@patronage/software-factory 1.0.0-alpha.7 → 1.0.0-alpha.9

package/dist/index.js

@@ -8,16 +8,16 @@ import crypto, { createHash, randomUUID } from "node:crypto";
 import { z } from "zod";
 import { execFileSync, spawnSync } from "node:child_process";
 import { link, lstat, mkdir, open, readFile, readdir, realpath, rename, stat, unlink } from "node:fs/promises";
-import os, { homedir } from "node:os";
+import os, { homedir, tmpdir } from "node:os";
 import { setImmediate } from "node:timers";
 import { setImmediate as setImmediate$1, setTimeout as setTimeout$1 } from "node:timers/promises";
 import { Worker } from "node:worker_threads";
 import picomatch from "picomatch";
 import { parse } from "yaml";
 import { promisify } from "node:util";
-import { GitHubApiError, mintInstallationToken } from "@patronage/factory-ci";
+import { FACTORY_PROOF_GATE_STEP_NAME, GitHubApiError, mintInstallationToken, productionImpactTargetOutput, readVitestProfileDocument } from "@patronage/factory-ci";
 //#region package.json
-var version = "1.0.0-alpha.7";
+var version = "1.0.0-alpha.9";
 //#endregion
 //#region src/review-rungs.ts
 const EVIDENCE_REVIEW_RUNGS$1 = [
@@ -981,7 +981,7 @@ const requiredCheckSchema = z.object({
 const impactTargetSchema = z.object({
 	importers: z.array(z.string().min(1)).min(1),
 	name: z.string().min(1),
-	paths: z.array(repoRelativeGlobSchema).min(1).optional()
+	paths: z.array(repoRelativeGlobSchema).min(1).optional().describe("Opt-in repo-relative path subscriptions. A target is affected only when a valid changed path matches one of its globs; valid unmatched paths affect no target and are recorded as unsubscribed. Shared files must be listed by every subscribing target.")
 }).strict();
 const impactConfigSchema = z.object({ targets: z.array(impactTargetSchema).min(1).superRefine((targets, context) => {
 	const names = targets.map((target) => target.name);
@@ -1082,7 +1082,7 @@ const factoryProjectProfileSchema = z.object({
 		mappedChecks.add(command.requiredCheck);
 	}
 }).meta({ description: PROFILE_JSON_SCHEMA_DESCRIPTION });
-const isRecord$1 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const isRecord$2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 const stringList = (value) => Array.isArray(value) ? value.filter((entry) => typeof entry === "string") : [];
 const quoteList = (values) => JSON.stringify(values);
 const namesExistingFile = (root, entry) => {
@@ -1131,13 +1131,13 @@ const migratedPolicyLines = (policy, root) => {
 */
 function v2MigrationLines(input, root) {
 	const lines = [];
-	const proof = isRecord$1(input.proof) ? input.proof : void 0;
-	if (proof && isRecord$1(proof.classificationPolicy)) lines.push(...migratedPolicyLines(proof.classificationPolicy, root));
-	const commands = isRecord$1(input.verification) ? input.verification.commands : void 0;
+	const proof = isRecord$2(input.proof) ? input.proof : void 0;
+	if (proof && isRecord$2(proof.classificationPolicy)) lines.push(...migratedPolicyLines(proof.classificationPolicy, root));
+	const commands = isRecord$2(input.verification) ? input.verification.commands : void 0;
 	if (Array.isArray(commands)) {
-		for (const [index, command] of commands.entries()) if (isRecord$1(command) && command.scope === "always") lines.push(`verification.commands[${index}].scope "always" -> "docs-only"`);
+		for (const [index, command] of commands.entries()) if (isRecord$2(command) && command.scope === "always") lines.push(`verification.commands[${index}].scope "always" -> "docs-only"`);
 	}
-	if (isRecord$1(input.hq) && typeof input.hq.endpoint === "string") try {
+	if (isRecord$2(input.hq) && typeof input.hq.endpoint === "string") try {
 		const url = new URL(input.hq.endpoint);
 		if (url.href !== `${url.origin}/` && url.href !== url.origin) lines.push(`hq.endpoint ${JSON.stringify(input.hq.endpoint)} -> ${JSON.stringify(url.origin)}`);
 	} catch {}
@@ -1149,25 +1149,25 @@ function hasCorrectnessOnlyReview(review) {
 }
 const v4MigrationLines = (input) => {
 	const lines = [];
-	if (isRecord$1(input.project) && "key" in input.project) lines.push("project.key -> removed; current proof writers derive projectKey from repository.name");
-	if (isRecord$1(input.repository) && "defaultBranch" in input.repository) lines.push("repository.defaultBranch -> removed; commands resolve the live base from Git/GitHub or an explicit --base");
-	if (isRecord$1(input.env) && "required" in input.env) lines.push("env.required -> removed; the command that needs an environment value owns its fail-closed diagnostic");
-	if (isRecord$1(input.review)) {
+	if (isRecord$2(input.project) && "key" in input.project) lines.push("project.key -> removed; current proof writers derive projectKey from repository.name");
+	if (isRecord$2(input.repository) && "defaultBranch" in input.repository) lines.push("repository.defaultBranch -> removed; commands resolve the live base from Git/GitHub or an explicit --base");
+	if (isRecord$2(input.env) && "required" in input.env) lines.push("env.required -> removed; the command that needs an environment value owns its fail-closed diagnostic");
+	if (isRecord$2(input.review)) {
 		const isCorrectnessOnlyReview = hasCorrectnessOnlyReview(input.review);
 		if ("defaultMaxCycles" in input.review) lines.push("review.defaultMaxCycles -> removed; the factory review cap is 5");
 		if ("modes" in input.review) lines.push("review.modes -> removed; correctness is always required");
 		if (isCorrectnessOnlyReview) lines.push("review -> removed; a correctness-only review has no v5 configuration, so delete the object");
 		if (Array.isArray(input.review.conditional)) {
-			for (const [index, conditional] of input.review.conditional.entries()) if (isRecord$1(conditional) && "modes" in conditional) lines.push(`review.conditional[${index}].modes -> removed; each retained conditional path list demands security review`);
+			for (const [index, conditional] of input.review.conditional.entries()) if (isRecord$2(conditional) && "modes" in conditional) lines.push(`review.conditional[${index}].modes -> removed; each retained conditional path list demands security review`);
 		}
 	}
 	if (Array.isArray(input.requiredChecks)) {
-		for (const [index, check] of input.requiredChecks.entries()) if (isRecord$1(check) && "checkType" in check) lines.push(`requiredChecks[${index}].checkType -> removed; external required checks are verify-type`);
+		for (const [index, check] of input.requiredChecks.entries()) if (isRecord$2(check) && "checkType" in check) lines.push(`requiredChecks[${index}].checkType -> removed; external required checks are verify-type`);
 	}
 	return lines;
 };
 function legacyProfileMigration(input, root) {
-	if (!(isRecord$1(input) && typeof input.schemaVersion === "number" && LEGACY_PROFILE_SCHEMA_VERSIONS.includes(input.schemaVersion))) return;
+	if (!(isRecord$2(input) && typeof input.schemaVersion === "number" && LEGACY_PROFILE_SCHEMA_VERSIONS.includes(input.schemaVersion))) return;
 	const foundVersion = input.schemaVersion;
 	const lines = [`schemaVersion ${foundVersion} -> 5`];
 	if (foundVersion === 2) lines.push(...v2MigrationLines(input, root));
@@ -3553,15 +3553,18 @@ const impactStampTargetSchema = z.object({
 const impactStampSchema = z.object({
 	basis: z.enum(["target-scoped", "conservative"]),
 	reasons: z.array(z.string()),
-	stampVersion: z.literal(2),
+	stampVersion: z.literal(3),
 	targets: z.array(impactStampTargetSchema).superRefine((targets, context) => {
 		const names = targets.map((target) => target.name);
 		if (new Set(names).size !== names.length) context.addIssue({
 			code: "custom",
 			message: "impact stamp targets must have distinct names."
 		});
-	})
+	}),
+	unsubscribedPaths: z.array(z.string())
 });
+/** Human-readable lines for every impact decision, including quiet releases. */
+const impactStampSummaryLines = (stamp) => [`Impact stamp: ${stamp.basis}; ${stamp.targets.filter(({ impact }) => impact === "affected").length}/${stamp.targets.length} target(s) affected.`, stamp.unsubscribedPaths.length === 0 ? "Unsubscribed changed paths: none." : `Unsubscribed changed paths (demand no target): ${stamp.unsubscribedPaths.join(", ")}`];
 /**
 * A configuration contradiction between the profile's impact declarations and
 * the repository's actual lockfile — e.g. a declared importer root that
@@ -3611,8 +3614,8 @@ const impactStampScopeDecision = ({ stamp, surface, targetName }) => {
 		reason: `no trusted identity-bound impact stamp covers this candidate; ${floor}`,
 		scoped: false
 	};
-	if (stamp.stampVersion !== 2) return {
-		reason: `impact stamp version ${String(stamp.stampVersion)} is not this build's version 2; ${floor}`,
+	if (stamp.stampVersion !== 3) return {
+		reason: `impact stamp version ${String(stamp.stampVersion)} is not this build's version 3; ${floor}`,
 		scoped: false
 	};
 	if (stamp.basis !== "target-scoped") return {
@@ -3654,15 +3657,16 @@ const impactStampDemandRelease = ({ checkName, stamp }) => {
 * every doubt path lands on, and the stamp a producer must fall back to if
 * stamp computation itself fails for any reason.
 */
-const conservativeImpactStamp = (targets, reasons) => ({
+const conservativeImpactStamp = (targets, reasons, unsubscribedPaths = []) => ({
 	basis: "conservative",
 	reasons,
-	stampVersion: 2,
+	stampVersion: 3,
 	targets: targets.map((target) => ({
 		basis: CONSERVATIVE_TARGET_BASIS,
 		impact: "affected",
 		name: target.name
-	}))
+	})),
+	unsubscribedPaths
 });
 const conservativeStamp = conservativeImpactStamp;
 const DEPENDENCY_FIELDS = [
@@ -3690,17 +3694,17 @@ const pnpmLockfileSchema = z.looseObject({
 	packages: z.record(z.string(), z.unknown()).optional(),
 	snapshots: z.record(z.string(), snapshotSectionSchema).optional()
 });
-const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const isRecord$1 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 const canonical = (value) => {
 	if (Array.isArray(value)) return value.map(canonical);
-	if (isRecord(value)) return Object.fromEntries(Object.keys(value).toSorted().map((key) => [key, canonical(value[key])]));
+	if (isRecord$1(value)) return Object.fromEntries(Object.keys(value).toSorted().map((key) => [key, canonical(value[key])]));
 	return value;
 };
 const stableStringify$1 = (value) => JSON.stringify(canonical(value));
 const parseLockfile = (content) => {
 	try {
 		const parsed = parse(content);
-		if (!isRecord(parsed)) return;
+		if (!isRecord$1(parsed)) return;
 		const validated = pnpmLockfileSchema.safeParse(parsed);
 		return validated.success ? validated.data : void 0;
 	} catch {
@@ -3793,9 +3797,10 @@ const targetImpactForLockfileDelta = (target, delta) => {
 /**
 * Compute the impact stamp for one candidate: every declared target recorded
 * as affected/not-affected with its exact basis. `not-affected` is only ever
-* returned only when every changed input is owned by a declared source glob or
-* is an analyzable pnpm-lock.yaml (v9) delta. Source and lockfile reachability
-* are unioned per target. Any invalid, unmatched, unreadable, unsupported, or
+* returned only when every changed input is a valid source path or an
+* analyzable pnpm-lock.yaml (v9) delta. Source and lockfile reachability are
+* unioned per target. A valid source path matched by no target is recorded in
+* `unsubscribedPaths` and affects none. Invalid, unreadable, unsupported, or
 * otherwise doubtful input widens the whole stamp to full impact.
 *
 * Total by contract: this function never throws. Any unexpected failure in
@@ -3872,10 +3877,6 @@ const analyzeSourcePaths = (sourceFiles, targets, profilePath) => {
 			kind: "conservative",
 			reason: `changed source path "${file}" is the impact profile being evaluated; fail closed to full impact`
 		};
-		if (!targets.some((target) => matchesAnyGlob(target.paths ?? [], file))) return {
-			kind: "conservative",
-			reason: `changed source path "${file}" has no declared impact target owner; fail closed to full impact`
-		};
 	}
 	return {
 		kind: "ok",
@@ -3890,7 +3891,8 @@ const analyzeSourcePaths = (sourceFiles, targets, profilePath) => {
 				impact: "affected",
 				name: target.name
 			};
-		})
+		}),
+		unsubscribedPaths: sourceFiles.filter((file) => !targets.some((target) => matchesAnyGlob(target.paths ?? [], file)))
 	};
 };
 const unionTargetImpact = (source, lockfile) => {
@@ -3906,8 +3908,9 @@ const computeImpactStampOrThrow = ({ changedFiles, profilePath = "software-facto
 	if (targets.length === 0) return {
 		basis: "conservative",
 		reasons: ["no impact targets declared in the profile; every surface keeps full demand"],
-		stampVersion: 2,
-		targets: []
+		stampVersion: 3,
+		targets: [],
+		unsubscribedPaths: changedFiles.filter((file) => file !== "pnpm-lock.yaml" && isRepoRelativePath(file))
 	};
 	assertDeclaredPathGlobs(targets);
 	const sides = readLockfileSides(readLockfile);
@@ -3916,18 +3919,19 @@ const computeImpactStampOrThrow = ({ changedFiles, profilePath = "software-facto
 	const sourceFiles = changedFiles.filter((file) => file !== LOCKFILE_PATH);
 	const source = analyzeSourcePaths(sourceFiles, targets, profilePath);
 	if (source.kind === "conservative") return conservativeStamp(targets, [source.reason]);
-	if (sides.kind === "threw") throw sides.error;
-	if (sides.kind === "unreadable") return conservativeStamp(targets, [`pnpm-lock.yaml is unreadable at the ${sides.side} side; fail closed to full impact`]);
-	if (sides.kind === "unparseable") return conservativeStamp(targets, [`pnpm-lock.yaml is unparseable or structurally malformed at the ${sides.side} side; fail closed to full impact`]);
-	if (sides.kind === "unsupported-version") return conservativeStamp(targets, [`pnpm-lock.yaml is not lockfileVersion ${SUPPORTED_LOCKFILE_VERSION}; only pnpm v9 lockfiles are modelled; fail closed to full impact`]);
+	if (sides.kind === "threw") return conservativeStamp(targets, [`impact stamp computation failed (${sides.error instanceof Error ? sides.error.message : String(sides.error)}); fail closed to full impact`], source.unsubscribedPaths);
+	if (sides.kind === "unreadable") return conservativeStamp(targets, [`pnpm-lock.yaml is unreadable at the ${sides.side} side; fail closed to full impact`], source.unsubscribedPaths);
+	if (sides.kind === "unparseable") return conservativeStamp(targets, [`pnpm-lock.yaml is unparseable or structurally malformed at the ${sides.side} side; fail closed to full impact`], source.unsubscribedPaths);
+	if (sides.kind === "unsupported-version") return conservativeStamp(targets, [`pnpm-lock.yaml is not lockfileVersion ${SUPPORTED_LOCKFILE_VERSION}; only pnpm v9 lockfiles are modelled; fail closed to full impact`], source.unsubscribedPaths);
 	if (!changedFiles.includes("pnpm-lock.yaml")) return {
 		basis: "target-scoped",
-		reasons: ["all changed source paths have declared target ownership; impact scoped by repo-relative path globs"],
-		stampVersion: 2,
-		targets: source.targets
+		reasons: [source.unsubscribedPaths.length === 0 ? "all changed source paths match at least one declared target subscription; impact scoped by repo-relative path globs" : `${source.unsubscribedPaths.length} changed source path(s) match no declared target subscription and affect no target`],
+		stampVersion: 3,
+		targets: source.targets,
+		unsubscribedPaths: source.unsubscribedPaths
 	};
 	const [baseLock, headLock] = sides.parsed;
-	if (stableStringify$1(nonGraphSections(baseLock)) !== stableStringify$1(nonGraphSections(headLock))) return conservativeStamp(targets, ["pnpm-lock.yaml delta touches sections outside importers/packages/snapshots (e.g. settings, overrides, patchedDependencies); fail closed to full impact"]);
+	if (stableStringify$1(nonGraphSections(baseLock)) !== stableStringify$1(nonGraphSections(headLock))) return conservativeStamp(targets, ["pnpm-lock.yaml delta touches sections outside importers/packages/snapshots (e.g. settings, overrides, patchedDependencies); fail closed to full impact"], source.unsubscribedPaths);
 	const delta = {
 		changedImporters: changedSectionKeys(baseLock.importers, headLock.importers),
 		changedPackages: changedSectionKeys(baseLock.packages, headLock.packages),
@@ -3938,9 +3942,10 @@ const computeImpactStampOrThrow = ({ changedFiles, profilePath = "software-facto
 	const mixed = sourceFiles.length > 0;
 	return {
 		basis: "target-scoped",
-		reasons: mixed ? ["all changed source paths have declared target ownership and pnpm-lock.yaml is analyzable; impact is the union of path ownership and importer/snapshot graph analysis"] : ["pnpm-lock.yaml is the only changed file; impact scoped by importer/snapshot graph analysis"],
-		stampVersion: 2,
-		targets: mixed ? source.targets.map((sourceTarget, index) => unionTargetImpact(sourceTarget, lockfileTargets[index])) : lockfileTargets
+		reasons: mixed ? [source.unsubscribedPaths.length === 0 ? "all changed source paths match at least one declared target subscription and pnpm-lock.yaml is analyzable; impact is the union of path subscriptions and importer/snapshot graph analysis" : `${source.unsubscribedPaths.length} changed source path(s) match no declared target subscription; subscribed path impact is unioned with importer/snapshot graph analysis`] : ["pnpm-lock.yaml is the only changed file; impact scoped by importer/snapshot graph analysis"],
+		stampVersion: 3,
+		targets: mixed ? source.targets.map((sourceTarget, index) => unionTargetImpact(sourceTarget, lockfileTargets[index])) : lockfileTargets,
+		unsubscribedPaths: source.unsubscribedPaths
 	};
 };
 //#endregion
@@ -5543,17 +5548,21 @@ const asClassification = (value) => DIFF_CLASSIFICATIONS$1.includes(value) ? val
 const prVerifyCheckPayloadFor = (proof) => {
 	const value = proof;
 	if (!value || typeof value.headSha !== "string" || value.headSha.length === 0 || !isResolvedPrVerifyMode(value.mode)) return;
+	const carriesReleases = value.notRequiredCommands !== void 0;
 	return {
 		classification: asClassification(value.classification),
 		executedCommands: (value.executedCommands ?? []).map(({ name }) => name).filter((name) => typeof name === "string"),
 		headSha: value.headSha,
+		...carriesReleases && value.impactStamp !== void 0 ? { impactStamp: value.impactStamp } : {},
 		kind: PR_VERIFY_CHECK_PAYLOAD_KIND,
 		mode: value.mode,
+		...carriesReleases ? { notRequiredCommands: value.notRequiredCommands } : {},
 		outcome: outcomeFor(value),
 		proofSchemaVersion: typeof value.schemaVersion === "number" ? value.schemaVersion : 0,
 		schemaVersion: PR_VERIFY_CHECK_PAYLOAD_SCHEMA_VERSION,
 		...typeof value.patchId === "string" ? { patchId: value.patchId } : {},
-		...typeof value.repository === "string" ? { repository: value.repository } : {}
+		...typeof value.repository === "string" ? { repository: value.repository } : {},
+		...carriesReleases && value.verificationCommands !== void 0 ? { verificationCommands: value.verificationCommands } : {}
 	};
 };
 const renderPrVerifyCheckPayloadText = (payload) => `\`\`\`json\n${JSON.stringify(payload, null, 2)}\n\`\`\``;
@@ -7442,9 +7451,15 @@ const installationToken = (repository, config, request, now, timeoutMs = GITHUB_
 function verifyOutput(proof) {
 	const value = proof;
 	const commands = value.executedCommands?.length ?? 0;
+	const unsubscribedBasis = value.impactStamp?.unsubscribedPaths;
+	let unsubscribedSummary;
+	if (Array.isArray(unsubscribedBasis)) {
+		const unsubscribed = unsubscribedBasis.filter((path) => typeof path === "string");
+		unsubscribedSummary = unsubscribed.length === 0 ? "Unsubscribed changed paths: none." : `Unsubscribed changed paths (demand no target): ${unsubscribed.join(", ")}.`;
+	} else unsubscribedSummary = "Unsubscribed changed paths: unavailable (legacy or malformed stamp).";
 	const payload = prVerifyCheckPayloadFor(proof);
 	return {
-		summary: `Schema v${value.schemaVersion}; mode **${value.mode ?? "unknown"}**; classification **${value.classification ?? "unknown"}**; outcome **${value.outcome ?? "unknown"}**; ${commands} command(s) executed.`,
+		summary: `Schema v${value.schemaVersion}; mode **${value.mode ?? "unknown"}**; classification **${value.classification ?? "unknown"}**; outcome **${value.outcome ?? "unknown"}**; ${commands} command(s) executed. ${unsubscribedSummary}`,
 		...payload ? { text: renderPrVerifyCheckPayloadText(payload) } : {},
 		title: `pr:verify ${value.outcome ?? "unknown"}`
 	};
@@ -7458,8 +7473,10 @@ function reviewOutput(proof) {
 	for (const { disposition } of value.ladder ? ladderLedgerFor(value.ladder) : []) dispositionCounts[disposition] = (dispositionCounts[disposition] ?? 0) + 1;
 	if (!value.ladder && findings > 0) dispositionCounts.open = findings;
 	const dispositions = Object.entries(dispositionCounts).map(([name, count]) => `${name} ${count}`).join(", ");
+	const unavailable = "unavailable (legacy proof)";
+	const provenance = reviews.length === 0 ? "not required" : reviews.map(({ kind, model, producer, rung }) => `${kind ?? "unknown mode"}: rung ${rung ?? unavailable}; producer ${producer ?? unavailable}; model ${model ?? unavailable}`).join(" | ");
 	return {
-		summary: `Schema v${value.schemaVersion}; modes **${modes}**; ${findings} finding(s) recorded; dispositions: ${dispositions || "none"}.`,
+		summary: `Schema v${value.schemaVersion}; modes **${modes}**; ${findings} finding(s) recorded; dispositions: ${dispositions || "none"}. Review provenance: ${provenance}.`,
 		title: findings === 0 ? "pr:review clean" : "pr:review proof recorded"
 	};
 }
@@ -8634,6 +8651,709 @@ function createBoundaryCheckCommand(output, action) {
 		if (record.status !== "ready") throw new Error(`boundary:check refused: ${record.blockingReasons.join("; ")}`);
 	})));
 }
+/** `tool` discriminator every emitted report carries. */
+const CI_ANALYZE_TOOL = "psf-ci-analyze";
+/** Cohort label for runs the caller did not assign to a cohort. */
+const UNGROUPED_COHORT = "ungrouped";
+const available = (value) => ({
+	available: true,
+	value
+});
+const unavailable = (reason) => ({
+	available: false,
+	reason
+});
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const stringField$1 = (source, key, where) => {
+	const value = source[key];
+	return typeof value === "string" && value.length > 0 ? available(value) : unavailable(`${where} has no ${key}`);
+};
+const numberField = (source, key, where) => {
+	const value = source[key];
+	return typeof value === "number" && Number.isFinite(value) ? available(value) : unavailable(`${where} has no ${key}`);
+};
+/**
+* An instant is only usable when it names its own timezone. `Date.parse`
+* interprets an offset-less `2026-08-06T12:00:00` in the *host's* zone, which
+* would make a duration depend on where the analyzer ran. The GitHub API
+* always sends `Z`-form, so requiring an explicit `Z` or numeric offset
+* rejects nothing genuine — anything else becomes explicitly unavailable.
+*/
+const EXPLICIT_OFFSET_PATTERN = /(?:Z|[+-]\d{2}:?\d{2})$/u;
+const parseInstantMs = (value) => {
+	if (!value.available) return;
+	if (!EXPLICIT_OFFSET_PATTERN.test(value.value)) return;
+	const parsed = Date.parse(value.value);
+	return Number.isNaN(parsed) ? void 0 : parsed;
+};
+/**
+* Wall clock between two ISO instants. Unavailable — with the missing side
+* named — whenever either instant is absent or unparsable; a negative span is
+* refused rather than clamped to a fake zero.
+*/
+const durationBetween = (start, end, label) => {
+	const startMs = parseInstantMs(start);
+	if (startMs === void 0) return unavailable(`${label}: start instant is ${start.available ? "unparsable" : `unavailable (${start.reason})`}`);
+	const endMs = parseInstantMs(end);
+	if (endMs === void 0) return unavailable(`${label}: end instant is ${end.available ? "unparsable" : `unavailable (${end.reason})`}`);
+	if (endMs < startMs) return unavailable(`${label}: end instant precedes start instant`);
+	return available(endMs - startMs);
+};
+const GITHUB_SETUP_STEP_NAME = "Set up job";
+const INSTALL_STEP_PATTERN = /install/iu;
+const analyzeStep = (step) => {
+	const startedAt = stringField$1(step, "started_at", "step");
+	const completedAt = stringField$1(step, "completed_at", "step");
+	return {
+		completedAt,
+		conclusion: stringField$1(step, "conclusion", "step"),
+		durationMs: durationBetween(startedAt, completedAt, "step duration"),
+		name: typeof step.name === "string" ? step.name : "(unnamed step)",
+		number: numberField(step, "number", "step"),
+		startedAt
+	};
+};
+const namedStepDuration = (steps, matches, description) => {
+	const step = steps.find((candidate) => matches(candidate.name));
+	return step === void 0 ? unavailable(`no ${description} step in this job`) : step.durationMs;
+};
+const analyzeJob = (job) => {
+	const steps = Array.isArray(job.steps) ? job.steps.filter(isRecord).map(analyzeStep) : [];
+	const createdAt = stringField$1(job, "created_at", "job");
+	const startedAt = stringField$1(job, "started_at", "job");
+	const completedAt = stringField$1(job, "completed_at", "job");
+	const labels = Array.isArray(job.labels) ? job.labels.filter((label) => typeof label === "string") : void 0;
+	return {
+		completedAt,
+		conclusion: stringField$1(job, "conclusion", "job"),
+		createdAt,
+		installMs: namedStepDuration(steps, (name) => INSTALL_STEP_PATTERN.test(name), "install"),
+		jobId: numberField(job, "id", "job"),
+		name: typeof job.name === "string" ? job.name : "(unnamed job)",
+		queueMs: durationBetween(createdAt, startedAt, "job queue"),
+		runnerLabels: labels === void 0 ? unavailable("job has no labels array") : available(labels),
+		setupMs: namedStepDuration(steps, (name) => name === GITHUB_SETUP_STEP_NAME, `"${GITHUB_SETUP_STEP_NAME}"`),
+		startedAt,
+		steps,
+		totalMs: durationBetween(startedAt, completedAt, "job duration"),
+		url: stringField$1(job, "html_url", "job")
+	};
+};
+/**
+* Classify proof reuse from step conclusions alone. A job whose gate step is
+* followed by at least one skipped step reused proof; a job whose post-gate
+* steps all executed ran the full fallback. No gate step anywhere means the
+* workflow does not expose the outcome, which is unavailable — not
+* full-fallback.
+*/
+const classifyProofReuse = (jobs) => {
+	const gateJobs = [];
+	const verdicts = /* @__PURE__ */ new Set();
+	for (const job of jobs) {
+		const gateIndex = job.steps.findIndex((step) => step.name === FACTORY_PROOF_GATE_STEP_NAME);
+		if (gateIndex === -1) continue;
+		const skippedStepsAfterGate = job.steps.slice(gateIndex + 1).filter((step) => step.conclusion.available && step.conclusion.value === "skipped").length;
+		verdicts.add(skippedStepsAfterGate > 0 ? "proof-reuse" : "full-fallback");
+		gateJobs.push({
+			gateConclusion: job.steps[gateIndex]?.conclusion ?? unavailable("gate step vanished"),
+			jobName: job.name,
+			skippedStepsAfterGate
+		});
+	}
+	if (gateJobs.length === 0) return unavailable(`no "${FACTORY_PROOF_GATE_STEP_NAME}" step in any job; this workflow does not expose a proof-reuse outcome`);
+	const [single] = [...verdicts];
+	return available({
+		classification: verdicts.size === 1 && single ? single : "mixed",
+		gateJobs
+	});
+};
+const parseArtifactListing = (value) => {
+	if (!isRecord(value) || !Array.isArray(value.artifacts)) return {
+		artifacts: [],
+		totalCount: void 0
+	};
+	return {
+		artifacts: value.artifacts.filter(isRecord).flatMap((artifact) => {
+			const { id, name } = artifact;
+			return typeof id === "number" && typeof name === "string" ? [{
+				expired: artifact.expired === true,
+				id,
+				name
+			}] : [];
+		}),
+		totalCount: typeof value.total_count === "number" ? value.total_count : void 0
+	};
+};
+const profileFromDocument = (artifactName, value) => {
+	const read = readVitestProfileDocument(value);
+	if (read.kind === "unrecognized") return {
+		artifactName,
+		kind: "unreadable",
+		reason: read.reason
+	};
+	const { profile } = read;
+	const testCounts = profile.runs.flatMap((run) => run.counts === null ? [] : [run.counts.tests]);
+	return {
+		artifactName,
+		kind: "profile",
+		profile: {
+			cpuCount: profile.environment.cpuCount,
+			cpuModel: profile.environment.cpuModel,
+			maxWorkers: profile.options.maxWorkers,
+			sampleDurationsMs: profile.runs.map((run) => run.durationMs),
+			scope: profile.command.join(" "),
+			slowFiles: profile.summary.slowFiles.map((file) => ({
+				medianMs: file.durationMs.median,
+				path: file.path
+			})),
+			slowTests: profile.summary.slowTests.map((test) => ({
+				file: test.file,
+				medianMs: test.durationMs.median,
+				name: test.name
+			})),
+			summaryDurationMs: profile.summary.durationMs,
+			testCount: testCounts.length === 0 ? unavailable("no sample in this profile carries test counts") : available(Math.max(...testCounts))
+		}
+	};
+};
+const collectProfiles = async (client, runId) => {
+	let listing;
+	try {
+		listing = parseArtifactListing(await client.listArtifacts(runId));
+	} catch (error) {
+		return unavailable(`artifact listing failed: ${error instanceof Error ? error.message : String(error)}`);
+	}
+	const { artifacts } = listing;
+	if (listing.totalCount !== void 0 && listing.totalCount > artifacts.length) return unavailable(`artifact listing is truncated: ${artifacts.length} of ${listing.totalCount} artifacts served`);
+	if (artifacts.length === 0) return unavailable("this run has no artifacts");
+	const analyses = [];
+	for (const artifact of artifacts) {
+		if (artifact.expired) {
+			analyses.push({
+				artifactName: artifact.name,
+				kind: "unreadable",
+				reason: "the artifact is expired and can no longer be downloaded"
+			});
+			continue;
+		}
+		let files;
+		try {
+			files = await client.readArtifactTextFiles(artifact.id);
+		} catch (error) {
+			analyses.push({
+				artifactName: artifact.name,
+				kind: "unreadable",
+				reason: `artifact download failed: ${error instanceof Error ? error.message : String(error)}`
+			});
+			continue;
+		}
+		for (const file of files) {
+			let parsed;
+			try {
+				parsed = JSON.parse(file.text);
+			} catch {
+				analyses.push({
+					artifactName: `${artifact.name}/${file.name}`,
+					kind: "unreadable",
+					reason: "the file is not valid JSON"
+				});
+				continue;
+			}
+			const analysis = profileFromDocument(`${artifact.name}/${file.name}`, parsed);
+			if (analysis.kind === "profile" || isRecord(parsed) && parsed.tool === "factory-ci-vitest-profile") analyses.push(analysis);
+		}
+	}
+	return analyses.length === 0 ? unavailable("no compatible factory-ci Vitest profile artifacts on this run") : available(analyses);
+};
+const earliest = (instants) => instants.length === 0 ? void 0 : Math.min(...instants);
+const latest = (instants) => instants.length === 0 ? void 0 : Math.max(...instants);
+const runQueueDuration = (createdAt, jobs) => {
+	const createdMs = parseInstantMs(createdAt);
+	if (createdMs === void 0) return unavailable("the run object has no parsable created_at");
+	const firstStart = earliest(jobs.flatMap((job) => {
+		const started = parseInstantMs(job.startedAt);
+		return started === void 0 ? [] : [started];
+	}));
+	if (firstStart === void 0) return unavailable("no job carries a parsable started_at");
+	return firstStart < createdMs ? unavailable("the earliest job start precedes the run creation instant") : available(firstStart - createdMs);
+};
+const runCompletionInstant = (jobs) => {
+	const completions = jobs.flatMap((job) => {
+		const completed = parseInstantMs(job.completedAt);
+		return completed === void 0 ? [] : [{
+			completed,
+			iso: job.completedAt
+		}];
+	});
+	const last = latest(completions.map((entry) => entry.completed));
+	const match = completions.find((entry) => entry.completed === last);
+	return match?.iso.available === true ? available(match.iso.value) : unavailable("no job carries a parsable completed_at");
+};
+/**
+* `cpuModel` never comes from the Actions API — only readable profile
+* artifacts carry silicon attribution, so both absence cases say so.
+*/
+const cpuModelsField = (cpuModels, profiles) => {
+	if (cpuModels === void 0) return unavailable(`CPU models come only from profile artifacts (${profiles.available ? "none usable" : profiles.reason}); the Actions API does not expose silicon`);
+	if (cpuModels.length === 0) return unavailable("no readable profile artifact recorded a CPU model");
+	return available(cpuModels);
+};
+const analyzeOneRun = async (client, request, entry) => {
+	const cohort = entry.cohort ?? "ungrouped";
+	let runValue;
+	let jobsValue;
+	try {
+		runValue = await client.getRun(entry.runId);
+		jobsValue = await client.listJobs(entry.runId);
+	} catch (error) {
+		return {
+			cohort,
+			kind: "unreadable",
+			reason: error instanceof Error ? error.message : String(error),
+			repository: request.repository,
+			runId: entry.runId
+		};
+	}
+	if (!isRecord(runValue)) return {
+		cohort,
+		kind: "unreadable",
+		reason: "the run response is not an object",
+		repository: request.repository,
+		runId: entry.runId
+	};
+	const jobRows = isRecord(jobsValue) && Array.isArray(jobsValue.jobs) ? jobsValue.jobs.filter(isRecord) : [];
+	if (isRecord(jobsValue) && typeof jobsValue.total_count === "number" && jobsValue.total_count > jobRows.length) return {
+		cohort,
+		kind: "unreadable",
+		reason: `jobs listing is truncated: ${jobRows.length} of ${jobsValue.total_count} jobs served`,
+		repository: request.repository,
+		runId: entry.runId
+	};
+	const jobs = jobRows.map(analyzeJob);
+	const createdAt = stringField$1(runValue, "created_at", "run");
+	const startedAt = stringField$1(runValue, "run_started_at", "run");
+	const completedAt = runCompletionInstant(jobs);
+	const profiles = request.includeProfiles ? await collectProfiles(client, entry.runId) : unavailable("profile artifacts were not requested (pass --profiles)");
+	const cpuModels = profiles.available ? [...new Set(profiles.value.flatMap((profile) => profile.kind === "profile" && profile.profile.cpuModel !== null ? [profile.profile.cpuModel] : []))] : void 0;
+	const labels = [...new Set(jobs.flatMap((job) => job.runnerLabels.available ? job.runnerLabels.value : []))];
+	return {
+		cohort,
+		completedAt,
+		conclusion: stringField$1(runValue, "conclusion", "run"),
+		cpuModels: cpuModelsField(cpuModels, profiles),
+		createdAt,
+		durations: {
+			queueMs: runQueueDuration(createdAt, jobs),
+			totalMs: durationBetween(startedAt, completedAt, "run duration")
+		},
+		event: stringField$1(runValue, "event", "run"),
+		headSha: stringField$1(runValue, "head_sha", "run"),
+		jobs,
+		kind: "analyzed",
+		profiles,
+		proofReuse: classifyProofReuse(jobs),
+		repository: request.repository,
+		runId: entry.runId,
+		runnerLabels: labels.length === 0 ? unavailable("no job carries runner labels") : available(labels),
+		startedAt,
+		url: stringField$1(runValue, "html_url", "run"),
+		workflowName: stringField$1(runValue, "name", "run")
+	};
+};
+/**
+* Quantile by the floor-index convention: over `sorted` (ascending), the
+* q-quantile is the element at index `floor(q * (n - 1))`. No interpolation —
+* every reported quantile is a duration that actually happened, and the
+* convention is stable for the small sample counts (3–10 runs) this command
+* exists for. median = q(0.5), p25 = q(0.25), p75 = q(0.75).
+*/
+const quantileFloorIndex = (sorted, q) => sorted[Math.floor(q * (sorted.length - 1))] ?? NaN;
+const quantileSummary = (values) => {
+	const sorted = values.toSorted((left, right) => left - right);
+	return {
+		count: sorted.length,
+		maximum: sorted.at(-1) ?? NaN,
+		median: quantileFloorIndex(sorted, .5),
+		minimum: sorted[0] ?? NaN,
+		p25: quantileFloorIndex(sorted, .25),
+		p75: quantileFloorIndex(sorted, .75)
+	};
+};
+const classificationOf = (run) => run.proofReuse.available ? run.proofReuse.value.classification : "unclassified";
+const aggregateCohorts = (runs) => {
+	const cells = /* @__PURE__ */ new Map();
+	for (const run of runs) {
+		if (run.kind !== "analyzed") continue;
+		const key = `${run.cohort}\0${classificationOf(run)}`;
+		const cell = cells.get(key) ?? [];
+		cell.push(run);
+		cells.set(key, cell);
+	}
+	return [...cells.entries()].map(([key, cellRuns]) => {
+		const [cohort = UNGROUPED_COHORT] = key.split("\0");
+		const totals = cellRuns.flatMap((run) => run.durations.totalMs.available ? [run.durations.totalMs.value] : []);
+		const excludedRunIds = cellRuns.filter((run) => !run.durations.totalMs.available).map((run) => run.runId);
+		return {
+			classification: classificationOf(cellRuns[0]),
+			cohort,
+			count: cellRuns.length,
+			excludedRunIds,
+			runIds: cellRuns.map((run) => run.runId),
+			totalDurationMs: totals.length === 0 ? unavailable("no run in this cell has an available total duration") : available(quantileSummary(totals))
+		};
+	}).toSorted((left, right) => `${left.cohort}\0${left.classification}`.localeCompare(`${right.cohort}\0${right.classification}`));
+};
+const cohortWarnings = (runs) => {
+	const warnings = [];
+	const byCohort = /* @__PURE__ */ new Map();
+	for (const run of runs) {
+		if (run.kind !== "analyzed") continue;
+		const cohort = byCohort.get(run.cohort) ?? [];
+		cohort.push(run);
+		byCohort.set(run.cohort, cohort);
+	}
+	for (const [cohort, cohortRuns] of [...byCohort.entries()].toSorted(([left], [right]) => left.localeCompare(right))) {
+		const workflows = [...new Set(cohortRuns.flatMap((run) => run.workflowName.available ? [run.workflowName.value] : []))].toSorted();
+		if (workflows.length > 1) warnings.push(`cohort "${cohort}" spans workflow shapes: ${workflows.join(", ")} — durations across different workflows are not comparable`);
+		const models = [...new Set(cohortRuns.flatMap((run) => run.cpuModels.available ? run.cpuModels.value : []))].toSorted();
+		if (models.length > 1) warnings.push(`cohort "${cohort}" spans CPU models: ${models.join(", ")} — stratify by cpuModel before comparing (see the CI runner analysis docs)`);
+	}
+	return warnings;
+};
+/**
+* Analyze the requested runs. Read-only: the client is only ever asked to GET.
+* One unreadable run never aborts the report — it is carried as an explicit
+* `unreadable` entry so a partially-served API answer stays auditable.
+*/
+const analyzeCiRuns = async (request, client, dependencies = {}) => {
+	if (request.runs.length === 0) throw new Error("ci:analyze requires at least one run id (--run, --runs-file, or --cohort).");
+	const runs = [];
+	for (const entry of request.runs) runs.push(await analyzeOneRun(client, request, entry));
+	return {
+		cohorts: aggregateCohorts(runs),
+		generatedAt: (dependencies.now?.() ?? /* @__PURE__ */ new Date()).toISOString(),
+		repository: request.repository,
+		runs,
+		schemaVersion: 1,
+		tool: CI_ANALYZE_TOOL,
+		warnings: cohortWarnings(runs)
+	};
+};
+const formatSeconds = (ms) => `${(ms / 1e3).toFixed(1)}s`;
+const formatMaybeDuration = (value) => value.available ? formatSeconds(value.value) : `unavailable (${value.reason})`;
+const CLASSIFICATION_HEADINGS = {
+	"full-fallback": "full hosted fallback",
+	mixed: "mixed proof outcomes",
+	"proof-reuse": "proof reuse",
+	unclassified: "no proof-gate signal"
+};
+const renderRunLine = (run) => {
+	const lines = [
+		`  run ${run.runId} — ${run.workflowName.available ? run.workflowName.value : "unknown workflow"} (${run.conclusion.available ? run.conclusion.value : "no conclusion"})`,
+		`    total ${formatMaybeDuration(run.durations.totalMs)}, queue ${formatMaybeDuration(run.durations.queueMs)}`,
+		`    ${run.url.available ? run.url.value : "run URL unavailable"}`
+	];
+	if (run.cpuModels.available) lines.push(`    cpu: ${run.cpuModels.value.join(", ")}`);
+	if (run.profiles.available) for (const profile of run.profiles.value) {
+		if (profile.kind === "unreadable") {
+			lines.push(`    profile ${profile.artifactName}: unreadable (${profile.reason})`);
+			continue;
+		}
+		const p = profile.profile;
+		lines.push(`    profile ${profile.artifactName}: median ${formatSeconds(p.summaryDurationMs.median)} over ${p.sampleDurationsMs.length} sample(s), ${p.testCount.available ? `${p.testCount.value} tests` : "test count unavailable"}, cpu ${p.cpuModel ?? "unrecorded"}`);
+		const [slowFile] = p.slowFiles;
+		if (slowFile) lines.push(`      slowest file ${slowFile.path} (${formatSeconds(slowFile.medianMs)} median)`);
+		const [slowTest] = p.slowTests;
+		if (slowTest) lines.push(`      slowest test ${slowTest.name} (${formatSeconds(slowTest.medianMs)} median)`);
+	}
+	return lines;
+};
+/**
+* Human rendering. Structure mirrors the aggregation rule: one section per
+* cohort × classification cell, so full fallback and proof reuse are never
+* visually blended, and before/after cohorts stay separate.
+*/
+const renderCiAnalyzeReport = (report) => {
+	const lines = [`ci:analyze — ${report.repository} (schema v${report.schemaVersion})`];
+	const analyzed = report.runs.filter((run) => run.kind === "analyzed");
+	for (const cohort of report.cohorts) {
+		lines.push("", `cohort "${cohort.cohort}" — ${CLASSIFICATION_HEADINGS[cohort.classification]} (${cohort.count} run(s))`);
+		if (cohort.totalDurationMs.available) {
+			const stats = cohort.totalDurationMs.value;
+			lines.push(`  total duration over ${stats.count} run(s): median ${formatSeconds(stats.median)}, p25 ${formatSeconds(stats.p25)}, p75 ${formatSeconds(stats.p75)}, min ${formatSeconds(stats.minimum)}, max ${formatSeconds(stats.maximum)}`);
+		} else lines.push(`  total duration: unavailable (${cohort.totalDurationMs.reason})`);
+		if (cohort.excludedRunIds.length > 0) lines.push(`  excluded from aggregates (total unavailable): ${cohort.excludedRunIds.join(", ")}`);
+		for (const run of analyzed.filter((candidate) => candidate.cohort === cohort.cohort && classificationOf(candidate) === cohort.classification)) lines.push(...renderRunLine(run));
+	}
+	const unreadable = report.runs.filter((run) => run.kind === "unreadable");
+	const unreadableCohorts = [...new Set(unreadable.map((run) => run.cohort))].toSorted((left, right) => left.localeCompare(right));
+	for (const cohort of unreadableCohorts) {
+		lines.push("", `cohort "${cohort}" — unreadable runs:`);
+		for (const run of unreadable.filter((candidate) => candidate.cohort === cohort)) lines.push(`  run ${run.runId}: ${run.reason}`);
+	}
+	if (report.warnings.length > 0) {
+		lines.push("", "warnings:");
+		for (const warning of report.warnings) lines.push(`  - ${warning}`);
+	}
+	return `${lines.join("\n")}\n`;
+};
+//#endregion
+//#region src/commands/ci-analyze.ts
+/**
+* `ci:analyze` command wiring (#647).
+*
+* The analysis itself lives in `../ci-analyze.js`; this module owns the flag
+* grammar, the run-id assembly (`--run`, `--runs-file`, `--cohort`), the
+* report output paths, and the default `gh`-backed {@link CiAnalyzeClient}.
+* Authentication is entirely the caller's: every request goes through the
+* `gh` CLI, which resolves its own token (GH_TOKEN / GITHUB_TOKEN / login) —
+* no credential is stored or minted here.
+*/
+const REPOSITORY_PATTERN = /^[\w.-]+\/[\w.-]+$/u;
+const parseRepository = (value) => {
+	if (!REPOSITORY_PATTERN.test(value)) throw new Error(`--repo must be owner/name, got "${value}"`);
+	return value;
+};
+const parseRunId = (value) => {
+	const parsed = Number(value);
+	if (!Number.isSafeInteger(parsed) || parsed < 1) throw new Error(`run id must be a positive integer, got "${value}"`);
+	return parsed;
+};
+const collectRunOption = (value, previous = []) => [...previous, parseRunId(value)];
+/**
+* `--cohort label=id,id` — the same `name=value` grammar the existing psf
+* flags use for structured values, repeatable once per label.
+*
+* The label `ungrouped` is reserved: it is what the report calls runs the
+* caller left unlabeled, so accepting it as a caller cohort would silently
+* blend a named population with the genuinely unlabeled one.
+*/
+const parseCohortOption = (value, previous = []) => {
+	const separator = value.indexOf("=");
+	const label = separator === -1 ? "" : value.slice(0, separator).trim();
+	const ids = separator === -1 ? "" : value.slice(separator + 1);
+	if (label === "" || ids.trim() === "") throw new Error(`--cohort must be <label>=<runId>[,<runId>...], got "${value}"`);
+	if (label === "ungrouped") throw new Error(`--cohort label "${UNGROUPED_COHORT}" is reserved for runs passed without a cohort; pick another label`);
+	return [...previous, {
+		label,
+		runIds: ids.split(",").map((id) => parseRunId(id.trim()))
+	}];
+};
+/** One run id per line; blank lines and `#` comments are ignored. */
+const parseRunsFile = (content) => content.split("\n").map((line) => line.trim()).filter((line) => line !== "" && !line.startsWith("#")).map(parseRunId);
+/**
+* Assemble the requested run set. A run id may appear in exactly one cohort;
+* uncohorted ids (from `--run` / `--runs-file`) stay unlabeled. Conflicting
+* cohort labels for one id are a hard error rather than a silent pick.
+*/
+const assembleRunRequests = (input) => {
+	const cohortByRun = /* @__PURE__ */ new Map();
+	for (const cohort of input.cohorts) for (const runId of cohort.runIds) {
+		const existing = cohortByRun.get(runId);
+		if (existing !== void 0 && existing !== cohort.label) throw new Error(`run ${runId} is assigned to both cohort "${existing}" and cohort "${cohort.label}"`);
+		cohortByRun.set(runId, cohort.label);
+	}
+	const ordered = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const cohort of input.cohorts) for (const runId of cohort.runIds) if (!seen.has(runId)) {
+		seen.add(runId);
+		ordered.push({
+			cohort: cohort.label,
+			runId
+		});
+	}
+	for (const runId of input.runIds) if (!seen.has(runId)) {
+		seen.add(runId);
+		ordered.push({
+			cohort: cohortByRun.get(runId) ?? null,
+			runId
+		});
+	}
+	return ordered;
+};
+const GH_ARTIFACT_MAX_BYTES = 256 * 1024 * 1024;
+const PAGE_SIZE = 100;
+const MAX_PAGES = 50;
+/**
+* Follow GitHub's pagination for one collection endpoint: request pages until
+* the served rows reach the response's `total_count` (or a page comes back
+* empty). The merged document keeps the `total_count` field, so if the page
+* budget is ever exhausted the analyzer's truncation guard reports the
+* shortfall as explicit unavailability instead of a silent partial read.
+*/
+const listActionsCollection = (basePath, key) => {
+	const rows = [];
+	let totalCount;
+	for (let page = 1; page <= MAX_PAGES; page += 1) {
+		const response = runGhJson(["api", `${basePath}?per_page=${PAGE_SIZE}&page=${page}`]);
+		const served = Array.isArray(response[key]) ? response[key] : [];
+		rows.push(...served);
+		totalCount = typeof response.total_count === "number" ? response.total_count : totalCount;
+		if (served.length === 0 || rows.length >= (totalCount ?? 0)) break;
+	}
+	return {
+		[key]: rows,
+		total_count: totalCount ?? rows.length
+	};
+};
+/**
+* A Unix-host entry line: permissions, zip version, host OS, decompressed
+* size, text/binary flags, method, date, time, then the member name (which
+* may itself contain spaces). This is the one form GitHub's artifact service
+* actually emits; other host forms are deliberately *not* supported — they
+* fail reconciliation below rather than being half-parsed.
+*/
+const ZIP_ENTRY_PATTERN = /^(?<perms>[-dl][a-srwxt-]{9})\s+\d+\.\d+\s+\S+\s+(?<size>\d+)\s+\S\S\s+\S+\s+\S+\s+\S+\s(?<name>.+)$/u;
+/** `Zip file size: 12109 bytes, number of entries: 2` */
+const ZIP_HEADER_PATTERN = /^Zip file size: \d+ bytes, number of entries: (?<count>\d+)$/u;
+/** `2 files, 81410 bytes uncompressed, 11689 bytes compressed:  85.6%` */
+const ZIP_TRAILER_PATTERN = /^(?<count>\d+) files?, \d+ bytes? uncompressed, \d+ bytes? compressed:\s+-?[\d.]+%$/u;
+/**
+* Parse zipinfo's default listing and *reconcile* it against the archive's
+* own declared entry count — fail closed, never a partial view.
+*
+* The security property the caps and member policy rest on is that the parsed
+* set is the WHOLE central directory. A listing line this parser does not
+* recognize (a FAT-host form, a future zipinfo change) therefore refuses the
+* whole artifact rather than being skipped: a skipped line would let
+* `unzip <name>` extract members the caps never counted. Three refusals:
+* an unrecognized line, a parsed count that differs from the declared count
+* (every header and trailer declaration must agree — a listing that
+* contradicts itself has no unambiguous count and is refused), and any
+* duplicate member name across the full parsed set — a parsed safe name
+* shadowed by an unparsed or differently-shaped duplicate is exactly the
+* bypass this closes.
+*/
+const parseZipInfoListing = (text) => {
+	const members = [];
+	const declaredCounts = [];
+	for (const line of text.split("\n")) {
+		if (line.trim() === "" || line.startsWith("Archive:")) continue;
+		const header = ZIP_HEADER_PATTERN.exec(line);
+		if (header?.groups) {
+			declaredCounts.push(Number(header.groups.count));
+			continue;
+		}
+		const trailer = ZIP_TRAILER_PATTERN.exec(line);
+		if (trailer?.groups) {
+			declaredCounts.push(Number(trailer.groups.count));
+			continue;
+		}
+		const entry = ZIP_ENTRY_PATTERN.exec(line);
+		if (entry?.groups) {
+			members.push({
+				isSymlink: entry.groups.perms?.startsWith("l") === true,
+				name: entry.groups.name ?? "",
+				sizeBytes: Number(entry.groups.size)
+			});
+			continue;
+		}
+		throw new Error(`zip listing reconciliation failed: unrecognized listing line "${line}"`);
+	}
+	const [declaredEntries] = declaredCounts;
+	if (declaredEntries === void 0) throw new Error("zip listing reconciliation failed: the listing declares no entry count");
+	if (declaredCounts.some((count) => count !== declaredEntries)) throw new Error(`zip listing reconciliation failed: contradictory declared entry counts (${declaredCounts.join(", ")})`);
+	if (members.length !== declaredEntries) throw new Error(`zip listing reconciliation failed: parsed ${members.length} of ${declaredEntries} declared entries`);
+	const seen = /* @__PURE__ */ new Set();
+	for (const member of members) {
+		if (seen.has(member.name)) throw new Error(`zip listing reconciliation failed: duplicate member name "${member.name}"`);
+		seen.add(member.name);
+	}
+	return members;
+};
+const MAX_ARTIFACT_DECOMPRESSED_BYTES = 256 * 1024 * 1024;
+const UNSAFE_MEMBER_CHARACTERS = /[*?[\]]/u;
+/**
+* The member policy for artifact zips, as a pure function so the security
+* decisions are testable without `unzip`. The archive is refused outright —
+* not partially read — when any member is a symlink, an absolute path, a
+* `..` traversal, option-shaped (leading `-`), or glob-ambiguous, or when the
+* archive exceeds the count or decompressed-size caps. What survives is the
+* `*.json` member list actually handed to extraction.
+*/
+const selectProfileZipMembers = (members) => {
+	if (members.length > 512) throw new Error(`artifact zip refused: ${members.length} members exceeds the 512-member cap`);
+	let totalBytes = 0;
+	for (const member of members) {
+		if (member.isSymlink) throw new Error(`artifact zip refused: member "${member.name}" is a symlink`);
+		if (member.name.startsWith("/") || /^[A-Za-z]:/u.test(member.name)) throw new Error(`artifact zip refused: member "${member.name}" is an absolute path`);
+		if (member.name.split("/").includes("..")) throw new Error(`artifact zip refused: member "${member.name}" traverses with ..`);
+		if (member.name.startsWith("-")) throw new Error(`artifact zip refused: member "${member.name}" is option-shaped`);
+		if (UNSAFE_MEMBER_CHARACTERS.test(member.name)) throw new Error(`artifact zip refused: member "${member.name}" contains glob metacharacters`);
+		if (!Number.isFinite(member.sizeBytes) || member.sizeBytes < 0) throw new Error(`artifact zip refused: member "${member.name}" reports no usable size`);
+		totalBytes += member.sizeBytes;
+	}
+	if (totalBytes > 268435456) throw new Error(`artifact zip refused: ${totalBytes} decompressed bytes exceeds the ${MAX_ARTIFACT_DECOMPRESSED_BYTES}-byte cap`);
+	return members.filter((member) => !member.name.endsWith("/") && member.name.endsWith(".json")).map((member) => member.name).toSorted();
+};
+/**
+* The default client: `gh api` for JSON endpoints (paginated), `gh api` plus
+* system `unzip` for artifact zips, with every member vetted by
+* {@link selectProfileZipMembers} before extraction. The exec adapter itself
+* is deliberately thin and untested networked code — every decision made from
+* these bytes lives behind {@link CiAnalyzeClient} or the pure policy
+* functions above, where fixtures drive it.
+*/
+const createGhCiAnalyzeClient = (repository) => ({
+	getRun: (runId) => Promise.resolve(runGhJson(["api", `/repos/${repository}/actions/runs/${runId}`])),
+	listArtifacts: (runId) => Promise.resolve(listActionsCollection(`/repos/${repository}/actions/runs/${runId}/artifacts`, "artifacts")),
+	listJobs: (runId) => Promise.resolve(listActionsCollection(`/repos/${repository}/actions/runs/${runId}/jobs`, "jobs")),
+	readArtifactTextFiles: (artifactId) => {
+		const scratch = mkdtempSync(path.join(tmpdir(), "psf-ci-analyze-"));
+		try {
+			const zip = execFileSync("gh", ["api", `/repos/${repository}/actions/artifacts/${artifactId}/zip`], { maxBuffer: GH_ARTIFACT_MAX_BYTES });
+			const zipPath = path.join(scratch, "artifact.zip");
+			writeFileSync(zipPath, zip);
+			const selected = selectProfileZipMembers(parseZipInfoListing(execFileSync("unzip", ["-Z", zipPath], {
+				encoding: "utf-8",
+				maxBuffer: GH_ARTIFACT_MAX_BYTES
+			})));
+			if (selected.length === 0) return Promise.resolve([]);
+			const extracted = path.join(scratch, "extracted");
+			execFileSync("unzip", [
+				"-o",
+				"-qq",
+				zipPath,
+				"-d",
+				extracted,
+				...selected
+			], { stdio: [
+				"ignore",
+				"ignore",
+				"pipe"
+			] });
+			return Promise.resolve(selected.map((name) => ({
+				name,
+				text: readFileSync(path.join(extracted, name), "utf-8")
+			})));
+		} finally {
+			rmSync(scratch, {
+				force: true,
+				recursive: true
+			});
+		}
+	}
+});
+const defaultAction = (request) => analyzeCiRuns(request, createGhCiAnalyzeClient(request.repository));
+function createCiAnalyzeCommand(output, action = defaultAction) {
+	return new Command("ci:analyze").description("Read-only GitHub Actions run lifecycle analysis: queue/setup/install/step/total durations, proof-reuse classification, cohort aggregates, and optional factory-ci Vitest profile readback").requiredOption("--repo <owner/name>", "repository the run ids belong to", parseRepository).option("--run <id>", "workflow run id to analyze (repeatable)", collectRunOption).option("--runs-file <path>", "file of run ids, one per line (# comments allowed)").option("--cohort <label=ids>", "label a comma-separated run-id list as one cohort, e.g. --cohort before=1,2 (repeatable; the label \"ungrouped\" is reserved for runs passed without a cohort)", parseCohortOption).option("--profiles", "download run artifacts and read compatible factory-ci Vitest profiles (the only source of cpuModel)").option("--output <path>", "write the versioned JSON report to a path").option("--json", "print the JSON report to stdout instead of prose").action(async (options) => {
+		const fromFile = options.runsFile === void 0 ? [] : parseRunsFile(readFileSync(path.resolve(options.runsFile), "utf-8"));
+		const report = await action({
+			includeProfiles: options.profiles === true,
+			repository: options.repo,
+			runs: assembleRunRequests({
+				cohorts: options.cohort ?? [],
+				runIds: [...options.run ?? [], ...fromFile]
+			})
+		});
+		if (options.output !== void 0) {
+			const outputPath = path.resolve(options.output);
+			writeFileSync(outputPath, `${JSON.stringify(report, null, 2)}\n`);
+			output.stderr.write(`ci:analyze report written to ${outputPath}\n`);
+		}
+		output.stdout.write(options.json ? `${JSON.stringify(report, null, 2)}\n` : renderCiAnalyzeReport(report));
+	});
+}
 //#endregion
 //#region src/checkout-repository.ts
 function normalizeRepositoryIdentity(repository) {
@@ -10929,6 +11649,7 @@ function runPrVerify(args, dependencies = {}) {
 		if (error instanceof ImpactStampConfigError) throw error;
 		impactStamp = conservativeImpactStamp(profile.impact?.targets ?? [], [`impact stamp computation failed (${error instanceof Error ? error.message : String(error)}); fail closed to full impact`]);
 	}
+	for (const line of impactStampSummaryLines(impactStamp)) console.log(line);
 	const vetoedTargets = boundFailingCheckNames({
 		candidate: {
 			headSha,
@@ -12890,6 +13611,13 @@ const prVerifyFollowUp = (authoringSession) => followUpFromArgv([
 	"pr:verify",
 	...authoringSession ? ["--authoring-session", authoringSession] : []
 ]);
+/** The route-owned Promotion from a GitHub draft into a Candidate. */
+const prUndraftFollowUp = (pr) => followUpFromArgv([
+	"gh",
+	"pr",
+	"ready",
+	String(pr)
+]);
 /** Canonical zod schema for the optional follow-up field on JSON outputs. */
 const FollowUpActionSchema = z.object({
 	argv: z.array(z.string()),
@@ -14005,15 +14733,18 @@ const collectBlockers = ({ correctnessRequired, correctnessStatus, correctnessUn
 			command: `gh pr checks ${input.pr} --watch`
 		} } : {}
 	});
-	if (input.draft) blockers.push({
-		demand: DEMAND_KEYS.draft,
-		reason: DRAFT_BLOCKER_REASON,
-		repair: {
-			action: "Mark the PR ready for review; draft is route-owned once proof gates pass.",
-			code: "undraft-pr",
-			command: `gh pr ready ${input.pr}`
-		}
-	});
+	if (input.draft) {
+		const promotion = prUndraftFollowUp(input.pr);
+		blockers.push({
+			demand: DEMAND_KEYS.draft,
+			reason: DRAFT_BLOCKER_REASON,
+			repair: {
+				action: "Mark the PR ready for review; draft is route-owned once proof gates pass.",
+				code: "undraft-pr",
+				command: promotion.command
+			}
+		});
+	}
 	return blockers;
 };
 const orderRepairs = (repairs) => repairs.toSorted((a, b) => READINESS_REPAIR_CODES.indexOf(a.code) - READINESS_REPAIR_CODES.indexOf(b.code));
@@ -14677,12 +15408,7 @@ async function runPrReady(args, dependencies = {}) {
 		]);
 		let followUp;
 		if (evaluation.status === "ready") followUp = arming?.outcome === "not-armed" ? readyRedispatch() : void 0;
-		else if (undraftRepair && evaluation.humanBlockingReasons.length === 0) followUp = followUpFromArgv([
-			"gh",
-			"pr",
-			"ready",
-			String(args.pr)
-		]);
+		else if (undraftRepair && evaluation.humanBlockingReasons.length === 0) followUp = prUndraftFollowUp(args.pr);
 		else if (!pendingExternalChecksOnly) followUp = prVerifyFollowUp(authoringSession);
 		const notices = [
 			...evaluation.notices,
@@ -15481,6 +16207,50 @@ const reevaluateReadiness = (args, dependencies) => (dependencies.runPrReady ??
 	...args,
 	throwWhenBlocked: false
 }, dependencies);
+const requirePromotionHead = ({ actualHeadSha, expectedHeadSha, phase }) => {
+	if (!sameHeadSha(actualHeadSha, expectedHeadSha)) throw new PrPublishTransactionAbortedError(`${phase}: live PR head ${actualHeadSha} differs from the proved publish head ${expectedHeadSha}. Re-run pr:publish against the current head.`);
+};
+/**
+* Promote a proved draft before the first Candidate demand evaluation (#649).
+* The route-owned action is shared with pr:ready; this helper only orders it.
+*/
+const promoteDraftBeforeDemandEvaluation = async ({ cwd, expectedHeadSha, factoryCliInvocation, fetchPr, pr, prSnapshot, runFollowUp }) => {
+	if (!prSnapshot.isDraft) return { status: "not-requested" };
+	const before = fetchPr();
+	requirePromotionHead({
+		actualHeadSha: before.headRefOid,
+		expectedHeadSha,
+		phase: "Promotion refused before transition"
+	});
+	if (!before.isDraft) return { status: "not-requested" };
+	const promotion = prUndraftFollowUp(pr);
+	try {
+		await (runFollowUp ?? defaultFollowUpRunner(factoryCliInvocation))(promotion, cwd);
+	} catch (error) {
+		throw new PrPublishTransactionAbortedError(`Promotion failed (${promotion.command}): ${errorMessage(error)}`);
+	}
+	const after = fetchPr();
+	requirePromotionHead({
+		actualHeadSha: after.headRefOid,
+		expectedHeadSha,
+		phase: "Promotion invalidated during transition"
+	});
+	if (after.isDraft) throw new PrPublishTransactionAbortedError(`Promotion did not make PR #${pr} ready for review at proved head ${expectedHeadSha}. Re-run pr:publish after GitHub settles.`);
+	return {
+		action: promotion,
+		reason: "Promotion precedes Candidate demand evaluation on the unchanged head",
+		status: "succeeded"
+	};
+};
+const requirePromotedProofHead = ({ expectedHeadSha, promotion, proof }) => {
+	if (promotion.status !== "succeeded") return;
+	requirePromotionHead({
+		actualHeadSha: proof.ledger.headSha,
+		expectedHeadSha,
+		phase: "Promotion invalidated before Candidate demand evaluation completed"
+	});
+};
+const candidateFollowUpAfterPromotion = (promotion, proof) => promotion.status === "not-requested" ? proof.followUp : void 0;
 /**
 * A proof with no follow-up that is not `ready` means `pr:ready` found the
 * candidate blocked solely on a pending hosted check for the family excluded
@@ -15615,6 +16385,11 @@ async function runPrPublish(args, dependencies = {}) {
 		reviewProofPath
 	});
 	const pr = fetchPr();
+	requirePromotionHead({
+		actualHeadSha: pr.headRefOid,
+		expectedHeadSha: verifyProof.headSha,
+		phase: "Publish refused before managed body update"
+	});
 	const parts = renderPrBodySectionParts({
 		reviewProof,
 		verifyProof: verifyProof && verifyProofPassed(verifyProof) ? verifyProof : void 0
@@ -15639,13 +16414,28 @@ async function runPrPublish(args, dependencies = {}) {
 		json: false,
 		report: false
 	};
+	const promotion = await promoteDraftBeforeDemandEvaluation({
+		cwd,
+		expectedHeadSha: verifyProof.headSha,
+		factoryCliInvocation,
+		fetchPr,
+		pr: prNumber,
+		prSnapshot: pr,
+		runFollowUp: dependencies.runFollowUp
+	});
 	const initialProof = await reevaluateReadiness(readyEvalArgs, publishDependencies);
+	requirePromotedProofHead({
+		expectedHeadSha: verifyProof.headSha,
+		promotion,
+		proof: initialProof
+	});
 	const initialHandoff = summarizeHumanHandoff(initialProof);
-	let followUp = { status: "not-requested" };
+	let followUp = promotion;
 	let currentProof = initialProof;
-	if (initialProof.followUp) {
+	const candidateFollowUp = candidateFollowUpAfterPromotion(promotion, initialProof);
+	if (candidateFollowUp) {
 		followUp = await settleFollowUp({
-			action: initialProof.followUp,
+			action: candidateFollowUp,
 			cwd,
 			factoryCliInvocation,
 			onFailure: (failed, error) => {
@@ -15660,13 +16450,13 @@ async function runPrPublish(args, dependencies = {}) {
 			},
 			plan: planPublishFollowUp({
 				binding: verifyProofBinding,
-				followUp: initialProof.followUp,
+				followUp: candidateFollowUp,
 				proofHeadSha: verifyProof.headSha,
 				verifiedHeadSha: verified.verifiedHeadSha
 			}),
 			runFollowUp: dependencies.runFollowUp
 		});
-		if (followUp.status === "succeeded" && isSelfInvalidatingFollowUp(initialProof.followUp)) currentProof = await reevaluateReadiness(readyEvalArgs, publishDependencies);
+		if (followUp.status === "succeeded" && isSelfInvalidatingFollowUp(candidateFollowUp)) currentProof = await reevaluateReadiness(readyEvalArgs, publishDependencies);
 	}
 	const proof = await awaitCurrentReadyVerdict({
 		args: readyEvalArgs,
@@ -15717,7 +16507,7 @@ async function deliverSpooledEvidence({ awaitPending, cwd, flush, profilePath })
 //#endregion
 //#region src/commands/pr-publish.ts
 function createPrPublishCommand(_output, action = runPrPublish) {
-	return markCwdOptionDefault(new Command("pr:publish").description("Compose supplied proof into a ready-for-human handoff; never launches review").option("--pr <number>", "pull request number", positiveInteger("--pr")).option("--base <ref>", "explicit base branch or ref override").option("--authoring-session <id>", "known authoring session identity for verification retries").option("--cwd <path>", "working directory to evaluate", collectCwdOption).option("--epic <number>", "epic issue containing the factory-boundary manifest; the composed readiness evaluation then applies the wave-demanded review rung (#351)", positiveInteger("--epic")).option("--findings <path>", "clean-session findings to validate when no current review proof is available").option("--json", "print the publish result as JSON").option("--output <path>", "write readiness proof JSON to a file").option("--profile <path>", "path to the project profile JSON file").option("--review-proof <path>", "pr:review proof JSON path").option("--verify-proof <path>", "pr:verify proof JSON path").action(async (options) => {
+	return markCwdOptionDefault(new Command("pr:publish").description("Promote a proved draft, then evaluate Candidate demands; never launches review").option("--pr <number>", "pull request number", positiveInteger("--pr")).option("--base <ref>", "explicit base branch or ref override").option("--authoring-session <id>", "known authoring session identity for verification retries").option("--cwd <path>", "working directory to evaluate", collectCwdOption).option("--epic <number>", "epic issue containing the factory-boundary manifest; the composed readiness evaluation then applies the wave-demanded review rung (#351)", positiveInteger("--epic")).option("--findings <path>", "clean-session findings to validate when no current review proof is available").option("--json", "print the publish result as JSON").option("--output <path>", "write readiness proof JSON to a file").option("--profile <path>", "path to the project profile JSON file").option("--review-proof <path>", "pr:review proof JSON path").option("--verify-proof <path>", "pr:verify proof JSON path").action(async (options) => {
 		await action({
 			authoringSessionIds: options.authoringSession ? [options.authoringSession] : void 0,
 			base: options.base ?? "",
@@ -15843,6 +16633,146 @@ function modeFor(options) {
 	if (options.full) return "full";
 	return "auto";
 }
+const COMMIT_SHA_PATTERN = /^[0-9a-f]{40}$/iu;
+const ZERO_SHA_PATTERN = /^0{40}$/u;
+const demandedTargets = (profile, reason) => (profile?.impact?.targets ?? []).map(({ name }) => ({
+	basis: reason,
+	name,
+	state: "demanded"
+}));
+const refusal = ({ after, before, profile, reason }) => ({
+	...after ? { afterSha: after } : {},
+	basis: {
+		changedFiles: [],
+		classification: "refused",
+		reasons: [reason]
+	},
+	...before ? { beforeSha: before } : {},
+	decision: "refused",
+	schemaVersion: 1,
+	targets: demandedTargets(profile, reason),
+	unsubscribedPaths: []
+});
+const assertCommitIdentity = (value, name) => {
+	if (value === void 0 || !COMMIT_SHA_PATTERN.test(value) || ZERO_SHA_PATTERN.test(value)) throw new Error(`${name} must be a non-zero 40-character commit SHA`);
+	return value.toLowerCase();
+};
+const assertReachableCommit = (cwd, sha, name) => {
+	try {
+		runCapture("git", [
+			"cat-file",
+			"-e",
+			`${sha}^{commit}`
+		], cwd);
+	} catch {
+		throw new Error(`${name} commit ${sha} is not reachable in this checkout`);
+	}
+};
+const writeGithubOutputs = (outputPath, decision) => {
+	appendFileSync(outputPath, `${[
+		`decision=${decision.decision}`,
+		`basis=${JSON.stringify(decision.basis)}`,
+		`unsubscribed_paths=${JSON.stringify(decision.unsubscribedPaths)}`,
+		...decision.targets.map((target) => `${productionImpactTargetOutput(target.name)}=${target.state}`)
+	].join("\n")}\n`, "utf-8");
+};
+/**
+* Recompute impact from one merge push's exact before/after commits. The
+* result may withdraw consumer work only; every doubt path returns a refused
+* decision whose known targets remain demanded.
+*/
+const runProductionImpact = (args) => {
+	const cwd = path.resolve(args.cwd ?? process.cwd());
+	let profile;
+	let profilePath;
+	let decision;
+	try {
+		const { path: loadedPath, profile: loadedProfile } = loadProjectProfile({
+			cwd,
+			profilePath: args.profilePath
+		});
+		profile = loadedProfile;
+		profilePath = loadedPath;
+		const before = assertCommitIdentity(args.before, "before");
+		const after = assertCommitIdentity(args.after, "after");
+		assertReachableCommit(cwd, before, "before");
+		assertReachableCommit(cwd, after, "after");
+		const checkedOutHead = runCapture("git", ["rev-parse", "HEAD"], cwd).stdout.trim().toLowerCase();
+		if (checkedOutHead !== after) throw new Error(`after commit ${after} is not the checked-out HEAD ${checkedOutHead}; refusing to mix commit identities with declarations from another tree`);
+		try {
+			runCapture("git", [
+				"merge-base",
+				"--is-ancestor",
+				before,
+				after
+			], cwd);
+		} catch {
+			throw new Error(`before commit ${before} is not an ancestor of after commit ${after}`);
+		}
+		const changedFiles = [...new Set(filesFromNameStatus(runCapture("git", [
+			"diff",
+			"--find-renames",
+			"--name-status",
+			before,
+			after
+		], cwd).stdout))].toSorted();
+		const stamp = computeImpactStamp({
+			changedFiles,
+			profile,
+			profilePath: path.relative(cwd, profilePath),
+			readLockfile: (side) => showFileAtRef(cwd, side === "base" ? before : after, path.join(cwd, LOCKFILE_PATH))
+		});
+		const usable = stamp.basis === "target-scoped";
+		decision = {
+			afterSha: after,
+			basis: {
+				changedFiles,
+				classification: stamp.basis,
+				reasons: stamp.reasons
+			},
+			beforeSha: before,
+			decision: usable ? "usable" : "refused",
+			schemaVersion: 1,
+			targets: stamp.targets.map((target) => ({
+				basis: target.basis,
+				name: target.name,
+				state: usable && target.impact === "not-affected" ? "withdrawn" : "demanded"
+			})),
+			unsubscribedPaths: stamp.unsubscribedPaths
+		};
+	} catch (error) {
+		decision = refusal({
+			after: args.after,
+			before: args.before,
+			profile,
+			reason: `production impact classification refused: ${error instanceof Error ? error.message : String(error)}`
+		});
+	}
+	if (args.githubOutput) writeGithubOutputs(path.resolve(cwd, args.githubOutput), decision);
+	if (args.githubSummary) appendFileSync(path.resolve(cwd, args.githubSummary), `### Production impact\n\n${productionImpactSummaryLines(decision).join("\n")}\n`, "utf-8");
+	return decision;
+};
+const productionImpactSummaryLines = (decision) => decision.basis.classification === "refused" ? [
+	"Production impact: refused; all consumer work remains demanded.",
+	...decision.basis.reasons,
+	"Unsubscribed changed paths: unavailable because classification was refused."
+] : [`Production impact: ${decision.basis.classification}; ${decision.targets.filter(({ state }) => state === "demanded").length}/${decision.targets.length} target(s) demanded.`, decision.unsubscribedPaths.length === 0 ? "Unsubscribed changed paths: none." : `Unsubscribed changed paths (demand no target): ${decision.unsubscribedPaths.join(", ")}`];
+//#endregion
+//#region src/commands/production-impact.ts
+function createProductionImpactCommand(output) {
+	return markCwdOptionDefault(new Command("production:impact").description("Classify production targets from an exact merge-push before/after diff").option("--before <sha>", "merge-push before commit SHA").option("--after <sha>", "merge-push after commit SHA").option("--cwd <path>", "repository working directory", collectCwdOption).option("--profile <path>", "path to the project profile JSON file").option("--github-output <path>", "append stable decision outputs to a GitHub Actions output file").option("--github-summary <path>", "append a human-readable decision to a GitHub Actions summary file").option("--json", "print the complete decision as JSON").action((options) => {
+		const decision = runProductionImpact({
+			after: options.after,
+			before: options.before,
+			cwd: resolveCwdOption(options.cwd),
+			githubOutput: options.githubOutput,
+			githubSummary: options.githubSummary,
+			profilePath: options.profile
+		});
+		if (options.json) output.stdout.write(`${JSON.stringify(decision, null, 2)}\n`);
+		else output.stdout.write(`${productionImpactSummaryLines(decision).join("\n")}\n`);
+	}));
+}
 //#endregion
 //#region src/worktree-scratch-files.ts
 var worktree_scratch_files_exports = /* @__PURE__ */ __exportAll({
@@ -16130,9 +17060,11 @@ function createProgram(options = {}) {
 	program.addCommand(createDoctorCommand(output));
 	program.addCommand(createConfigCommand(output));
 	program.addCommand(createEvidenceEmitCommand(output));
+	program.addCommand(createCiAnalyzeCommand(output));
 	program.addCommand(createHqFlushCommand(output));
 	program.addCommand(createBoundaryCheckCommand(output, options.actions?.boundaryCheck));
 	program.addCommand(createPrVerifyCommand(output));
+	program.addCommand(createProductionImpactCommand(output));
 	program.addCommand(createCloseoutCommand(output));
 	program.addCommand(createEpicPublishStructureCommand(output));
 	program.addCommand(createPrReviewCommand(output, options.actions?.prReview));