@webpieces/pr-gate 0.4.497 → 0.4.499

package/src/scripts/commands/cleanup-command.js.map

@@ -1 +1 @@
-{"version":3,"file":"cleanup-command.js","sourceRoot":"","sources":["../../../../../../../packages/tooling/pr-gate/src/scripts/commands/cleanup-command.ts"],"names":[],"mappings":";;;;AAAA,2DAAqC;AACrC,0DAYiC;AACjC,yCAA2D;AAE3D,MAAM,GAAG,GAAG,0DAA0D,CAAC;AAEvE,qGAAqG;AACrG,mGAAmG;AACnG,8EAA8E;AAC9E,MAAM,uBAAuB,GAAqC;IAC9D,CAAC,wCAAyB,CAAC,EACvB,kGAAkG;UAChG,qGAAqG;IAC3G,CAAC,6CAA8B,CAAC,EAC5B,8FAA8F;UAC5F,uEAAuE;IAC7E,CAAC,4CAA6B,CAAC,EAC3B,gGAAgG;UAC9F,6FAA6F;CACtG,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;GAoBG;AAEI,IAAM,cAAc,GAApB,MAAM,cAAc;IAEF;IACA;IACA;IAHrB,YACqB,cAA8B,EAC9B,YAA0B,EAC1B,QAAwB;QAFxB,mBAAc,GAAd,cAAc,CAAgB;QAC9B,iBAAY,GAAZ,YAAY,CAAc;QAC1B,aAAQ,GAAR,QAAQ,CAAgB;IAC1C,CAAC;IAEJ,KAAK,CAAC,GAAG;QACL,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QACpE,MAAM,SAAS,GAAG,IAAA,8BAAe,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC;QAC1E,+FAA+F;QAC/F,4EAA4E;QAC5E,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;QAC/E,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QAE1C,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAClD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QACpC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC;QACvD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;QACzD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qDAAqD,CAAC,CAAC;YAC5E,OAAO;QACX,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;QAC3F,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9C,CAAC;IAEO,MAAM,CAAC,MAAkB;QAC7B,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3D,OAAO,+DAA+D,CAAC;QAC3E,CAAC;QAED,IAAI,GAAG,GAAG,IAAI,GAAG,GAAG,GAAG,iBAAiB,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,0BAA0B,GAAG,GAAG,GAAG,IAAI,CAAC;QAC5G,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM;YAAE,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAEjE,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,GAAG,IAAI,SAAS,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,qCAAqC,CAAC;YAClF,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM;gBAAE,GAAG,IAAI,OAAO,KAAK,CAAC,MAAM,MAAM,KAAK,CAAC,KAAK,IAAI,CAAC;QACvF,CAAC;QAED,6FAA6F;QAC7F,+EAA+E;QAC/E,GAAG,IAAI,iGAAiG;cAClG,gEAAgE,CAAC;QACvE,OAAO,GAAG,CAAC;IACf,CAAC;IAEO,UAAU,CAAC,KAAmB;QAClC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,gGAAgG;QAChG,4FAA4F;QAC5F,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,KAAK,EAAE;YACpC,CAAC,CAAC,sBAAsB,KAAK,CAAC,UAAU,gBAAgB,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,GAAG;YACvH,CAAC,CAAC,EAAE,CAAC;QACT,OAAO,OAAO,KAAK,CAAC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,MAAM,GAAG,QAAQ,IAAI,CAAC;IACtE,CAAC;IAED,6FAA6F;IAC7F,iGAAiG;IACjG,0DAA0D;IAClD,UAAU,CAAC,MAAyB;QACxC,MAAM,GAAG,GAAsB,EAAE,CAAC;QAClC,KAAK,MAAM,cAAc,IAAI,yCAA0B,EAAE,CAAC;YACtD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBACzB,IAAI,KAAK,CAAC,cAAc,KAAK,cAAc;oBAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACjE,CAAC;QACL,CAAC;QACD,OAAO,GAAG,CAAC;IACf,CAAC;IAED,oGAAoG;IACpG,0FAA0F;IAClF,eAAe,CAAC,UAA6B;QACjD,IAAI,GAAG,GAAG,IAAI,GAAG,GAAG,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,6CAA6C,GAAG,GAAG,CAAC;QAC1G,IAAI,OAAO,GAAG,EAAE,CAAC;QACjB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5C,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;YAC5B,IAAI,KAAK,CAAC,cAAc,KAAK,OAAO,EAAE,CAAC;gBACnC,OAAO,GAAG,KAAK,CAAC,cAAc,CAAC;gBAC/B,GAAG,IAAI,KAAK,uBAAuB,CAAC,OAAO,CAAC,IAAI,OAAO,MAAM,CAAC;YAClE,CAAC;YACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC,wBAAwB,CAAC;YAC5G,GAAG,IAAI,MAAM,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,KAAK,CAAC,MAAM,aAAa,OAAO,MAAM,KAAK,CAAC,MAAM,IAAI,CAAC;QAC1F,CAAC;QACD,OAAO,GAAG,CAAC;IACf,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,gBAAgB,CAAC,UAA6B;QACxD,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;YAC/B,OAAO,CAAC,MAAM,CAAC,KAAK,CAChB,mEAAmE;kBACjE,oFAAoF,CACzF,CAAC;YACF,OAAO,EAAE,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,QAAQ,CAC/B,4DAA4D,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACxF,IAAI,MAAM,KAAK,EAAE,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,GAAG;YAAE,OAAO,EAAE,CAAC;QACpE,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,GAAG;YAAE,OAAO,UAAU,CAAC;QAC1D,OAAO,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IACjD,CAAC;IAED,mGAAmG;IACnG,2EAA2E;IACnE,YAAY,CAAC,UAA6B,EAAE,MAAc;QAC9D,MAAM,GAAG,GAAsB,EAAE,CAAC;QAClC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YAC5B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,UAAU,CAAC,MAAM;gBAAE,SAAS;YACjF,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;QACpC,CAAC;QACD,OAAO,GAAG,CAAC;IACf,CAAC;IAED,mFAAmF;IACzE,QAAQ,CAAC,MAAc;QAC7B,MAAM,EAAE,GAAG,QAAQ,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QACtF,OAAO,IAAI,OAAO,CAAS,CAAC,OAAgC,EAAQ,EAAE;YAClE,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,MAAc,EAAQ,EAAE;gBACzC,EAAE,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,CAAC,MAAM,CAAC,CAAC;YACpB,CAAC,CAAC,CAAC;QACP,CAAC,CAAC,CAAC;IACP,CAAC;CACJ,CAAA;AApIY,wCAAc;yBAAd,cAAc;IAD1B,IAAA,sBAAU,EAAC,8BAAkB,CAAC,SAAS,CAAC;6CAGA,6BAAc;QAChB,2BAAY;QAChB,6BAAc;GAJpC,cAAc,CAoI1B","sourcesContent":["import * as readline from 'readline';\nimport {\n    BranchArchiver,\n    BranchReaper,\n    DeletableBranch,\n    ReapResult,\n    ReapedBranch,\n    RepoRootFinder,\n    loadAndValidate,\n    CLASSIFICATION_SUPERSEDED,\n    CLASSIFICATION_CONTENT_IN_MAIN,\n    CLASSIFICATION_NEVER_PROPOSED,\n    PROMPTABLE_CLASSIFICATIONS,\n} from '@webpieces/rules-config';\nimport { injectable, bindingScopeValues } from 'inversify';\n\nconst SEP = '━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\\n';\n\n// One line of human-facing explanation per promptable classification, ordered most-safe first. These\n// replace the single string `no merged PR found — a human must decide`, which covered all three of\n// these situations identically and so told a human nothing they could act on.\nconst CLASSIFICATION_HEADINGS: Readonly<Record<string, string>> = {\n    [CLASSIFICATION_SUPERSEDED]:\n        'SUPERSEDED — the PR was closed WITHOUT merging and later PRs have merged since. Near-certainly\\n'\n        + '  the abandoned first attempt at work that landed under a different number. Safest group to delete.',\n    [CLASSIFICATION_CONTENT_IN_MAIN]:\n        'CONTENT ALREADY IN MAIN — every commit has a patch-equivalent in origin/main (git cherry).\\n'\n        + '  The work is not unique to this branch; only the commit objects are.',\n    [CLASSIFICATION_NEVER_PROPOSED]:\n        'NEVER PROPOSED — no PR was ever opened, and these commits may be the ONLY copy in existence.\\n'\n        + '  Read the unique-commit counts before answering. This is the group to say no to if unsure.',\n};\n\n/**\n * wp-cleanup: delete the local branches whose PR is already merged (or that hold no commits), then ASK\n * about the ones that are merely probably-dead.\n *\n * WHY a named command instead of the `git branch -D a b c` the guards used to print: an AI agent\n * reads a raw `-D` as destructive, so it asks permission and stops — which is exactly why branches\n * piled up despite the tooling knowing precisely which ones were dead. `pnpm wp-cleanup` is one\n * boring, allowlistable verb whose safety is a property of the command itself rather than of the\n * agent's judgement about a git flag.\n *\n * WHY IT NOW PROMPTS: sparing silently was the other half of the same problem. Every spared branch\n * reported the identical `no merged PR found — a human must decide`, so the human could not decide,\n * so nothing got deleted, so the pile grew until branch-creation-guard refused to make the next branch\n * and an agent went looking for a config knob to loosen. Shown a real classification with unique-commit\n * counts, the human in that session answered in five words: \"these should all be delete branches\".\n * The prompt is cheap because archiving happens FIRST — a yes costs a tag, not the history.\n *\n * All the danger still lives in the verdicts, not here — see BranchReaper for why every AUTOMATICALLY\n * deleted branch is provably dead and recoverable, and note that nothing in the prompted group is ever\n * deleted without an explicit typed answer.\n */\n@injectable(bindingScopeValues.Singleton)\nexport class CleanupCommand {\n    constructor(\n        private readonly repoRootFinder: RepoRootFinder,\n        private readonly branchReaper: BranchReaper,\n        private readonly archiver: BranchArchiver,\n    ) {}\n\n    async run(): Promise<void> {\n        const repoRoot = this.repoRootFinder.resolveRepoRoot(process.cwd());\n        const retention = loadAndValidate(repoRoot).prGate.landPr.branchRetention;\n        // No cache argument: wp-cleanup recomputes the verdicts itself. The file on disk is allowed to\n        // go stale, and stale evidence is fine for BLOCKING but never for DELETING.\n        const result = this.branchReaper.reap(repoRoot, 'wp-cleanup', null, retention);\n        process.stdout.write(this.report(result));\n\n        const promptable = this.promptable(result.spared);\n        if (promptable.length === 0) return;\n        process.stdout.write(this.classifiedBlock(promptable));\n        const approved = await this.askWhichToDelete(promptable);\n        if (approved.length === 0) {\n            process.stdout.write('\\nNothing deleted — the branches above were kept.\\n');\n            return;\n        }\n        const second = this.branchReaper.reapApproved(repoRoot, 'wp-cleanup', approved, retention);\n        process.stdout.write(this.report(second));\n    }\n\n    private report(result: ReapResult): string {\n        if (result.reaped.length === 0 && result.failed.length === 0) {\n            return '\\n✅ Nothing to clean up — no local branch is provably dead.\\n';\n        }\n\n        let out = '\\n' + SEP + `🧹 Cleaned up ${String(result.reaped.length)} dead local branch(es)\\n` + SEP + '\\n';\n        for (const entry of result.reaped) out += this.reapedLine(entry);\n\n        if (result.failed.length > 0) {\n            out += `\\n⚠️  ${String(result.failed.length)} branch(es) could not be deleted:\\n`;\n            for (const entry of result.failed) out += `  ✗ ${entry.branch} — ${entry.error}\\n`;\n        }\n\n        // Printed even on success: a deletion the human cannot undo is a deletion they have to trust\n        // blindly, and the whole argument for auto-cleanup is that they never have to.\n        out += '\\nEvery deletion is logged with its pre-delete SHA in .webpieces/hooks/branch-mutations.log —\\n'\n            + 'recover any of them with the `recover=` command on its line.\\n';\n        return out;\n    }\n\n    private reapedLine(entry: ReapedBranch): string {\n        const sha = entry.sha !== '' ? ` (was ${entry.sha.slice(0, 8)})` : '';\n        // The archive tag is printed inline because it is the ONE thing that makes this delete casually\n        // reversible — a name a human can type, rather than a sha they have to go dig out of a log.\n        const archived = entry.archiveTag !== ''\n            ? `\\n      archived → ${entry.archiveTag}   (restore: ${this.archiver.restoreCommand(entry.branch, entry.archiveTag)})`\n            : '';\n        return `  ✓ ${entry.branch}${sha} — ${entry.reason}${archived}\\n`;\n    }\n\n    // The spared branches a human can meaningfully rule on, grouped and ordered most-safe first.\n    // Branches spared for a MECHANICAL reason (checked out in a worktree) are deliberately excluded:\n    // there is no judgement to make, git would simply refuse.\n    private promptable(spared: DeletableBranch[]): DeletableBranch[] {\n        const out: DeletableBranch[] = [];\n        for (const classification of PROMPTABLE_CLASSIFICATIONS) {\n            for (const entry of spared) {\n                if (entry.classification === classification) out.push(entry);\n            }\n        }\n        return out;\n    }\n\n    // The classification table: what each group means, and per branch its unique-commit count — the one\n    // number that says whether a yes costs nothing or costs the only copy of somebody's work.\n    private classifiedBlock(promptable: DeletableBranch[]): string {\n        let out = '\\n' + SEP + `🤔 ${String(promptable.length)} branch(es) are probably dead — your call\\n` + SEP;\n        let current = '';\n        for (let i = 0; i < promptable.length; i += 1) {\n            const entry = promptable[i];\n            if (entry.classification !== current) {\n                current = entry.classification;\n                out += `\\n${CLASSIFICATION_HEADINGS[current] ?? current}\\n\\n`;\n            }\n            const commits = entry.commits >= 0 ? `${String(entry.commits)} unique commit(s)` : 'unique commits unknown';\n            out += `  [${String(i + 1)}] ${entry.branch}\\n        ${commits} — ${entry.reason}\\n`;\n        }\n        return out;\n    }\n\n    /**\n     * Ask which of the classified branches to delete. Answers: `all`, `none` (default), or a\n     * comma/space-separated list of the numbers shown.\n     *\n     * NON-INTERACTIVE (no TTY — CI, a hook, a piped agent shell) answers NONE and says so. A prompt\n     * nobody can see must never be read as consent, and this is the one place in the tooling where a\n     * deletion is not backed by a proof.\n     */\n    private async askWhichToDelete(promptable: DeletableBranch[]): Promise<DeletableBranch[]> {\n        if (process.stdin.isTTY !== true) {\n            process.stdout.write(\n                '\\nNot a terminal — nothing was deleted and nothing was assumed.\\n'\n                + 'Run `pnpm wp-cleanup` in an interactive shell to answer, or delete individually.\\n',\n            );\n            return [];\n        }\n        const answer = (await this.question(\n            `\\nDelete which? [all / none / e.g. \"1,3\"] (default none): `)).trim().toLowerCase();\n        if (answer === '' || answer === 'none' || answer === 'n') return [];\n        if (answer === 'all' || answer === 'a') return promptable;\n        return this.pickByNumber(promptable, answer);\n    }\n\n    // Parse `1,3` / `1 3` into branches, ignoring anything out of range. An unparseable answer selects\n    // nothing, which is the fail-safe direction for a question about deleting.\n    private pickByNumber(promptable: DeletableBranch[], answer: string): DeletableBranch[] {\n        const out: DeletableBranch[] = [];\n        for (const token of answer.split(/[\\s,]+/)) {\n            const index = Number(token);\n            if (!Number.isInteger(index) || index < 1 || index > promptable.length) continue;\n            out.push(promptable[index - 1]);\n        }\n        return out;\n    }\n\n    // Seam: overridden in the spec so the prompt parsing is testable with no terminal.\n    protected question(prompt: string): Promise<string> {\n        const rl = readline.createInterface({ input: process.stdin, output: process.stdout });\n        return new Promise<string>((resolve: (value: string) => void): void => {\n            rl.question(prompt, (answer: string): void => {\n                rl.close();\n                resolve(answer);\n            });\n        });\n    }\n}\n"]}
+{"version":3,"file":"cleanup-command.js","sourceRoot":"","sources":["../../../../../../../packages/tooling/pr-gate/src/scripts/commands/cleanup-command.ts"],"names":[],"mappings":";;;;AAAA,2DAAqC;AACrC,0DAaiC;AACjC,yCAA2D;AAE3D,yDAA4D;AAE5D,MAAM,GAAG,GAAG,0DAA0D,CAAC;AAEvE,qGAAqG;AACrG,mGAAmG;AACnG,8EAA8E;AAC9E,MAAM,uBAAuB,GAAqC;IAC9D,CAAC,wCAAyB,CAAC,EACvB,kGAAkG;UAChG,qGAAqG;IAC3G,CAAC,6CAA8B,CAAC,EAC5B,8FAA8F;UAC5F,uEAAuE;IAC7E,CAAC,4CAA6B,CAAC,EAC3B,gGAAgG;UAC9F,6FAA6F;CACtG,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEI,IAAM,cAAc,GAApB,MAAM,cAAc;IAEF;IACA;IACA;IACA;IAJrB,YACqB,cAA8B,EAC9B,YAA0B,EAC1B,QAAwB,EACxB,eAAuC;QAHvC,mBAAc,GAAd,cAAc,CAAgB;QAC9B,iBAAY,GAAZ,YAAY,CAAc;QAC1B,aAAQ,GAAR,QAAQ,CAAgB;QACxB,oBAAe,GAAf,eAAe,CAAwB;IACzD,CAAC;IAEJ;;;;;;OAMG;IACH,KAAK,CAAC,GAAG;QACL,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QACpE,MAAM,SAAS,GAAG,IAAA,8BAAe,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC;QAC1E,MAAM,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QACjD,MAAM,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACpD,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,QAAgB,EAAE,SAAiB;QAC7D,+FAA+F;QAC/F,4EAA4E;QAC5E,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;QAC/E,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QAE1C,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAClD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QACpC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC;QACvD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QACnE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qDAAqD,CAAC,CAAC;YAC5E,OAAO;QACX,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;QAC3F,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9C,CAAC;IAED;;;;;;;;OAQG;IACK,KAAK,CAAC,gBAAgB,CAAC,QAAgB,EAAE,SAAiB;QAC9D,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACzD,MAAM,IAAI,GAAG,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QACzD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClB,OAAO,CAAC,MAAM,CAAC,KAAK,CAChB,IAAI,CAAC,eAAe,CAAC,MAAM,CACvB,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC;QACjF,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;QAEvE,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC7D,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QACpC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC;QACnE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QACrE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sDAAsD,CAAC,CAAC;YAC7E,OAAO;QACX,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAChB,IAAI,CAAC,eAAe,CAAC,MAAM,CACvB,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC;IACrF,CAAC;IAEO,MAAM,CAAC,MAAkB;QAC7B,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3D,OAAO,+DAA+D,CAAC;QAC3E,CAAC;QAED,IAAI,GAAG,GAAG,IAAI,GAAG,GAAG,GAAG,iBAAiB,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,0BAA0B,GAAG,GAAG,GAAG,IAAI,CAAC;QAC5G,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM;YAAE,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAEjE,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,GAAG,IAAI,SAAS,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,qCAAqC,CAAC;YAClF,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM;gBAAE,GAAG,IAAI,OAAO,KAAK,CAAC,MAAM,MAAM,KAAK,CAAC,KAAK,IAAI,CAAC;QACvF,CAAC;QAED,6FAA6F;QAC7F,+EAA+E;QAC/E,GAAG,IAAI,iGAAiG;cAClG,gEAAgE,CAAC;QACvE,OAAO,GAAG,CAAC;IACf,CAAC;IAEO,UAAU,CAAC,KAAmB;QAClC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,gGAAgG;QAChG,4FAA4F;QAC5F,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,KAAK,EAAE;YACpC,CAAC,CAAC,sBAAsB,KAAK,CAAC,UAAU,gBAAgB,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,GAAG;YACvH,CAAC,CAAC,EAAE,CAAC;QACT,OAAO,OAAO,KAAK,CAAC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,MAAM,GAAG,QAAQ,IAAI,CAAC;IACtE,CAAC;IAED;;;;;;;;;;;OAWG;IACK,UAAU,CAAC,MAAyB;QACxC,MAAM,GAAG,GAAsB,EAAE,CAAC;QAClC,KAAK,MAAM,cAAc,IAAI,yCAA0B,EAAE,CAAC;YACtD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBACzB,IAAI,KAAK,CAAC,cAAc,KAAK,cAAc;oBAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACjE,CAAC;QACL,CAAC;QACD,OAAO,GAAG,CAAC;IACf,CAAC;IAED,oGAAoG;IACpG,0FAA0F;IAClF,eAAe,CAAC,UAA6B;QACjD,IAAI,GAAG,GAAG,IAAI,GAAG,GAAG,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,6CAA6C,GAAG,GAAG,CAAC;QAC1G,IAAI,OAAO,GAAG,EAAE,CAAC;QACjB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5C,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;YAC5B,IAAI,KAAK,CAAC,cAAc,KAAK,OAAO,EAAE,CAAC;gBACnC,OAAO,GAAG,KAAK,CAAC,cAAc,CAAC;gBAC/B,GAAG,IAAI,KAAK,uBAAuB,CAAC,OAAO,CAAC,IAAI,OAAO,MAAM,CAAC;YAClE,CAAC;YACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC,wBAAwB,CAAC;YAC5G,GAAG,IAAI,MAAM,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,KAAK,CAAC,MAAM,aAAa,OAAO,MAAM,KAAK,CAAC,MAAM,IAAI,CAAC;QAC1F,CAAC;QACD,OAAO,GAAG,CAAC;IACf,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,gBAAgB,CAC1B,UAAe,EAAE,IAAY;QAE7B,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;YAC/B,OAAO,CAAC,MAAM,CAAC,KAAK,CAChB,yBAAyB,IAAI,yCAAyC;kBACpE,oFAAoF,CACzF,CAAC;YACF,OAAO,EAAE,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,QAAQ,CAC/B,kBAAkB,IAAI,iDAAiD,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACnG,IAAI,MAAM,KAAK,EAAE,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,GAAG;YAAE,OAAO,EAAE,CAAC;QACpE,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,GAAG;YAAE,OAAO,UAAU,CAAC;QAC1D,OAAO,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IACjD,CAAC;IAED,mGAAmG;IACnG,2EAA2E;IACnE,YAAY,CAAgD,UAAe,EAAE,MAAc;QAC/F,MAAM,GAAG,GAAQ,EAAE,CAAC;QACpB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YAC5B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,UAAU,CAAC,MAAM;gBAAE,SAAS;YACjF,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;QACpC,CAAC;QACD,OAAO,GAAG,CAAC;IACf,CAAC;IAED,mFAAmF;IACzE,QAAQ,CAAC,MAAc;QAC7B,MAAM,EAAE,GAAG,QAAQ,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QACtF,OAAO,IAAI,OAAO,CAAS,CAAC,OAAgC,EAAQ,EAAE;YAClE,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,MAAc,EAAQ,EAAE;gBACzC,EAAE,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,CAAC,MAAM,CAAC,CAAC;YACpB,CAAC,CAAC,CAAC;QACP,CAAC,CAAC,CAAC;IACP,CAAC;CACJ,CAAA;AA5LY,wCAAc;yBAAd,cAAc;IAD1B,IAAA,sBAAU,EAAC,8BAAkB,CAAC,SAAS,CAAC;6CAGA,6BAAc;QAChB,2BAAY;QAChB,6BAAc;QACP,yCAAsB;GALnD,cAAc,CA4L1B","sourcesContent":["import * as readline from 'readline';\nimport {\n    BranchArchiver,\n    BranchReaper,\n    DeletableBranch,\n    DeletableWorktree,\n    ReapResult,\n    ReapedBranch,\n    RepoRootFinder,\n    loadAndValidate,\n    CLASSIFICATION_SUPERSEDED,\n    CLASSIFICATION_CONTENT_IN_MAIN,\n    CLASSIFICATION_NEVER_PROPOSED,\n    PROMPTABLE_CLASSIFICATIONS,\n} from '@webpieces/rules-config';\nimport { injectable, bindingScopeValues } from 'inversify';\n\nimport { WorktreeCleanupSection } from './worktree-cleanup';\n\nconst SEP = '━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\\n';\n\n// One line of human-facing explanation per promptable classification, ordered most-safe first. These\n// replace the single string `no merged PR found — a human must decide`, which covered all three of\n// these situations identically and so told a human nothing they could act on.\nconst CLASSIFICATION_HEADINGS: Readonly<Record<string, string>> = {\n    [CLASSIFICATION_SUPERSEDED]:\n        'SUPERSEDED — the PR was closed WITHOUT merging and later PRs have merged since. Near-certainly\\n'\n        + '  the abandoned first attempt at work that landed under a different number. Safest group to delete.',\n    [CLASSIFICATION_CONTENT_IN_MAIN]:\n        'CONTENT ALREADY IN MAIN — every commit has a patch-equivalent in origin/main (git cherry).\\n'\n        + '  The work is not unique to this branch; only the commit objects are.',\n    [CLASSIFICATION_NEVER_PROPOSED]:\n        'NEVER PROPOSED — no PR was ever opened, and these commits may be the ONLY copy in existence.\\n'\n        + '  Read the unique-commit counts before answering. This is the group to say no to if unsure.',\n};\n\n/**\n * wp-cleanup: remove the dead WORKTREES, delete the local branches whose PR is already merged (or that\n * hold no commits), then ASK about the ones that are merely probably-dead.\n *\n * WHY WORKTREES ARE PART OF THIS: they were the half that never got reaped. The verdicts existed —\n * merged-branches.ts has been writing a full `DeletableWorktree[]` into the cache all along — and their\n * only consumer used them to BLOCK the next `git worktree add`, never to remove anything. Meanwhile a\n * live worktree pins its branch, so the branch was spared too. Two things the tooling could PROVE were\n * dead, accumulating forever, until the guard refused to create the next branch and the only remedy it\n * could offer was loosening its own cap. See WorktreeCleanupSection and WorktreeReaper.\n *\n * WHY a named command instead of the `git branch -D a b c` the guards used to print: an AI agent\n * reads a raw `-D` as destructive, so it asks permission and stops — which is exactly why branches\n * piled up despite the tooling knowing precisely which ones were dead. `pnpm wp-cleanup` is one\n * boring, allowlistable verb whose safety is a property of the command itself rather than of the\n * agent's judgement about a git flag.\n *\n * WHY IT NOW PROMPTS: sparing silently was the other half of the same problem. Every spared branch\n * reported the identical `no merged PR found — a human must decide`, so the human could not decide,\n * so nothing got deleted, so the pile grew until branch-creation-guard refused to make the next branch\n * and an agent went looking for a config knob to loosen. Shown a real classification with unique-commit\n * counts, the human in that session answered in five words: \"these should all be delete branches\".\n * The prompt is cheap because archiving happens FIRST — a yes costs a tag, not the history.\n *\n * All the danger still lives in the verdicts, not here — see BranchReaper for why every AUTOMATICALLY\n * deleted branch is provably dead and recoverable, and note that nothing in the prompted group is ever\n * deleted without an explicit typed answer.\n */\n@injectable(bindingScopeValues.Singleton)\nexport class CleanupCommand {\n    constructor(\n        private readonly repoRootFinder: RepoRootFinder,\n        private readonly branchReaper: BranchReaper,\n        private readonly archiver: BranchArchiver,\n        private readonly worktreeSection: WorktreeCleanupSection,\n    ) {}\n\n    /**\n     * WORKTREES FIRST, then branches. The order is the fix, not a detail: a worktree HOLDS its branch,\n     * so that branch is spared `in-use` (\"remove that worktree before deleting the branch\") and nothing\n     * used to remove the worktree — so both piled up until branch-creation-guard refused to make the\n     * next one. Reaping the worktree takes its branch with it, and the branch pass then recomputes its\n     * verdicts from scratch against the post-removal truth.\n     */\n    async run(): Promise<void> {\n        const repoRoot = this.repoRootFinder.resolveRepoRoot(process.cwd());\n        const retention = loadAndValidate(repoRoot).prGate.landPr.branchRetention;\n        await this.cleanUpWorktrees(repoRoot, retention);\n        await this.cleanUpBranches(repoRoot, retention);\n    }\n\n    private async cleanUpBranches(repoRoot: string, retention: string): Promise<void> {\n        // No cache argument: wp-cleanup recomputes the verdicts itself. The file on disk is allowed to\n        // go stale, and stale evidence is fine for BLOCKING but never for DELETING.\n        const result = this.branchReaper.reap(repoRoot, 'wp-cleanup', null, retention);\n        process.stdout.write(this.report(result));\n\n        const promptable = this.promptable(result.spared);\n        if (promptable.length === 0) return;\n        process.stdout.write(this.classifiedBlock(promptable));\n        const approved = await this.askWhichToDelete(promptable, 'branch');\n        if (approved.length === 0) {\n            process.stdout.write('\\nNothing deleted — the branches above were kept.\\n');\n            return;\n        }\n        const second = this.branchReaper.reapApproved(repoRoot, 'wp-cleanup', approved, retention);\n        process.stdout.write(this.report(second));\n    }\n\n    /**\n     * Reap the provably-dead worktrees, then ASK about the probably-dead ones — the same two-tier\n     * posture the branch half has, because it is the same verdict on the same branch.\n     *\n     * WorktreeReaper enforces the safety rails regardless of what is passed or answered: never the\n     * primary clone, never the tree this command is running in, and never `--force` (git's refusal to\n     * remove a worktree holding untracked or modified files is a feature, and forcing it is how a\n     * cleanup command becomes a data-loss command).\n     */\n    private async cleanUpWorktrees(repoRoot: string, retention: string): Promise<void> {\n        const verdicts = this.worktreeSection.verdicts(repoRoot);\n        const dead = this.worktreeSection.provablyDead(verdicts);\n        if (dead.length > 0) {\n            process.stdout.write(\n                this.worktreeSection.report(\n                    this.worktreeSection.reap(repoRoot, 'wp-cleanup', dead, retention)));\n        }\n        process.stdout.write(this.worktreeSection.sparedBlock(verdicts, dead));\n\n        const promptable = this.worktreeSection.promptable(verdicts);\n        if (promptable.length === 0) return;\n        process.stdout.write(this.worktreeSection.promptBlock(promptable));\n        const approved = await this.askWhichToDelete(promptable, 'worktree');\n        if (approved.length === 0) {\n            process.stdout.write('\\nNothing removed — the worktrees above were kept.\\n');\n            return;\n        }\n        process.stdout.write(\n            this.worktreeSection.report(\n                this.worktreeSection.reap(repoRoot, 'wp-cleanup', approved, retention)));\n    }\n\n    private report(result: ReapResult): string {\n        if (result.reaped.length === 0 && result.failed.length === 0) {\n            return '\\n✅ Nothing to clean up — no local branch is provably dead.\\n';\n        }\n\n        let out = '\\n' + SEP + `🧹 Cleaned up ${String(result.reaped.length)} dead local branch(es)\\n` + SEP + '\\n';\n        for (const entry of result.reaped) out += this.reapedLine(entry);\n\n        if (result.failed.length > 0) {\n            out += `\\n⚠️  ${String(result.failed.length)} branch(es) could not be deleted:\\n`;\n            for (const entry of result.failed) out += `  ✗ ${entry.branch} — ${entry.error}\\n`;\n        }\n\n        // Printed even on success: a deletion the human cannot undo is a deletion they have to trust\n        // blindly, and the whole argument for auto-cleanup is that they never have to.\n        out += '\\nEvery deletion is logged with its pre-delete SHA in .webpieces/hooks/branch-mutations.log —\\n'\n            + 'recover any of them with the `recover=` command on its line.\\n';\n        return out;\n    }\n\n    private reapedLine(entry: ReapedBranch): string {\n        const sha = entry.sha !== '' ? ` (was ${entry.sha.slice(0, 8)})` : '';\n        // The archive tag is printed inline because it is the ONE thing that makes this delete casually\n        // reversible — a name a human can type, rather than a sha they have to go dig out of a log.\n        const archived = entry.archiveTag !== ''\n            ? `\\n      archived → ${entry.archiveTag}   (restore: ${this.archiver.restoreCommand(entry.branch, entry.archiveTag)})`\n            : '';\n        return `  ✓ ${entry.branch}${sha} — ${entry.reason}${archived}\\n`;\n    }\n\n    /**\n     * The spared branches a human can meaningfully rule on, grouped and ordered most-safe first.\n     *\n     * Branches spared as IN_USE — checked out in a worktree — are still excluded here, but the reason\n     * is no longer \"git would simply refuse\". That premise died the moment worktrees became reapable.\n     * The real reason is the ORDER in run(): the worktree pass has already run, so an IN_USE branch is\n     * one of exactly two things. Either its worktree was dead and the reap took the branch with it (so\n     * it is not in this list at all), or its worktree is one we are deliberately keeping — locked, held\n     * open by uncommitted work, or the one we are standing in — and offering to delete the branch out\n     * from under a live checkout is not a question worth asking. The pair is offered TOGETHER by the\n     * worktree prompt, which shows both the path and the branch it holds, or it is not offered at all.\n     */\n    private promptable(spared: DeletableBranch[]): DeletableBranch[] {\n        const out: DeletableBranch[] = [];\n        for (const classification of PROMPTABLE_CLASSIFICATIONS) {\n            for (const entry of spared) {\n                if (entry.classification === classification) out.push(entry);\n            }\n        }\n        return out;\n    }\n\n    // The classification table: what each group means, and per branch its unique-commit count — the one\n    // number that says whether a yes costs nothing or costs the only copy of somebody's work.\n    private classifiedBlock(promptable: DeletableBranch[]): string {\n        let out = '\\n' + SEP + `🤔 ${String(promptable.length)} branch(es) are probably dead — your call\\n` + SEP;\n        let current = '';\n        for (let i = 0; i < promptable.length; i += 1) {\n            const entry = promptable[i];\n            if (entry.classification !== current) {\n                current = entry.classification;\n                out += `\\n${CLASSIFICATION_HEADINGS[current] ?? current}\\n\\n`;\n            }\n            const commits = entry.commits >= 0 ? `${String(entry.commits)} unique commit(s)` : 'unique commits unknown';\n            out += `  [${String(i + 1)}] ${entry.branch}\\n        ${commits} — ${entry.reason}\\n`;\n        }\n        return out;\n    }\n\n    /**\n     * Ask which of the classified branches to delete. Answers: `all`, `none` (default), or a\n     * comma/space-separated list of the numbers shown.\n     *\n     * NON-INTERACTIVE (no TTY — CI, a hook, a piped agent shell) answers NONE and says so. A prompt\n     * nobody can see must never be read as consent, and this is the one place in the tooling where a\n     * deletion is not backed by a proof.\n     */\n    private async askWhichToDelete<T extends DeletableBranch | DeletableWorktree>(\n        promptable: T[], kind: string,\n    ): Promise<T[]> {\n        if (process.stdin.isTTY !== true) {\n            process.stdout.write(\n                `\\nNot a terminal — no ${kind} was deleted and nothing was assumed.\\n`\n                + 'Run `pnpm wp-cleanup` in an interactive shell to answer, or delete individually.\\n',\n            );\n            return [];\n        }\n        const answer = (await this.question(\n            `\\nDelete which ${kind}(s)? [all / none / e.g. \"1,3\"] (default none): `)).trim().toLowerCase();\n        if (answer === '' || answer === 'none' || answer === 'n') return [];\n        if (answer === 'all' || answer === 'a') return promptable;\n        return this.pickByNumber(promptable, answer);\n    }\n\n    // Parse `1,3` / `1 3` into branches, ignoring anything out of range. An unparseable answer selects\n    // nothing, which is the fail-safe direction for a question about deleting.\n    private pickByNumber<T extends DeletableBranch | DeletableWorktree>(promptable: T[], answer: string): T[] {\n        const out: T[] = [];\n        for (const token of answer.split(/[\\s,]+/)) {\n            const index = Number(token);\n            if (!Number.isInteger(index) || index < 1 || index > promptable.length) continue;\n            out.push(promptable[index - 1]);\n        }\n        return out;\n    }\n\n    // Seam: overridden in the spec so the prompt parsing is testable with no terminal.\n    protected question(prompt: string): Promise<string> {\n        const rl = readline.createInterface({ input: process.stdin, output: process.stdout });\n        return new Promise<string>((resolve: (value: string) => void): void => {\n            rl.question(prompt, (answer: string): void => {\n                rl.close();\n                resolve(answer);\n            });\n        });\n    }\n}\n"]}

package/src/scripts/commands/finish-upsert-pr-command.d.ts

@@ -5,7 +5,7 @@ import { ChecklistScanner } from '../workflow/checklist-scanner';
 import { GitExec } from '../workflow/git-exec';
 import { BuildAffected } from '../workflow/build-affected';
 import { MergeState } from '../workflow/merge-state';
-import { MergeEnd } from '../workflow/merge-end';
+import { ReviewStageReceiptService } from '../workflow/review-stage-receipt';
 import { PrMerger } from '../workflow/pr-merger';
 import { GatedPrPublisher } from '../workflow/gated-pr-publisher';
 import { Dashboard } from '../../dashboard/dashboard';
@@ -16,7 +16,6 @@ export declare class FinishUpsertPrCommand {
     private readonly gitExec;
     private readonly buildAffected;
     private readonly mergeState;
-    private readonly mergeEnd;
     private readonly prMerger;
     private readonly publisher;
     private readonly dashboard;
@@ -25,13 +24,51 @@ export declare class FinishUpsertPrCommand {
     private readonly gateTokenService;
     private readonly provenance;
     private readonly instructions;
-    constructor(repoRootFinder: RepoRootFinder, aiBranchName: AiBranchName, branchNaming: BranchNaming, gitExec: GitExec, buildAffected: BuildAffected, mergeState: MergeState, mergeEnd: MergeEnd, prMerger: PrMerger, publisher: GatedPrPublisher, dashboard: Dashboard, checklistScanner: ChecklistScanner, reviewJsonService: ReviewJsonService, gateTokenService: GateTokenService, provenance: SubagentProvenanceService, instructions: ChecklistInstructionsService);
+    private readonly receipts;
+    constructor(repoRootFinder: RepoRootFinder, aiBranchName: AiBranchName, branchNaming: BranchNaming, gitExec: GitExec, buildAffected: BuildAffected, mergeState: MergeState, prMerger: PrMerger, publisher: GatedPrPublisher, dashboard: Dashboard, checklistScanner: ChecklistScanner, reviewJsonService: ReviewJsonService, gateTokenService: GateTokenService, provenance: SubagentProvenanceService, instructions: ChecklistInstructionsService, receipts: ReviewStageReceiptService);
     run(): Promise<void>;
     private emitClickableLinkDirective;
-    private finalizeAnyInProgressMerge;
+    /**
+     * The build gate — SKIPPED when stage ②'s receipt already covers this exact HEAD.
+     *
+     * The gate is authoritative per-COMMIT, not per-command: re-running it on a tree that has not moved
+     * since stage ② verified it buys nothing and costs a full `nx affected`. That skip is what makes the
+     * three-stage flow cost ONE build rather than two, and it is why moving the gate earlier was affordable.
+     */
+    private runOrSkipBuildGate;
+    /**
+     * The two stage-② preconditions, together: no unvalidated merge, and a receipt proving stage ② ran.
+     * Returns true when that receipt covers the CURRENT HEAD, i.e. the build gate can be skipped.
+     */
+    private assertStageTwoRan;
+    /**
+     * REFUSE while a 3-point merge is still unvalidated — do not finalize it here.
+     *
+     * This command used to do the finalizing itself. Finalizing means validating a conflict resolution, and
+     * two commands owning that means two implementations that can drift; `PrContextWriter`'s docstring
+     * records this codebase already paying for exactly that once. It also came too late to matter: by the
+     * time finish ran, the reviewers had already reviewed the pre-merge tree.
+     *
+     * So stage ② owns it, and finish only checks. Nothing is lost — the recovery is one command away, and
+     * running it also builds the merged tree and re-briefs the reviewers against it, which finalizing here
+     * never did.
+     */
+    private assertNoUnvalidatedMerge;
+    /**
+     * REQUIRE stage ② (`wp-review-upsert-pr`) to have run, and report whether it ran on THIS commit.
+     *
+     * Returns true when the receipt matches the current HEAD — the caller then skips its own build, because
+     * the receipt IS the gate for that sha and rebuilding an unchanged tree is a second full `nx affected`
+     * run for a foregone answer.
+     *
+     * Without this check a repo with NO checklists has nothing forcing stage ②: `assertEveryReviewerRan`
+     * is vacuous, and review.json — the only other interlock — is a file the AI writes itself. It could
+     * write it and come straight here, skipping the merge validation and the build entirely.
+     */
+    private assertReviewStageRan;
     /**
      * Refuse the PR while ANY applicable checklist still owes a verdict, naming exactly those reviewers and
-     * exactly what to tell them — via the same renderer `wp-checklist` uses, so the AI sees the identical
+     * exactly what to tell them — via the same renderer `wp-review-upsert-pr` uses, so the AI sees the identical
      * block it would have seen there. Lists ONLY the outstanding ones: re-instructing an already-reviewed
      * checklist invites a redundant second run and reads as though the earlier verdict did not count.
      * No-op for a repo with no applicable checklists.
@@ -50,6 +87,19 @@ export declare class FinishUpsertPrCommand {
     private commentRows;
     private gateTokenBody;
     private enforceProvenance;
+    /**
+     * What each credited reviewer actually read. Purely observational here — {@link evidenceErrors} decides
+     * whether any of it blocks, and by default none of it does.
+     */
+    private gatherEvidence;
+    /**
+     * WARN (default) or REFUSE (opt-in) on a reviewer that wrote a verdict without opening the diff.
+     *
+     * Default-warn because the signal is derived from undocumented Claude Code transcript internals: if the
+     * format shifts, a blocking check wedges every PR in every consumer repo with no self-service recovery.
+     * `requireDiffEvidence` lets a repo that has watched the warning promote it deliberately.
+     */
+    private evidenceErrors;
     /**
      * Publish the roster + every reviewer's full `output` as ONE combined PR comment, idempotently (find the
      * marker comment → PATCH it, else POST). Never fatal: by here the PR is already created/updated, so a

package/src/scripts/commands/finish-upsert-pr-command.js

@@ -13,12 +13,23 @@ const checklist_scanner_1 = require("../workflow/checklist-scanner");
 const git_exec_1 = require("../workflow/git-exec");
 const build_affected_1 = require("../workflow/build-affected");
 const merge_state_1 = require("../workflow/merge-state");
-const merge_end_1 = require("../workflow/merge-end");
-const merge_start_1 = require("../workflow/merge-start");
+const review_stage_receipt_1 = require("../workflow/review-stage-receipt");
 const pr_merger_1 = require("../workflow/pr-merger");
 const gated_pr_publisher_1 = require("../workflow/gated-pr-publisher");
 const dashboard_1 = require("../../dashboard/dashboard");
 const SEP = '━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n';
+/**
+ * The provenance outcome: whether each reviewer was VERIFIED to have run (the integrity check, which
+ * blocks) plus what each one actually read (the quality signal, which is published). Data-only.
+ */
+class ProvenanceReport {
+    verified;
+    evidence;
+    constructor(verified, evidence) {
+        this.verified = verified;
+        this.evidence = evidence;
+    }
+}
 // A resolved PR's number + web URL. Both '' when the PR can't be resolved (e.g. create failed).
 class PrRef {
     number;
@@ -41,10 +52,16 @@ class UpsertResult {
         this.merge = merge;
     }
 }
-// FINISH of the AI-first PR flow. Runs after the AI wrote review.json. In order: (1) if a 3-point merge
-// was in progress, validate + commit + FINALIZE via merge-END; (2) REQUIRE review.json; (3) run the
-// authoritative build gate; (4) render the dashboard; (5) create/update the PR via `gh`. The ONLY
-// command that posts PRs.
+// STAGE ③ — FINISH of the AI-first PR flow, and the ONLY command that posts PRs. Runs after
+// `wp-review-upsert-pr` verified the branch and the AI spawned the reviewers + wrote review.json.
+//
+// In order: (1) REFUSE on an unvalidated 3-point merge and REQUIRE stage ②'s receipt; (2) REQUIRE
+// review.json + every reviewer's verdict + provenance; (3) run the build gate UNLESS the receipt already
+// covers this exact HEAD; (4) render the dashboard; (5) create/update the PR via `gh`.
+//
+// It no longer FINALIZES a merge — stage ② does. Two commands owning conflict-resolution validation is two
+// implementations that drift, and finalizing here came too late to help anyway: the reviewers had already
+// reviewed the pre-merge tree by then.
 let FinishUpsertPrCommand = class FinishUpsertPrCommand {
     repoRootFinder;
     aiBranchName;
@@ -52,7 +69,6 @@ let FinishUpsertPrCommand = class FinishUpsertPrCommand {
     gitExec;
     buildAffected;
     mergeState;
-    mergeEnd;
     prMerger;
     publisher;
     dashboard;
@@ -61,14 +77,14 @@ let FinishUpsertPrCommand = class FinishUpsertPrCommand {
     gateTokenService;
     provenance;
     instructions;
-    constructor(repoRootFinder, aiBranchName, branchNaming, gitExec, buildAffected, mergeState, mergeEnd, prMerger, publisher, dashboard, checklistScanner, reviewJsonService, gateTokenService, provenance, instructions) {
+    receipts;
+    constructor(repoRootFinder, aiBranchName, branchNaming, gitExec, buildAffected, mergeState, prMerger, publisher, dashboard, checklistScanner, reviewJsonService, gateTokenService, provenance, instructions, receipts) {
         this.repoRootFinder = repoRootFinder;
         this.aiBranchName = aiBranchName;
         this.branchNaming = branchNaming;
         this.gitExec = gitExec;
         this.buildAffected = buildAffected;
         this.mergeState = mergeState;
-        this.mergeEnd = mergeEnd;
         this.prMerger = prMerger;
         this.publisher = publisher;
         this.dashboard = dashboard;
@@ -77,17 +93,19 @@ let FinishUpsertPrCommand = class FinishUpsertPrCommand {
         this.gateTokenService = gateTokenService;
         this.provenance = provenance;
         this.instructions = instructions;
+        this.receipts = receipts;
     }
     async run() {
         const repoRoot = this.repoRootFinder.resolveRepoRoot(process.cwd());
         // Refresh the AI-facing workflow doc so it's present + current for any failure message to cite.
         (0, rules_config_1.writeTemplate)(repoRoot, 'webpieces.git-workflow.md');
-        // 1. Finish any in-progress conflict resolution: validate + commit + finalize the branch swap.
-        await this.finalizeAnyInProgressMerge(repoRoot);
+        // 1. REQUIRE stage ② — see assertStageTwoRan. Returns true when its receipt covers THIS commit,
+        //    which is what lets the build gate below be skipped rather than re-run for a foregone answer.
+        const buildAlreadyGreen = this.assertStageTwoRan(repoRoot);
         // 2. REQUIRE the AI-authored review.json (throws InformAiError with the schema if missing/invalid).
         //    Compute the consumer checklists this diff triggered FIRST so an unacknowledged BLOCK throws
         //    here — BEFORE any `gh pr create` — matching the guarantee buildCommand already provides.
-        // The SAME scan wp-checklist runs, with filterAlreadyReviewed:true so `outstanding` is exactly what
+        // The SAME scan wp-review-upsert-pr runs, with filterAlreadyReviewed:true so `outstanding` is exactly what
         // still owes a verdict (Z of N of X). Sharing the computation is the point: the command that REPORTS
         // and the command that GATES must not be able to disagree about what is owed. review-<id>.json files
         // persist locally, so a re-run re-validates the EXISTING verdicts against the (possibly changed)
@@ -105,11 +123,11 @@ let FinishUpsertPrCommand = class FinishUpsertPrCommand {
         //     artifacts) that such a subagent actually ran on this branch — the coding agent may not
         //     self-certify. Absent CLAUDE_CODE_SESSION_ID this skips with a warning (CI / plain terminal).
         const currentBranch = (0, child_process_1.execSync)('git branch --show-current', { encoding: 'utf8' }).trim();
-        const provenanceVerified = this.enforceProvenance(required, currentBranch);
+        const provenance = this.enforceProvenance(required, currentBranch, repoRoot, (0, rules_config_1.loadAndValidate)(repoRoot).prGate);
         // 2b. The build gate validates the WORKING TREE but we push HEAD — so they MUST be identical.
         this.gitExec.assertCleanTree(repoRoot);
-        // 3. Authoritative build gate, then post the gated body, then push (that ORDER — see GatedPrPublisher).
-        this.buildAffected.runBuildGate(repoRoot, new build_affected_1.BuildGateOptions('🛠️  Build gate (authoritative)', 'pnpm wp-finish-upsert-pr', 'Build failed — no PR created/updated.'));
+        // 3. Build gate, then post the gated body, then push (that ORDER — see GatedPrPublisher).
+        this.runOrSkipBuildGate(repoRoot, buildAlreadyGreen);
         const base = this.branchNaming.baseBranchName((0, child_process_1.execSync)('git branch --show-current', { encoding: 'utf8' }).trim());
         process.stdout.write('\n' + SEP + '📋 Dashboard + PR\n' + SEP + '\n');
         const title = this.prTitleFrom(review);
@@ -125,7 +143,7 @@ let FinishUpsertPrCommand = class FinishUpsertPrCommand {
         const result = this.upsertPr(repoRoot, base, body, title, input);
         // Publish each reviewer's full output as ONE combined PR comment (idempotent, opt-out-aware). Never
         // fatal — the PR is already up by now, so a comment failure only warns.
-        this.postChecklistComment(repoRoot, result.prNumber, scan, review, provenanceVerified);
+        this.postChecklistComment(repoRoot, result.prNumber, scan, review, provenance);
         const prNum = result.prNumber;
         process.stdout.write('\n' + SEP + '✅ PR finished — here is exactly what I did\n' + SEP + '\n' +
             `   1. validated the build gate (authoritative)\n` +
@@ -150,17 +168,85 @@ let FinishUpsertPrCommand = class FinishUpsertPrCommand {
     // Validate + commit + finalize a 3-point merge the AI resolved, if one is in progress. Finalizing here
     // does NOT push (pushRemote=false): this command pushes exactly ONCE, from GatedPrPublisher, and only
     // after review.json + every BLOCK checklist + the build gate pass and the gated PR body is written.
-    async finalizeAnyInProgressMerge(repoRoot) {
+    /**
+     * The build gate — SKIPPED when stage ②'s receipt already covers this exact HEAD.
+     *
+     * The gate is authoritative per-COMMIT, not per-command: re-running it on a tree that has not moved
+     * since stage ② verified it buys nothing and costs a full `nx affected`. That skip is what makes the
+     * three-stage flow cost ONE build rather than two, and it is why moving the gate earlier was affordable.
+     */
+    runOrSkipBuildGate(repoRoot, alreadyGreen) {
+        if (alreadyGreen) {
+            process.stdout.write('\n🛠️  Build gate: already green for this commit (stage ② receipt) — skipping the rebuild.\n');
+            return;
+        }
+        this.buildAffected.runBuildGate(repoRoot, new build_affected_1.BuildGateOptions('🛠️  Build gate (authoritative)', 'pnpm wp-finish-upsert-pr', 'Build failed — no PR created/updated.'));
+    }
+    /**
+     * The two stage-② preconditions, together: no unvalidated merge, and a receipt proving stage ② ran.
+     * Returns true when that receipt covers the CURRENT HEAD, i.e. the build gate can be skipped.
+     */
+    assertStageTwoRan(repoRoot) {
+        this.assertNoUnvalidatedMerge(repoRoot);
+        return this.assertReviewStageRan(repoRoot, this.aiBranchName.getFeatureName(), this.gitOut(['rev-parse', 'HEAD']));
+    }
+    /**
+     * REFUSE while a 3-point merge is still unvalidated — do not finalize it here.
+     *
+     * This command used to do the finalizing itself. Finalizing means validating a conflict resolution, and
+     * two commands owning that means two implementations that can drift; `PrContextWriter`'s docstring
+     * records this codebase already paying for exactly that once. It also came too late to matter: by the
+     * time finish ran, the reviewers had already reviewed the pre-merge tree.
+     *
+     * So stage ② owns it, and finish only checks. Nothing is lost — the recovery is one command away, and
+     * running it also builds the merged tree and re-briefs the reviewers against it, which finalizing here
+     * never did.
+     */
+    assertNoUnvalidatedMerge(repoRoot) {
         const home = this.mergeState.mergeDirFor(repoRoot, this.aiBranchName.getFeatureName());
         const activeDir = this.mergeState.findActiveMergeRunDir(home);
         const marker = activeDir ? this.mergeState.readMergeMarker(activeDir) : null;
         if (!activeDir || !marker || marker.validated)
             return;
-        await this.mergeEnd.mergeEnd(repoRoot, 'wp-finish-upsert-pr', activeDir, new merge_start_1.MergeContext(marker.currentBranch, marker.squashBranch, marker.backupBranch, marker.prNumber), new merge_end_1.MergeEndOptions(marker.conflictedFiles, false));
+        throw new rules_config_1.InformAiError('⛔ NO PR — a 3-point merge on this branch is still unvalidated, so nothing here has been\n' +
+            'verified: the conflict resolution is unchecked, the merged tree was never built, and any\n' +
+            'reviewer that ran judged the PRE-merge code.\n\n' +
+            `Conflicted file(s): ${marker.conflictedFiles.join(', ')}\n\n` +
+            'Resolve them (see .webpieces/instruct-ai/webpieces.mergeprocess.md), then run:\n' +
+            '  pnpm wp-review-upsert-pr\n' +
+            'It validates the resolution, commits it, builds it, and re-briefs the reviewers.');
+    }
+    /**
+     * REQUIRE stage ② (`wp-review-upsert-pr`) to have run, and report whether it ran on THIS commit.
+     *
+     * Returns true when the receipt matches the current HEAD — the caller then skips its own build, because
+     * the receipt IS the gate for that sha and rebuilding an unchanged tree is a second full `nx affected`
+     * run for a foregone answer.
+     *
+     * Without this check a repo with NO checklists has nothing forcing stage ②: `assertEveryReviewerRan`
+     * is vacuous, and review.json — the only other interlock — is a file the AI writes itself. It could
+     * write it and come straight here, skipping the merge validation and the build entirely.
+     */
+    assertReviewStageRan(repoRoot, featureName, headSha) {
+        const receipt = this.receipts.read(repoRoot, featureName);
+        if (receipt === null) {
+            throw new rules_config_1.InformAiError('⛔ NO PR — stage ② never ran on this branch. That means the 3-point merge is unvalidated,\n' +
+                'the build gate has not run, no diff was extracted, and no reviewer was briefed.\n\n' +
+                'Run:  pnpm wp-review-upsert-pr\n' +
+                '(then spawn the reviewers it names, write review.json, and re-run this command)');
+        }
+        if (receipt.headSha === headSha)
+            return true;
+        // Not fatal. Re-reviewing on every follow-up commit would be intolerable, and most drift is a typo
+        // fix. But it is never silent: the build re-runs here, and the PR says the reviewers saw an older tree.
+        process.stderr.write(`\n⚠️  HEAD moved since stage ② ran (reviewed ${receipt.headSha.slice(0, 8)}, now ${headSha.slice(0, 8)}).\n` +
+            '   The build gate will re-run, and the PR will record that reviewers judged an earlier tree.\n' +
+            '   If the change was substantive, re-run pnpm wp-review-upsert-pr and re-spawn the reviewers.\n\n');
+        return false;
     }
     /**
      * Refuse the PR while ANY applicable checklist still owes a verdict, naming exactly those reviewers and
-     * exactly what to tell them — via the same renderer `wp-checklist` uses, so the AI sees the identical
+     * exactly what to tell them — via the same renderer `wp-review-upsert-pr` uses, so the AI sees the identical
      * block it would have seen there. Lists ONLY the outstanding ones: re-instructing an already-reviewed
      * checklist invites a redundant second run and reads as though the earlier verdict did not count.
      * No-op for a repo with no applicable checklists.
@@ -179,7 +265,9 @@ let FinishUpsertPrCommand = class FinishUpsertPrCommand {
             `branch have no passing verdict yet: ${this.instructions.names(scan.outstanding)}\n\n` +
             format +
             `${this.instructions.render(scan.outstanding, scan.reviewPath, scan.context)}\n\n` +
-            `Then re-run: pnpm wp-finish-upsert-pr   (or check anytime with: pnpm wp-checklist)`);
+            `Then re-run: pnpm wp-finish-upsert-pr\n` +
+            `(Each reviewer's generated instructions file is already written — re-running wp-review-upsert-pr\n` +
+            ` is only needed if the code changed since it ran.)`);
     }
     gitOut(args) {
         const result = (0, child_process_1.spawnSync)('git', args, { encoding: 'utf8' });
@@ -220,7 +308,11 @@ let FinishUpsertPrCommand = class FinishUpsertPrCommand {
      * absent from `applicable` by construction, and their "why not" evidence (the configured globs and the
      * changed-file total) exists nowhere else without recomputing the diff a second way.
      */
-    commentRows(scan, review) {
+    commentRows(scan, review, provenance) {
+        // agentType -> did it open the diff. Absent ⇒ not assessed, which prints nothing (see ChecklistCommentRow.diffRead).
+        const readByAgent = new Map();
+        for (const e of provenance.evidence)
+            readByAgent.set(e.agentType, e.readDiff);
         return scan.roster.entries.map((entry) => {
             const ran = entry.matchedFiles.length > 0;
             const req = new rules_config_1.RequiredChecklist(entry.def.id, entry.def.subagent, entry.def.doc, entry.matchedFiles, entry.matchedPatterns);
@@ -229,7 +321,10 @@ let FinishUpsertPrCommand = class FinishUpsertPrCommand {
             const verdict = ran
                 ? this.reviewJsonService.resolveVerdict(req, review.results)
                 : new rules_config_1.ChecklistVerdict(entry.def.id, '', '');
-            return new dashboard_1.ChecklistCommentRow(entry.def.subagent, verdict.status, verdict.detail, ran, entry.def.patterns, entry.matchedPatterns, entry.matchedFiles, scan.roster.changedFileCount);
+            const row = new dashboard_1.ChecklistCommentRow(entry.def.subagent, verdict.status, verdict.detail, ran, entry.def.patterns, entry.matchedPatterns, entry.matchedFiles, scan.roster.changedFileCount);
+            const read = readByAgent.get(entry.def.subagent);
+            row.diffRead = read === undefined ? '' : (read ? 'yes' : 'no');
+            return row;
         });
     }
     // Hidden HMAC gate-token marker (with a leading blank line) to append to the PR body, or '' when the
@@ -241,26 +336,62 @@ let FinishUpsertPrCommand = class FinishUpsertPrCommand {
     // Enforce that EACH matched checklist was reviewed by its OWN named subagent, as a DISTINCT run —
     // the coding agent may not self-certify, and one reviewer may not stand in for several. A verified set
     // passes silently; no session id warns but passes; any missing reviewer throws so the PR does not open.
-    enforceProvenance(required, branch) {
+    // eslint-disable-next-line @typescript-eslint/max-params
+    enforceProvenance(required, branch, repoRoot, config) {
         const errors = [];
-        let verified = true; // no reviewers to verify ⇒ vacuously true
+        const report = new ProvenanceReport(true, []); // no reviewers to verify ⇒ vacuously verified
         const subagents = required.map((r) => r.subagent.trim()).filter((s) => s !== '');
         if (subagents.length > 0) {
             const result = this.provenance.verifyDistinct(subagents, branch);
-            verified = result.status === rules_config_1.PROVENANCE_OK;
+            report.verified = result.status === rules_config_1.PROVENANCE_OK;
             if (result.status === rules_config_1.PROVENANCE_MISSING) {
                 errors.push(result.detail);
             }
             else if (result.status === rules_config_1.PROVENANCE_SKIPPED) {
                 process.stderr.write(`⚠️  ${result.detail}\n`);
             }
+            report.evidence = this.gatherEvidence(repoRoot, required, result, branch);
+            errors.push(...this.evidenceErrors(report.evidence, config));
         }
         if (errors.length > 0) {
             throw new rules_config_1.InformAiError(`${errors.length} checklist(s) require an independent reviewer subagent that did not run — fix, then re-run pnpm wp-finish-upsert-pr:\n\n` +
                 errors.map((e) => `  • ${e}`).join('\n') +
                 `\n\nSpawn the named reviewer subagent to review the checklist on THIS branch, then re-run.`);
         }
-        return verified;
+        return report;
+    }
+    /**
+     * What each credited reviewer actually read. Purely observational here — {@link evidenceErrors} decides
+     * whether any of it blocks, and by default none of it does.
+     */
+    // eslint-disable-next-line @typescript-eslint/max-params
+    gatherEvidence(repoRoot, required, result, branch) {
+        const docPaths = {};
+        for (const req of required) {
+            if (req.subagent.trim() !== '')
+                docPaths[req.subagent] = req.doc.trim() === '' ? '' : path.resolve(repoRoot, req.doc);
+        }
+        const diffDir = path.join((0, rules_config_1.prDirFor)(repoRoot, this.aiBranchName.getFeatureName()), 'diff');
+        return this.provenance.evidenceFor(new rules_config_1.EvidenceRequest(branch, result.agentIds, diffDir, docPaths));
+    }
+    /**
+     * WARN (default) or REFUSE (opt-in) on a reviewer that wrote a verdict without opening the diff.
+     *
+     * Default-warn because the signal is derived from undocumented Claude Code transcript internals: if the
+     * format shifts, a blocking check wedges every PR in every consumer repo with no self-service recovery.
+     * `requireDiffEvidence` lets a repo that has watched the warning promote it deliberately.
+     */
+    evidenceErrors(evidence, config) {
+        const blind = evidence.filter((e) => !e.readDiff);
+        if (blind.length === 0)
+            return [];
+        const names = blind.map((e) => e.agentType).join(', ');
+        if (!config.requireDiffEvidence) {
+            process.stderr.write(`\n⚠️  ${blind.length} reviewer(s) wrote a verdict with no record of opening the extracted diff: ${names}\n` +
+                '   Published on the PR as a note. Not blocking — set pr-gate.requireDiffEvidence:true to make it one.\n');
+            return [];
+        }
+        return [`these reviewers wrote a verdict without opening the diff (pr-gate.requireDiffEvidence is on): ${names}`];
     }
     /**
      * Publish the roster + every reviewer's full `output` as ONE combined PR comment, idempotently (find the
@@ -273,12 +404,13 @@ let FinishUpsertPrCommand = class FinishUpsertPrCommand {
      * checklists configured must still see no comment at all (see ChecklistNotice / renderDashboard).
      */
     // eslint-disable-next-line @typescript-eslint/max-params
-    postChecklistComment(repoRoot, prNumber, scan, review, provenanceVerified) {
+    // eslint-disable-next-line @typescript-eslint/max-params
+    postChecklistComment(repoRoot, prNumber, scan, review, provenance) {
         if (prNumber === '' || scan.defined.length === 0)
             return;
         if (!(0, rules_config_1.loadAndValidate)(repoRoot).prGate.checklistComments)
             return;
-        const body = this.dashboard.renderChecklistComment(this.commentRows(scan, review), provenanceVerified, scan.roster.baseResolved);
+        const body = this.dashboard.renderChecklistComment(this.commentRows(scan, review, provenance), provenance.verified, scan.roster.baseResolved);
         const prDir = (0, rules_config_1.prDirFor)(repoRoot, this.aiBranchName.getFeatureName());
         fs.mkdirSync(prDir, { recursive: true });
         const payload = path.join(prDir, 'checklist-comment.json');
@@ -356,7 +488,6 @@ exports.FinishUpsertPrCommand = FinishUpsertPrCommand = tslib_1.__decorate([
         git_exec_1.GitExec,
         build_affected_1.BuildAffected,
         merge_state_1.MergeState,
-        merge_end_1.MergeEnd,
         pr_merger_1.PrMerger,
         gated_pr_publisher_1.GatedPrPublisher,
         dashboard_1.Dashboard,
@@ -364,6 +495,7 @@ exports.FinishUpsertPrCommand = FinishUpsertPrCommand = tslib_1.__decorate([
         rules_config_1.ReviewJsonService,
         rules_config_1.GateTokenService,
         rules_config_1.SubagentProvenanceService,
-        rules_config_1.ChecklistInstructionsService])
+        rules_config_1.ChecklistInstructionsService,
+        review_stage_receipt_1.ReviewStageReceiptService])
 ], FinishUpsertPrCommand);
 //# sourceMappingURL=finish-upsert-pr-command.js.map