@patronage/software-factory 1.0.0-alpha.30 → 1.0.0-alpha.31

package/dist/index.js

@@ -18,7 +18,8 @@ import { FACTORY_APP_BROKER_ORIGIN, FACTORY_APP_BROKER_PATH, FACTORY_CURSOR_OIDC
 import http from "node:http";
 import { pathToFileURL } from "node:url";
 //#region package.json
-var version = "1.0.0-alpha.30";
+var name = "@patronage/software-factory";
+var version = "1.0.0-alpha.31";
 //#endregion
 //#region src/cli-entry.ts
 /**
@@ -2277,7 +2278,7 @@ const migratedPolicyLines = (policy, root) => {
 * still on `schemaVersion` 2 — or `undefined` when it is not.
 *
 * v3 is a hard break: there is no in-memory translation and no compatibility
-* path (ADR 0023, #318). What replaces it is a refusal that names each
+* path (ADR 0021, #318). What replaces it is a refusal that names each
 * offending field and prints its replacement, so migrating is a transcription
 * rather than a reading exercise. The message is a courtesy, never a control:
 * every rule it describes is enforced by the schema below it.
@@ -2402,7 +2403,7 @@ function hqLaneRefBaseUrlFromProfile(profile) {
 	return hqLaneRefBaseUrl(profile.hq.endpoint);
 }
 function formatLegacyProfileError(profilePath, foundVersion, migration) {
-	return [`Profile is invalid: ${profilePath}: schemaVersion ${foundVersion} is not supported; migrate to schemaVersion 6 (ADR 0023).`, ...migration.map((line) => `  ${line}`)].join("\n");
+	return [`Profile is invalid: ${profilePath}: schemaVersion ${foundVersion} is not supported; migrate to schemaVersion 6 (ADR 0021).`, ...migration.map((line) => `  ${line}`)].join("\n");
 }
 function formatProfileError(profilePath, error) {
 	return `Profile is invalid: ${profilePath}: ${error.issues.map((issue) => {
@@ -5580,18 +5581,18 @@ const evidenceEnvelopeSchema$1 = z.object({
 	if (envelope.checkType === "review") {
 		if (envelope.rung === void 0) context.addIssue({
 			code: "custom",
-			message: "review-type evidence envelope requires a rung (ADR 0014 §3).",
+			message: "review-type evidence envelope requires a rung (ADR 0014).",
 			path: ["rung"]
 		});
 	} else {
 		if (envelope.rung !== void 0) context.addIssue({
 			code: "custom",
-			message: "verify-type evidence envelope must not carry rung (review-type-only field, ADR 0014 §3).",
+			message: "verify-type evidence envelope must not carry rung (review-type-only field, ADR 0014).",
 			path: ["rung"]
 		});
 		if (envelope.model !== void 0) context.addIssue({
 			code: "custom",
-			message: "verify-type evidence envelope must not carry model (review-type-only field, ADR 0014 §3).",
+			message: "verify-type evidence envelope must not carry model (review-type-only field, ADR 0014).",
 			path: ["model"]
 		});
 	}
@@ -5700,7 +5701,7 @@ const evidenceEmitInvocation = (check) => check.checkType === "review" ? "review
 * the reader has a thread to pull rather than a demand to interpret. It stays a
 * courtesy: the schema and the envelope remain the control.
 */
-const absentEnvelopeReason = (check) => `Required check "${check.name}" has no evidence envelope; absence fails closed (ADR 0014 §2). This demand resolves ${check.checkType} envelope files under ${EVIDENCE_DIR}/ in this checkout — not GitHub check runs, so a green hosted job satisfies nothing on its own. Satisfy it with a passing ${check.checkType} envelope named "${check.name}", bound to this candidate's headSha, patchId, and mergeBaseSha: ${evidenceEmitInvocation(check)}`;
+const absentEnvelopeReason = (check) => `Required check "${check.name}" has no evidence envelope; absence fails closed (ADR 0014). This demand resolves ${check.checkType} envelope files under ${EVIDENCE_DIR}/ in this checkout — not GitHub check runs, so a green hosted job satisfies nothing on its own. Satisfy it with a passing ${check.checkType} envelope named "${check.name}", bound to this candidate's headSha, patchId, and mergeBaseSha: ${evidenceEmitInvocation(check)}`;
 const freshnessRefusalReason = (name) => `Required check "${name}" evidence is stale: the envelope's patchId no longer matches the candidate delta.`;
 const evaluateInScopeCheck = ({ authoringSessionIds, candidate, check, envelopes, parsed }) => {
 	const named = parsed.filter((loaded) => loaded.envelope.check === check.name);
@@ -5709,7 +5710,7 @@ const evaluateInScopeCheck = ({ authoringSessionIds, candidate, check, envelopes
 		if (malformedForCheck) return {
 			checkType: check.checkType,
 			name: check.name,
-			reason: `Required check "${check.name}" envelope fails the three-way binding requirement (headSha+patchId+mergeBaseSha always required, ADR 0014 §3): ${malformedForCheck.error}.`,
+			reason: `Required check "${check.name}" envelope fails the three-way binding requirement (headSha+patchId+mergeBaseSha always required, ADR 0014): ${malformedForCheck.error}.`,
 			status: "unmet"
 		};
 		return {
@@ -5871,10 +5872,10 @@ const loadEvidenceEnvelopes = (cwd) => {
 };
 function independenceRefusalReason(name, independence) {
 	switch (independence.reason) {
-		case "no-session": return `Required review check "${name}" carries no usable sessionId (absent or the reserved "unknown" sentinel), so different-session independence is unconfirmable; fail closed (ADR 0014 §5).`;
-		case "unknown-authoring-identity": return `Required review check "${name}" independence is unconfirmable: the candidate authoring identity is unknown, so a different-session cross-check cannot run; fail closed (ADR 0014 §5, resolution 4).`;
-		case "same-session": return `Required review check "${name}" ran in the same session as the authoring identity; same-session self-review never meets the rung (ADR 0014 §5).`;
-		default: return `Required review check "${name}" independence could not be confirmed; fail closed (ADR 0014 §5).`;
+		case "no-session": return `Required review check "${name}" carries no usable sessionId (absent or the reserved "unknown" sentinel), so different-session independence is unconfirmable; fail closed (ADR 0014).`;
+		case "unknown-authoring-identity": return `Required review check "${name}" independence is unconfirmable: the candidate authoring identity is unknown, so a different-session cross-check cannot run; fail closed (ADR 0014).`;
+		case "same-session": return `Required review check "${name}" ran in the same session as the authoring identity; same-session self-review never meets the rung (ADR 0014).`;
+		default: return `Required review check "${name}" independence could not be confirmed; fail closed (ADR 0014).`;
 	}
 }
 //#endregion
@@ -7157,7 +7158,7 @@ const catchUpRecognitionSchema = z.object({
 }).strict();
 //#endregion
 //#region src/policy-resolution.ts
-const COMMIT_SHA_PATTERN$2 = /^[0-9a-f]{40}$/u;
+const COMMIT_SHA_PATTERN$3 = /^[0-9a-f]{40}$/u;
 const digestSchema = z.string().regex(/^[0-9a-f]{64}$/u);
 /**
 * The authority resolved: the live tip of the PR's own base ref served a
@@ -7181,7 +7182,7 @@ const authoritativePolicyResolutionSchema = z.object({
 	/** sha256 of the merged (base ∪ candidate) protected-path set. */
 	effectiveDigest: digestSchema,
 	/** The base-ref tip the base policy was read at. */
-	policyBaseSha: z.string().regex(COMMIT_SHA_PATTERN$2),
+	policyBaseSha: z.string().regex(COMMIT_SHA_PATTERN$3),
 	/**
 	* Whether the candidate's `review` subtree differs from the base's. The
 	* digests prove which policies were read; this says whether they agreed,
@@ -8873,7 +8874,6 @@ const foldLedger = (cycles, refs) => {
 	};
 };
 const openLadderFindings = (ledger) => ledger.filter((entry) => entry.disposition === "open");
-const nonOpenLadderFindings = (ledger) => ledger.filter((entry) => entry.disposition !== "open");
 const blockingLadderFindings = (ledger) => openLadderFindings(ledger).filter((entry) => resolveFindingBlocking(entry, entry.disposition));
 const staleRepeatLadderFindings = (ledger) => ledger.filter((entry) => entry.disposition === "stale-repeat");
 const inferFixedInThreadDispositions = (ledger, findings, options = {}) => {
@@ -9137,8 +9137,27 @@ const reviewAcceptedAfterCycleCap = (proof, review) => {
 	});
 	return state.windowExhausted && state.autoBlockingFindings === 0;
 };
+const ladderRefoldDisagreement = (epoch) => {
+	if (epoch.kind !== "ladder") return {
+		autoBlockingFindings: 0,
+		unmatchedDispositions: 0
+	};
+	if (epoch.snapshot) return {
+		autoBlockingFindings: epoch.snapshot.cycleState.autoBlockingFindings,
+		unmatchedDispositions: epoch.snapshot.evaluation.unmatchedDispositions.length
+	};
+	const { ledger, unmatchedDispositions } = foldLedger(epoch.ladder.cycles, ladderCycleRefsFor(epoch.ladder.cycles));
+	return {
+		autoBlockingFindings: blockingLadderFindings([...ledger.values()]).length,
+		unmatchedDispositions: unmatchedDispositions.length
+	};
+};
 const resolveReviewAcceptanceForEpoch = (proof, review, epoch) => {
-	if (review.outcome === "passed") return "accepted-clean";
+	if (review.outcome === "passed") {
+		const disagreement = ladderRefoldDisagreement(epoch);
+		if (disagreement.autoBlockingFindings > 0 || disagreement.unmatchedDispositions > 0) return "blocked";
+		return "accepted-clean";
+	}
 	if (review.outcome !== "failed") return "blocked";
 	if (epoch.kind === "ladder" && epoch.snapshot && reviewAcceptedThroughSnapshot(epoch.snapshot)) return "accepted-through-ladder";
 	if (epoch.kind === "declared-window" && reviewAcceptedAfterCycleCap(proof, review)) return "accepted-after-cap";
@@ -9149,7 +9168,10 @@ const resolveReviewTerminalStateForEpoch = (proof, review, epoch, adjudicatedLed
 	const acceptance = resolveReviewAcceptanceForEpoch(proof, review, epoch);
 	if (acceptance === "accepted-clean") return "clean";
 	const { autoBlockingFindings, openFindings } = reviewCycleStateForEpoch(proof, epoch, adjudicatedLedger);
-	if (acceptance === "blocked") return openFindings === 0 && autoBlockingFindings === 0 ? "clean" : "blocked";
+	if (acceptance === "blocked") {
+		if (ladderRefoldDisagreement(epoch).unmatchedDispositions > 0) return "blocked";
+		return openFindings === 0 && autoBlockingFindings === 0 ? "clean" : "blocked";
+	}
 	return openFindings === 0 ? "clean" : "accepted-with-findings";
 };
 const resolveReviewTerminalState = (proof, review, policy) => resolveReviewTerminalStateForEpoch(proof, review, reviewEpochModeFor(proof, policy));
@@ -9475,18 +9497,18 @@ z.object({
 	if (envelope.checkType === "review") {
 		if (envelope.rung === void 0) context.addIssue({
 			code: "custom",
-			message: "review-type evidence envelope requires a rung (ADR 0014 §3).",
+			message: "review-type evidence envelope requires a rung (ADR 0014).",
 			path: ["rung"]
 		});
 	} else {
 		if (envelope.rung !== void 0) context.addIssue({
 			code: "custom",
-			message: "verify-type evidence envelope must not carry rung (review-type-only field, ADR 0014 §3).",
+			message: "verify-type evidence envelope must not carry rung (review-type-only field, ADR 0014).",
 			path: ["rung"]
 		});
 		if (envelope.model !== void 0) context.addIssue({
 			code: "custom",
-			message: "verify-type evidence envelope must not carry model (review-type-only field, ADR 0014 §3).",
+			message: "verify-type evidence envelope must not carry model (review-type-only field, ADR 0014).",
 			path: ["model"]
 		});
 	}
@@ -10708,7 +10730,7 @@ function createBoundaryCheckCommand(output, action) {
 //#endregion
 //#region src/candidate-impact.ts
 const CANDIDATE_IMPACT_DECISION_SCHEMA_VERSION = 1;
-const COMMIT_SHA_PATTERN$1 = /^[0-9a-f]{40}$/iu;
+const COMMIT_SHA_PATTERN$2 = /^[0-9a-f]{40}$/iu;
 const ZERO_SHA_PATTERN$1 = /^0{40}$/u;
 const demandedTargets$1 = (profile, reason) => (profile?.impact?.targets ?? []).map(({ name }) => ({
 	basis: reason,
@@ -10747,10 +10769,10 @@ const canonicalJson = (content) => {
 	}
 };
 const assertCommitIdentity$1 = (value, name) => {
-	if (value === void 0 || !COMMIT_SHA_PATTERN$1.test(value) || ZERO_SHA_PATTERN$1.test(value)) throw new Error(`${name} must be a non-zero 40-character commit SHA`);
+	if (value === void 0 || !COMMIT_SHA_PATTERN$2.test(value) || ZERO_SHA_PATTERN$1.test(value)) throw new Error(`${name} must be a non-zero 40-character commit SHA`);
 	return value.toLowerCase();
 };
-const assertReachableCommit$1 = (cwd, sha, name) => {
+const assertReachableCommit = (cwd, sha, name) => {
 	try {
 		runCapture("git", [
 			"cat-file",
@@ -10806,8 +10828,8 @@ const classifyCandidateImpact = (args) => {
 		});
 		const base = assertCommitIdentity$1(args.base, "base");
 		const head = assertCommitIdentity$1(args.head, "head");
-		assertReachableCommit$1(cwd, base, "base");
-		assertReachableCommit$1(cwd, head, "head");
+		assertReachableCommit(cwd, base, "base");
+		assertReachableCommit(cwd, head, "head");
 		const checkedOutHead = runCapture("git", ["rev-parse", "HEAD"], cwd).stdout.trim().toLowerCase();
 		if (checkedOutHead !== head) throw new Error(`head commit ${head} is not the checked-out HEAD ${checkedOutHead}; refusing to mix commit identities with declarations from another tree`);
 		const relativeProfilePath = relativeProfile;
@@ -10819,7 +10841,7 @@ const classifyCandidateImpact = (args) => {
 			base,
 			head
 		], cwd).stdout.trim().toLowerCase();
-		if (!COMMIT_SHA_PATTERN$1.test(mergeBase)) throw new Error(`no merge base exists between base ${base} and head ${head}`);
+		if (!COMMIT_SHA_PATTERN$2.test(mergeBase)) throw new Error(`no merge base exists between base ${base} and head ${head}`);
 		const changedFiles = [...new Set(filesFromNameStatus(runCapture("git", [
 			"diff",
 			"--find-renames",
@@ -11445,9 +11467,9 @@ const renderCiAnalyzeReport = (report) => {
 * `gh` CLI, which resolves its own token (GH_TOKEN / GITHUB_TOKEN / login) —
 * no credential is stored or minted here.
 */
-const REPOSITORY_PATTERN = /^[\w.-]+\/[\w.-]+$/u;
+const REPOSITORY_PATTERN$1 = /^[\w.-]+\/[\w.-]+$/u;
 const parseRepository = (value) => {
-	if (!REPOSITORY_PATTERN.test(value)) throw new Error(`--repo must be owner/name, got "${value}"`);
+	if (!REPOSITORY_PATTERN$1.test(value)) throw new Error(`--repo must be owner/name, got "${value}"`);
 	return value;
 };
 const parseRunId = (value) => {
@@ -13900,7 +13922,7 @@ function formatHumanReport(report) {
 const EPIC_STRUCTURE_SCHEMA_VERSION = 1;
 /**
 * DAG-node PLANNING statuses — the planning-plane vocabulary a planner authors
-* on a `dag.yml` node. Carried forward by ADR 0018 §4 and defined by the epic
+* on a `dag.yml` node. Carried forward by ADR 0018 and defined by the epic
 * skill (`reference/epic-artifacts.md`) and both `CONTEXT.md` glossaries.
 *
 * A DAG node is a unit of *plan*; an HQ lane is a unit of *runtime execution*.
@@ -14713,7 +14735,7 @@ const isFactoryReadyCheck = (check) => check.context?.startsWith("patronage-fact
 * The hosted verification gate's context name — the branch ruleset's other
 * source-pinned required check, alongside `patronage-factory/pr-ready`. One
 * name across the fleet because one generator emits the workflow that posts
-* it (ADR 0016, 2026-07-31 amendment).
+* it (ADR 0016).
 */
 const HOSTED_VERIFY_CHECK_NAME$1 = "verify";
 /**
@@ -14963,7 +14985,7 @@ function armAutoMerge(input, dependencies = {}) {
 const MERGE_FREEZE_CHECK_NAME = "patronage-factory/merge-freeze";
 const MERGE_FREEZE_APP_SLUG = "patronage-factory";
 const HOSTED_VERIFY_CHECK_NAME = "verify";
-const GITHUB_ACTIONS_APP_ID = 15368;
+const GITHUB_ACTIONS_APP_ID$1 = 15368;
 const GITHUB_ACTIONS_APP_SLUG = "github-actions";
 const MERGE_FREEZE_SCHEMA_VERSION = 1;
 const CHECK_RUNS_PER_PAGE$1 = 100;
@@ -14991,7 +15013,7 @@ const inactiveMergeFreezeStateSchema = z.object({
 const mergeFreezeStateSchema = z.discriminatedUnion("active", [activeMergeFreezeStateSchema, inactiveMergeFreezeStateSchema]);
 /**
 * The write side of this contract lives in the generated merge-target push
-* Verify workflow (#356, ADR 0016 as amended; #429): it is the ONLY producer of
+* Verify workflow (#356, ADR 0016; #429): it is the ONLY producer of
 * `patronage-factory/merge-freeze` generations. Its emitted `output.text`
 * payload must parse under this exact reader schema, which is what the
 * workflow's own tests assert through this export.
@@ -15028,7 +15050,7 @@ const completedMergeFreezeCheckRunSchema = mergeFreezeCheckRunListItemSchema.ext
 });
 const hostedVerifyCheckRunSchema = z.object({
 	app: z.object({
-		id: z.literal(GITHUB_ACTIONS_APP_ID),
+		id: z.literal(GITHUB_ACTIONS_APP_ID$1),
 		slug: z.literal(GITHUB_ACTIONS_APP_SLUG)
 	}),
 	head_sha: shaSchema$2,
@@ -15224,7 +15246,7 @@ const activeMergeFreezeReason = (reason) => `Merge freeze is active (${reason}).
 */
 const unreadableMergeFreezeReason = (headSha, detail) => `Merge freeze refuses this candidate: the authoritative ${MERGE_FREEZE_CHECK_NAME} state for its base tip ${headSha} could not be read (${detail}). Which recovery applies is what that detail says: restore readability where the authority is missing or unreachable — the merge-target push Verify workflow generated, its writer App credentials configured, GitHub's Checks API reachable with read access — and/or let a fresh valid App-owned generation supersede a defective one, which a later Verify push to this base branch normally produces. Then rerun pr:ready. An operator may waive it for one candidate with patronage-factory demand:waive --pr <pr> --demand merge-freeze --rationale <why>.`;
 /** What every settling notice says after it has named its own witness. */
-const SETTLING_MERGE_FREEZE_TAIL = "readiness proceeds (ADR 0016, 2026-07-31/2026-08-01 amendments). If this wave authorizes machine merge, arming follows the admission decision. The Verify run for that tip still refuses every later readiness decision against this base branch if it goes red.";
+const SETTLING_MERGE_FREEZE_TAIL = "readiness proceeds (ADR 0016). If this wave authorizes machine merge, arming follows the admission decision. The Verify run for that tip still refuses every later readiness decision against this base branch if it goes red.";
 /**
 * The notice each settling phase earns, from the witness that phase carries.
 *
@@ -15239,7 +15261,7 @@ const settlingMergeFreezeNotice = (headSha, generation) => {
 };
 /**
 * The freeze read during readiness, before any authorized arming (#477,
-* ADR 0016 as amended 2026-07-31/2026-08-01).
+* ADR 0016).
 *
 * An **active** generation refuses readiness and names both exits. **Unreadable**
 * authority refuses too — the identity and ordering predicates are unchanged,
@@ -17568,11 +17590,12 @@ const priorLadderStateFor = ({ base, cwd, headSha, isAncestor, output }) => {
 	}, isAncestor) ? prior.ladder : void 0;
 };
 const normalizedDispositionKey = ({ file, title }) => `(title=${JSON.stringify(normalizeTitle(title))}, file=${file === void 0 ? "<unspecified>" : JSON.stringify(normalizeFile(file))})`;
-const assertDeclaredDispositionsMatch = (priorLedger, declarations) => {
-	const unmatched = declarations.filter((declaration) => !priorLedger.some((entry) => declarationMatchesEntry(entry, declaration.finding)));
+const assertDeclaredDispositionsMatch = (priorLedger, declarations, currentFindings = []) => {
+	const unmatched = declarations.filter((declaration) => !priorLedger.some((entry) => declarationMatchesEntry(entry, declaration.finding)) && !currentFindings.some((finding) => declarationMatchesEntry(finding, declaration.finding)));
 	if (unmatched.length > 0) {
 		const unmatchedKeys = unmatched.map((declaration) => normalizedDispositionKey(declaration.finding)).join("; ");
-		const availableKeys = priorLedger.length === 0 ? "prior ledger is empty" : priorLedger.map((entry) => normalizedDispositionKey(entry)).join("; ");
+		const availableTargets = [...priorLedger.map((entry) => normalizedDispositionKey(entry)), ...currentFindings.map((finding) => normalizedDispositionKey(finding))];
+		const availableKeys = availableTargets.length === 0 ? "prior ledger is empty" : availableTargets.join("; ");
 		throw new Error(`--dispositions entries match no ledger finding. Unmatched normalized declaration keys: ${unmatchedKeys}. Available normalized ledger keys: ${availableKeys}. Declarations are keyed by normalized title plus file; check both against the persisted ladder ledger.`);
 	}
 };
@@ -17594,10 +17617,19 @@ function ladderStateForRun({ declaredDispositions, cycle, historical, identity,
 		...sessionAttribution?.sessionId ? { sessionId: sessionAttribution.sessionId } : {},
 		...sessionAttribution?.runtime ? { runtime: sessionAttribution.runtime } : {}
 	};
+	const sameCycleDeclared = historical === true ? declaredDispositions.flatMap((declaration) => {
+		const finding = findings.find((candidate) => declarationMatchesEntry(candidate, declaration.finding));
+		return finding === void 0 ? [] : [{
+			...declaration,
+			findingReport: finding
+		}];
+	}) : [];
+	const priorDeclared = historical === true ? declaredDispositions.filter((declaration) => !findings.some((candidate) => declarationMatchesEntry(candidate, declaration.finding))) : declaredDispositions;
 	const currentCycle = {
 		dispositions: [
 			...inferenceSafe ? inferFixedInThreadDispositions(priorLedger, findings, { sameHeadAsPriorCycle }) : [],
-			...declaredDispositions,
+			...priorDeclared,
+			...sameCycleDeclared,
 			...priorCycles.length >= 1 || (cycle ?? 1) >= 2 ? findings.filter((finding) => {
 				const severity = resolveReviewFindingSeverity(finding.priority);
 				return severity === "medium" || severity === "low";
@@ -17675,7 +17707,7 @@ ${waveRung === void 0 ? "" : `  "producer": "<the engine and model that ran this
 }
 ${authorityRule(waveRung)}
 ${SESSION_ID_RULE}
-Use category "correctness", "safety", "coordination", or "maintainability"; set blockingAfterCap true for correctness, safety, or coordination findings. citedSpan must be the exact code text the finding is about, quoted verbatim from the diff (identity is derived from this, not from the title, so quote precisely). prescribedAction must be a concise, standalone statement of the required fix (identity is derived from this text too). If this finding is a restatement of a prior finding shown in the prior review ledger below, set supersedes to {"title": "<exact prior title>", "file": "<its file>"} instead of minting a new title for the same theme.`;
+Use category "correctness", "safety", "coordination", or "maintainability"; set blockingAfterCap true for correctness, safety, or coordination findings. citedSpan must be the exact code text the finding is about, quoted verbatim from the diff (identity is derived from this, not from the title, so quote precisely). prescribedAction must be a concise, standalone statement of the required fix (identity is derived from this text too).`;
 };
 //#endregion
 //#region src/review-prompt.ts
@@ -17756,7 +17788,7 @@ ${focus.text}`
 const priorLedgerEntryLine = (entry) => {
 	const location = entry.file ? ` (${entry.file})` : "";
 	const reference = entry.reference ? ` — ${entry.reference}` : "";
-	return `- [${entry.disposition}] "${entry.title}"${location}${reference} (flagged ${entry.flagCount}x)`;
+	return `- [${entry.disposition === "open" ? "open, unadjudicated" : entry.disposition}] "${entry.title}"${location}${reference} (flagged ${entry.flagCount}x)`;
 };
 const priorLedgerSegment = (entries) => ({
 	section: {
@@ -17764,13 +17796,13 @@ const priorLedgerSegment = (entries) => ({
 		source: "persisted pr:review disposition ledger (prior cycles, #233)",
 		text: entries.map(priorLedgerEntryLine).join("\n")
 	},
-	text: `Prior review ledger (source: persisted pr:review disposition ledger from earlier cycles on this PR; already adjudicated — do not re-litigate):
+	text: `Prior review ledger (source: persisted pr:review disposition ledger from earlier cycles on this PR):
 ${entries.map(priorLedgerEntryLine).join("\n")}
 
-Do not re-raise any of the findings above under a new title: they are already adjudicated (waived, filed as a follow-up, or fixed in this thread). If new evidence genuinely supersedes one of them, say so explicitly and name the exact prior finding (its title and file) that it supersedes, rather than minting an unrelated title for the same underlying theme.`
+Open entries above are unadjudicated: they still need a disposition or a supersedes citation. Do not re-raise any already-adjudicated finding (waived, filed as a follow-up, or fixed in this thread) under a new title. If this finding is a restatement of a prior finding shown in this ledger, set supersedes to {"title": "<exact prior title>", "file": "<its file>"} instead of minting a new title for the same theme.`
 });
 const assembleReviewPrompt = ({ base, changedFiles, cwd = process.cwd(), headSha, issueFocus, kind, patchId, priorLedgerEntries, profile, waveRung }, dependencies = {}) => {
-	const priorLedger = priorLedgerEntries ? nonOpenLadderFindings(priorLedgerEntries) : [];
+	const priorLedger = priorLedgerEntries ?? [];
 	const optionalSegments = {
 		"coding-standards": codingStandardsSegment({
 			contents: kind === "correctness" ? readCodingStandardsAtHead({
@@ -17991,7 +18023,9 @@ const reviewResults = (findingsFile, kinds, startedAt, endedAt) => {
 const assertReviewOutcomes = (proof, policy, cycle, maxCycles) => {
 	if (!proof.reviews.some((review) => resolveReviewAcceptance(proof, review, policy) === "blocked")) return;
 	const state = reviewCycleStateFor(proof, policy);
-	console.error(cycle >= maxCycles ? `Review cycle limit reached (${cycle}/${maxCycles}). Stop and request human direction before rerunning.` : `Fix ${state.openFindings} actionable finding(s) before rerunning pr:review as cycle ${cycle + 1}/${maxCycles}.`);
+	if (proof.reviews.some((review) => review.outcome === "passed")) console.error(`Stored review outcome is passed, but a re-fold of persisted cycles yields ${state.autoBlockingFindings} auto-blocking finding(s) and ${state.openFindings} open finding(s). The stored pass and the ladder disagree.`);
+	else if (cycle >= maxCycles) console.error(`Review cycle limit reached (${cycle}/${maxCycles}). Stop and request human direction before rerunning.`);
+	else console.error(`Fix ${state.openFindings} actionable finding(s) before rerunning pr:review as cycle ${cycle + 1}/${maxCycles}.`);
 	throw new Error("pr:review found actionable review findings.");
 };
 const loadIssueFocus = (issue, profile, fetchIssueBody) => {
@@ -18124,7 +18158,7 @@ const resolveFindingsBinding = ({ args, cwd, findingsPatchId, git, headSha, patc
 	});
 	if (args.historical !== true) {
 		if (atCandidate) return { kind: "candidate" };
-		throw new Error(`Review findings patchId ${findingsPatchId} does not match the candidate stable patch-id ${patchId}. Every fix moves the patch-id, so a cycle must be recorded before the fixes that answer it. If these findings read an earlier commit on this branch, record them with pr:review --historical: the cycle joins the ladder as prior history and renders no verdict of its own, so it never admits. Declare each finding the fixes answered with --dispositions.`);
+		throw new Error(`Review findings patchId ${findingsPatchId} does not match the candidate stable patch-id ${patchId}. Every fix moves the patch-id, so a cycle must be recorded before the fixes that answer it. If these findings read an earlier commit on this branch, record them first with pr:review --historical --findings <path>: the cycle joins the ladder as prior history and renders no verdict of its own, so it never admits. That historical recording may carry --dispositions for the findings it itself flags. Otherwise declare each finding the fixes answered with --dispositions on the next cycle, once the findings are persisted ledger entries.`);
 	}
 	if (atCandidate) throw new Error(`--historical findings already match the candidate stable patch-id ${patchId}. Record them as the current cycle, without --historical.`);
 	const ancestors = resolveAncestorCandidatePatchIds({
@@ -18141,6 +18175,7 @@ const resolveFindingsBinding = ({ args, cwd, findingsPatchId, git, headSha, patc
 		ref: matched.ref
 	};
 };
+const currentCycleDispositionTargets = (historical, findingsFile) => historical ? findingsFile.reviews.flatMap((review) => review.findings) : [];
 /** The flag combinations that describe no single run. */
 const assertReviewFlagsCombine = (args) => {
 	if (args.assemble === true && args.findings !== void 0) throw new Error("--assemble and --findings cannot be combined; they are sequential steps.");
@@ -18363,8 +18398,8 @@ async function runPrReview(args, dependencies = {}) {
 	});
 	const priorLedger = priorLedgerFor(priorLadder);
 	const declaredDispositions = declaredDispositionsFor(args.dispositions, cwd);
-	assertDeclaredDispositionsMatch(priorLedger, declaredDispositions);
 	const historical = binding.kind === "historical";
+	assertDeclaredDispositionsMatch(priorLedger, declaredDispositions, currentCycleDispositionTargets(historical, findingsFile));
 	const { identity, reviews } = cycleRecordFor({
 		binding,
 		cwd,
@@ -18463,7 +18498,7 @@ function editPullRequestBody({ body, owner, repo, pr }) {
 		repo
 	}), process.cwd());
 }
-const defaultGhRunner = (args, cwd) => runCapture("gh", args, cwd).stdout;
+const defaultGhRunner$1 = (args, cwd) => runCapture("gh", args, cwd).stdout;
 const resolveFollowUpArgv = (followUp, factoryCliInvocation) => {
 	const [command, ...args] = followUp.argv;
 	if (!command) throw new Error("pr:ready returned an empty follow-up argv.");
@@ -18961,7 +18996,7 @@ async function runPrPublish(args, dependencies = {}) {
 		args,
 		branch: args.pr === void 0 ? (dependencies.currentBranch ?? currentBranchName)(cwd) : void 0,
 		cwd,
-		gh: dependencies.gh ?? defaultGhRunner
+		gh: dependencies.gh ?? defaultGhRunner$1
 	});
 	const readyArgs = {
 		...args,
@@ -19165,7 +19200,7 @@ function createPrPublishCommand(_output, action = runPrPublish) {
 //#endregion
 //#region src/commands/pr-ready.ts
 function createPrReadyCommand(output, action) {
-	return markCwdOptionDefault(new Command("pr:ready").description("Evaluate typed proof and GitHub state for final readiness").requiredOption("--pr <number>", "pull request number", positiveInteger$1("--pr")).option("--base <ref>", "explicit base branch or ref override").option("--authoring-session <id...>", "recorded authoring session id(s) for review-type requiredCheck independence (ADR 0014 §5)").option("--cwd <path>", "working directory to evaluate", collectCwdOption).option("--epic <number>", "issue carrying the factory-boundary manifest, which may be the work issue itself; readiness then evaluates the wave-demanded review rung (#351, #789)", positiveInteger$1("--epic")).option("--json", "print the readiness proof as JSON").option("--output <path>", "write proof JSON to a file").option("--profile <path>", "path to the project profile JSON file").option("--review-proof <path>", "pr:review proof JSON path").option("--verify-proof <path>", "pr:verify proof JSON path").action(withGateTiming({
+	return markCwdOptionDefault(new Command("pr:ready").description("Evaluate typed proof and GitHub state for final readiness").requiredOption("--pr <number>", "pull request number", positiveInteger$1("--pr")).option("--base <ref>", "explicit base branch or ref override").option("--authoring-session <id...>", "recorded authoring session id(s) for review-type requiredCheck independence (ADR 0014)").option("--cwd <path>", "working directory to evaluate", collectCwdOption).option("--epic <number>", "issue carrying the factory-boundary manifest, which may be the work issue itself; readiness then evaluates the wave-demanded review rung (#351, #789)", positiveInteger$1("--epic")).option("--json", "print the readiness proof as JSON").option("--output <path>", "write proof JSON to a file").option("--profile <path>", "path to the project profile JSON file").option("--review-proof <path>", "pr:review proof JSON path").option("--verify-proof <path>", "pr:verify proof JSON path").action(withGateTiming({
 		gate: "pr:ready",
 		resolveLedgerRoot: (options) => resolveCwdOption(options.cwd),
 		stderr: output.stderr
@@ -19212,7 +19247,7 @@ function assertForegroundGate({ gate, env = process.env }) {
 //#endregion
 //#region src/commands/pr-review.ts
 function createPrReviewCommand(output, action) {
-	return markCwdOptionDefault(new Command("pr:review").description("Assemble a factory-owned review prompt, or validate clean-session findings and write typed review proof").option("--base <ref>", "base branch or ref", "origin/main").option("--cwd <path>", "working directory to review", collectCwdOption).option("--cycle <number>", "review cycle number", positiveInteger$1("--cycle"), 1).option("--mode <mode>", "correctness, security, or all", "all").option("--assemble", "write the factory-owned review prompt for a clean session; do not validate findings").option("--epic <number>", "issue carrying the factory-boundary manifest, which may be the work issue itself; --assemble then asks the reviewer for the findings schema the wave-demanded review rung accepts (#1001)", positiveInteger$1("--epic")).option("--findings <path>", "typed clean-session findings JSON file").option("--historical", "record findings that read an earlier commit on this branch: the cycle joins the ladder as prior history and renders no verdict of its own, so it never admits. It leaves the candidate's recorded verdict untouched. Use --dispositions for the findings its fixes answered").option("--dispositions <path>", "JSON file of ladder disposition declarations (waived / follow-up-filed / fixed-in-thread) for previously flagged findings").option("--issue <number>", "issue number recorded on the review ladder trace; --assemble also loads Review focus from this issue", positiveInteger$1("--issue")).option("--output <path>", "write proof JSON to a file").option("--profile <path>", "path to the project profile JSON file").option("--verify-proof <path>", "pr:verify proof JSON path").action(withGateTiming({
+	return markCwdOptionDefault(new Command("pr:review").description("Assemble a factory-owned review prompt, or validate clean-session findings and write typed review proof").option("--base <ref>", "base branch or ref", "origin/main").option("--cwd <path>", "working directory to review", collectCwdOption).option("--cycle <number>", "review cycle number", positiveInteger$1("--cycle"), 1).option("--mode <mode>", "correctness, security, or all", "all").option("--assemble", "write the factory-owned review prompt for a clean session; do not validate findings").option("--epic <number>", "issue carrying the factory-boundary manifest, which may be the work issue itself; --assemble then asks the reviewer for the findings schema the wave-demanded review rung accepts (#1001)", positiveInteger$1("--epic")).option("--findings <path>", "typed clean-session findings JSON file").option("--historical", "record findings that read an earlier commit on this branch: the cycle joins the ladder as prior history and renders no verdict of its own, so it never admits. It leaves the candidate's recorded verdict untouched. This recording may carry --dispositions for the findings it flags; otherwise declare them on the next cycle once they are persisted ledger entries").option("--dispositions <path>", "JSON file of ladder disposition declarations (waived / follow-up-filed / fixed-in-thread) for previously flagged findings, or for the findings a --historical recording itself flags").option("--issue <number>", "issue number recorded on the review ladder trace; --assemble also loads Review focus from this issue", positiveInteger$1("--issue")).option("--output <path>", "write proof JSON to a file").option("--profile <path>", "path to the project profile JSON file").option("--verify-proof <path>", "pr:verify proof JSON path").action(withGateTiming({
 		gate: "pr:review",
 		resolveCycle: (options) => options.cycle,
 		resolveLedgerRoot: (options) => resolveCwdOption(options.cwd),
@@ -19270,56 +19305,544 @@ function modeFor(options) {
 	if (options.full) return "full";
 	return "auto";
 }
+/** The GitHub deployment `task` that names receipts this tool wrote. */
+const DEPLOYMENT_RECEIPT_TASK = "patronage-factory/deployment";
+/** The `performed_via_github_app.id` of GitHub Actions itself. */
+const GITHUB_ACTIONS_APP_ID = 15368;
+const RECEIPT_PAGE_SIZE = 100;
+var DeploymentReceiptTransportError = class extends Error {
+	code;
+	constructor(code) {
+		super(`deployment receipt transport failed: ${code}`);
+		this.name = "DeploymentReceiptTransportError";
+		this.code = code;
+	}
+};
+/** The code a failure is reported as; anything not classified is `transport`. */
+const transportCode = (error) => error instanceof DeploymentReceiptTransportError ? error.code : "transport";
+const COMMIT_SHA_PATTERN$1 = /^[0-9a-f]{40}$/u;
+const REPOSITORY_PATTERN = /^[^/\s]+\/[^/\s]+$/u;
+const RUN_ID_PATTERN = /^[1-9]\d*$/u;
+const WORKFLOW_REF_PATTERN = /^(?<repository>[^/\s]+\/[^/\s]+)\/(?<path>\.github\/workflows\/[^@\s]+)@(?<ref>refs\/\S+)$/u;
+/**
+* Read the run identity from GitHub Actions environment variables. Returns
+* the missing or malformed variable names when the environment is not a
+* workflow run; the caller then refuses to read or write receipts.
+*/
+const workflowRunIdentityFromEnv = (env) => {
+	const invalid = [];
+	const workflowRef = WORKFLOW_REF_PATTERN.exec(env.GITHUB_WORKFLOW_REF ?? "");
+	const repository = env.GITHUB_REPOSITORY ?? "";
+	const runId = env.GITHUB_RUN_ID ?? "";
+	const runAttempt = env.GITHUB_RUN_ATTEMPT ?? "";
+	const serverUrl = env.GITHUB_SERVER_URL ?? "";
+	const ref = env.GITHUB_REF ?? "";
+	if (!REPOSITORY_PATTERN.test(repository)) invalid.push("GITHUB_REPOSITORY");
+	if (!workflowRef?.groups || REPOSITORY_PATTERN.test(repository) && workflowRef.groups.repository !== repository) invalid.push("GITHUB_WORKFLOW_REF");
+	if (!RUN_ID_PATTERN.test(runId)) invalid.push("GITHUB_RUN_ID");
+	if (!RUN_ID_PATTERN.test(runAttempt)) invalid.push("GITHUB_RUN_ATTEMPT");
+	if (!/^https:\/\/[^/\s]+$/u.test(serverUrl)) invalid.push("GITHUB_SERVER_URL");
+	if (!ref.startsWith("refs/")) invalid.push("GITHUB_REF");
+	if (invalid.length > 0 || !workflowRef?.groups?.path) return { invalid };
+	return { identity: {
+		ref,
+		repository,
+		runAttempt: Number(runAttempt),
+		runId,
+		serverUrl,
+		workflowPath: workflowRef.groups.path
+	} };
+};
+/** The payload this tool writes into every deployment it creates. */
+const receiptPayloadSchema = z.object({
+	repository: z.string().regex(REPOSITORY_PATTERN),
+	schemaVersion: z.literal(1),
+	sourceSha: z.string().regex(COMMIT_SHA_PATTERN$1),
+	stage: z.string().min(1).optional(),
+	target: z.string().min(1),
+	tool: z.object({
+		name: z.literal(name),
+		version: z.string().min(1)
+	}),
+	workflow: z.object({
+		path: z.string().min(1),
+		ref: z.string().min(1),
+		runAttempt: z.number().int().positive(),
+		runId: z.string().regex(RUN_ID_PATTERN)
+	})
+});
+const deploymentRecordSchema = z.object({
+	created_at: z.string(),
+	environment: z.string(),
+	id: z.number().int(),
+	/** Fixed at creation. `environment` can be rewritten by a later status write. */
+	original_environment: z.string(),
+	payload: z.unknown(),
+	performed_via_github_app: z.object({ id: z.number().int() }).nullable().optional(),
+	sha: z.string(),
+	task: z.string()
+});
+const workflowRunJobSchema = z.object({
+	conclusion: z.string().nullable(),
+	head_sha: z.string(),
+	id: z.number().int(),
+	name: z.string(),
+	steps: z.array(z.object({
+		conclusion: z.string().nullable(),
+		name: z.string()
+	})).optional()
+});
+const workflowRunRecordSchema = z.object({
+	head_branch: z.string().nullable(),
+	head_sha: z.string(),
+	id: z.number().int(),
+	path: z.string(),
+	repository: z.object({ full_name: z.string() })
+});
+/** The deployment environment one target's receipts live in. */
+const deploymentReceiptEnvironment = (target) => target;
+const runUrl = (identity, runId) => `${identity.serverUrl}/${identity.repository}/actions/runs/${runId}`;
+/** The `$GITHUB_OUTPUT` key a success publication writes the new deployment id under. */
+const RECEIPT_DEPLOYMENT_ID_OUTPUT = "deployment_id";
+/**
+* The name of the generated step that binds one deployment record to the run
+* that created it. The identity is the record's server-assigned id alone,
+* so no two records render the same name and no target or stage text takes
+* part. `factoryProductionImpactWorkflow().receiptSteps()` emits this text
+* with the id as a step-output expression; the production-impact integration
+* test holds the two together. The reader looks the rendered name up in
+* GitHub's job record, where only the run itself can have put it.
+*/
+const boundReceiptStepName = (deploymentId) => `Bind deployment receipt ${deploymentId}`;
+/**
+* Bind the deployment record and its payload to this reader: performed by
+* GitHub Actions, written by this tool for this repository, target, stage,
+* source, workflow, and ref.
+*/
+const bindReceiptPayload = (args, deployment) => {
+	const label = `deployment ${deployment.id}`;
+	if (deployment.performed_via_github_app?.id !== GITHUB_ACTIONS_APP_ID) return { reason: `${label} was not performed by GitHub Actions` };
+	if (deployment.task !== "patronage-factory/deployment") return { reason: `${label} has a foreign task, not a factory receipt` };
+	const payload = receiptPayloadSchema.safeParse(deployment.payload);
+	if (!payload.success) return { reason: `${label} payload is not a schema-version-1 factory receipt` };
+	const receipt = payload.data;
+	if (receipt.repository !== args.identity.repository) return { reason: `${label} names another repository` };
+	if (receipt.target !== args.target || receipt.stage !== args.stage) return { reason: `${label} names another target or stage` };
+	if (receipt.sourceSha !== deployment.sha.toLowerCase()) return { reason: `${label} payload source ${receipt.sourceSha} differs from its deployment sha` };
+	if (receipt.workflow.path !== args.identity.workflowPath) return { reason: `${label} was written by another workflow file, not ${args.identity.workflowPath}` };
+	if (receipt.workflow.ref !== args.identity.ref) return { reason: `${label} was written for another ref, not ${args.identity.ref}` };
+	return { receipt };
+};
+/**
+* Judge one deployment record. The payload bindings come first; then the run
+* GitHub records for the payload's run id must agree with the receipt and
+* must have bound this record's id. The first failure names the receipt
+* untrusted. Statuses are not read: they are caller-written.
+*/
+const trustReceipt = (args, deployment) => {
+	const label = `deployment ${deployment.id}`;
+	const bound = bindReceiptPayload(args, deployment);
+	if ("reason" in bound) return bound;
+	const { receipt } = bound;
+	let runRecord;
+	let jobRecords;
+	try {
+		runRecord = args.transport.getWorkflowRun(receipt.workflow.runId);
+		jobRecords = args.transport.listWorkflowRunJobs(receipt.workflow.runId);
+	} catch (error) {
+		return { reason: `${label} names run ${receipt.workflow.runId}, which could not be read (transport error code: ${transportCode(error)})` };
+	}
+	const run = workflowRunRecordSchema.safeParse(runRecord);
+	if (!run.success) return { reason: `${label} names run ${receipt.workflow.runId}, which GitHub does not record` };
+	const expectedBranch = args.identity.ref.replace(/^refs\/heads\//u, "");
+	if (run.data.path !== args.identity.workflowPath || run.data.repository.full_name !== args.identity.repository || run.data.head_sha.toLowerCase() !== receipt.sourceSha || run.data.head_branch !== expectedBranch) return { reason: `${label} names run ${receipt.workflow.runId}, whose recorded workflow, repository, head, or branch disagrees with the receipt` };
+	const jobs = z.object({ jobs: z.array(workflowRunJobSchema) }).safeParse(jobRecords);
+	if (!jobs.success) return { reason: `${label} names run ${receipt.workflow.runId}, whose job records are malformed` };
+	const stepName = boundReceiptStepName(deployment.id);
+	if (jobs.data.jobs.find((job) => job.conclusion === "success" && job.head_sha.toLowerCase() === receipt.sourceSha && job.steps?.some((step) => step.name === stepName && step.conclusion === "success")) === void 0) return { reason: `${label} names run ${receipt.workflow.runId}, but no succeeded job of that run at ${receipt.sourceSha} bound deployment ${deployment.id}` };
+	return {
+		baseline: {
+			deploymentId: deployment.id,
+			runId: receipt.workflow.runId,
+			sha: receipt.sourceSha
+		},
+		trusted: true
+	};
+};
+/**
+* Resolve the trusted baseline for one target from GitHub deployment
+* records. The repository's newest page of records is read once and the
+* target's records are those whose `original_environment` is the target;
+* a target whose newest record is older than that page has no baseline. The
+* newest such record decides: bound by
+* its run's job record, it is the baseline; otherwise the baseline is
+* absent, and an older trusted receipt does not rescue it. Failed, partial,
+* foreign, and copied records are all unbound, so every one of them demands
+* reconciliation. Do not declare `environment: <target>` on a job; the
+* record GitHub creates for it is unbound too.
+*/
+const resolveDeploymentBaseline = (args) => {
+	const environment = deploymentReceiptEnvironment(args.target);
+	let deployments;
+	try {
+		const parsed = z.array(deploymentRecordSchema).safeParse(args.transport.listDeployments());
+		if (!parsed.success) return {
+			kind: "absent",
+			reasons: [`deployment records for ${environment} are malformed`]
+		};
+		deployments = parsed.data.filter((deployment) => deployment.original_environment === environment).toSorted((left, right) => left.created_at === right.created_at ? right.id - left.id : right.created_at.localeCompare(left.created_at));
+	} catch (error) {
+		return {
+			kind: "absent",
+			reasons: [`deployment records for ${environment} could not be read (transport error code: ${transportCode(error)})`]
+		};
+	}
+	const [newest] = deployments;
+	if (newest === void 0) return {
+		kind: "absent",
+		reasons: [`no deployment receipt for ${environment}${args.stage ? ` stage ${args.stage}` : ""}`]
+	};
+	const verdict = trustReceipt(args, newest);
+	if ("trusted" in verdict) return {
+		baseline: verdict.baseline,
+		kind: "trusted"
+	};
+	return {
+		kind: "absent",
+		reasons: [`newest receipt is not a bound success: ${verdict.reason}`]
+	};
+};
+const createdDeploymentSchema = z.object({ id: z.number().int() });
+/**
+* Write one receipt: a deployment bound to this run, then its terminal
+* status. The payload carries only the fixed identity fields above; no
+* command output and no secret can enter it. A `success` receipt marks
+* earlier successful deployments of the environment inactive, so the newest
+* success is always what production runs.
+*/
+const publishDeploymentReceipt = (args) => {
+	const environment = deploymentReceiptEnvironment(args.target);
+	const payload = {
+		repository: args.identity.repository,
+		schemaVersion: 1,
+		sourceSha: args.sourceSha,
+		...args.stage === void 0 ? {} : { stage: args.stage },
+		target: args.target,
+		tool: {
+			name,
+			version
+		},
+		workflow: {
+			path: args.identity.workflowPath,
+			ref: args.identity.ref,
+			runAttempt: args.identity.runAttempt,
+			runId: args.identity.runId
+		}
+	};
+	const created = createdDeploymentSchema.parse(args.transport.createDeployment({
+		auto_merge: false,
+		description: `${DEPLOYMENT_RECEIPT_TASK} ${args.target} at ${args.sourceSha}`,
+		environment,
+		payload,
+		production_environment: true,
+		ref: args.sourceSha,
+		required_contexts: [],
+		task: DEPLOYMENT_RECEIPT_TASK
+	}));
+	args.transport.createDeploymentStatus(created.id, {
+		auto_inactive: args.state === "success",
+		description: `${args.state}: ${args.target} at ${args.sourceSha} by run ${args.identity.runId} attempt ${args.identity.runAttempt}`,
+		log_url: `${runUrl(args.identity, args.identity.runId)}/attempts/${args.identity.runAttempt}`,
+		state: args.state
+	});
+	return {
+		deploymentId: created.id,
+		environment,
+		payload,
+		state: args.state
+	};
+};
+const defaultGhRunner = (args, cwd) => runCapture("gh", args, cwd).stdout;
+const HTTP_STATUS_PATTERN = /\bHTTP (?<status>\d{3})\b/u;
+/**
+* Classify a failed `gh` call from the HTTP status gh reports. The error text
+* is read here and dropped; only the code leaves this function.
+*/
+const classifyGhFailure = (error) => {
+	const text = error instanceof Error ? error.message : "";
+	const status = Number(HTTP_STATUS_PATTERN.exec(text)?.groups?.status ?? 0);
+	if (status === 401 || status === 403) return new DeploymentReceiptTransportError("unauthorized");
+	if (status === 404) return new DeploymentReceiptTransportError("not-found");
+	if (status === 429) return new DeploymentReceiptTransportError("rate-limited");
+	if (status >= 500) return new DeploymentReceiptTransportError("unavailable");
+	return new DeploymentReceiptTransportError("transport");
+};
+const ghJson = (run, args, cwd) => {
+	let stdout;
+	try {
+		stdout = run(args, cwd);
+	} catch (error) {
+		throw classifyGhFailure(error);
+	}
+	try {
+		return JSON.parse(stdout);
+	} catch {
+		throw new DeploymentReceiptTransportError("malformed-response");
+	}
+};
+/**
+* The `gh`-backed transport. Reads take the first page of 100, which is
+* newest first; a target with more than 100 deployments still resolves from
+* the newest. The environment is not filtered by task, so a foreign
+* deployment of the same environment is judged, not hidden. Writes hand the JSON body to `gh api --input` through a file,
+* because `runCapture` does not open stdin.
+*/
+const ghDeploymentReceiptTransport = (cwd, repository, run = defaultGhRunner) => {
+	const api = (route) => ghJson(run, ["api", route], cwd);
+	const post = (route, body) => {
+		const directory = mkdtempSync(path.join(tmpdir(), "factory-receipt-"));
+		try {
+			const input = path.join(directory, "body.json");
+			writeFileSync(input, JSON.stringify(body), "utf-8");
+			return ghJson(run, [
+				"api",
+				"-X",
+				"POST",
+				route,
+				"--input",
+				input
+			], cwd);
+		} finally {
+			rmSync(directory, {
+				force: true,
+				recursive: true
+			});
+		}
+	};
+	const base = `/repos/${repository}`;
+	return {
+		createDeployment: (body) => post(`${base}/deployments`, body),
+		createDeploymentStatus: (deploymentId, body) => post(`${base}/deployments/${deploymentId}/statuses`, body),
+		getWorkflowRun: (runId) => api(`${base}/actions/runs/${runId}`),
+		listDeploymentStatuses: (deploymentId) => api(`${base}/deployments/${deploymentId}/statuses?per_page=${RECEIPT_PAGE_SIZE}`),
+		listDeployments: () => api(`${base}/deployments?per_page=${RECEIPT_PAGE_SIZE}`),
+		listWorkflowRunJobs: (runId) => api(`${base}/actions/runs/${runId}/jobs?per_page=${RECEIPT_PAGE_SIZE}`)
+	};
+};
 //#endregion
 //#region src/production-impact.ts
-const PRODUCTION_IMPACT_DECISION_SCHEMA_VERSION = 1;
+/**
+* Production deployment demand (#1075, epic #1063).
+*
+* Two questions live here and they stay separate:
+*
+* 1. Per-change impact: does a delta touch a target? `computeImpactStamp`
+*    answers it for any two commits, and `candidate:impact` uses it for pull
+*    requests.
+* 2. Permission to withdraw a production deploy: may this candidate skip a
+*    target? Only the delta from the target's last trusted successful
+*    deployment receipt to the candidate can answer it. A push's before/after
+*    commits cannot, because a failed or cancelled push leaves its changes
+*    undeployed and the next push's diff does not contain them.
+*
+* Every doubt path keeps the target demanded. Only a trusted baseline that
+* is an ancestor of the candidate and whose delta provably misses the target
+* withdraws it, and only a trusted baseline that the candidate is an
+* ancestor of supersedes it.
+*/
+const PRODUCTION_IMPACT_DECISION_SCHEMA_VERSION = 2;
 const COMMIT_SHA_PATTERN = /^[0-9a-f]{40}$/iu;
 const ZERO_SHA_PATTERN = /^0{40}$/u;
+/**
+* A refusal this module states in its own fixed words. Only its message may
+* enter evidence; every other throw is reported by class as a code.
+*/
+var RefusalError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "RefusalError";
+	}
+};
+/**
+* Run git for this decision. A failure carries git's stderr, which is
+* unclassified text, so it is rethrown as the `git` transport code.
+*/
+const git = (cwd, args) => {
+	try {
+		return runCapture("git", args, cwd).stdout;
+	} catch {
+		throw new DeploymentReceiptTransportError("git");
+	}
+};
+/** The reason a refusal records: fixed words, a code, or a named class. */
+const refusalReason = (error) => {
+	if (error instanceof RefusalError) return error.message;
+	if (error instanceof DeploymentReceiptTransportError) return `transport error code: ${error.code}`;
+	if (error instanceof ImpactStampConfigError) return "impact declarations contradict the lockfile; run candidate:impact for the detail";
+	return "unclassified error";
+};
 const demandedTargets = (profile, reason) => (profile?.impact?.targets ?? []).map(({ name }) => ({
 	basis: reason,
 	name,
 	state: "demanded"
 }));
-const refusal = ({ after, before, profile, reason }) => ({
-	...after ? { afterSha: after } : {},
+const refusal = ({ candidate, profile, reason, stage }) => ({
 	basis: {
-		changedFiles: [],
 		classification: "refused",
 		reasons: [reason]
 	},
-	...before ? { beforeSha: before } : {},
+	...candidate !== void 0 && COMMIT_SHA_PATTERN.test(candidate) && !ZERO_SHA_PATTERN.test(candidate) ? { candidateSha: candidate.toLowerCase() } : {},
 	decision: "refused",
 	schemaVersion: PRODUCTION_IMPACT_DECISION_SCHEMA_VERSION,
+	...stage === void 0 ? {} : { stage },
 	targets: demandedTargets(profile, reason),
 	unsubscribedPaths: []
 });
 const assertCommitIdentity = (value, name) => {
-	if (value === void 0 || !COMMIT_SHA_PATTERN.test(value) || ZERO_SHA_PATTERN.test(value)) throw new Error(`${name} must be a non-zero 40-character commit SHA`);
+	if (value === void 0 || !COMMIT_SHA_PATTERN.test(value) || ZERO_SHA_PATTERN.test(value)) throw new RefusalError(`${name} must be a non-zero 40-character commit SHA`);
 	return value.toLowerCase();
 };
-const assertReachableCommit = (cwd, sha, name) => {
+const isReachableCommit = (cwd, sha) => {
 	try {
 		runCapture("git", [
 			"cat-file",
 			"-e",
 			`${sha}^{commit}`
 		], cwd);
+		return true;
 	} catch {
-		throw new Error(`${name} commit ${sha} is not reachable in this checkout`);
+		return false;
 	}
 };
+const assertCheckedOutCandidate = (cwd, candidate) => {
+	if (!isReachableCommit(cwd, candidate)) throw new RefusalError(`candidate commit ${candidate} is not reachable in this checkout`);
+	if (git(cwd, ["rev-parse", "HEAD"]).trim().toLowerCase() !== candidate) throw new RefusalError(`candidate commit ${candidate} is not the checked-out HEAD; refusing to mix commit identities with declarations from another tree`);
+};
+const identityFromEnv = () => {
+	const fromEnv = workflowRunIdentityFromEnv(process.env);
+	if ("invalid" in fromEnv) throw new RefusalError(`deployment receipts need a GitHub Actions run identity; missing or malformed: ${fromEnv.invalid.join(", ")}`);
+	return fromEnv.identity;
+};
+/**
+* The run identity and transport the decision reads receipts with. Both come
+* from the GitHub Actions environment and `gh` unless a test injects them.
+*/
+const resolveReceiptSource = (cwd, receipts) => {
+	const identity = receipts?.identity ?? identityFromEnv();
+	return {
+		identity,
+		transport: receipts?.transport ?? ghDeploymentReceiptTransport(cwd, identity.repository)
+	};
+};
+const outputState = (state) => state === "superseded" ? "withdrawn" : state;
 const writeGithubOutputs = (outputPath, decision) => {
 	appendFileSync(outputPath, `${[
 		`decision=${decision.decision}`,
 		`basis=${JSON.stringify(decision.basis)}`,
 		`unsubscribed_paths=${JSON.stringify(decision.unsubscribedPaths)}`,
-		...decision.targets.map((target) => `${productionImpactTargetOutput(target.name)}=${target.state}`)
+		...decision.targets.map((target) => `${productionImpactTargetOutput(target.name)}=${outputState(target.state)}`)
 	].join("\n")}\n`, "utf-8");
 };
+/** Classify the delta from one baseline to the candidate, once per distinct baseline. */
+const classifyDelta = ({ baseline, candidate, cwd, profile, profilePath }) => {
+	const changedFiles = [...new Set(filesFromNameStatus(git(cwd, [
+		"diff",
+		"--find-renames",
+		"--name-status",
+		baseline,
+		candidate
+	])))].toSorted();
+	const stamp = computeImpactStamp({
+		changedFiles,
+		profile,
+		profilePath: repositoryRelativeProfilePath({
+			cwd,
+			profilePath
+		}),
+		readLockfile: (side) => showFileAtRef(cwd, side === "base" ? baseline : candidate, LOCKFILE_PATH)
+	});
+	return {
+		changedFiles,
+		targets: new Map(stamp.targets.map((target) => [target.name, target.impact])),
+		unsubscribedPaths: stamp.unsubscribedPaths,
+		usable: stamp.basis === "target-scoped"
+	};
+};
+const resolveTargets = ({ candidate, cwd, identity, profile, profilePath, stage, transport }) => {
+	const deltas = /* @__PURE__ */ new Map();
+	const unsubscribedPaths = /* @__PURE__ */ new Set();
+	return {
+		targets: (profile.impact?.targets ?? []).map(({ name }) => {
+			const resolution = resolveDeploymentBaseline({
+				identity,
+				stage,
+				target: name,
+				transport
+			});
+			if (resolution.kind === "absent") return {
+				basis: `reconciliation demanded: ${resolution.reasons.join("; ")}`,
+				name,
+				state: "demanded"
+			};
+			const { baseline } = resolution;
+			const bound = {
+				baseline,
+				name
+			};
+			if (baseline.sha === candidate) return {
+				...bound,
+				basis: `trusted baseline ${baseline.sha} is the candidate; already deployed by run ${baseline.runId}`,
+				state: "withdrawn"
+			};
+			if (!isReachableCommit(cwd, baseline.sha)) return {
+				...bound,
+				basis: `reconciliation demanded: trusted baseline ${baseline.sha} is not reachable in this checkout`,
+				state: "demanded"
+			};
+			if (isAncestor(cwd, candidate, baseline.sha)) return {
+				...bound,
+				basis: `candidate ${candidate} is an ancestor of trusted baseline ${baseline.sha}; deploying would regress run ${baseline.runId}`,
+				state: "superseded"
+			};
+			if (!isAncestor(cwd, baseline.sha, candidate)) return {
+				...bound,
+				basis: `reconciliation demanded: trusted baseline ${baseline.sha} is not an ancestor of candidate ${candidate}`,
+				state: "demanded"
+			};
+			let delta = deltas.get(baseline.sha);
+			if (delta === void 0) {
+				delta = classifyDelta({
+					baseline: baseline.sha,
+					candidate,
+					cwd,
+					profile,
+					profilePath
+				});
+				deltas.set(baseline.sha, delta);
+			}
+			for (const unsubscribed of delta.unsubscribedPaths) unsubscribedPaths.add(unsubscribed);
+			const impact = delta.targets.get(name);
+			if (!delta.usable || impact === void 0) return {
+				...bound,
+				basis: `reconciliation demanded: delta from ${baseline.sha} is not target-scoped (conservative impact stamp)`,
+				changedFiles: delta.changedFiles,
+				state: "demanded"
+			};
+			return {
+				...bound,
+				basis: `delta from trusted baseline ${baseline.sha}: target-scoped impact stamp says ${impact}`,
+				changedFiles: delta.changedFiles,
+				state: impact === "not-affected" ? "withdrawn" : "demanded"
+			};
+		}),
+		unsubscribedPaths: [...unsubscribedPaths].toSorted()
+	};
+};
 /**
-* Recompute impact from one merge push's exact before/after commits. The
-* result may withdraw consumer work only; every doubt path returns a refused
-* decision whose known targets remain demanded.
+* Resolve production deployment demand for every declared target from its
+* trusted deployment baseline to the checked-out candidate. The result may
+* withdraw or supersede consumer work only through a usable decision; every
+* refusal keeps every known target demanded.
 */
 const runProductionImpact = (args) => {
 	const cwd = path.resolve(args.cwd ?? process.cwd());
@@ -19327,108 +19850,152 @@ const runProductionImpact = (args) => {
 	let profilePath;
 	let decision;
 	try {
-		const { path: loadedPath, profile: loadedProfile } = loadProjectProfile({
-			cwd,
-			profilePath: args.profilePath
-		});
-		profile = loadedProfile;
-		profilePath = loadedPath;
-		const before = assertCommitIdentity(args.before, "before");
-		const after = assertCommitIdentity(args.after, "after");
-		assertReachableCommit(cwd, before, "before");
-		assertReachableCommit(cwd, after, "after");
-		const checkedOutHead = runCapture("git", ["rev-parse", "HEAD"], cwd).stdout.trim().toLowerCase();
-		if (checkedOutHead !== after) throw new Error(`after commit ${after} is not the checked-out HEAD ${checkedOutHead}; refusing to mix commit identities with declarations from another tree`);
 		try {
-			runCapture("git", [
-				"merge-base",
-				"--is-ancestor",
-				before,
-				after
-			], cwd);
+			const { path: loadedPath, profile: loadedProfile } = loadProjectProfile({
+				cwd,
+				profilePath: args.profilePath
+			});
+			profile = loadedProfile;
+			profilePath = loadedPath;
 		} catch {
-			throw new Error(`before commit ${before} is not an ancestor of after commit ${after}`);
+			throw new RefusalError("project profile could not be loaded or validated; run psf doctor");
 		}
-		const changedFiles = [...new Set(filesFromNameStatus(runCapture("git", [
-			"diff",
-			"--find-renames",
-			"--name-status",
-			before,
-			after
-		], cwd).stdout))].toSorted();
-		const stamp = computeImpactStamp({
-			changedFiles,
+		const candidate = assertCommitIdentity(args.candidate, "candidate");
+		assertCheckedOutCandidate(cwd, candidate);
+		const { identity, transport } = resolveReceiptSource(cwd, args.receipts);
+		const resolved = resolveTargets({
+			candidate,
+			cwd,
+			identity,
 			profile,
-			profilePath: repositoryRelativeProfilePath({
-				cwd,
-				profilePath
-			}),
-			readLockfile: (side) => showFileAtRef(cwd, side === "base" ? before : after, LOCKFILE_PATH)
+			profilePath,
+			stage: args.stage,
+			transport
 		});
-		const core = {
-			afterSha: after,
-			beforeSha: before,
-			schemaVersion: PRODUCTION_IMPACT_DECISION_SCHEMA_VERSION,
-			unsubscribedPaths: stamp.unsubscribedPaths
-		};
-		decision = stamp.basis === "target-scoped" ? {
-			...core,
+		decision = {
 			basis: {
-				changedFiles,
-				classification: stamp.basis,
-				reasons: stamp.reasons
+				classification: "receipt-baseline",
+				reasons: [`resolved from trusted ${identity.workflowPath} deployment receipts in ${identity.repository}`]
 			},
+			candidateSha: candidate,
 			decision: "usable",
-			targets: stamp.targets.map((target) => ({
-				basis: target.basis,
-				name: target.name,
-				state: target.impact === "not-affected" ? "withdrawn" : "demanded"
-			}))
-		} : {
-			...core,
-			basis: {
-				changedFiles,
-				classification: stamp.basis,
-				reasons: stamp.reasons
-			},
-			decision: "refused",
-			targets: stamp.targets.map((target) => ({
-				basis: target.basis,
-				name: target.name,
-				state: "demanded"
-			}))
+			schemaVersion: PRODUCTION_IMPACT_DECISION_SCHEMA_VERSION,
+			...args.stage === void 0 ? {} : { stage: args.stage },
+			targets: resolved.targets,
+			unsubscribedPaths: resolved.unsubscribedPaths
 		};
 	} catch (error) {
 		decision = refusal({
-			after: args.after,
-			before: args.before,
+			candidate: args.candidate,
 			profile,
-			reason: `production impact classification refused: ${error instanceof Error ? error.message : String(error)}`
+			reason: `production impact classification refused: ${refusalReason(error)}`,
+			stage: args.stage
 		});
 	}
 	if (args.githubOutput) writeGithubOutputs(path.resolve(cwd, args.githubOutput), decision);
 	if (args.githubSummary) appendFileSync(path.resolve(cwd, args.githubSummary), `### Production impact\n\n${productionImpactSummaryLines(decision).join("\n")}\n`, "utf-8");
 	return decision;
 };
-const productionImpactSummaryLines = (decision) => decision.basis.classification === "refused" ? [
+const productionImpactSummaryLines = (decision) => decision.decision === "refused" ? [
 	"Production impact: refused; all consumer work remains demanded.",
 	...decision.basis.reasons,
 	unsubscribedPathsLine(void 0, "classification was refused")
-] : [`Production impact: ${decision.basis.classification}; ${decision.targets.filter(({ state }) => state === "demanded").length}/${decision.targets.length} target(s) demanded.`, unsubscribedPathsLine(decision.unsubscribedPaths)];
+] : [
+	`Production impact: ${decision.basis.classification}; ${decision.targets.filter(({ state }) => state === "demanded").length}/${decision.targets.length} target(s) demanded.`,
+	...decision.targets.map((target) => `- ${target.name}: ${target.state} — ${target.basis}`),
+	unsubscribedPathsLine(decision.unsubscribedPaths)
+];
+/**
+* The trusted baseline a `success` receipt for this candidate would
+* overwrite with an older revision, when one stands.
+*/
+const overwrittenBaseline = ({ candidate, cwd, identity, stage, target, transport }) => {
+	const standing = resolveDeploymentBaseline({
+		identity,
+		stage,
+		target,
+		transport
+	});
+	if (standing.kind === "trusted" && standing.baseline.sha !== candidate && isReachableCommit(cwd, standing.baseline.sha) && isAncestor(cwd, candidate, standing.baseline.sha)) return standing.baseline;
+};
+/**
+* Publish one target's deployment receipt for the checked-out candidate.
+* Consumers call it only after deployment and their health checks conclude;
+* a `success` receipt advances the target's baseline, a `failure` receipt
+* records the attempt and advances nothing.
+*/
+const runProductionReceipt = (args) => {
+	const cwd = path.resolve(args.cwd ?? process.cwd());
+	if (args.state !== "success" && args.state !== "failure") throw new RefusalError("--publish-receipt must be success or failure");
+	if (args.target === void 0 || args.target.length === 0) throw new RefusalError("--publish-receipt requires --target <name>");
+	const candidate = assertCommitIdentity(args.candidate, "candidate");
+	assertCheckedOutCandidate(cwd, candidate);
+	const { identity, transport } = resolveReceiptSource(cwd, args.receipts);
+	const { stage } = args;
+	const staleCandidate = args.state === "success" ? overwrittenBaseline({
+		candidate,
+		cwd,
+		identity,
+		stage,
+		target: args.target,
+		transport
+	}) : void 0;
+	const receipt = publishDeploymentReceipt({
+		identity,
+		sourceSha: candidate,
+		stage,
+		state: args.state,
+		target: args.target,
+		transport
+	});
+	if (args.githubOutput) appendFileSync(path.resolve(cwd, args.githubOutput), `${RECEIPT_DEPLOYMENT_ID_OUTPUT}=${receipt.deploymentId}\n`, "utf-8");
+	if (args.githubSummary) appendFileSync(path.resolve(cwd, args.githubSummary), `### Deployment receipt\n\n${productionReceiptSummaryLines({
+		receipt,
+		...staleCandidate ? { staleCandidate } : {}
+	}).join("\n")}\n`, "utf-8");
+	return {
+		receipt,
+		...staleCandidate ? { staleCandidate } : {}
+	};
+};
+const productionReceiptSummaryLines = (result) => [`Deployment receipt: ${result.receipt.state} for ${result.receipt.payload.target}${result.receipt.payload.stage ? ` stage ${result.receipt.payload.stage}` : ""} at ${result.receipt.payload.sourceSha} (deployment ${result.receipt.deploymentId}, run ${result.receipt.payload.workflow.runId}).`, ...result.staleCandidate ? [`Stale candidate: ${result.receipt.payload.sourceSha} is an ancestor of the previously trusted baseline ${result.staleCandidate.sha} (run ${result.staleCandidate.runId}); production now runs the older revision and needs reconciliation.`] : []];
 //#endregion
 //#region src/commands/production-impact.ts
-function createProductionImpactCommand(output) {
-	return markCwdOptionDefault(new Command("production:impact").description("Classify production targets from an exact merge-push before/after diff").option("--before <sha>", "merge-push before commit SHA").option("--after <sha>", "merge-push after commit SHA").option("--cwd <path>", "repository working directory", collectCwdOption).option("--profile <path>", "path to the project profile JSON file (default: software-factory.profile.json in --cwd)").option("--github-output <path>", "append stable decision outputs to a GitHub Actions output file").option("--github-summary <path>", "append a human-readable decision to a GitHub Actions summary file").option("--json", "print the complete decision as JSON").action((options) => {
+/**
+* `production:impact` has two modes on one command. Without
+* `--publish-receipt` it resolves deployment demand from receipts; with it,
+* it writes one target's receipt after the consumer deployed and checked
+* health. `receipts` is the test seam for the transport and run identity.
+*/
+function createProductionImpactCommand(output, receipts) {
+	return markCwdOptionDefault(new Command("production:impact").description("Resolve production deployment demand from trusted deployment receipts, or publish one").option("--candidate <sha>", "checked-out candidate commit SHA").option("--cwd <path>", "repository working directory", collectCwdOption).option("--profile <path>", "path to the project profile JSON file (default: software-factory.profile.json in --cwd)").option("--stage <name>", "deployment stage the receipts are bound to (optional)").option("--publish-receipt <state>", "publish a success or failure receipt for --target instead of deciding").option("--target <name>", "declared impact target the receipt names").option("--github-output <path>", "append stable decision outputs (or the published deployment_id) to a GitHub Actions output file").option("--github-summary <path>", "append a human-readable decision to a GitHub Actions summary file").option("--json", "print the complete decision as JSON").action((options) => {
+		const cwd = resolveCwdOption(options.cwd);
+		if (options.publishReceipt !== void 0) {
+			const result = runProductionReceipt({
+				candidate: options.candidate,
+				cwd,
+				githubOutput: options.githubOutput,
+				githubSummary: options.githubSummary,
+				receipts,
+				stage: options.stage,
+				state: options.publishReceipt,
+				target: options.target
+			});
+			output.stdout.write(options.json ? `${JSON.stringify(result, null, 2)}\n` : `${productionReceiptSummaryLines(result).join("\n")}\n`);
+			if (result.staleCandidate) throw new Error(`stale candidate ${result.receipt.payload.sourceSha} overwrote trusted baseline ${result.staleCandidate.sha}; reconcile the target`);
+			return;
+		}
+		if (options.target !== void 0) throw new Error("--target applies only with --publish-receipt");
 		const decision = runProductionImpact({
-			after: options.after,
-			before: options.before,
-			cwd: resolveCwdOption(options.cwd),
+			candidate: options.candidate,
+			cwd,
 			githubOutput: options.githubOutput,
 			githubSummary: options.githubSummary,
-			profilePath: options.profile
+			profilePath: options.profile,
+			receipts,
+			stage: options.stage
 		});
-		if (options.json) output.stdout.write(`${JSON.stringify(decision, null, 2)}\n`);
-		else output.stdout.write(`${productionImpactSummaryLines(decision).join("\n")}\n`);
+		output.stdout.write(options.json ? `${JSON.stringify(decision, null, 2)}\n` : `${productionImpactSummaryLines(decision).join("\n")}\n`);
 	}));
 }
 //#endregion