@patronage/software-factory 1.0.0-alpha.34 → 1.0.0-alpha.35

package/dist/index.js

@@ -6,6 +6,8 @@ import { z } from "zod";
 import { execFileSync, spawnSync } from "node:child_process";
 import * as nodeFs from "node:fs";
 import { appendFileSync, closeSync, constants, cpSync, existsSync, fsyncSync, mkdirSync, mkdtempSync, openSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statSync, unlinkSync, writeFileSync } from "node:fs";
+import { isDeepStrictEqual, promisify } from "node:util";
+import { FACTORY_APP_BROKER_ORIGIN, FACTORY_APP_BROKER_PATH, FACTORY_CURSOR_OIDC_AUDIENCE, FACTORY_PROOF_GATE_APP_ID, FACTORY_PROOF_GATE_STEP_NAME, GitHubApiError, mintInstallationToken, previewProofInventory, productionImpactTargetOutput, readVitestProfileDocument } from "@patronage/factory-ci";
 import { Buffer as Buffer$1 } from "node:buffer";
 import picomatch from "picomatch";
 import { link, lstat, mkdir, open, readFile, readdir, realpath, rename, stat, unlink } from "node:fs/promises";
@@ -14,13 +16,11 @@ import { setImmediate } from "node:timers";
 import { setImmediate as setImmediate$1, setTimeout as setTimeout$1 } from "node:timers/promises";
 import { Worker } from "node:worker_threads";
 import { parse } from "yaml";
-import { promisify } from "node:util";
-import { FACTORY_APP_BROKER_ORIGIN, FACTORY_APP_BROKER_PATH, FACTORY_CURSOR_OIDC_AUDIENCE, FACTORY_PROOF_GATE_APP_ID, FACTORY_PROOF_GATE_STEP_NAME, GitHubApiError, mintInstallationToken, previewProofInventory, productionImpactTargetOutput, readVitestProfileDocument } from "@patronage/factory-ci";
 import http from "node:http";
 import { pathToFileURL } from "node:url";
 //#region package.json
 var name = "@patronage/software-factory";
-var version = "1.0.0-alpha.34";
+var version = "1.0.0-alpha.35";
 //#endregion
 //#region src/cli-entry.ts
 /**
@@ -7082,1239 +7082,1351 @@ const RESOLVED_PR_VERIFY_MODES = new Set([
 ]);
 const isResolvedPrVerifyMode = (value) => RESOLVED_PR_VERIFY_MODES.has(value);
 //#endregion
-//#region src/pr-verify-check-payload.ts
+//#region src/catch-up-recognition-record.ts
+const objectShaSchema = z.string().regex(/^[0-9a-f]{40}$/u);
+const catchUpRecognitionSchema = z.object({
+	baseRef: z.string().min(1),
+	baseTipSha: objectShaSchema,
+	mergedParentSha: objectShaSchema,
+	mergedTreeSha: objectShaSchema,
+	upstreamRef: z.string().min(1)
+}).strict();
+//#endregion
+//#region src/policy-resolution.ts
+const COMMIT_SHA_PATTERN$3 = /^[0-9a-f]{40}$/u;
+const digestSchema = z.string().regex(/^[0-9a-f]{64}$/u);
 /**
-* Machine-readable binding carried on the `patronage-factory/pr-verify` check
-* run (#247), alongside the human-readable prose summary.
+* The authority resolved: the live tip of the PR's own base ref served a
+* parseable profile, and demand was resolved from the union of that policy and
+* the candidate's.
 *
-* It records *what was verified*, for the head SHA it was written for. It
-* grants nothing and gates nothing on its own: a consumer still has to verify
-* the producing App, the conclusion, and its own freshness rule. The payload
-* is a fenced JSON document in `output.text`.
-*/
-const PR_VERIFY_CHECK_PAYLOAD_KIND = "pr-verify-proof-binding";
-const PR_VERIFY_CHECK_PAYLOAD_SCHEMA_VERSION = 1;
-const OUTCOMES = ["aborted", "passed"];
-const isOutcome = (value) => OUTCOMES.includes(value);
-/**
-* The payload's outcome must agree with the check run's own conclusion, which
-* comes from `verifyProofPassed`: a proof with no recorded outcome is
-* unfinished (fail closed).
+* Every identity field is REQUIRED. A cross-stage reader compares these digests
+* to decide whether two stages judged the same candidate under the same policy;
+* an `authoritative` record with a digest missing would read to that reader as
+* "nothing disagrees", which is a silent downgrade of exactly the demand this
+* record exists to protect. `reason` is forbidden here — a resolved authority
+* has nothing to explain.
 */
-const outcomeFor$1 = (value) => isOutcome(value.outcome) ? value.outcome : "aborted";
-const asClassification = (value) => DIFF_CLASSIFICATIONS.includes(value) ? value : "unknown";
+const authoritativePolicyResolutionSchema = z.object({
+	/** sha256 of the canonical base `review` subtree. */
+	basePolicyDigest: digestSchema,
+	/** The PR's own base ref, whose live tip is the authority. */
+	baseRefName: z.string().min(1),
+	/** sha256 of the canonical candidate `review` subtree. */
+	candidatePolicyDigest: digestSchema,
+	/** sha256 of the merged (base ∪ candidate) protected-path set. */
+	effectiveDigest: digestSchema,
+	/** The base-ref tip the base policy was read at. */
+	policyBaseSha: z.string().regex(COMMIT_SHA_PATTERN$3),
+	/**
+	* Whether the candidate's `review` subtree differs from the base's. The
+	* digests prove which policies were read; this says whether they agreed,
+	* which is the fact that explains a demand the candidate's own profile
+	* would not have produced.
+	*/
+	reviewPolicyChanged: z.boolean(),
+	status: z.literal("authoritative")
+}).strict();
 /**
-* Project a local pr:verify proof onto the durable check-run payload. Accepts
-* `unknown` because the publisher is handed an opaque proof value; anything
-* unrecognizable degrades to `undefined` so the check run still publishes its
-* prose.
+* The authority could not be read, and `reason` says why — required, because an
+* unresolved record with no reason is an unactionable refusal. `pr:ready`
+* refuses before it writes a proof, so a Slice A ready proof never carries one;
+* this member is the recorded form of that refusal for the stages that carry it
+* forward.
 */
-const prVerifyCheckPayloadFor = (proof) => {
-	const value = proof;
-	if (!value || typeof value.headSha !== "string" || value.headSha.length === 0 || !isResolvedPrVerifyMode(value.mode)) return;
-	const carriesReleases = value.notRequiredCommands !== void 0;
-	return {
-		classification: asClassification(value.classification),
-		executedCommands: (value.executedCommands ?? []).map(({ name }) => name).filter((name) => typeof name === "string"),
-		headSha: value.headSha,
-		...carriesReleases && value.impactStamp !== void 0 ? { impactStamp: value.impactStamp } : {},
-		kind: PR_VERIFY_CHECK_PAYLOAD_KIND,
-		mode: value.mode,
-		...carriesReleases ? { notRequiredCommands: value.notRequiredCommands } : {},
-		outcome: outcomeFor$1(value),
-		proofSchemaVersion: typeof value.schemaVersion === "number" ? value.schemaVersion : 0,
-		schemaVersion: PR_VERIFY_CHECK_PAYLOAD_SCHEMA_VERSION,
-		...typeof value.patchId === "string" ? { patchId: value.patchId } : {},
-		...typeof value.repository === "string" ? { repository: value.repository } : {},
-		...carriesReleases && value.verificationCommands !== void 0 ? { verificationCommands: value.verificationCommands } : {}
-	};
-};
-const renderPrVerifyCheckPayloadText = (payload) => `\`\`\`json\n${JSON.stringify(payload, null, 2)}\n\`\`\``;
+const unresolvedPolicyResolutionSchema = z.object({
+	/** The base ref whose policy could not be read. */
+	baseRefName: z.string().min(1),
+	/** Why the authority is unresolved. */
+	reason: z.string().min(1),
+	status: z.literal("unresolved")
+}).strict();
+/** How a gate resolved the review policy it evaluated a candidate under. */
+const policyResolutionSchema = z.discriminatedUnion("status", [authoritativePolicyResolutionSchema, unresolvedPolicyResolutionSchema]);
 //#endregion
-//#region src/github-check-runs.ts
-const FACTORY_CHECK_NAMES = {
-	"pr-ready": "patronage-factory/pr-ready",
-	"pr-verify": "patronage-factory/pr-verify"
-};
-const hqLaneRefUrl = (base, repo, number) => `${base}/${encodeURIComponent(repo)}/${number}`;
+//#region src/verification-battery.ts
+const UNCONDITIONAL_BASIS = "unconditional: the profile declares no impactTarget for this command";
 /**
-* Fire-and-forget publication for a check run that is a *mirror* of a local
-* verdict — swallowing the failure cannot change what the gate decided.
+* The `vetoedTargets` contract, enforced at RUNTIME as well as at the type
+* level. TypeScript makes the parameter required for callers it compiles;
+* `new Set(undefined)` is a perfectly good empty set, so an untyped JavaScript
+* caller that omits it would otherwise scope exactly as if it had inspected
+* the envelopes and found nothing — the silent state requiring the parameter
+* exists to eliminate.
 *
-* Not every branded check is a mirror any more (#477). `patronage-factory/
-* pr-ready` is a source-pinned required check in the branch ruleset: a
-* swallowed failure there leaves a candidate armed, unmergeable, and — as epic
-* #473 wave 2 measured — with no rollup row saying why. So no `pr-ready`
-* publication comes through here at all: `pr:ready` publishes once, completed,
-* through {@link ensureFactoryCheckRunPublished}, whose result the caller
-* reads. It used to publish an in-progress run here while hosted checks
-* settled, on the reasoning that a missing in-progress check cannot green
-* anything — true, and beside the point, because a *present* one cannot be
-* un-blocked and nothing ever completed it (#526).
-*/
-function publishFactoryCheckSafely(publisher, input) {
-	try {
-		publisher?.(input);
-	} catch (error) {
-		console.warn(`${FACTORY_CHECK_NAMES[input.gate]} proof mirror failed without affecting the gate: ${error instanceof Error ? error.message : String(error)}`);
-	}
-}
-/**
-* The detached, fire-and-forget publisher does not retry: it runs on a tail the
-* process may never await, so sleeping there buys no durability. Reliability is
-* bought on the awaited path (`ensureFactoryCheckRunPublished`), which the
-* composed `pr:publish` flow runs once the head SHA is on GitHub.
-*/
-const DEFAULT_CHECK_RUN_RETRY = {
-	attempts: 1,
-	delayMs: 0
-};
-/**
-* The awaited path blocks `pr:publish`, so it is bounded twice: by attempts and
-* by a wall-clock budget. Publication can no longer fail the gate; it must not
-* be able to hang it either.
+* A malformed CALL is API misuse, not data doubt: it fails loudly (ADR 0024)
+* rather than degrading to the conservative floor, because a producer that
+* never resolved the veto set has a bug its author must see.
 */
-const DURABLE_CHECK_RUN_RETRY = {
-	attempts: 3,
-	budgetMs: 2e4,
-	delayMs: 750
-};
-const defaultSleep = async (ms) => {
-	const { setTimeout: delay } = await import("node:timers/promises");
-	await delay(ms);
+const assertVetoedTargets = (vetoedTargets, caller) => {
+	if (!Array.isArray(vetoedTargets)) throw new TypeError(`${caller} requires vetoedTargets: the target names with a current, candidate-bound FAILING envelope. Resolve it with boundFailingCheckNames and pass the result; pass [] to mean "inspected the envelopes and found no bound failure". It has no default because omitting it would silently scope work whose standing demand nothing on this head could meet.`);
 };
 /**
-* Worth another attempt: 422 is what GitHub answers for a head SHA it has not
-* seen yet (the whole reason the retry exists), 5xx and rate limiting are
-* transient, and a thrown non-HTTP error is a network/timeout failure. A 401 /
-* 403 / 404 means the credentials or installation are wrong, and retrying that
-* only burns the caller's time budget.
+* Plan one verification battery against the candidate's impact stamp.
+*
+* Pure and total: it makes a decision, it never reads a proof, a profile file,
+* or the filesystem, and no INPUT can make it throw — every doubt path is a
+* decision, not an exception. A malformed CALL is the one exception to that,
+* and deliberately so: omitting `vetoedTargets` is API misuse rather than data
+* doubt, and it throws (see {@link assertVetoedTargets}).
+*
+* `stamp` must already be trusted by
+* the caller — inside `pr:verify` that is the stamp just computed for this
+* candidate's own identity triple; anywhere else it is `trustedImpactStamp`'s
+* output or `undefined`.
 */
-const isRetryableCheckRunFailure = (error) => {
-	if (!(error instanceof GitHubApiError)) return true;
-	return error.status === 422 || error.status === 429 || error.status >= 500;
+const planVerificationBattery = ({ commands, stamp, vetoedTargets }) => {
+	assertVetoedTargets(vetoedTargets, "planVerificationBattery");
+	const vetoed = new Set(vetoedTargets);
+	const dispositions = [];
+	const execute = [];
+	const notRequired = [];
+	for (const command of commands) {
+		const { impactTarget, name } = command;
+		if (impactTarget === void 0) {
+			dispositions.push({
+				basis: UNCONDITIONAL_BASIS,
+				disposition: "executed",
+				name
+			});
+			execute.push(command);
+			continue;
+		}
+		const decision = impactStampScopeDecision({
+			stamp,
+			surface: "verification-battery",
+			targetName: impactTarget
+		});
+		const vetoedHere = decision.scoped && vetoed.has(impactTarget);
+		const basis = vetoedHere ? `veto: a current envelope bound to this candidate records target "${impactTarget}" as FAILING, so the stamp's release is withheld (${decision.reason})` : decision.reason;
+		const scoped = decision.scoped && !vetoedHere;
+		dispositions.push({
+			basis,
+			disposition: scoped ? "not-required" : "executed",
+			impactTarget,
+			name
+		});
+		if (scoped) notRequired.push({
+			basis,
+			impactTarget,
+			name
+		});
+		else execute.push(command);
+	}
+	return {
+		dispositions,
+		execute,
+		notRequired
+	};
 };
 /**
-* The pre-push state of the detached `pr:verify` publisher: GitHub 422s a check
-* run whose `head_sha` it has never seen.
+* The completeness invariant as an enforceable control (ADR 0024: controls
+* fail loudly), shared by both pr:verify proof schemas so they cannot drift.
 *
-* Scoped to `pr:verify` because that is the gate whose proof `pr:publish`
-* rebinds after the push (`republishVerifyProofCheckRun`); the other gates run
-* against a head GitHub already has.
+* Four rules:
+*  1. A withheld command names one the resolved mode actually selected.
+*  2. A command is never recorded as both executed and not-required.
+*  3. Withheld commands are distinct — a duplicated disposition would let one
+*     name carry two different bases.
+*  4. On a PASSED proof, every selected command has a disposition: silence is
+*     not a disposition, and "absent from both lists" is exactly the silent
+*     skip this epic forbids.
 *
-* Scoped to a *successful* verification because `pr:verify` also publishes this
-* gate from its aborted path (`writePartialProof`, `pr-verify.ts`), which 422s
-* pre-push in exactly the same way. That proof is incomplete — applicability
-* classifies it `typed-aborted` and readiness answers "re-run pr:verify" — so
-* telling the operator it is stored and needs no rerun would be false in every
-* clause, and false in the expensive direction. A failed verification keeps the
-* plain diagnostic (#316).
-*/
-const isPrePushVerifyBinding = (input, error) => input.gate === "pr-verify" && input.conclusion === "success" && error instanceof GitHubApiError && error.status === 422;
-/**
-* What to tell an operator when the head SHA is not on GitHub yet.
+* Rule 4 is scoped to `outcome: "passed"` because an ABORTED proof legitimately
+* records partial execution — the run stopped at the failing command.
 *
-* Reported as a bare "unable to post check run", this reads as a defect to
-* chase rather than the ordinary pre-push state, and on PR #314 it prompted a
-* second full verification after the push — every command re-run for nothing.
-* The proof is already written and `pr:publish` binds it to this same commit
-* with no re-execution, so say that instead (#316).
+* The check is one-directional on purpose. Every SELECTED command must be
+* accounted for, but `executedCommands` may legitimately carry MORE than the
+* profile selected — full mode appends the `workspace:install-resolves` probe,
+* which is real work no profile declares.
 */
-const prePushVerifyBindingNotice = (sha) => `${FACTORY_CHECK_NAMES["pr-verify"]}: commit ${sha.slice(0, 7)} is not on GitHub yet, so there is no commit to bind the check to. That is the normal state before the branch is pushed, not a failure.
-The proof is complete and stored. After you push, pr:publish binds this check to the same commit and reuses that proof — no verification command runs again.
-Re-verify only if the tree changes: a new commit, an amend, or a rebase.
-`;
+const assertBatteryCompleteness = (proof, context) => {
+	const selected = proof.verificationCommands.map((command) => command.name);
+	const selectedSet = new Set(selected);
+	const executed = new Set((proof.executedCommands ?? []).map((command) => command.name));
+	const notRequired = proof.notRequiredCommands ?? [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const [index, entry] of notRequired.entries()) {
+		if (!selectedSet.has(entry.name)) context.addIssue({
+			code: "custom",
+			message: `notRequiredCommands entry "${entry.name}" is not one of this proof's verificationCommands.`,
+			path: [
+				"notRequiredCommands",
+				index,
+				"name"
+			]
+		});
+		if (executed.has(entry.name)) context.addIssue({
+			code: "custom",
+			message: `Command "${entry.name}" is recorded both as executed and as not-required.`,
+			path: [
+				"notRequiredCommands",
+				index,
+				"name"
+			]
+		});
+		if (seen.has(entry.name)) context.addIssue({
+			code: "custom",
+			message: `notRequiredCommands records "${entry.name}" more than once.`,
+			path: [
+				"notRequiredCommands",
+				index,
+				"name"
+			]
+		});
+		seen.add(entry.name);
+	}
+	if (proof.outcome !== "passed") return;
+	const disposed = new Set([...executed, ...seen]);
+	const undisposed = selected.filter((name) => !disposed.has(name));
+	if (undisposed.length > 0) context.addIssue({
+		code: "custom",
+		message: `A passed pr:verify proof must give every selected verification command a disposition; [${undisposed.join(", ")}] appear in verificationCommands but in neither executedCommands nor notRequiredCommands.`,
+		path: ["executedCommands"]
+	});
+};
 /**
-* Mint an installation token for the Patronage Factory App.
+* The stamp-authorization control: a passed proof may only claim a command
+* was NOT REQUIRED if its own recorded stamp says so.
 *
-* The mechanism — app JWT, installation lookup, token exchange — lives in
-* `@patronage/factory-ci` (#617), because paitronage's proof-comment publisher
-* had grown a second copy of it. What stays here is what is this repository's:
-* where the credentials come from (`user-config`), and the publish timeout the
-* rest of these calls are bound by. Nothing is cached, as before.
+* `assertBatteryCompleteness` proves the two lists partition the selected
+* commands — that no command is silently absent. It does not prove the
+* withholding was EARNED. Without this rule a proof could name every expensive
+* command in `notRequiredCommands`, carry no stamp at all (or a conservative
+* one), and still read as full verification: the omission would be recorded,
+* accounted for, and completely unauthorized.
 *
-* Retry budget is the caller's. The fire-and-forget publisher passes one
-* attempt because it already has a commit-status fallback (#938). The
-* confirmation read-back leaves the default, because it has no fallback and
-* a stale keep-alive is the class #923 covers.
+* Two things have to hold, and the first is what keeps the second honest:
+*
+*  1. COHERENCE. The entry's `impactTarget` must equal the `impactTarget` the
+*     proof records for that same command in `verificationCommands`. The entry
+*     does not get to nominate its own target; the proof's command→target
+*     mapping (written by `pr:verify` from the loaded profile) does. Without
+*     this, authorization validates a self-reported field and a crafted proof
+*     can withhold an affected command while pointing at an unrelated released
+*     target.
+*  2. AUTHORIZATION. That recorded target must be one the proof's own stamp
+*     provably released.
+*
+* The proof is one artifact and a determined forger controls all of it; this
+* is internal-coherence belt-and-braces in the same trust domain as the rest
+* of the proof, and write-time truth stays `pr:verify`'s job.
+*
+* The authorizing evidence is the proof's OWN `impactStamp` — the same stamp
+* `pr:verify` computed for this candidate's identity triple and recorded here,
+* so authorization is bound to the same identities the proof binds. The
+* predicate is the shared {@link impactStampScopeDecision}, not a second
+* reading of the stamp: an entry is authorized exactly when the stamp would
+* have released that target's command in the first place (target-scoped
+* basis, this build's stamp version, exactly one row for the target,
+* `not-affected`). A conservative stamp, an unknown version, a
+* self-contradictory stamp, an unclassified name, or an `affected` verdict all
+* fail the same way scoping itself would.
+*
+* Scoped to `outcome: "passed"` for the same reason as the completeness rule:
+* an aborted run records partial execution, so it makes no false completeness
+* claim.
+*/
+const assertNotRequiredStampAuthorization = (proof, context) => {
+	const notRequired = proof.notRequiredCommands ?? [];
+	if (proof.outcome !== "passed" || notRequired.length === 0) return;
+	const { impactStamp } = proof;
+	if (impactStamp === void 0) {
+		context.addIssue({
+			code: "custom",
+			message: `A passed pr:verify proof that withholds verification commands must record the impact stamp that authorized the withholding; [${notRequired.map((entry) => entry.name).join(", ")}] are recorded not-required by a proof carrying no impactStamp.`,
+			path: ["impactStamp"]
+		});
+		return;
+	}
+	const recordedTargets = new Map(proof.verificationCommands.map((command) => [command.name, command.impactTarget]));
+	for (const [index, entry] of notRequired.entries()) {
+		const recorded = recordedTargets.get(entry.name);
+		if (recorded !== entry.impactTarget) {
+			context.addIssue({
+				code: "custom",
+				message: recorded === void 0 ? `notRequiredCommands entry "${entry.name}" claims impactTarget "${entry.impactTarget}", but this proof records no impactTarget for that command; only a command the profile scopes can be withheld.` : `notRequiredCommands entry "${entry.name}" claims impactTarget "${entry.impactTarget}", but this proof records impactTarget "${recorded}" for that command.`,
+				path: [
+					"notRequiredCommands",
+					index,
+					"impactTarget"
+				]
+			});
+			continue;
+		}
+		const decision = impactStampScopeDecision({
+			stamp: impactStamp,
+			surface: "verification-battery",
+			targetName: entry.impactTarget
+		});
+		if (!decision.scoped) context.addIssue({
+			code: "custom",
+			message: `notRequiredCommands entry "${entry.name}" is not authorized by this proof's impactStamp: ${decision.reason}.`,
+			path: [
+				"notRequiredCommands",
+				index,
+				"impactTarget"
+			]
+		});
+	}
+};
+/** Console lines naming every withheld command and why. Never silent. */
+const batteryScopeSummaryLines = (plan) => {
+	if (plan.notRequired.length === 0) return [];
+	return ["Verification battery scoped by the impact stamp (not-required):", ...plan.notRequired.map((entry) => `- ${entry.name} (${entry.impactTarget}): ${entry.basis}`)];
+};
+//#endregion
+//#region src/pr-verify-proof-rules.ts
+const assertPrVerifyProofRules = (proof, context) => {
+	if (proof.notDemandedRecords !== void 0 && proof.impactStamp === void 0) context.addIssue({
+		code: "custom",
+		message: "notDemandedRecords requires impactStamp; package-level not-demanded records are bound to the stamp identity.",
+		path: ["notDemandedRecords"]
+	});
+	assertBatteryCompleteness(proof, context);
+	assertNotRequiredStampAuthorization(proof, context);
+};
+/**
+* The pr:verify proof versions a reader accepts: the current one only (#920
+* item 1). #917 narrowed the pr:ready reader the same way. A pr:verify proof
+* is per-candidate and short-lived — it is rewritten on every head — so no
+* stored v1–v3 proof can outlive the release that drops it. Pre-1.0 posture
+* applies: one current contract, no compat reader. A consumer on an older
+* factory must adopt this release before HQ ingests its pr:verify proofs.
+*/
+const SUPPORTED_PR_VERIFY_SCHEMA_VERSIONS = [4];
+const prVerifyTestFailureSchema = z.object({
+	file: z.string().min(1),
+	kind: z.enum([
+		"assertion",
+		"error",
+		"timeout"
+	]),
+	title: z.string().min(1)
+});
+const executedCommandSchema = z.object({
+	command: z.string().min(1),
+	counts: z.object({
+		testFiles: z.number().nonnegative().optional(),
+		tests: z.number().nonnegative().optional()
+	}).optional(),
+	durationMs: z.number().nonnegative(),
+	exitCode: z.number(),
+	failures: z.array(prVerifyTestFailureSchema).min(1).optional(),
+	name: z.string().min(1),
+	scope: z.enum([
+		"docs-only",
+		"trivial",
+		"full"
+	])
+});
+const notRequiredCommandSchema = z.object({
+	basis: z.string().min(1),
+	impactTarget: z.string().min(1),
+	name: z.string().min(1)
+});
+const notDemandedRecordSchema = z.object({
+	basis: z.string().min(1),
+	name: z.string().min(1)
+});
+const prVerifySchemaVersionSchema = z.literal(4);
+const prVerifyProofSchema = z.object({
+	authoringSession: z.string().trim().min(1),
+	base: z.string().min(1),
+	baseSha: z.string().regex(/^[0-9a-f]{40}$/u).optional(),
+	baselineFullProofs: z.array(z.object({
+		base: z.string().min(1),
+		changedFiles: z.array(z.string()),
+		headSha: z.string().regex(/^[0-9a-f]{40}$/u),
+		profilePath: z.string().min(1),
+		projectKey: z.string().min(1),
+		repository: z.string().min(1)
+	})).optional(),
+	catchUpRecognition: catchUpRecognitionSchema.optional(),
+	changedFiles: z.array(z.string()),
+	classification: z.enum([
+		"docs/process-only",
+		"trivial",
+		"non-trivial"
+	]),
+	classificationReasons: z.array(z.string()),
+	command: z.literal("patronage-factory pr:verify"),
+	durationMs: z.number().nonnegative(),
+	endedAt: z.iso.datetime(),
+	executedCommands: z.array(executedCommandSchema).optional(),
+	headSha: z.string().regex(/^[0-9a-f]{40}$/u),
+	impactStamp: impactStampSchema.optional(),
+	mergeBaseSha: z.string().regex(/^[0-9a-f]{40}$/u).optional(),
+	mode: z.enum([
+		"docs-only",
+		"trivial",
+		"full"
+	]),
+	notDemandedRecords: z.array(notDemandedRecordSchema).min(1).optional(),
+	notRequiredCommands: z.array(notRequiredCommandSchema).min(1).optional(),
+	outcome: z.enum(["aborted", "passed"]).optional(),
+	patchId: z.string().regex(/^[0-9a-f]{40}$/u).optional(),
+	policyResolution: policyResolutionSchema.optional(),
+	profilePath: z.string().min(1),
+	projectKey: z.string().min(1),
+	repository: z.string().min(1),
+	schemaVersion: prVerifySchemaVersionSchema,
+	startedAt: z.iso.datetime(),
+	verificationCommands: z.array(z.object({
+		command: z.string().min(1),
+		description: z.string().min(1),
+		impactTarget: z.string().min(1).optional(),
+		name: z.string().min(1),
+		scope: z.enum([
+			"docs-only",
+			"trivial",
+			"full"
+		])
+	}))
+}).superRefine(assertPrVerifyProofRules);
+function validatePrVerifyProof(value) {
+	return prVerifyProofSchema.parse(value);
+}
+//#endregion
+//#region src/pr-verify-check-payload.ts
+/**
+* Machine-readable binding carried on the `patronage-factory/pr-verify` check
+* run (#247), alongside the human-readable prose summary.
+*
+* It records *what was verified*, for the head SHA it was written for. It
+* grants nothing and gates nothing on its own: a consumer still has to verify
+* the producing App, the conclusion, and its own freshness rule. The payload
+* is a fenced JSON document in `output.text`.
+*/
+const PR_VERIFY_CHECK_PAYLOAD_KIND = "pr-verify-proof-binding";
+const PR_VERIFY_CHECK_PAYLOAD_SCHEMA_VERSION = 1;
+const OUTCOMES = ["aborted", "passed"];
+const isOutcome = (value) => OUTCOMES.includes(value);
+/**
+* The payload's outcome must agree with the check run's own conclusion, which
+* comes from `verifyProofPassed`: a proof with no recorded outcome is
+* unfinished (fail closed).
+*/
+const outcomeFor$1 = (value) => isOutcome(value.outcome) ? value.outcome : "aborted";
+const asClassification = (value) => DIFF_CLASSIFICATIONS.includes(value) ? value : "unknown";
+/**
+* Project a local pr:verify proof onto the durable check-run payload. Accepts
+* `unknown` because the publisher is handed an opaque proof value; anything
+* unrecognizable degrades to `undefined` so the check run still publishes its
+* prose.
 */
-const installationToken = (repository, config, request, now, budget = {}) => mintFactoryInstallationToken(repository, config, request, now, {
-	timeoutMs: budget.timeoutMs ?? 5e3,
-	...budget.transportAttempts === void 0 ? {} : { transportAttempts: budget.transportAttempts }
-});
-function verifyOutput(proof) {
+const prVerifyCheckPayloadFor = (proof) => {
 	const value = proof;
-	const commands = value.executedCommands?.length ?? 0;
-	const payload = prVerifyCheckPayloadFor(proof);
-	return {
-		summary: `Schema v${value.schemaVersion}; mode **${value.mode ?? "unknown"}**; classification **${value.classification ?? "unknown"}**; outcome **${value.outcome ?? "unknown"}**; ${commands} command(s) executed. ${unsubscribedPathsLine(value.impactStamp?.unsubscribedPaths)}`,
-		...payload ? { text: renderPrVerifyCheckPayloadText(payload) } : {},
-		title: `pr:verify ${value.outcome ?? "unknown"}`
+	if (!value || typeof value.headSha !== "string" || value.headSha.length === 0 || !isResolvedPrVerifyMode(value.mode)) return;
+	const carriesReleases = value.notRequiredCommands !== void 0;
+	const payload = {
+		classification: asClassification(value.classification),
+		executedCommands: (value.executedCommands ?? []).map(({ name }) => name).filter((name) => typeof name === "string"),
+		headSha: value.headSha,
+		...carriesReleases && value.impactStamp !== void 0 ? { impactStamp: value.impactStamp } : {},
+		kind: PR_VERIFY_CHECK_PAYLOAD_KIND,
+		mode: value.mode,
+		...carriesReleases ? { notRequiredCommands: value.notRequiredCommands } : {},
+		outcome: outcomeFor$1(value),
+		proofSchemaVersion: typeof value.schemaVersion === "number" ? value.schemaVersion : 0,
+		schemaVersion: PR_VERIFY_CHECK_PAYLOAD_SCHEMA_VERSION,
+		...typeof value.patchId === "string" ? { patchId: value.patchId } : {},
+		...typeof value.repository === "string" ? { repository: value.repository } : {},
+		...carriesReleases && value.verificationCommands !== void 0 ? { verificationCommands: value.verificationCommands } : {}
 	};
-}
-/**
-* The refusals to name, preferring the attributed projection (#391) so each
-* line carries its demand code. `blockingReasons` is the fallback because the
-* throwing path in `pr:ready` publishes a proof that carries only that field.
-* The two projections hold the same refusals in the same order, so reading
-* either one tells the same story.
-*/
-const readyReasonLines = (value) => {
-	const named = value.blockedReasons ?? [];
-	if (named.length > 0) return named.map((reason) => ({
-		...reason.code === void 0 ? {} : { code: reason.code },
-		detail: reason.detail ?? "unrecorded"
-	}));
-	return (value.blockingReasons ?? []).map((reason) => ({ detail: typeof reason === "string" ? reason : "unrecorded" }));
+	try {
+		const verificationProof = validatePrVerifyProof(proof);
+		const transported = {
+			...payload,
+			verificationProof
+		};
+		if (new TextEncoder().encode(renderPrVerifyCheckPayloadText(transported)).length <= 6e4) return transported;
+	} catch {}
+	return payload;
 };
-const readyReasonBlock = (reasons) => {
-	return `\n\n${reasons.length === 1 ? "1 blocking reason:" : `${reasons.length} blocking reasons:`}\n\n${reasons.map((reason) => `- ${reason.code === void 0 ? "" : `**${reason.code}** — `}${reason.detail}`).join("\n")}`;
+const readTransportedVerifyProof = (value, text) => {
+	if (value === void 0 || new TextEncoder().encode(text).length > 6e4) return {};
+	return { verificationProof: validatePrVerifyProof(value) };
 };
-const readyIdentityField = (value) => value === void 0 || value.trim().length === 0 ? "unrecorded" : `\`${value}\``;
 /**
-* #1037: the review identity the proof already records, printed where the
-* merge decision is made. `pr:ready` recorded the review session, model, and
-* producer, and the authoring session it was checked against, but only the PR
-* body prose showed them — so a human merging from the checks page could not
-* see which model produced the review that admitted the candidate.
-*
-* This is recording made visible, not a control. The attended merge is the
-* control.
+* Parse the binding back out of check-run `output.text` (preferred) or
+* `output.summary`. Absence / unparseable / wrong shape ⇒ `undefined`, so a
+* consumer fails closed to "no proof" rather than to a partial record.
 */
-const readyIdentityBlock = (value) => {
-	const runs = value.ledger?.reviewRuns ?? [];
-	if (runs.length === 0 && value.authoringSession === void 0) return "";
-	return `\n\nRecorded review identity:\n\n${[...runs.map((run) => {
-		const rung = run.rung === void 0 ? "" : ` at rung \`${run.rung}\``;
-		return `- ${run.kind ?? "review"}${rung}: session ${readyIdentityField(run.sessionId)} · model ${readyIdentityField(run.model)} · producer ${readyIdentityField(run.producer)}`;
-	}), `- authoring session: ${readyIdentityField(value.authoringSession)}`].join("\n")}`;
+const parsePrVerifyCheckPayload = (text) => {
+	if (!text?.trim()) return;
+	const candidate = (text.match(/```(?:json)?\s*(?<body>[\s\S]*?)```/u)?.groups?.body ?? text).trim();
+	try {
+		const parsed = JSON.parse(candidate);
+		if (parsed.schemaVersion !== PR_VERIFY_CHECK_PAYLOAD_SCHEMA_VERSION || parsed.kind !== "pr-verify-proof-binding" || typeof parsed.headSha !== "string" || parsed.headSha.length === 0 || !isResolvedPrVerifyMode(parsed.mode) || !isOutcome(parsed.outcome)) return;
+		return {
+			...readTransportedVerifyProof(parsed.verificationProof, text),
+			classification: asClassification(parsed.classification),
+			executedCommands: (parsed.executedCommands ?? []).filter((name) => typeof name === "string"),
+			headSha: parsed.headSha,
+			...parsed.impactStamp === void 0 ? {} : { impactStamp: parsed.impactStamp },
+			kind: PR_VERIFY_CHECK_PAYLOAD_KIND,
+			mode: parsed.mode,
+			...parsed.notRequiredCommands === void 0 ? {} : { notRequiredCommands: parsed.notRequiredCommands },
+			outcome: parsed.outcome,
+			proofSchemaVersion: typeof parsed.proofSchemaVersion === "number" ? parsed.proofSchemaVersion : 0,
+			schemaVersion: PR_VERIFY_CHECK_PAYLOAD_SCHEMA_VERSION,
+			...typeof parsed.patchId === "string" ? { patchId: parsed.patchId } : {},
+			...typeof parsed.repository === "string" ? { repository: parsed.repository } : {},
+			...parsed.verificationCommands === void 0 ? {} : { verificationCommands: parsed.verificationCommands }
+		};
+	} catch {}
 };
-function readyOutput(proof) {
-	const value = proof;
-	const reasons = readyReasonLines(value);
-	return {
-		summary: `${`Schema v${value.schemaVersion}; readiness verdict **${value.status ?? "unknown"}**;${reasons.length === 0 ? " no blocking reasons;" : ""} ledger head \`${value.ledger?.headSha ?? "unknown"}\`.`}${reasons.length === 0 ? "" : readyReasonBlock(reasons)}${readyIdentityBlock(value)}`,
-		title: `pr:ready ${value.status ?? "unknown"}`
-	};
-}
-function factoryCheckOutput(gate, proof) {
-	return {
-		"pr-ready": readyOutput,
-		"pr-verify": verifyOutput
-	}[gate](proof);
-}
-async function runGhDetails(args, cwd) {
-	const { execFile } = await import("node:child_process");
-	const { stdout } = await promisify(execFile)("gh", args, {
-		cwd,
-		encoding: "utf-8",
-		timeout: GITHUB_PUBLISH_TIMEOUT_MS
-	});
-	return stdout;
-}
-async function resolveFactoryDetailsUrl(input, run = runGhDetails) {
-	const hqBase = input.hqLaneBaseUrl;
-	if (hqBase !== void 0 && input.pr !== void 0) return hqLaneRefUrl(hqBase, input.repo, input.pr);
-	const raw = await run([
-		"pr",
-		"view",
-		...input.pr === void 0 ? [] : [
-			String(input.pr),
-			"--repo",
-			`${input.owner}/${input.repo}`
-		],
-		"--json",
-		"comments,number,url"
-	], input.cwd);
-	const pr = JSON.parse(raw);
-	if (hqBase !== void 0 && typeof pr.number === "number") return hqLaneRefUrl(hqBase, input.repo, pr.number);
-	return (pr.comments?.find((comment) => comment.body?.includes("patronage-factory-readiness-ledger:start")))?.url ?? pr.url ?? `https://github.com/${input.owner}/${input.repo}/commit/${input.sha}`;
-}
-const checkRunRequestBody = (input, detailsUrl) => {
-	const status = input.status ?? "completed";
-	return {
-		...status === "completed" ? { conclusion: input.conclusion } : {},
-		details_url: detailsUrl,
-		head_sha: input.sha,
-		name: FACTORY_CHECK_NAMES[input.gate],
-		output: factoryCheckOutput(input.gate, input.proof),
-		status
-	};
+const renderPrVerifyCheckPayloadText = (payload) => `\`\`\`json\n${JSON.stringify(payload, null, 2)}\n\`\`\``;
+//#endregion
+//#region src/github-check-runs.ts
+const FACTORY_CHECK_NAMES = {
+	"pr-ready": "patronage-factory/pr-ready",
+	"pr-verify": "patronage-factory/pr-verify"
 };
+const hqLaneRefUrl = (base, repo, number) => `${base}/${encodeURIComponent(repo)}/${number}`;
 /**
-* POST the check run, retrying a bounded number of times.
-*
-* The retry exists for one specific failure: GitHub rejects a check run whose
-* `head_sha` it has not seen. `pr:verify` routinely runs before the branch is
-* pushed, and even after a push the commit can take a moment to be visible.
-* Without a retry the POST 422s, falls through to a commit status that 422s
-* too, and the run reads as "verification did not happen" (#247).
-*
-* Retries are bounded three ways: a maximum attempt count, an optional
-* wall-clock budget, and retryability of the failure itself — a 401/403/404
-* means the credentials are wrong, and re-sending them cannot help.
+* Fire-and-forget publication for a check run that is a *mirror* of a local
+* verdict — swallowing the failure cannot change what the gate decided.
 *
-* Throws the last error when every attempt fails; callers decide whether to
-* fall back or to swallow. Returns the created check run, whose `id` is the
-* only handle on *which* run this call produced — what the read-back below
-* requires the served run to be.
+* Not every branded check is a mirror any more (#477). `patronage-factory/
+* pr-ready` is a source-pinned required check in the branch ruleset: a
+* swallowed failure there leaves a candidate armed, unmergeable, and — as epic
+* #473 wave 2 measured — with no rollup row saying why. So no `pr-ready`
+* publication comes through here at all: `pr:ready` publishes once, completed,
+* through {@link ensureFactoryCheckRunPublished}, whose result the caller
+* reads. It used to publish an in-progress run here while hosted checks
+* settled, on the reasoning that a missing in-progress check cannot green
+* anything — true, and beside the point, because a *present* one cannot be
+* un-blocked and nothing ever completed it (#526).
 */
-async function postFactoryCheckRun({ config, deadlineMs, dependencies, detailsUrl, input, remainingAttempts }) {
-	const { attempts, budgetMs, delayMs } = dependencies.retry ?? DEFAULT_CHECK_RUN_RETRY;
-	const clock = dependencies.now ?? Date.now;
-	const remaining = remainingAttempts ?? Math.max(1, attempts);
-	const deadline = deadlineMs ?? (budgetMs === void 0 ? void 0 : clock() + budgetMs);
-	const request = dependencies.fetch ?? fetch;
-	const timeoutMs = dependencies.timeoutMs ?? 5e3;
+function publishFactoryCheckSafely(publisher, input) {
 	try {
-		const token = dependencies.token ?? await installationToken(input, config, request, (dependencies.now ?? Date.now)(), {
-			timeoutMs,
-			transportAttempts: 1
-		});
-		return await requestGitHubJson(request, `https://api.github.com/repos/${input.owner}/${input.repo}/check-runs`, {
-			body: JSON.stringify(checkRunRequestBody(input, detailsUrl)),
-			headers: {
-				Authorization: `Bearer ${token}`,
-				"Content-Type": "application/json"
-			},
-			method: "POST"
-		}, timeoutMs);
+		publisher?.(input);
 	} catch (error) {
-		if (remaining <= 1 || !isRetryableCheckRunFailure(error) || deadline !== void 0 && clock() + delayMs >= deadline) throw error;
-		await (dependencies.sleep ?? defaultSleep)(delayMs);
-		return await postFactoryCheckRun({
-			config,
-			deadlineMs: deadline,
-			dependencies,
-			detailsUrl,
-			input,
-			remainingAttempts: remaining - 1
-		});
+		console.warn(`${FACTORY_CHECK_NAMES[input.gate]} proof mirror failed without affecting the gate: ${error instanceof Error ? error.message : String(error)}`);
 	}
 }
 /**
-* Whether the Details-URL lookup failed only because the branch has no pull
-* request yet. `gh pr view` exits non-zero in that case, which is the ordinary
-* state of every `pr:verify` run made before the push (#323).
+* The detached, fire-and-forget publisher does not retry: it runs on a tail the
+* process may never await, so sleeping there buys no durability. Reliability is
+* bought on the awaited path (`ensureFactoryCheckRunPublished`), which the
+* composed `pr:publish` flow runs once the head SHA is on GitHub.
 */
-const isNoPullRequestYet = (message) => /no pull requests found for branch/iu.test(message);
+const DEFAULT_CHECK_RUN_RETRY = {
+	attempts: 1,
+	delayMs: 0
+};
 /**
-* What to tell an operator when there is no pull request to link to yet.
-*
-* Reported as "unable to resolve Details URL", this reads as a defect to chase
-* on the exact path where that register has already cost a full redundant
-* verification once (PR #314, #316). Nothing is wrong: the commit link is the
-* correct Details target until a pull request exists, and `pr:publish` binds
-* the check to the pull request afterwards.
+* The awaited path blocks `pr:publish`, so it is bounded twice: by attempts and
+* by a wall-clock budget. Publication can no longer fail the gate; it must not
+* be able to hang it either.
 */
-const noPullRequestDetailsUrlNotice = (gate) => `${FACTORY_CHECK_NAMES[gate]}: no pull request exists for this branch yet, so the Details link points at the commit. That is the normal state before the branch is pushed, not a failure.
-`;
-async function resolveDetailsUrlSafely(input, dependencies, onDiagnostic) {
-	try {
-		return await (dependencies.resolveDetailsUrl ?? resolveFactoryDetailsUrl)(input);
-	} catch (error) {
-		const message = error instanceof Error ? error.message : String(error);
-		onDiagnostic?.(isNoPullRequestYet(message) ? noPullRequestDetailsUrlNotice(input.gate) : `${FACTORY_CHECK_NAMES[input.gate]}: unable to resolve Details URL; using commit: ${message}\n`);
-		return `https://github.com/${input.owner}/${input.repo}/commit/${input.sha}`;
-	}
-}
+const DURABLE_CHECK_RUN_RETRY = {
+	attempts: 3,
+	budgetMs: 2e4,
+	delayMs: 750
+};
+const defaultSleep = async (ms) => {
+	const { setTimeout: delay } = await import("node:timers/promises");
+	await delay(ms);
+};
 /**
-* Read back every run GitHub serves for this check name on this head SHA.
-*
-* `filter=all`, not `filter=latest` (#524). `latest` was chosen here on the
-* rationale that it is the view the required-check rollup reads; that rationale
-* is false, measured on PR #523's head `77cf425`. Two `patronage-factory/
-* pr-ready` runs existed there — `91323051988` (`in_progress`, stranded by
-* older code) and `91323113996` (`completed`/`success`). `latest` served the
-* completed one, while the pull request's rollup reported *both*
-* (`PENDING` and `SUCCESS`) and `mergeStateStatus` stayed `BLOCKED`. So `latest`
-* can report a publication confirmed while the gate still blocks on a different
-* run of the same name — false confidence in exactly the direction this
-* read-back exists to eliminate. The set the gate evaluates is every run of the
-* name, which is what this asks for.
-*
-* Three pins keep the answer usable as proof:
+* Worth another attempt: 422 is what GitHub answers for a head SHA it has not
+* seen yet (the whole reason the retry exists), 5xx and rate limiting are
+* transient, and a thrown non-HTTP error is a network/timeout failure. A 401 /
+* 403 / 404 means the credentials or installation are wrong, and retrying that
+* only burns the caller's time budget.
+*/
+const isRetryableCheckRunFailure = (error) => {
+	if (!(error instanceof GitHubApiError)) return true;
+	return error.status === 422 || error.status === 429 || error.status >= 500;
+};
+/**
+* The pre-push state of the detached `pr:verify` publisher: GitHub 422s a check
+* run whose `head_sha` it has never seen.
 *
-* - `app_id` — the required check is source-pinned to the factory App, so a
-*   same-named run from another installed app (a GitHub Actions job named
-*   `patronage-factory/pr-ready` materializes under integration 15368) is not
-*   the pinned requirement. Left unpinned it could confirm a publication the
-*   pinned check never got, or refuse every genuine one. This is the same
-*   fail-closed rule `checkRunProducedByFactoryApp` applies to durable records
-*   below. A run served without any `app` id is refused rather than filtered
-*   out: dropping it fails closed for the newest-run clause but open for
-*   terminality, and an unfinished run of unknown provenance still blocks the
-*   gate.
-* - `per_page=100` with a required `total_count` that equals the page — a
-*   truncated page holds neither the whole set nor a defensible newest run, and
-*   `filter=all` returns strictly more runs than `latest` did, so this guard now
-*   carries more weight. Truncation is unconfirmed, not paginated: a busy head
-*   refuses rather than judging a publication against a page that silently
-*   omits the run blocking it. An absent or malformed count cannot establish
-*   completeness at all, so it refuses too.
-* - an unparsable or absent `started_at` — unorderable state is refused before
-*   selection rather than sorting to an extreme and being chosen.
+* Scoped to `pr:verify` because that is the gate whose proof `pr:publish`
+* rebinds after the push (`republishVerifyProofCheckRun`); the other gates run
+* against a head GitHub already has.
 *
-* Ordering among what survives goes through the sequencing owner rather than a
-* second rule here.
+* Scoped to a *successful* verification because `pr:verify` also publishes this
+* gate from its aborted path (`writePartialProof`, `pr-verify.ts`), which 422s
+* pre-push in exactly the same way. That proof is incomplete — applicability
+* classifies it `typed-aborted` and readiness answers "re-run pr:verify" — so
+* telling the operator it is stored and needs no rerun would be false in every
+* clause, and false in the expensive direction. A failed verification keeps the
+* plain diagnostic (#316).
 */
-async function servedFactoryCheckRun(input, config, dependencies) {
-	const request = dependencies.fetch ?? fetch;
-	const timeoutMs = dependencies.timeoutMs ?? 5e3;
-	const token = dependencies.token ?? await installationToken(input, config, request, (dependencies.now ?? Date.now)(), { timeoutMs });
-	const query = new URLSearchParams({
-		app_id: String(config.appId),
-		check_name: FACTORY_CHECK_NAMES[input.gate],
-		filter: "all",
-		per_page: "100"
-	});
-	const served = await requestGitHubJson(request, `https://api.github.com/repos/${input.owner}/${input.repo}/commits/${input.sha}/check-runs?${query.toString()}`, {
-		headers: { Authorization: `Bearer ${token}` },
-		method: "GET"
-	}, timeoutMs);
-	const page = Array.isArray(served.check_runs) ? served.check_runs : [];
-	const totalCount = served.total_count;
-	if (!(typeof totalCount === "number" && Number.isSafeInteger(totalCount))) return {
-		kind: "unavailable",
-		reason: "the served page reports no usable total_count"
-	};
-	if (totalCount !== page.length) return {
-		kind: "unavailable",
-		reason: `${page.length} runs on the page against a total_count of ${totalCount}`
-	};
-	if (page.some((run) => (run.app?.id ?? null) === null)) return {
-		kind: "unavailable",
-		reason: "a served run has no app identity"
-	};
-	const runs = page.filter((run) => String(run.app?.id ?? "") === String(config.appId));
-	const orderable = runs.flatMap((run) => {
-		const orderMs = generationOrderMs(run.started_at);
-		return Number.isFinite(orderMs) ? [{
-			orderMs,
-			run
-		}] : [];
-	});
-	if (orderable.length !== runs.length) return {
-		kind: "unavailable",
-		reason: "a served run has no usable started_at"
-	};
-	const newest = selectNewestGeneration(orderable);
-	if (newest.kind === "ambiguous") return {
-		kind: "unavailable",
-		reason: `${newest.tied.length} served runs share the newest started_at`
-	};
-	if (newest.kind === "none") return {
-		kind: "unavailable",
-		reason: "no run is served for this name"
-	};
-	return {
-		kind: "newest",
-		run: newest.generation.run,
-		runs
-	};
-}
-/** Runs GitHub has not finished. A non-terminal run blocks its required check. */
-const unfinishedRuns = (runs) => runs.filter((run) => run.status !== "completed");
+const isPrePushVerifyBinding = (input, error) => input.gate === "pr-verify" && input.conclusion === "success" && error instanceof GitHubApiError && error.status === 422;
 /**
-* Whether the served run *is* the publication that was just posted: the same
-* run, in the status that was asked for, and — for a completed one — with the
-* conclusion that was asked for.
+* What to tell an operator when the head SHA is not on GitHub yet.
 *
-* Requiring the id is what separates "GitHub serves a run that looks like
-* mine" from "GitHub serves mine". An older identical success from a previous
-* invocation satisfies every field comparison while this POST is still
-* invisible, and confirming on it is exactly the assumed-vs-live trust this
-* read-back exists to end.
+* Reported as a bare "unable to post check run", this reads as a defect to
+* chase rather than the ordinary pre-push state, and on PR #314 it prompted a
+* second full verification after the push — every command re-run for nothing.
+* The proof is already written and `pr:publish` binds it to this same commit
+* with no re-execution, so say that instead (#316).
 */
-const publishedRunIsServed = (input, createdId, served) => {
-	if (createdId === void 0 || served.id !== createdId) return false;
-	const status = input.status ?? "completed";
-	if (served.status !== status) return false;
-	return status !== "completed" || served.conclusion === input.conclusion;
-};
+const prePushVerifyBindingNotice = (sha) => `${FACTORY_CHECK_NAMES["pr-verify"]}: commit ${sha.slice(0, 7)} is not on GitHub yet, so there is no commit to bind the check to. That is the normal state before the branch is pushed, not a failure.
+The proof is complete and stored. After you push, pr:publish binds this check to the same commit and reuses that proof — no verification command runs again.
+Re-verify only if the tree changes: a new commit, an amend, or a rebase.
+`;
 /**
-* Whether the required check this publication targets is *satisfied* on the
-* head: the newest run of the name is this call's own, and no run of the name
-* survives unfinished.
+* Mint an installation token for the Patronage Factory App.
 *
-* The second clause is what makes the answer the *gate's* answer rather than
-* one collapsed view of it (#524). A stranded `in_progress` run of a
-* required-check name blocks its pull request permanently and is not cleared by
-* publishing a newer completed run, so a confirmation that ignores it is a lie
-* in the one direction that matters. A publication that is itself non-terminal
-* therefore never confirms — correctly, since it cannot satisfy the check
-* either. No factory gate makes one for this name any more: `pr:ready`'s
-* in-progress writer, the last of them, is deleted (#526).
+* The mechanism — app JWT, installation lookup, token exchange — lives in
+* `@patronage/factory-ci` (#617), because paitronage's proof-comment publisher
+* had grown a second copy of it. What stays here is what is this repository's:
+* where the credentials come from (`user-config`), and the publish timeout the
+* rest of these calls are bound by. Nothing is cached, as before.
+*
+* Retry budget is the caller's. The fire-and-forget publisher passes one
+* attempt because it already has a commit-status fallback (#938). The
+* confirmation read-back leaves the default, because it has no fallback and
+* a stale keep-alive is the class #923 covers.
 */
-const servedRunConfirmsPublication = (input, createdId, selection) => publishedRunIsServed(input, createdId, selection.run) && unfinishedRuns(selection.runs).length === 0;
+const installationToken = (repository, config, request, now, budget = {}) => mintFactoryInstallationToken(repository, config, request, now, {
+	timeoutMs: budget.timeoutMs ?? 5e3,
+	...budget.transportAttempts === void 0 ? {} : { transportAttempts: budget.transportAttempts }
+});
+function verifyOutput(proof) {
+	const value = proof;
+	const commands = value.executedCommands?.length ?? 0;
+	const payload = prVerifyCheckPayloadFor(proof);
+	return {
+		summary: `Schema v${value.schemaVersion}; mode **${value.mode ?? "unknown"}**; classification **${value.classification ?? "unknown"}**; outcome **${value.outcome ?? "unknown"}**; ${commands} command(s) executed. ${unsubscribedPathsLine(value.impactStamp?.unsubscribedPaths)}`,
+		...payload ? { text: renderPrVerifyCheckPayloadText(payload) } : {},
+		title: `pr:verify ${value.outcome ?? "unknown"}`
+	};
+}
 /**
-* Which of the two refusals happened, reported in the order an operator can act
-* on: this call's own publication first, then any *other* run holding the check
-* open. Once the first clause holds, this call's run is terminal, so everything
-* the second clause names belongs to something else.
+* The refusals to name, preferring the attributed projection (#391) so each
+* line carries its demand code. `blockingReasons` is the fallback because the
+* throwing path in `pr:ready` publishes a proof that carries only that field.
+* The two projections hold the same refusals in the same order, so reading
+* either one tells the same story.
 */
-const unconfirmedDetail = (input, createdId, selection) => {
-	const served = selection.run;
-	if (!publishedRunIsServed(input, createdId, served)) return served.id === createdId ? `status ${served.status ?? "unknown"}${served.conclusion ? `, conclusion ${served.conclusion}` : ""}` : `run ${served.id ?? "unknown"} rather than the run ${createdId ?? "unknown"} this call created`;
-	return `${unfinishedRuns(selection.runs).map((run) => `run ${run.id ?? "unknown"} (${run.status ?? "unknown"})`).join(", ")} unfinished for this name alongside it — a non-terminal run blocks the required check whatever this call published, and publishing a newer one does not clear it`;
+const readyReasonLines = (value) => {
+	const named = value.blockedReasons ?? [];
+	if (named.length > 0) return named.map((reason) => ({
+		...reason.code === void 0 ? {} : { code: reason.code },
+		detail: reason.detail ?? "unrecorded"
+	}));
+	return (value.blockingReasons ?? []).map((reason) => ({ detail: typeof reason === "string" ? reason : "unrecorded" }));
+};
+const readyReasonBlock = (reasons) => {
+	return `\n\n${reasons.length === 1 ? "1 blocking reason:" : `${reasons.length} blocking reasons:`}\n\n${reasons.map((reason) => `- ${reason.code === void 0 ? "" : `**${reason.code}** — `}${reason.detail}`).join("\n")}`;
 };
+const readyIdentityField = (value) => value === void 0 || value.trim().length === 0 ? "unrecorded" : `\`${value}\``;
 /**
-* Confirm the publication against what GitHub serves, and say plainly which of
-* the two events failed when it cannot.
+* #1037: the review identity the proof already records, printed where the
+* merge decision is made. `pr:ready` recorded the review session, model, and
+* producer, and the authoring session it was checked against, but only the PR
+* body prose showed them — so a human merging from the checks page could not
+* see which model produced the review that admitted the candidate.
 *
-* Only the read is wrapped. A token, timeout, or 5xx failure here is not a
-* failure to publish — the POST already succeeded and the check is probably
-* present — so it must not be reported through the "unable to republish"
-* register, which drives `pr:ready`'s "this run's verdict never reached the
-* required check" notice.
+* This is recording made visible, not a control. The attended merge is the
+* control.
 */
-async function confirmPublishedCheckRun({ config, createdId, dependencies, input, onDiagnostic }) {
-	const checkName = FACTORY_CHECK_NAMES[input.gate];
-	let selection;
-	try {
-		selection = await servedFactoryCheckRun(input, config, dependencies);
-	} catch (error) {
-		selection = {
-			kind: "unavailable",
-			reason: error instanceof Error ? error.message : String(error)
-		};
-	}
-	if (selection.kind === "unavailable") {
-		onDiagnostic?.(`${checkName}: the check run was accepted but could not be read back for ${input.sha.slice(0, 7)} (${selection.reason}), so the publication is not confirmed. The check itself may well be present.\n`);
-		return false;
-	}
-	if (!servedRunConfirmsPublication(input, createdId, selection)) {
-		onDiagnostic?.(`${checkName}: the check run was accepted but for ${input.sha.slice(0, 7)} GitHub serves ${unconfirmedDetail(input, createdId, selection)}, so the publication is not confirmed.\n`);
-		return false;
-	}
-	return true;
+const readyIdentityBlock = (value) => {
+	const runs = value.ledger?.reviewRuns ?? [];
+	if (runs.length === 0 && value.authoringSession === void 0) return "";
+	return `\n\nRecorded review identity:\n\n${[...runs.map((run) => {
+		const rung = run.rung === void 0 ? "" : ` at rung \`${run.rung}\``;
+		return `- ${run.kind ?? "review"}${rung}: session ${readyIdentityField(run.sessionId)} · model ${readyIdentityField(run.model)} · producer ${readyIdentityField(run.producer)}`;
+	}), `- authoring session: ${readyIdentityField(value.authoringSession)}`].join("\n")}`;
+};
+function readyOutput(proof) {
+	const value = proof;
+	const reasons = readyReasonLines(value);
+	return {
+		summary: `${`Schema v${value.schemaVersion}; readiness verdict **${value.status ?? "unknown"}**;${reasons.length === 0 ? " no blocking reasons;" : ""} ledger head \`${value.ledger?.headSha ?? "unknown"}\`.`}${reasons.length === 0 ? "" : readyReasonBlock(reasons)}${readyIdentityBlock(value)}`,
+		title: `pr:ready ${value.status ?? "unknown"}`
+	};
+}
+function factoryCheckOutput(gate, proof) {
+	return {
+		"pr-ready": readyOutput,
+		"pr-verify": verifyOutput
+	}[gate](proof);
+}
+async function runGhDetails(args, cwd) {
+	const { execFile } = await import("node:child_process");
+	const { stdout } = await promisify(execFile)("gh", args, {
+		cwd,
+		encoding: "utf-8",
+		timeout: GITHUB_PUBLISH_TIMEOUT_MS
+	});
+	return stdout;
+}
+async function resolveFactoryDetailsUrl(input, run = runGhDetails) {
+	const hqBase = input.hqLaneBaseUrl;
+	if (hqBase !== void 0 && input.pr !== void 0) return hqLaneRefUrl(hqBase, input.repo, input.pr);
+	const raw = await run([
+		"pr",
+		"view",
+		...input.pr === void 0 ? [] : [
+			String(input.pr),
+			"--repo",
+			`${input.owner}/${input.repo}`
+		],
+		"--json",
+		"comments,number,url"
+	], input.cwd);
+	const pr = JSON.parse(raw);
+	if (hqBase !== void 0 && typeof pr.number === "number") return hqLaneRefUrl(hqBase, input.repo, pr.number);
+	return (pr.comments?.find((comment) => comment.body?.includes("patronage-factory-readiness-ledger:start")))?.url ?? pr.url ?? `https://github.com/${input.owner}/${input.repo}/commit/${input.sha}`;
 }
+const checkRunRequestBody = (input, detailsUrl) => {
+	const status = input.status ?? "completed";
+	return {
+		...status === "completed" ? { conclusion: input.conclusion } : {},
+		details_url: detailsUrl,
+		head_sha: input.sha,
+		name: FACTORY_CHECK_NAMES[input.gate],
+		output: factoryCheckOutput(input.gate, input.proof),
+		status
+	};
+};
 /**
-* Publish a factory check run and *wait* for it, so a caller that has just made
-* the head SHA visible on GitHub (pushed the branch, created the PR) can make
-* the proof reliably present for that SHA before it returns (#247).
-*
-* Never posts a commit-status fallback: the commit status is a human-readable
-* mirror, not a proof surface, so a caller that needs an App-verified check
-* run must be told plainly whether it got one. Returns `true` only when the
-* App-owned check run landed. Throws {@link FactoryAppUnevaluableError} when
-* Factory App access is fail-closed (missing mint or Cursor OIDC exchange,
-* #949): `pr:ready` must not notice that miss and exit 0, and must not publish
-* a red check that reads as candidate refusal (#1125). An optional-App skip
-* still returns `false`.
+* POST the check run, retrying a bounded number of times.
 *
-* "Landed" means GitHub serves it, not that the POST was accepted (#520). On
-* PR #519 the POST was accepted, `pr:ready` reported ready and armed, and the
-* source-pinned required check read `in_progress` across three runs — so GitHub
-* never scheduled the merge and emitted no rollup row saying why. Arming
-* already refuses to infer its outcome from the invocation and reads the pull
-* request back (`arm-auto-merge.ts`); publication now does the same.
+* The retry exists for one specific failure: GitHub rejects a check run whose
+* `head_sha` it has not seen. `pr:verify` routinely runs before the branch is
+* pushed, and even after a push the commit can take a moment to be visible.
+* Without a retry the POST 422s, falls through to a commit status that 422s
+* too, and the run reads as "verification did not happen" (#247).
 *
-* "Landed" is judged against every run of the name from the pinned App, not
-* against the one GitHub collapses to (#524): the newest must be *this* run, in
-* the status and conclusion that were published, and no run of the name may
-* still be unfinished. A surviving `in_progress` run blocks the required check
-* on its own, so confirming past it would report success on a pull request
-* GitHub will never merge. One read, no polling: an unconfirmed publication
-* returns `false`, which `pr:ready` already turns into a notice and an
-* idempotent re-dispatch.
+* Retries are bounded three ways: a maximum attempt count, an optional
+* wall-clock budget, and retryability of the failure itself — a 401/403/404
+* means the credentials are wrong, and re-sending them cannot help.
 *
-* Confirmation is a point-in-time read, deliberately: a later publication for
-* the same name changes the answer — a completed one by becoming the newest, an
-* unfinished one by holding the check open beside this verdict rather than
-* replacing it — and every remaining writer publishes once, as the last thing
-* its invocation does. No retry, no poll, no re-confirm.
+* Throws the last error when every attempt fails; callers decide whether to
+* fall back or to swallow. Returns the created check run, whose `id` is the
+* only handle on *which* run this call produced — what the read-back below
+* requires the served run to be.
 */
-async function ensureFactoryCheckRunPublished(input, dependencies = {}) {
-	const { onDiagnostic } = dependencies;
-	const checkName = FACTORY_CHECK_NAMES[input.gate];
-	const access = await resolveFactoryAppAccess(input, dependencies);
-	if (access.kind !== "ok") {
-		onDiagnostic?.(`${checkName}: ${access.message}`);
-		if (access.failClosed) throw new FactoryAppUnevaluableError(`${checkName}: ${access.message.trim()}`);
-		return false;
-	}
+async function postFactoryCheckRun({ config, deadlineMs, dependencies, detailsUrl, input, remainingAttempts }) {
+	const { attempts, budgetMs, delayMs } = dependencies.retry ?? DEFAULT_CHECK_RUN_RETRY;
+	const clock = dependencies.now ?? Date.now;
+	const remaining = remainingAttempts ?? Math.max(1, attempts);
+	const deadline = deadlineMs ?? (budgetMs === void 0 ? void 0 : clock() + budgetMs);
+	const request = dependencies.fetch ?? fetch;
+	const timeoutMs = dependencies.timeoutMs ?? 5e3;
 	try {
-		const config = dependencies.githubApp ?? tryUserConfig()?.config.githubApp ?? {
-			appId: access.appId,
-			privateKeyPath: "factory-app-broker"
-		};
-		const tokenDependencies = {
-			...dependencies,
-			token: access.token
-		};
-		const detailsUrl = await resolveDetailsUrlSafely(input, dependencies, onDiagnostic);
-		const created = await postFactoryCheckRun({
-			config,
-			dependencies: {
-				retry: DURABLE_CHECK_RUN_RETRY,
-				...tokenDependencies
-			},
-			detailsUrl,
-			input
+		const token = dependencies.token ?? await installationToken(input, config, request, (dependencies.now ?? Date.now)(), {
+			timeoutMs,
+			transportAttempts: 1
 		});
-		return await confirmPublishedCheckRun({
+		return await requestGitHubJson(request, `https://api.github.com/repos/${input.owner}/${input.repo}/check-runs`, {
+			body: JSON.stringify(checkRunRequestBody(input, detailsUrl)),
+			headers: {
+				Authorization: `Bearer ${token}`,
+				"Content-Type": "application/json"
+			},
+			method: "POST"
+		}, timeoutMs);
+	} catch (error) {
+		if (remaining <= 1 || !isRetryableCheckRunFailure(error) || deadline !== void 0 && clock() + delayMs >= deadline) throw error;
+		await (dependencies.sleep ?? defaultSleep)(delayMs);
+		return await postFactoryCheckRun({
 			config,
-			createdId: typeof created.id === "number" ? created.id : void 0,
-			dependencies: tokenDependencies,
+			deadlineMs: deadline,
+			dependencies,
+			detailsUrl,
 			input,
-			onDiagnostic
+			remainingAttempts: remaining - 1
 		});
-	} catch (error) {
-		const message = error instanceof Error ? error.message : String(error);
-		onDiagnostic?.(`${FACTORY_CHECK_NAMES[input.gate]}: unable to republish check run: ${message}\n`);
-		return false;
 	}
 }
-function createFactoryCheckPublisher(output, dependencies = {}) {
-	const postStatus = dependencies.postCommitStatus ?? createGhCommitStatusPoster(output);
-	let publishQueue = Promise.resolve();
-	return (input) => {
-		const publish = async () => {
-			await Promise.resolve();
-			const checkName = FACTORY_CHECK_NAMES[input.gate];
-			const { conclusion } = input;
-			const status = input.status ?? "completed";
-			if (status === "completed" && conclusion === void 0) throw new Error("A completed factory check requires a conclusion.");
-			const detailsUrl = await resolveDetailsUrlSafely(input, dependencies, (m) => output.stderr.write(m));
-			const postFallback = (suppressFailureDiagnostic = false) => {
-				try {
-					postStatus({
-						context: checkName,
-						cwd: input.cwd,
-						description: status === "in_progress" ? `${input.gate} gate is running` : `${input.gate} gate ${conclusion === "success" ? "passed" : "failed"}`,
-						owner: input.owner,
-						repo: input.repo,
-						sha: input.sha,
-						state: status === "in_progress" ? "pending" : conclusion ?? "failure",
-						suppressFailureDiagnostic,
-						targetUrl: detailsUrl
-					});
-				} catch (error) {
-					const message = error instanceof Error ? error.message : String(error);
-					output.stderr.write(`${checkName}: unable to post fallback status: ${message}\n`);
-				}
-			};
-			const access = await resolveFactoryAppAccess(input, {
-				...dependencies,
-				transportAttempts: 1
-			});
-			if (access.kind !== "ok") {
-				output.stderr.write(`${checkName}: ${access.message}`);
-				if (!access.failClosed) postFallback();
-				return;
-			}
-			const config = dependencies.githubApp ?? tryUserConfig()?.config.githubApp ?? {
-				appId: access.appId,
-				privateKeyPath: "factory-app-broker"
-			};
-			try {
-				await postFactoryCheckRun({
-					config,
-					dependencies: {
-						...dependencies,
-						token: access.token
-					},
-					detailsUrl,
-					input
-				});
-				output.stdout.write(`${checkName} check run posted\n`);
-			} catch (error) {
-				const prePush = isPrePushVerifyBinding(input, error);
-				const message = error instanceof Error ? error.message : String(error);
-				output.stderr.write(prePush ? prePushVerifyBindingNotice(input.sha) : `${checkName}: unable to post check run: ${message}\n`);
-				postFallback(prePush);
-			}
-		};
-		publishQueue = publishQueue.then(publish, publish);
-		runDetachedBestEffort(() => publishQueue);
-	};
-}
-//#endregion
-//#region src/repository-profile-path.ts
 /**
-* `git rev-parse --show-toplevel` answers with a real path, while a caller's
-* `cwd` may reach the same directory through a symlink (every macOS temporary
-* directory does). Both sides are resolved before they are compared, so a
-* symlinked checkout is not mistaken for a profile outside the repository.
+* Whether the Details-URL lookup failed only because the branch has no pull
+* request yet. `gh pr view` exits non-zero in that case, which is the ordinary
+* state of every `pr:verify` run made before the push (#323).
 */
-const realPath = (value) => {
-	try {
-		return realpathSync(value);
-	} catch {
-		return value;
-	}
-};
+const isNoPullRequestYet = (message) => /no pull requests found for branch/iu.test(message);
 /**
-* The repository top level for `cwd`, or `cwd` itself when it is not a git
-* checkout. Never throws: a caller rooting a path has a usable answer either
-* way, and the checkout-less case keeps the previous cwd-rooted behavior.
+* What to tell an operator when there is no pull request to link to yet.
+*
+* Reported as "unable to resolve Details URL", this reads as a defect to chase
+* on the exact path where that register has already cost a full redundant
+* verification once (PR #314, #316). Nothing is wrong: the commit link is the
+* correct Details target until a pull request exists, and `pr:publish` binds
+* the check to the pull request afterwards.
 */
-const repositoryRootOrCwd = ({ cwd, readRepositoryRoot = repositoryRoot }) => {
+const noPullRequestDetailsUrlNotice = (gate) => `${FACTORY_CHECK_NAMES[gate]}: no pull request exists for this branch yet, so the Details link points at the commit. That is the normal state before the branch is pushed, not a failure.
+`;
+async function resolveDetailsUrlSafely(input, dependencies, onDiagnostic) {
 	try {
-		return readRepositoryRoot(cwd);
-	} catch {
-		return cwd;
+		return await (dependencies.resolveDetailsUrl ?? resolveFactoryDetailsUrl)(input);
+	} catch (error) {
+		const message = error instanceof Error ? error.message : String(error);
+		onDiagnostic?.(isNoPullRequestYet(message) ? noPullRequestDetailsUrlNotice(input.gate) : `${FACTORY_CHECK_NAMES[input.gate]}: unable to resolve Details URL; using commit: ${message}\n`);
+		return `https://github.com/${input.owner}/${input.repo}/commit/${input.sha}`;
 	}
-};
+}
 /**
-* The repository-relative, POSIX-separated path of `profilePath`.
+* Read back every run GitHub serves for this check name on this head SHA.
 *
-* A cwd that is not a git checkout, and a profile the repository top level
-* does not contain, both fall back to the cwd-relative path: this function
-* makes a path more portable, and it must never invent one. Callers that
-* require the profile to be inside the trusted checkout keep enforcing that
-* themselves.
-*/
-const repositoryRelativeProfilePath = ({ cwd, profilePath, readRepositoryRoot = repositoryRoot }) => {
-	const cwdRelative = path.relative(cwd, profilePath).split(path.sep).join("/");
-	const root = repositoryRootOrCwd({
-		cwd,
-		readRepositoryRoot
-	});
-	const rootRelative = path.relative(realPath(root), realPath(profilePath)).split(path.sep).join("/");
-	return rootRelative.length > 0 && !rootRelative.startsWith("../") ? rootRelative : cwdRelative;
-};
-/** A path that names no file inside the root it was measured from. */
-const escapesRoot = (relativePath) => relativePath.length === 0 || relativePath === ".." || relativePath.startsWith("../") || path.isAbsolute(relativePath);
-/**
-* The same path, for a caller that must REFUSE a profile the repository does
-* not contain.
+* `filter=all`, not `filter=latest` (#524). `latest` was chosen here on the
+* rationale that it is the view the required-check rollup reads; that rationale
+* is false, measured on PR #523's head `77cf425`. Two `patronage-factory/
+* pr-ready` runs existed there — `91323051988` (`in_progress`, stranded by
+* older code) and `91323113996` (`completed`/`success`). `latest` served the
+* completed one, while the pull request's rollup reported *both*
+* (`PENDING` and `SUCCESS`) and `mergeStateStatus` stayed `BLOCKED`. So `latest`
+* can report a publication confirmed while the gate still blocks on a different
+* run of the same name — false confidence in exactly the direction this
+* read-back exists to eliminate. The set the gate evaluates is every run of the
+* name, which is what this asks for.
+*
+* Three pins keep the answer usable as proof:
 *
-* Containment is measured from the repository top level, not from `cwd`.
-* Measuring it from `cwd` refuses the repository-root profile whenever the
-* command runs in a package subdirectory — a profile that is plainly inside
-* the trusted checkout — and it refused before the conversion above could run
-* (cycle-1 review finding on PR #1004).
+* - `app_id` — the required check is source-pinned to the factory App, so a
+*   same-named run from another installed app (a GitHub Actions job named
+*   `patronage-factory/pr-ready` materializes under integration 15368) is not
+*   the pinned requirement. Left unpinned it could confirm a publication the
+*   pinned check never got, or refuse every genuine one. This is the same
+*   fail-closed rule `checkRunProducedByFactoryApp` applies to durable records
+*   below. A run served without any `app` id is refused rather than filtered
+*   out: dropping it fails closed for the newest-run clause but open for
+*   terminality, and an unfinished run of unknown provenance still blocks the
+*   gate.
+* - `per_page=100` with a required `total_count` that equals the page — a
+*   truncated page holds neither the whole set nor a defensible newest run, and
+*   `filter=all` returns strictly more runs than `latest` did, so this guard now
+*   carries more weight. Truncation is unconfirmed, not paginated: a busy head
+*   refuses rather than judging a publication against a page that silently
+*   omits the run blocking it. An absent or malformed count cannot establish
+*   completeness at all, so it refuses too.
+* - an unparsable or absent `started_at` — unorderable state is refused before
+*   selection rather than sorting to an extreme and being chosen.
 *
-* Fail-closed is unchanged. A profile genuinely outside the repository root
-* falls back to the cwd-relative path, which still escapes, and throws here.
-* A cwd that is not a git checkout has no root to measure from and keeps the
-* previous cwd-relative rule exactly.
+* Ordering among what survives goes through the sequencing owner rather than a
+* second rule here.
 */
-const repositoryContainedProfilePath = ({ cwd, profilePath, readRepositoryRoot = repositoryRoot }) => {
-	const relativePath = repositoryRelativeProfilePath({
-		cwd,
-		profilePath,
-		readRepositoryRoot
+async function servedFactoryCheckRun(input, config, dependencies) {
+	const request = dependencies.fetch ?? fetch;
+	const timeoutMs = dependencies.timeoutMs ?? 5e3;
+	const token = dependencies.token ?? await installationToken(input, config, request, (dependencies.now ?? Date.now)(), { timeoutMs });
+	const query = new URLSearchParams({
+		app_id: String(config.appId),
+		check_name: FACTORY_CHECK_NAMES[input.gate],
+		filter: "all",
+		per_page: "100"
 	});
-	if (escapesRoot(relativePath)) throw new Error("The readiness profile must be inside the trusted checkout.");
-	return relativePath;
-};
-//#endregion
-//#region src/pr-classification.ts
-const MISSING_STAMP_REASON = "impact stamp is missing; fail closed to non-trivial";
-function ownershipFromStamp(stamp, file) {
-	if (stamp.inertPaths.includes(file)) return { kind: "inert" };
-	if (stamp.unsubscribedPaths.includes(file)) return { kind: "unowned" };
-	const named = stamp.targets.find((target) => target.impact === "affected" && target.subscribedPaths.includes(file));
-	if (named) return {
-		kind: "target",
-		target: named.name
+	const served = await requestGitHubJson(request, `https://api.github.com/repos/${input.owner}/${input.repo}/commits/${input.sha}/check-runs?${query.toString()}`, {
+		headers: { Authorization: `Bearer ${token}` },
+		method: "GET"
+	}, timeoutMs);
+	const page = Array.isArray(served.check_runs) ? served.check_runs : [];
+	const totalCount = served.total_count;
+	if (!(typeof totalCount === "number" && Number.isSafeInteger(totalCount))) return {
+		kind: "unavailable",
+		reason: "the served page reports no usable total_count"
 	};
-	const affected = stamp.targets.find((target) => target.impact === "affected");
-	if (affected) return {
-		kind: "target",
-		target: affected.name
+	if (totalCount !== page.length) return {
+		kind: "unavailable",
+		reason: `${page.length} runs on the page against a total_count of ${totalCount}`
 	};
-	return { kind: "unowned" };
-}
-function reasonForOwnership(file, ownership) {
-	switch (ownership.kind) {
-		case "inert": return `${file}: repository-inert ownership (stamp.inertPaths)`;
-		case "target": return `${file}: affects product target "${ownership.target}"`;
-		default: return `${file}: no declared owner; fail closed to non-trivial`;
-	}
-}
-function relativeProfilePath(options) {
-	return repositoryRelativeProfilePath({
-		cwd: options.cwd,
-		profilePath: options.profilePath
-	});
-}
-function applyProfileEditGuard(files, relativeProfile, profilePath, base) {
-	if (!files.some((file) => file === relativeProfile || file === profilePath)) return base;
-	return {
-		classification: "non-trivial",
-		reasons: [...base.reasons, `${relativeProfile}: edits the ownership declarations; forced non-trivial`]
+	if (page.some((run) => (run.app?.id ?? null) === null)) return {
+		kind: "unavailable",
+		reason: "a served run has no app identity"
 	};
-}
-/**
-* Path ownership as the stamp recorded it. A missing stamp fails closed.
-* Does not glob, and does not refuse the docs rung on a conservative basis —
-* that gate belongs to {@link classifyDiffForRunWithStamp}.
-*/
-function classifyDiff(files, stamp) {
-	if (stamp === void 0) return {
-		classification: "non-trivial",
-		reasons: [MISSING_STAMP_REASON]
+	const runs = page.filter((run) => String(run.app?.id ?? "") === String(config.appId));
+	const orderable = runs.flatMap((run) => {
+		const orderMs = generationOrderMs(run.started_at);
+		return Number.isFinite(orderMs) ? [{
+			orderMs,
+			run
+		}] : [];
+	});
+	if (orderable.length !== runs.length) return {
+		kind: "unavailable",
+		reason: "a served run has no usable started_at"
 	};
-	const sortedFiles = [...files].toSorted();
-	if (sortedFiles.length === 0) return {
-		classification: "non-trivial",
-		reasons: ["No changed files detected; defaulting to non-trivial verification."]
+	const newest = selectNewestGeneration(orderable);
+	if (newest.kind === "ambiguous") return {
+		kind: "unavailable",
+		reason: `${newest.tied.length} served runs share the newest started_at`
 	};
-	const ownerships = sortedFiles.map((file) => ({
-		file,
-		ownership: ownershipFromStamp(stamp, file)
-	}));
-	const reasons = ownerships.map(({ file, ownership }) => reasonForOwnership(file, ownership));
-	if (ownerships.every(({ ownership }) => ownership.kind === "inert")) return {
-		classification: "docs/process-only",
-		reasons
+	if (newest.kind === "none") return {
+		kind: "unavailable",
+		reason: "no run is served for this name"
 	};
 	return {
-		classification: "non-trivial",
-		reasons
+		kind: "newest",
+		run: newest.generation.run,
+		runs
 	};
 }
+/** Runs GitHub has not finished. A non-terminal run blocks its required check. */
+const unfinishedRuns = (runs) => runs.filter((run) => run.status !== "completed");
 /**
-* The candidate classification `pr:verify` records: path ownership gated by
-* the impact stamp's positive evidence. The docs/process-only rung requires a
-* `target-scoped` stamp with zero affected targets ON TOP of full inert
-* ownership — a conservative stamp (unreadable or unsupported lockfile sides,
-* no declared targets, computation doubt) refuses the reduced rung, so a
-* fail-closed stamp can never coexist with a reduced verification battery
-* (#742 review cycle 3).
+* Whether the served run *is* the publication that was just posted: the same
+* run, in the status that was asked for, and — for a completed one — with the
+* conclusion that was asked for.
 *
-* Ownership and reasons come from `stamp.targets`, `stamp.inertPaths`, and
-* `stamp.unsubscribedPaths`. A missing stamp fails closed; this function
-* never evaluates profile globs.
-*/
-function classifyDiffForRunWithStamp(profile, files, stamp, options) {
-	const base = applyProfileEditGuard(files, relativeProfilePath(options), options.profilePath, classifyDiff(files, stamp));
-	if (stamp === void 0 || base.classification === "non-trivial") return base;
-	if (stamp.basis !== "target-scoped") return {
-		classification: "non-trivial",
-		reasons: [...base.reasons, "impact stamp is conservative; the docs/process-only rung needs a target-scoped stamp with zero affected targets"]
-	};
-	const affected = stamp.targets.filter((target) => target.impact === "affected");
-	if (affected.length > 0) return {
-		classification: "non-trivial",
-		reasons: [...base.reasons, `impact stamp records ${affected.length} affected target(s); forced non-trivial`]
-	};
-	return base;
-}
-/**
-* Path predicate for consumers that do not already hold a stamp (pr-ready's
-* docs-only delta). Computes one stamp through {@link computeImpactStamp} —
-* the only glob-evaluation site — then reads ownership from it.
+* Requiring the id is what separates "GitHub serves a run that looks like
+* mine" from "GitHub serves mine". An older identical success from a previous
+* invocation satisfies every field comparison while this POST is still
+* invisible, and confirming on it is exactly the assumed-vs-live trust this
+* read-back exists to end.
 */
-function classifyDiffForRun(profile, files, options) {
-	const relativeProfile = relativeProfilePath(options);
-	const stamp = computeImpactStamp({
-		changedFiles: files,
-		profile,
-		profilePath: relativeProfile,
-		readLockfile: () => void 0
-	});
-	return applyProfileEditGuard(files, relativeProfile, options.profilePath, classifyDiff(files, stamp));
-}
-//#endregion
-//#region src/catch-up-recognition-record.ts
-const objectShaSchema = z.string().regex(/^[0-9a-f]{40}$/u);
-const catchUpRecognitionSchema = z.object({
-	baseRef: z.string().min(1),
-	baseTipSha: objectShaSchema,
-	mergedParentSha: objectShaSchema,
-	mergedTreeSha: objectShaSchema,
-	upstreamRef: z.string().min(1)
-}).strict();
-//#endregion
-//#region src/policy-resolution.ts
-const COMMIT_SHA_PATTERN$3 = /^[0-9a-f]{40}$/u;
-const digestSchema = z.string().regex(/^[0-9a-f]{64}$/u);
+const publishedRunIsServed = (input, createdId, served) => {
+	if (createdId === void 0 || served.id !== createdId) return false;
+	const status = input.status ?? "completed";
+	if (served.status !== status) return false;
+	return status !== "completed" || served.conclusion === input.conclusion;
+};
 /**
-* The authority resolved: the live tip of the PR's own base ref served a
-* parseable profile, and demand was resolved from the union of that policy and
-* the candidate's.
+* Whether the required check this publication targets is *satisfied* on the
+* head: the newest run of the name is this call's own, and no run of the name
+* survives unfinished.
 *
-* Every identity field is REQUIRED. A cross-stage reader compares these digests
-* to decide whether two stages judged the same candidate under the same policy;
-* an `authoritative` record with a digest missing would read to that reader as
-* "nothing disagrees", which is a silent downgrade of exactly the demand this
-* record exists to protect. `reason` is forbidden here — a resolved authority
-* has nothing to explain.
+* The second clause is what makes the answer the *gate's* answer rather than
+* one collapsed view of it (#524). A stranded `in_progress` run of a
+* required-check name blocks its pull request permanently and is not cleared by
+* publishing a newer completed run, so a confirmation that ignores it is a lie
+* in the one direction that matters. A publication that is itself non-terminal
+* therefore never confirms — correctly, since it cannot satisfy the check
+* either. No factory gate makes one for this name any more: `pr:ready`'s
+* in-progress writer, the last of them, is deleted (#526).
 */
-const authoritativePolicyResolutionSchema = z.object({
-	/** sha256 of the canonical base `review` subtree. */
-	basePolicyDigest: digestSchema,
-	/** The PR's own base ref, whose live tip is the authority. */
-	baseRefName: z.string().min(1),
-	/** sha256 of the canonical candidate `review` subtree. */
-	candidatePolicyDigest: digestSchema,
-	/** sha256 of the merged (base ∪ candidate) protected-path set. */
-	effectiveDigest: digestSchema,
-	/** The base-ref tip the base policy was read at. */
-	policyBaseSha: z.string().regex(COMMIT_SHA_PATTERN$3),
-	/**
-	* Whether the candidate's `review` subtree differs from the base's. The
-	* digests prove which policies were read; this says whether they agreed,
-	* which is the fact that explains a demand the candidate's own profile
-	* would not have produced.
-	*/
-	reviewPolicyChanged: z.boolean(),
-	status: z.literal("authoritative")
-}).strict();
+const servedRunConfirmsPublication = (input, createdId, selection) => publishedRunIsServed(input, createdId, selection.run) && unfinishedRuns(selection.runs).length === 0;
 /**
-* The authority could not be read, and `reason` says why — required, because an
-* unresolved record with no reason is an unactionable refusal. `pr:ready`
-* refuses before it writes a proof, so a Slice A ready proof never carries one;
-* this member is the recorded form of that refusal for the stages that carry it
-* forward.
+* Which of the two refusals happened, reported in the order an operator can act
+* on: this call's own publication first, then any *other* run holding the check
+* open. Once the first clause holds, this call's run is terminal, so everything
+* the second clause names belongs to something else.
 */
-const unresolvedPolicyResolutionSchema = z.object({
-	/** The base ref whose policy could not be read. */
-	baseRefName: z.string().min(1),
-	/** Why the authority is unresolved. */
-	reason: z.string().min(1),
-	status: z.literal("unresolved")
-}).strict();
-/** How a gate resolved the review policy it evaluated a candidate under. */
-const policyResolutionSchema = z.discriminatedUnion("status", [authoritativePolicyResolutionSchema, unresolvedPolicyResolutionSchema]);
-//#endregion
-//#region src/verification-battery.ts
-const UNCONDITIONAL_BASIS = "unconditional: the profile declares no impactTarget for this command";
+const unconfirmedDetail = (input, createdId, selection) => {
+	const served = selection.run;
+	if (!publishedRunIsServed(input, createdId, served)) return served.id === createdId ? `status ${served.status ?? "unknown"}${served.conclusion ? `, conclusion ${served.conclusion}` : ""}` : `run ${served.id ?? "unknown"} rather than the run ${createdId ?? "unknown"} this call created`;
+	return `${unfinishedRuns(selection.runs).map((run) => `run ${run.id ?? "unknown"} (${run.status ?? "unknown"})`).join(", ")} unfinished for this name alongside it — a non-terminal run blocks the required check whatever this call published, and publishing a newer one does not clear it`;
+};
 /**
-* The `vetoedTargets` contract, enforced at RUNTIME as well as at the type
-* level. TypeScript makes the parameter required for callers it compiles;
-* `new Set(undefined)` is a perfectly good empty set, so an untyped JavaScript
-* caller that omits it would otherwise scope exactly as if it had inspected
-* the envelopes and found nothing — the silent state requiring the parameter
-* exists to eliminate.
+* Confirm the publication against what GitHub serves, and say plainly which of
+* the two events failed when it cannot.
 *
-* A malformed CALL is API misuse, not data doubt: it fails loudly (ADR 0024)
-* rather than degrading to the conservative floor, because a producer that
-* never resolved the veto set has a bug its author must see.
+* Only the read is wrapped. A token, timeout, or 5xx failure here is not a
+* failure to publish — the POST already succeeded and the check is probably
+* present — so it must not be reported through the "unable to republish"
+* register, which drives `pr:ready`'s "this run's verdict never reached the
+* required check" notice.
 */
-const assertVetoedTargets = (vetoedTargets, caller) => {
-	if (!Array.isArray(vetoedTargets)) throw new TypeError(`${caller} requires vetoedTargets: the target names with a current, candidate-bound FAILING envelope. Resolve it with boundFailingCheckNames and pass the result; pass [] to mean "inspected the envelopes and found no bound failure". It has no default because omitting it would silently scope work whose standing demand nothing on this head could meet.`);
-};
+async function confirmPublishedCheckRun({ config, createdId, dependencies, input, onDiagnostic }) {
+	const checkName = FACTORY_CHECK_NAMES[input.gate];
+	let selection;
+	try {
+		selection = await servedFactoryCheckRun(input, config, dependencies);
+	} catch (error) {
+		selection = {
+			kind: "unavailable",
+			reason: error instanceof Error ? error.message : String(error)
+		};
+	}
+	if (selection.kind === "unavailable") {
+		onDiagnostic?.(`${checkName}: the check run was accepted but could not be read back for ${input.sha.slice(0, 7)} (${selection.reason}), so the publication is not confirmed. The check itself may well be present.\n`);
+		return false;
+	}
+	if (!servedRunConfirmsPublication(input, createdId, selection)) {
+		onDiagnostic?.(`${checkName}: the check run was accepted but for ${input.sha.slice(0, 7)} GitHub serves ${unconfirmedDetail(input, createdId, selection)}, so the publication is not confirmed.\n`);
+		return false;
+	}
+	return true;
+}
 /**
-* Plan one verification battery against the candidate's impact stamp.
+* Publish a factory check run and *wait* for it, so a caller that has just made
+* the head SHA visible on GitHub (pushed the branch, created the PR) can make
+* the proof reliably present for that SHA before it returns (#247).
 *
-* Pure and total: it makes a decision, it never reads a proof, a profile file,
-* or the filesystem, and no INPUT can make it throw — every doubt path is a
-* decision, not an exception. A malformed CALL is the one exception to that,
-* and deliberately so: omitting `vetoedTargets` is API misuse rather than data
-* doubt, and it throws (see {@link assertVetoedTargets}).
+* Never posts a commit-status fallback: the commit status is a human-readable
+* mirror, not a proof surface, so a caller that needs an App-verified check
+* run must be told plainly whether it got one. Returns `true` only when the
+* App-owned check run landed. Throws {@link FactoryAppUnevaluableError} when
+* Factory App access is fail-closed (missing mint or Cursor OIDC exchange,
+* #949): `pr:ready` must not notice that miss and exit 0, and must not publish
+* a red check that reads as candidate refusal (#1125). An optional-App skip
+* still returns `false`.
 *
-* `stamp` must already be trusted by
-* the caller — inside `pr:verify` that is the stamp just computed for this
-* candidate's own identity triple; anywhere else it is `trustedImpactStamp`'s
-* output or `undefined`.
+* "Landed" means GitHub serves it, not that the POST was accepted (#520). On
+* PR #519 the POST was accepted, `pr:ready` reported ready and armed, and the
+* source-pinned required check read `in_progress` across three runs — so GitHub
+* never scheduled the merge and emitted no rollup row saying why. Arming
+* already refuses to infer its outcome from the invocation and reads the pull
+* request back (`arm-auto-merge.ts`); publication now does the same.
+*
+* "Landed" is judged against every run of the name from the pinned App, not
+* against the one GitHub collapses to (#524): the newest must be *this* run, in
+* the status and conclusion that were published, and no run of the name may
+* still be unfinished. A surviving `in_progress` run blocks the required check
+* on its own, so confirming past it would report success on a pull request
+* GitHub will never merge. One read, no polling: an unconfirmed publication
+* returns `false`, which `pr:ready` already turns into a notice and an
+* idempotent re-dispatch.
+*
+* Confirmation is a point-in-time read, deliberately: a later publication for
+* the same name changes the answer — a completed one by becoming the newest, an
+* unfinished one by holding the check open beside this verdict rather than
+* replacing it — and every remaining writer publishes once, as the last thing
+* its invocation does. No retry, no poll, no re-confirm.
 */
-const planVerificationBattery = ({ commands, stamp, vetoedTargets }) => {
-	assertVetoedTargets(vetoedTargets, "planVerificationBattery");
-	const vetoed = new Set(vetoedTargets);
-	const dispositions = [];
-	const execute = [];
-	const notRequired = [];
-	for (const command of commands) {
-		const { impactTarget, name } = command;
-		if (impactTarget === void 0) {
-			dispositions.push({
-				basis: UNCONDITIONAL_BASIS,
-				disposition: "executed",
-				name
-			});
-			execute.push(command);
-			continue;
-		}
-		const decision = impactStampScopeDecision({
-			stamp,
-			surface: "verification-battery",
-			targetName: impactTarget
-		});
-		const vetoedHere = decision.scoped && vetoed.has(impactTarget);
-		const basis = vetoedHere ? `veto: a current envelope bound to this candidate records target "${impactTarget}" as FAILING, so the stamp's release is withheld (${decision.reason})` : decision.reason;
-		const scoped = decision.scoped && !vetoedHere;
-		dispositions.push({
-			basis,
-			disposition: scoped ? "not-required" : "executed",
-			impactTarget,
-			name
+async function ensureFactoryCheckRunPublished(input, dependencies = {}) {
+	const { onDiagnostic } = dependencies;
+	const checkName = FACTORY_CHECK_NAMES[input.gate];
+	const access = await resolveFactoryAppAccess(input, dependencies);
+	if (access.kind !== "ok") {
+		onDiagnostic?.(`${checkName}: ${access.message}`);
+		if (access.failClosed) throw new FactoryAppUnevaluableError(`${checkName}: ${access.message.trim()}`);
+		return false;
+	}
+	try {
+		const config = dependencies.githubApp ?? tryUserConfig()?.config.githubApp ?? {
+			appId: access.appId,
+			privateKeyPath: "factory-app-broker"
+		};
+		const tokenDependencies = {
+			...dependencies,
+			token: access.token
+		};
+		const detailsUrl = await resolveDetailsUrlSafely(input, dependencies, onDiagnostic);
+		const created = await postFactoryCheckRun({
+			config,
+			dependencies: {
+				retry: DURABLE_CHECK_RUN_RETRY,
+				...tokenDependencies
+			},
+			detailsUrl,
+			input
 		});
-		if (scoped) notRequired.push({
-			basis,
-			impactTarget,
-			name
+		return await confirmPublishedCheckRun({
+			config,
+			createdId: typeof created.id === "number" ? created.id : void 0,
+			dependencies: tokenDependencies,
+			input,
+			onDiagnostic
 		});
-		else execute.push(command);
+	} catch (error) {
+		const message = error instanceof Error ? error.message : String(error);
+		onDiagnostic?.(`${FACTORY_CHECK_NAMES[input.gate]}: unable to republish check run: ${message}\n`);
+		return false;
+	}
+}
+function createFactoryCheckPublisher(output, dependencies = {}) {
+	const postStatus = dependencies.postCommitStatus ?? createGhCommitStatusPoster(output);
+	let publishQueue = Promise.resolve();
+	return (input) => {
+		const publish = async () => {
+			await Promise.resolve();
+			const checkName = FACTORY_CHECK_NAMES[input.gate];
+			const { conclusion } = input;
+			const status = input.status ?? "completed";
+			if (status === "completed" && conclusion === void 0) throw new Error("A completed factory check requires a conclusion.");
+			const detailsUrl = await resolveDetailsUrlSafely(input, dependencies, (m) => output.stderr.write(m));
+			const postFallback = (suppressFailureDiagnostic = false) => {
+				try {
+					postStatus({
+						context: checkName,
+						cwd: input.cwd,
+						description: status === "in_progress" ? `${input.gate} gate is running` : `${input.gate} gate ${conclusion === "success" ? "passed" : "failed"}`,
+						owner: input.owner,
+						repo: input.repo,
+						sha: input.sha,
+						state: status === "in_progress" ? "pending" : conclusion ?? "failure",
+						suppressFailureDiagnostic,
+						targetUrl: detailsUrl
+					});
+				} catch (error) {
+					const message = error instanceof Error ? error.message : String(error);
+					output.stderr.write(`${checkName}: unable to post fallback status: ${message}\n`);
+				}
+			};
+			const access = await resolveFactoryAppAccess(input, {
+				...dependencies,
+				transportAttempts: 1
+			});
+			if (access.kind !== "ok") {
+				output.stderr.write(`${checkName}: ${access.message}`);
+				if (!access.failClosed) postFallback();
+				return;
+			}
+			const config = dependencies.githubApp ?? tryUserConfig()?.config.githubApp ?? {
+				appId: access.appId,
+				privateKeyPath: "factory-app-broker"
+			};
+			try {
+				await postFactoryCheckRun({
+					config,
+					dependencies: {
+						...dependencies,
+						token: access.token
+					},
+					detailsUrl,
+					input
+				});
+				output.stdout.write(`${checkName} check run posted\n`);
+			} catch (error) {
+				const prePush = isPrePushVerifyBinding(input, error);
+				const message = error instanceof Error ? error.message : String(error);
+				output.stderr.write(prePush ? prePushVerifyBindingNotice(input.sha) : `${checkName}: unable to post check run: ${message}\n`);
+				postFallback(prePush);
+			}
+		};
+		publishQueue = publishQueue.then(publish, publish);
+		runDetachedBestEffort(() => publishQueue);
+	};
+}
+const configuredFactoryAppId = (config) => config === void 0 ? void 0 : String(config.appId);
+const checkRunProducedByFactoryApp = ({ app, expectedAppId }) => {
+	if (!expectedAppId || !app) return;
+	if (app.id !== void 0 && app.id !== null && String(app.id) === expectedAppId) return {
+		identity: String(app.id),
+		mode: "app"
+	};
+	if (typeof app.slug === "string" && app.slug.length > 0 && app.slug === expectedAppId) return {
+		identity: app.slug,
+		mode: "app"
+	};
+};
+const completeCheckRunPages = (pages) => {
+	if (!Array.isArray(pages) || pages.length === 0 || pages.some((page) => !Array.isArray(page?.check_runs) || !Number.isSafeInteger(page.total_count) || page.total_count < 0)) return;
+	const runs = pages.flatMap((page) => page.check_runs);
+	return pages.every((page) => page.total_count === runs.length) ? runs : void 0;
+};
+/**
+* Read the machine-readable `pr:verify` binding for one commit (#247).
+*
+* Deliberately narrow: it reads check runs only, and only those whose `app`
+* identity matches the configured factory App. It never consults commit
+* statuses. `patronage-factory/pr-verify` is postable as a commit status by any
+* token with write access, so that surface stays a human-readable mirror and
+* can never satisfy a consumer that wants proof. Absent, foreign, or
+* unparseable ⇒ `undefined` (fail closed).
+*/
+function fetchPrVerifyProofBinding({ expectedAppId, githubApp, owner, repo, sha, runJson = runGhJson }) {
+	const resolvedAppId = expectedAppId ?? configuredFactoryAppId(githubApp ?? tryUserConfig()?.config.githubApp);
+	if (!resolvedAppId) return;
+	const checkName = FACTORY_CHECK_NAMES["pr-verify"];
+	let pages;
+	try {
+		pages = runJson([
+			"api",
+			"--paginate",
+			"--slurp",
+			`/repos/${owner}/${repo}/commits/${sha}/check-runs?check_name=${encodeURIComponent(checkName)}&filter=all&per_page=100`
+		]);
+	} catch {
+		return;
 	}
+	const runs = completeCheckRunPages(pages);
+	if (!runs) return;
+	const ordered = runs.filter((run) => run?.name === checkName && checkRunProducedByFactoryApp({
+		app: run.app,
+		expectedAppId: resolvedAppId
+	})).map((run) => ({
+		orderMs: generationOrderMs(run.started_at),
+		run
+	}));
+	if (ordered.some(({ orderMs }) => !Number.isFinite(orderMs))) return;
+	const selected = selectNewestGeneration(ordered);
+	if (selected.kind !== "newest") return;
+	const { run } = selected.generation;
+	if (run.status !== "completed" || run.head_sha !== sha) return;
+	const payload = parsePrVerifyCheckPayload(run.output?.text) ?? parsePrVerifyCheckPayload(run.output?.summary);
+	if (!payload || payload.headSha !== sha || payload.repository !== `${owner}/${repo}`) return;
+	const producer = checkRunProducedByFactoryApp({
+		app: run.app,
+		expectedAppId: resolvedAppId
+	});
+	if (!producer) return;
 	return {
-		dispositions,
-		execute,
-		notRequired
+		completedAtMs: generationOrderMs(run.completed_at),
+		conclusion: run.conclusion ?? "",
+		payload,
+		producer
 	};
+}
+//#endregion
+//#region src/repository-profile-path.ts
+/**
+* `git rev-parse --show-toplevel` answers with a real path, while a caller's
+* `cwd` may reach the same directory through a symlink (every macOS temporary
+* directory does). Both sides are resolved before they are compared, so a
+* symlinked checkout is not mistaken for a profile outside the repository.
+*/
+const realPath = (value) => {
+	try {
+		return realpathSync(value);
+	} catch {
+		return value;
+	}
 };
 /**
-* The completeness invariant as an enforceable control (ADR 0024: controls
-* fail loudly), shared by both pr:verify proof schemas so they cannot drift.
-*
-* Four rules:
-*  1. A withheld command names one the resolved mode actually selected.
-*  2. A command is never recorded as both executed and not-required.
-*  3. Withheld commands are distinct — a duplicated disposition would let one
-*     name carry two different bases.
-*  4. On a PASSED proof, every selected command has a disposition: silence is
-*     not a disposition, and "absent from both lists" is exactly the silent
-*     skip this epic forbids.
-*
-* Rule 4 is scoped to `outcome: "passed"` because an ABORTED proof legitimately
-* records partial execution — the run stopped at the failing command.
-*
-* The check is one-directional on purpose. Every SELECTED command must be
-* accounted for, but `executedCommands` may legitimately carry MORE than the
-* profile selected — full mode appends the `workspace:install-resolves` probe,
-* which is real work no profile declares.
+* The repository top level for `cwd`, or `cwd` itself when it is not a git
+* checkout. Never throws: a caller rooting a path has a usable answer either
+* way, and the checkout-less case keeps the previous cwd-rooted behavior.
 */
-const assertBatteryCompleteness = (proof, context) => {
-	const selected = proof.verificationCommands.map((command) => command.name);
-	const selectedSet = new Set(selected);
-	const executed = new Set((proof.executedCommands ?? []).map((command) => command.name));
-	const notRequired = proof.notRequiredCommands ?? [];
-	const seen = /* @__PURE__ */ new Set();
-	for (const [index, entry] of notRequired.entries()) {
-		if (!selectedSet.has(entry.name)) context.addIssue({
-			code: "custom",
-			message: `notRequiredCommands entry "${entry.name}" is not one of this proof's verificationCommands.`,
-			path: [
-				"notRequiredCommands",
-				index,
-				"name"
-			]
-		});
-		if (executed.has(entry.name)) context.addIssue({
-			code: "custom",
-			message: `Command "${entry.name}" is recorded both as executed and as not-required.`,
-			path: [
-				"notRequiredCommands",
-				index,
-				"name"
-			]
-		});
-		if (seen.has(entry.name)) context.addIssue({
-			code: "custom",
-			message: `notRequiredCommands records "${entry.name}" more than once.`,
-			path: [
-				"notRequiredCommands",
-				index,
-				"name"
-			]
-		});
-		seen.add(entry.name);
+const repositoryRootOrCwd = ({ cwd, readRepositoryRoot = repositoryRoot }) => {
+	try {
+		return readRepositoryRoot(cwd);
+	} catch {
+		return cwd;
 	}
-	if (proof.outcome !== "passed") return;
-	const disposed = new Set([...executed, ...seen]);
-	const undisposed = selected.filter((name) => !disposed.has(name));
-	if (undisposed.length > 0) context.addIssue({
-		code: "custom",
-		message: `A passed pr:verify proof must give every selected verification command a disposition; [${undisposed.join(", ")}] appear in verificationCommands but in neither executedCommands nor notRequiredCommands.`,
-		path: ["executedCommands"]
-	});
 };
 /**
-* The stamp-authorization control: a passed proof may only claim a command
-* was NOT REQUIRED if its own recorded stamp says so.
-*
-* `assertBatteryCompleteness` proves the two lists partition the selected
-* commands — that no command is silently absent. It does not prove the
-* withholding was EARNED. Without this rule a proof could name every expensive
-* command in `notRequiredCommands`, carry no stamp at all (or a conservative
-* one), and still read as full verification: the omission would be recorded,
-* accounted for, and completely unauthorized.
-*
-* Two things have to hold, and the first is what keeps the second honest:
-*
-*  1. COHERENCE. The entry's `impactTarget` must equal the `impactTarget` the
-*     proof records for that same command in `verificationCommands`. The entry
-*     does not get to nominate its own target; the proof's command→target
-*     mapping (written by `pr:verify` from the loaded profile) does. Without
-*     this, authorization validates a self-reported field and a crafted proof
-*     can withhold an affected command while pointing at an unrelated released
-*     target.
-*  2. AUTHORIZATION. That recorded target must be one the proof's own stamp
-*     provably released.
+* The repository-relative, POSIX-separated path of `profilePath`.
 *
-* The proof is one artifact and a determined forger controls all of it; this
-* is internal-coherence belt-and-braces in the same trust domain as the rest
-* of the proof, and write-time truth stays `pr:verify`'s job.
+* A cwd that is not a git checkout, and a profile the repository top level
+* does not contain, both fall back to the cwd-relative path: this function
+* makes a path more portable, and it must never invent one. Callers that
+* require the profile to be inside the trusted checkout keep enforcing that
+* themselves.
+*/
+const repositoryRelativeProfilePath = ({ cwd, profilePath, readRepositoryRoot = repositoryRoot }) => {
+	const cwdRelative = path.relative(cwd, profilePath).split(path.sep).join("/");
+	const root = repositoryRootOrCwd({
+		cwd,
+		readRepositoryRoot
+	});
+	const rootRelative = path.relative(realPath(root), realPath(profilePath)).split(path.sep).join("/");
+	return rootRelative.length > 0 && !rootRelative.startsWith("../") ? rootRelative : cwdRelative;
+};
+/** A path that names no file inside the root it was measured from. */
+const escapesRoot = (relativePath) => relativePath.length === 0 || relativePath === ".." || relativePath.startsWith("../") || path.isAbsolute(relativePath);
+/**
+* The same path, for a caller that must REFUSE a profile the repository does
+* not contain.
 *
-* The authorizing evidence is the proof's OWN `impactStamp` — the same stamp
-* `pr:verify` computed for this candidate's identity triple and recorded here,
-* so authorization is bound to the same identities the proof binds. The
-* predicate is the shared {@link impactStampScopeDecision}, not a second
-* reading of the stamp: an entry is authorized exactly when the stamp would
-* have released that target's command in the first place (target-scoped
-* basis, this build's stamp version, exactly one row for the target,
-* `not-affected`). A conservative stamp, an unknown version, a
-* self-contradictory stamp, an unclassified name, or an `affected` verdict all
-* fail the same way scoping itself would.
+* Containment is measured from the repository top level, not from `cwd`.
+* Measuring it from `cwd` refuses the repository-root profile whenever the
+* command runs in a package subdirectory — a profile that is plainly inside
+* the trusted checkout — and it refused before the conversion above could run
+* (cycle-1 review finding on PR #1004).
 *
-* Scoped to `outcome: "passed"` for the same reason as the completeness rule:
-* an aborted run records partial execution, so it makes no false completeness
-* claim.
+* Fail-closed is unchanged. A profile genuinely outside the repository root
+* falls back to the cwd-relative path, which still escapes, and throws here.
+* A cwd that is not a git checkout has no root to measure from and keeps the
+* previous cwd-relative rule exactly.
 */
-const assertNotRequiredStampAuthorization = (proof, context) => {
-	const notRequired = proof.notRequiredCommands ?? [];
-	if (proof.outcome !== "passed" || notRequired.length === 0) return;
-	const { impactStamp } = proof;
-	if (impactStamp === void 0) {
-		context.addIssue({
-			code: "custom",
-			message: `A passed pr:verify proof that withholds verification commands must record the impact stamp that authorized the withholding; [${notRequired.map((entry) => entry.name).join(", ")}] are recorded not-required by a proof carrying no impactStamp.`,
-			path: ["impactStamp"]
-		});
-		return;
-	}
-	const recordedTargets = new Map(proof.verificationCommands.map((command) => [command.name, command.impactTarget]));
-	for (const [index, entry] of notRequired.entries()) {
-		const recorded = recordedTargets.get(entry.name);
-		if (recorded !== entry.impactTarget) {
-			context.addIssue({
-				code: "custom",
-				message: recorded === void 0 ? `notRequiredCommands entry "${entry.name}" claims impactTarget "${entry.impactTarget}", but this proof records no impactTarget for that command; only a command the profile scopes can be withheld.` : `notRequiredCommands entry "${entry.name}" claims impactTarget "${entry.impactTarget}", but this proof records impactTarget "${recorded}" for that command.`,
-				path: [
-					"notRequiredCommands",
-					index,
-					"impactTarget"
-				]
-			});
-			continue;
-		}
-		const decision = impactStampScopeDecision({
-			stamp: impactStamp,
-			surface: "verification-battery",
-			targetName: entry.impactTarget
-		});
-		if (!decision.scoped) context.addIssue({
-			code: "custom",
-			message: `notRequiredCommands entry "${entry.name}" is not authorized by this proof's impactStamp: ${decision.reason}.`,
-			path: [
-				"notRequiredCommands",
-				index,
-				"impactTarget"
-			]
-		});
-	}
-};
-/** Console lines naming every withheld command and why. Never silent. */
-const batteryScopeSummaryLines = (plan) => {
-	if (plan.notRequired.length === 0) return [];
-	return ["Verification battery scoped by the impact stamp (not-required):", ...plan.notRequired.map((entry) => `- ${entry.name} (${entry.impactTarget}): ${entry.basis}`)];
+const repositoryContainedProfilePath = ({ cwd, profilePath, readRepositoryRoot = repositoryRoot }) => {
+	const relativePath = repositoryRelativeProfilePath({
+		cwd,
+		profilePath,
+		readRepositoryRoot
+	});
+	if (escapesRoot(relativePath)) throw new Error("The readiness profile must be inside the trusted checkout.");
+	return relativePath;
 };
 //#endregion
-//#region src/pr-verify-proof-rules.ts
-const assertPrVerifyProofRules = (proof, context) => {
-	if (proof.notDemandedRecords !== void 0 && proof.impactStamp === void 0) context.addIssue({
-		code: "custom",
-		message: "notDemandedRecords requires impactStamp; package-level not-demanded records are bound to the stamp identity.",
-		path: ["notDemandedRecords"]
+//#region src/pr-classification.ts
+const MISSING_STAMP_REASON = "impact stamp is missing; fail closed to non-trivial";
+function ownershipFromStamp(stamp, file) {
+	if (stamp.inertPaths.includes(file)) return { kind: "inert" };
+	if (stamp.unsubscribedPaths.includes(file)) return { kind: "unowned" };
+	const named = stamp.targets.find((target) => target.impact === "affected" && target.subscribedPaths.includes(file));
+	if (named) return {
+		kind: "target",
+		target: named.name
+	};
+	const affected = stamp.targets.find((target) => target.impact === "affected");
+	if (affected) return {
+		kind: "target",
+		target: affected.name
+	};
+	return { kind: "unowned" };
+}
+function reasonForOwnership(file, ownership) {
+	switch (ownership.kind) {
+		case "inert": return `${file}: repository-inert ownership (stamp.inertPaths)`;
+		case "target": return `${file}: affects product target "${ownership.target}"`;
+		default: return `${file}: no declared owner; fail closed to non-trivial`;
+	}
+}
+function relativeProfilePath(options) {
+	return repositoryRelativeProfilePath({
+		cwd: options.cwd,
+		profilePath: options.profilePath
 	});
-	assertBatteryCompleteness(proof, context);
-	assertNotRequiredStampAuthorization(proof, context);
-};
+}
+function applyProfileEditGuard(files, relativeProfile, profilePath, base) {
+	if (!files.some((file) => file === relativeProfile || file === profilePath)) return base;
+	return {
+		classification: "non-trivial",
+		reasons: [...base.reasons, `${relativeProfile}: edits the ownership declarations; forced non-trivial`]
+	};
+}
 /**
-* The pr:verify proof versions a reader accepts: the current one only (#920
-* item 1). #917 narrowed the pr:ready reader the same way. A pr:verify proof
-* is per-candidate and short-lived — it is rewritten on every head — so no
-* stored v1–v3 proof can outlive the release that drops it. Pre-1.0 posture
-* applies: one current contract, no compat reader. A consumer on an older
-* factory must adopt this release before HQ ingests its pr:verify proofs.
+* Path ownership as the stamp recorded it. A missing stamp fails closed.
+* Does not glob, and does not refuse the docs rung on a conservative basis —
+* that gate belongs to {@link classifyDiffForRunWithStamp}.
 */
-const SUPPORTED_PR_VERIFY_SCHEMA_VERSIONS = [4];
-const prVerifyTestFailureSchema = z.object({
-	file: z.string().min(1),
-	kind: z.enum([
-		"assertion",
-		"error",
-		"timeout"
-	]),
-	title: z.string().min(1)
-});
-const executedCommandSchema = z.object({
-	command: z.string().min(1),
-	counts: z.object({
-		testFiles: z.number().nonnegative().optional(),
-		tests: z.number().nonnegative().optional()
-	}).optional(),
-	durationMs: z.number().nonnegative(),
-	exitCode: z.number(),
-	failures: z.array(prVerifyTestFailureSchema).min(1).optional(),
-	name: z.string().min(1),
-	scope: z.enum([
-		"docs-only",
-		"trivial",
-		"full"
-	])
-});
-const notRequiredCommandSchema = z.object({
-	basis: z.string().min(1),
-	impactTarget: z.string().min(1),
-	name: z.string().min(1)
-});
-const notDemandedRecordSchema = z.object({
-	basis: z.string().min(1),
-	name: z.string().min(1)
-});
-const prVerifySchemaVersionSchema = z.literal(4);
-const prVerifyProofSchema = z.object({
-	authoringSession: z.string().trim().min(1),
-	base: z.string().min(1),
-	baseSha: z.string().regex(/^[0-9a-f]{40}$/u).optional(),
-	baselineFullProofs: z.array(z.object({
-		base: z.string().min(1),
-		changedFiles: z.array(z.string()),
-		headSha: z.string().regex(/^[0-9a-f]{40}$/u),
-		profilePath: z.string().min(1),
-		projectKey: z.string().min(1),
-		repository: z.string().min(1)
-	})).optional(),
-	catchUpRecognition: catchUpRecognitionSchema.optional(),
-	changedFiles: z.array(z.string()),
-	classification: z.enum([
-		"docs/process-only",
-		"trivial",
-		"non-trivial"
-	]),
-	classificationReasons: z.array(z.string()),
-	command: z.literal("patronage-factory pr:verify"),
-	durationMs: z.number().nonnegative(),
-	endedAt: z.iso.datetime(),
-	executedCommands: z.array(executedCommandSchema).optional(),
-	headSha: z.string().regex(/^[0-9a-f]{40}$/u),
-	impactStamp: impactStampSchema.optional(),
-	mergeBaseSha: z.string().regex(/^[0-9a-f]{40}$/u).optional(),
-	mode: z.enum([
-		"docs-only",
-		"trivial",
-		"full"
-	]),
-	notDemandedRecords: z.array(notDemandedRecordSchema).min(1).optional(),
-	notRequiredCommands: z.array(notRequiredCommandSchema).min(1).optional(),
-	outcome: z.enum(["aborted", "passed"]).optional(),
-	patchId: z.string().regex(/^[0-9a-f]{40}$/u).optional(),
-	policyResolution: policyResolutionSchema.optional(),
-	profilePath: z.string().min(1),
-	projectKey: z.string().min(1),
-	repository: z.string().min(1),
-	schemaVersion: prVerifySchemaVersionSchema,
-	startedAt: z.iso.datetime(),
-	verificationCommands: z.array(z.object({
-		command: z.string().min(1),
-		description: z.string().min(1),
-		impactTarget: z.string().min(1).optional(),
-		name: z.string().min(1),
-		scope: z.enum([
-			"docs-only",
-			"trivial",
-			"full"
-		])
-	}))
-}).superRefine(assertPrVerifyProofRules);
-function validatePrVerifyProof(value) {
-	return prVerifyProofSchema.parse(value);
+function classifyDiff(files, stamp) {
+	if (stamp === void 0) return {
+		classification: "non-trivial",
+		reasons: [MISSING_STAMP_REASON]
+	};
+	const sortedFiles = [...files].toSorted();
+	if (sortedFiles.length === 0) return {
+		classification: "non-trivial",
+		reasons: ["No changed files detected; defaulting to non-trivial verification."]
+	};
+	const ownerships = sortedFiles.map((file) => ({
+		file,
+		ownership: ownershipFromStamp(stamp, file)
+	}));
+	const reasons = ownerships.map(({ file, ownership }) => reasonForOwnership(file, ownership));
+	if (ownerships.every(({ ownership }) => ownership.kind === "inert")) return {
+		classification: "docs/process-only",
+		reasons
+	};
+	return {
+		classification: "non-trivial",
+		reasons
+	};
+}
+/**
+* The candidate classification `pr:verify` records: path ownership gated by
+* the impact stamp's positive evidence. The docs/process-only rung requires a
+* `target-scoped` stamp with zero affected targets ON TOP of full inert
+* ownership — a conservative stamp (unreadable or unsupported lockfile sides,
+* no declared targets, computation doubt) refuses the reduced rung, so a
+* fail-closed stamp can never coexist with a reduced verification battery
+* (#742 review cycle 3).
+*
+* Ownership and reasons come from `stamp.targets`, `stamp.inertPaths`, and
+* `stamp.unsubscribedPaths`. A missing stamp fails closed; this function
+* never evaluates profile globs.
+*/
+function classifyDiffForRunWithStamp(profile, files, stamp, options) {
+	const base = applyProfileEditGuard(files, relativeProfilePath(options), options.profilePath, classifyDiff(files, stamp));
+	if (stamp === void 0 || base.classification === "non-trivial") return base;
+	if (stamp.basis !== "target-scoped") return {
+		classification: "non-trivial",
+		reasons: [...base.reasons, "impact stamp is conservative; the docs/process-only rung needs a target-scoped stamp with zero affected targets"]
+	};
+	const affected = stamp.targets.filter((target) => target.impact === "affected");
+	if (affected.length > 0) return {
+		classification: "non-trivial",
+		reasons: [...base.reasons, `impact stamp records ${affected.length} affected target(s); forced non-trivial`]
+	};
+	return base;
+}
+/**
+* Path predicate for consumers that do not already hold a stamp (pr-ready's
+* docs-only delta). Computes one stamp through {@link computeImpactStamp} —
+* the only glob-evaluation site — then reads ownership from it.
+*/
+function classifyDiffForRun(profile, files, options) {
+	const relativeProfile = relativeProfilePath(options);
+	const stamp = computeImpactStamp({
+		changedFiles: files,
+		profile,
+		profilePath: relativeProfile,
+		readLockfile: () => void 0
+	});
+	return applyProfileEditGuard(files, relativeProfile, options.profilePath, classifyDiff(files, stamp));
 }
 //#endregion
 //#region src/pr-readiness/verification-proof.ts
@@ -9089,7 +9201,6 @@ function runPrVerify(args, dependencies = {}) {
 	}) : void 0;
 	const selectedProfileCommands = profile.verification.commands.filter((command) => commandAppliesToMode(command, resolvedMode));
 	const commands = commandsForMode(profile, resolvedMode);
-	if (args.requireKnownAuthoringSession && authoringSession === "unknown") throw new Error("A known authoring session is required before verification can run.");
 	if (commands.length === 0) throw new Error(`No verification commands configured for ${resolvedMode}.`);
 	console.log(`pr:verify mode: ${resolvedMode}${args.mode === "auto" ? " (auto)" : ""}`);
 	console.log(`classification: ${classification.classification}`);
@@ -9114,6 +9225,34 @@ function runPrVerify(args, dependencies = {}) {
 	const scopedOutNames = new Set(notRequiredCommands.map(({ name }) => name));
 	for (const line of batteryScopeSummaryLines(battery)) console.log(line);
 	const repository = `${profile.repository.owner}/${profile.repository.name}`;
+	if (args.reuseAccepted) {
+		assertCleanWorktreeForProof({
+			cwd,
+			dirtyMessage: "Accepted verification requires a clean committed checkout.",
+			statusPorcelain: git.statusPorcelain
+		});
+		const binding = (dependencies.fetchVerifyBinding ?? fetchPrVerifyProofBinding)({
+			expectedAppId: FACTORY_PROOF_GATE_APP_ID,
+			owner: profile.repository.owner,
+			repo: profile.repository.name,
+			sha: headSha
+		});
+		const accepted = binding?.payload.verificationProof;
+		if (binding?.conclusion === "success" && binding.payload.outcome === "passed" && accepted && accepted.outcome === "passed" && accepted.authoringSession !== "unknown" && commands.every((command) => scopedOutNames.has(command.name) || accepted.executedCommands?.some((executed) => executed.name === command.name && executed.command === command.command && executed.scope === command.scope && executed.exitCode === 0)) && accepted.executedCommands?.every((executed) => executed.exitCode === 0) && accepted.headSha === headSha && accepted.patchId === patchId && accepted.repository === repository && accepted.base === base.ref && accepted.baseSha === base.sha && accepted.mergeBaseSha === proofMergeBaseSha && accepted.mode === resolvedMode && accepted.classification === classification.classification && vetoedTargets.length === 0 && isDeepStrictEqual(accepted.changedFiles.toSorted(), files.toSorted()) && isDeepStrictEqual(accepted.verificationCommands, commands) && isDeepStrictEqual(accepted.impactStamp, impactStamp) && isDeepStrictEqual(accepted.notRequiredCommands ?? [], notRequiredCommands) && isDeepStrictEqual(accepted.policyResolution, policyResolution)) {
+			assertCleanWorktreeForProof({
+				cwd,
+				dirtyMessage: "Checkout changed while reading accepted verification.",
+				statusPorcelain: git.statusPorcelain
+			});
+			if (git.currentHeadSha(cwd) !== headSha) throw new Error("Candidate HEAD changed while reading accepted verification.");
+			const paths = resolveProofOutputPaths(cwd, DEFAULT_PR_VERIFY_PROOF_PATH, args.output);
+			writeProofToPaths((target) => writeProofJson(accepted, target), paths.canonical, paths.additional);
+			console.log(`pr:verify reused accepted exact-candidate proof; original provenance preserved at ${paths.canonical}`);
+			return accepted;
+		}
+		console.log("pr:verify accepted coverage unavailable or mismatched; running verification.");
+	}
+	if (args.requireKnownAuthoringSession && authoringSession === "unknown") throw new Error("A known authoring session is required before verification can run.");
 	let gateState = "failure";
 	const { env: verificationEnv, cleanup } = context.buildEnv();
 	const { canonical: output, additional: additionalOutput } = resolveProofOutputPaths(cwd, DEFAULT_PR_VERIFY_PROOF_PATH, args.output);
@@ -15699,7 +15838,7 @@ const renderPrBodySections = ({ reviewProof, verifyProof }) => `${renderPrBodySe
 //#endregion
 //#region src/pr-readiness/status-check-rollup.ts
 var status_check_rollup_exports = /* @__PURE__ */ __exportAll({
-	HOSTED_VERIFY_CHECK_NAME: () => HOSTED_VERIFY_CHECK_NAME$1,
+	HOSTED_VERIFY_CHECK_NAME: () => HOSTED_VERIFY_CHECK_NAME,
 	HOSTED_VERIFY_DRAFT_CHECK_NAME: () => HOSTED_VERIFY_DRAFT_CHECK_NAME,
 	hostedVerifyCheckState: () => hostedVerifyCheckState,
 	isDraftHostedVerifyCheck: () => isDraftHostedVerifyCheck,
@@ -15735,7 +15874,7 @@ const isFactoryReadyCheck = (check) => check.context?.startsWith("patronage-fact
 * name across the fleet because one generator emits the workflow that posts
 * it (ADR 0016).
 */
-const HOSTED_VERIFY_CHECK_NAME$1 = "verify";
+const HOSTED_VERIFY_CHECK_NAME = "verify";
 /**
 * Is this rollup entry the hosted `verify` gate, from the producer the
 * ruleset pins it to?
@@ -15756,7 +15895,7 @@ const isHostedVerifyCheck = (check) => check.name === "verify" && Boolean(check.
 * the literal; this is the reader's copy of it, and
 * `software-factory-hq/alchemy/verify-workflow.test.ts` pins the two equal.
 */
-const HOSTED_VERIFY_DRAFT_CHECK_NAME = `${HOSTED_VERIFY_CHECK_NAME$1} (draft)`;
+const HOSTED_VERIFY_DRAFT_CHECK_NAME = `${HOSTED_VERIFY_CHECK_NAME} (draft)`;
 /**
 * Is this the draft-head summary run's residue?
 *
@@ -15982,12 +16121,11 @@ function armAutoMerge(input, dependencies = {}) {
 //#region src/merge-freeze.ts
 const MERGE_FREEZE_CHECK_NAME = "patronage-factory/merge-freeze";
 const MERGE_FREEZE_APP_SLUG = "patronage-factory";
-const HOSTED_VERIFY_CHECK_NAME = "verify";
-const GITHUB_ACTIONS_APP_ID$1 = 15368;
-const GITHUB_ACTIONS_APP_SLUG = "github-actions";
 const MERGE_FREEZE_SCHEMA_VERSION = 1;
 const CHECK_RUNS_PER_PAGE$1 = 100;
 const CHECK_RUN_PAGE_LIMIT$1 = 10;
+const WORKFLOW_RUNS_PER_PAGE = 100;
+const WORKFLOW_RUN_PAGE_LIMIT = 10;
 const shaSchema$2 = z.string().regex(/^[0-9a-f]{40}$/u);
 const verificationSchema = z.object({
 	jobs: z.record(z.string(), z.enum([
@@ -16058,19 +16196,23 @@ const completedMergeFreezeCheckRunSchema = mergeFreezeCheckRunListItemSchema.ext
 	output: z.object({ text: z.string().min(1) }),
 	status: z.literal("completed")
 });
-const hostedVerifyCheckRunSchema = z.object({
-	app: z.object({
-		id: z.literal(GITHUB_ACTIONS_APP_ID$1),
-		slug: z.literal(GITHUB_ACTIONS_APP_SLUG)
-	}),
-	head_sha: shaSchema$2,
+const workflowRunIdentitySchema = z.object({
 	id: z.number().int().positive(),
-	name: z.literal(HOSTED_VERIFY_CHECK_NAME),
-	started_at: z.iso.datetime().nullable(),
+	workflow_id: z.number().int().positive()
+});
+const workflowRunListItemSchema = workflowRunIdentitySchema.extend({
+	conclusion: z.string().nullable().optional(),
+	created_at: z.iso.datetime(),
+	event: z.string(),
+	head_sha: shaSchema$2,
+	run_attempt: z.number().int().positive(),
 	status: z.enum([
 		"completed",
 		"in_progress",
-		"queued"
+		"pending",
+		"queued",
+		"requested",
+		"waiting"
 	])
 });
 const commitParentsSchema = z.object({
@@ -16133,40 +16275,48 @@ function selectMissingMergeFreezeGenerationUnchecked(api, input) {
 		name: MERGE_FREEZE_CHECK_NAME
 	}), parentSha);
 	if (parentGeneration.kind !== "settled") return unconfiguredMergeFreeze(input, `the immediate parent ${parentSha} has no settled App-owned freeze generation (${parentGeneration.kind}).`);
-	const verifyRuns = z.object({ check_runs: z.array(z.unknown()) }).parse(api.list({
+	if (!(api.workflowRun && api.workflowRuns)) return unconfiguredMergeFreeze(input, "the authority cannot read GitHub Actions workflow runs.");
+	const { verification } = parentGeneration.state;
+	if (!verification) return unconfiguredMergeFreeze(input, `the immediate parent ${parentSha}'s settled generation records no producing workflow run; regenerate the merge-target push Verify workflow so the writer records its run.`);
+	const parentRun = workflowRunIdentitySchema.parse(api.workflowRun({
 		...input,
-		name: HOSTED_VERIFY_CHECK_NAME
-	})).check_runs.map((run) => hostedVerifyCheckRunSchema.parse(run));
-	const completedVerify = verifyRuns.find((run) => run.status === "completed");
-	if (completedVerify) return unconfiguredMergeFreeze(input, `the current tip's source-pinned GitHub Actions ${HOSTED_VERIFY_CHECK_NAME} run ${completedVerify.id} already completed without producing a freeze generation.`);
-	const pendingVerifyRuns = verifyRuns.filter((run) => run.status !== "completed");
-	const orderedVerifyRuns = pendingVerifyRuns.flatMap((run) => run.started_at ? [{
-		orderMs: generationOrderMs(run.started_at),
-		run
-	}] : []);
-	if (pendingVerifyRuns.length > 1 && orderedVerifyRuns.length !== pendingVerifyRuns.length) return unconfiguredMergeFreeze(input, `multiple pending source-pinned ${HOSTED_VERIFY_CHECK_NAME} runs cannot be ordered because at least one has no start time.`);
-	const selectedVerify = pendingVerifyRuns.length === 1 ? {
-		generation: { run: pendingVerifyRuns[0] },
-		kind: "selected"
-	} : selectNewestGeneration(orderedVerifyRuns);
-	if (selectedVerify.kind === "ambiguous") return unconfiguredMergeFreeze(input, `the newest source-pinned ${HOSTED_VERIFY_CHECK_NAME} generation is ambiguous.`);
-	if (selectedVerify.kind === "none") return unconfiguredMergeFreeze(input, `the current tip has no source-pinned GitHub Actions ${HOSTED_VERIFY_CHECK_NAME} run.`);
-	const verify = selectedVerify.generation.run;
-	if (verify.head_sha !== input.headSha) return unconfiguredMergeFreeze(input, `the newest source-pinned ${HOSTED_VERIFY_CHECK_NAME} run targets ${verify.head_sha}.`);
-	const refreshed = selectListedMergeFreezeGeneration(api.list({
+		runId: verification.runId
+	}));
+	if (parentRun.id !== verification.runId) return unconfiguredMergeFreeze(input, `the parent generation's producing run ${verification.runId} could not be read (GitHub returned run ${parentRun.id}).`);
+	const workflowId = parentRun.workflow_id;
+	const tipRuns = z.object({ workflow_runs: z.array(z.unknown()) }).parse(api.workflowRuns({
+		...input,
+		workflowId
+	})).workflow_runs.map((run) => workflowRunListItemSchema.parse(run)).filter((run) => run.workflow_id === workflowId && run.head_sha === input.headSha && run.event === "push");
+	const rereadTipGeneration = () => selectListedMergeFreezeGeneration(api.list({
 		...input,
 		name: MERGE_FREEZE_CHECK_NAME
 	}), input.headSha);
+	const completedRun = tipRuns.find((run) => run.status === "completed");
+	if (completedRun) {
+		const refreshedAfterCompletion = rereadTipGeneration();
+		if (refreshedAfterCompletion.kind !== "missing") return refreshedAfterCompletion;
+		return unconfiguredMergeFreeze(input, `the current tip's push run ${completedRun.id} of the freeze-writing Verify workflow already completed without producing a freeze generation.`);
+	}
+	const selectedRun = selectNewestGeneration(tipRuns.filter((run) => run.status !== "completed").map((run) => ({
+		orderMs: generationOrderMs(run.created_at),
+		run
+	})));
+	if (selectedRun.kind === "ambiguous") return unconfiguredMergeFreeze(input, "the newest pending push run of the freeze-writing Verify workflow is ambiguous.");
+	if (selectedRun.kind === "none") return unconfiguredMergeFreeze(input, `the current tip has no queued or running push run of the freeze-writing Verify workflow (workflow ${workflowId}).`);
+	const { run } = selectedRun.generation;
+	const refreshed = rereadTipGeneration();
 	if (refreshed.kind !== "missing") return refreshed;
 	return {
 		kind: "settling",
 		phase: "awaiting-generation",
-		reason: `No ${MERGE_FREEZE_CHECK_NAME} generation exists yet for ${input.headSha}; the immediate parent has a settled generation and source-pinned GitHub Actions ${HOSTED_VERIFY_CHECK_NAME} run ${verify.id} is ${verify.status}.`,
+		reason: `No ${MERGE_FREEZE_CHECK_NAME} generation exists yet for ${input.headSha}; the immediate parent ${parentSha} has a settled generation written by workflow ${workflowId}, and that workflow's push run ${run.id} on the tip is ${run.status}.`,
 		witness: {
 			headSha: input.headSha,
 			parentSha,
-			verifyRunId: verify.id,
-			verifyStatus: verify.status
+			workflowId,
+			workflowRunId: run.id,
+			workflowRunStatus: run.status
 		}
 	};
 }
@@ -16174,7 +16324,7 @@ function selectMissingMergeFreezeGeneration(api, input) {
 	try {
 		return selectMissingMergeFreezeGenerationUnchecked(api, input);
 	} catch (error) {
-		return unconfiguredMergeFreeze(input, `the required GitHub history or check-run evidence is unreadable: ${error instanceof Error ? error.message : String(error)}.`);
+		return unconfiguredMergeFreeze(input, `the required GitHub history, check-run, or workflow-run evidence is unreadable: ${error instanceof Error ? error.message : String(error)}.`);
 	}
 }
 function selectMergeFreezeGeneration(api, input) {
@@ -16219,6 +16369,19 @@ function createGitHubCheckRunMergeFreezeApi(dependencies = {}) {
 		},
 		parent({ cwd, headSha, repository }) {
 			return (dependencies.readJson ?? runGhJsonAt)(["api", `/repos/${repository.owner}/${repository.name}/commits/${headSha}`], cwd);
+		},
+		workflowRun({ cwd, repository, runId }) {
+			return (dependencies.readJson ?? runGhJsonAt)(["api", `/repos/${repository.owner}/${repository.name}/actions/runs/${runId}`], cwd);
+		},
+		workflowRuns({ cwd, headSha, repository, workflowId }) {
+			const workflowRuns = [];
+			for (let page = 1; page <= WORKFLOW_RUN_PAGE_LIMIT; page += 1) {
+				const response = z.object({ workflow_runs: z.array(z.unknown()) }).parse((dependencies.readJson ?? runGhJsonAt)(["api", `/repos/${repository.owner}/${repository.name}/actions/workflows/${workflowId}/runs?head_sha=${headSha}&event=push&per_page=${WORKFLOW_RUNS_PER_PAGE}&page=${page}`], cwd));
+				workflowRuns.push(...response.workflow_runs);
+				if (response.workflow_runs.length < WORKFLOW_RUNS_PER_PAGE) break;
+				if (page === WORKFLOW_RUN_PAGE_LIMIT) throw new Error(`workflow ${workflowId} run pagination limit was exhausted before GitHub returned a final page.`);
+			}
+			return { workflow_runs: workflowRuns };
 		}
 	};
 }
@@ -16262,12 +16425,12 @@ const SETTLING_MERGE_FREEZE_TAIL = "readiness proceeds (ADR 0016). If this wave
 *
 * The two phases permit readiness for different reasons, so they say different
 * things. A running generation is the writer already at work on this tip. An
-* awaited one is the writer proven to run — a settled parent — plus the hosted
-* verify run that owes the generation.
+* awaited one is the writer proven to run — a settled parent — plus that
+* writer's workflow's push run on the tip, which owes the generation.
 */
 const settlingMergeFreezeNotice = (headSha, generation) => {
 	if (generation.phase === "running-generation") return `Merge freeze generation ${generation.witness.runId} for base ${headSha} is still settling (${generation.reason}); that running generation writes the verdict for this tip, so ${SETTLING_MERGE_FREEZE_TAIL}`;
-	return `Merge freeze for base ${headSha} is still settling with no generation yet (${generation.reason}); settled parent ${generation.witness.parentSha} and ${HOSTED_VERIFY_CHECK_NAME} run ${generation.witness.verifyRunId}, which is ${generation.witness.verifyStatus}, prove one is owed, so ${SETTLING_MERGE_FREEZE_TAIL}`;
+	return `Merge freeze for base ${headSha} is still settling with no generation yet (${generation.reason}); settled parent ${generation.witness.parentSha} and push run ${generation.witness.workflowRunId} of its freeze-writing workflow ${generation.witness.workflowId}, which is ${generation.witness.workflowRunStatus}, prove one is owed, so ${SETTLING_MERGE_FREEZE_TAIL}`;
 };
 /**
 * The freeze read during readiness, before any authorized arming (#477,
@@ -16279,8 +16442,9 @@ const settlingMergeFreezeNotice = (headSha, generation) => {
 * **settling** generation permits readiness and any authorized arming with a
 * notice only when the writer is observable, and each phase proves that by its
 * own rule (#890): `running-generation` shows the generation itself in flight,
-* while `awaiting-generation` shows a settled parent tip plus a pending
-* source-pinned hosted verify run that owes one (#521). Epic #473 decision 5
+* while `awaiting-generation` shows a settled parent tip plus a pending push
+* run, on this tip, of the workflow that wrote the parent's generation (#521,
+* #1276). Epic #473 decision 5
 * deliberately trades the settle-window wait against the measured rarity of a
 * red merge target. A writerless or unprovable repository fails closed.
 */
@@ -16842,7 +17006,7 @@ const collectBlockers = ({ correctnessRequired, correctnessStatus, correctnessUn
 	const awaitPostUndraftChecks = awaitPostUndraftChecksRepair(input);
 	if ((input.hostedVerifyCheck ?? "none") === "none") blockers.push({
 		demand: DEMAND_KEYS.githubChecks,
-		reason: `GitHub has no ${HOSTED_VERIFY_CHECK_NAME$1} check run from its workflow producer on this head; the branch ruleset pins it as a required check and the status rollup does not report the shortfall.`,
+		reason: `GitHub has no ${HOSTED_VERIFY_CHECK_NAME} check run from its workflow producer on this head; the branch ruleset pins it as a required check and the status rollup does not report the shortfall.`,
 		...awaitPostUndraftChecks
 	});
 	if (input.requiredChecks === "none" && input.classification !== "docs/process-only") blockers.push({
@@ -20310,7 +20474,7 @@ async function awaitHostedChecksSettled({ expectedHeadSha, fetchPr, report = (me
 			status: "timed-out",
 			verifyState
 		};
-		report(`pr:publish is waiting for hosted check runs on ${expectedHeadSha} to settle (${HOSTED_VERIFY_CHECK_NAME$1}: ${verifyState}; still running: ${pending.length > 0 ? pending.join(", ") : "none reported yet"}); attempt ${attempts + 1} of 40.\n`);
+		report(`pr:publish is waiting for hosted check runs on ${expectedHeadSha} to settle (${HOSTED_VERIFY_CHECK_NAME}: ${verifyState}; still running: ${pending.length > 0 ? pending.join(", ") : "none reported yet"}); attempt ${attempts + 1} of 40.\n`);
 		await sleep(PUBLISH_HOSTED_CHECKS_WAIT_MS);
 	}
 }
@@ -20767,7 +20931,7 @@ function createPrReviewCommand(output, action) {
 //#endregion
 //#region src/commands/pr-verify.ts
 function createPrVerifyCommand(output, action = runPrVerify) {
-	return markCwdOptionDefault(new Command("pr:verify").description("Run project-profile verification commands and write typed proof").option("--base <ref>", "base ref to assert. With a pull request open for this branch its live base is the base and a disagreeing value is refused; without one, this ref (default origin/main) is fetched fresh and its SHA recorded").option("--cwd <path>", "working directory to verify", collectCwdOption).option("--docs-only", "run the docs/process verification gate").option("--full", "run the full verification gate").option("--authoring-session <id>", "explicit authoring session identity (required for review evidence)").option("--json", "print the proof as JSON after verification").option("--output <path>", "write proof JSON to a file").option("--profile <path>", "path to the project profile JSON file").option("--no-status", "skip posting the patronage-factory/pr-verify commit status").action(withGateTiming({
+	return markCwdOptionDefault(new Command("pr:verify").description("Run project-profile verification commands and write typed proof").option("--base <ref>", "base ref to assert. With a pull request open for this branch its live base is the base and a disagreeing value is refused; without one, this ref (default origin/main) is fetched fresh and its SHA recorded").option("--cwd <path>", "working directory to verify", collectCwdOption).option("--docs-only", "run the docs/process verification gate").option("--full", "run the full verification gate").option("--authoring-session <id>", "explicit authoring session identity (required for review evidence)").option("--reuse-accepted", "reuse an exact-candidate App proof with matching current verification coverage; otherwise verify normally").option("--json", "print the proof as JSON after verification").option("--output <path>", "write proof JSON to a file").option("--profile <path>", "path to the project profile JSON file").option("--no-status", "skip posting the patronage-factory/pr-verify commit status").action(withGateTiming({
 		gate: "pr:verify",
 		resolveLedgerRoot: (options) => resolveCwdOption(options.cwd),
 		stderr: output.stderr
@@ -20782,7 +20946,8 @@ function createPrVerifyCommand(output, action = runPrVerify) {
 			mode: modeFor(options),
 			output: options.output,
 			profilePath: options.profile,
-			requireKnownAuthoringSession: true
+			requireKnownAuthoringSession: true,
+			reuseAccepted: options.reuseAccepted
 		}, dependencies);
 		if (options.json) output.stdout.write(`${JSON.stringify(proof, null, 2)}\n`);
 	})));
@@ -20794,6 +20959,7 @@ function modeFor(options) {
 }
 /** The GitHub deployment `task` that names receipts this tool wrote. */
 const DEPLOYMENT_RECEIPT_TASK = "patronage-factory/deployment";
+const PREVIEW_DEPLOYMENT_RECEIPT_TASK = "patronage-factory/preview-deployment";
 /** The `performed_via_github_app.id` of GitHub Actions itself. */
 const GITHUB_ACTIONS_APP_ID = 15368;
 const RECEIPT_PAGE_SIZE = 100;
@@ -20841,7 +21007,12 @@ const workflowRunIdentityFromEnv = (env) => {
 	} };
 };
 /** The payload this tool writes into every deployment it creates. */
+const previewScopeSchema = z.object({
+	headRef: z.string().min(1),
+	pr: z.number().int().positive()
+});
 const receiptPayloadSchema = z.object({
+	preview: previewScopeSchema.optional(),
 	repository: z.string().regex(REPOSITORY_PATTERN),
 	schemaVersion: z.literal(1),
 	sourceSha: z.string().regex(COMMIT_SHA_PATTERN$1),
@@ -20866,6 +21037,7 @@ const deploymentRecordSchema = z.object({
 	original_environment: z.string(),
 	payload: z.unknown(),
 	performed_via_github_app: z.object({ id: z.number().int() }).nullable().optional(),
+	production_environment: z.boolean().optional(),
 	sha: z.string(),
 	task: z.string()
 });
@@ -20882,15 +21054,23 @@ const workflowRunJobSchema = z.object({
 	})).optional()
 });
 const workflowRunRecordSchema = z.object({
+	event: z.string().optional(),
 	head_branch: z.string().nullable(),
 	head_sha: z.string(),
 	id: z.number().int(),
 	path: z.string(),
+	pull_requests: z.array(z.object({
+		head: z.object({
+			ref: z.string(),
+			sha: z.string()
+		}),
+		number: z.number().int()
+	})).optional(),
 	repository: z.object({ full_name: z.string() }),
 	run_attempt: z.number().int().positive()
 });
 /** The deployment environment one target's receipts live in. */
-const deploymentReceiptEnvironment = (target) => target;
+const deploymentReceiptEnvironment = (target, preview) => preview ? `${target}:pr-${preview.pr}` : target;
 const runUrl = (identity, runId) => `${identity.serverUrl}/${identity.repository}/actions/runs/${runId}`;
 /** The `$GITHUB_OUTPUT` key a success publication writes the new deployment id under. */
 const RECEIPT_DEPLOYMENT_ID_OUTPUT = "deployment_id";
@@ -20909,18 +21089,24 @@ const boundReceiptStepName = (deploymentId) => `Bind deployment receipt ${deploy
 * GitHub Actions, written by this tool for this repository, target, stage,
 * source, workflow, and ref.
 */
+const previewPayloadRefusal = (args, deployment, receipt) => {
+	if (!args.preview) return receipt.preview === void 0 ? void 0 : "is a preview receipt, not production";
+	if (deployment.production_environment !== false || receipt.preview?.pr !== args.preview.pr || receipt.preview.headRef !== args.preview.headRef || receipt.stage !== `pr-${args.preview.pr}` || receipt.sourceSha !== args.preview.candidateSha || receipt.workflow.ref !== `refs/pull/${args.preview.pr}/merge` || !args.preview.publishers.some((p) => p.workflowPath === receipt.workflow.path)) return "is not the expected hosted preview candidate and publisher";
+};
 const bindReceiptPayload = (args, deployment) => {
 	const label = `deployment ${deployment.id}`;
 	if (deployment.performed_via_github_app?.id !== GITHUB_ACTIONS_APP_ID) return { reason: `${label} was not performed by GitHub Actions` };
-	if (deployment.task !== "patronage-factory/deployment") return { reason: `${label} has a foreign task, not a factory receipt` };
+	if (deployment.task !== (args.preview ? PREVIEW_DEPLOYMENT_RECEIPT_TASK : "patronage-factory/deployment")) return { reason: `${label} has a foreign task, not a factory receipt` };
 	const payload = receiptPayloadSchema.safeParse(deployment.payload);
 	if (!payload.success) return { reason: `${label} payload is not a schema-version-1 factory receipt` };
 	const receipt = payload.data;
+	const previewReason = previewPayloadRefusal(args, deployment, receipt);
+	if (previewReason) return { reason: `${label} ${previewReason}` };
 	if (receipt.repository !== args.identity.repository) return { reason: `${label} names another repository` };
 	if (receipt.target !== args.target || receipt.stage !== args.stage) return { reason: `${label} names another target or stage` };
 	if (receipt.sourceSha !== deployment.sha.toLowerCase()) return { reason: `${label} payload source ${receipt.sourceSha} differs from its deployment sha` };
-	if (receipt.workflow.path !== args.identity.workflowPath) return { reason: `${label} was written by another workflow file, not ${args.identity.workflowPath}` };
-	if (receipt.workflow.ref !== args.identity.ref) return { reason: `${label} was written for another ref, not ${args.identity.ref}` };
+	if (!args.preview && receipt.workflow.path !== args.identity.workflowPath) return { reason: `${label} was written by another workflow file, not ${args.identity.workflowPath}` };
+	if (!args.preview && receipt.workflow.ref !== args.identity.ref) return { reason: `${label} was written for another ref, not ${args.identity.ref}` };
 	return { receipt };
 };
 /**
@@ -20929,11 +21115,52 @@ const bindReceiptPayload = (args, deployment) => {
 * must have bound this record's id. The first failure names the receipt
 * untrusted. Statuses are not read: they are caller-written.
 */
+const previewRunMatches = (preview, run, receipt) => !preview || run.event === "pull_request" && run.pull_requests?.some((pr) => pr.number === preview.pr && pr.head.sha === receipt.sourceSha && pr.head.ref === preview.headRef) === true;
+const previewStatusPassed = (transport, deploymentId) => {
+	try {
+		return z.array(z.object({
+			id: z.number().int(),
+			state: z.string()
+		})).parse(transport.listDeploymentStatuses(deploymentId)).toSorted((a, b) => b.id - a.id)[0]?.state === "success";
+	} catch {
+		return false;
+	}
+};
+const isReceiptWriter = (job, receipt, stepName, preview) => job.conclusion === "success" && job.run_id === Number(receipt.workflow.runId) && job.run_attempt === receipt.workflow.runAttempt && job.head_sha.toLowerCase() === receipt.sourceSha && job.steps?.some((step) => step.name === stepName && step.conclusion === "success") === true && (!preview || preview.publishers.some((p) => p.workflowPath === receipt.workflow.path && p.jobName === job.name && p.requiredSteps.length > 0 && p.requiredSteps.every((name) => job.steps?.some((step) => step.name === name && step.conclusion === "success"))));
+const runMatchesReceipt = (args, run, receipt) => run.id === Number(receipt.workflow.runId) && run.run_attempt === receipt.workflow.runAttempt && run.path === receipt.workflow.path && run.repository.full_name === args.identity.repository && run.head_sha.toLowerCase() === receipt.sourceSha && run.head_branch === (args.preview ? args.preview.headRef : args.identity.ref.replace(/^refs\/heads\//u, ""));
+const sameRunAttempt = (current, original) => current.id === original.id && current.run_attempt === original.run_attempt && current.path === original.path && current.repository.full_name === original.repository.full_name && current.head_sha === original.head_sha && current.head_branch === original.head_branch;
+const previewRunIsNewest = (args, receipt) => {
+	if (!args.preview) return true;
+	try {
+		const [newest] = args.preview.publishers.flatMap((publisher) => z.array(z.object({
+			conclusion: z.string().nullable(),
+			head_sha: z.literal(receipt.sourceSha),
+			id: z.number().int().positive(),
+			run_attempt: z.number().int().positive(),
+			run_started_at: z.string().datetime(),
+			status: z.string()
+		})).parse(args.transport.listPreviewWorkflowRuns?.(publisher.workflowPath, receipt.sourceSha))).toSorted((a, b) => Date.parse(b.run_started_at) - Date.parse(a.run_started_at) || b.id - a.id);
+		return newest?.id === Number(receipt.workflow.runId) && newest.run_attempt === receipt.workflow.runAttempt && newest.status === "completed" && newest.conclusion === "success";
+	} catch {
+		return false;
+	}
+};
+const previewWorkflowMatches = (args, receipt) => {
+	if (!args.preview) return true;
+	try {
+		const file = z.object({ sha: z.string().regex(/^[a-f0-9]{40}$/u) }).parse(args.transport.getWorkflowFile?.(receipt.workflow.path, receipt.sourceSha));
+		return args.preview.publishers.some((p) => p.workflowPath === receipt.workflow.path && p.workflowBlobSha === file.sha);
+	} catch {
+		return false;
+	}
+};
 const trustReceipt = (args, deployment) => {
 	const label = `deployment ${deployment.id}`;
 	const bound = bindReceiptPayload(args, deployment);
 	if ("reason" in bound) return bound;
 	const { receipt } = bound;
+	if (!previewRunIsNewest(args, receipt)) return { reason: `${label} is not the newest successful preview producer run` };
+	if (!previewWorkflowMatches(args, receipt)) return { reason: `${label} producer workflow differs from trusted default-branch authority` };
 	let runRecord;
 	let jobRecords;
 	let latestRunRecord;
@@ -20946,17 +21173,18 @@ const trustReceipt = (args, deployment) => {
 	}
 	const run = workflowRunRecordSchema.safeParse(runRecord);
 	if (!run.success) return { reason: `${label} names run ${receipt.workflow.runId}, which GitHub does not record` };
-	const expectedBranch = args.identity.ref.replace(/^refs\/heads\//u, "");
-	if (run.data.id !== Number(receipt.workflow.runId) || run.data.run_attempt !== receipt.workflow.runAttempt || run.data.path !== args.identity.workflowPath || run.data.repository.full_name !== args.identity.repository || run.data.head_sha.toLowerCase() !== receipt.sourceSha || run.data.head_branch !== expectedBranch) return { reason: `${label} names run ${receipt.workflow.runId}, whose recorded run, attempt, workflow, repository, head, or branch disagrees with the receipt` };
+	if (!runMatchesReceipt(args, run.data, receipt)) return { reason: `${label} run identity disagrees with the receipt` };
+	if (!previewRunMatches(args.preview, run.data, receipt)) return { reason: `${label} run does not identify this pull request candidate` };
 	const latestRun = workflowRunRecordSchema.safeParse(latestRunRecord);
-	if (!latestRun.success || latestRun.data.id !== run.data.id || latestRun.data.run_attempt !== receipt.workflow.runAttempt || latestRun.data.path !== run.data.path || latestRun.data.repository.full_name !== run.data.repository.full_name || latestRun.data.head_sha !== run.data.head_sha || latestRun.data.head_branch !== run.data.head_branch) return { reason: `${label} producing attempt is no longer the current matching run attempt; reconciliation is required` };
+	if (!latestRun.success || !sameRunAttempt(latestRun.data, run.data)) return { reason: `${label} producing attempt is no longer the current matching run attempt; reconciliation is required` };
 	const jobs = z.object({
 		jobs: z.array(workflowRunJobSchema),
 		total_count: z.number().int().nonnegative()
 	}).safeParse(jobRecords);
 	if (!jobs.success || jobs.data.total_count !== jobs.data.jobs.length) return { reason: `${label} names run ${receipt.workflow.runId}, whose job records are malformed or incomplete` };
 	const stepName = boundReceiptStepName(deployment.id);
-	if (jobs.data.jobs.find((job) => job.conclusion === "success" && job.run_id === Number(receipt.workflow.runId) && job.run_attempt === receipt.workflow.runAttempt && job.head_sha.toLowerCase() === receipt.sourceSha && job.steps?.some((step) => step.name === stepName && step.conclusion === "success")) === void 0) return { reason: `${label} names run ${receipt.workflow.runId}, but no succeeded job of that run at ${receipt.sourceSha} bound deployment ${deployment.id}` };
+	if (jobs.data.jobs.find((job) => isReceiptWriter(job, receipt, stepName, args.preview)) === void 0) return { reason: `${label} names run ${receipt.workflow.runId}, but no succeeded job of that run at ${receipt.sourceSha} bound deployment ${deployment.id}` };
+	if (args.preview && !previewStatusPassed(args.transport, deployment.id)) return { reason: `${label} preview status is not a readable success` };
 	return {
 		baseline: {
 			deploymentId: deployment.id,
@@ -20979,7 +21207,7 @@ const trustReceipt = (args, deployment) => {
 * record GitHub creates for it is unbound too.
 */
 const resolveDeploymentBaseline = (args) => {
-	const environment = deploymentReceiptEnvironment(args.target);
+	const environment = deploymentReceiptEnvironment(args.target, args.preview);
 	let deployments;
 	try {
 		const parsed = z.array(deploymentRecordSchema).safeParse(args.transport.listDeployments());
@@ -21017,9 +21245,20 @@ const createdDeploymentSchema = z.object({ id: z.number().int() });
 * earlier successful deployments of the environment inactive, so the newest
 * success is always what production runs.
 */
+const assertPublicationScope = (args) => {
+	if (args.preview && (args.stage !== `pr-${args.preview.pr}` || args.state !== "inactive" && args.identity.ref !== `refs/pull/${args.preview.pr}/merge`)) throw new Error("Preview receipt stage and workflow ref must identify the pull request.");
+	if (!args.preview && (args.deploymentId !== void 0 || args.state === "pending" || args.state === "inactive")) throw new Error("Pending, inactive and same-record completion are preview-only.");
+	if (args.preview && args.state === "success" && args.deploymentId === void 0) throw new Error("Preview success must finish its pre-mutation deployment intent.");
+};
+const assertOwnPreviewIntent = (args, payload, environment, deploymentId) => {
+	const own = z.array(deploymentRecordSchema).parse(args.transport.listDeployments()).find((record) => record.id === deploymentId);
+	if (!own || own.original_environment !== environment || own.sha !== args.sourceSha || own.production_environment !== false || own.task !== PREVIEW_DEPLOYMENT_RECEIPT_TASK || own.performed_via_github_app?.id !== GITHUB_ACTIONS_APP_ID || JSON.stringify(receiptPayloadSchema.parse(own.payload)) !== JSON.stringify(receiptPayloadSchema.parse(payload))) throw new Error("Preview completion must name this run's own deployment intent.");
+};
 const publishDeploymentReceipt = (args) => {
-	const environment = deploymentReceiptEnvironment(args.target);
+	const environment = deploymentReceiptEnvironment(args.target, args.preview);
+	assertPublicationScope(args);
 	const payload = {
+		...args.preview ? { preview: args.preview } : {},
 		repository: args.identity.repository,
 		schemaVersion: 1,
 		sourceSha: args.sourceSha,
@@ -21036,24 +21275,26 @@ const publishDeploymentReceipt = (args) => {
 			runId: args.identity.runId
 		}
 	};
-	const created = createdDeploymentSchema.parse(args.transport.createDeployment({
+	let { deploymentId } = args;
+	if (deploymentId === void 0) deploymentId = createdDeploymentSchema.parse(args.transport.createDeployment({
 		auto_merge: false,
 		description: `${DEPLOYMENT_RECEIPT_TASK} ${args.target} at ${args.sourceSha}`,
 		environment,
 		payload,
-		production_environment: true,
+		production_environment: !args.preview,
 		ref: args.sourceSha,
 		required_contexts: [],
-		task: DEPLOYMENT_RECEIPT_TASK
-	}));
-	args.transport.createDeploymentStatus(created.id, {
+		task: args.preview ? PREVIEW_DEPLOYMENT_RECEIPT_TASK : DEPLOYMENT_RECEIPT_TASK
+	})).id;
+	else assertOwnPreviewIntent(args, payload, environment, deploymentId);
+	args.transport.createDeploymentStatus(deploymentId, {
 		auto_inactive: args.state === "success",
 		description: `${args.state}: ${args.target} at ${args.sourceSha} by run ${args.identity.runId} attempt ${args.identity.runAttempt}`,
 		log_url: `${runUrl(args.identity, args.identity.runId)}/attempts/${args.identity.runAttempt}`,
 		state: args.state
 	});
 	return {
-		deploymentId: created.id,
+		deploymentId,
 		environment,
 		payload,
 		state: args.state
@@ -21120,10 +21361,20 @@ const ghDeploymentReceiptTransport = (cwd, repository, run = defaultGhRunner) =>
 	return {
 		createDeployment: (body) => post(`${base}/deployments`, body),
 		createDeploymentStatus: (deploymentId, body) => post(`${base}/deployments/${deploymentId}/statuses`, body),
+		getWorkflowFile: (workflowPath, sourceSha) => api(`${base}/contents/${workflowPath}?ref=${sourceSha}`),
 		getWorkflowRun: (runId) => api(`${base}/actions/runs/${runId}`),
 		getWorkflowRunAttempt: (runId, attempt) => api(`${base}/actions/runs/${runId}/attempts/${attempt}`),
 		listDeploymentStatuses: (deploymentId) => api(`${base}/deployments/${deploymentId}/statuses?per_page=${RECEIPT_PAGE_SIZE}`),
 		listDeployments: () => api(`${base}/deployments?per_page=${RECEIPT_PAGE_SIZE}`),
+		listPreviewWorkflowRuns: (workflowPath, sourceSha) => {
+			const pages = ghJson(run, [
+				"api",
+				"--paginate",
+				"--slurp",
+				`${base}/actions/workflows/${encodeURIComponent(path.basename(workflowPath))}/runs?head_sha=${sourceSha}&event=pull_request&per_page=${RECEIPT_PAGE_SIZE}`
+			], cwd);
+			return z.array(z.object({ workflow_runs: z.array(z.unknown()) })).parse(pages).flatMap((page) => page.workflow_runs);
+		},
 		listWorkflowRunJobs: (runId, attempt) => api(`${base}/actions/runs/${runId}/attempts/${attempt}/jobs?per_page=${RECEIPT_PAGE_SIZE}`)
 	};
 };
@@ -22166,6 +22417,138 @@ function createPreviewReapCommand(output, deps = {}) {
 	});
 }
 //#endregion
+//#region src/preview-receipt-command.ts
+const policySchema = z.object({
+	cleanupWorkflowPaths: z.array(z.string().regex(/^\.github\/workflows\/[^/]+\.ya?ml$/u)),
+	publishers: z.array(z.object({
+		jobId: z.string().min(1),
+		jobName: z.string().min(1),
+		requiredSteps: z.array(z.string().min(1)).min(1),
+		workflowPath: z.string().regex(/^\.github\/workflows\/[^/]+\.ya?ml$/u)
+	})).min(1),
+	targets: z.array(z.string().regex(/^preview:[a-z][a-z0-9-]*$/u)).min(1)
+});
+const safeCapture = (capture) => (args, cwd) => {
+	try {
+		const text = capture(args, cwd);
+		JSON.parse(text);
+		return text;
+	} catch {
+		throw new Error("Preview receipt authority could not be read.");
+	}
+};
+/** Authority is the GitHub default-branch profile at a resolved immutable SHA. */
+const readPreviewReceiptPolicy = (repository, cwd, rawCapture) => {
+	const capture = safeCapture(rawCapture);
+	const metadata = z.object({ default_branch: z.string().min(1) }).parse(JSON.parse(capture(["api", `repos/${repository}`], cwd)));
+	const ref = z.object({ object: z.object({ sha: z.string().regex(/^[a-f0-9]{40}$/u) }) }).parse(JSON.parse(capture(["api", `repos/${repository}/git/ref/heads/${encodeURIComponent(metadata.default_branch)}`], cwd)));
+	const file = z.object({
+		content: z.string(),
+		encoding: z.literal("base64")
+	}).parse(JSON.parse(capture(["api", `repos/${repository}/contents/software-factory.profile.json?ref=${ref.object.sha}`], cwd)));
+	const profile = JSON.parse(Buffer.from(file.content, "base64").toString("utf-8"));
+	const policy = policySchema.parse(profile.extensions?.hostedPreviewReceipts);
+	return {
+		...policy,
+		publishers: policy.publishers.map((publisher) => ({
+			...publisher,
+			workflowBlobSha: z.object({ sha: z.string().regex(/^[a-f0-9]{40}$/u) }).parse(JSON.parse(capture(["api", `repos/${repository}/contents/${publisher.workflowPath}?ref=${ref.object.sha}`], cwd))).sha
+		}))
+	};
+};
+const assertCurrentCheckout = (candidate, cwd) => {
+	if (candidate.state !== "open" || candidate.draft || runCapture("git", ["rev-parse", "HEAD"], cwd).stdout.trim() !== candidate.head.sha || runCapture("git", [
+		"status",
+		"--porcelain",
+		"--untracked-files=no"
+	], cwd).stdout.trim() !== "") throw new Error("Preview publication requires the clean current candidate checkout.");
+};
+const runPreviewReceipt = (options, env = process.env, rawCapture = (args, cwd) => runCapture("gh", args, cwd).stdout) => {
+	const capture = safeCapture(rawCapture);
+	const cwd = resolveCwdOption(options.cwd);
+	const repository = z.object({ nameWithOwner: z.string().regex(/^[^/\s]+\/[^/\s]+$/u) }).parse(JSON.parse(capture([
+		"repo",
+		"view",
+		"--json",
+		"nameWithOwner"
+	], cwd))).nameWithOwner;
+	const identityResult = workflowRunIdentityFromEnv(env);
+	if (options.action !== "read" && "invalid" in identityResult) throw new Error("Preview receipts require a complete GitHub Actions identity.");
+	const pr = z.coerce.number().int().positive().parse(options.pr);
+	const policy = readPreviewReceiptPolicy(repository, cwd, capture);
+	const candidate = z.object({
+		draft: z.boolean(),
+		head: z.object({
+			ref: z.string().min(1),
+			repo: z.object({ full_name: z.literal(repository) }),
+			sha: z.string().regex(/^[a-f0-9]{40}$/u)
+		}),
+		state: z.enum(["open", "closed"])
+	}).parse(JSON.parse(capture(["api", `repos/${repository}/pulls/${pr}`], cwd)));
+	const preview = {
+		headRef: candidate.head.ref,
+		pr
+	};
+	const stage = `pr-${pr}`;
+	const transport = ghDeploymentReceiptTransport(cwd, repository, capture);
+	if (options.action === "read") {
+		if (candidate.state !== "open" || candidate.draft) throw new Error("Preview reuse requires an open, ready candidate.");
+		const targets = policy.targets.map((target) => ({
+			receipt: resolveDeploymentBaseline({
+				identity: { repository },
+				preview: {
+					...preview,
+					candidateSha: candidate.head.sha,
+					publishers: policy.publishers
+				},
+				stage,
+				target,
+				transport
+			}),
+			target
+		}));
+		return {
+			headSha: candidate.head.sha,
+			physicalFreshness: "unchecked",
+			pr,
+			stage,
+			targets
+		};
+	}
+	if ("invalid" in identityResult || identityResult.identity.repository !== repository) throw new Error("Preview publisher identity disagrees with the current repository.");
+	const { identity } = identityResult;
+	if (!options.target || !policy.targets.includes(options.target)) throw new Error("Preview target is not authorized by the default-branch profile.");
+	const cleanup = options.action === "invalidate";
+	if (cleanup ? !policy.cleanupWorkflowPaths.includes(identity.workflowPath) : !policy.publishers.some((publisher) => publisher.workflowPath === identity.workflowPath && publisher.jobId === env.GITHUB_JOB)) throw new Error("This workflow job is not an authorized preview receipt publisher.");
+	if (!cleanup) assertCurrentCheckout(candidate, cwd);
+	const deploymentId = options.deploymentId === void 0 ? void 0 : z.coerce.number().int().positive().parse(options.deploymentId);
+	if (options.action === "complete" !== (deploymentId !== void 0)) throw new Error("Only completion requires a deployment id.");
+	let state = "inactive";
+	if (options.action === "begin") state = "pending";
+	if (options.action === "complete") state = z.enum(["success", "failure"]).parse(options.outcome);
+	const receipt = publishDeploymentReceipt({
+		deploymentId,
+		identity,
+		preview,
+		sourceSha: candidate.head.sha,
+		stage,
+		state,
+		target: options.target,
+		transport
+	});
+	if (options.githubOutput) appendFileSync(options.githubOutput, `deployment_id=${receipt.deploymentId}\n`);
+	return receipt;
+};
+const createPreviewReceiptCommand = (output) => markCwdOptionDefault(new Command("preview:receipt").description("Record hosted preview intent/results or read bound target receipts; physical freshness remains consumer-owned").requiredOption("--action <action>", "begin, complete, invalidate, or read").requiredOption("--pr <number>", "pull request owning the hosted pr-N stage").option("--cwd <path>", "repository working directory", collectCwdOption).option("--target <name>", "preview target from the trusted default-branch profile").option("--deployment-id <id>", "same intent id returned by begin").option("--outcome <outcome>", "success or failure for complete").option("--github-output <path>", "append deployment_id to the Actions output file").action((options) => {
+	z.enum([
+		"begin",
+		"complete",
+		"invalidate",
+		"read"
+	]).parse(options.action);
+	output.stdout.write(`${JSON.stringify(runPreviewReceipt(options), null, 2)}\n`);
+}));
+//#endregion
 //#region src/worktree-scratch-files.ts
 var worktree_scratch_files_exports = /* @__PURE__ */ __exportAll({
 	checkWorktreeScratchFiles: () => checkWorktreeScratchFiles,
@@ -22238,6 +22621,7 @@ function createProgram(options = {}) {
 	program.addCommand(createBoundaryCheckCommand(output, options.actions?.boundaryCheck));
 	program.addCommand(createPrVerifyCommand(output));
 	program.addCommand(createProductionImpactCommand(output));
+	program.addCommand(createPreviewReceiptCommand(output));
 	program.addCommand(createPreviewReapCommand(output));
 	program.addCommand(createCandidateImpactCommand(output));
 	program.addCommand(createCloseoutCommand(output));