@patronage/software-factory 1.0.0-alpha.5 → 1.0.0-alpha.7

package/README.md

@@ -37,7 +37,7 @@ A stacked release train has one terminal release-owning slice. Interior slices d
 A stable cut has two phases. Phase 1 is the verified package candidate: steps 1 through 4 below, ending in the attended npm publish, tag, and GitHub release. Phase 2 is post-publication stable-doc convergence: steps 5 and 6, a normal admitted docs PR followed by the read-only convergence assertion from a clean `main`. Stable docs must never claim an unpublished version, so they cannot land in the phase-1 change. Prerelease behavior is unchanged: prerelease notes may land before publish while stable docs keep naming the prior stable version.
 
 1. Bump `package.json` to valid SemVer. The assertion derives its expected stable or prerelease channel from the version; it accepts no channel flag.
-2. Publish to npm per the [repository operations runbook](../docs/repository-operations.md#publishing) (attended, hand-cut, `pnpm publish` only). Both factory packages pin `publishConfig.tag: next`, so a bare `pnpm --filter @patronage/software-factory publish` lands on `next` and cannot move `latest`. A prerelease is therefore the bare command; a stable version must say it out loud: `pnpm --filter @patronage/software-factory publish --tag latest`. Forgetting the flag on a stable cut leaves `latest` untouched for the convergence assertion to flag — the safe failure direction.
+2. Publish to npm per the [repository operations runbook](../docs/repository-operations.md#publishing) (attended, hand-cut, `pnpm publish` only). **Always pass `--tag` explicitly, on every publish, prerelease or stable** — `pnpm --filter @patronage/software-factory publish --tag next` for a prerelease, `--tag latest` for a stable cut. A filtered publish takes pnpm's recursive path, which passes its own `--tag` (defaulting to `latest`) to npm and therefore ignores the `publishConfig.tag: next` pin both factory packages carry; that is how 1.0.0-alpha.6 briefly took `latest` (#658). The pins stay as belt and braces, but they are not the control. Omitting the flag is not a safe failure: on the filtered command it moves `latest`, which the convergence assertion can only report after the fact.
 3. Cut the `software-factory-vX.Y.Z` tag and push it.
 4. Cut the GitHub release for that tag, with notes covering features, deletions, breaking changes, and closed issues. Mark it as a prerelease exactly when its SemVer version has a prerelease component. When the release changes the profile `schemaVersion`, state it in the notes — the profile schema version is a separate axis from the package version.
 5. Converge the stable docs after publication. Update affected `software-factory-docs/` pages through a normal admitted docs PR. Stable docs must state the current stable version. Prerelease docs may record the candidate and its migration notes, but must not represent it as the current stable release.

package/dist/index.d.ts

@@ -145,8 +145,6 @@ interface HqIngestDependencies {
    * `timeoutMs`: see the note there.
    */
   journalFlushBudgetMs?: number;
-  /** @deprecated Legacy sidecars are now streamed directly; retained for API compatibility. */
-  sidecarReclaimMs?: number;
   /**
    * Setup budget for callers that own the process lifetime — honored AS GIVEN,
    * above the `DEFAULT_HQ_INGEST_TIMEOUT_MS` ceiling that clamps `timeoutMs`.
@@ -184,12 +182,6 @@ interface HqSpoolEntryOutcome {
   kind: string;
   spool: string;
   /**
-   * `migrated` belongs to the legacy JSONL journal only: the row was moved
-   * into the current spool without being delivered. The spool pass that runs
-   * after it in the same drain supersedes that line with a real outcome when
-   * it gets to the row; a `migrated` line that survives the run means the row
-   * is still waiting.
-   *
    * `undeliverable` is the one terminal verdict (#445). Every other status
    * describes a moment: HQ was unreachable, HQ refused this content today, the
    * row moved. Retrying is meaningful for all of them. A wrong-origin entry is
@@ -198,13 +190,11 @@ interface HqSpoolEntryOutcome {
    * run. Leaving it spooled asks the operator to retry something that provably
    * cannot succeed, and the count it inflates is the one doctor goes red on.
    */
-  status: "delivered" | "duplicate" | "migrated" | "rejected" | "undeliverable" | "unreachable";
+  status: "delivered" | "duplicate" | "rejected" | "undeliverable" | "unreachable";
 }
 interface HqSpoolFlushInput {
   clientId: string;
   clientSecret: string;
-  /** Repository root whose legacy `.factory-memory` spool is also drained. */
-  cwd: string;
   /** The profile's HQ origin; entries recorded against another are refused. */
   endpoint: string;
   /** Operator-named spool directories; replaces the default two locations. */
@@ -239,13 +229,13 @@ interface HqSpoolFlushSummary {
 interface HqSpoolWorkCount {
   /**
    * The earliest moment learned across pending spool files (their own write
-   * time) and legacy journal rows (their own `failedAt`). Absent only when
+   * time). Absent only when
    * `pending` is `0`, or when every timestamp source was unreadable within
    * budget — an estimate for doctor's remediation message (#394), never a
    * precise audit trail.
    */
   oldestQueuedAt?: string;
-  /** Spooled events and replayable journals waiting in the locations below. */
+  /** Spooled events waiting in the locations below. */
   pending: number;
   /** Locations that exist and hold spooled work. */
   spools: string[];
@@ -266,7 +256,7 @@ interface HqSpoolWorkCount {
  * same locations `flushHqSpool` drains are inspected here, read-only: no
  * directory is created, nothing is secured, and nothing is delivered.
  */
-declare function countHqSpoolWork(input: Pick<HqSpoolFlushInput, "cwd" | "explicitDirectories" | "repository">, dependencies?: {
+declare function countHqSpoolWork(input: Pick<HqSpoolFlushInput, "explicitDirectories" | "repository">, dependencies?: {
   budgetMs?: number;
   env?: NodeJS.ProcessEnv;
 }): Promise<HqSpoolWorkCount>;
@@ -275,7 +265,7 @@ interface HqSpoolOrphan {
   /** The `hq-retry-spool` directory itself, ready to pass to `--dir`. */
   directory: string;
   oldestQueuedAt?: string;
-  /** Spooled events and journal rows waiting there. */
+  /** Spooled events waiting there. */
   pending: number;
   /**
    * The location exists but could not be listed. As everywhere else in this
@@ -753,8 +743,8 @@ declare const mergeFreezeStateSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
   generationId: z.ZodNumber;
   headSha: z.ZodString;
   outcome: z.ZodEnum<{
-    active: "active";
     stale: "stale";
+    active: "active";
   }>;
   reason: z.ZodString;
   recordedAt: z.ZodISODateTime;
@@ -1234,8 +1224,8 @@ declare const managedReadinessLedgerSchema: z.ZodObject<{
       "run-interior-cycle": "run-interior-cycle";
     }>;
     stage: z.ZodEnum<{
-      gate: "gate";
       interior: "interior";
+      gate: "gate";
       "interior-complete": "interior-complete";
     }>;
   }, z.core.$strip>>;
@@ -1251,10 +1241,10 @@ declare const managedReadinessLedgerSchema: z.ZodObject<{
       reviewedHeadSha: z.ZodOptional<z.ZodString>;
       reviewedPatchId: z.ZodOptional<z.ZodString>;
       status: z.ZodEnum<{
-        blocked: "blocked";
         "not-required": "not-required";
-        stale: "stale";
+        blocked: "blocked";
         current: "current";
+        stale: "stale";
         missing: "missing";
       }>;
     }, z.core.$strip>;
@@ -1263,10 +1253,10 @@ declare const managedReadinessLedgerSchema: z.ZodObject<{
       reviewedHeadSha: z.ZodOptional<z.ZodString>;
       reviewedPatchId: z.ZodOptional<z.ZodString>;
       status: z.ZodEnum<{
-        blocked: "blocked";
         "not-required": "not-required";
-        stale: "stale";
+        blocked: "blocked";
         current: "current";
+        stale: "stale";
         missing: "missing";
       }>;
     }, z.core.$strip>>;
@@ -1277,8 +1267,8 @@ declare const managedReadinessLedgerSchema: z.ZodObject<{
     docsOnlyDeltaAccepted: z.ZodOptional<z.ZodBoolean>;
     docsOnlyVerifiedHeadSha: z.ZodOptional<z.ZodString>;
     prVerify: z.ZodEnum<{
-      stale: "stale";
       passed: "passed";
+      stale: "stale";
       missing: "missing";
     }>;
     trivialDeltaAccepted: z.ZodOptional<z.ZodBoolean>;
@@ -1778,10 +1768,10 @@ declare const loadEvidenceEnvelopes: (cwd: string) => LoadedEvidenceEnvelope[];
 //#region src/review-proof-applicability.d.ts
 declare const REVIEW_STATUS_VALUES: readonly ["not-required", "current", "stale", "missing", "blocked"];
 declare const reviewStatusSchema: z.ZodEnum<{
-  blocked: "blocked";
   "not-required": "not-required";
-  stale: "stale";
+  blocked: "blocked";
   current: "current";
+  stale: "stale";
   missing: "missing";
 }>;
 type ReviewStatus = z.infer<typeof reviewStatusSchema>;
@@ -2187,9 +2177,9 @@ declare const retroEnvelopeV1Schema: z.ZodObject<{
   kind: z.ZodLiteral<"retro-envelope">;
   outcome: z.ZodOptional<z.ZodObject<{
     status: z.ZodEnum<{
-      blocked: "blocked";
       success: "success";
       fail: "fail";
+      blocked: "blocked";
       "ship-with-followups": "ship-with-followups";
     }>;
     verdict: z.ZodOptional<z.ZodString>;
@@ -2949,8 +2939,8 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
     sessionId: z.ZodOptional<z.ZodString>;
   }, z.core.$strict>>;
   stage: z.ZodEnum<{
-    gate: "gate";
     interior: "interior";
+    gate: "gate";
   }>;
   usage: z.ZodOptional<z.ZodObject<{
     estimatedCostUsd: z.ZodOptional<z.ZodNumber>;
@@ -3002,8 +2992,8 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
     sessionId: z.ZodOptional<z.ZodString>;
   }, z.core.$strict>>;
   stage: z.ZodEnum<{
-    gate: "gate";
     interior: "interior";
+    gate: "gate";
   }>;
   usage: z.ZodOptional<z.ZodObject<{
     estimatedCostUsd: z.ZodOptional<z.ZodNumber>;
@@ -3046,8 +3036,8 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
       sessionId: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>>;
     stage: z.ZodEnum<{
-      gate: "gate";
       interior: "interior";
+      gate: "gate";
     }>;
     usage: z.ZodOptional<z.ZodObject<{
       estimatedCostUsd: z.ZodOptional<z.ZodNumber>;
@@ -3077,7 +3067,7 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
     staleRepeats: number;
   };
   observedAt: string;
-  stage: "gate" | "interior";
+  stage: "interior" | "gate";
   issue?: number | undefined;
   pr?: number | undefined;
   threadId?: string | undefined;
@@ -4076,13 +4066,13 @@ declare const evaluateReadiness: (input: EvaluationInput) => {
     reviews: {
       correctness: {
         required: boolean;
-        status: "blocked" | "not-required" | "stale" | "current" | "missing";
+        status: "not-required" | "blocked" | "current" | "stale" | "missing";
         reviewedHeadSha?: string | undefined;
         reviewedPatchId?: string | undefined;
       };
       security?: {
         required: boolean;
-        status: "blocked" | "not-required" | "stale" | "current" | "missing";
+        status: "not-required" | "blocked" | "current" | "stale" | "missing";
         reviewedHeadSha?: string | undefined;
         reviewedPatchId?: string | undefined;
       } | undefined;
@@ -4090,7 +4080,7 @@ declare const evaluateReadiness: (input: EvaluationInput) => {
     schemaVersion: 1;
     verification: {
       command: "patronage-factory pr:verify";
-      prVerify: "stale" | "passed" | "missing";
+      prVerify: "passed" | "stale" | "missing";
       docsOnlyDeltaAccepted?: boolean | undefined;
       docsOnlyVerifiedHeadSha?: string | undefined;
       trivialDeltaAccepted?: boolean | undefined;
@@ -4133,7 +4123,7 @@ declare const evaluateReadiness: (input: EvaluationInput) => {
         interior: number;
       };
       nextAction: "run-gate-cycle" | "accept-nonblocking-findings" | "escalate-to-triage" | "ready-for-human" | "advance-to-gate" | "run-interior-cycle";
-      stage: "gate" | "interior" | "interior-complete";
+      stage: "interior" | "gate" | "interior-complete";
       forcedTransition?: "gate-cap-exhausted" | "interior-cap-reached" | undefined;
     } | undefined;
     reviewRuns?: PrReviewResult[] | undefined;

package/dist/index.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { t as __exportAll } from "./chunk-pbuEa-1d.js";
-import { appendFileSync, constants, cpSync, createReadStream, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { appendFileSync, constants, cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { pathToFileURL } from "node:url";
 import { Command, InvalidArgumentError } from "commander";
 import path from "node:path";
@@ -9,7 +9,6 @@ import { z } from "zod";
 import { execFileSync, spawnSync } from "node:child_process";
 import { link, lstat, mkdir, open, readFile, readdir, realpath, rename, stat, unlink } from "node:fs/promises";
 import os, { homedir } from "node:os";
-import { createInterface } from "node:readline";
 import { setImmediate } from "node:timers";
 import { setImmediate as setImmediate$1, setTimeout as setTimeout$1 } from "node:timers/promises";
 import { Worker } from "node:worker_threads";
@@ -18,7 +17,7 @@ import { parse } from "yaml";
 import { promisify } from "node:util";
 import { GitHubApiError, mintInstallationToken } from "@patronage/factory-ci";
 //#region package.json
-var version = "1.0.0-alpha.5";
+var version = "1.0.0-alpha.7";
 //#endregion
 //#region src/review-rungs.ts
 const EVIDENCE_REVIEW_RUNGS$1 = [
@@ -1348,7 +1347,6 @@ function formatUserConfigError(configPath, error) {
 }
 const DEFAULT_HQ_TRANSPORT_TIMEOUT_MS = 2500;
 const HQ_RETRY_SPOOL_DIRNAME = "hq-retry-spool";
-const HQ_RETRY_JOURNAL_BASENAME = "hq-retry-journal.jsonl";
 /**
 * Appended to a spooled event that can never be delivered (#445).
 *
@@ -1389,9 +1387,6 @@ const SPOOL_REPOSITORY_MARKER = ".repository-identity";
 * and the extra level is slack for a key scheme that nests one deeper.
 */
 const HQ_SPOOL_SWEEP_MAX_DEPTH = 4;
-`${HQ_RETRY_JOURNAL_BASENAME}`;
-`${HQ_RETRY_SPOOL_DIRNAME}`;
-const LEGACY_FACTORY_MEMORY_DIRNAME = ".factory-memory";
 const HQ_SPOOL_STATE_SEGMENTS = ["patronage-factory", "hq-spool"];
 const MAX_HQ_CONFIG_BYTES = 1024 * 1024;
 const MAX_HQ_INGEST_PAYLOAD_BYTES = 256 * 1024;
@@ -1503,12 +1498,6 @@ const repositorySpoolLayout = (repository, env = process.env) => ({
 		HQ_RETRY_SPOOL_DIRNAME
 	]
 });
-/** Read-only drain source for spools written before the relocation. */
-const legacySpoolLayout = (cwd) => ({
-	create: false,
-	root: cwd,
-	segments: [LEGACY_FACTORY_MEMORY_DIRNAME, HQ_RETRY_SPOOL_DIRNAME]
-});
 /**
 * An operator-named directory (`hq:flush --dir`). Accepts either the spool
 * itself or the directory holding it, so a `.factory-memory` path and a
@@ -1580,30 +1569,10 @@ const secureSpoolLayout = async (layout, deadline) => {
 	const memoryIdentity = identities.at(-2);
 	if (spool === void 0 || memory === void 0 || spoolIdentity === void 0 || memoryIdentity === void 0 || !await directoryIdentityMatches(memory, memoryIdentity, deadline) || !await directoryIdentityMatches(spool, spoolIdentity, deadline)) return;
 	return {
-		memory,
-		memoryIdentity,
 		spool,
 		spoolIdentity
 	};
 };
-/**
-* The legacy JSONL journal lives one level above the spool. Securing it on its
-* own lets a pre-spool `.factory-memory` (journal but no spool directory)
-* drain without the read path creating anything inside the worktree.
-*/
-const secureJournalDirectory = async (layout, deadline) => {
-	const segments = layout.segments.slice(0, -1);
-	if (segments.length === 0) return;
-	const chain = await secureChain(layout, segments, deadline);
-	if (chain === void 0) return;
-	const directory = chain.directories.at(-1);
-	const identity = chain.identities.at(-1);
-	if (directory === void 0 || identity === void 0 || !await directoryIdentityMatches(directory, identity, deadline)) return;
-	return {
-		directory,
-		identity
-	};
-};
 const readDirectoryIdentity = async (directory, deadline) => {
 	const opened = await openWithin(directory, constants.O_RDONLY + constants.O_DIRECTORY + constants.O_NOFOLLOW, remainingMs(deadline));
 	if (opened.status !== "fulfilled") return;
@@ -2333,225 +2302,6 @@ const replayCloseoutSpool = async (layout, endpoint, clientId, clientSecret, req
 		if (!await mutateBoundDirectory(spool, spoolIdentity, performance.now() + flushBudgetMs, () => outcome.ok ? unlink(claimPath) : rename(claimPath, eventPath))) return;
 	}
 };
-const writeLegacyCursor = async (directory, directoryIdentity, cursorPath, offset, deadline) => {
-	if (path.dirname(cursorPath) !== directory || !await directoryIdentityMatches(directory, directoryIdentity, deadline)) return false;
-	const temporary = `${cursorPath}.${randomUUID()}.tmp`;
-	const opened = await openWithin(temporary, constants.O_CREAT + constants.O_EXCL + constants.O_WRONLY + constants.O_NOFOLLOW, remainingMs(deadline), 384);
-	if (opened.status !== "fulfilled") return false;
-	const wrote = await settleWithin((async () => {
-		await opened.value.writeFile(String(offset), "utf-8");
-		await opened.value.sync();
-	})(), remainingMs(deadline));
-	const closed = await settleWithin(opened.value.close(), remainingMs(deadline));
-	if (wrote.status !== "fulfilled" || closed.status !== "fulfilled") {
-		await mutateBoundDirectory(directory, directoryIdentity, deadline, async () => unlink(temporary));
-		return false;
-	}
-	if (!await mutateBoundDirectory(directory, directoryIdentity, deadline, async () => rename(temporary, cursorPath))) {
-		await mutateBoundDirectory(directory, directoryIdentity, deadline, async () => unlink(temporary));
-		return false;
-	}
-	return await syncBoundDirectory(directory, directoryIdentity, deadline);
-};
-const readLegacyCursor = async (cursorPath, deadline) => {
-	const file = await readBoundedTextFileNoFollow(cursorPath, deadline, 128);
-	if (file === void 0) return 0;
-	const offset = Number(file.contents);
-	return Number.isSafeInteger(offset) && offset >= 0 ? offset : 0;
-};
-const claimLegacySource = async (sourcePath, target, directory, directoryIdentity, deadline) => {
-	if (path.dirname(sourcePath) !== directory || !await directoryIdentityMatches(directory, directoryIdentity, deadline)) return;
-	const metadata = await settleWithin(lstat(sourcePath), remainingMs(deadline));
-	if (metadata.status !== "fulfilled" || !metadata.value.isFile() || metadata.value.isSymbolicLink()) return;
-	const claimPath = `${target}.legacy-claim-${randomUUID()}`;
-	if (!await mutateBoundDirectory(directory, directoryIdentity, deadline, async () => rename(sourcePath, claimPath))) return;
-	return claimPath;
-};
-const releaseLegacyClaim = async (claimPath, target, directory, directoryIdentity, deadline) => {
-	if (path.dirname(claimPath) !== directory) return false;
-	const readyPath = `${target}.legacy-ready-${randomUUID()}`;
-	return mutateBoundDirectory(directory, directoryIdentity, deadline, async () => rename(claimPath, readyPath));
-};
-async function replayRetryJournal(layout, writeLayout, endpoint, clientId, clientSecret, request, dependencies, transportBudgetMs, setupDeadline, replayDeadline, options = {}) {
-	const maxEntries = options.maxEntries ?? MAX_HQ_REPLAY_ENTRIES;
-	const { report } = options;
-	const secured = await settleWithin(secureJournalDirectory(layout, setupDeadline), remainingMs(setupDeadline));
-	if (secured.status !== "fulfilled" || secured.value === void 0) return;
-	const { directory, identity: directoryIdentity } = secured.value;
-	const target = path.join(directory, HQ_RETRY_JOURNAL_BASENAME);
-	const baseName = path.basename(target);
-	const listing = await settleWithin(readdir(directory), remainingMs(setupDeadline));
-	if (listing.status !== "fulfilled") return;
-	let delivered = 0;
-	let corruptDropped = 0;
-	const sources = listing.value.filter((name) => name === baseName || name.startsWith(`${baseName}.legacy-ready-`) || name.startsWith(`${baseName}.draining-`) || name.startsWith(`${baseName}.legacy-claim-`)).filter((name) => !name.includes(".cursor")).toSorted();
-	for (const name of sources) {
-		if (delivered >= maxEntries || remainingMs(replayDeadline) <= 0) break;
-		const sourcePath = path.join(directory, name);
-		if (name.startsWith(`${baseName}.draining-`) || name.startsWith(`${baseName}.legacy-claim-`)) {
-			const metadata = await settleWithin(lstat(sourcePath), remainingMs(setupDeadline));
-			if (metadata.status !== "fulfilled" || !metadata.value.isFile() || metadata.value.isSymbolicLink() || Date.now() - Math.max(metadata.value.mtimeMs, metadata.value.ctimeMs) < STALE_SPOOL_ARTIFACT_MS) continue;
-		}
-		const claimPath = await claimLegacySource(sourcePath, target, directory, directoryIdentity, setupDeadline);
-		if (claimPath === void 0) continue;
-		const opened = await openWithin(claimPath, constants.O_RDONLY + constants.O_NOFOLLOW, remainingMs(setupDeadline));
-		if (opened.status !== "fulfilled") {
-			await releaseLegacyClaim(claimPath, target, directory, directoryIdentity, setupDeadline);
-			continue;
-		}
-		const sourceMetadata = await settleWithin(opened.value.stat(), remainingMs(setupDeadline));
-		if (sourceMetadata.status !== "fulfilled" || !sourceMetadata.value.isFile()) {
-			await settleWithin(opened.value.close(), remainingMs(setupDeadline));
-			await releaseLegacyClaim(claimPath, target, directory, directoryIdentity, setupDeadline);
-			continue;
-		}
-		const cursorPath = `${target}.legacy-cursor-${String(sourceMetadata.value.dev)}-${String(sourceMetadata.value.ino)}`;
-		let offset = await readLegacyCursor(cursorPath, setupDeadline);
-		if (offset >= sourceMetadata.value.size) {
-			await settleWithin(opened.value.close(), remainingMs(setupDeadline));
-			const current = await settleWithin(lstat(claimPath), remainingMs(setupDeadline));
-			if (current.status === "fulfilled" && current.value.isFile() && !current.value.isSymbolicLink() && current.value.dev === sourceMetadata.value.dev && current.value.ino === sourceMetadata.value.ino && current.value.size === sourceMetadata.value.size) {
-				await mutateBoundDirectory(directory, directoryIdentity, setupDeadline, async () => unlink(claimPath));
-				await mutateBoundDirectory(directory, directoryIdentity, setupDeadline, async () => unlink(cursorPath));
-			}
-			continue;
-		}
-		const abort = new AbortController();
-		const streamBudget = Math.min(remainingMs(setupDeadline), remainingMs(replayDeadline));
-		const abortTimer = setTimeout(() => abort.abort(), Math.max(0, streamBudget));
-		abortTimer.unref();
-		const stream = createReadStream(claimPath, {
-			autoClose: false,
-			encoding: "utf-8",
-			fd: opened.value.fd,
-			signal: abort.signal,
-			start: offset
-		});
-		const lines = createInterface({
-			crlfDelay: Infinity,
-			input: stream
-		});
-		let reachedEof = true;
-		try {
-			for await (const line of lines) {
-				if (delivered >= maxEntries || remainingMs(replayDeadline) <= 0 || remainingMs(setupDeadline) <= 0) {
-					reachedEof = false;
-					break;
-				}
-				const nextOffset = Math.min(sourceMetadata.value.size, offset + Buffer.byteLength(line, "utf-8") + 1);
-				if (line.trim().length === 0) {
-					offset = nextOffset;
-					if (!await writeLegacyCursor(directory, directoryIdentity, cursorPath, offset, setupDeadline)) {
-						reachedEof = false;
-						break;
-					}
-					continue;
-				}
-				let parsed;
-				try {
-					parsed = JSON.parse(line);
-				} catch {
-					corruptDropped += 1;
-					offset = nextOffset;
-					if (!await writeLegacyCursor(directory, directoryIdentity, cursorPath, offset, setupDeadline)) {
-						reachedEof = false;
-						break;
-					}
-					continue;
-				}
-				if (!isReplayableEntry(parsed)) {
-					offset = nextOffset;
-					if (!await writeLegacyCursor(directory, directoryIdentity, cursorPath, offset, setupDeadline)) {
-						reachedEof = false;
-						break;
-					}
-					continue;
-				}
-				const entryEndpoint = validatedEndpoint(parsed.endpoint);
-				let handled = false;
-				const row = {
-					eventId: parsed.event.eventId,
-					kind: parsed.event.kind
-				};
-				let rowOutcome = {
-					detail: `recorded endpoint ${entryEndpoint?.origin ?? "(unusable)"} is not this repository's authorized HQ origin ${endpoint.origin}`,
-					...row,
-					spool: directory,
-					status: "migrated"
-				};
-				if (entryEndpoint?.origin === endpoint.origin) {
-					rowOutcome = {
-						...rowOutcome,
-						detail: "event could not be serialized for delivery"
-					};
-					let body;
-					try {
-						body = JSON.stringify(parsed.event);
-					} catch {
-						body = void 0;
-					}
-					if (body !== void 0) {
-						const outcome = await attemptTransport(request, endpoint, clientId, clientSecret, body, Math.min(transportBudgetMs, remainingMs(replayDeadline)), report !== void 0);
-						handled = outcome.ok;
-						if (handled) delivered += 1;
-						rowOutcome = outcome.ok ? {
-							...row,
-							spool: directory,
-							status: outcome.duplicate === true ? "duplicate" : "delivered"
-						} : {
-							...row,
-							detail: outcome.detail === void 0 ? outcome.reason : `${outcome.reason}: ${outcome.detail}`,
-							spool: directory,
-							status: drainFailureStatus(outcome.reason)
-						};
-					}
-				}
-				if (!handled) {
-					const retained = await appendCloseoutSpool(writeLayout, parsed, performance.now() + journalFlushBudgetFor(dependencies));
-					if (retained === void 0) options.onMigrate?.();
-					if (retained !== void 0) {
-						report?.({
-							...rowOutcome,
-							detail: `${rowOutcome.detail ?? rowOutcome.status}; migration into the current spool ${retained}`,
-							status: "unreachable"
-						});
-						reachedEof = false;
-						break;
-					}
-				}
-				report?.(rowOutcome);
-				offset = nextOffset;
-				if (!await writeLegacyCursor(directory, directoryIdentity, cursorPath, offset, setupDeadline)) {
-					reachedEof = false;
-					break;
-				}
-			}
-		} catch {
-			reachedEof = false;
-		} finally {
-			clearTimeout(abortTimer);
-			abort.abort();
-			lines.close();
-			stream.destroy();
-			await settleWithin(opened.value.close(), remainingMs(setupDeadline));
-		}
-		if (reachedEof && offset >= sourceMetadata.value.size) {
-			const current = await settleWithin(lstat(claimPath), remainingMs(setupDeadline));
-			if (current.status === "fulfilled" && current.value.isFile() && !current.value.isSymbolicLink() && current.value.dev === sourceMetadata.value.dev && current.value.ino === sourceMetadata.value.ino && current.value.size === sourceMetadata.value.size && await directoryIdentityMatches(directory, directoryIdentity, setupDeadline)) {
-				await mutateBoundDirectory(directory, directoryIdentity, setupDeadline, async () => unlink(claimPath));
-				await mutateBoundDirectory(directory, directoryIdentity, setupDeadline, async () => unlink(cursorPath));
-			}
-		} else await releaseLegacyClaim(claimPath, target, directory, directoryIdentity, setupDeadline);
-	}
-	await reportReplayOutcome(dependencies, delivered, corruptDropped);
-}
-async function reportReplayOutcome(dependencies, delivered, corruptDropped) {
-	if (delivered <= 0 && corruptDropped <= 0) return;
-	const parts = [];
-	if (delivered > 0) parts.push(`${delivered} queued event(s) delivered from the retry journal`);
-	if (corruptDropped > 0) parts.push(`${corruptDropped} unparseable journal line(s) dropped (partial write recovered, #120)`);
-	await reportDiagnostic(dependencies, performance.now() + journalFlushBudgetFor(dependencies), parts.join("; "), delivered > 0 ? "HQ ingest confirmed" : "HQ ingest recovered");
-}
 async function deliverHqIngest(input, dependencies, setupDeadline, timeoutMs, transportBudgetMs) {
 	let config;
 	try {
@@ -2595,7 +2345,6 @@ async function deliverHqIngest(input, dependencies, setupDeadline, timeoutMs, tr
 		owner: input.profile.repository.owner,
 		repo: input.profile.repository.name
 	}, env);
-	const readLayouts = [writeLayout, legacySpoolLayout(input.cwd)];
 	const now = dependencies.now ?? (() => /* @__PURE__ */ new Date());
 	const makeEventId = dependencies.randomUUID ?? randomUUID;
 	let event;
@@ -2666,10 +2415,7 @@ async function deliverHqIngest(input, dependencies, setupDeadline, timeoutMs, tr
 			throw new Error(reason);
 		}
 		const replayDeadline = performance.now() + timeoutMs;
-		for (const readLayout of readLayouts) {
-			await replayCloseoutSpool(readLayout, endpoint, clientId, clientSecret, request, transportBudgetMs, replayDeadline, replayDeadline, journalFlushBudgetFor(dependencies), persistedEventPath);
-			await replayRetryJournal(readLayout, writeLayout, endpoint, clientId, clientSecret, request, dependencies, transportBudgetMs, replayDeadline, replayDeadline);
-		}
+		await replayCloseoutSpool(writeLayout, endpoint, clientId, clientSecret, request, transportBudgetMs, replayDeadline, replayDeadline, journalFlushBudgetFor(dependencies), persistedEventPath);
 		const outcome = await attemptTransport(request, endpoint, clientId, clientSecret, body, transportBudgetMs);
 		if (!outcome.ok) {
 			({reason, unconfirmed} = outcome);
@@ -2748,20 +2494,7 @@ async function awaitPendingHqIngest() {
 const DEFAULT_HQ_FLUSH_BUDGET_MS = 600 * 1e3;
 /** ENOENT is the only filesystem answer that means "this location is absent". */
 const isMissingEntryError = (error) => typeof error === "object" && error !== null && error.code === "ENOENT";
-const journalRowCount = (contents) => contents.split("\n").filter((line) => line.trim() !== "").length;
-const journalLineTimestamps = (contents) => {
-	const timestamps = [];
-	for (const line of contents.split("\n")) {
-		const trimmed = line.trim();
-		if (trimmed === "") continue;
-		try {
-			const parsed = JSON.parse(trimmed);
-			if (typeof parsed.failedAt === "string") timestamps.push(parsed.failedAt);
-		} catch {}
-	}
-	return timestamps;
-};
-const countRemainingSpoolWork = async (spools, drainLayouts, deadline) => {
+const countRemainingSpoolWork = async (spools, deadline) => {
 	let remaining = 0;
 	let unlistableScans = 0;
 	let oldestMs;
@@ -2790,27 +2523,6 @@ const countRemainingSpoolWork = async (spools, drainLayouts, deadline) => {
 			if (probed.status === "fulfilled") noteTimestamp(probed.value.mtime.toISOString());
 		}
 	}
-	for (const layout of drainLayouts) {
-		const journalDir = path.dirname(layoutPath(layout));
-		const journalListing = await settleWithin(readdir(journalDir), remainingMs(deadline));
-		if (journalListing.status !== "fulfilled") {
-			await countUnlistable(journalDir);
-			continue;
-		}
-		const journalNames = journalListing.value.filter((name) => name === "hq-retry-journal.jsonl" || name.startsWith(`hq-retry-journal.jsonl.legacy-ready-`) || name.startsWith(`hq-retry-journal.jsonl.legacy-claim-`) || name.startsWith(`hq-retry-journal.jsonl.draining-`));
-		for (const name of journalNames) {
-			const journalFilePath = path.join(journalDir, name);
-			const read = await settleWithin(readFile(journalFilePath, "utf-8"), remainingMs(deadline));
-			if (read.status === "fulfilled") {
-				remaining += journalRowCount(read.value);
-				for (const timestamp of journalLineTimestamps(read.value)) noteTimestamp(timestamp);
-				continue;
-			}
-			remaining += 1;
-			const probed = await settleWithin(lstat(journalFilePath), remainingMs(deadline));
-			if (probed.status === "fulfilled") noteTimestamp(probed.value.mtime.toISOString());
-		}
-	}
 	return {
 		...oldestMs === void 0 ? {} : { oldestQueuedAt: new Date(oldestMs).toISOString() },
 		remaining,
@@ -2831,10 +2543,10 @@ const DEFAULT_HQ_SPOOL_INSPECT_BUDGET_MS = 5e3;
 */
 async function countHqSpoolWork(input, dependencies = {}) {
 	const env = dependencies.env ?? process.env;
-	const layouts = input.explicitDirectories && input.explicitDirectories.length > 0 ? input.explicitDirectories.map(explicitSpoolLayout) : [repositorySpoolLayout(input.repository, env), legacySpoolLayout(input.cwd)];
+	const layouts = input.explicitDirectories && input.explicitDirectories.length > 0 ? input.explicitDirectories.map(explicitSpoolLayout) : [repositorySpoolLayout(input.repository, env)];
 	const deadline = performance.now() + (dependencies.budgetMs ?? DEFAULT_HQ_SPOOL_INSPECT_BUDGET_MS);
 	const paths = layouts.map((layout) => layoutPath(layout));
-	const { oldestQueuedAt, remaining, unlistableScans } = await countRemainingSpoolWork(paths, layouts, deadline);
+	const { oldestQueuedAt, remaining, unlistableScans } = await countRemainingSpoolWork(paths, deadline);
 	const existing = await Promise.all(paths.map(async (spool) => {
 		return (await settleWithin(lstat(spool), remainingMs(deadline))).status === "fulfilled" ? spool : void 0;
 	}));
@@ -3002,7 +2714,7 @@ async function sweepHqSpoolOrphans(input, dependencies = {}) {
 			});
 			continue;
 		}
-		const counted = await countRemainingSpoolWork([spool], [explicitSpoolLayout(spool)], deadline);
+		const counted = await countRemainingSpoolWork([spool], deadline);
 		if (counted.remaining === 0 && counted.unlistableScans === 0) continue;
 		orphans.push({
 			directory: spool,
@@ -3022,7 +2734,7 @@ async function sweepHqSpoolOrphans(input, dependencies = {}) {
 			});
 			continue;
 		}
-		const counted = await countRemainingSpoolWork([spool], [explicitSpoolLayout(spool)], deadline);
+		const counted = await countRemainingSpoolWork([spool], deadline);
 		if (counted.remaining === 0 && counted.unlistableScans === 0) continue;
 		orphans.push({
 			directory: spool,
@@ -3042,8 +2754,8 @@ async function sweepHqSpoolOrphans(input, dependencies = {}) {
 * This is the deliberate counterpart to the sink's advisory emit path: the
 * caller has already resolved credentials explicitly, so there is no cap, no
 * daemon, and no background retry — one pass, bounded, over the repo-keyed
-* location plus the legacy cwd location (or the operator's `--dir`). Delivery
-* itself is the sink's own replay, so there is exactly one POST path.
+* location (or the operator's `--dir`). Delivery itself is the sink's own
+* replay, so there is exactly one POST path.
 */
 async function flushHqSpool(input, dependencies = {}) {
 	const endpoint = validatedIngestEndpoint(input.endpoint);
@@ -3056,8 +2768,7 @@ async function flushHqSpool(input, dependencies = {}) {
 		journalFlushBudgetMs: dependencies.journalFlushBudgetMs
 	});
 	const deadline = performance.now() + (dependencies.budgetMs ?? DEFAULT_HQ_FLUSH_BUDGET_MS);
-	const writeLayout = repositorySpoolLayout(input.repository, env);
-	const layouts = input.explicitDirectories && input.explicitDirectories.length > 0 ? input.explicitDirectories.map(explicitSpoolLayout) : [writeLayout, legacySpoolLayout(input.cwd)];
+	const layouts = input.explicitDirectories && input.explicitDirectories.length > 0 ? input.explicitDirectories.map(explicitSpoolLayout) : [repositorySpoolLayout(input.repository, env)];
 	const outcomeById = /* @__PURE__ */ new Map();
 	let rejectedFiles = 0;
 	let unreachableFiles = 0;
@@ -3066,31 +2777,13 @@ async function flushHqSpool(input, dependencies = {}) {
 		outcomeById.set(outcome.eventId, outcome);
 		dependencies.report?.(outcome);
 	};
-	const journalReport = (outcome) => {
-		if (outcome.status === "unreachable" && outcome.detail?.includes("migration into the current spool")) unreachableFiles += 1;
-		record(outcome);
-	};
 	const spoolReport = (outcome) => {
 		if (outcome.status === "rejected") rejectedFiles += 1;
 		if (outcome.status === "unreachable") unreachableFiles += 1;
 		record(outcome);
 	};
 	const spools = [];
-	let migratedIntoWriteLayout = false;
-	const journalDrainOptions = {
-		maxEntries: Number.POSITIVE_INFINITY,
-		onMigrate: () => {
-			migratedIntoWriteLayout = true;
-		},
-		report: journalReport
-	};
-	for (const layout of layouts) await replayRetryJournal(layout, writeLayout, endpoint, input.clientId, input.clientSecret, request, {
-		env,
-		fetch: request,
-		journalFlushBudgetMs: flushBudgetMs
-	}, transportBudgetMs, deadline, deadline, journalDrainOptions);
-	const drainLayouts = migratedIntoWriteLayout && !layouts.some((layout) => layoutPath(layout) === layoutPath(writeLayout)) ? [...layouts, writeLayout] : layouts;
-	for (const layout of drainLayouts) {
+	for (const layout of layouts) {
 		await replayCloseoutSpool(layout, endpoint, input.clientId, input.clientSecret, request, transportBudgetMs, deadline, deadline, flushBudgetMs, void 0, {
 			maxEntries: Number.POSITIVE_INFINITY,
 			report: spoolReport
@@ -3100,7 +2793,7 @@ async function flushHqSpool(input, dependencies = {}) {
 			if ((await settleWithin(lstat(layoutPath(layout)), remainingMs(deadline))).status === "fulfilled") unsecurableSpools += 1;
 		} else spools.push(secured.spool);
 	}
-	const { remaining, unlistableScans } = await countRemainingSpoolWork(spools, drainLayouts, deadline);
+	const { remaining, unlistableScans } = await countRemainingSpoolWork(spools, deadline);
 	const outcomes = [...outcomeById.values()];
 	const count = (status) => outcomes.filter((outcome) => outcome.status === status).length;
 	const rejected = count("rejected");
@@ -8860,8 +8553,24 @@ function positiveInteger(name) {
 	};
 }
 function resolveCwdOption(cwd) {
-	if (typeof cwd !== "string" || cwd.trim() === "") throw new Error("--cwd requires a non-empty path; relative values resolve against the current working directory");
-	return path.resolve(cwd);
+	const value = typeof cwd === "string" ? cwd : ".";
+	if (value.trim() === "") throw new Error("--cwd requires a non-empty path; relative values resolve against the current working directory");
+	return path.resolve(value);
+}
+function collectCwdOption(rawValue, previous) {
+	if (previous === void 0) return rawValue;
+	const previousResolved = resolveCwdOption(previous);
+	const currentResolved = resolveCwdOption(rawValue);
+	if (previousResolved !== currentResolved) throw new Error(`--cwd was passed multiple times with conflicting values: "${previous}" (resolves to ${previousResolved}) and "${rawValue}" (resolves to ${currentResolved})`);
+	return rawValue;
+}
+function markCwdOptionDefault(command) {
+	const option = command.options.find((candidate) => candidate.attributeName() === "cwd");
+	if (option) {
+		option.defaultValue = ".";
+		option.defaultValueDescription = ".";
+	}
+	return command;
 }
 function resolveCheckoutPath(cwd, target) {
 	return path.resolve(cwd, target);
@@ -8884,7 +8593,7 @@ const renderReport = (record) => {
 	return `${lines.join("\n")}\n`;
 };
 function createBoundaryCheckCommand(output, action) {
-	return new Command("boundary:check").description("Boundary readiness gate (T8): require a membership-fresh boundary-review proof at the declared closeout rung. Blocks closeout/enablement, never merge.").requiredOption("--epic <number>", "epic issue number carrying the factory-boundary manifest", positiveInteger("--epic")).option("--repo <owner/name>", "GitHub repository (default: resolved from --cwd)").option("--cwd <path>", "repository working directory", ".").option("--output <path>", "write an additional proof copy to this path").option("--profile <path>", "path to the project profile JSON file").option("--json", "print the full proof record as JSON").action(withGateTiming({
+	return markCwdOptionDefault(new Command("boundary:check").description("Boundary readiness gate (T8): require a membership-fresh boundary-review proof at the declared closeout rung. Blocks closeout/enablement, never merge.").requiredOption("--epic <number>", "epic issue number carrying the factory-boundary manifest", positiveInteger("--epic")).option("--repo <owner/name>", "GitHub repository (default: resolved from --cwd)").option("--cwd <path>", "repository working directory", collectCwdOption).option("--output <path>", "write an additional proof copy to this path").option("--profile <path>", "path to the project profile JSON file").option("--json", "print the full proof record as JSON").action(withGateTiming({
 		gate: "boundary:check",
 		resolveLedgerRoot: (options) => resolveCwdOption(options.cwd),
 		stderr: output.stderr
@@ -8923,7 +8632,7 @@ function createBoundaryCheckCommand(output, action) {
 		}
 		output.stdout.write(options.json ? `${JSON.stringify(record, null, 2)}\n` : renderReport(record));
 		if (record.status !== "ready") throw new Error(`boundary:check refused: ${record.blockingReasons.join("; ")}`);
-	}));
+	})));
 }
 //#endregion
 //#region src/checkout-repository.ts
@@ -11526,7 +11235,7 @@ const runDemandWaive = (args, dependencies = {}) => {
 * offers no way to declare a demand met, only to waive it on the record.
 */
 function createDemandWaiveCommand(_output, action = runDemandWaive) {
-	return new Command("demand:waive").description("Waive one resolved demand for one candidate, on the operator's identity, with the rationale recorded in the proof").requiredOption("--pr <number>", "pull request number", positiveInteger("--pr")).requiredOption("--demand <key>", "resolved demand key, e.g. review-rung:human, required-check:core, merge-freeze").requiredOption("--rationale <text>", "why this demand is being waived").option("--cwd <path>", "working directory to evaluate", ".").option("--json", "print the recorded waiver as JSON").option("--output <path>", "waiver record JSON path").action((options) => {
+	return markCwdOptionDefault(new Command("demand:waive").description("Waive one resolved demand for one candidate, on the operator's identity, with the rationale recorded in the proof").requiredOption("--pr <number>", "pull request number", positiveInteger("--pr")).requiredOption("--demand <key>", "resolved demand key, e.g. review-rung:human, required-check:core, merge-freeze").requiredOption("--rationale <text>", "why this demand is being waived").option("--cwd <path>", "working directory to evaluate", collectCwdOption).option("--json", "print the recorded waiver as JSON").option("--output <path>", "waiver record JSON path").action((options) => {
 		action({
 			cwd: resolveCwdOption(options.cwd),
 			demand: options.demand,
@@ -11535,7 +11244,7 @@ function createDemandWaiveCommand(_output, action = runDemandWaive) {
 			pr: options.pr,
 			rationale: options.rationale
 		});
-	});
+	}));
 }
 //#endregion
 //#region src/demand-resolution.ts
@@ -12128,10 +11837,10 @@ const describeOrphans = (orphans) => {
 	return ` ${orphans.length} spool location(s) hold this repository's evidence under an earlier key it no longer resolves to — a key-format change strands evidence there where no drain looks: ${described}. Drain each with \`psf hq:flush --dir <path>\`.`;
 };
 /**
-* Red when HQ evidence is waiting for this repository: its own spool or legacy
-* journal, or a sibling location written under an earlier key of its own that
-* it no longer resolves to (#420). Another repository's spool under the shared
-* root is that repository's business, never this check's (#446).
+* Warns when HQ evidence is waiting for this repository: its own spool or a
+* sibling location written under an earlier key of its own that it no longer
+* resolves to (#420). Another repository's spool under the shared root is that
+* repository's business, never this check's (#446).
 *
 * Reuses `countHqSpoolWork` (#414) — the same read-only, credential-free
 * inspection `hq:flush` itself consults before ever resolving a secret — so
@@ -12141,19 +11850,23 @@ const describeOrphans = (orphans) => {
 * the spool resolve exactly one key, so evidence written under an older one is
 * invisible to a drain and, before this, to doctor: the failure epic #389 was
 * chartered to end is evidence that is neither delivered nor visibly stranded.
-* An orphan holding pending events is red for the same reason the repo-keyed
-* spool is.
+* An orphan holding pending events warns for the same reason the repo-keyed
+* spool does.
+*
+* `warning`, not `error` (#659, epic #663 wave 1): a spooled event is real
+* HQ-delivery lag, but doctor is a read-only diagnostic that must never gain a
+* flush side-effect, and a preflight gate that treats doctor's exit code as
+* the bar must not block admission on delivery lag it cannot fix from here.
+* `psf hq:flush` — a trusted local session, not doctor — is still how the
+* spool actually drains.
 */
 async function hqSpoolDoctorCheck(input, dependencies = {}) {
 	const countSpool = dependencies.countSpool ?? countHqSpoolWork;
 	const sweepOrphans = dependencies.sweepOrphans ?? sweepHqSpoolOrphans;
-	const [counted, swept] = await Promise.all([countSpool({
-		cwd: input.cwd,
-		repository: input.repository
-	}, { env: input.env }), sweepOrphans({ repository: input.repository }, { env: input.env })]);
+	const [counted, swept] = await Promise.all([countSpool({ repository: input.repository }, { env: input.env }), sweepOrphans({ repository: input.repository }, { env: input.env })]);
 	const orphanNote = swept.orphans.length === 0 ? "" : describeOrphans(swept.orphans);
 	if (counted.pending === 0 && counted.unlistable === 0 && swept.orphans.length === 0) return {
-		message: "HQ spool and journal are empty; no evidence is waiting to be drained.",
+		message: "HQ spool is empty; no evidence is waiting to be drained.",
 		name: HQ_SPOOL_CHECK_NAME,
 		status: "ok"
 	};
@@ -12162,17 +11875,17 @@ async function hqSpoolDoctorCheck(input, dependencies = {}) {
 	if (counted.pending > 0) return {
 		message: `${counted.pending} HQ event(s) are spooled locally.${oldestNote}${locationsNote} ${FLUSH_REMEDY}${orphanNote}`,
 		name: HQ_SPOOL_CHECK_NAME,
-		status: "error"
+		status: "warning"
 	};
 	if (counted.unlistable > 0) return {
 		message: `${counted.unlistable} spool location(s) exist but could not be listed within budget, so this cannot be reported as empty.${locationsNote} ${FLUSH_REMEDY}${orphanNote}`,
 		name: HQ_SPOOL_CHECK_NAME,
-		status: "error"
+		status: "warning"
 	};
 	return {
 		message: `This repository's HQ spool is empty, but stranded evidence is waiting under the spool root ${swept.root}.${orphanNote}`,
 		name: HQ_SPOOL_CHECK_NAME,
-		status: "error"
+		status: "warning"
 	};
 }
 const readJsonFiles = async (dir, readFileImpl) => {
@@ -12357,7 +12070,6 @@ async function doctorProjectProfile(input = {}) {
 	const cwd = input.cwd ?? process.cwd();
 	const userConfig = resolveDoctorUserConfig(env, input.userConfig);
 	const [hqSpoolCheck, hqRetroReadbackCheck] = await Promise.all([hqSpoolDoctorCheck({
-		cwd,
 		env,
 		repository: {
 			owner: profile.repository.owner,
@@ -12524,7 +12236,7 @@ function repositoryUrlMatches(origin, profile) {
 //#endregion
 //#region src/commands/doctor.ts
 function createDoctorCommand(output) {
-	return new Command("doctor").description("Validate a project profile without mutating GitHub or local files").option("--base <ref>", "base branch or ref for --preflight", "origin/main").option("--cwd <path>", "working directory to validate", ".").option("--json", "print the doctor report as JSON").option("--preflight", "also list the pre-checkable admission requirements for the current candidate (read-only; never blocks); findings-file shape and wave membership have no read-only pre-check").option("--profile <path>", "path to the project profile JSON file").action(async (options) => {
+	return markCwdOptionDefault(new Command("doctor").description("Validate a project profile without mutating GitHub or local files").option("--base <ref>", "base branch or ref for --preflight", "origin/main").option("--cwd <path>", "working directory to validate", collectCwdOption).option("--json", "print the doctor report as JSON").option("--preflight", "also list the pre-checkable admission requirements for the current candidate (read-only; never blocks); findings-file shape and wave membership have no read-only pre-check").option("--profile <path>", "path to the project profile JSON file").action(async (options) => {
 		const report = await doctorProjectProfile({
 			base: options.base,
 			cwd: resolveCwdOption(options.cwd),
@@ -12534,7 +12246,7 @@ function createDoctorCommand(output) {
 		if (options.json) output.stdout.write(`${JSON.stringify(report, null, 2)}\n`);
 		else output.stdout.write(formatHumanReport(report));
 		if (!report.ok) process.exitCode = 1;
-	});
+	}));
 }
 function formatHumanReport(report) {
 	return [
@@ -12942,7 +12654,7 @@ function optionalString(key, flagValue, stdinValue) {
 	return resolved ? { [key]: resolved } : {};
 }
 function createEvidenceEmitCommand(output, action = runEvidenceEmit, readInput = readStdin) {
-	return new Command("evidence:emit").description("Build, validate, and write an external-evidence envelope (ADR 0014)").option("--cwd <path>", "repository working directory", ".").option("--base <ref>", "base branch or ref for the three-way binding", "origin/main").option("--check <name>", "declared requiredChecks name this evidence satisfies").option("--outcome <pass|fail>", "the check outcome").option("--producer <id>", "the producing identity (recorded, not gated)").option("--policy-version <version>", "canonical prompt / Warden rules version").option("--session-id <id>", "producer session id (independence join key)").option("--request-id <id>", "producer request id (join key)").option("--findings-pointer <ref>", "pointer to findings (never embedded)").option("--profile <path>", "path to the project profile JSON file (accepted for a uniform consumer-wrapper flag set and loaded strictly when supplied)").option("--output <path>", "write the envelope to a specific path").option("--stdin", "merge JSON field values from stdin (flags win)").option("--json", "print the written envelope as JSON").action((options) => {
+	return markCwdOptionDefault(new Command("evidence:emit").description("Build, validate, and write an external-evidence envelope (ADR 0014)").option("--cwd <path>", "repository working directory", collectCwdOption).option("--base <ref>", "base branch or ref for the three-way binding", "origin/main").option("--check <name>", "declared requiredChecks name this evidence satisfies").option("--outcome <pass|fail>", "the check outcome").option("--producer <id>", "the producing identity (recorded, not gated)").option("--policy-version <version>", "canonical prompt / Warden rules version").option("--session-id <id>", "producer session id (independence join key)").option("--request-id <id>", "producer request id (join key)").option("--findings-pointer <ref>", "pointer to findings (never embedded)").option("--profile <path>", "path to the project profile JSON file (accepted for a uniform consumer-wrapper flag set and loaded strictly when supplied)").option("--output <path>", "write the envelope to a specific path").option("--stdin", "merge JSON field values from stdin (flags win)").option("--json", "print the written envelope as JSON").action((options) => {
 		const cwd = resolveCwdOption(options.cwd);
 		const fromStdin = options.stdin ? readInput() : {};
 		rejectRetiredStdinFields(fromStdin);
@@ -12969,7 +12681,7 @@ function createEvidenceEmitCommand(output, action = runEvidenceEmit, readInput =
 		});
 		output.stdout.write(`evidence:emit wrote envelope for "${result.envelope.check}" to ${result.path}\n`);
 		if (options.json && "envelope" in result) output.stdout.write(`${JSON.stringify(result.envelope, null, 2)}\n`);
-	});
+	}));
 }
 //#endregion
 //#region src/hq-flush.ts
@@ -13035,7 +12747,6 @@ async function runHqFlush(args, dependencies = {}) {
 	};
 	const explicitDirectories = args.dir && args.dir.length > 0 ? { explicitDirectories: args.dir } : {};
 	const pending = await (dependencies.countSpool ?? countHqSpoolWork)({
-		cwd: args.cwd,
 		...explicitDirectories,
 		repository
 	}, { env });
@@ -13080,7 +12791,6 @@ async function runHqFlush(args, dependencies = {}) {
 		...await (dependencies.flush ?? flushHqSpool)({
 			clientId: resolution.credentials.clientId,
 			clientSecret: resolution.credentials.clientSecret,
-			cwd: args.cwd,
 			endpoint: profile.hq.endpoint,
 			...explicitDirectories,
 			repository
@@ -13107,7 +12817,7 @@ function renderHqFlush(result) {
 		`hq:flush ${result.endpoint}`,
 		...result.spools.length === 0 ? ["no spool directory found"] : result.spools.map((spool) => `spool: ${spool}`),
 		...result.outcomes.map(outcomeLine),
-		`delivered ${result.delivered}, duplicate ${result.duplicate}, rejected ${result.rejected}, undeliverable ${result.undeliverable}, unreachable ${result.unreachable}, migrated ${result.outcomes.filter((outcome) => outcome.status === "migrated").length}`,
+		`delivered ${result.delivered}, duplicate ${result.duplicate}, rejected ${result.rejected}, undeliverable ${result.undeliverable}, unreachable ${result.unreachable}`,
 		...result.undeliverable > 0 ? [`${result.undeliverable} event(s) can never be delivered and were dispositioned in place, renamed with \`.undeliverable\` and left readable; they no longer count as work waiting.`] : [],
 		result.incomplete ? `INCOMPLETE: ${result.remaining} event(s) still spooled; the drain did not finish. Run hq:flush again.` : `spool drained: ${result.remaining} event(s) remain (rejections stay until HQ accepts them)`,
 		...orphanLines(result.orphans)
@@ -13134,7 +12844,7 @@ const hqFlushExitCode = (result) => {
 //#endregion
 //#region src/commands/hq-flush.ts
 function createHqFlushCommand(output, action = runHqFlush) {
-	return new Command("hq:flush").description("Drain this repository's spooled HQ evidence and report every event; exits 1 when transport failed and 2 when the drain did not finish").option("--cwd <path>", "working directory to evaluate", ".").option("--dir <path>", "drain an explicit spool directory instead of the default locations; repeatable", (value, previous = []) => [...previous, value]).option("--json", "print the flush result as JSON").option("--profile <path>", "path to the project profile JSON file").action(async (options) => {
+	return markCwdOptionDefault(new Command("hq:flush").description("Drain this repository's spooled HQ evidence and report every event; exits 1 when transport failed and 2 when the drain did not finish").option("--cwd <path>", "working directory to evaluate", collectCwdOption).option("--dir <path>", "drain an explicit spool directory instead of the default locations; repeatable", (value, previous = []) => [...previous, value]).option("--json", "print the flush result as JSON").option("--profile <path>", "path to the project profile JSON file").action(async (options) => {
 		const result = await action({
 			cwd: resolveCwdOption(options.cwd),
 			...options.dir ? { dir: options.dir } : {},
@@ -13144,7 +12854,7 @@ function createHqFlushCommand(output, action = runHqFlush) {
 		output.stdout.write(options.json ? `${JSON.stringify(result, null, 2)}\n` : renderHqFlush(result));
 		const exitCode = hqFlushExitCode(result);
 		if (exitCode !== 0) process.exitCode = exitCode;
-	});
+	}));
 }
 //#endregion
 //#region src/follow-up.ts
@@ -16007,7 +15717,7 @@ async function deliverSpooledEvidence({ awaitPending, cwd, flush, profilePath })
 //#endregion
 //#region src/commands/pr-publish.ts
 function createPrPublishCommand(_output, action = runPrPublish) {
-	return new Command("pr:publish").description("Compose supplied proof into a ready-for-human handoff; never launches review").option("--pr <number>", "pull request number", positiveInteger("--pr")).option("--base <ref>", "explicit base branch or ref override").option("--authoring-session <id>", "known authoring session identity for verification retries").option("--cwd <path>", "working directory to evaluate", ".").option("--epic <number>", "epic issue containing the factory-boundary manifest; the composed readiness evaluation then applies the wave-demanded review rung (#351)", positiveInteger("--epic")).option("--findings <path>", "clean-session findings to validate when no current review proof is available").option("--json", "print the publish result as JSON").option("--output <path>", "write readiness proof JSON to a file").option("--profile <path>", "path to the project profile JSON file").option("--review-proof <path>", "pr:review proof JSON path").option("--verify-proof <path>", "pr:verify proof JSON path").action(async (options) => {
+	return markCwdOptionDefault(new Command("pr:publish").description("Compose supplied proof into a ready-for-human handoff; never launches review").option("--pr <number>", "pull request number", positiveInteger("--pr")).option("--base <ref>", "explicit base branch or ref override").option("--authoring-session <id>", "known authoring session identity for verification retries").option("--cwd <path>", "working directory to evaluate", collectCwdOption).option("--epic <number>", "epic issue containing the factory-boundary manifest; the composed readiness evaluation then applies the wave-demanded review rung (#351)", positiveInteger("--epic")).option("--findings <path>", "clean-session findings to validate when no current review proof is available").option("--json", "print the publish result as JSON").option("--output <path>", "write readiness proof JSON to a file").option("--profile <path>", "path to the project profile JSON file").option("--review-proof <path>", "pr:review proof JSON path").option("--verify-proof <path>", "pr:verify proof JSON path").action(async (options) => {
 		await action({
 			authoringSessionIds: options.authoringSession ? [options.authoringSession] : void 0,
 			base: options.base ?? "",
@@ -16021,12 +15731,12 @@ function createPrPublishCommand(_output, action = runPrPublish) {
 			reviewProof: options.reviewProof,
 			verifyProof: options.verifyProof
 		});
-	});
+	}));
 }
 //#endregion
 //#region src/commands/pr-ready.ts
 function createPrReadyCommand(output, action) {
-	return new Command("pr:ready").description("Evaluate typed proof and GitHub state for final readiness").requiredOption("--pr <number>", "pull request number", positiveInteger("--pr")).option("--base <ref>", "explicit base branch or ref override").option("--authoring-session <id...>", "recorded authoring session id(s) for review-type requiredCheck independence (ADR 0014 §5)").option("--cwd <path>", "working directory to evaluate", ".").option("--epic <number>", "epic issue containing the factory-boundary manifest; readiness then evaluates the wave-demanded review rung (#351)", positiveInteger("--epic")).option("--json", "print the readiness proof as JSON").option("--output <path>", "write proof JSON to a file").option("--profile <path>", "path to the project profile JSON file").option("--review-proof <path>", "pr:review proof JSON path").option("--verify-proof <path>", "pr:verify proof JSON path").action(withGateTiming({
+	return markCwdOptionDefault(new Command("pr:ready").description("Evaluate typed proof and GitHub state for final readiness").requiredOption("--pr <number>", "pull request number", positiveInteger("--pr")).option("--base <ref>", "explicit base branch or ref override").option("--authoring-session <id...>", "recorded authoring session id(s) for review-type requiredCheck independence (ADR 0014 §5)").option("--cwd <path>", "working directory to evaluate", collectCwdOption).option("--epic <number>", "epic issue containing the factory-boundary manifest; readiness then evaluates the wave-demanded review rung (#351)", positiveInteger("--epic")).option("--json", "print the readiness proof as JSON").option("--output <path>", "write proof JSON to a file").option("--profile <path>", "path to the project profile JSON file").option("--review-proof <path>", "pr:review proof JSON path").option("--verify-proof <path>", "pr:verify proof JSON path").action(withGateTiming({
 		gate: "pr:ready",
 		resolveLedgerRoot: (options) => resolveCwdOption(options.cwd),
 		stderr: output.stderr
@@ -16044,7 +15754,7 @@ function createPrReadyCommand(output, action) {
 			verifyProof: options.verifyProof
 		};
 		await (action ? action(args) : runPrReady(args));
-	}));
+	})));
 }
 //#endregion
 //#region src/gate-foreground-guard.ts
@@ -16073,7 +15783,7 @@ function assertForegroundGate({ gate, env = process.env }) {
 //#endregion
 //#region src/commands/pr-review.ts
 function createPrReviewCommand(output, action) {
-	return new Command("pr:review").description("Validate clean-session findings and write typed review proof").option("--base <ref>", "base branch or ref", "origin/main").option("--cwd <path>", "working directory to review", ".").option("--cycle <number>", "review cycle number", positiveInteger("--cycle"), 1).option("--mode <mode>", "correctness, security, or all", "all").option("--findings <path>", "typed clean-session findings JSON file").option("--dispositions <path>", "JSON file of ladder disposition declarations (waived / follow-up-filed / fixed-in-thread) for previously flagged findings").option("--issue <number>", "issue number recorded on the review ladder trace", positiveInteger("--issue")).option("--output <path>", "write proof JSON to a file").option("--profile <path>", "path to the project profile JSON file").option("--verify-proof <path>", "pr:verify proof JSON path").action(withGateTiming({
+	return markCwdOptionDefault(new Command("pr:review").description("Validate clean-session findings and write typed review proof").option("--base <ref>", "base branch or ref", "origin/main").option("--cwd <path>", "working directory to review", collectCwdOption).option("--cycle <number>", "review cycle number", positiveInteger("--cycle"), 1).option("--mode <mode>", "correctness, security, or all", "all").option("--findings <path>", "typed clean-session findings JSON file").option("--dispositions <path>", "JSON file of ladder disposition declarations (waived / follow-up-filed / fixed-in-thread) for previously flagged findings").option("--issue <number>", "issue number recorded on the review ladder trace", positiveInteger("--issue")).option("--output <path>", "write proof JSON to a file").option("--profile <path>", "path to the project profile JSON file").option("--verify-proof <path>", "pr:verify proof JSON path").action(withGateTiming({
 		gate: "pr:review",
 		resolveCycle: (options) => options.cycle,
 		resolveLedgerRoot: (options) => resolveCwdOption(options.cwd),
@@ -16098,12 +15808,12 @@ function createPrReviewCommand(output, action) {
 			verifyProof: options.verifyProof
 		};
 		await (action ? action(args) : runPrReview(args, { publishCheckRun: createFactoryCheckPublisher(output) }));
-	}));
+	})));
 }
 //#endregion
 //#region src/commands/pr-verify.ts
 function createPrVerifyCommand(output, action = runPrVerify) {
-	return new Command("pr:verify").description("Run project-profile verification commands and write typed proof").option("--base <ref>", "base branch or ref", "origin/main").option("--cwd <path>", "working directory to verify", ".").option("--docs-only", "run the docs/process verification gate").option("--trivial", "run the trivial verification gate").option("--full", "run the full verification gate").option("--authoring-session <id>", "explicit authoring session identity (required for review evidence)").option("--json", "print the proof as JSON after verification").option("--output <path>", "write proof JSON to a file").option("--profile <path>", "path to the project profile JSON file").option("--no-status", "skip posting the patronage-factory/pr-verify commit status").action(withGateTiming({
+	return markCwdOptionDefault(new Command("pr:verify").description("Run project-profile verification commands and write typed proof").option("--base <ref>", "base branch or ref", "origin/main").option("--cwd <path>", "working directory to verify", collectCwdOption).option("--docs-only", "run the docs/process verification gate").option("--trivial", "run the trivial verification gate").option("--full", "run the full verification gate").option("--authoring-session <id>", "explicit authoring session identity (required for review evidence)").option("--json", "print the proof as JSON after verification").option("--output <path>", "write proof JSON to a file").option("--profile <path>", "path to the project profile JSON file").option("--no-status", "skip posting the patronage-factory/pr-verify commit status").action(withGateTiming({
 		gate: "pr:verify",
 		resolveLedgerRoot: (options) => resolveCwdOption(options.cwd),
 		stderr: output.stderr
@@ -16125,7 +15835,7 @@ function createPrVerifyCommand(output, action = runPrVerify) {
 			requireKnownAuthoringSession: true
 		}, dependencies);
 		if (options.json) output.stdout.write(`${JSON.stringify(proof, null, 2)}\n`);
-	}));
+	})));
 }
 function modeFor(options) {
 	if (options.docsOnly) return "docs-only";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@patronage/software-factory",
-  "version": "1.0.0-alpha.5",
+  "version": "1.0.0-alpha.7",
   "description": "Shared Patronage software factory CLI and project-profile validation tools",
   "license": "MIT",
   "repository": {
@@ -37,7 +37,7 @@
     "picomatch": "^4.0.5",
     "yaml": "^2.9.0",
     "zod": "4.4.3",
-    "@patronage/factory-ci": "1.0.0-alpha.5"
+    "@patronage/factory-ci": "1.0.0-alpha.7"
   },
   "devDependencies": {
     "@types/node": "24.13.3",
@@ -77,6 +77,8 @@
     "profile:schema": "tsx scripts/generate-profile-schema.ts",
     "pretest": "bash ../scripts/ensure-worktree-bootstrap.sh",
     "test": "vitest run",
+    "pretest:profile": "bash ../scripts/ensure-worktree-bootstrap.sh",
+    "test:profile": "tsx scripts/vitest-profile.ts",
     "pretest:stress": "bash ../scripts/ensure-worktree-bootstrap.sh",
     "test:stress": "node scripts/stress-tests.mjs",
     "pretypecheck": "bash ../scripts/ensure-worktree-bootstrap.sh",