@patronage/software-factory 1.0.0-alpha.4 → 1.0.0-alpha.41

package/dist/schemas.d.ts

@@ -1,5 +1,214 @@
 import { z } from "zod";
-
+//#region src/packages/review-prompt-sections/schema.d.ts
+declare const reviewPromptSectionSchema: z.ZodObject<{
+  provenance: z.ZodEnum<{
+    "coding-standards": "coding-standards";
+    "prior-review-ledger": "prior-review-ledger";
+    "issue-review-focus": "issue-review-focus";
+  }>;
+  source: z.ZodString;
+  text: z.ZodString;
+}, z.core.$strict>;
+type ReviewPromptSection = z.infer<typeof reviewPromptSectionSchema>;
+type ReviewPromptSectionProvenance = ReviewPromptSection["provenance"];
+declare const reviewPromptSectionsSchema: z.ZodArray<z.ZodObject<{
+  provenance: z.ZodEnum<{
+    "coding-standards": "coding-standards";
+    "prior-review-ledger": "prior-review-ledger";
+    "issue-review-focus": "issue-review-focus";
+  }>;
+  source: z.ZodString;
+  text: z.ZodString;
+}, z.core.$strict>>;
+//#endregion
+//#region src/policy-resolution.d.ts
+/** How a gate resolved the review policy it evaluated a candidate under. */
+declare const policyResolutionSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+  basePolicyDigest: z.ZodString;
+  baseRefName: z.ZodString;
+  candidatePolicyDigest: z.ZodString;
+  effectiveDigest: z.ZodString;
+  policyBaseSha: z.ZodString;
+  reviewPolicyChanged: z.ZodBoolean;
+  status: z.ZodLiteral<"authoritative">;
+}, z.core.$strict>, z.ZodObject<{
+  baseRefName: z.ZodString;
+  cause: z.ZodOptional<z.ZodEnum<{
+    "no-pull-request": "no-pull-request";
+    "lookup-failed": "lookup-failed";
+    "policy-unreadable": "policy-unreadable";
+  }>>;
+  reason: z.ZodString;
+  status: z.ZodLiteral<"unresolved">;
+}, z.core.$strict>], "status">;
+type PolicyResolution = z.infer<typeof policyResolutionSchema>;
+//#endregion
+//#region src/review-ladder-policy.d.ts
+type ReviewFindingCategory = "correctness" | "safety" | "coordination" | "maintainability" | "unknown";
+interface ReviewFindingAttributes {
+  blockingAfterCap?: boolean;
+  category?: string;
+  citedSpan?: string;
+  file?: string;
+  prescribedAction?: string;
+  priority?: string;
+  supersedes?: {
+    file?: string;
+    title: string;
+  };
+  title: string;
+}
+//#endregion
+//#region src/review-rungs.d.ts
+declare const EVIDENCE_REVIEW_RUNGS: readonly ["independent-model", "oracle", "human"];
+type EvidenceReviewRung = (typeof EVIDENCE_REVIEW_RUNGS)[number];
+//#endregion
+//#region src/review-ladder-ledger.d.ts
+type LadderCycleStage = "interior" | "gate";
+type LadderFindingReport = ReviewFindingAttributes;
+/** One finding as recorded in one cycle (GLOSSARY.md: finding occurrence). */
+interface ReviewOccurrenceRecord {
+  address: string;
+  /** The ladder-assigned cycle number the occurrence was recorded in. */
+  declaredCycle: number;
+  /**
+   * The root occurrence this one repeats: exact `findingKey` equality with an
+   * earlier occurrence, or the earlier occurrence an explicit `supersedes`
+   * names (decision 3), computed once at recording time. Points at the root
+   * of the group, never at an intermediate repeat.
+   */
+  repeatOf?: string;
+}
+declare const POLICY_DECLARATION_RULES: readonly ["cycle-2-severity-floor", "identity-repeat"];
+type PolicyDeclarationRule = (typeof POLICY_DECLARATION_RULES)[number];
+/**
+ * A disposition declaration as stored (GLOSSARY.md: disposition declaration):
+ * one occurrence, one disposition, the authority that made it and its
+ * reference (operator, reviewer) or rule (policy).
+ */
+type ReviewDeclarationRecord = {
+  authority: "operator" | "reviewer";
+  disposition: "fixed-in-thread" | "follow-up-filed" | "waived";
+  reference?: string;
+  target: string;
+} | {
+  authority: "policy";
+  disposition: "policy-accepted" | "stale-repeat";
+  rule: PolicyDeclarationRule;
+  target: string;
+};
+//#endregion
+//#region src/review-recording-schema.d.ts
+interface ReviewRecordedCycleIdentity {
+  /**
+   * SHA-256 of the proof file bytes this recording was applied to, or
+   * `absent` when no proof existed. The compare-and-swap at write time
+   * refuses to replace a proof whose bytes no longer digest to this value.
+   */
+  appliedTo: string;
+  base: {
+    ref: string;
+    sha: string;
+  };
+  /** SHA-256 of the dispositions file bytes; absent when none was given. */
+  dispositionsDigest?: string;
+  /** SHA-256 of the findings file bytes; names the retained copy. */
+  findingsDigest: string;
+  recordingId: string;
+}
+type ReviewCycleRecording = {
+  declarations: ReviewDeclarationRecord[]; /** Index-aligned with the cycle's `findings`. */
+  occurrences: ReviewOccurrenceRecord[];
+} & ReviewRecordedCycleIdentity;
+//#endregion
+//#region src/review-ladder.d.ts
+interface LadderSessionAttribution {
+  orchestrationMode?: "autonomous" | "manual";
+  resumedSession?: boolean;
+  runtime?: string;
+  sessionId?: string;
+}
+interface LadderUsageReport {
+  estimatedCostUsd?: number;
+  source?: string;
+  totalTokens?: number;
+}
+interface ReviewLadderCycle {
+  engine?: string;
+  findings: LadderFindingReport[];
+  identity?: {
+    headSha: string;
+    patchId: string;
+  };
+  historical?: true;
+  model?: string;
+  recording: ReviewCycleRecording;
+  session?: LadderSessionAttribution;
+  stage: LadderCycleStage;
+  usage?: LadderUsageReport;
+}
+//#endregion
+//#region src/pr-readiness/ladder-proof-state.d.ts
+interface PrReviewLadderState {
+  cycles: ReviewLadderCycle[];
+}
+//#endregion
+//#region src/pr-readiness/review-proof-types.d.ts
+type PrReviewKind = "correctness" | "security";
+type PrReviewOutcome = "passed" | "failed" | "error";
+//#endregion
+//#region src/pr-readiness/review-proof-shape.d.ts
+interface PrReviewFinding extends ReviewFindingAttributes {
+  body: string;
+  category?: ReviewFindingCategory;
+  line?: number;
+  protocolFinding?: true;
+}
+interface PrReviewResult {
+  kind: PrReviewKind;
+  startedAt: string;
+  endedAt: string;
+  durationMs: number;
+  model?: string;
+  producer?: string;
+  rung?: EvidenceReviewRung;
+  sessionId?: string;
+  outcome: PrReviewOutcome;
+  issuesFlagged: number;
+  summary: string;
+  findings: PrReviewFinding[];
+  lowerFindings?: (PrReviewFinding & {
+    priority: string;
+  })[];
+  typedVerdict?: boolean;
+  verdictSource?: "footer" | "recovered";
+  promptSections?: ReviewPromptSection[];
+}
+interface PrReviewProof {
+  schemaVersion: 3;
+  findingProvenanceVersion: 1;
+  base: string;
+  headSha: string;
+  patchId: string;
+  reviewCycle?: number;
+  maxReviewCycles?: number;
+  changedFiles: string[];
+  cleanedPaths: string[];
+  ladder?: PrReviewLadderState;
+  /**
+   * The policy identity this review run resolved its demanded kinds under
+   * (#922 Slice B). Optional: a run that could not reach the authority records
+   * the refusal instead, and `pr:ready` decides what an unresolved or
+   * disagreeing identity means for admission.
+   */
+  policyResolution?: PolicyResolution;
+  reviewRequirement?: {
+    reason: "no-applicable-mode" | "faithful-merge";
+    status: "not-required";
+  };
+  reviews: PrReviewResult[];
+}
+//#endregion
 //#region src/demand-waiver.d.ts
 /**
  * A demand that was in force, was NOT met, and was waived by the operator.
@@ -92,6 +301,55 @@ declare const boundaryReviewProofBaseSchema: z.ZodObject<{
 }, z.core.$loose>;
 type BoundaryReviewProof = z.infer<typeof boundaryReviewProofBaseSchema>;
 //#endregion
+//#region src/catch-up-recognition-record.d.ts
+interface CatchUpRecognition {
+  /** The ref the candidate targets, as the recognizing command resolved it. */
+  baseRef: string;
+  /** The live target tip at recognition time; the head's first parent. */
+  baseTipSha: string;
+  /** The head's second parent: the admitted base-side content merged in. */
+  mergedParentSha: string;
+  /**
+   * The tree `git merge-tree --write-tree` produced for the two parents. It
+   * equals the head's own tree; that equality is the faithfulness proof.
+   */
+  mergedTreeSha: string;
+  /** The ref that proves the second parent is admitted content. */
+  upstreamRef: string;
+}
+//#endregion
+//#region src/diff-classification.d.ts
+declare const DIFF_CLASSIFICATIONS: readonly ["docs/process-only", "trivial", "non-trivial"];
+type DiffClassification = (typeof DIFF_CLASSIFICATIONS)[number];
+//#endregion
+//#region src/impact-stamp.d.ts
+/**
+ * The recorded stamp. `targets` satisfies the completeness invariant: every
+ * target the profile declares is present, each with its exact basis — never
+ * silently absent. `basis: "conservative"` means an unmodelled or unprovable
+ * input widened every target to full impact.
+ */
+declare const impactStampSchema: z.ZodObject<{
+  basis: z.ZodEnum<{
+    "target-scoped": "target-scoped";
+    conservative: "conservative";
+  }>;
+  inertPaths: z.ZodDefault<z.ZodArray<z.ZodString>>;
+  reasons: z.ZodArray<z.ZodString>;
+  stampVersion: z.ZodLiteral<4>;
+  targets: z.ZodArray<z.ZodObject<{
+    basis: z.ZodString;
+    impact: z.ZodEnum<{
+      affected: "affected";
+      "not-affected": "not-affected";
+    }>;
+    name: z.ZodString;
+    subscribedPaths: z.ZodArray<z.ZodString>;
+  }, z.core.$strip>>;
+  unsubscribedPaths: z.ZodArray<z.ZodString>;
+}, z.core.$strip>;
+type ImpactStamp = z.infer<typeof impactStampSchema>;
+//#endregion
 //#region src/follow-up.d.ts
 interface FollowUpAction {
   /**
@@ -109,10 +367,6 @@ interface FollowUpAction {
   command: string;
 }
 //#endregion
-//#region src/diff-classification.d.ts
-declare const DIFF_CLASSIFICATIONS: readonly ["docs/process-only", "trivial", "non-trivial"];
-type DiffClassification = (typeof DIFF_CLASSIFICATIONS)[number];
-//#endregion
 //#region src/pr-verify-mode.d.ts
 /**
  * The verification mode `pr:verify` resolved for a run.
@@ -123,130 +377,272 @@ type DiffClassification = (typeof DIFF_CLASSIFICATIONS)[number];
  */
 type ResolvedPrVerifyMode = "docs-only" | "trivial" | "full";
 //#endregion
-//#region src/packages/review-prompt-sections/schema.d.ts
-declare const reviewPromptSectionSchema: z.ZodObject<{
-  provenance: z.ZodEnum<{
-    "prior-review-ledger": "prior-review-ledger";
-    "issue-review-focus": "issue-review-focus";
-  }>;
-  source: z.ZodString;
-  text: z.ZodString;
-}, z.core.$strict>;
-type ReviewPromptSection = z.infer<typeof reviewPromptSectionSchema>;
-//#endregion
-//#region src/review-ladder-policy.d.ts
-type ReviewFindingCategory = "correctness" | "safety" | "coordination" | "maintainability" | "unknown";
-declare const FINDING_DISPOSITIONS: readonly ["open", "fixed-in-thread", "follow-up-filed", "waived", "stale-repeat", "rerun-noise"];
-type FindingDisposition = (typeof FINDING_DISPOSITIONS)[number];
-interface ReviewFindingAttributes {
-  blockingAfterCap?: boolean;
-  category?: string;
-  citedSpan?: string;
-  file?: string;
-  prescribedAction?: string;
-  priority?: string;
-  supersedes?: {
-    file?: string;
-    title: string;
-  };
+//#region src/pr-verify-proof-contract.d.ts
+/**
+ * The pr:verify proof versions a reader accepts: the current one only (#920
+ * item 1). #917 narrowed the pr:ready reader the same way. A pr:verify proof
+ * is per-candidate and short-lived — it is rewritten on every head — so no
+ * stored v1–v3 proof can outlive the release that drops it. Pre-1.0 posture
+ * applies: one current contract, no compat reader. A consumer on an older
+ * factory must adopt this release before HQ ingests its pr:verify proofs.
+ */
+declare const SUPPORTED_PR_VERIFY_SCHEMA_VERSIONS: readonly [4];
+type PrVerifySchemaVersion = (typeof SUPPORTED_PR_VERIFY_SCHEMA_VERSIONS)[number];
+interface PrVerifyCommandResult {
+  command: string;
+  description: string;
+  /**
+   * Epic #550 wave 3 (#430): the profile's declared impact target for this
+   * command, recorded from v4 on. It is the proof's own command→target
+   * mapping: a `notRequiredCommands` entry must name the target recorded HERE
+   * for the same command, so a withholding cannot point at whichever released
+   * target happens to be convenient. Absent for a command the profile does
+   * not scope.
+   */
+  impactTarget?: string;
+  name: string;
+  scope: "docs-only" | "trivial" | "full";
+}
+/**
+ * One failing test a verification command reported (#1035).
+ *
+ * The proof keeps the failing test's IDENTITY and its failure CLASS, and
+ * nothing else. That is enough to decide retry-or-fix — a `timeout` under
+ * machine load is a flake, an `assertion` is a real break — without rerunning
+ * the aggregate to read a title off the console.
+ *
+ * It deliberately keeps no raw output tail and no error message body. This
+ * payload is transmitted to HQ ingest, and arbitrary command output can carry
+ * secrets (an echoed environment, a connection string inside a stack frame). A
+ * file path, a test title, and a closed `kind` enum cannot. The cost is the
+ * assertion diff and the stack frames: they help you FIX a failure, and the
+ * operator still reads them from the run's own console output.
+ */
+interface PrVerifyTestFailure {
+  /** The test file the reporter named, as the reporter wrote it. */
+  file: string;
+  /**
+   * The failure class. `timeout` is the test-timeout error vitest raises at
+   * its own ceiling; `assertion` is a failed expectation; `error` is every
+   * other thrown failure.
+   */
+  kind: "assertion" | "error" | "timeout";
+  /** The full test title, suite names included, as the reporter wrote it. */
   title: string;
 }
-//#endregion
-//#region src/review-rungs.d.ts
-declare const EVIDENCE_REVIEW_RUNGS: readonly ["independent-model", "oracle", "human"];
-type EvidenceReviewRung = (typeof EVIDENCE_REVIEW_RUNGS)[number];
-//#endregion
-//#region src/review-ladder-ledger.d.ts
-type LadderCycleStage = "interior" | "gate";
-type LadderFindingReport = ReviewFindingAttributes;
-type DeclarableFindingDisposition = Exclude<FindingDisposition, "open" | "stale-repeat" | "rerun-noise">;
-interface LadderDispositionDeclaration {
-  disposition: DeclarableFindingDisposition;
-  finding: {
-    file?: string;
-    title: string;
+interface PrVerifyExecutedCommand {
+  command: string;
+  counts?: {
+    testFiles?: number;
+    tests?: number;
   };
-  findingReport?: LadderFindingReport;
-  reference?: string;
-}
-//#endregion
-//#region src/review-ladder.d.ts
-interface LadderSessionAttribution {
-  orchestrationMode?: "autonomous" | "manual";
-  resumedSession?: boolean;
-  runtime?: string;
-  sessionId?: string;
-}
-interface LadderUsageReport {
-  estimatedCostUsd?: number;
-  source?: string;
-  totalTokens?: number;
+  durationMs: number;
+  exitCode: number;
+  /**
+   * The failing tests this command reported (#1035). Present only when the
+   * command produced parseable failures, so a passing command's record is
+   * byte-identical to the one it wrote before this field existed.
+   */
+  failures?: PrVerifyTestFailure[];
+  name: string;
+  scope: "docs-only" | "trivial" | "full";
 }
-interface ReviewLadderCycle {
-  dispositions?: LadderDispositionDeclaration[];
-  engine?: string;
-  findings: LadderFindingReport[];
-  identity?: {
-    headSha: string;
-    patchId: string;
-  };
-  model?: string;
-  correlatedRerun?: boolean;
-  session?: LadderSessionAttribution;
-  stage: LadderCycleStage;
-  usage?: LadderUsageReport;
-}
-//#endregion
-//#region src/pr-readiness/ladder-proof-state.d.ts
-interface PrReviewLadderState {
-  cycles: ReviewLadderCycle[];
-}
-//#endregion
-//#region src/pr-readiness/review-proof-types.d.ts
-type PrReviewKind = "correctness" | "security";
-type PrReviewOutcome = "passed" | "failed" | "error";
-//#endregion
-//#region src/pr-readiness/review-proof-shape.d.ts
-interface PrReviewFinding extends ReviewFindingAttributes {
-  body: string;
-  category?: ReviewFindingCategory;
-  line?: number;
-  protocolFinding?: true;
+/**
+ * Epic #550 wave 3 (#430): a verification command the impact stamp proved this
+ * candidate cannot reach, so the battery did not run it.
+ *
+ * The completeness invariant lives in the pairing: `verificationCommands`
+ * records every command the resolved mode selected, `executedCommands` records
+ * what ran, and this list records the rest WITH the stamp's own basis. A
+ * withheld stack is therefore never silently absent from the proof — it is
+ * present, named, and explained.
+ */
+interface PrVerifyNotRequiredCommand {
+  basis: string;
+  impactTarget: string;
+  name: string;
 }
-interface PrReviewResult {
-  kind: PrReviewKind;
-  startedAt: string;
-  endedAt: string;
-  durationMs: number;
-  model?: string;
-  producer?: string;
-  rung?: EvidenceReviewRung;
-  sessionId?: string;
-  outcome: PrReviewOutcome;
-  issuesFlagged: number;
-  summary: string;
-  findings: PrReviewFinding[];
-  typedVerdict?: boolean;
-  verdictSource?: "footer" | "recovered";
-  promptSections?: ReviewPromptSection[];
+/**
+ * Epic #758 (#762): a consumer package a stamp-scoped selection skipped, and
+ * why. Bound to the proof's stamp identity — refused when the proof records no
+ * stamp. The factory does not write this list; consumers do.
+ */
+interface PrVerifyNotDemandedRecord {
+  basis: string;
+  name: string;
 }
-interface PrReviewProof {
-  schemaVersion: 2;
-  findingProvenanceVersion: 1;
+interface PrVerifyProof {
+  schemaVersion: PrVerifySchemaVersion;
+  authoringSession: string;
   base: string;
-  headSha: string;
-  patchId: string;
-  reviewCycle?: number;
-  maxReviewCycles?: number;
+  /**
+   * The commit `base` resolved to when this proof was written (#1132): the
+   * live pull request base tip, or the freshly fetched ref. Optional and
+   * additive; a proof written before it existed parses unchanged.
+   */
+  baseSha?: string;
+  baselineFullProofs?: {
+    base: string;
+    changedFiles: string[];
+    headSha: string;
+    profilePath: string;
+    projectKey: string;
+    repository: string;
+  }[];
+  catchUpRecognition?: CatchUpRecognition;
   changedFiles: string[];
-  cleanedPaths: string[];
-  ladder?: PrReviewLadderState;
-  reviewRequirement?: {
-    reason: "no-applicable-mode";
-    status: "not-required";
-  };
-  reviews: PrReviewResult[];
+  classification: DiffClassification;
+  classificationReasons: string[];
+  command: "patronage-factory pr:verify";
+  durationMs: number;
+  endedAt: string;
+  executedCommands?: PrVerifyExecutedCommand[];
+  headSha: string;
+  impactStamp?: ImpactStamp;
+  mode: ResolvedPrVerifyMode;
+  mergeBaseSha?: string;
+  notDemandedRecords?: PrVerifyNotDemandedRecord[];
+  notRequiredCommands?: PrVerifyNotRequiredCommand[];
+  outcome?: "aborted" | "passed";
+  patchId?: string;
+  /**
+   * The review policy identity this verification run resolved (#922 Slice B).
+   *
+   * Verification demands no review mode of its own. It records the identity so
+   * `pr:ready` can see whether the stage that produced this proof judged the
+   * candidate under the same policy readiness resolves. Optional, and normally
+   * `unresolved` on the first run of a branch: a candidate is verified before
+   * it has a pull request, and there is no authority to read without one.
+   */
+  policyResolution?: PolicyResolution;
+  profilePath: string;
+  projectKey: string;
+  repository: string;
+  startedAt: string;
+  verificationCommands: PrVerifyCommandResult[];
 }
+declare const prVerifyProofSchema: z.ZodObject<{
+  authoringSession: z.ZodString;
+  base: z.ZodString;
+  baseSha: z.ZodOptional<z.ZodString>;
+  baselineFullProofs: z.ZodOptional<z.ZodArray<z.ZodObject<{
+    base: z.ZodString;
+    changedFiles: z.ZodArray<z.ZodString>;
+    headSha: z.ZodString;
+    profilePath: z.ZodString;
+    projectKey: z.ZodString;
+    repository: z.ZodString;
+  }, z.core.$strip>>>;
+  catchUpRecognition: z.ZodOptional<z.ZodType<CatchUpRecognition, unknown, z.core.$ZodTypeInternals<CatchUpRecognition, unknown>>>;
+  changedFiles: z.ZodArray<z.ZodString>;
+  classification: z.ZodEnum<{
+    "docs/process-only": "docs/process-only";
+    trivial: "trivial";
+    "non-trivial": "non-trivial";
+  }>;
+  classificationReasons: z.ZodArray<z.ZodString>;
+  command: z.ZodLiteral<"patronage-factory pr:verify">;
+  durationMs: z.ZodNumber;
+  endedAt: z.ZodISODateTime;
+  executedCommands: z.ZodOptional<z.ZodArray<z.ZodObject<{
+    command: z.ZodString;
+    counts: z.ZodOptional<z.ZodObject<{
+      testFiles: z.ZodOptional<z.ZodNumber>;
+      tests: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strip>>;
+    durationMs: z.ZodNumber;
+    exitCode: z.ZodNumber;
+    failures: z.ZodOptional<z.ZodArray<z.ZodObject<{
+      file: z.ZodString;
+      kind: z.ZodEnum<{
+        error: "error";
+        assertion: "assertion";
+        timeout: "timeout";
+      }>;
+      title: z.ZodString;
+    }, z.core.$strip>>>;
+    name: z.ZodString;
+    scope: z.ZodEnum<{
+      trivial: "trivial";
+      "docs-only": "docs-only";
+      full: "full";
+    }>;
+  }, z.core.$strip>>>;
+  headSha: z.ZodString;
+  impactStamp: z.ZodOptional<z.ZodObject<{
+    basis: z.ZodEnum<{
+      "target-scoped": "target-scoped";
+      conservative: "conservative";
+    }>;
+    inertPaths: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    reasons: z.ZodArray<z.ZodString>;
+    stampVersion: z.ZodLiteral<4>;
+    targets: z.ZodArray<z.ZodObject<{
+      basis: z.ZodString;
+      impact: z.ZodEnum<{
+        affected: "affected";
+        "not-affected": "not-affected";
+      }>;
+      name: z.ZodString;
+      subscribedPaths: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>>;
+    unsubscribedPaths: z.ZodArray<z.ZodString>;
+  }, z.core.$strip>>;
+  mergeBaseSha: z.ZodOptional<z.ZodString>;
+  mode: z.ZodEnum<{
+    trivial: "trivial";
+    "docs-only": "docs-only";
+    full: "full";
+  }>;
+  notDemandedRecords: z.ZodOptional<z.ZodArray<z.ZodObject<{
+    basis: z.ZodString;
+    name: z.ZodString;
+  }, z.core.$strip>>>;
+  notRequiredCommands: z.ZodOptional<z.ZodArray<z.ZodObject<{
+    basis: z.ZodString;
+    impactTarget: z.ZodString;
+    name: z.ZodString;
+  }, z.core.$strip>>>;
+  outcome: z.ZodOptional<z.ZodEnum<{
+    passed: "passed";
+    aborted: "aborted";
+  }>>;
+  patchId: z.ZodOptional<z.ZodString>;
+  policyResolution: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+    basePolicyDigest: z.ZodString;
+    baseRefName: z.ZodString;
+    candidatePolicyDigest: z.ZodString;
+    effectiveDigest: z.ZodString;
+    policyBaseSha: z.ZodString;
+    reviewPolicyChanged: z.ZodBoolean;
+    status: z.ZodLiteral<"authoritative">;
+  }, z.core.$strict>, z.ZodObject<{
+    baseRefName: z.ZodString;
+    cause: z.ZodOptional<z.ZodEnum<{
+      "no-pull-request": "no-pull-request";
+      "lookup-failed": "lookup-failed";
+      "policy-unreadable": "policy-unreadable";
+    }>>;
+    reason: z.ZodString;
+    status: z.ZodLiteral<"unresolved">;
+  }, z.core.$strict>], "status">>;
+  profilePath: z.ZodString;
+  projectKey: z.ZodString;
+  repository: z.ZodString;
+  schemaVersion: z.ZodLiteral<4>;
+  startedAt: z.ZodISODateTime;
+  verificationCommands: z.ZodArray<z.ZodObject<{
+    command: z.ZodString;
+    description: z.ZodString;
+    impactTarget: z.ZodOptional<z.ZodString>;
+    name: z.ZodString;
+    scope: z.ZodEnum<{
+      trivial: "trivial";
+      "docs-only": "docs-only";
+      full: "full";
+    }>;
+  }, z.core.$strip>>;
+}, z.core.$strip>;
 //#endregion
 //#region src/pr-readiness/readiness-ledger.d.ts
 declare const readinessRepairSchema: z.ZodObject<{
@@ -270,7 +666,6 @@ declare const managedReadinessLedgerSchema: z.ZodObject<{
       review: "review";
       verify: "verify";
     }>;
-    inScope: z.ZodBoolean;
     name: z.ZodString;
     reason: z.ZodOptional<z.ZodString>;
     scope: z.ZodOptional<z.ZodObject<{
@@ -324,17 +719,17 @@ declare const managedReadinessLedgerSchema: z.ZodObject<{
     }, z.core.$strip>;
     highestBlockingSeverity: z.ZodOptional<z.ZodEnum<{
       unknown: "unknown";
+      critical: "critical";
+      high: "high";
       low: "low";
       medium: "medium";
-      high: "high";
-      critical: "critical";
     }>>;
     highestOpenSeverity: z.ZodOptional<z.ZodEnum<{
       unknown: "unknown";
+      critical: "critical";
+      high: "high";
       low: "low";
       medium: "medium";
-      high: "high";
-      critical: "critical";
     }>>;
     maxReviewCycles: z.ZodOptional<z.ZodNumber>;
     nonBlockingFindings: z.ZodNumber;
@@ -378,8 +773,8 @@ declare const managedReadinessLedgerSchema: z.ZodObject<{
       reviewedHeadSha: z.ZodOptional<z.ZodString>;
       reviewedPatchId: z.ZodOptional<z.ZodString>;
       status: z.ZodEnum<{
-        "not-required": "not-required";
         blocked: "blocked";
+        "not-required": "not-required";
         current: "current";
         stale: "stale";
         missing: "missing";
@@ -390,28 +785,37 @@ declare const managedReadinessLedgerSchema: z.ZodObject<{
       reviewedHeadSha: z.ZodOptional<z.ZodString>;
       reviewedPatchId: z.ZodOptional<z.ZodString>;
       status: z.ZodEnum<{
-        "not-required": "not-required";
         blocked: "blocked";
+        "not-required": "not-required";
         current: "current";
         stale: "stale";
         missing: "missing";
       }>;
     }, z.core.$strip>>;
   }, z.core.$strip>;
-  schemaVersion: z.ZodLiteral<1>;
-  verification: z.ZodObject<{
+  schemaVersion: z.ZodLiteral<2>;
+  verification: z.ZodDiscriminatedUnion<[z.ZodObject<{
     command: z.ZodLiteral<"patronage-factory pr:verify">;
-    docsOnlyDeltaAccepted: z.ZodOptional<z.ZodBoolean>;
-    docsOnlyVerifiedHeadSha: z.ZodOptional<z.ZodString>;
-    prVerify: z.ZodEnum<{
-      passed: "passed";
-      stale: "stale";
-      missing: "missing";
-    }>;
-    trivialDeltaAccepted: z.ZodOptional<z.ZodBoolean>;
-    trivialVerifiedHeadSha: z.ZodOptional<z.ZodString>;
+    prVerify: z.ZodLiteral<"missing">;
+  }, z.core.$strict>, z.ZodObject<{
+    command: z.ZodLiteral<"patronage-factory pr:verify">;
+    prVerify: z.ZodLiteral<"stale">;
+    verifiedHeadSha: z.ZodString;
+  }, z.core.$strict>, z.ZodObject<{
+    command: z.ZodLiteral<"patronage-factory pr:verify">;
+    prVerify: z.ZodLiteral<"passed-via-head">;
+    verifiedHeadSha: z.ZodString;
+  }, z.core.$strict>, z.ZodObject<{
+    command: z.ZodLiteral<"patronage-factory pr:verify">;
+    docsOnlyVerifiedHeadSha: z.ZodString;
+    prVerify: z.ZodLiteral<"docs-only-delta">;
     verifiedHeadSha: z.ZodOptional<z.ZodString>;
-  }, z.core.$strip>;
+  }, z.core.$strict>, z.ZodObject<{
+    command: z.ZodLiteral<"patronage-factory pr:verify">;
+    prVerify: z.ZodLiteral<"trivial-delta">;
+    trivialVerifiedHeadSha: z.ZodString;
+    verifiedHeadSha: z.ZodOptional<z.ZodString>;
+  }, z.core.$strict>], "prVerify">;
 }, z.core.$strip>;
 type ReadinessRepair = z.infer<typeof readinessRepairSchema>;
 type ReadinessStatus = "ready" | "blocked";
@@ -422,17 +826,28 @@ interface PrReadyProof {
   schemaVersion: 3;
   /**
    * What GitHub actually did when this run armed native auto-merge (#477).
-   * Present exactly when a ready wave authorizes machine merge and arming ran;
-   * read back from the PR rather than inferred from the invocation, because `gh pr merge
-   * --auto` arms, merges, or does nothing with the same exit code and the same
-   * empty output. `not-armed` means the candidate is admitted but nothing will
-   * merge it, and `followUp` carries the re-dispatch.
+   * Also reports an already-merged no-op (#1456). Otherwise present exactly
+   * when a ready run called the arming module (#1299): not
+   * for an `autoMerge: false` wave, and not when a notice names why the run
+   * did not arm. Read back from the PR rather than inferred from the
+   * invocation, because `gh pr merge --auto` arms, merges, or does nothing
+   * with the same exit code and the same empty output. `not-armed` means the
+   * candidate is admitted but nothing will merge it, and `followUp` carries
+   * the re-dispatch.
    */
   arming?: {
     detail?: string;
     headSha: string;
     outcome: "armed" | "merged" | "not-armed";
   };
+  /**
+   * The authoring session readiness resolved for the review-independence
+   * cross-check (#1037). Recorded so the branded check can print it beside the
+   * review session, model, and producer the ledger already carries — the four
+   * identities a human weighs at merge time. Additive and optional: proofs
+   * written before it carry no field, so no schema version moves.
+   */
+  authoringSession?: string;
   /**
    * Why this run blocked, one entry per refusing demand (#391): `code` is the
    * demand key from the resolver's vocabulary, `detail` the one-sentence
@@ -467,6 +882,13 @@ interface PrReadyProof {
    * waived demand reads to a human. Absent when there are none.
    */
   notices?: string[];
+  /**
+   * The policy identity readiness resolved review demand under (#922): the
+   * base ref, its live tip, and the digests of the base, candidate, and merged
+   * review policies. Optional on the wire and additive — this is a new record
+   * on an unchanged contract, so no schema version moves.
+   */
+  policyResolution?: PolicyResolution;
   /** Committed profile blob evaluated by readiness. Required for merge. */
   profileBlobSha?: string;
   /** Checkout-relative committed profile path evaluated by readiness. */
@@ -484,31 +906,6 @@ interface PrReadyProof {
   waivedDemands?: WaivedDemand[];
 }
 //#endregion
-//#region src/impact-stamp.d.ts
-/**
- * The recorded stamp. `targets` satisfies the completeness invariant: every
- * target the profile declares is present, each with its exact basis — never
- * silently absent. `basis: "conservative"` means an unmodelled or unprovable
- * input widened every target to full impact.
- */
-declare const impactStampSchema: z.ZodObject<{
-  basis: z.ZodEnum<{
-    "target-scoped": "target-scoped";
-    conservative: "conservative";
-  }>;
-  reasons: z.ZodArray<z.ZodString>;
-  stampVersion: z.ZodLiteral<2>;
-  targets: z.ZodArray<z.ZodObject<{
-    basis: z.ZodString;
-    impact: z.ZodEnum<{
-      affected: "affected";
-      "not-affected": "not-affected";
-    }>;
-    name: z.ZodString;
-  }, z.core.$strip>>;
-}, z.core.$strip>;
-type ImpactStamp = z.infer<typeof impactStampSchema>;
-//#endregion
 //#region src/pr-readiness/external-evidence.d.ts
 declare const evidenceEnvelopeBaseSchema: z.ZodObject<{
   check: z.ZodString;
@@ -532,489 +929,27 @@ declare const evidenceEnvelopeBaseSchema: z.ZodObject<{
     "independent-model": "independent-model";
     oracle: "oracle";
     human: "human";
-  }>>;
-  schemaVersion: z.ZodLiteral<1>;
-  sessionId: z.ZodOptional<z.ZodString>;
-  timestamp: z.ZodOptional<z.ZodISODateTime>;
-}, z.core.$loose>;
-type EvidenceEnvelope = z.infer<typeof evidenceEnvelopeBaseSchema>;
-//#endregion
-//#region src/pr-readiness/verification-proof.d.ts
-declare const SUPPORTED_PR_VERIFY_SCHEMA_VERSIONS$1: readonly [1, 2, 3, 4];
-type PrVerifySchemaVersion = (typeof SUPPORTED_PR_VERIFY_SCHEMA_VERSIONS$1)[number];
-interface PrVerifyCommandResult {
-  command: string;
-  description: string;
-  /**
-   * Epic #550 wave 3 (#430): the profile's declared impact target for this
-   * command, recorded from v4 on. It is the proof's own command→target
-   * mapping: a `notRequiredCommands` entry must name the target recorded HERE
-   * for the same command, so a withholding cannot point at whichever released
-   * target happens to be convenient. Absent for a command the profile does
-   * not scope, and for v1–v3 proofs, which predate the field.
-   */
-  impactTarget?: string;
-  name: string;
-  scope: "always" | "docs-only" | "trivial" | "full";
-}
-interface PrVerifyExecutedCommand {
-  command: string;
-  counts?: {
-    testFiles?: number;
-    tests?: number;
-  };
-  durationMs: number;
-  exitCode: number;
-  name: string;
-  scope: "always" | "docs-only" | "trivial" | "full";
-}
-/**
- * Epic #550 wave 3 (#430): a verification command the impact stamp proved this
- * candidate cannot reach, so the battery did not run it.
- *
- * The completeness invariant lives in the pairing: `verificationCommands`
- * records every command the resolved mode selected, `executedCommands` records
- * what ran, and this list records the rest WITH the stamp's own basis. A
- * withheld stack is therefore never silently absent from the proof — it is
- * present, named, and explained.
- */
-interface PrVerifyNotRequiredCommand {
-  basis: string;
-  impactTarget: string;
-  name: string;
-}
-interface PrVerifyProof {
-  schemaVersion: PrVerifySchemaVersion;
-  authoringSession?: string;
-  base: string;
-  baselineFullProofs?: {
-    base: string;
-    changedFiles: string[];
-    headSha: string;
-    profilePath: string;
-    projectKey: string;
-    repository: string;
-  }[];
-  changedFiles: string[];
-  classification: DiffClassification;
-  classificationReasons: string[];
-  command: "patronage-factory pr:verify";
-  durationMs: number;
-  endedAt: string;
-  executedCommands?: PrVerifyExecutedCommand[];
-  headSha: string;
-  impactStamp?: ImpactStamp;
-  mode: ResolvedPrVerifyMode;
-  mergeBaseSha?: string;
-  notRequiredCommands?: PrVerifyNotRequiredCommand[];
-  outcome?: "aborted" | "passed";
-  patchId?: string;
-  profilePath: string;
-  projectKey: string;
-  repository: string;
-  startedAt: string;
-  verificationCommands: PrVerifyCommandResult[];
-}
-//#endregion
-//#region src/closeout-artifact.d.ts
-/** Current writer plus retained reader versions accepted at ingest. */
-declare const SUPPORTED_CLOSEOUT_SCHEMA_VERSIONS: readonly [3, 4];
-/** Strict, bounded runtime transport contract emitted by factory:closeout. */
-declare const closeoutArtifactSchema: z.ZodObject<{
-  boundaryThermo: z.ZodObject<{
-    owner: z.ZodString;
-    runs: z.ZodNumber;
-    waived: z.ZodBoolean;
-    waiverRationale: z.ZodOptional<z.ZodString>;
-  }, z.core.$strict>;
-  budget: z.ZodObject<{
-    note: z.ZodString;
-    tier: z.ZodLiteral<"overseer">;
-  }, z.core.$strict> | z.ZodObject<{
-    interiorSourcesConsumed: z.ZodNumber;
-    note: z.ZodString;
-    scoping: z.ZodOptional<z.ZodObject<{
-      epic: z.ZodString;
-      issueFilter: z.ZodOptional<z.ZodNumber>;
-      prFilter: z.ZodOptional<z.ZodNumber>;
-      repo: z.ZodString;
-      scopedByEpicIssueSet: z.ZodBoolean;
-      window: z.ZodObject<{
-        from: z.ZodString;
-        to: z.ZodString;
-      }, z.core.$strict>;
-    }, z.core.$strict>>;
-    tier: z.ZodLiteral<"overseer">;
-  }, z.core.$strict>;
-  couldNotSee: z.ZodArray<z.ZodObject<{
-    id: z.ZodString;
-    note: z.ZodString;
-    reason: z.ZodOptional<z.ZodString>;
-  }, z.core.$strict>>;
-  epic: z.ZodString;
-  generatedAt: z.ZodISODateTime;
-  ledgerRows: z.ZodArray<z.ZodObject<{
-    detail: z.ZodOptional<z.ZodString>;
-    epic: z.ZodString;
-    generatedAt: z.ZodISODateTime;
-    key: z.ZodString;
-    landingSpot: z.ZodOptional<z.ZodEnum<{
-      CLI: "CLI";
-      profile: "profile";
-      skill: "skill";
-      ADR: "ADR";
-    }>>;
-    repo: z.ZodString;
-    rowType: z.ZodEnum<{
-      metric: "metric";
-      lesson: "lesson";
-      blindspot: "blindspot";
-    }>;
-    schemaVersion: z.ZodLiteral<3 | 4>;
-    source: z.ZodString;
-    unit: z.ZodOptional<z.ZodString>;
-    value: z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodNull]>;
-  }, z.core.$strict>>;
-  lessons: z.ZodArray<z.ZodObject<{
-    id: z.ZodString;
-    landingSpot: z.ZodEnum<{
-      CLI: "CLI";
-      profile: "profile";
-      skill: "skill";
-      ADR: "ADR";
-    }>;
-    lesson: z.ZodString;
-    rationale: z.ZodOptional<z.ZodString>;
-    source: z.ZodOptional<z.ZodObject<{
-      detail: z.ZodString;
-      kind: z.ZodLiteral<"boundary-thermo-attestation">;
-    }, z.core.$strict>>;
-  }, z.core.$strict> | z.ZodObject<{
-    id: z.ZodString;
-    landingSpot: z.ZodEnum<{
-      CLI: "CLI";
-      profile: "profile";
-      skill: "skill";
-      ADR: "ADR";
-    }>;
-    lesson: z.ZodString;
-    rationale: z.ZodOptional<z.ZodString>;
-    source: z.ZodOptional<z.ZodObject<{
-      detail: z.ZodString;
-      kind: z.ZodEnum<{
-        "boundary-thermo-attestation": "boundary-thermo-attestation";
-        "interior-telemetry": "interior-telemetry";
-      }>;
-    }, z.core.$strict>>;
-  }, z.core.$strict>>;
-  metrics: z.ZodArray<z.ZodObject<{
-    label: z.ZodString;
-    metric: z.ZodString;
-    source: z.ZodObject<{
-      detail: z.ZodString;
-      kind: z.ZodLiteral<"boundary-thermo-attestation">;
-    }, z.core.$strict>;
-    unit: z.ZodEnum<{
-      boolean: "boolean";
-      text: "text";
-      count: "count";
-    }>;
-    value: z.ZodUnion<readonly [z.ZodNumber, z.ZodString, z.ZodBoolean, z.ZodNull]>;
-  }, z.core.$strict> | z.ZodObject<{
-    label: z.ZodString;
-    metric: z.ZodString;
-    source: z.ZodObject<{
-      detail: z.ZodString;
-      kind: z.ZodEnum<{
-        "boundary-thermo-attestation": "boundary-thermo-attestation";
-        "interior-telemetry": "interior-telemetry";
-      }>;
-    }, z.core.$strict>;
-    unit: z.ZodEnum<{
-      boolean: "boolean";
-      text: "text";
-      count: "count";
-      tokens: "tokens";
-      usd: "usd";
-      ratio: "ratio";
-    }>;
-    value: z.ZodUnion<readonly [z.ZodNumber, z.ZodString, z.ZodBoolean, z.ZodNull]>;
-  }, z.core.$strict>>;
-  repo: z.ZodString;
-  schemaVersion: z.ZodLiteral<3 | 4>;
-}, z.core.$strict>;
-/** Reader-only compatibility for closeout artifacts written before #554. */
-declare const legacyCloseoutArtifactSchema: z.ZodObject<{
-  boundaryThermo: z.ZodObject<{
-    owner: z.ZodString;
-    runs: z.ZodNumber;
-    waived: z.ZodBoolean;
-    waiverRationale: z.ZodOptional<z.ZodString>;
-  }, z.core.$strict>;
-  budget: z.ZodObject<{
-    note: z.ZodString;
-    tier: z.ZodLiteral<"overseer">;
-  }, z.core.$strict> | z.ZodObject<{
-    interiorSourcesConsumed: z.ZodNumber;
-    note: z.ZodString;
-    scoping: z.ZodOptional<z.ZodObject<{
-      epic: z.ZodString;
-      issueFilter: z.ZodOptional<z.ZodNumber>;
-      prFilter: z.ZodOptional<z.ZodNumber>;
-      repo: z.ZodString;
-      scopedByEpicIssueSet: z.ZodBoolean;
-      window: z.ZodObject<{
-        from: z.ZodString;
-        to: z.ZodString;
-      }, z.core.$strict>;
-    }, z.core.$strict>>;
-    tier: z.ZodLiteral<"overseer">;
-  }, z.core.$strict>;
-  couldNotSee: z.ZodArray<z.ZodObject<{
-    id: z.ZodString;
-    note: z.ZodString;
-    reason: z.ZodOptional<z.ZodString>;
-  }, z.core.$strict>>;
-  epic: z.ZodString;
-  generatedAt: z.ZodISODateTime;
-  ledgerRows: z.ZodArray<z.ZodObject<{
-    detail: z.ZodOptional<z.ZodString>;
-    epic: z.ZodString;
-    generatedAt: z.ZodISODateTime;
-    key: z.ZodString;
-    landingSpot: z.ZodOptional<z.ZodEnum<{
-      CLI: "CLI";
-      profile: "profile";
-      skill: "skill";
-      ADR: "ADR";
-    }>>;
-    repo: z.ZodString;
-    rowType: z.ZodEnum<{
-      metric: "metric";
-      lesson: "lesson";
-      blindspot: "blindspot";
-    }>;
-    schemaVersion: z.ZodLiteral<3 | 4>;
-    source: z.ZodString;
-    unit: z.ZodOptional<z.ZodString>;
-    value: z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodNull]>;
-  }, z.core.$strict>>;
-  lessons: z.ZodArray<z.ZodObject<{
-    id: z.ZodString;
-    landingSpot: z.ZodEnum<{
-      CLI: "CLI";
-      profile: "profile";
-      skill: "skill";
-      ADR: "ADR";
-    }>;
-    lesson: z.ZodString;
-    rationale: z.ZodOptional<z.ZodString>;
-    source: z.ZodOptional<z.ZodObject<{
-      detail: z.ZodString;
-      kind: z.ZodLiteral<"boundary-thermo-attestation">;
-    }, z.core.$strict>>;
-  }, z.core.$strict> | z.ZodObject<{
-    id: z.ZodString;
-    landingSpot: z.ZodEnum<{
-      CLI: "CLI";
-      profile: "profile";
-      skill: "skill";
-      ADR: "ADR";
-    }>;
-    lesson: z.ZodString;
-    rationale: z.ZodOptional<z.ZodString>;
-    source: z.ZodOptional<z.ZodObject<{
-      detail: z.ZodString;
-      kind: z.ZodEnum<{
-        "boundary-thermo-attestation": "boundary-thermo-attestation";
-        "interior-telemetry": "interior-telemetry";
-      }>;
-    }, z.core.$strict>>;
-  }, z.core.$strict>>;
-  metrics: z.ZodArray<z.ZodObject<{
-    label: z.ZodString;
-    metric: z.ZodString;
-    source: z.ZodObject<{
-      detail: z.ZodString;
-      kind: z.ZodLiteral<"boundary-thermo-attestation">;
-    }, z.core.$strict>;
-    unit: z.ZodEnum<{
-      boolean: "boolean";
-      text: "text";
-      count: "count";
-    }>;
-    value: z.ZodUnion<readonly [z.ZodNumber, z.ZodString, z.ZodBoolean, z.ZodNull]>;
-  }, z.core.$strict> | z.ZodObject<{
-    label: z.ZodString;
-    metric: z.ZodString;
-    source: z.ZodObject<{
-      detail: z.ZodString;
-      kind: z.ZodEnum<{
-        "boundary-thermo-attestation": "boundary-thermo-attestation";
-        "interior-telemetry": "interior-telemetry";
-      }>;
-    }, z.core.$strict>;
-    unit: z.ZodEnum<{
-      boolean: "boolean";
-      text: "text";
-      count: "count";
-      tokens: "tokens";
-      usd: "usd";
-      ratio: "ratio";
-    }>;
-    value: z.ZodUnion<readonly [z.ZodNumber, z.ZodString, z.ZodBoolean, z.ZodNull]>;
-  }, z.core.$strict>>;
-  repo: z.ZodString;
-  schemaVersion: z.ZodLiteral<3 | 4>;
-}, z.core.$strict>;
-/** Accept current output and retained v3 artifacts when reading or replaying. */
-declare const closeoutArtifactReadSchema: z.ZodUnion<readonly [z.ZodObject<{
-  boundaryThermo: z.ZodObject<{
-    owner: z.ZodString;
-    runs: z.ZodNumber;
-    waived: z.ZodBoolean;
-    waiverRationale: z.ZodOptional<z.ZodString>;
-  }, z.core.$strict>;
-  budget: z.ZodObject<{
-    note: z.ZodString;
-    tier: z.ZodLiteral<"overseer">;
-  }, z.core.$strict> | z.ZodObject<{
-    interiorSourcesConsumed: z.ZodNumber;
-    note: z.ZodString;
-    scoping: z.ZodOptional<z.ZodObject<{
-      epic: z.ZodString;
-      issueFilter: z.ZodOptional<z.ZodNumber>;
-      prFilter: z.ZodOptional<z.ZodNumber>;
-      repo: z.ZodString;
-      scopedByEpicIssueSet: z.ZodBoolean;
-      window: z.ZodObject<{
-        from: z.ZodString;
-        to: z.ZodString;
-      }, z.core.$strict>;
-    }, z.core.$strict>>;
-    tier: z.ZodLiteral<"overseer">;
-  }, z.core.$strict>;
-  couldNotSee: z.ZodArray<z.ZodObject<{
-    id: z.ZodString;
-    note: z.ZodString;
-    reason: z.ZodOptional<z.ZodString>;
-  }, z.core.$strict>>;
-  epic: z.ZodString;
-  generatedAt: z.ZodISODateTime;
-  ledgerRows: z.ZodArray<z.ZodObject<{
-    detail: z.ZodOptional<z.ZodString>;
-    epic: z.ZodString;
-    generatedAt: z.ZodISODateTime;
-    key: z.ZodString;
-    landingSpot: z.ZodOptional<z.ZodEnum<{
-      CLI: "CLI";
-      profile: "profile";
-      skill: "skill";
-      ADR: "ADR";
-    }>>;
-    repo: z.ZodString;
-    rowType: z.ZodEnum<{
-      metric: "metric";
-      lesson: "lesson";
-      blindspot: "blindspot";
-    }>;
-    schemaVersion: z.ZodLiteral<3 | 4>;
-    source: z.ZodString;
-    unit: z.ZodOptional<z.ZodString>;
-    value: z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodNull]>;
-  }, z.core.$strict>>;
-  lessons: z.ZodArray<z.ZodObject<{
-    id: z.ZodString;
-    landingSpot: z.ZodEnum<{
-      CLI: "CLI";
-      profile: "profile";
-      skill: "skill";
-      ADR: "ADR";
-    }>;
-    lesson: z.ZodString;
-    rationale: z.ZodOptional<z.ZodString>;
-    source: z.ZodOptional<z.ZodObject<{
-      detail: z.ZodString;
-      kind: z.ZodLiteral<"boundary-thermo-attestation">;
-    }, z.core.$strict>>;
-  }, z.core.$strict> | z.ZodObject<{
-    id: z.ZodString;
-    landingSpot: z.ZodEnum<{
-      CLI: "CLI";
-      profile: "profile";
-      skill: "skill";
-      ADR: "ADR";
-    }>;
-    lesson: z.ZodString;
-    rationale: z.ZodOptional<z.ZodString>;
-    source: z.ZodOptional<z.ZodObject<{
-      detail: z.ZodString;
-      kind: z.ZodEnum<{
-        "boundary-thermo-attestation": "boundary-thermo-attestation";
-        "interior-telemetry": "interior-telemetry";
-      }>;
-    }, z.core.$strict>>;
-  }, z.core.$strict>>;
-  metrics: z.ZodArray<z.ZodObject<{
-    label: z.ZodString;
-    metric: z.ZodString;
-    source: z.ZodObject<{
-      detail: z.ZodString;
-      kind: z.ZodLiteral<"boundary-thermo-attestation">;
-    }, z.core.$strict>;
-    unit: z.ZodEnum<{
-      boolean: "boolean";
-      text: "text";
-      count: "count";
-    }>;
-    value: z.ZodUnion<readonly [z.ZodNumber, z.ZodString, z.ZodBoolean, z.ZodNull]>;
-  }, z.core.$strict> | z.ZodObject<{
-    label: z.ZodString;
-    metric: z.ZodString;
-    source: z.ZodObject<{
-      detail: z.ZodString;
-      kind: z.ZodEnum<{
-        "boundary-thermo-attestation": "boundary-thermo-attestation";
-        "interior-telemetry": "interior-telemetry";
-      }>;
-    }, z.core.$strict>;
-    unit: z.ZodEnum<{
-      boolean: "boolean";
-      text: "text";
-      count: "count";
-      tokens: "tokens";
-      usd: "usd";
-      ratio: "ratio";
-    }>;
-    value: z.ZodUnion<readonly [z.ZodNumber, z.ZodString, z.ZodBoolean, z.ZodNull]>;
-  }, z.core.$strict>>;
-  repo: z.ZodString;
-  schemaVersion: z.ZodLiteral<3 | 4>;
-}, z.core.$strict>, z.ZodObject<{
-  boundaryThermo: z.ZodObject<{
-    owner: z.ZodString;
-    runs: z.ZodNumber;
-    waived: z.ZodBoolean;
-    waiverRationale: z.ZodOptional<z.ZodString>;
-  }, z.core.$strict>;
+  }>>;
+  schemaVersion: z.ZodLiteral<1>;
+  sessionId: z.ZodOptional<z.ZodString>;
+  timestamp: z.ZodOptional<z.ZodISODateTime>;
+}, z.core.$loose>;
+type EvidenceEnvelope = z.infer<typeof evidenceEnvelopeBaseSchema>;
+//#endregion
+//#region src/pr-readiness/review-proof.d.ts
+declare const PR_REVIEW_SCHEMA_VERSION = 3;
+declare const prReviewFindingSchema: z.ZodType<PrReviewFinding>;
+declare const prReviewResultSchema: z.ZodType<PrReviewResult>;
+declare const prReviewProofSchema: z.ZodType<PrReviewProof>;
+//#endregion
+//#region src/closeout-artifact.d.ts
+/** Artifact versions accepted at ingest. */
+declare const SUPPORTED_CLOSEOUT_SCHEMA_VERSIONS: readonly [5];
+/** Strict, bounded runtime transport contract emitted by factory:closeout. */
+declare const closeoutArtifactSchema: z.ZodObject<{
   budget: z.ZodObject<{
     note: z.ZodString;
     tier: z.ZodLiteral<"overseer">;
-  }, z.core.$strict> | z.ZodObject<{
-    interiorSourcesConsumed: z.ZodNumber;
-    note: z.ZodString;
-    scoping: z.ZodOptional<z.ZodObject<{
-      epic: z.ZodString;
-      issueFilter: z.ZodOptional<z.ZodNumber>;
-      prFilter: z.ZodOptional<z.ZodNumber>;
-      repo: z.ZodString;
-      scopedByEpicIssueSet: z.ZodBoolean;
-      window: z.ZodObject<{
-        from: z.ZodString;
-        to: z.ZodString;
-      }, z.core.$strict>;
-    }, z.core.$strict>>;
-    tier: z.ZodLiteral<"overseer">;
   }, z.core.$strict>;
   couldNotSee: z.ZodArray<z.ZodObject<{
     id: z.ZodString;
@@ -1023,82 +958,12 @@ declare const closeoutArtifactReadSchema: z.ZodUnion<readonly [z.ZodObject<{
   }, z.core.$strict>>;
   epic: z.ZodString;
   generatedAt: z.ZodISODateTime;
-  ledgerRows: z.ZodArray<z.ZodObject<{
-    detail: z.ZodOptional<z.ZodString>;
-    epic: z.ZodString;
-    generatedAt: z.ZodISODateTime;
-    key: z.ZodString;
-    landingSpot: z.ZodOptional<z.ZodEnum<{
-      CLI: "CLI";
-      profile: "profile";
-      skill: "skill";
-      ADR: "ADR";
-    }>>;
-    repo: z.ZodString;
-    rowType: z.ZodEnum<{
-      metric: "metric";
-      lesson: "lesson";
-      blindspot: "blindspot";
-    }>;
-    schemaVersion: z.ZodLiteral<3 | 4>;
-    source: z.ZodString;
-    unit: z.ZodOptional<z.ZodString>;
-    value: z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodNull]>;
-  }, z.core.$strict>>;
-  lessons: z.ZodArray<z.ZodObject<{
-    id: z.ZodString;
-    landingSpot: z.ZodEnum<{
-      CLI: "CLI";
-      profile: "profile";
-      skill: "skill";
-      ADR: "ADR";
-    }>;
-    lesson: z.ZodString;
-    rationale: z.ZodOptional<z.ZodString>;
-    source: z.ZodOptional<z.ZodObject<{
-      detail: z.ZodString;
-      kind: z.ZodLiteral<"boundary-thermo-attestation">;
-    }, z.core.$strict>>;
-  }, z.core.$strict> | z.ZodObject<{
-    id: z.ZodString;
-    landingSpot: z.ZodEnum<{
-      CLI: "CLI";
-      profile: "profile";
-      skill: "skill";
-      ADR: "ADR";
-    }>;
-    lesson: z.ZodString;
-    rationale: z.ZodOptional<z.ZodString>;
-    source: z.ZodOptional<z.ZodObject<{
-      detail: z.ZodString;
-      kind: z.ZodEnum<{
-        "boundary-thermo-attestation": "boundary-thermo-attestation";
-        "interior-telemetry": "interior-telemetry";
-      }>;
-    }, z.core.$strict>>;
-  }, z.core.$strict>>;
   metrics: z.ZodArray<z.ZodObject<{
     label: z.ZodString;
     metric: z.ZodString;
     source: z.ZodObject<{
       detail: z.ZodString;
-      kind: z.ZodLiteral<"boundary-thermo-attestation">;
-    }, z.core.$strict>;
-    unit: z.ZodEnum<{
-      boolean: "boolean";
-      text: "text";
-      count: "count";
-    }>;
-    value: z.ZodUnion<readonly [z.ZodNumber, z.ZodString, z.ZodBoolean, z.ZodNull]>;
-  }, z.core.$strict> | z.ZodObject<{
-    label: z.ZodString;
-    metric: z.ZodString;
-    source: z.ZodObject<{
-      detail: z.ZodString;
-      kind: z.ZodEnum<{
-        "boundary-thermo-attestation": "boundary-thermo-attestation";
-        "interior-telemetry": "interior-telemetry";
-      }>;
+      kind: z.ZodLiteral<"token-harvest">;
     }, z.core.$strict>;
     unit: z.ZodEnum<{
       boolean: "boolean";
@@ -1106,191 +971,35 @@ declare const closeoutArtifactReadSchema: z.ZodUnion<readonly [z.ZodObject<{
       count: "count";
       tokens: "tokens";
       usd: "usd";
-      ratio: "ratio";
     }>;
     value: z.ZodUnion<readonly [z.ZodNumber, z.ZodString, z.ZodBoolean, z.ZodNull]>;
   }, z.core.$strict>>;
   repo: z.ZodString;
-  schemaVersion: z.ZodLiteral<3 | 4>;
-}, z.core.$strict>]>;
+  schemaVersion: z.ZodLiteral<5>;
+}, z.core.$strict>;
 type CloseoutArtifact = z.infer<typeof closeoutArtifactSchema>;
-type HistoricalCloseoutArtifact = z.infer<typeof legacyCloseoutArtifactSchema>;
 //#endregion
-//#region src/retro-envelope.d.ts
-/**
- * Versioned retro envelope schema (epic #27 wave 2, issue #34).
- *
- * One envelope per lane, built at `factory:closeout` and delivered through the
- * typed gate-sink as the `retro-envelope` ingest kind. Re-derived in TypeScript
- * from the `spike/telemetry-layer2` S5 scratch schema (reference-only, never
- * merged). This module is the single source of truth for the v1 wire shape
- * and its bounds ({@link RETRO_ENVELOPE_WIRE_BOUNDS}) — producer and consumer
- * alike. HQ imports these exports directly from the Worker-safe
- * `@patronage/software-factory/schemas` subpath
- * (`software-factory-hq/src/contracts/retro-schemas.ts`) instead of
- * maintaining a parallel hand-written copy, so there is exactly one wire
- * contract and no drift-detection machinery is needed (issue #350; formerly
- * a hand-written twin plus a 767-line parity test, #46).
- *
- * DESIGN INVARIANT: cross-family token sums must be UNREPRESENTABLE.
- *
- * The two model families use different tokenizers, prices, and accounting
- * conventions, so any token total that spans Claude and GPT is a lie:
- *
- * 1. There is no combined/total token field anywhere in the envelope.
- * 2. `tokenFamilies` is strict — its only keys are `claude` and `gpt`; data
- *    cannot smuggle in a third "all"/"combined" slot.
- * 3. The family BLOCKS are structurally different shapes with DIFFERENT keys
- *    (claude is a single flat block keyed on freshInput/cacheReadInput/
- *    cacheCreationInput; gpt is `{ roles: [...] }`). The exclusive input-tier
- *    COUNTS share no key name across families. The residual names shared
- *    between the claude block and a gpt ROLE entry are pinned to exactly
- *    {costUsd, model, output} (PR #32 advisory): `costUsd` is deliberate —
- *    USD is the one cross-family summable unit (rule 4); `model` is an
- *    unsummable label; `output` is the same name at DIFFERENT depths (lane
- *    block vs per-role entry), frozen by a tripwire test in
- *    `retro-envelope.test.ts` so the overlap cannot grow. Renaming `output`
- *    is a schemaVersion-2 wire change, deliberately not spent in v1.
- * 4. Cost is per-family USD and nullable. Combined totals are allowed in USD
- *    only, and only as a projection-time sum of per-family USD.
- *
- * Field names also encode the S2/S3 reader lessons: Claude `freshInput` alone
- * is not prompt size (true input context = freshInput + cacheReadInput +
- * cacheCreationInput, requestId-deduped), and codex `inputInclusiveOfCache`
- * already includes `cachedInput`, so `freshInputDerived` (inclusive − cached)
- * is the only value safe to feed a per-token pricer.
- *
- * COMPLETENESS POSTURE: harvest may have no usable native log for a lane, so
- * `tokenFamilies` may legitimately be absent. The closeout build gate demands
- * a valid envelope, not available telemetry. A families-absent envelope keeps
- * its operator-visible data gaps and is a replayable advisory HQ event, so it
- * never substitutes unavailable usage with zero. The wire shape (field names,
- * types, structure) stays byte-parity with HQ v1.
- */
-declare const RETRO_ENVELOPE_SCHEMA_VERSION = 1;
-/**
- * v1 wire bounds — the single source the schemas below are built from and the
- * builder's sanitization seam clamps to (`retro-envelope-builder.ts` imports
- * these; it keeps no bound constants of its own). HQ imports this module
- * directly (issue #350), so there is one set of bounds, not a second copy to
- * keep in sync.
- */
-declare const RETRO_ENVELOPE_WIRE_BOUNDS: {
-  /** archiveRef pointer (key/URL) max characters. */readonly archiveRefMaxChars: 2048; /** refs.branch max characters (git ref length ceiling). */
-  readonly branchMaxChars: 255; /** gates[] wire cap — the builder keeps the most recent records. */
-  readonly gatesMax: 500; /** gpt roles[] cap (delegated roles per lane). */
-  readonly gptRolesMax: 20; /** Cap for list fields: joinKeys id arrays, phases, dataGaps. */
-  readonly listMax: 100; /** Bounded name fields: agentRunId, gate, phase name, refs, join-key ids. */
-  readonly nameMaxChars: 200; /** Short identifier fields: repo name/owner, model, role. */
-  readonly shortMaxChars: 100; /** Free-text fields: dataGaps entries, outcome.verdict. */
-  readonly textMaxChars: 500;
-};
-declare const retroEnvelopeV1Schema: z.ZodObject<{
+//#region src/gate-timing-record.d.ts
+declare const gateTimingRecordSchema: z.ZodObject<{
   agentRunId: z.ZodString;
-  archiveRef: z.ZodOptional<z.ZodString>;
-  cycles: z.ZodObject<{
-    gateRunsToFirstGreen: z.ZodNumber;
-    reviewerFixRounds: z.ZodNumber;
-    thermoFixRounds: z.ZodNumber;
-  }, z.core.$strict>;
-  dataGaps: z.ZodDefault<z.ZodArray<z.ZodString>>;
-  gates: z.ZodArray<z.ZodObject<{
-    cycle: z.ZodNumber;
-    duration: z.ZodNumber;
-    gate: z.ZodString;
-    outcome: z.ZodEnum<{
-      pass: "pass";
-      fail: "fail";
-      skip: "skip";
-    }>;
-    startedAt: z.ZodISODateTime;
-  }, z.core.$strict>>;
-  generatedAt: z.ZodISODateTime;
-  interventions: z.ZodObject<{
-    count: z.ZodNumber;
-  }, z.core.$strict>;
-  joinKeys: z.ZodObject<{
-    claudeSessionIds: z.ZodDefault<z.ZodArray<z.ZodString>>;
-    codexThreadIds: z.ZodDefault<z.ZodArray<z.ZodString>>;
-  }, z.core.$strict>;
-  kind: z.ZodLiteral<"retro-envelope">;
-  outcome: z.ZodOptional<z.ZodObject<{
-    status: z.ZodEnum<{
-      fail: "fail";
-      success: "success";
-      blocked: "blocked";
-      "ship-with-followups": "ship-with-followups";
-    }>;
-    verdict: z.ZodOptional<z.ZodString>;
-  }, z.core.$strict>>;
-  phases: z.ZodArray<z.ZodObject<{
-    at: z.ZodISODateTime;
-    deltaSec: z.ZodOptional<z.ZodNumber>;
-    name: z.ZodString;
-  }, z.core.$strict>>;
-  refs: z.ZodObject<{
-    branch: z.ZodOptional<z.ZodString>;
-    epic: z.ZodOptional<z.ZodString>;
-    headSha: z.ZodOptional<z.ZodString>;
-    issue: z.ZodOptional<z.ZodString>;
-    prNumber: z.ZodOptional<z.ZodNumber>;
-  }, z.core.$strict>;
-  repo: z.ZodObject<{
-    name: z.ZodString;
-    owner: z.ZodString;
-  }, z.core.$strict>;
+  cycle: z.ZodNumber;
+  durationMs: z.ZodNumber;
+  gate: z.ZodEnum<{
+    "boundary:check": "boundary:check";
+    "factory:closeout": "factory:closeout";
+    "pr:ready": "pr:ready";
+    "pr:review": "pr:review";
+    "pr:verify": "pr:verify";
+  }>;
+  outcome: z.ZodEnum<{
+    pass: "pass";
+    fail: "fail";
+  }>;
   schemaVersion: z.ZodLiteral<1>;
-  tokenFamilies: z.ZodObject<{
-    claude: z.ZodOptional<z.ZodObject<{
-      cacheCreationInput: z.ZodNumber;
-      cacheReadInput: z.ZodNumber;
-      costUsd: z.ZodNullable<z.ZodNumber>;
-      family: z.ZodLiteral<"claude">;
-      freshInput: z.ZodNumber;
-      model: z.ZodString;
-      output: z.ZodNumber;
-      requests: z.ZodNumber;
-    }, z.core.$strict>>;
-    gpt: z.ZodOptional<z.ZodObject<{
-      family: z.ZodLiteral<"gpt">;
-      roles: z.ZodArray<z.ZodObject<{
-        cachedInput: z.ZodNumber;
-        costUsd: z.ZodNullable<z.ZodNumber>;
-        freshInputDerived: z.ZodNumber;
-        inputInclusiveOfCache: z.ZodNumber;
-        model: z.ZodString;
-        output: z.ZodNumber;
-        reasoningOutput: z.ZodNumber;
-        role: z.ZodString;
-        threadId: z.ZodOptional<z.ZodString>;
-      }, z.core.$strict>>;
-    }, z.core.$strict>>;
-  }, z.core.$strict>;
-  wallClock: z.ZodObject<{
-    endTs: z.ZodISODateTime;
-    startTs: z.ZodISODateTime;
-    totalSec: z.ZodNumber;
-  }, z.core.$strict>;
+  startOffsetMs: z.ZodNumber;
+  startedAt: z.ZodISODateTime;
 }, z.core.$strict>;
-type RetroEnvelope = z.infer<typeof retroEnvelopeV1Schema>;
-/**
- * Versioned payload validators, keyed by schema major. Unknown majors never
- * reach these — {@link parseRetroEnvelope} returns them raw and marked
- * degraded, mirroring HQ's ingest skew posture (stored raw, never dropped).
- */
-declare const RETRO_ENVELOPE_VALIDATORS: Record<number, z.ZodType<RetroEnvelope, unknown>>;
-declare const SUPPORTED_RETRO_ENVELOPE_SCHEMA_VERSIONS: readonly number[];
-type ParsedRetroEnvelope = {
-  disposition: "trusted";
-  envelope: RetroEnvelope;
-  schemaVersion: number;
-} | {
-  disposition: "degraded";
-  raw: unknown;
-  schemaVersion: number | undefined;
-};
-/** Epic anchor for an envelope: refs.epic, else refs.issue, else the PR. */
-declare const retroEpicReference: (refs: RetroEnvelope["refs"]) => string | undefined;
+type GateTimingRecord = z.infer<typeof gateTimingRecordSchema>;
 //#endregion
 //#region src/schemas.d.ts
 declare const EVIDENCE_ENVELOPE_SCHEMA_VERSION = 1;
@@ -1321,222 +1030,6 @@ declare const evidenceEnvelopeSchema: z.ZodObject<{
   sessionId: z.ZodOptional<z.ZodString>;
   timestamp: z.ZodOptional<z.ZodISODateTime>;
 }, z.core.$loose>;
-declare const SUPPORTED_PR_VERIFY_SCHEMA_VERSIONS: readonly [1, 2, 3, 4];
-declare const prVerifyProofSchema: z.ZodObject<{
-  authoringSession: z.ZodOptional<z.ZodString>;
-  base: z.ZodString;
-  baselineFullProofs: z.ZodOptional<z.ZodArray<z.ZodObject<{
-    base: z.ZodString;
-    changedFiles: z.ZodArray<z.ZodString>;
-    headSha: z.ZodString;
-    profilePath: z.ZodString;
-    projectKey: z.ZodString;
-    repository: z.ZodString;
-  }, z.core.$strip>>>;
-  changedFiles: z.ZodArray<z.ZodString>;
-  classification: z.ZodEnum<{
-    "docs/process-only": "docs/process-only";
-    trivial: "trivial";
-    "non-trivial": "non-trivial";
-  }>;
-  classificationReasons: z.ZodArray<z.ZodString>;
-  command: z.ZodLiteral<"patronage-factory pr:verify">;
-  durationMs: z.ZodNumber;
-  endedAt: z.ZodISODateTime;
-  executedCommands: z.ZodOptional<z.ZodArray<z.ZodObject<{
-    command: z.ZodString;
-    counts: z.ZodOptional<z.ZodObject<{
-      testFiles: z.ZodOptional<z.ZodNumber>;
-      tests: z.ZodOptional<z.ZodNumber>;
-    }, z.core.$strip>>;
-    durationMs: z.ZodNumber;
-    exitCode: z.ZodNumber;
-    name: z.ZodString;
-    scope: z.ZodEnum<{
-      trivial: "trivial";
-      always: "always";
-      "docs-only": "docs-only";
-      full: "full";
-    }>;
-  }, z.core.$strip>>>;
-  headSha: z.ZodString;
-  impactStamp: z.ZodOptional<z.ZodObject<{
-    basis: z.ZodEnum<{
-      "target-scoped": "target-scoped";
-      conservative: "conservative";
-    }>;
-    reasons: z.ZodArray<z.ZodString>;
-    stampVersion: z.ZodLiteral<2>;
-    targets: z.ZodArray<z.ZodObject<{
-      basis: z.ZodString;
-      impact: z.ZodEnum<{
-        affected: "affected";
-        "not-affected": "not-affected";
-      }>;
-      name: z.ZodString;
-    }, z.core.$strip>>;
-  }, z.core.$strip>>;
-  mergeBaseSha: z.ZodOptional<z.ZodString>;
-  mode: z.ZodEnum<{
-    trivial: "trivial";
-    "docs-only": "docs-only";
-    full: "full";
-  }>;
-  notRequiredCommands: z.ZodOptional<z.ZodArray<z.ZodObject<{
-    basis: z.ZodString;
-    impactTarget: z.ZodString;
-    name: z.ZodString;
-  }, z.core.$strip>>>;
-  outcome: z.ZodOptional<z.ZodEnum<{
-    aborted: "aborted";
-    passed: "passed";
-  }>>;
-  patchId: z.ZodOptional<z.ZodString>;
-  profilePath: z.ZodString;
-  projectKey: z.ZodString;
-  repository: z.ZodString;
-  schemaVersion: z.ZodNumber & z.ZodType<1 | 2 | 3 | 4, number, z.core.$ZodTypeInternals<1 | 2 | 3 | 4, number>>;
-  startedAt: z.ZodISODateTime;
-  verificationCommands: z.ZodArray<z.ZodObject<{
-    command: z.ZodString;
-    description: z.ZodString;
-    impactTarget: z.ZodOptional<z.ZodString>;
-    name: z.ZodString;
-    scope: z.ZodEnum<{
-      trivial: "trivial";
-      always: "always";
-      "docs-only": "docs-only";
-      full: "full";
-    }>;
-  }, z.core.$strip>>;
-}, z.core.$strip>;
-declare const PR_REVIEW_SCHEMA_VERSION = 2;
-declare const prReviewProofSchema: z.ZodObject<{
-  base: z.ZodString;
-  changedFiles: z.ZodArray<z.ZodString>;
-  cleanedPaths: z.ZodArray<z.ZodString>;
-  findingProvenanceVersion: z.ZodLiteral<1>;
-  headSha: z.ZodString;
-  ladder: z.ZodOptional<z.ZodObject<{
-    cycles: z.ZodArray<z.ZodObject<{
-      dispositions: z.ZodOptional<z.ZodArray<z.ZodObject<{
-        disposition: z.ZodEnum<{
-          "fixed-in-thread": "fixed-in-thread";
-          "follow-up-filed": "follow-up-filed";
-          waived: "waived";
-        }>;
-        finding: z.ZodObject<{
-          file: z.ZodOptional<z.ZodString>;
-          title: z.ZodString;
-        }, z.core.$strip>;
-        reference: z.ZodOptional<z.ZodString>;
-      }, z.core.$loose>>>;
-      findings: z.ZodArray<z.ZodObject<{
-        citedSpan: z.ZodOptional<z.ZodString>;
-        file: z.ZodOptional<z.ZodString>;
-        prescribedAction: z.ZodOptional<z.ZodString>;
-        supersedes: z.ZodOptional<z.ZodObject<{
-          file: z.ZodOptional<z.ZodString>;
-          title: z.ZodString;
-        }, z.core.$strip>>;
-        title: z.ZodString;
-      }, z.core.$loose>>;
-    }, z.core.$loose>>;
-  }, z.core.$strip>>;
-  maxReviewCycles: z.ZodOptional<z.ZodNumber>;
-  patchId: z.ZodString;
-  reviewCycle: z.ZodOptional<z.ZodNumber>;
-  reviewRequirement: z.ZodOptional<z.ZodObject<{
-    reason: z.ZodEnum<{
-      "no-applicable-mode": "no-applicable-mode";
-    }>;
-    status: z.ZodLiteral<"not-required">;
-  }, z.core.$strict>>;
-  reviews: z.ZodArray<z.ZodObject<{
-    command: z.ZodOptional<z.ZodString>;
-    durationMs: z.ZodNumber;
-    endedAt: z.ZodString;
-    exitCode: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
-    findings: z.ZodArray<z.ZodObject<{
-      blockingAfterCap: z.ZodOptional<z.ZodBoolean>;
-      body: z.ZodString;
-      category: z.ZodOptional<z.ZodEnum<{
-        unknown: "unknown";
-        correctness: "correctness";
-        safety: "safety";
-        coordination: "coordination";
-        maintainability: "maintainability";
-      }>>;
-      citedSpan: z.ZodOptional<z.ZodString>;
-      file: z.ZodOptional<z.ZodString>;
-      line: z.ZodOptional<z.ZodNumber>;
-      prescribedAction: z.ZodOptional<z.ZodString>;
-      priority: z.ZodOptional<z.ZodString>;
-      protocolFinding: z.ZodOptional<z.ZodLiteral<true>>;
-      supersedes: z.ZodOptional<z.ZodObject<{
-        file: z.ZodOptional<z.ZodString>;
-        title: z.ZodString;
-      }, z.core.$strip>>;
-      title: z.ZodString;
-    }, z.core.$strip>>;
-    issuesFlagged: z.ZodNumber;
-    kind: z.ZodEnum<{
-      correctness: "correctness";
-      security: "security";
-    }>;
-    model: z.ZodOptional<z.ZodString>;
-    outcome: z.ZodEnum<{
-      error: "error";
-      passed: "passed";
-      failed: "failed";
-    }>;
-    producer: z.ZodOptional<z.ZodString>;
-    promptSections: z.ZodOptional<z.ZodArray<z.ZodObject<{
-      provenance: z.ZodEnum<{
-        "prior-review-ledger": "prior-review-ledger";
-        "issue-review-focus": "issue-review-focus";
-      }>;
-      source: z.ZodString;
-      text: z.ZodString;
-    }, z.core.$strict>>>;
-    rung: z.ZodOptional<z.ZodEnum<{
-      "independent-model": "independent-model";
-      oracle: "oracle";
-      human: "human";
-    }>>;
-    sessionId: z.ZodOptional<z.ZodString>;
-    stageResolution: z.ZodOptional<z.ZodObject<{
-      effort: z.ZodOptional<z.ZodEnum<{
-        low: "low";
-        medium: "medium";
-        high: "high";
-        xhigh: "xhigh";
-      }>>;
-      engine: z.ZodString;
-      layerSource: z.ZodEnum<{
-        cli: "cli";
-        operatorSessionGlobal: "operatorSessionGlobal";
-        operatorSessionKind: "operatorSessionKind";
-        profilePin: "profilePin";
-        stageConfig: "stageConfig";
-        userConfig: "userConfig";
-      }>;
-      model: z.ZodString;
-      rung: z.ZodOptional<z.ZodEnum<{
-        oracle: "oracle";
-        independentModel: "independentModel";
-      }>>;
-    }, z.core.$strip>>;
-    startedAt: z.ZodString;
-    summary: z.ZodString;
-    typedVerdict: z.ZodOptional<z.ZodBoolean>;
-    verdictSource: z.ZodOptional<z.ZodEnum<{
-      footer: "footer";
-      recovered: "recovered";
-    }>>;
-  }, z.core.$strip>>;
-  schemaVersion: z.ZodLiteral<2>;
-}, z.core.$loose>;
 declare const BOUNDARY_REVIEW_PROOF_KIND = "boundary-review-proof";
 declare const boundaryReviewProofSchema: z.ZodObject<{
   boundary: z.ZodString;
@@ -1638,12 +1131,15 @@ declare const boundaryCheckProofSchema: z.ZodObject<{
 type BoundaryCheckProofRecord = z.infer<typeof boundaryCheckProofSchema>;
 declare const PR_READY_SCHEMA_VERSION = 3;
 /**
- * The pr:ready proof versions a reader still accepts. `pr:ready` emits v3 only
- * (#477) — one current contract — but v1 and v2 events were spooled before the
- * bumps and HQ must ingest them without degrading, so the wire schema parses
- * all three.
+ * The pr:ready proof versions a reader accepts: the current one only (#917
+ * item 1). #894 narrowed the nested readiness ledger to `schemaVersion: 2` and
+ * the `prVerify` tagged union, which no v1 or v2 pr:ready proof can satisfy.
+ * Advertising 1 and 2 here therefore promised an acceptance the nested schema
+ * already refused. Pre-1.0 posture applies: one current contract, no compat
+ * reader. An alpha.22 consumer must adopt alpha.23 before HQ ingests its
+ * pr:ready proofs.
  */
-declare const SUPPORTED_PR_READY_SCHEMA_VERSIONS: readonly [1, 2, 3];
+declare const SUPPORTED_PR_READY_SCHEMA_VERSIONS: readonly [3];
 declare const prReadyProofSchema: z.ZodObject<{
   arming: z.ZodOptional<z.ZodObject<{
     detail: z.ZodOptional<z.ZodString>;
@@ -1654,6 +1150,7 @@ declare const prReadyProofSchema: z.ZodObject<{
       "not-armed": "not-armed";
     }>;
   }, z.core.$strip>>;
+  authoringSession: z.ZodOptional<z.ZodString>;
   blockedReasons: z.ZodOptional<z.ZodArray<z.ZodObject<{
     code: z.ZodString;
     detail: z.ZodString;
@@ -1678,7 +1175,6 @@ declare const prReadyProofSchema: z.ZodObject<{
         review: "review";
         verify: "verify";
       }>;
-      inScope: z.ZodBoolean;
       name: z.ZodString;
       reason: z.ZodOptional<z.ZodString>;
       scope: z.ZodOptional<z.ZodObject<{
@@ -1695,7 +1191,6 @@ declare const prReadyProofSchema: z.ZodObject<{
         "out-of-scope": "out-of-scope";
       }>;
     }, z.core.$strip>>>;
-    finalReviewPoint: z.ZodOptional<z.ZodBoolean>;
     github: z.ZodObject<{
       draft: z.ZodBoolean;
       mergeStateStatus: z.ZodString;
@@ -1710,43 +1205,14 @@ declare const prReadyProofSchema: z.ZodObject<{
       reviewDecision: z.ZodOptional<z.ZodNullable<z.ZodString>>;
       unresolvedReviewThreads: z.ZodNumber;
     }, z.core.$strip>;
-    handledCommentsProducer: z.ZodOptional<z.ZodObject<{
-      identity: z.ZodString;
-      mode: z.ZodEnum<{
-        app: "app";
-        "commit-status": "commit-status";
-      }>;
-    }, z.core.$strip>>;
-    handledHumanComments: z.ZodOptional<z.ZodArray<z.ZodObject<{
-      clearedAt: z.ZodOptional<z.ZodString>;
-      sessionId: z.ZodOptional<z.ZodString>;
-      source: z.ZodEnum<{
-        cli: "cli";
-        "check-run": "check-run";
-      }>;
-      url: z.ZodString;
-    }, z.core.$strip>>>;
     headSha: z.ZodString;
     mergeBaseSha: z.ZodOptional<z.ZodString>;
     patchId: z.ZodString;
-    postReadinessHumanComments: z.ZodOptional<z.ZodArray<z.ZodObject<{
-      author: z.ZodString;
-      createdAt: z.ZodString;
-      summary: z.ZodString;
-      url: z.ZodString;
-    }, z.core.$strip>>>;
-    postReadinessHumanReviews: z.ZodOptional<z.ZodArray<z.ZodObject<{
-      author: z.ZodString;
-      createdAt: z.ZodString;
-      summary: z.ZodString;
-      url: z.ZodString;
-    }, z.core.$strip>>>;
     pr: z.ZodNumber;
     repairs: z.ZodDefault<z.ZodArray<z.ZodObject<{
       action: z.ZodString;
       code: z.ZodEnum<{
         "undraft-pr": "undraft-pr";
-        "render-pr-body-sections": "render-pr-body-sections";
         "await-post-undraft-checks": "await-post-undraft-checks";
       }>;
       command: z.ZodString;
@@ -1762,17 +1228,17 @@ declare const prReadyProofSchema: z.ZodObject<{
       }, z.core.$strip>;
       highestBlockingSeverity: z.ZodOptional<z.ZodEnum<{
         unknown: "unknown";
+        critical: "critical";
+        high: "high";
         low: "low";
         medium: "medium";
-        high: "high";
-        critical: "critical";
       }>>;
       highestOpenSeverity: z.ZodOptional<z.ZodEnum<{
         unknown: "unknown";
+        critical: "critical";
+        high: "high";
         low: "low";
         medium: "medium";
-        high: "high";
-        critical: "critical";
       }>>;
       maxReviewCycles: z.ZodOptional<z.ZodNumber>;
       nonBlockingFindings: z.ZodNumber;
@@ -1789,7 +1255,6 @@ declare const prReadyProofSchema: z.ZodObject<{
       forcedTransition: z.ZodOptional<z.ZodEnum<{
         "gate-cap-exhausted": "gate-cap-exhausted";
         "interior-cap-reached": "interior-cap-reached";
-        "interior-takeover": "interior-takeover";
       }>>;
       nextAction: z.ZodEnum<{
         "run-interior-cycle": "run-interior-cycle";
@@ -1802,93 +1267,10 @@ declare const prReadyProofSchema: z.ZodObject<{
       stage: z.ZodEnum<{
         gate: "gate";
         interior: "interior";
-        "interior-takeover": "interior-takeover";
         "interior-complete": "interior-complete";
       }>;
     }, z.core.$strip>>;
-    reviewRuns: z.ZodOptional<z.ZodArray<z.ZodObject<{
-      command: z.ZodOptional<z.ZodString>;
-      durationMs: z.ZodNumber;
-      endedAt: z.ZodString;
-      exitCode: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
-      findings: z.ZodArray<z.ZodObject<{
-        blockingAfterCap: z.ZodOptional<z.ZodBoolean>;
-        body: z.ZodString;
-        category: z.ZodOptional<z.ZodEnum<{
-          unknown: "unknown";
-          correctness: "correctness";
-          safety: "safety";
-          coordination: "coordination";
-          maintainability: "maintainability";
-        }>>;
-        citedSpan: z.ZodOptional<z.ZodString>;
-        file: z.ZodOptional<z.ZodString>;
-        line: z.ZodOptional<z.ZodNumber>;
-        prescribedAction: z.ZodOptional<z.ZodString>;
-        priority: z.ZodOptional<z.ZodString>;
-        protocolFinding: z.ZodOptional<z.ZodLiteral<true>>;
-        supersedes: z.ZodOptional<z.ZodObject<{
-          file: z.ZodOptional<z.ZodString>;
-          title: z.ZodString;
-        }, z.core.$strip>>;
-        title: z.ZodString;
-      }, z.core.$strip>>;
-      issuesFlagged: z.ZodNumber;
-      kind: z.ZodEnum<{
-        correctness: "correctness";
-        security: "security";
-      }>;
-      model: z.ZodOptional<z.ZodString>;
-      outcome: z.ZodEnum<{
-        error: "error";
-        passed: "passed";
-        failed: "failed";
-      }>;
-      producer: z.ZodOptional<z.ZodString>;
-      promptSections: z.ZodOptional<z.ZodArray<z.ZodObject<{
-        provenance: z.ZodEnum<{
-          "prior-review-ledger": "prior-review-ledger";
-          "issue-review-focus": "issue-review-focus";
-        }>;
-        source: z.ZodString;
-        text: z.ZodString;
-      }, z.core.$strict>>>;
-      rung: z.ZodOptional<z.ZodEnum<{
-        "independent-model": "independent-model";
-        oracle: "oracle";
-        human: "human";
-      }>>;
-      sessionId: z.ZodOptional<z.ZodString>;
-      stageResolution: z.ZodOptional<z.ZodObject<{
-        effort: z.ZodOptional<z.ZodEnum<{
-          low: "low";
-          medium: "medium";
-          high: "high";
-          xhigh: "xhigh";
-        }>>;
-        engine: z.ZodString;
-        layerSource: z.ZodEnum<{
-          cli: "cli";
-          operatorSessionGlobal: "operatorSessionGlobal";
-          operatorSessionKind: "operatorSessionKind";
-          profilePin: "profilePin";
-          stageConfig: "stageConfig";
-          userConfig: "userConfig";
-        }>;
-        model: z.ZodString;
-        rung: z.ZodOptional<z.ZodEnum<{
-          oracle: "oracle";
-          independentModel: "independentModel";
-        }>>;
-      }, z.core.$strip>>;
-      startedAt: z.ZodString;
-      summary: z.ZodString;
-      typedVerdict: z.ZodOptional<z.ZodBoolean>;
-      verdictSource: z.ZodOptional<z.ZodEnum<{
-        footer: "footer";
-        recovered: "recovered";
-      }>>;
-    }, z.core.$strip>>>;
+    reviewRuns: z.ZodOptional<z.ZodArray<z.ZodType<PrReviewResult, unknown, z.core.$ZodTypeInternals<PrReviewResult, unknown>>>>;
     reviewTerminalState: z.ZodOptional<z.ZodEnum<{
       blocked: "blocked";
       "accepted-with-findings": "accepted-with-findings";
@@ -1896,73 +1278,90 @@ declare const prReadyProofSchema: z.ZodObject<{
     }>>;
     reviews: z.ZodObject<{
       correctness: z.ZodObject<{
-        docsOnlyDeltaAccepted: z.ZodOptional<z.ZodBoolean>;
         required: z.ZodBoolean;
         reviewedHeadSha: z.ZodOptional<z.ZodString>;
         reviewedPatchId: z.ZodOptional<z.ZodString>;
         status: z.ZodEnum<{
-          "not-required": "not-required";
           blocked: "blocked";
+          "not-required": "not-required";
           current: "current";
           stale: "stale";
           missing: "missing";
         }>;
-      }, z.core.$strip>;
+      }, z.core.$strict>;
       security: z.ZodOptional<z.ZodObject<{
-        docsOnlyDeltaAccepted: z.ZodOptional<z.ZodBoolean>;
         required: z.ZodBoolean;
         reviewedHeadSha: z.ZodOptional<z.ZodString>;
         reviewedPatchId: z.ZodOptional<z.ZodString>;
         status: z.ZodEnum<{
-          "not-required": "not-required";
           blocked: "blocked";
+          "not-required": "not-required";
           current: "current";
           stale: "stale";
           missing: "missing";
         }>;
-      }, z.core.$strip>>;
+      }, z.core.$strict>>;
     }, z.core.$strip>;
-    schemaVersion: z.ZodLiteral<1>;
-    stackRole: z.ZodOptional<z.ZodEnum<{
-      single: "single";
-      slice: "slice";
-      rollup: "rollup";
-      "merge-gate prerequisite": "merge-gate prerequisite";
-    }>>;
-    verification: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<2>;
+    verification: z.ZodDiscriminatedUnion<[z.ZodObject<{
       command: z.ZodLiteral<"patronage-factory pr:verify">;
-      docsOnlyDeltaAccepted: z.ZodOptional<z.ZodBoolean>;
-      docsOnlyVerifiedHeadSha: z.ZodOptional<z.ZodString>;
-      prVerify: z.ZodEnum<{
-        passed: "passed";
-        stale: "stale";
-        missing: "missing";
-      }>;
-      trivialDeltaAccepted: z.ZodOptional<z.ZodBoolean>;
-      trivialVerifiedHeadSha: z.ZodOptional<z.ZodString>;
+      prVerify: z.ZodLiteral<"missing">;
+    }, z.core.$strict>, z.ZodObject<{
+      command: z.ZodLiteral<"patronage-factory pr:verify">;
+      prVerify: z.ZodLiteral<"stale">;
+      verifiedHeadSha: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+      command: z.ZodLiteral<"patronage-factory pr:verify">;
+      prVerify: z.ZodLiteral<"passed-via-head">;
+      verifiedHeadSha: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+      command: z.ZodLiteral<"patronage-factory pr:verify">;
+      docsOnlyVerifiedHeadSha: z.ZodString;
+      prVerify: z.ZodLiteral<"docs-only-delta">;
       verifiedHeadSha: z.ZodOptional<z.ZodString>;
-    }, z.core.$strip>;
+    }, z.core.$strict>, z.ZodObject<{
+      command: z.ZodLiteral<"patronage-factory pr:verify">;
+      prVerify: z.ZodLiteral<"trivial-delta">;
+      trivialVerifiedHeadSha: z.ZodString;
+      verifiedHeadSha: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>], "prVerify">;
   }, z.core.$strip>;
   notices: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  policyResolution: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+    basePolicyDigest: z.ZodString;
+    baseRefName: z.ZodString;
+    candidatePolicyDigest: z.ZodString;
+    effectiveDigest: z.ZodString;
+    policyBaseSha: z.ZodString;
+    reviewPolicyChanged: z.ZodBoolean;
+    status: z.ZodLiteral<"authoritative">;
+  }, z.core.$strict>, z.ZodObject<{
+    baseRefName: z.ZodString;
+    cause: z.ZodOptional<z.ZodEnum<{
+      "no-pull-request": "no-pull-request";
+      "lookup-failed": "lookup-failed";
+      "policy-unreadable": "policy-unreadable";
+    }>>;
+    reason: z.ZodString;
+    status: z.ZodLiteral<"unresolved">;
+  }, z.core.$strict>], "status">>;
   profileBlobSha: z.ZodOptional<z.ZodString>;
   profilePath: z.ZodOptional<z.ZodString>;
   repairs: z.ZodDefault<z.ZodArray<z.ZodObject<{
     action: z.ZodString;
     code: z.ZodEnum<{
       "undraft-pr": "undraft-pr";
-      "render-pr-body-sections": "render-pr-body-sections";
       "await-post-undraft-checks": "await-post-undraft-checks";
     }>;
     command: z.ZodString;
   }, z.core.$strip>>>;
   repository: z.ZodOptional<z.ZodString>;
-  schemaVersion: z.ZodNumber & z.ZodType<1 | 2 | 3, number, z.core.$ZodTypeInternals<1 | 2 | 3, number>>;
+  schemaVersion: z.ZodLiteral<3>;
   status: z.ZodEnum<{
     ready: "ready";
     blocked: "blocked";
-    "slice-ready/not-final": "slice-ready/not-final";
   }>;
   waivedDemands: z.ZodOptional<z.ZodArray<z.ZodType<WaivedDemand, unknown, z.core.$ZodTypeInternals<WaivedDemand, unknown>>>>;
 }, z.core.$strip>;
 //#endregion
-export { BLOCKED_REASONS_MAX, BLOCKED_REASON_DETAIL_MAX, BOUNDARY_CHECK_SCHEMA_VERSION, BOUNDARY_REVIEW_PROOF_KIND, type BlockedReason, BoundaryCheckProofRecord, type BoundaryReviewProof, type CloseoutArtifact, EVIDENCE_ENVELOPE_SCHEMA_VERSION, type EvidenceEnvelope, type HistoricalCloseoutArtifact, PR_READY_SCHEMA_VERSION, PR_REVIEW_SCHEMA_VERSION, type ParsedRetroEnvelope, type PrReadyProof, type PrReviewProof, type PrVerifyProof, RETRO_ENVELOPE_SCHEMA_VERSION, RETRO_ENVELOPE_VALIDATORS, RETRO_ENVELOPE_WIRE_BOUNDS, type RetroEnvelope, SUPPORTED_CLOSEOUT_SCHEMA_VERSIONS, SUPPORTED_PR_READY_SCHEMA_VERSIONS, SUPPORTED_PR_VERIFY_SCHEMA_VERSIONS, SUPPORTED_RETRO_ENVELOPE_SCHEMA_VERSIONS, type WaivedDemand, blockedReasonSchema, blockedReasonsSchema, boundaryCheckProofSchema, boundaryReviewProofSchema, closeoutArtifactReadSchema, closeoutArtifactSchema, evidenceEnvelopeSchema, legacyCloseoutArtifactSchema, prReadyProofSchema, prReviewProofSchema, prVerifyProofSchema, retroEnvelopeV1Schema, retroEpicReference, waivedDemandSchema };
+export { BLOCKED_REASONS_MAX, BLOCKED_REASON_DETAIL_MAX, BOUNDARY_CHECK_SCHEMA_VERSION, BOUNDARY_REVIEW_PROOF_KIND, type BlockedReason, BoundaryCheckProofRecord, type BoundaryReviewProof, type CloseoutArtifact, EVIDENCE_ENVELOPE_SCHEMA_VERSION, type EvidenceEnvelope, type GateTimingRecord, PR_READY_SCHEMA_VERSION, PR_REVIEW_SCHEMA_VERSION, type PrReadyProof, type PrReviewProof, type PrVerifyProof, type ReviewPromptSection, type ReviewPromptSectionProvenance, SUPPORTED_CLOSEOUT_SCHEMA_VERSIONS, SUPPORTED_PR_READY_SCHEMA_VERSIONS, SUPPORTED_PR_VERIFY_SCHEMA_VERSIONS, type WaivedDemand, blockedReasonSchema, blockedReasonsSchema, boundaryCheckProofSchema, boundaryReviewProofSchema, closeoutArtifactSchema, evidenceEnvelopeSchema, gateTimingRecordSchema, prReadyProofSchema, prReviewFindingSchema, prReviewProofSchema, prReviewResultSchema, prVerifyProofSchema, reviewPromptSectionSchema, reviewPromptSectionsSchema, waivedDemandSchema };