@patronage/software-factory 1.0.0-alpha.40 → 1.0.0-alpha.41

package/dist/index.d.ts

@@ -239,8 +239,8 @@ declare const boundaryReviewProofBaseSchema: z.ZodObject<{
     mergedSha: z.ZodOptional<z.ZodString>;
     pr: z.ZodNumber;
     state: z.ZodEnum<{
-      merged: "merged";
       open: "open";
+      merged: "merged";
     }>;
     wave: z.ZodOptional<z.ZodString>;
   }, z.core.$loose>>;
@@ -283,8 +283,8 @@ declare const boundaryReviewProofSchema: z.ZodObject<{
     mergedSha: z.ZodOptional<z.ZodString>;
     pr: z.ZodNumber;
     state: z.ZodEnum<{
-      merged: "merged";
       open: "open";
+      merged: "merged";
     }>;
     wave: z.ZodOptional<z.ZodString>;
   }, z.core.$loose>>;
@@ -796,7 +796,7 @@ interface LadderCycleRef {
   stage: LadderCycleStage;
 }
 type LadderFindingReport = ReviewFindingAttributes;
-/** One finding as recorded in one cycle (CONTEXT.md: finding occurrence). */
+/** One finding as recorded in one cycle (GLOSSARY.md: finding occurrence). */
 interface ReviewOccurrenceRecord {
   address: string;
   /** The ladder-assigned cycle number the occurrence was recorded in. */
@@ -813,7 +813,7 @@ declare const POLICY_DECLARATION_RULES: readonly ["cycle-2-severity-floor", "ide
 type PolicyDeclarationRule = (typeof POLICY_DECLARATION_RULES)[number];
 type DeclarationAuthority = "operator" | "reviewer" | "policy";
 /**
- * A disposition declaration as stored (CONTEXT.md: disposition declaration):
+ * A disposition declaration as stored (GLOSSARY.md: disposition declaration):
  * one occurrence, one disposition, the authority that made it and its
  * reference (operator, reviewer) or rule (policy).
  */
@@ -1735,14 +1735,19 @@ interface ExactHeadRunSource {
 //#endregion
 //#region src/merge-freeze.d.ts
 declare const MERGE_FREEZE_CHECK_NAME = "patronage-factory/merge-freeze";
+/**
+ * The Factory App's slug, as GitHub serves it on the runs the writer posts.
+ * It is not a trust predicate: an App chooses its own slug, so the reader
+ * trusts the pinned numeric App id instead (ADR 0022, #1393).
+ */
 declare const MERGE_FREEZE_APP_SLUG = "patronage-factory";
 declare const mergeFreezeStateSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
   active: z.ZodLiteral<true>;
   generationId: z.ZodNumber;
   headSha: z.ZodString;
   outcome: z.ZodEnum<{
-    stale: "stale";
     active: "active";
+    stale: "stale";
   }>;
   reason: z.ZodString;
   recordedAt: z.ZodISODateTime;
@@ -2012,8 +2017,8 @@ declare const managedReadinessLedgerSchema: z.ZodObject<{
       "ready-for-human": "ready-for-human";
     }>;
     stage: z.ZodEnum<{
-      gate: "gate";
       interior: "interior";
+      gate: "gate";
       "interior-complete": "interior-complete";
     }>;
   }, z.core.$strip>>;
@@ -2029,10 +2034,10 @@ declare const managedReadinessLedgerSchema: z.ZodObject<{
       reviewedHeadSha: z.ZodOptional<z.ZodString>;
       reviewedPatchId: z.ZodOptional<z.ZodString>;
       status: z.ZodEnum<{
-        blocked: "blocked";
         "not-required": "not-required";
-        current: "current";
         stale: "stale";
+        blocked: "blocked";
+        current: "current";
         missing: "missing";
       }>;
     }, z.core.$strip>;
@@ -2041,10 +2046,10 @@ declare const managedReadinessLedgerSchema: z.ZodObject<{
       reviewedHeadSha: z.ZodOptional<z.ZodString>;
       reviewedPatchId: z.ZodOptional<z.ZodString>;
       status: z.ZodEnum<{
-        blocked: "blocked";
         "not-required": "not-required";
-        current: "current";
         stale: "stale";
+        blocked: "blocked";
+        current: "current";
         missing: "missing";
       }>;
     }, z.core.$strip>>;
@@ -3114,10 +3119,10 @@ declare const loadEvidenceEnvelopes: (cwd: string) => LoadedEvidenceEnvelope[];
 //#region src/review-proof-applicability.d.ts
 declare const REVIEW_STATUS_VALUES: readonly ["not-required", "current", "stale", "missing", "blocked"];
 declare const reviewStatusSchema: z.ZodEnum<{
-  blocked: "blocked";
   "not-required": "not-required";
-  current: "current";
   stale: "stale";
+  blocked: "blocked";
+  current: "current";
   missing: "missing";
 }>;
 type ReviewStatus = z.infer<typeof reviewStatusSchema>;
@@ -3225,8 +3230,8 @@ declare const boundaryCheckProofSchema: z.ZodObject<{
     pr: z.ZodNumber;
     sha: z.ZodString;
     state: z.ZodEnum<{
-      merged: "merged";
       open: "open";
+      merged: "merged";
     }>;
     wave: z.ZodString;
   }, z.core.$strip>>;
@@ -3628,6 +3633,12 @@ interface PrVerifyDependencies {
 }
 declare function runPrVerify(args: PrVerifyArgs, dependencies?: PrVerifyDependencies): PrVerifyProof;
 //#endregion
+//#region src/pull-request-fill.d.ts
+interface CommitMessage {
+  body: string;
+  subject: string;
+}
+//#endregion
 //#region src/pr-publish.d.ts
 type PrPublishArgs = Omit<PrReadyArgs, "pr" | "throwWhenBlocked"> & {
   /** A clean-session findings file to validate into the review proof. */findings?: string;
@@ -3726,6 +3737,12 @@ interface PrPublishDependencies extends PrReadyDependencies {
   ensureVerifyCheckRun?: typeof ensureFactoryCheckRunPublished;
   factoryCliInvocation?: FactoryCliInvocation;
   gh?: GhRunner;
+  /**
+   * The branch's commits into its base, oldest first, that a pull request
+   * publish creates is titled and described from (#1366). Tests only;
+   * production reads them from Git.
+   */
+  pullRequestCommits?: PullRequestCommits;
   github?: PrReadyDependencies["github"] & {
     editPullRequestBody?: (input: {
       body: string;
@@ -3741,7 +3758,10 @@ interface PrPublishDependencies extends PrReadyDependencies {
    * carries the publisher for the verdict it records (#1323).
    */
   runPrReview?: (args: PrReviewArgs, dependencies?: ProducerPublisher) => Promise<PrReviewProof>;
-  /** Settles asynchronously scheduled sink work before the handoff drain. */
+  /**
+   * Settles asynchronously scheduled sink work: after a review cycle publish
+   * records from `--findings` (#1382), and before the handoff drain.
+   */
   awaitPendingIngest?: () => Promise<void>;
   /**
    * The handoff drain (#390). Advisory everywhere: publish reports what it
@@ -3767,6 +3787,7 @@ interface PrPublishDependencies extends PrReadyDependencies {
    */
   sleep?: (ms: number) => Promise<void>;
 }
+type PullRequestCommits = (cwd: string, base: string) => CommitMessage[];
 /**
  * What became of the durable `pr:verify` binding for this publish. Reported in
  * the publish summary: a binding that silently failed to land is
@@ -4059,8 +4080,8 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
     sessionId: z.ZodOptional<z.ZodString>;
   }, z.core.$strict>>;
   stage: z.ZodEnum<{
-    gate: "gate";
     interior: "interior";
+    gate: "gate";
   }>;
   usage: z.ZodOptional<z.ZodObject<{
     estimatedCostUsd: z.ZodOptional<z.ZodNumber>;
@@ -4112,8 +4133,8 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
     sessionId: z.ZodOptional<z.ZodString>;
   }, z.core.$strict>>;
   stage: z.ZodEnum<{
-    gate: "gate";
     interior: "interior";
+    gate: "gate";
   }>;
   usage: z.ZodOptional<z.ZodObject<{
     estimatedCostUsd: z.ZodOptional<z.ZodNumber>;
@@ -4156,8 +4177,8 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
       sessionId: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>>;
     stage: z.ZodEnum<{
-      gate: "gate";
       interior: "interior";
+      gate: "gate";
     }>;
     usage: z.ZodOptional<z.ZodObject<{
       estimatedCostUsd: z.ZodOptional<z.ZodNumber>;
@@ -4187,7 +4208,7 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
     staleRepeats: number;
   };
   observedAt: string;
-  stage: "gate" | "interior";
+  stage: "interior" | "gate";
   issue?: number | undefined;
   pr?: number | undefined;
   threadId?: string | undefined;
@@ -4647,13 +4668,13 @@ declare const evaluateReadiness: (input: EvaluationInput) => {
     reviews: {
       correctness: {
         required: boolean;
-        status: "blocked" | "not-required" | "current" | "stale" | "missing";
+        status: "not-required" | "stale" | "blocked" | "current" | "missing";
         reviewedHeadSha?: string | undefined;
         reviewedPatchId?: string | undefined;
       };
       security?: {
         required: boolean;
-        status: "blocked" | "not-required" | "current" | "stale" | "missing";
+        status: "not-required" | "stale" | "blocked" | "current" | "missing";
         reviewedHeadSha?: string | undefined;
         reviewedPatchId?: string | undefined;
       } | undefined;
@@ -4716,7 +4737,7 @@ declare const evaluateReadiness: (input: EvaluationInput) => {
         interior: number;
       };
       nextAction: "run-interior-cycle" | "advance-to-gate" | "run-gate-cycle" | "accept-nonblocking-findings" | "escalate-to-triage" | "ready-for-human";
-      stage: "gate" | "interior" | "interior-complete";
+      stage: "interior" | "gate" | "interior-complete";
       forcedTransition?: "gate-cap-exhausted" | "interior-cap-reached" | undefined;
     } | undefined;
     reviewRuns?: PrReviewResult[] | undefined;
@@ -4766,13 +4787,13 @@ declare const evaluateReadiness: (input: EvaluationInput) => {
     reviews: {
       correctness: {
         required: boolean;
-        status: "blocked" | "not-required" | "current" | "stale" | "missing";
+        status: "not-required" | "stale" | "blocked" | "current" | "missing";
         reviewedHeadSha?: string | undefined;
         reviewedPatchId?: string | undefined;
       };
       security?: {
         required: boolean;
-        status: "blocked" | "not-required" | "current" | "stale" | "missing";
+        status: "not-required" | "stale" | "blocked" | "current" | "missing";
         reviewedHeadSha?: string | undefined;
         reviewedPatchId?: string | undefined;
       } | undefined;
@@ -4835,7 +4856,7 @@ declare const evaluateReadiness: (input: EvaluationInput) => {
         interior: number;
       };
       nextAction: "run-interior-cycle" | "advance-to-gate" | "run-gate-cycle" | "accept-nonblocking-findings" | "escalate-to-triage" | "ready-for-human";
-      stage: "gate" | "interior" | "interior-complete";
+      stage: "interior" | "gate" | "interior-complete";
       forcedTransition?: "gate-cap-exhausted" | "interior-cap-reached" | undefined;
     } | undefined;
     reviewRuns?: PrReviewResult[] | undefined;
@@ -4927,7 +4948,7 @@ declare const EPIC_STRUCTURE_SCHEMA_VERSION = 1;
 /**
  * DAG-node PLANNING statuses — the planning-plane vocabulary a planner authors
  * on a `dag.yml` node. Carried forward by ADR 0018 and defined by the epic
- * skill (`reference/epic-artifacts.md`) and both `CONTEXT.md` glossaries.
+ * skill (`reference/epic-artifacts.md`) and both `GLOSSARY.md` glossaries.
  *
  * A DAG node is a unit of *plan*; an HQ lane is a unit of *runtime execution*.
  * These are two planes with two vocabularies and must not be conflated — the

package/dist/index.js

@@ -22,7 +22,7 @@ import { AsyncLocalStorage } from "node:async_hooks";
 import { pathToFileURL } from "node:url";
 //#region package.json
 var name = "@patronage/software-factory";
-var version = "1.0.0-alpha.40";
+var version = "1.0.0-alpha.41";
 //#endregion
 //#region src/git-globals-parse.ts
 const VALUE_TAKING_GIT_OPTIONS = new Set([
@@ -4353,7 +4353,7 @@ function resolveCandidateIdentity({ base, cwd, git }) {
 * and `resolveCandidateIdentity`'s own 40-character object-id check would
 * reject a legitimate 64-character patch id from a SHA-256 repository, which
 * the original direct call never rejected. This is a narrower view over the
-* same owned machine — not a second primitive and not a new `CONTEXT.md`
+* same owned machine — not a second primitive and not a new `GLOSSARY.md`
 * entry.
 *
 * Takes the primitive itself, not a `git` object to read it off: the original
@@ -7305,7 +7305,7 @@ const headShaMatches = (recorded, candidate) => Boolean(recorded.headSha && cand
 * describes the candidate.
 *
 * Time is not an input and never will be: adding one would contradict the
-* `freshness` definition in root `CONTEXT.md`.
+* `freshness` definition in root `GLOSSARY.md`.
 */
 function evidenceFresh({ candidate, recorded, rule }) {
 	if (patchIdMatches(recorded, candidate)) return true;
@@ -9632,6 +9632,64 @@ const completeCheckRunPages = (pages) => {
 	const runs = pages.flatMap((page) => page.check_runs);
 	return pages.every((page) => page.total_count === runs.length) ? runs : void 0;
 };
+/** The same bound payload with the same status and conclusion. */
+const sameVerdict = (one, other) => one.payload !== void 0 && (one.run.status ?? "") === (other.run.status ?? "") && (one.run.conclusion ?? "") === (other.run.conclusion ?? "") && isDeepStrictEqual(one.payload, other.payload);
+/**
+* The newest generation of the `pr:verify` proof at one head (#1409), or
+* nothing when no single generation can be trusted. It is the rule #1408 gave
+* the proof resume (`proof-resume.ts`, since reverted by #1411), applied to
+* this reader:
+*
+* - A run whose bound payload transports a typed proof is ordered at the
+*   `endedAt` that proof records, never by when it reached GitHub. Runs that
+*   carry the same such payload with the same status and conclusion are one
+*   generation posted more than once (`pr:verify` posts, `pr:publish`
+*   re-posts), so an older pass re-posted after a newer failure does not
+*   outrank it, and the normal post plus re-post is not a tie.
+* - Any other run is its own generation at its `started_at`: no bound payload,
+*   or a proof over the text cap that travels without its typed proof. The
+*   factory records a proof before it posts it, so that is the latest its
+*   proof could have been recorded, and it still vetoes every pass recorded
+*   before it was posted.
+* - Such a run carries no generation identity, so it is never grouped. Two
+*   separate executions with the same command names and verdict post the same
+*   compact payload, and so does a re-post. When the newest generation is one
+*   of these and repeats another run's verdict (`sameVerdict`), it could be a
+*   re-post of an older verdict or a new one, and nothing is trusted. Proofs
+*   that size are rare, so refusing costs one fresh verification.
+* - Two different generations at the newest instant refuse, by the shared
+*   sequencing owner's rule.
+*
+* Factory-ci's hosted proof-reuse gate applies the same rule in jq.
+*/
+const newestVerifyProofGeneration = (runs, bound) => {
+	const generations = [];
+	for (const run of runs) {
+		const parsed = parsePrVerifyCheckPayload(run.output?.text) ?? parsePrVerifyCheckPayload(run.output?.summary);
+		const payload = run.head_sha === bound.sha && parsed?.headSha === bound.sha && parsed.repository === bound.repository ? parsed : void 0;
+		const recordedMs = generationOrderMs(payload?.verificationProof?.endedAt);
+		if (payload === void 0 || !Number.isFinite(recordedMs)) {
+			generations.push({
+				orderMs: generationOrderMs(run.started_at),
+				...payload === void 0 ? {} : { payload },
+				recorded: false,
+				run
+			});
+			continue;
+		}
+		const generation = {
+			orderMs: recordedMs,
+			payload,
+			recorded: true,
+			run
+		};
+		if (!generations.some((earlier) => earlier.recorded && sameVerdict(earlier, generation))) generations.push(generation);
+	}
+	const selected = selectNewestGeneration(generations);
+	if (selected.kind !== "newest") return;
+	const newest = selected.generation;
+	return !newest.recorded && newest.payload !== void 0 && generations.some((generation) => generation !== newest && sameVerdict(generation, newest)) ? void 0 : newest;
+};
 /**
 * Read the machine-readable `pr:verify` binding for one commit (#247).
 *
@@ -9659,20 +9717,18 @@ function fetchPrVerifyProofBinding({ expectedAppId, githubApp, owner, repo, sha,
 	}
 	const runs = completeCheckRunPages(pages);
 	if (!runs) return;
-	const ordered = runs.filter((run) => run?.name === checkName && checkRunProducedByFactoryApp({
+	const owned = runs.filter((run) => run?.name === checkName && checkRunProducedByFactoryApp({
 		app: run.app,
 		expectedAppId: resolvedAppId
-	})).map((run) => ({
-		orderMs: generationOrderMs(run.started_at),
-		run
 	}));
-	if (ordered.some(({ orderMs }) => !Number.isFinite(orderMs))) return;
-	const selected = selectNewestGeneration(ordered);
-	if (selected.kind !== "newest") return;
-	const { run } = selected.generation;
-	if (run.status !== "completed" || run.head_sha !== sha) return;
-	const payload = parsePrVerifyCheckPayload(run.output?.text) ?? parsePrVerifyCheckPayload(run.output?.summary);
-	if (!payload || payload.headSha !== sha || payload.repository !== `${owner}/${repo}`) return;
+	if (owned.some((run) => !Number.isFinite(generationOrderMs(run.started_at)))) return;
+	const newest = newestVerifyProofGeneration(owned, {
+		repository: `${owner}/${repo}`,
+		sha
+	});
+	if (newest === void 0) return;
+	const { payload, run } = newest;
+	if (run.status !== "completed" || !payload) return;
 	const producer = checkRunProducedByFactoryApp({
 		app: run.app,
 		expectedAppId: resolvedAppId
@@ -14606,8 +14662,9 @@ function buildEpicCloseoutReport(input) {
 *
 * `factory:closeout` reads the lane's native at-rest provider logs by its
 * session join keys and records what they say as closeout metric rows. The
-* rows land in the one local closeout markdown, which is the read path the
-* `patronage-software-factory-lookback` skill uses.
+* rows land in the one local closeout markdown, and the closeout artifact
+* carries them to HQ as an advisory handoff. The weekly look-back no longer
+* reads token cost (#1433).
 *
 * Harvest NEVER throws: a missing or unreadable log degrades to an absent
 * family plus a data gap, so telemetry content can never fail the closeout.
@@ -16686,7 +16743,7 @@ const EPIC_STRUCTURE_SCHEMA_VERSION = 1;
 /**
 * DAG-node PLANNING statuses — the planning-plane vocabulary a planner authors
 * on a `dag.yml` node. Carried forward by ADR 0018 and defined by the epic
-* skill (`reference/epic-artifacts.md`) and both `CONTEXT.md` glossaries.
+* skill (`reference/epic-artifacts.md`) and both `GLOSSARY.md` glossaries.
 *
 * A DAG node is a unit of *plan*; an HQ lane is a unit of *runtime execution*.
 * These are two planes with two vocabularies and must not be conflated — the
@@ -17756,6 +17813,11 @@ function armAutoMerge(input, dependencies = {}) {
 //#endregion
 //#region src/merge-freeze.ts
 const MERGE_FREEZE_CHECK_NAME = "patronage-factory/merge-freeze";
+/**
+* The Factory App's slug, as GitHub serves it on the runs the writer posts.
+* It is not a trust predicate: an App chooses its own slug, so the reader
+* trusts the pinned numeric App id instead (ADR 0022, #1393).
+*/
 const MERGE_FREEZE_APP_SLUG = "patronage-factory";
 const MERGE_FREEZE_SCHEMA_VERSION = 1;
 const CHECK_RUNS_PER_PAGE$1 = 100;
@@ -17806,7 +17868,10 @@ function validateMergeFreezeState(value) {
 	return mergeFreezeStateSchema.parse(value);
 }
 const mergeFreezeCheckRunListItemSchema = z.object({
-	app: z.object({ slug: z.literal(MERGE_FREEZE_APP_SLUG) }),
+	app: z.object({
+		id: z.number(),
+		slug: z.string().nullable().optional()
+	}),
 	conclusion: z.enum([
 		"failure",
 		"neutral",
@@ -17856,7 +17921,14 @@ const commitParentsSchema = z.object({
 	sha: shaSchema$2
 });
 function selectListedMergeFreezeGeneration(listed, expectedHeadSha) {
-	const runs = z.object({ check_runs: z.array(z.unknown()) }).parse(listed).check_runs.map((run) => mergeFreezeCheckRunListItemSchema.parse(run));
+	const runs = z.object({ check_runs: z.array(z.unknown()) }).parse(listed).check_runs.map((run) => {
+		const listedRun = mergeFreezeCheckRunListItemSchema.parse(run);
+		if (!checkRunProducedByFactoryApp({
+			app: listedRun.app,
+			expectedAppId: FACTORY_PROOF_GATE_APP_ID
+		})) throw new Error(`${MERGE_FREEZE_CHECK_NAME} check run ${listedRun.id} was not written by the pinned Factory App ${FACTORY_PROOF_GATE_APP_ID}.`);
+		return listedRun;
+	});
 	if (runs.length === 0) return { kind: "missing" };
 	const selected = selectNewestGeneration(runs.map((run) => ({
 		orderMs: generationOrderMs(run.started_at),
@@ -22143,6 +22215,35 @@ const admittedPullRequestBodyEdit = (admission) => async ({ body, owner, repo, p
 		repo
 	}), process.cwd(), extraEnv === void 0 ? {} : { extraEnv });
 };
+/**
+* `gh pr create` for the draft (#1366). With a base, the title and body come
+* from the branch's commits, built as the Cursor VM's REST create builds them
+* (#1327). gh's own `--fill` keeps only the commit subjects once a branch has
+* two commits, which dropped every `Closes #N` line in a commit body, and
+* membership derives from those lines. With no base there is no range to
+* read, so gh fills from the repository default branch, every commit body
+* included (`--fill-verbose`).
+*/
+const ghArgsForPullRequestCreate = ({ base, commits, cwd }) => {
+	if (base === void 0) return [
+		"pr",
+		"create",
+		"--draft",
+		"--fill-verbose"
+	];
+	const { body, title } = pullRequestFill(commits(cwd, base));
+	return [
+		"pr",
+		"create",
+		"--draft",
+		"--title",
+		title,
+		"--body",
+		body,
+		"--base",
+		base
+	];
+};
 /** The REST create a Cursor VM uses in place of `gh pr create` (#1327). */
 const ghApiArgsForPullRequestCreate = ({ base, body, head, owner, repo, title }) => [
 	"api",
@@ -22169,13 +22270,18 @@ const ghApiArgsForPullRequestCreate = ({ base, body, head, owner, repo, title })
 * reads both branch refs, which is why the admission scope carries
 * `contents: read` (#1375). The title and body come from the branch's
 * commits, and the head is the already-pushed branch, so nothing is pushed.
-* Off a Cursor VM the call is `gh pr create`, unchanged.
+* Off a Cursor VM the call is `gh pr create`, with the same title and body
+* (#1366).
 */
-const admittedPullRequestCreate = (admission, repository) => async ({ args, base, branch, cwd }) => {
+const admittedPullRequestCreate = (admission, repository, commits) => async ({ base, branch, cwd }) => {
 	const extraEnv = await admission.ghEnv("create-pull-request", repository);
-	if (extraEnv === void 0) return runCapture("gh", args, cwd).stdout;
+	if (extraEnv === void 0) return runCapture("gh", ghArgsForPullRequestCreate({
+		base,
+		commits,
+		cwd
+	}), cwd).stdout;
 	if (base === void 0) throw new Error("pr:publish on a Cursor VM needs a base branch to create the pull request against, and none was passed or recorded. Run pr:verify, which records its base, or pass --base.");
-	const { body, title } = pullRequestFill(commitsSinceBase(cwd, base));
+	const { body, title } = pullRequestFill(commits(cwd, base));
 	return runCapture("gh", ghApiArgsForPullRequestCreate({
 		base,
 		body,
@@ -22194,9 +22300,14 @@ const admittedPullRequestCreate = (admission, repository) => async ({ args, base
 */
 const publishGithubAdapters = (dependencies, repository) => {
 	const admission = dependencies.admission ?? processAdmissionCredential;
+	const commits = dependencies.pullRequestCommits ?? commitsSinceBase;
 	const injectedGh = dependencies.gh;
 	return {
-		create: injectedGh ? ({ args, cwd }) => injectedGh(args, cwd) : admittedPullRequestCreate(admission, repository),
+		create: injectedGh ? ({ base, cwd }) => injectedGh(ghArgsForPullRequestCreate({
+			base,
+			commits,
+			cwd
+		}), cwd) : admittedPullRequestCreate(admission, repository, commits),
 		github: dependencies.github ?? {
 			...defaultPrReadyGithub(),
 			editPullRequestBody: admittedPullRequestBodyEdit(admission)
@@ -22289,15 +22400,7 @@ async function discoverOrCreatePullRequest({ args, branch, create, cwd, gh, revi
 		reviewProofPath,
 		verifyProofPath
 	});
-	const createArgs = [
-		"pr",
-		"create",
-		"--draft",
-		"--fill"
-	];
-	if (creationBase !== void 0) createArgs.push("--base", creationBase);
 	await create({
-		args: createArgs,
 		base: creationBase,
 		branch,
 		cwd
@@ -22469,6 +22572,18 @@ async function ensureVerifyProof({ args, cwd, dependencies, headSha, pr, verifyP
 	};
 }
 const reviewNotRequired = (proof) => proof.reviewRequirement?.status === "not-required";
+/**
+* Let the `pr-review-proof` event a cycle recorded from `--findings` reach HQ
+* or the spool before publish goes on (#1382). The sink's setup budget starts
+* when `pr:review` enqueues the event, and its first step waits for the event
+* loop. Standalone `pr:review` exits next, so the loop is free. Publish goes
+* straight on to synchronous `gh` calls, which held the loop past that budget,
+* so the sink gave up before spooling anything. Bounded by the sink's own
+* budgets.
+*/
+const settleRecordedReviewEvent = async (dependencies) => {
+	await (dependencies.awaitPendingIngest ?? awaitPendingHqIngest)();
+};
 async function ensureReviewProof({ args, cwd, dependencies, currentReviewIdentity, pr, reviewProofPath }) {
 	const proof = readOptionalReviewProof(cwd, reviewProofPath);
 	const ladderPolicy = resolveReviewLadderPolicy();
@@ -22497,9 +22612,11 @@ async function ensureReviewProof({ args, cwd, dependencies, currentReviewIdentit
 				verifyProof: args.verifyProof
 			}, publisher.dependencies);
 		} catch (error) {
+			await settleRecordedReviewEvent(dependencies);
 			await publisher.post()?.settled;
 			throw error;
 		}
+		await settleRecordedReviewEvent(dependencies);
 		const producerPost = publisher.post();
 		return {
 			...producerPost === void 0 ? {} : { producerPost },

package/dist/schemas.d.ts

@@ -66,7 +66,7 @@ type EvidenceReviewRung = (typeof EVIDENCE_REVIEW_RUNGS)[number];
 //#region src/review-ladder-ledger.d.ts
 type LadderCycleStage = "interior" | "gate";
 type LadderFindingReport = ReviewFindingAttributes;
-/** One finding as recorded in one cycle (CONTEXT.md: finding occurrence). */
+/** One finding as recorded in one cycle (GLOSSARY.md: finding occurrence). */
 interface ReviewOccurrenceRecord {
   address: string;
   /** The ladder-assigned cycle number the occurrence was recorded in. */
@@ -82,7 +82,7 @@ interface ReviewOccurrenceRecord {
 declare const POLICY_DECLARATION_RULES: readonly ["cycle-2-severity-floor", "identity-repeat"];
 type PolicyDeclarationRule = (typeof POLICY_DECLARATION_RULES)[number];
 /**
- * A disposition declaration as stored (CONTEXT.md: disposition declaration):
+ * A disposition declaration as stored (GLOSSARY.md: disposition declaration):
  * one occurrence, one disposition, the authority that made it and its
  * reference (operator, reviewer) or rule (policy).
  */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@patronage/software-factory",
-  "version": "1.0.0-alpha.40",
+  "version": "1.0.0-alpha.41",
   "description": "Shared Patronage software factory CLI and project-profile validation tools",
   "license": "MIT",
   "repository": {
@@ -15,7 +15,7 @@
   "files": [
     "dist",
     "README.md",
-    "CONTEXT.md"
+    "GLOSSARY.md"
   ],
   "type": "module",
   "exports": {
@@ -37,7 +37,7 @@
     "picomatch": "^4.0.5",
     "yaml": "^2.9.0",
     "zod": "4.4.3",
-    "@patronage/factory-ci": "1.0.0-alpha.40"
+    "@patronage/factory-ci": "1.0.0-alpha.41"
   },
   "devDependencies": {
     "@types/node": "24.13.3",