewCycleState, ReviewFindingCategory, ReviewFindingSeverity, ReviewTerminalState, prReviewFindingSchema, prReviewProofSchema, prReviewResultSchema, readPrReviewProof, resolveReviewAcceptance, resolveReviewTerminalState, resolveReviewTerminalStateAcrossReviews, resolveReviewTerminalStateAcrossReviewsForPolicy, resolveReviewTerminalStateForEpoch, reviewCycleStateFor, reviewProofFor, validatePrReviewProof, validatePrReviewResult };
-}
-declare const PR_REVIEW_SCHEMA_VERSION = 2;
-declare const PR_REVIEW_FINDING_PROVENANCE_VERSION = 1;
-declare const DEFAULT_PR_REVIEW_PROOF_PATH = ".factory-memory/pr-review.json";
-declare const DEFAULT_PR_REVIEW_MAX_CYCLES = 5;
-declare const PR_REVIEW_FINAL_READINESS_NOTICE = "pr:review is a final readiness proof gate. Run it after local verification and avoid repeated full runs unless the review proof records actionable findings. Default review window: 5 cycles.";
-declare const prReviewFindingSchema: z.ZodType<PrReviewFinding>;
-declare const prReviewResultSchema: z.ZodType<PrReviewResult>;
-declare const prReviewProofSchema: z.ZodType<PrReviewProof>;
-declare const validatePrReviewResult: (value: unknown) => PrReviewResult;
-declare const validatePrReviewProof: (value: unknown) => PrReviewProof;
-declare const readPrReviewProof: (filePath: string) => PrReviewProof;
-declare const PR_REVIEW_PROOF_DESCRIPTOR: ProofDescriptor<PrReviewProof>;
-declare namespace verification_proof_d_exports {
-  export { PrVerifyBaselineFullProof, PrVerifyCommandResult, PrVerifyExecutedCommand, PrVerifyNotRequiredCommand, PrVerifyProof, PrVerifySchemaVersion, ResolvedPrVerifyMode, SUPPORTED_PR_VERIFY_SCHEMA_VERSIONS, VerificationHeadShas, VerificationProofState, VerifiedHeadShas, prVerifyFullHeadShasForDiff, prVerifyProofHeadShas, readPrVerifyProof, resolveVerifyProofApplicability, trustedImpactStamp, validatePrVerifyProof, verificationProofApplicabilityFor, verificationProofBlockingReason, verificationProofForReadiness, verificationProofStateFor, verifyProofIdentityMatches, verifyProofPassed };
-}
-interface VerifiedHeadShas {
-  docsOnlyVerifiedHeadShas: string[];
-  trivialVerifiedHeadShas: string[];
-  verifiedHeadShas: string[];
-}
-type VerificationHeadShas = {
-  explicitFailure: true;
-} | VerifiedHeadShas;
-declare const SUPPORTED_PR_VERIFY_SCHEMA_VERSIONS: readonly [1, 2, 3, 4];
-type PrVerifySchemaVersion = (typeof SUPPORTED_PR_VERIFY_SCHEMA_VERSIONS)[number];
-interface PrVerifyCommandResult {
-  command: string;
-  description: string;
-  /**
-   * Epic #550 wave 3 (#430): the profile's declared impact target for this
-   * command, recorded from v4 on. It is the proof's own command→target
-   * mapping: a `notRequiredCommands` entry must name the target recorded HERE
-   * for the same command, so a withholding cannot point at whichever released
-   * target happens to be convenient. Absent for a command the profile does
-   * not scope, and for v1–v3 proofs, which predate the field.
-   */
-  impactTarget?: string;
-  name: string;
-  scope: "always" | "docs-only" | "trivial" | "full";
-}
-interface PrVerifyExecutedCommand {
-  command: string;
-  counts?: {
-    testFiles?: number;
-    tests?: number;
-  };
-  durationMs: number;
-  exitCode: number;
-  name: string;
-  scope: "always" | "docs-only" | "trivial" | "full";
-}
-/**
- * Epic #550 wave 3 (#430): a verification command the impact stamp proved this
- * candidate cannot reach, so the battery did not run it.
- *
- * The completeness invariant lives in the pairing: `verificationCommands`
- * records every command the resolved mode selected, `executedCommands` records
- * what ran, and this list records the rest WITH the stamp's own basis. A
- * withheld stack is therefore never silently absent from the proof — it is
- * present, named, and explained.
- */
-interface PrVerifyNotRequiredCommand {
-  basis: string;
-  impactTarget: string;
-  name: string;
-}
-interface PrVerifyProof {
-  schemaVersion: PrVerifySchemaVersion;
-  authoringSession?: string;
-  base: string;
-  baselineFullProofs?: {
-    base: string;
-    changedFiles: string[];
-    headSha: string;
-    profilePath: string;
-    projectKey: string;
-    repository: string;
-  }[];
-  changedFiles: string[];
-  classification: DiffClassification;
-  classificationReasons: string[];
-  command: "patronage-factory pr:verify";
-  durationMs: number;
-  endedAt: string;
-  executedCommands?: PrVerifyExecutedCommand[];
-  headSha: string;
-  impactStamp?: ImpactStamp;
-  mode: ResolvedPrVerifyMode;
-  mergeBaseSha?: string;
-  notRequiredCommands?: PrVerifyNotRequiredCommand[];
-  outcome?: "aborted" | "passed";
-  patchId?: string;
-  profilePath: string;
-  projectKey: string;
-  repository: string;
-  startedAt: string;
-  verificationCommands: PrVerifyCommandResult[];
-}
-type PrVerifyBaselineFullProof = NonNullable<PrVerifyProof["baselineFullProofs"]>[number];
-declare function validatePrVerifyProof(value: unknown): PrVerifyProof;
-declare function readPrVerifyProof(filePath: string): PrVerifyProof;
-declare const verifyProofPassed: (proof: PrVerifyProof) => boolean;
-declare const prVerifyProofHeadShas: (proof: PrVerifyProof | undefined, creditedHeadSha?: string) => VerifiedHeadShas;
-declare const verifyProofIdentityMatches: ({
-  currentIdentity,
-  proof
-}: {
-  currentIdentity?: {
-    patchId: string;
-    mergeBaseSha?: string;
-  };
-  proof?: PrVerifyProof;
-}) => boolean;
-/**
- * Wave-2 consumption (#542): the recorded impact stamp, released for demand
- * resolution ONLY when it is identity-bound to the current candidate — the
- * proof passed, and its recorded headSha AND patchId both name exactly this
- * candidate (the same identities the proof already binds). Everything else —
- * no proof, an aborted run, a stale head, a moved patch id, a pre-stamp proof
- * — returns `undefined`, and the consumer keeps today's full-demand floor.
- *
- * Deliberately stricter than verify-once applicability (which tolerates a
- * head-only or patch-id-only match): a stamp narrows external demands, so it
- * is trusted only on an exact double binding, fail closed.
- */
-declare const trustedImpactStamp: ({
-  candidate,
-  proof
-}: {
-  candidate: {
-    headSha: string;
-    patchId: string;
-  };
-  proof: PrVerifyProof | undefined;
-}) => ImpactStamp | undefined;
-declare const prVerifyFullHeadShasForDiff: ({
-  docsOnlyDeltaAcceptedSince,
-  files,
-  proof
-}: {
-  docsOnlyDeltaAcceptedSince?: (baselineHeadSha: string) => boolean;
-  files: string[];
-  proof: PrVerifyProof;
-}) => string[];
-type VerificationProofState = {
-  kind: "typed-aborted";
-  proof: PrVerifyProof;
-} | {
-  kind: "typed-missing";
-  path: string;
-  reason: "enoent" | "invalid";
-  message?: string;
-} | {
-  kind: "typed";
-  headShas: VerifiedHeadShas;
-  proof: PrVerifyProof;
-} | {
-  kind: "typed-diff-mismatch";
-  mode: ResolvedPrVerifyMode;
-};
-declare const verificationProofStateFor: ({
-  proof,
-  proofMatchesCurrentDiff,
-  proofPath
-}: {
-  proof?: PrVerifyProof;
-  proofMatchesCurrentDiff?: boolean;
-  proofPath?: string;
-}) => VerificationProofState;
-declare const verificationProofApplicabilityFor: ({
-  docsOnlyDeltaAcceptedSince,
-  explicitProof,
-  files,
-  headSha,
-  currentIdentity,
-  proof,
-  proofPath,
-  proofReadError
-}: {
-  docsOnlyDeltaAcceptedSince?: (baselineHeadSha: string) => boolean;
-  explicitProof: boolean;
-  files: string[];
-  headSha: string;
-  currentIdentity?: {
-    patchId: string;
-    mergeBaseSha?: string;
-  };
-  proof?: PrVerifyProof;
-  proofPath?: string;
-  proofReadError?: unknown;
-}) => {
-  fullVerifiedHeadShas: never[];
-  verificationProof: VerificationProofState;
-} | {
-  fullVerifiedHeadShas: string[];
-  verificationProof: {
-    headShas: VerifiedHeadShas;
-    kind: "typed";
-    proof: PrVerifyProof;
-  };
-};
-declare const resolveVerifyProofApplicability: ({
-  proofPath,
-  explicitProof,
-  docsOnlyDeltaAcceptedSince,
-  files,
-  headSha,
-  currentVerifyIdentityForBase,
-  preread
-}: {
-  proofPath: string;
-  explicitProof: boolean;
-  docsOnlyDeltaAcceptedSince?: (baselineHeadSha: string) => boolean;
-  files: string[];
-  headSha: string;
-  currentVerifyIdentityForBase?: (base: string) => {
-    patchId: string;
-    mergeBaseSha?: string;
-  };
-  preread?: {
-    proof?: PrVerifyProof;
-    error?: unknown;
-  };
-}) => {
-  fullVerifiedHeadShas: never[];
-  verificationProof: VerificationProofState;
+  candidate,
+  envelope
+}: {
+  candidate: EvidenceCandidateIdentity;
+  envelope: EvidenceEnvelope;
+}) => boolean;
+interface IndependenceResult {
+  independent: boolean;
+  reason?: "no-session" | "unknown-authoring-identity" | "same-session";
+}
+declare const evidenceReviewIndependence: ({
+  authoringSessionIds,
+  envelope
+}: {
+  authoringSessionIds: string[];
+  envelope: EvidenceEnvelope;
+}) => IndependenceResult;
+type LoadedEvidenceEnvelope = {
+  ok: true;
+  envelope: EvidenceEnvelope;
+  path: string;
 } | {
-  fullVerifiedHeadShas: string[];
-  verificationProof: {
-    headShas: VerifiedHeadShas;
-    kind: "typed";
-    proof: PrVerifyProof;
-  };
+  check?: string;
+  error: string;
+  ok: false;
+  path: string;
 };
-declare const verificationProofForReadiness: (state: VerificationProofState) => VerificationHeadShas;
-declare const verificationProofBlockingReason: (state: VerificationProofState) => string | undefined;
-//#endregion
-//#region src/retro-envelope.d.ts
 /**
- * Versioned retro envelope schema (epic #27 wave 2, issue #34).
- *
- * One envelope per lane, built at `factory:closeout` and delivered through the
- * typed gate-sink as the `retro-envelope` ingest kind. Re-derived in TypeScript
- * from the `spike/telemetry-layer2` S5 scratch schema (reference-only, never
- * merged). This module is the single source of truth for the v1 wire shape
- * and its bounds ({@link RETRO_ENVELOPE_WIRE_BOUNDS}) — producer and consumer
- * alike. HQ imports these exports directly from the Worker-safe
- * `@patronage/software-factory/schemas` subpath
- * (`software-factory-hq/src/contracts/retro-schemas.ts`) instead of
- * maintaining a parallel hand-written copy, so there is exactly one wire
- * contract and no drift-detection machinery is needed (issue #350; formerly
- * a hand-written twin plus a 767-line parity test, #46).
- *
- * DESIGN INVARIANT: cross-family token sums must be UNREPRESENTABLE.
- *
- * The two model families use different tokenizers, prices, and accounting
- * conventions, so any token total that spans Claude and GPT is a lie:
- *
- * 1. There is no combined/total token field anywhere in the envelope.
- * 2. `tokenFamilies` is strict — its only keys are `claude` and `gpt`; data
- *    cannot smuggle in a third "all"/"combined" slot.
- * 3. The family BLOCKS are structurally different shapes with DIFFERENT keys
- *    (claude is a single flat block keyed on freshInput/cacheReadInput/
- *    cacheCreationInput; gpt is `{ roles: [...] }`). The exclusive input-tier
- *    COUNTS share no key name across families. The residual names shared
- *    between the claude block and a gpt ROLE entry are pinned to exactly
- *    {costUsd, model, output} (PR #32 advisory): `costUsd` is deliberate —
- *    USD is the one cross-family summable unit (rule 4); `model` is an
- *    unsummable label; `output` is the same name at DIFFERENT depths (lane
- *    block vs per-role entry), frozen by a tripwire test in
- *    `retro-envelope.test.ts` so the overlap cannot grow. Renaming `output`
- *    is a schemaVersion-2 wire change, deliberately not spent in v1.
- * 4. Cost is per-family USD and nullable. Combined totals are allowed in USD
- *    only, and only as a projection-time sum of per-family USD.
+ * Every check name with a current, candidate-bound FAILING envelope on disk.
  *
- * Field names also encode the S2/S3 reader lessons: Claude `freshInput` alone
- * is not prompt size (true input context = freshInput + cacheReadInput +
- * cacheCreationInput, requestId-deduped), and codex `inputInclusiveOfCache`
- * already includes `cachedInput`, so `freshInputDerived` (inclusive − cached)
- * is the only value safe to feed a per-token pricer.
+ * The wave-3 scoping veto input. Callers pass the resolved set to
+ * `planVerificationBattery` / `planPreviewLifecycle`, which stay pure — the
+ * planners decide, they never read the filesystem.
  *
- * COMPLETENESS POSTURE: harvest may have no usable native log for a lane, so
- * `tokenFamilies` may legitimately be absent. The closeout build gate demands
- * a valid envelope, not available telemetry. A families-absent envelope keeps
- * its operator-visible data gaps and is a replayable advisory HQ event, so it
- * never substitutes unavailable usage with zero. The wire shape (field names,
- * types, structure) stays byte-parity with HQ v1.
- */
-declare const RETRO_ENVELOPE_SCHEMA_VERSION = 1;
-declare const retroEnvelopeV1Schema: z.ZodObject<{
-  agentRunId: z.ZodString;
-  archiveRef: z.ZodOptional<z.ZodString>;
-  cycles: z.ZodObject<{
-    gateRunsToFirstGreen: z.ZodNumber;
-    reviewerFixRounds: z.ZodNumber;
-    thermoFixRounds: z.ZodNumber;
-  }, z.core.$strict>;
-  dataGaps: z.ZodDefault<z.ZodArray<z.ZodString>>;
-  gates: z.ZodArray<z.ZodObject<{
-    cycle: z.ZodNumber;
-    duration: z.ZodNumber;
-    gate: z.ZodString;
-    outcome: z.ZodEnum<{
-      pass: "pass";
-      fail: "fail";
-      skip: "skip";
-    }>;
-    startedAt: z.ZodISODateTime;
-  }, z.core.$strict>>;
-  generatedAt: z.ZodISODateTime;
-  interventions: z.ZodObject<{
-    count: z.ZodNumber;
-  }, z.core.$strict>;
-  joinKeys: z.ZodObject<{
-    claudeSessionIds: z.ZodDefault<z.ZodArray<z.ZodString>>;
-    codexThreadIds: z.ZodDefault<z.ZodArray<z.ZodString>>;
-  }, z.core.$strict>;
-  kind: z.ZodLiteral<"retro-envelope">;
-  outcome: z.ZodOptional<z.ZodObject<{
-    status: z.ZodEnum<{
-      success: "success";
-      fail: "fail";
-      blocked: "blocked";
-      "ship-with-followups": "ship-with-followups";
-    }>;
-    verdict: z.ZodOptional<z.ZodString>;
-  }, z.core.$strict>>;
-  phases: z.ZodArray<z.ZodObject<{
-    at: z.ZodISODateTime;
-    deltaSec: z.ZodOptional<z.ZodNumber>;
-    name: z.ZodString;
-  }, z.core.$strict>>;
-  refs: z.ZodObject<{
-    branch: z.ZodOptional<z.ZodString>;
-    epic: z.ZodOptional<z.ZodString>;
-    headSha: z.ZodOptional<z.ZodString>;
-    issue: z.ZodOptional<z.ZodString>;
-    prNumber: z.ZodOptional<z.ZodNumber>;
-  }, z.core.$strict>;
-  repo: z.ZodObject<{
-    name: z.ZodString;
-    owner: z.ZodString;
-  }, z.core.$strict>;
-  schemaVersion: z.ZodLiteral<1>;
-  tokenFamilies: z.ZodObject<{
-    claude: z.ZodOptional<z.ZodObject<{
-      cacheCreationInput: z.ZodNumber;
-      cacheReadInput: z.ZodNumber;
-      costUsd: z.ZodNullable<z.ZodNumber>;
-      family: z.ZodLiteral<"claude">;
-      freshInput: z.ZodNumber;
-      model: z.ZodString;
-      output: z.ZodNumber;
-      requests: z.ZodNumber;
-    }, z.core.$strict>>;
-    gpt: z.ZodOptional<z.ZodObject<{
-      family: z.ZodLiteral<"gpt">;
-      roles: z.ZodArray<z.ZodObject<{
-        cachedInput: z.ZodNumber;
-        costUsd: z.ZodNullable<z.ZodNumber>;
-        freshInputDerived: z.ZodNumber;
-        inputInclusiveOfCache: z.ZodNumber;
-        model: z.ZodString;
-        output: z.ZodNumber;
-        reasoningOutput: z.ZodNumber;
-        role: z.ZodString;
-        threadId: z.ZodOptional<z.ZodString>;
-      }, z.core.$strict>>;
-    }, z.core.$strict>>;
-  }, z.core.$strict>;
-  wallClock: z.ZodObject<{
-    endTs: z.ZodISODateTime;
-    startTs: z.ZodISODateTime;
-    totalSec: z.ZodNumber;
-  }, z.core.$strict>;
-}, z.core.$strict>;
-type RetroEnvelope = z.infer<typeof retroEnvelopeV1Schema>;
-/**
- * Versioned payload validators, keyed by schema major. Unknown majors never
- * reach these — {@link parseRetroEnvelope} returns them raw and marked
- * degraded, mirroring HQ's ingest skew posture (stored raw, never dropped).
+ * `checkType` is the caller's, not a guess: schema-v5 requiredChecks are
+ * verify-only (`resolveProfileRequiredChecks`), so a scoping caller passes
+ * `"verify"` and matches exactly the pair wave 2 evaluates.
  */
-declare const RETRO_ENVELOPE_VALIDATORS: Record<number, z.ZodType<RetroEnvelope, unknown>>;
-declare const SUPPORTED_RETRO_ENVELOPE_SCHEMA_VERSIONS: readonly number[];
-/** The `schemaVersion` a candidate declares, or undefined when unreadable. */
-declare const retroEnvelopeSchemaVersionOf: (candidate: unknown) => number | undefined;
-type ParsedRetroEnvelope = {
-  disposition: "trusted";
-  envelope: RetroEnvelope;
-  schemaVersion: number;
+declare const boundFailingCheckNames: ({
+  candidate,
+  checkType,
+  envelopes
+}: {
+  candidate: EvidenceCandidateIdentity;
+  checkType: EvidenceCheckType;
+  envelopes: LoadedEvidenceEnvelope[];
+}) => string[];
+interface RequiredCheckEvaluationInput {
+  authoringSessionIds: string[];
+  candidate: EvidenceCandidateIdentity;
+  envelopes: LoadedEvidenceEnvelope[];
+  requiredChecks: RequiredCheck[];
+  scopeContext: RequiredCheckScopeContext;
+}
+interface RequiredCheckOutcome {
+  name: string;
+  checkType: EvidenceCheckType;
+  status: "satisfied" | "unmet" | "out-of-scope";
+  scopeReason: string;
+  scope?: RequiredCheckScope;
+  reason?: string;
+  matchedPath?: string;
+}
+interface RequiredCheckEvaluation {
+  outcomes: RequiredCheckOutcome[];
+  blockingReasons: string[];
+}
+declare const evaluateRequiredChecks: ({
+  authoringSessionIds,
+  candidate,
+  envelopes,
+  requiredChecks,
+  scopeContext
+}: RequiredCheckEvaluationInput) => RequiredCheckEvaluation;
+declare const EVIDENCE_DIR = ".factory-memory/evidence";
+declare const loadEvidenceEnvelopes: (cwd: string) => LoadedEvidenceEnvelope[];
+//#endregion
+//#region src/review-proof-applicability.d.ts
+declare const REVIEW_STATUS_VALUES: readonly ["not-required", "current", "stale", "missing", "blocked"];
+declare const reviewStatusSchema: z.ZodEnum<{
+  "not-required": "not-required";
+  blocked: "blocked";
+  current: "current";
+  stale: "stale";
+  missing: "missing";
+}>;
+type ReviewStatus = z.infer<typeof reviewStatusSchema>;
+interface CurrentReviewIdentity {
+  headSha: string;
+  patchId: string;
+}
+declare const reviewStatus: ({
+  blocked,
+  required,
+  reviewedHeadSha,
+  reviewedPatchId,
+  headSha,
+  patchId
+}: CurrentReviewIdentity & {
+  blocked?: boolean;
+  required: boolean;
+  reviewedHeadSha?: string;
+  reviewedPatchId?: string;
+}) => ReviewStatus;
+declare namespace proof_identity_d_exports {
+  export { CurrentReviewIdentity, REVIEW_STATUS_VALUES, ReviewProofClaim, ReviewStatus, explicitFailureIdentity, isExplicitReviewFailure, isUntypedReviewProof, reviewStatus, reviewStatusSchema, selectReviewProof };
+}
+type ReviewProofClaim = {
+  reviewedHeadSha?: string;
+  reviewedPatchId?: string;
+  untypedVerdict?: boolean;
 } | {
-  disposition: "degraded";
-  raw: unknown;
-  schemaVersion: number | undefined;
+  explicitFailure: true;
+  reviewedHeadSha?: string;
+  reviewedPatchId?: string;
+  untypedVerdict?: boolean;
 };
-/**
- * Parses a candidate against the versioned validators. A recognized major is
- * validated typed-only (throws on an invalid known-version payload); an unknown
- * major is round-tripped RAW and marked degraded — the retained payload is the
- * exact input object, never a coerced projection. Mirrors the HQ ingest seam so
- * the two sides agree on the skew posture.
- */
-declare const parseRetroEnvelope: (candidate: unknown) => ParsedRetroEnvelope;
-/**
- * Whether harvest recorded at least one token family. This is an operator
- * summary predicate, not a delivery gate: a families-absent envelope remains
- * valid and replayable when its data gaps explain why telemetry is unavailable.
- */
-declare const isRetroEnvelopeWireComplete: (envelope: Pick<RetroEnvelope, "tokenFamilies">) => boolean;
-/** Epic anchor for an envelope: refs.epic, else refs.issue, else the PR. */
-declare const retroEpicReference: (refs: RetroEnvelope["refs"]) => string | undefined;
+declare const isExplicitReviewFailure: (proof: ReviewProofClaim) => proof is {
+  explicitFailure: true;
+  reviewedHeadSha?: string;
+  reviewedPatchId?: string;
+  untypedVerdict?: boolean;
+};
+declare const isUntypedReviewProof: (proof: ReviewProofClaim) => proof is {
+  untypedVerdict: true;
+  reviewedHeadSha?: string;
+  reviewedPatchId?: string;
+};
+declare const explicitFailureIdentity: (proof: ReviewProofClaim) => {
+  reviewedHeadSha?: string;
+  reviewedPatchId?: string;
+};
+declare const selectReviewProof: ({
+  reviewProof
+}: {
+  reviewProof: ReviewProofClaim;
+}) => {
+  reviewedHeadSha?: string;
+  reviewedPatchId?: string;
+  untypedVerdict?: boolean;
+};
+//#endregion
+//#region src/pr-readiness/review-epoch.d.ts
+interface ReviewCycleState {
+  autoBlockingFindings: number;
+  countsBySeverity: Record<ReviewFindingSeverity, number>;
+  highestBlockingSeverity?: ReviewFindingSeverity;
+  highestOpenSeverity?: ReviewFindingSeverity;
+  maxReviewCycles?: number;
+  nonBlockingFindings: number;
+  openFindings: number;
+  reviewCycle?: number;
+  staleRepeatFindings?: number;
+  windowExhausted: boolean;
+}
+declare const reviewCycleStateFor: (proof: Pick<PrReviewProof, "ladder" | "reviewCycle" | "maxReviewCycles" | "reviews">, policy?: ReviewLadderPolicy, adjudicatedLedger?: FindingLedgerEntry[]) => ReviewCycleState;
+type ReviewAcceptance = "accepted-after-cap" | "accepted-clean" | "accepted-through-ladder" | "blocked";
+declare const resolveReviewAcceptance: (proof: PrReviewProof, review: PrReviewResult, policy: ReviewLadderPolicy | undefined) => ReviewAcceptance;
+type ReviewTerminalState = "accepted-with-findings" | "blocked" | "clean";
+declare const resolveReviewTerminalStateForEpoch: (proof: PrReviewProof, review: PrReviewResult, epoch: ReviewEpochMode, adjudicatedLedger?: FindingLedgerEntry[]) => ReviewTerminalState;
+declare const resolveReviewTerminalState: (proof: PrReviewProof, review: PrReviewResult, policy: ReviewLadderPolicy | undefined) => ReviewTerminalState;
+declare const resolveReviewTerminalStateAcrossReviews: (proof: PrReviewProof, epoch: ReviewEpochMode, adjudicatedLedger?: FindingLedgerEntry[]) => ReviewTerminalState | undefined;
+declare const resolveReviewTerminalStateAcrossReviewsForPolicy: (proof: PrReviewProof, policy: ReviewLadderPolicy) => ReviewTerminalState | undefined;
+declare const reviewProofFor: (proof: PrReviewProof | undefined, kind: PrReviewKind, policy: ReviewLadderPolicy | undefined, current?: {
+  patchId: string;
+}) => ReviewProofClaim;
+declare namespace review_proof_d_exports {
+  export { DEFAULT_PR_REVIEW_MAX_CYCLES, DEFAULT_PR_REVIEW_PROOF_PATH, PR_REVIEW_FINAL_READINESS_NOTICE, PR_REVIEW_FINDING_PROVENANCE_VERSION, PR_REVIEW_PROOF_DESCRIPTOR, PR_REVIEW_SCHEMA_VERSION, PrReviewFinding, PrReviewKind, PrReviewLadderState, PrReviewMode, PrReviewOutcome, PrReviewProof, PrReviewResult, PrReviewStageResolution, REVIEW_SEVERITIES, ReviewAcceptance, ReviewCycleState, ReviewFindingCategory, ReviewFindingSeverity, ReviewTerminalState, prReviewFindingSchema, prReviewProofSchema, prReviewResultSchema, resolveReviewAcceptance, resolveReviewTerminalState, resolveReviewTerminalStateAcrossReviews, resolveReviewTerminalStateAcrossReviewsForPolicy, resolveReviewTerminalStateForEpoch, reviewCycleStateFor, reviewProofFor, validatePrReviewProof, validatePrReviewResult };
+}
+declare const PR_REVIEW_SCHEMA_VERSION = 2;
+declare const PR_REVIEW_FINDING_PROVENANCE_VERSION = 1;
+declare const DEFAULT_PR_REVIEW_PROOF_PATH = ".factory-memory/pr-review.json";
+declare const DEFAULT_PR_REVIEW_MAX_CYCLES = 5;
+declare const PR_REVIEW_FINAL_READINESS_NOTICE = "pr:review is a final readiness proof gate. Run it after local verification and avoid repeated full runs unless the review proof records actionable findings. Default review window: 5 cycles.";
+declare const prReviewFindingSchema: z.ZodType<PrReviewFinding>;
+declare const prReviewResultSchema: z.ZodType<PrReviewResult>;
+declare const prReviewProofSchema: z.ZodType<PrReviewProof>;
+declare const validatePrReviewResult: (value: unknown) => PrReviewResult;
+declare const validatePrReviewProof: (value: unknown) => PrReviewProof;
+declare const PR_REVIEW_PROOF_DESCRIPTOR: ProofDescriptor<PrReviewProof>;
 //#endregion
 //#region src/schemas.d.ts
 declare const boundaryCheckProofSchema: z.ZodObject<{
@@ -2328,28 +2830,46 @@ declare const boundaryCheckProofSchema: z.ZodObject<{
     value: z.ZodString;
   }, z.core.$strip>>;
   status: z.ZodEnum<{
-    blocked: "blocked";
     ready: "ready";
+    blocked: "blocked";
   }>;
 }, z.core.$strip>;
 type BoundaryCheckProofRecord = z.infer<typeof boundaryCheckProofSchema>;
 //#endregion
 //#region src/boundary-check.d.ts
-interface BoundaryPullRequestRef {
-  headRefOid?: string;
-  mergeCommitOid?: string;
-  number: number;
-  state: "OPEN" | "CLOSED" | "MERGED";
-}
 interface BoundaryCheckGithub {
   fetchIssueBody: (repo: string, issue: number) => string;
   fetchIssueComments: (repo: string, issue: number) => GithubIssueComment[];
   fetchClosingPullRequests: (repo: string, issue: number) => BoundaryPullRequestRef[];
-  fetchPullRequest: (repo: string, pr: number) => BoundaryPullRequestRef;
+  fetchPullRequest?: (repo: string, pr: number) => BoundaryPullRequestRef;
+  /**
+   * Child issue state for the close-gate (#901). Required so a stub cannot
+   * skip the gate and look like a pass.
+   */
+  fetchIssueState: (repo: string, issue: number) => "OPEN" | "CLOSED";
+  /**
+   * PRs whose bodies may contribute closing-keyword membership (#901). For
+   * `each-to-epic`, production lists PRs targeting the integration branch.
+   * Branch targeting never joins; only a keyword naming a declared child does.
+   * Required so omitting the channel cannot silently drop it.
+   */
+  listCandidatePullRequests: (repo: string, input: {
+    integrationBranch?: string;
+  }) => (BoundaryPullRequestRef & {
+    body?: string;
+  })[];
 }
 interface BoundaryCheckArgs {
   cwd?: string;
   epic: number;
+  /**
+   * Closeout-final mode (#853): a manifest-declared issue whose closing-PR
+   * set is empty is a blocking reason, not a notice. Off by default so the
+   * interior boundary review (run before the terminal release PR exists,
+   * e.g. epic #842's own review of #844) keeps working; the epic closeout
+   * step turns this on as the last check before factory:closeout.
+   */
+  final?: boolean;
   json?: boolean;
   output?: string;
   repo?: string;
@@ -2357,12 +2877,13 @@ interface BoundaryCheckArgs {
 interface BoundaryCheckDependencies {
   github?: BoundaryCheckGithub;
   hq?: HqIngestDependencies;
+  readWaivers?: (cwd: string) => DemandWaiver[];
   resolveRepo?: (cwd: string) => string;
 }
 declare function runBoundaryCheck(args: BoundaryCheckArgs, dependencies?: BoundaryCheckDependencies): BoundaryCheckProofRecord;
 declare function validateBoundaryCheckProof(value: unknown): BoundaryCheckProofRecord;
 //#endregion
-//#region src/commands/doctor.d.ts
+//#region src/cli-output.d.ts
 interface CliOutput {
   stderr: Pick<NodeJS.WriteStream, "write">;
   stdout: Pick<NodeJS.WriteStream, "write">;
@@ -2410,32 +2931,6 @@ declare const runDemandWaive: (args: DemandWaiveArgs, dependencies?: DemandWaive
 //#region src/commands/demand-waive.d.ts
 type DemandWaiveAction = (args: DemandWaiveArgs) => DemandWaiver;
 //#endregion
-//#region src/hq-credentials.d.ts
-/**
- * Why a reference did not resolve. Each value names a different remedy, and
- * none of them can be inferred from a value-or-nothing result:
- *
- * - `resolver-missing` — no secret-manager binary on PATH.
- * - `resolver-blocked` — a binary exists but this session may not execute it
- *   (a sandbox denying exec). The command belongs outside the sandbox.
- * - `resolver-timeout` — the probe expired: a desktop agent waiting on an
- *   approval nobody can give here.
- * - `resolver-refused` — the binary ran and produced no value. Its store is
- *   unreachable from this session (a sandbox with no keychain access) or the
- *   reference is not readable. These two stay one status on purpose: telling
- *   them apart would mean reading resolver output.
- */
-type SecretResolutionFailure = "resolver-blocked" | "resolver-missing" | "resolver-refused" | "resolver-timeout";
-/** A structured resolution outcome. The value travels only when resolved. */
-type SecretResolution = {
-  status: "resolved";
-  value: string;
-} | {
-  status: SecretResolutionFailure;
-};
-/** Resolves a secret reference. Injected so tests stay offline. */
-type SecretReferenceResolver = (reference: string) => SecretResolution;
-//#endregion
 //#region src/hq-flush.d.ts
 /**
  * Spool locations this run did not drain because they sit under an earlier
@@ -2459,12 +2954,34 @@ type HqFlushResult = (HqFlushOrphans & {
   status: "flushed";
 });
 //#endregion
+//#region src/catch-up-recognition.d.ts
+type CatchUpRecognitionResult = {
+  recognition: CatchUpRecognition;
+  recognized: true;
+} | {
+  reasons: string[];
+  recognized: false;
+};
+type CatchUpRecognizer = (input: {
+  base: string;
+  cwd: string;
+}) => CatchUpRecognitionResult;
+//#endregion
 //#region src/pr-review.d.ts
 interface PrReviewArgs extends LoadProjectProfileInput {
+  assemble?: boolean;
   base: string;
   cycle: number;
+  /**
+   * Issue carrying the factory-boundary manifest, which may be the work issue
+   * itself. `--assemble` uses it to name the review rung the candidate's wave
+   * demands, so the prompt asks for the findings schema the gate accepts
+   * (#1001). It is the same handle `pr:publish` and `pr:ready` take.
+   */
+  epic?: number;
   dispositions?: string;
   findings?: string;
+  historical?: boolean;
   issue?: number;
   mode: PrReviewMode;
   output?: string;
@@ -2472,15 +2989,52 @@ interface PrReviewArgs extends LoadProjectProfileInput {
 }
 interface PrReviewGitDependencies {
   changedFiles: (cwd: string, base: string) => string[];
+  checkoutRepository?: (cwd: string) => CheckoutRepository;
   currentHeadSha: (cwd: string) => string;
+  firstParentCommits?: (cwd: string, base: string) => string[];
   isAncestor: (cwd: string, ancestor: string, descendant: string) => boolean;
+  recognizeCatchUp?: CatchUpRecognizer;
+  repositoryRoot?: (cwd: string) => string;
+  showFileAtRef?: (cwd: string, ref: string, absolutePath: string) => string | undefined;
   stablePatchId: (cwd: string, base: string) => string;
+  stablePatchIdAtRef?: (cwd: string, base: string, ref: string) => string;
   statusPorcelain: (cwd: string) => string;
 }
+interface PrReviewIssueBodyInput {
+  issue: number;
+  owner: string;
+  repo: string;
+}
 interface PrReviewDependencies {
+  /**
+   * The authoritative base-policy reader (#922). Injectable for the same
+   * reason `pr:ready` injects it: an unstated authority must be a refusal a
+   * test can state, never a silent pass.
+   */
+  basePolicy?: BaseReviewPolicyAuthority;
+  /**
+   * How the wave resolver reads an issue's closing pull requests (#1001).
+   * Injected for the same reason `fetchIssueBody` is: the wave demand must be
+   * statable in a test without a live repository.
+   */
+  fetchClosingPullRequests?: (input: PrReviewIssueBodyInput) => {
+    number: number;
+    state?: "OPEN" | "CLOSED" | "MERGED";
+  }[];
+  fetchIssueBody?: (input: PrReviewIssueBodyInput) => string;
+  /**
+   * How `--assemble` reads the pull request whose wave demand names the review
+   * rung (#1001). Defaults to the GitHub lookup, and its result is validated
+   * before use, so an injected stub is held to the same shape.
+   */
+  fetchWavePullRequest?: (cwd: string) => unknown;
   git?: PrReviewGitDependencies;
   hq?: HqIngestDependencies;
-  publishCheckRun?: (input: PublishFactoryCheckInput) => void;
+  /**
+   * How this run finds the pull request whose base ref is the policy authority
+   * (#922 Slice B). Defaults to the GitHub lookup.
+   */
+  lookupPullRequest?: (cwd: string) => CandidatePullRequestLookup;
 }
 declare function runPrReview(args: PrReviewArgs, dependencies?: PrReviewDependencies): Promise<PrReviewProof>;
 //#endregion
@@ -2493,7 +3047,7 @@ interface CleanInstallResolutionDependencies {
 }
 //#endregion
 //#region src/pr-verify.d.ts
-type PrVerifyMode = "auto" | "docs-only" | "trivial" | "full";
+type PrVerifyMode = "auto" | "docs-only" | "full";
 interface VerificationCommandOutcome {
   counts?: {
     testFiles?: number;
@@ -2501,6 +3055,8 @@ interface VerificationCommandOutcome {
   };
   durationMs: number;
   exitCode: number;
+  /** The failing tests scraped from this command's output (#1035). */
+  failures?: PrVerifyTestFailure[];
 }
 interface PrVerifyArgs extends LoadProjectProfileInput {
   authoringSession?: string;
@@ -2511,16 +3067,30 @@ interface PrVerifyArgs extends LoadProjectProfileInput {
 }
 interface PrVerifyGitDependencies {
   changedFiles: (cwd: string, base: string) => string[];
+  checkoutRepository?: (cwd: string) => CheckoutRepository;
   currentHeadSha: (cwd: string) => string;
   emptyTreeHash: (cwd: string) => string;
   mergeBaseSha: (cwd: string, base: string) => string;
+  recognizeCatchUp?: CatchUpRecognizer;
   runVerificationCommand: (command: string, cwd: string, env: Record<string, string>) => VerificationCommandOutcome;
   showFileAtRef?: (cwd: string, ref: string, absolutePath: string) => string | undefined;
   statusPorcelain: (cwd: string) => string;
   stablePatchId: (cwd: string, base: string) => string;
 }
 interface PrVerifyDependencies {
+  /**
+   * The authoritative base-policy reader (#922). Injectable for the same
+   * reason `pr:ready` injects it: an unstated authority must be a refusal a
+   * test can state, never a silent pass.
+   */
+  basePolicy?: BaseReviewPolicyAuthority;
   cleanInstall?: CleanInstallResolutionDependencies | false;
+  /**
+   * How this run finds the pull request whose base ref is the policy authority
+   * (#922 Slice B). Defaults to the GitHub lookup; a checkout with no pull
+   * request resolves `unavailable`, which is normal before publication.
+   */
+  lookupPullRequest?: (cwd: string) => CandidatePullRequestLookup;
   env?: NodeJS.ProcessEnv;
   git?: PrVerifyGitDependencies;
   hq?: HqIngestDependencies;
@@ -2623,6 +3193,12 @@ interface PrPublishDependencies extends PrReadyDependencies {
     cwd: string;
   }) => Promise<HqFlushResult>;
   runPrVerify?: (args: PrVerifyArgs) => Promise<PrVerifyProof>;
+  /**
+   * Injectable clock for the promotion instant the hosted-run await measures
+   * `verify` staleness against (#1045; tests only — production reads the real
+   * clock).
+   */
+  now?: () => Date;
   /**
    * Injectable delay for the bounded hosted-run await (#348; tests only —
    * production always waits the real interval).
@@ -2702,6 +3278,28 @@ type PrReadyAction = (args: PrReadyArgs) => Promise<unknown>;
 //#region src/commands/pr-review.d.ts
 type PrReviewAction = (args: PrReviewArgs) => Promise<unknown>;
 //#endregion
+//#region src/pr-status-hud-command.d.ts
+interface PrStatusHudArgs {
+  readonly cwd: string;
+  readonly headSha: string;
+  /**
+   * Contents-read token for the preview-proof inventory list and the live
+   * git-ref tip. The App token has no contents permission, so the workflow
+   * `GITHUB_TOKEN` serves those reads (#825, #908).
+   */
+  readonly inventoryToken?: string;
+  readonly owner: string;
+  readonly planPath?: string;
+  readonly pr: number;
+  readonly repo: string;
+  readonly token: string;
+}
+type PrStatusHudAction = (args: PrStatusHudArgs) => Promise<{
+  action: string;
+  commentId: number;
+  url: string;
+}>;
+//#endregion
 //#region src/packages/trace/implementation/core.d.ts
 declare const FactoryTraceEnvelopeCoreSchema: z.ZodObject<{
   createdAt: z.ZodString;
@@ -2846,6 +3444,7 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
   patchId: z.ZodString;
   reason: z.ZodEnum<{
     "no-applicable-mode": "no-applicable-mode";
+    "faithful-merge": "faithful-merge";
   }>;
   reviewCycle: z.ZodNumber;
 }, z.core.$strict>, readonly [z.ZodObject<{
@@ -2868,6 +3467,7 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
   patchId: z.ZodString;
   reason: z.ZodEnum<{
     "no-applicable-mode": "no-applicable-mode";
+    "faithful-merge": "faithful-merge";
   }>;
   reviewCycle: z.ZodNumber;
 }, z.core.$strict>], {
@@ -2881,6 +3481,7 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
     patchId: z.ZodString;
     reason: z.ZodEnum<{
       "no-applicable-mode": "no-applicable-mode";
+      "faithful-merge": "faithful-merge";
     }>;
     reviewCycle: z.ZodNumber;
   }, z.core.$strict>;
@@ -2898,7 +3499,7 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
   observedAt: string;
   outcome: "not-required";
   patchId: string;
-  reason: "no-applicable-mode";
+  reason: "no-applicable-mode" | "faithful-merge";
   reviewCycle: number;
   issue?: number | undefined;
   pr?: number | undefined;
@@ -2949,8 +3550,8 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
     sessionId: z.ZodOptional<z.ZodString>;
   }, z.core.$strict>>;
   stage: z.ZodEnum<{
-    gate: "gate";
     interior: "interior";
+    gate: "gate";
   }>;
   usage: z.ZodOptional<z.ZodObject<{
     estimatedCostUsd: z.ZodOptional<z.ZodNumber>;
@@ -3002,8 +3603,8 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
     sessionId: z.ZodOptional<z.ZodString>;
   }, z.core.$strict>>;
   stage: z.ZodEnum<{
-    gate: "gate";
     interior: "interior";
+    gate: "gate";
   }>;
   usage: z.ZodOptional<z.ZodObject<{
     estimatedCostUsd: z.ZodOptional<z.ZodNumber>;
@@ -3046,8 +3647,8 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
       sessionId: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>>;
     stage: z.ZodEnum<{
-      gate: "gate";
       interior: "interior";
+      gate: "gate";
     }>;
     usage: z.ZodOptional<z.ZodObject<{
       estimatedCostUsd: z.ZodOptional<z.ZodNumber>;
@@ -3077,7 +3678,7 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
     staleRepeats: number;
   };
   observedAt: string;
-  stage: "gate" | "interior";
+  stage: "interior" | "gate";
   issue?: number | undefined;
   pr?: number | undefined;
   threadId?: string | undefined;
@@ -3699,74 +4300,6 @@ declare const scanFactoryTraceDiagnostics: ({
   repoRoot,
   to
 }: ScanFactoryTraceDiagnosticsOptions) => FactoryTraceDiagnostic[];
-//#endregion
-//#region src/interior-telemetry/gate-timing.d.ts
-declare const GATE_TIMING_SCHEMA_VERSION = 1;
-type FactoryGateName = "boundary:check" | "factory:closeout" | "pr:ready" | "pr:review" | "pr:verify";
-type GateTimingOutcome = "fail" | "pass";
-interface GateTimingRecord {
-  agentRunId: string;
-  cycle: number;
-  durationMs: number;
-  gate: FactoryGateName;
-  outcome: GateTimingOutcome;
-  schemaVersion: typeof GATE_TIMING_SCHEMA_VERSION;
-  startedAt: string;
-  startOffsetMs: number;
-}
-//#endregion
-//#region src/retro-envelope-builder.d.ts
-/**
- * Folds a lane's gate-timing ledger (`.factory-memory/gate-timing/<id>.jsonl`,
- * wave-1 PR #33) into a versioned retro envelope at `factory:closeout`.
- *
- * STRUCTURAL INVARIANT (#677 repeat-class rule; PR #35 review cycles 1-2):
- * telemetry CONTENT can never fail the closeout build gate. Every value that
- * reaches the envelope passes through one sanitization seam that makes the
- * output valid BY CONSTRUCTION:
- *
- * - strings are clamped to their wire bounds (truncated, with a data gap when
- *   truncation lost information);
- * - numbers must be finite and within plausibility bounds BEFORE any derived
- *   arithmetic; an absurd value (1e16 ms duration, year-9999 timestamp) SKIPS
- *   its record with a data gap rather than clamping, because clamping would
- *   assert a measurement that never happened;
- * - arrays are bounded to their schema maxima (gates[] keeps the most recent);
- * - derived computations (wall clock, cycles) consume only sanitized inputs,
- *   so no ledger content can push them outside Date/Number safe ranges.
- *
- * Terminal backstop: the assembled candidate goes through a final schema
- * parse; if that still fails, a minimal-valid envelope (clamped identity,
- * empty gates, a data gap naming the failure) is built and returned instead.
- * `buildRetroEnvelope` therefore never throws for content — the closeout gate
- * can only fail on filesystem errors when persisting.
- */
-interface BuildRetroEnvelopeInput {
-  agentRunId: string;
-  /** Optional pointer (key/URL) to #8's durable proof archive — never payload. */
-  archiveRef?: string;
-  dataGaps?: string[];
-  generatedAt: Date;
-  interventions?: number;
-  /** Per-family session identities the lane already records. */
-  joinKeys?: {
-    claudeSessionIds?: string[];
-    codexThreadIds?: string[];
-  };
-  /** The lane's gate-timing ledger records, in append order. */
-  ledger: GateTimingRecord[];
-  outcome?: RetroEnvelope["outcome"];
-  phases?: RetroEnvelope["phases"];
-  refs: RetroEnvelope["refs"];
-  repo: RetroEnvelope["repo"];
-  /**
-   * Token families. They may be absent when native session data is unavailable
-   * (valid does not imply available telemetry). When present they satisfy the
-   * family invariants.
-   */
-  tokenFamilies?: RetroEnvelope["tokenFamilies"];
-}
-declare const buildRetroEnvelope: (input: BuildRetroEnvelopeInput) => RetroEnvelope;
 declare namespace comment_provenance_d_exports {
   export { SHA_MATCH_MIN_LENGTH, isBotLogin, sameHeadSha };
 }
@@ -3776,18 +4309,12 @@ declare const sameHeadSha: (left: string, right: string) => boolean;
 //#endregion
 //#region src/doctor-hq-checks.d.ts
 /**
- * Two `doctor` checks that make silent HQ delivery failure loud (#394,
- * epic #389 wave 2).
- *
- * Both consume #414's structured credential resolution rather than inventing
- * a second classification: a sandboxed session that cannot reach the
- * keychain is reported as "cannot resolve credentials here", never as
- * "credentials are wrong" or a silent pass. Both name `psf hq:flush` and
- * `psf pr:publish` as the commands that need a trusted local session.
+ * The `doctor` check that makes silent HQ delivery failure loud (#394,
+ * epic #389 wave 2): the local spool is empty, and no stranded evidence is
+ * waiting under the spool root.
  *
- * Advisory stays advisory: neither check can block anything but doctor's own
- * exit status (epic #389 design decision 4). Absent credentials make the
- * remote check a skip with a printed reason, never a silent pass.
+ * Advisory stays advisory: this check can block nothing but doctor's own exit
+ * status (epic #389 design decision 4).
  */
 type DoctorCheckStatus = "error" | "ok" | "warning";
 interface DoctorCheck {
@@ -3799,12 +4326,6 @@ interface HqSpoolCheckDependencies {
   countSpool?: typeof countHqSpoolWork;
   sweepOrphans?: typeof sweepHqSpoolOrphans;
 }
-interface HqRetroReadbackCheckDependencies {
-  fetch?: typeof fetch;
-  readFile?: typeof readFile;
-  resolve?: SecretReferenceResolver;
-  timeoutMs?: number;
-}
 //#endregion
 //#region src/doctor.d.ts
 interface DoctorReport {
@@ -3823,8 +4344,6 @@ interface DoctorProjectProfileInput extends LoadProjectProfileInput {
   base?: string;
   env?: NodeJS.ProcessEnv;
   /** Test seam for the local HQ spool check (#394); production never sets this. */
-  hqRetroReadbackDependencies?: HqRetroReadbackCheckDependencies;
-  /** Test seam for the remote HQ retro-envelope read-back check (#394). */
   hqSpoolDependencies?: HqSpoolCheckDependencies;
   /**
    * Append the read-only admission checklist (#292): every requirement this
@@ -3913,98 +4432,6 @@ declare const renderPrBodySections: ({
   reviewProof?: PrReviewProof;
   verifyProof?: PrVerifyProof;
 }) => string;
-declare namespace boundary_manifest_d_exports {
-  export { BOUNDARY_CLOSEOUT_DEFAULT_RUNG, BOUNDARY_MANIFEST_SCHEMA_VERSION, BoundaryManifest, BoundaryManifestExtraction, BoundaryManifestParse, FACTORY_BOUNDARY_FENCE_LANG, boundaryManifestSchema, closeoutRungFor, extractBoundaryManifestBlock, manifestContentHash, parseBoundaryManifest, rungMeetsMinimum, specContentHash };
-}
-declare const FACTORY_BOUNDARY_FENCE_LANG = "factory-boundary";
-declare const BOUNDARY_MANIFEST_SCHEMA_VERSION = 1;
-declare const BOUNDARY_CLOSEOUT_DEFAULT_RUNG: EvidenceReviewRung;
-declare const rungMeetsMinimum: (rung: EvidenceReviewRung, minimum: EvidenceReviewRung) => boolean;
-declare const boundaryManifestBaseSchema: z.ZodObject<{
-  boundary: z.ZodString;
-  closeout: z.ZodOptional<z.ZodObject<{
-    review: z.ZodEnum<{
-      oracle: "oracle";
-      "independent-model": "independent-model";
-      human: "human";
-    }>;
-  }, z.core.$loose>>;
-  declaredBy: z.ZodString;
-  prs: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-  schemaVersion: z.ZodLiteral<1>;
-  topology: z.ZodEnum<{
-    flagged: "flagged";
-    "each-to-main": "each-to-main";
-    stacked: "stacked";
-  }>;
-  waves: z.ZodArray<z.ZodObject<{
-    autoMerge: z.ZodOptional<z.ZodBoolean>;
-    issues: z.ZodArray<z.ZodNumber>;
-    name: z.ZodString;
-    review: z.ZodEnum<{
-      oracle: "oracle";
-      "independent-model": "independent-model";
-      human: "human";
-    }>;
-  }, z.core.$loose>>;
-}, z.core.$loose>;
-declare const boundaryManifestSchema: z.ZodObject<{
-  boundary: z.ZodString;
-  closeout: z.ZodOptional<z.ZodObject<{
-    review: z.ZodEnum<{
-      oracle: "oracle";
-      "independent-model": "independent-model";
-      human: "human";
-    }>;
-  }, z.core.$loose>>;
-  declaredBy: z.ZodString;
-  prs: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-  schemaVersion: z.ZodLiteral<1>;
-  topology: z.ZodEnum<{
-    flagged: "flagged";
-    "each-to-main": "each-to-main";
-    stacked: "stacked";
-  }>;
-  waves: z.ZodArray<z.ZodObject<{
-    autoMerge: z.ZodOptional<z.ZodBoolean>;
-    issues: z.ZodArray<z.ZodNumber>;
-    name: z.ZodString;
-    review: z.ZodEnum<{
-      oracle: "oracle";
-      "independent-model": "independent-model";
-      human: "human";
-    }>;
-  }, z.core.$loose>>;
-}, z.core.$loose>;
-type BoundaryManifest = z.infer<typeof boundaryManifestBaseSchema>;
-type BoundaryManifestExtraction = {
-  ok: true;
-  blockText: string;
-} | {
-  ok: false;
-  error: string;
-};
-declare const extractBoundaryManifestBlock: (issueBody: string) => BoundaryManifestExtraction;
-declare const manifestContentHash: (blockText: string) => string;
-declare const specContentHash: (issueBody: string) => string;
-type BoundaryManifestParse = {
-  ok: true;
-  manifest: BoundaryManifest;
-  manifestHash: string;
-} | {
-  ok: false;
-  error: string;
-};
-declare const parseBoundaryManifest: (issueBody: string) => BoundaryManifestParse;
-declare const closeoutRungFor: (manifest: BoundaryManifest) => EvidenceReviewRung;
-//#endregion
-//#region src/demand-resolution.d.ts
-/** The boundary-manifest wave demand that applies to one pull request. */
-interface WaveReviewDemand {
-  autoMerge: boolean;
-  review: EvidenceReviewRung;
-  wave: string;
-}
 declare namespace readiness_evaluation_d_exports {
   export { CORRECTNESS_UNTYPED_REVIEW_BLOCKER_REASON, DRAFT_BLOCKER_REASON, EvaluationInput, ManagedReadinessLedger, PENDING_CHECKS_BLOCKER_REASON_PREFIX, READINESS_REPAIR_CODES, ReadinessRepair, ReadinessStatus, SCHEMA_VERSION, SECURITY_UNTYPED_REVIEW_BLOCKER_REASON, evaluateReadiness, managedReadinessLedgerSchema, readinessExitCode, readinessRepairSchema, validateManagedReadinessLedger };
 }
@@ -4031,6 +4458,13 @@ interface EvaluationInput {
   mergeStateStatus: string;
   ladderPolicy?: ReviewLadderPolicy;
   reviewModes?: PrReviewKind[];
+  /**
+   * Cross-stage policy-identity refusals resolved at the command boundary
+   * (#922 Slice B), already worded. Evaluation only decides whether they are
+   * in force: a recognized catch-up withdraws every review demand, so it
+   * withdraws these with them.
+   */
+  policyIdentityRefusals?: string[];
   reviewProof?: PrReviewProof;
   verificationProof?: VerificationProofState;
   docsOnlyVerifyBaselineHeadShas?: string[];
@@ -4056,7 +4490,7 @@ declare const evaluateReadiness: (input: EvaluationInput) => {
   ledger: {
     baseSha: string;
     blockingReasons: string[];
-    classification: "trivial" | "docs/process-only" | "non-trivial";
+    classification: "docs/process-only" | "trivial" | "non-trivial";
     github: {
       draft: boolean;
       mergeStateStatus: string;
@@ -4076,36 +4510,48 @@ declare const evaluateReadiness: (input: EvaluationInput) => {
     reviews: {
       correctness: {
         required: boolean;
-        status: "blocked" | "stale" | "not-required" | "current" | "missing";
+        status: "not-required" | "blocked" | "current" | "stale" | "missing";
         reviewedHeadSha?: string | undefined;
         reviewedPatchId?: string | undefined;
       };
       security?: {
         required: boolean;
-        status: "blocked" | "stale" | "not-required" | "current" | "missing";
+        status: "not-required" | "blocked" | "current" | "stale" | "missing";
         reviewedHeadSha?: string | undefined;
         reviewedPatchId?: string | undefined;
       } | undefined;
     };
-    schemaVersion: 1;
+    schemaVersion: 2;
     verification: {
       command: "patronage-factory pr:verify";
-      prVerify: "stale" | "passed" | "missing";
-      docsOnlyDeltaAccepted?: boolean | undefined;
-      docsOnlyVerifiedHeadSha?: string | undefined;
-      trivialDeltaAccepted?: boolean | undefined;
-      trivialVerifiedHeadSha?: string | undefined;
+      prVerify: "missing";
+    } | {
+      command: "patronage-factory pr:verify";
+      prVerify: "stale";
+      verifiedHeadSha: string;
+    } | {
+      command: "patronage-factory pr:verify";
+      prVerify: "passed-via-head";
+      verifiedHeadSha: string;
+    } | {
+      command: "patronage-factory pr:verify";
+      docsOnlyVerifiedHeadSha: string;
+      prVerify: "docs-only-delta";
+      verifiedHeadSha?: string | undefined;
+    } | {
+      command: "patronage-factory pr:verify";
+      prVerify: "trivial-delta";
+      trivialVerifiedHeadSha: string;
       verifiedHeadSha?: string | undefined;
     };
     externalChecks?: {
       checkType: "review" | "verify";
-      inScope: boolean;
       name: string;
       scopeReason: string;
       status: "satisfied" | "unmet" | "out-of-scope";
       reason?: string | undefined;
       scope?: {
-        classifications: ("trivial" | "docs/process-only" | "non-trivial")[];
+        classifications: ("docs/process-only" | "trivial" | "non-trivial")[];
       } | undefined;
     }[] | undefined;
     mergeBaseSha?: string | undefined;
@@ -4132,8 +4578,8 @@ declare const evaluateReadiness: (input: EvaluationInput) => {
         gate: number;
         interior: number;
       };
-      nextAction: "run-gate-cycle" | "accept-nonblocking-findings" | "escalate-to-triage" | "ready-for-human" | "advance-to-gate" | "run-interior-cycle";
-      stage: "gate" | "interior" | "interior-complete";
+      nextAction: "run-interior-cycle" | "advance-to-gate" | "run-gate-cycle" | "accept-nonblocking-findings" | "escalate-to-triage" | "ready-for-human";
+      stage: "interior" | "gate" | "interior-complete";
       forcedTransition?: "gate-cap-exhausted" | "interior-cap-reached" | undefined;
     } | undefined;
     reviewRuns?: PrReviewResult[] | undefined;
@@ -4390,12 +4836,21 @@ declare const reviewFocusFromIssueBody: (body: string) => string | undefined;
 interface AssembleReviewPromptInput {
   base: string;
   changedFiles: string[];
+  cwd?: string;
   headSha: string;
   issueFocus?: IssueReviewFocus;
   kind: PrReviewKind;
   patchId: string;
   priorLedgerEntries?: FindingLedgerEntry[];
   profile: FactoryProjectProfile;
+  waveRung?: EvidenceReviewRung;
+}
+interface AssembleReviewPromptGitDependencies {
+  repositoryRoot: (cwd: string) => string;
+  showFileAtRef: (cwd: string, ref: string, absolutePath: string) => string | undefined;
+}
+interface AssembleReviewPromptDependencies {
+  git?: AssembleReviewPromptGitDependencies;
 }
 interface AssembledReviewPrompt {
   prompt: string;
@@ -4404,59 +4859,43 @@ interface AssembledReviewPrompt {
 declare const assembleReviewPrompt: ({
   base,
   changedFiles,
+  cwd,
   headSha,
   issueFocus,
   kind,
   patchId,
   priorLedgerEntries,
-  profile
-}: AssembleReviewPromptInput) => AssembledReviewPrompt;
+  profile,
+  waveRung
+}: AssembleReviewPromptInput, dependencies?: AssembleReviewPromptDependencies) => AssembledReviewPrompt;
 //#endregion
-//#region src/review-ladder-trace.d.ts
-interface ReviewLadderTraceIdentity {
-  issue?: number;
-  pr?: number;
-  repo: string;
-  threadId?: string;
-  workerId?: string;
-}
-interface ReviewLadderStageTraceWriteResult {
-  errorMessage?: string;
-  filePath?: string;
-  mirrorDiagnostics: TraceMirrorDiagnostic[];
-  ok: boolean;
-}
-declare const buildReviewLadderStageTraceEvent: ({
-  createdAt,
-  event,
-  headSha,
-  identity,
-  patchId
-}: {
-  createdAt?: string;
-  event: ReviewLadderStageEvent;
-  headSha?: string;
-  identity: ReviewLadderTraceIdentity;
-  patchId?: string;
-}) => FactoryTraceEvent;
-declare const appendReviewLadderStageTraceEvent: ({
-  createdAt,
-  event,
-  headSha,
-  identity,
-  mirror,
-  patchId,
-  repoRoot
-}: {
-  createdAt?: string;
-  event: ReviewLadderStageEvent;
-  headSha?: string;
-  identity: ReviewLadderTraceIdentity;
-  mirror?: TraceSink;
-  patchId?: string;
-  repoRoot: string;
-}) => AppendFactoryTraceEventResult;
-declare const tryAppendReviewLadderStageTraceEvent: (input: Parameters<typeof appendReviewLadderStageTraceEvent>[0]) => ReviewLadderStageTraceWriteResult;
+//#region src/verification-run-context.d.ts
+declare const FACTORY_BASE_REF_ENV = "FACTORY_BASE_REF";
+declare const FACTORY_CHANGED_FILES_ENV = "FACTORY_CHANGED_FILES";
+declare const FACTORY_CHANGED_FILES_FILE_ENV = "FACTORY_CHANGED_FILES_FILE";
+declare const EMPTY_TREE_OBJECT_HASH = "4b825dc642cb6eb9a060e54bf8d69288fbee4904";
+declare const DEFAULT_ROOT_SHARED_GLOBS: string[];
+interface VerificationRunContextInput {
+  baseRef: string;
+  changedFiles: string[];
+  fullSuiteBaseRef?: string;
+  rootSharedGlobs?: string[];
+  inlineLimitBytes?: number;
+  tmpDir?: string;
+}
+interface VerificationEnv {
+  env: Record<string, string>;
+  cleanup: () => void;
+}
+interface VerificationRunContext {
+  readonly baseRef: string;
+  readonly changedFiles: string[];
+  readonly forcesFullSuite: boolean;
+  readonly fullSuiteReasons: string[];
+  buildEnv: () => VerificationEnv;
+  runSummaryLines: () => string[];
+}
+declare function createVerificationRunContext(input: VerificationRunContextInput): VerificationRunContext;
 //#endregion
 //#region src/verification-battery.d.ts
 type BatteryDisposition = "executed" | "not-required";
@@ -4535,92 +4974,6 @@ declare const planVerificationBattery: <Command extends BatteryCandidateCommand>
 /** Console lines naming every withheld command and why. Never silent. */
 declare const batteryScopeSummaryLines: (plan: VerificationBatteryPlan<BatteryCandidateCommand>) => string[];
 //#endregion
-//#region src/preview-lifecycle.d.ts
-type PreviewDisposition = "deploy" | "not-required";
-interface PreviewTargetPlan {
-  basis: string;
-  disposition: PreviewDisposition;
-  name: string;
-}
-interface PreviewLifecyclePlan {
-  /** The declared preview stacks to deploy, in declaration order. */
-  deploy: string[];
-  /** The withheld stacks, in declaration order. */
-  notRequired: PreviewTargetPlan[];
-  /** Whether a trusted, identity-bound stamp was available at all. */
-  stampTrusted: boolean;
-  /** Every declared preview target with its disposition, in declaration order. */
-  targets: PreviewTargetPlan[];
-}
-/**
- * Structural subset of the profile: the impact declarations plus the external
- * demand list. Structural rather than a `Pick` so this module does not import
- * `profile.ts`.
- */
-interface PreviewLifecycleProfile {
-  impact?: {
-    targets: {
-      name: string;
-    }[];
-  };
-  requiredChecks?: {
-    name: string;
-  }[];
-}
-/**
- * The declared preview stacks: impact targets that are ALSO declared required
- * checks — i.e. targets whose proof is produced externally, which is exactly
- * what a preview producer is.
- *
- * Deriving the list from the two existing declarations rather than adding a
- * third is what makes lifecycle and demand unable to disagree: the stacks this
- * plan can withhold are precisely the demands wave 2 can release, so a stack
- * can never be skipped while its proof stays demanded.
- */
-declare const previewLifecycleTargets: (profile: PreviewLifecycleProfile) => string[];
-/**
- * Plan the preview lifecycle for one candidate.
- *
- * Trust is resolved here through the SAME identity gate demand release uses
- * (`trustedImpactStamp`): the proof must have passed and must bind both the
- * candidate's headSha and its patchId. A stale, aborted, absent, or
- * differently-bound proof yields no stamp, and every declared stack is planned
- * for deploy. Total over its INPUTS — no proof, stamp, or profile can make it
- * throw. A malformed CALL is the deliberate exception: omitting
- * `vetoedTargets` is API misuse, not data doubt, and throws.
- */
-declare const planPreviewLifecycle: ({
-  candidate,
-  profile,
-  proof,
-  vetoedTargets
-}: {
-  candidate: {
-    headSha: string;
-    patchId: string;
-  };
-  profile: PreviewLifecycleProfile;
-  proof: PrVerifyProof | undefined;
-  /**
-   * Stack names with a current, candidate-bound FAILING envelope. Scoping is
-   * withheld for these whatever the stamp says — the same veto demand release
-   * applies, and for the same reason: a withheld stack is a stack that can
-   * never re-emit the envelope its standing demand needs. Callers hold the
-   * checkout context, so they resolve the set with `boundFailingCheckNames`
-   * and pass it in; this module stays pure.
-   *
-   * REQUIRED, with no default, on purpose: a defaulted `[]` reads the same
-   * whether the caller inspected the envelopes or never looked, and this seam
-   * exists precisely for EXTERNAL preview producers — the callers most likely
-   * to skip the lookup. Pass the result of `boundFailingCheckNames`; pass `[]`
-   * only to mean "inspected the envelopes and found no bound failure".
-   *
-   * Deliberately visible to `api:check` as a breaking signature change
-   * (pre-1.0, no external callers yet).
-   */
-  vetoedTargets: readonly string[];
-}) => PreviewLifecyclePlan;
-//#endregion
 //#region src/worker-checkout-guard.d.ts
 type CheckoutDirsProbe = (cwd: string) => {
   gitCommonDir: string;
@@ -4647,11 +5000,18 @@ interface CreateProgramOptions {
     prPublish?: PrPublishAction;
     prReady?: PrReadyAction;
     prReview?: PrReviewAction;
+    prStatusHud?: PrStatusHudAction;
   };
   factoryCliInvocation?: FactoryCliInvocation;
   output?: CliOutput;
 }
 declare function createProgram(options?: CreateProgramOptions): Command;
-declare function run(argv?: string[]): Promise<void>;
+/**
+ * Parse `argv` and run the matching command. `cliEntry` is the path of the
+ * runnable bin module, which follow-up commands spawn; the bin entry passes its
+ * own path. This function never runs itself — `./cli.js` is the only caller
+ * that does (#386).
+ */
+declare function run(argv?: string[], cliEntry?: string): Promise<void>;
 //#endregion
-export { type AppendFactoryTraceEventResult, type AssembledReviewPrompt, type BatteryCommandDisposition, type BatteryDisposition, type BoundaryCheckArgs, type BoundaryCheckDependencies, type BoundaryCheckProofRecord, type BuildEpicStructureEventInput, type BuildRetroEnvelopeInput, type CloudflareAccessServiceToken, CreateProgramOptions, DEFAULT_DEMAND_WAIVER_PATH, DEFAULT_FACTORY_REPOSITORY, type DagDocument, type DemandWaiveArgs, type DemandWaiveDependencies, DemandWaiveRefusalError, type DemandWaiver, type DemandWaiverStore, EPIC_STRUCTURE_NODE_STATUSES, EPIC_STRUCTURE_SCHEMA_VERSION, type EpicStructureEvent, type EpicStructureGraphPayload, type EpicStructureNodeStatus, EpicStructureValidationError, type EvidenceEmitArgs, type EvidenceEmitDependencies, type EvidenceEmitResult, type FactoryCliInvocation, FactoryCliInvocationSchema, type FactoryProjectProfile, type FactoryTraceDiagnostic, type FactoryTraceEnvelope, type FactoryTraceEvent, type FindingDisposition, type FindingLedgerEntry, type FollowUpAction, FollowUpActionSchema, type ImpactScopeDecision, type ImpactScopeSurface, type IssueReviewFocus, type LadderDispositionDeclaration, MERGE_FREEZE_APP_SLUG, MERGE_FREEZE_CHECK_NAME, type MergeFreezeState, type ParsedRetroEnvelope, type PrPublishArgs, type PrPublishDependencies, PrPublishFollowUpError, type PrPublishFollowUpOutcome, type PrPublishHandoff, type PrPublishResult, type PrReadyArgs, type PrReadyProof, type PreviewDisposition, type PreviewLifecyclePlan, type PreviewTargetPlan, type PublishEpicStructureArgs, type PublishEpicStructureResult, type PublishFollowUpPlan, RETRO_ENVELOPE_SCHEMA_VERSION, RETRO_ENVELOPE_VALIDATORS, REVIEW_FOCUS_SECTION, type RetroEnvelope, type ReviewGateNotRequiredProof, type ReviewGateTraceIdentity, type ReviewLadderCycle, type ReviewLadderEvaluation, type ReviewLadderPolicy, type ReviewLadderStageEvent, type ReviewLadderTraceIdentity, type ReviewPromptSection, type ReviewPromptSectionProvenance, SUPPORTED_RETRO_ENVELOPE_SCHEMA_VERSIONS, type ScanFactoryTraceDiagnosticsOptions, type ScanFactoryTraceOptions, type ScanFactoryTraceResult, type ScopedOutCommand, type TraceMirrorDiagnostic, type TraceSink, type TraceWriteResult, type TraceWriteSinks, type VerificationBatteryPlan, type VerificationReuse, type WaivedDemand, WorkerCheckoutGuardError, type WorkerCloseoutLessonsTraceEvent, appendReviewLadderStageTraceEvent, appendWithTraceSinks, applyDemandWaiver, assembleReviewPrompt, assertWorkerCheckoutAllowed, authorizeDemandWaiver, batteryScopeSummaryLines, blockingLadderFindings, boundary_manifest_d_exports as boundaryManifest, boundary_review_proof_d_exports as boundaryReviewProof, buildEpicStructureEvent, buildEpicStructurePayload, buildEvidenceEnvelope, buildRetroEnvelope, buildReviewGateNotRequiredTraceEvent, buildReviewLadderStageTraceEvent, comment_provenance_d_exports as commentProvenance, createLocalJsonlTraceSink, createProgram, doctorProjectProfile, epicStructureEventId, evaluateReviewLadder, evidenceEnvelopeFilename, findingKey, followUpFromArgv, impactStampScopeDecision, inferFixedInThreadDispositions, isProductionHqUrl, isRetroEnvelopeWireComplete, loadProjectProfile, normalizeIssueComments, openLadderFindings, parseRetroEnvelope, planPreviewLifecycle, planPublishFollowUp, planVerificationBattery, readiness_evaluation_d_exports as prReadinessEvaluation, external_evidence_d_exports as prReadinessExternalEvidence, pr_body_renderer_d_exports as prReadinessPrBodyRenderer, proof_identity_d_exports as prReadinessProofIdentity, review_proof_d_exports as prReadinessReviewProof, status_check_rollup_d_exports as prReadinessStatusChecks, verification_proof_d_exports as prReadinessVerificationProof, previewLifecycleTargets, publishEpicStructure, readDemandWaivers, readPrReadyProof, readPrReviewProof, resolveFactoryRepository, resolveFindingBlocking, resolveReviewFindingCategory, resolveReviewFindingSeverity, resolveReviewLadderPolicy, resolveTraceWriteSinks, retroEnvelopeSchemaVersionOf, retroEnvelopeV1Schema, retroEpicReference, reviewCycleStateFor, reviewFocusFromIssueBody, reviewPromptSectionSchema, reviewPromptSectionsSchema, run, runBoundaryCheck, runDemandWaive, runEvidenceEmit, runPrPublish, runPrReady, runPrReview, runPrVerify, scanFactoryTraceDiagnostics, scanFactoryTraceEvents, selectWaiversForCandidate, staleRepeatLadderFindings, toFactoryTraceEnvelope, tryAppendReviewGateNotRequiredTraceEvent, tryAppendReviewLadderStageTraceEvent, validateBoundaryCheckProof, validateDagDocument, validateDemandWaiverStore, validateFactoryTraceEvent, validateMergeFreezeState, validatePrReadyProof, validatePrReviewProof, validatePrVerifyProof, waivedDemandNotice, waivedDemandSchema, worktree_scratch_files_d_exports as worktreeScratchFiles };
+export { type AppendFactoryTraceEventResult, type AssembledReviewPrompt, type BatteryCommandDisposition, type BatteryDisposition, type BoundaryCheckArgs, type BoundaryCheckDependencies, type BoundaryCheckProofRecord, type BuildEpicStructureEventInput, type CloudflareAccessServiceToken, type CompletedFactoryCheckSnapshot, CreateProgramOptions, DEFAULT_DEMAND_WAIVER_PATH, DEFAULT_FACTORY_REPOSITORY, DEFAULT_ROOT_SHARED_GLOBS, type DagDocument, type DemandWaiveArgs, type DemandWaiveDependencies, DemandWaiveRefusalError, type DemandWaiver, type DemandWaiverStore, EMPTY_TREE_OBJECT_HASH, EPIC_STRUCTURE_NODE_STATUSES, EPIC_STRUCTURE_SCHEMA_VERSION, type EpicStructureEvent, type EpicStructureGraphPayload, type EpicStructureNodeStatus, EpicStructureValidationError, type EvidenceEmitArgs, type EvidenceEmitDependencies, type EvidenceEmitResult, FACTORY_BASE_REF_ENV, FACTORY_CHANGED_FILES_ENV, FACTORY_CHANGED_FILES_FILE_ENV, type FactoryCliInvocation, FactoryCliInvocationSchema, type FactoryPrStatusCheckName, type FactoryPrStatusSources, type FactoryProjectProfile, type FactoryTraceDiagnostic, type FactoryTraceEnvelope, type FactoryTraceEvent, type FollowUpAction, FollowUpActionSchema, type GitHubCheckRunMergeFreezeApi, type ImpactScopeDecision, type ImpactScopeSurface, type IssueReviewFocus, MERGE_FREEZE_APP_SLUG, MERGE_FREEZE_CHECK_NAME, type MergeFreezeAuthority, type MergeFreezeGeneration, type MergeFreezeState, type MergeFreezeStoreInput, type PlanFactoryPrStatusHudInput, type PrPublishArgs, type PrPublishDependencies, PrPublishFollowUpError, type PrPublishFollowUpOutcome, type PrPublishHandoff, type PrPublishResult, type PrReadyArgs, type PrReadyProof, type PrVerifyProof, type PresentFactoryPrStatusHudDependencies, type PresentFactoryPrStatusHudInput, type PreviewDisposition, type PreviewLifecyclePlan, type PreviewTargetPlan, type PublishEpicStructureArgs, type PublishEpicStructureResult, type PublishFollowUpPlan, REVIEW_FOCUS_SECTION, type ReadFactoryPrStatusSourcesDependencies, type ReadFactoryPrStatusSourcesInput, type RefreshFactoryPrStatusHudInput, type RenderFactoryPrStatusHudInput, type ReviewGateNotRequiredProof, type ReviewGateTraceIdentity, type ReviewPromptSection, type ReviewPromptSectionProvenance, type ScanFactoryTraceDiagnosticsOptions, type ScanFactoryTraceOptions, type ScanFactoryTraceResult, type ScopedOutCommand, type TraceMirrorDiagnostic, type TraceSink, type TraceWriteResult, type TraceWriteSinks, type VerificationBatteryPlan, type VerificationReuse, type VerificationRunContext, type VerificationRunContextInput, type WaivedDemand, WorkerCheckoutGuardError, type WorkerCloseoutLessonsTraceEvent, appendWithTraceSinks, applyDemandWaiver, assembleReviewPrompt, assertFactoryPrStatusIdentity, assertWorkerCheckoutAllowed, authorizeDemandWaiver, batteryScopeSummaryLines, boundary_manifest_d_exports as boundaryManifest, boundary_review_proof_d_exports as boundaryReviewProof, buildEpicStructureEvent, buildEpicStructurePayload, buildEvidenceEnvelope, buildReviewGateNotRequiredTraceEvent, comment_provenance_d_exports as commentProvenance, createGitHubCheckRunMergeFreezeStore, createLocalJsonlTraceSink, createProgram, createVerificationRunContext, doctorProjectProfile, epicStructureEventId, evidenceEnvelopeFilename, followUpFromArgv, impactStampScopeDecision, isProductionHqUrl, loadProjectProfile, normalizeIssueComments, planFactoryPrStatusHud, planPreviewLifecycle, planPublishFollowUp, planVerificationBattery, readiness_evaluation_d_exports as prReadinessEvaluation, external_evidence_d_exports as prReadinessExternalEvidence, pr_body_renderer_d_exports as prReadinessPrBodyRenderer, proof_identity_d_exports as prReadinessProofIdentity, review_proof_d_exports as prReadinessReviewProof, status_check_rollup_d_exports as prReadinessStatusChecks, verification_proof_d_exports as prReadinessVerificationProof, presentFactoryPrStatusHud, previewLifecycleTargets, publishEpicStructure, readDemandWaivers, readFactoryPrStatusSources, readPrReadyProof, refreshFactoryPrStatusHud, refreshFactoryPrStatusHudSafely, renderFactoryPrStatusHud, resolveFactoryRepository, resolveTraceWriteSinks, reviewFocusFromIssueBody, reviewPromptSectionSchema, reviewPromptSectionsSchema, run, runBoundaryCheck, runDemandWaive, runEvidenceEmit, runPrPublish, runPrReady, runPrReview, runPrVerify, scanFactoryTraceDiagnostics, scanFactoryTraceEvents, selectWaiversForCandidate, toFactoryTraceEnvelope, tryAppendReviewGateNotRequiredTraceEvent, validateBoundaryCheckProof, validateDagDocument, validateDemandWaiverStore, validateFactoryTraceEvent, validateMergeFreezeState, validatePrReadyProof, validatePrVerifyProof, validatePreviewLifecyclePlan, waivedDemandNotice, waivedDemandSchema, worktree_scratch_files_d_exports as worktreeScratchFiles };