greprag 5.80.0 → 5.82.0

package/dist/commands/skillgain.js

@@ -24,6 +24,8 @@ const HELP = `greprag skillgain — Skill Learning Loop queue (docs/skill-learni
 
 USAGE
   greprag skillgain list             Pending gains for this project (not yet landed).
+  greprag skillgain list --all       Pending gains across EVERY project, labelled
+                                     by the project each came from.
   greprag skillgain reject <8hex>    The UNDO: mark a gain bogus AND remove its
                                      landed artifacts (the fuse line in SKILL.md
                                      + the docs/learned/<slug>.md doc).
@@ -31,6 +33,9 @@ USAGE
                                      (rarely needed — landing is automatic and a
                                      digested fuse needs no marking).
 
+reject/done address a gain by its id, which is unique across every project —
+they work from any directory, no need to stand in the gain's own repo.
+
 Gains land automatically at session start as a briefcase (fuse line + focused
 doc) and SELF-APPLY on the skill's next invocation.`;
 async function runSkillGain(args) {
@@ -40,11 +45,14 @@ async function runSkillGain(args) {
         console.error('GREPRAG_API_KEY not set — run `greprag init` first.');
         process.exit(1);
     }
-    const anchor = (0, project_anchor_1.readAnchor)(process.cwd());
     if (sub === 'list') {
-        const res = await fetch(`${cfg.apiUrl}/v1/skillgain/${anchor.projectId}/pending`, {
-            headers: { 'Authorization': `Bearer ${cfg.apiKey}` },
-        });
+        // --all is tenant-wide and needs no anchor; the default view is this
+        // project's queue, so only that branch resolves one.
+        const all = args.includes('--all');
+        const url = all
+            ? `${cfg.apiUrl}/v1/skillgain/pending`
+            : `${cfg.apiUrl}/v1/skillgain/${(0, project_anchor_1.readAnchor)(process.cwd()).projectId}/pending`;
+        const res = await fetch(url, { headers: { 'Authorization': `Bearer ${cfg.apiKey}` } });
         if (!res.ok) {
             console.error(`API ${res.status}`);
             process.exit(1);
@@ -52,11 +60,14 @@ async function runSkillGain(args) {
         const data = await res.json();
         const gains = data.gains || [];
         if (gains.length === 0) {
-            console.log('No pending skill gains.');
+            console.log(all ? 'No pending skill gains in any project.' : 'No pending skill gains.');
+            if (!all)
+                console.log('(this project only — `greprag skillgain list --all` covers every project)');
             return;
         }
         for (const g of gains) {
-            console.log(`[${g.nodeId}] ${g.skill} · ${g.gainType}\n  ${g.text}`);
+            const where = all && g.projectName ? ` · @${g.projectName}` : '';
+            console.log(`[${g.nodeId}] ${g.skill} · ${g.gainType}${where}\n  ${g.text}`);
         }
         return;
     }
@@ -67,13 +78,13 @@ async function runSkillGain(args) {
             process.exit(1);
         }
         const status = sub === 'done' ? 'landed' : 'rejected';
-        const res = await fetch(`${cfg.apiUrl}/v1/skillgain/${anchor.projectId}/status`, {
+        // Id-addressed and tenant-wide: no projectId in the path, no anchor read,
+        // so this resolves the gain wherever it was captured rather than only in
+        // the repo the operator happens to be standing in.
+        const res = await fetch(`${cfg.apiUrl}/v1/skillgain/status`, {
             method: 'POST',
             headers: { 'Authorization': `Bearer ${cfg.apiKey}`, 'Content-Type': 'application/json' },
-            body: JSON.stringify({
-                projectName: anchor.projectName,
-                updates: [{ nodeId, status }],
-            }),
+            body: JSON.stringify({ updates: [{ nodeId, status }] }),
         });
         if (!res.ok) {
             console.error(`API ${res.status}`);
@@ -81,24 +92,21 @@ async function runSkillGain(args) {
         }
         const data = await res.json();
         if ((data.updated || 0) === 0) {
-            console.error(`[${nodeId}] not found in ${anchor.projectName}'s skillgain queue.`);
+            console.error(`[${nodeId}] no such skill gain in this tenant.`);
+            console.error('List what is pending with `greprag skillgain list --all`.');
             process.exit(1);
         }
-        console.log(`[${nodeId}] → ${status}`);
+        const hit = (data.resolved || [])[0];
+        console.log(`[${nodeId}] → ${status}${hit?.projectName ? ` (from @${hit.projectName})` : ''}`);
         // Reject is the UNDO: also remove any landed artifacts (the fuse line in
-        // SKILL.md + the docs/learned/<slug>.md doc). Skill name via the record.
-        if (sub === 'reject') {
+        // SKILL.md + the docs/learned/<slug>.md doc). The status call already told
+        // us the skill, so this needs no second lookup.
+        if (sub === 'reject' && hit?.skill) {
             try {
-                const gr = await fetch(`${cfg.apiUrl}/v1/skillgain/${anchor.projectId}/gain/${nodeId}`, { headers: { 'Authorization': `Bearer ${cfg.apiKey}` } });
-                if (gr.ok) {
-                    const gd = await gr.json();
-                    if (gd.gain?.skill) {
-                        const homeDir = process.env.HOME || process.env.USERPROFILE || '';
-                        const removed = (0, skill_landing_1.removeLandedGain)(gd.gain.skill, nodeId, process.cwd(), homeDir);
-                        if (removed)
-                            console.log(`  removed landed artifacts from ${gd.gain.skill}`);
-                    }
-                }
+                const homeDir = process.env.HOME || process.env.USERPROFILE || '';
+                const removed = (0, skill_landing_1.removeLandedGain)(hit.skill, nodeId, process.cwd(), homeDir);
+                if (removed)
+                    console.log(`  removed landed artifacts from ${hit.skill}`);
             }
             catch { /* best-effort — the stamp makes manual cleanup findable */ }
         }

package/dist/delivery-lifecycle.js

@@ -1,8 +1,9 @@
 "use strict";
 /** Lifecycle verbs governed by the announce-first Delivery System pilot. */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DELIVERY_LIFECYCLE_VERBS = void 0;
+exports.DELIVERY_OWNED_VERBS = exports.DELIVERY_LIFECYCLE_VERBS = void 0;
 exports.isDeliveryLifecycleVerb = isDeliveryLifecycleVerb;
+exports.isDeliveryOwnedVerb = isDeliveryOwnedVerb;
 exports.DELIVERY_LIFECYCLE_VERBS = [
     'commit', 'merge', 'push', 'deploy', 'release',
 ];
@@ -10,3 +11,17 @@ const DELIVERY_LIFECYCLE_SET = new Set(exports.DELIVERY_LIFECYCLE_VERBS);
 function isDeliveryLifecycleVerb(verb) {
     return DELIVERY_LIFECYCLE_SET.has((verb || '').trim().toLowerCase());
 }
+/** Verbs whose recipe the repo's **Delivery Profile document** owns. A procedure
+ *  row for one of these may POINT at a profile section; it may never hold a copy
+ *  of that section's text, be hand-registered with steps, or be written by the
+ *  LEARN leg. The five lifecycle verbs qualify by the pilot. `verify` qualifies
+ *  because "is my change live" is answered by the deploy document's own liveness
+ *  section — it is the second half of deploy, not a separate recipe.
+ *  adr: adr/delivery-owned-procedures.md */
+exports.DELIVERY_OWNED_VERBS = [
+    ...exports.DELIVERY_LIFECYCLE_VERBS, 'verify',
+];
+const DELIVERY_OWNED_SET = new Set(exports.DELIVERY_OWNED_VERBS);
+function isDeliveryOwnedVerb(verb) {
+    return DELIVERY_OWNED_SET.has((verb || '').trim().toLowerCase());
+}

package/dist/deploy-gate.js

@@ -0,0 +1,355 @@
+"use strict";
+/** deploy-gate.ts — the harness-independent half of a repo's deploy gate.
+ *
+ *  WHY THIS EXISTS. `scripts/lib/canonical-deploy.mjs` carries a delimited
+ *  "shared block" that is byte-identical in C:/sift and C:/suppliersift-site,
+ *  held in sync by a sha256 literal in each repo's contract test. That detects
+ *  drift; it does not prevent it, and it makes onboarding a third repo cost a
+ *  ~380-line paste plus a hash. Everything in that block answers questions that
+ *  do not depend on how a target's artifact is produced — WHERE a deploy may run
+ *  from, WHETHER one is already running, WHAT is shipping — so it belongs in one
+ *  place that every repo already has: this CLI.
+ *
+ *  WHAT STAYS IN THE REPO. The artifact proof. The worker guards its working
+ *  tree because wrangler bundles it from disk; the site guards `dist/` because
+ *  it uploads a directory built earlier. Those are different objects and the
+ *  gate never pretends to know them — it reports `artifact` as repo-owned and
+ *  the caller supplies the proof.
+ *
+ *  READ-ONLY BY CONSTRUCTION. Nothing here acquires a lock, writes a ledger, or
+ *  mutates a checkout. That is what makes it safe to run in shadow beside a
+ *  live gate: a shadow run must never be able to affect the deploy it observes.
+ *  Acquiring the lock is the caller's job and stays in the repo until the flip.
+ *
+ *  # adr: adr/deploy-gate-cli.md
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LOCATION_CHECKS = exports.DEPLOY_GATE_VERSION = void 0;
+exports.normalizePath = normalizePath;
+exports.shippingSummaryLines = shippingSummaryLines;
+exports.evaluateDeployGate = evaluateDeployGate;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const proc_1 = require("./proc");
+const delivery_config_1 = require("./delivery-config");
+const deploy_locks_1 = require("./deploy-locks");
+/** Bump when a check is added, removed, or changes verdict for the same repo state.
+ *  The shadow log records it, so a disagreement can be attributed to a version
+ *  rather than to the repo, and the flip can assert a floor.
+ *
+ *  v2 — added `merge-state` and `merge-lock`.
+ *  v3 — added `provenance`.
+ *  v4 — canonicalRoot is optional; absent means a ref-shipping repo, where the branch
+ *       check also accepts a tip that is a fast-forward of the remote default branch. */
+exports.DEPLOY_GATE_VERSION = 4;
+/** The checks the repo gates already perform for themselves. The shadow harness
+ *  compares against THIS subset, so a refusal on a check no repo gate has yet is
+ *  recorded as the CLI being stricter rather than as the two gates disagreeing. */
+exports.LOCATION_CHECKS = ['profile', 'canonical-root', 'primary-checkout', 'branch'];
+function normalizePath(value) {
+    return path.resolve(value).replace(/\\/g, '/').replace(/\/+$/, '').toLowerCase();
+}
+function git(args, cwd) {
+    const result = (0, proc_1.safeSpawnSync)('git', args, {
+        encoding: 'utf8', cwd, stdio: ['ignore', 'pipe', 'pipe'],
+    });
+    if (result.status !== 0)
+        throw new Error(`git ${args.join(' ')} failed`);
+    return String(result.stdout || '').trim();
+}
+/** The ledger lives inside `.git` beside the locks, so it is never tree dirt and
+ *  can never be committed. The `sift-` basename is the name already on disk in
+ *  both repos — the gate reads the real file rather than a parallel one. */
+const LOCK_PREFIX = process.env.GREPRAG_DEPLOY_LOCK_PREFIX || 'sift';
+function lastDeployPath(cwd, target) {
+    return path.join(git(['rev-parse', '--absolute-git-dir'], cwd), `${LOCK_PREFIX}-last-deploy-${target}.json`);
+}
+function minutes(ms) {
+    return Number.isFinite(ms) ? `${Math.round(ms / 60000)}m` : 'unknown age';
+}
+/** Pure: turn `git log` porcelain into the lines a deployer should read before
+ *  uploading. Each line is `<sha>\t<author date ISO>\t<author>: <subject>`.
+ *
+ *  A commit authored BEFORE the last deploy but only shipping now is
+ *  late-arriving code — the signature of a stale branch merged long after it was
+ *  cut. Author date is the right clock: rebase and cherry-pick rewrite the
+ *  committer date, so only the author date remembers when the code was written.
+ *  A notice, never a gate. */
+function shippingSummaryLines(logOutput, lastSha, sinceIso) {
+    const commits = String(logOutput || '')
+        .split('\n')
+        .map(line => line.trim())
+        .filter(line => line.length > 0)
+        .map(line => {
+        const [sha, authoredIso, rest] = line.split('\t');
+        return rest === undefined
+            ? { text: line, authoredIso: null }
+            : { text: `${sha} ${rest}`, authoredIso };
+    });
+    if (!lastSha)
+        return ['no record of a previous deploy from this checkout; shipping HEAD as-is'];
+    if (commits.length === 0)
+        return [`nothing new since the last deploy from here (${lastSha.slice(0, 10)})`];
+    const since = sinceIso ? Date.parse(sinceIso) : NaN;
+    const stale = Number.isNaN(since)
+        ? []
+        : commits.filter(c => c.authoredIso && Date.parse(c.authoredIso) < since);
+    return [
+        `shipping ${commits.length} commit(s) since the last deploy from here (${lastSha.slice(0, 10)}):`,
+        ...commits.map(c => `  ${c.text}`),
+        ...(stale.length
+            ? [
+                `note: ${stale.length} of these were written before that deploy — old code arriving late.`,
+                '      Expected when sweeping an older branch. Unexpected here means a stale merge.',
+            ]
+            : []),
+    ];
+}
+function shippingSummary(cwd, target) {
+    let lastSha = null;
+    try {
+        const record = JSON.parse(fs.readFileSync(lastDeployPath(cwd, target), 'utf8'));
+        lastSha = typeof record?.sha === 'string' && record.sha ? record.sha : null;
+    }
+    catch {
+        lastSha = null;
+    }
+    if (!lastSha)
+        return shippingSummaryLines('', null);
+    try {
+        const log = git(['log', '--no-merges', '--format=%h%x09%aI%x09%an: %s', `${lastSha}..HEAD`], cwd);
+        const sinceIso = git(['log', '-1', '--format=%aI', lastSha], cwd);
+        return shippingSummaryLines(log, lastSha, sinceIso);
+    }
+    catch {
+        // The recorded sha can vanish from history after a reset or a force-push.
+        return [`previous deploy ${lastSha.slice(0, 10)} is no longer in history; shipping HEAD as-is`];
+    }
+}
+/**
+ * Run every repo-independent deploy check and report, without deciding anything.
+ *
+ * Never throws: an internal failure becomes a failing check, because a gate that
+ * crashes instead of refusing is indistinguishable from a gate that passed.
+ */
+function evaluateDeployGate(options = {}) {
+    const cwd = path.resolve(options.cwd || process.cwd());
+    const target = options.target || 'default';
+    const checks = [];
+    const add = (id, status, detail) => { checks.push({ id, status, detail }); };
+    let canonicalRoot = null;
+    let defaultBranch = null;
+    let branch = null;
+    let head = null;
+    let shipping = [];
+    const resolved = (0, delivery_config_1.resolveDeliveryProfile)(cwd);
+    if (resolved.mode !== 'profile' || !resolved.profile) {
+        add('profile', 'fail', `no valid delivery profile (${resolved.mode}): ${resolved.errors.join('; ') || 'none'}`);
+        return finish();
+    }
+    defaultBranch = resolved.profile.git.defaultBranch;
+    // The env override exists so a rescue can deploy from a relocated checkout.
+    // It is deliberately loud in the verdict rather than silent.
+    const override = process.env.GREPRAG_DEPLOY_CANONICAL_ROOT || process.env.SIFT_CANONICAL_ROOT || '';
+    canonicalRoot = override || resolved.profile.deploy?.canonicalRoot || null;
+    add('profile', 'pass', `${resolved.configPath}${override ? ' (canonicalRoot overridden by env)' : ''}`);
+    if (!canonicalRoot) {
+        // A profile with no canonicalRoot is a DECLARATION, not an omission: this repo
+        // ships committed refs, not a working tree. The canonical-checkout rule exists
+        // because a bundler reads files off disk, so a worktree could ship unreleased
+        // edits — `git push` cannot do that, it moves a ref. Paybot's own deploy doc
+        // explicitly allows pushing from a delivery worktree when it is a fast-forward,
+        // and refusing that would impose a disk-artifact rule on a repo with no disk
+        // artifact. Everything else — the locks, merge state, provenance — still applies.
+        add('canonical-root', 'skip', 'no canonicalRoot declared: this repo ships committed refs, not a working tree');
+        add('primary-checkout', 'skip', 'not applicable without a canonicalRoot');
+    }
+    else if (normalizePath(cwd) !== normalizePath(canonicalRoot)) {
+        add('canonical-root', 'fail', `refusing to deploy from ${cwd}. Worktrees are for building. Merge to ${defaultBranch}, then deploy from ${canonicalRoot}.`);
+    }
+    else {
+        add('canonical-root', 'pass', canonicalRoot);
+    }
+    // Only meaningful for a repo that ships a working tree; skipped above otherwise.
+    if (canonicalRoot)
+        try {
+            // Branch name alone is not enough: a clone has its own default branch, and a
+            // linked worktree can sit on one too. The primary checkout is the one whose
+            // git dir IS the common dir.
+            const gitDir = git(['rev-parse', '--absolute-git-dir'], cwd);
+            const common = path.resolve(cwd, git(['rev-parse', '--git-common-dir'], cwd));
+            if (normalizePath(gitDir) !== normalizePath(common)) {
+                add('primary-checkout', 'fail', `refusing to deploy from a git worktree at ${cwd}. Merge to ${defaultBranch}, then deploy from ${canonicalRoot || 'the canonical checkout'}.`);
+            }
+            else {
+                add('primary-checkout', 'pass', gitDir);
+            }
+        }
+        catch (error) {
+            add('primary-checkout', 'fail', message(error));
+        }
+    try {
+        head = git(['rev-parse', 'HEAD'], cwd);
+        branch = git(['rev-parse', '--abbrev-ref', 'HEAD'], cwd);
+        if (process.env.GREPRAG_DEPLOY_ALLOW_BRANCH === '1' || process.env.SIFT_DEPLOY_ALLOW_BRANCH === '1') {
+            add('branch', 'skip', `branch gate disabled by env (on ${branch})`);
+        }
+        else if (branch === defaultBranch) {
+            add('branch', 'pass', branch);
+        }
+        else if (!canonicalRoot && defaultBranch
+            && (0, deploy_locks_1.isAncestorOfHead)(cwd, `${resolved.profile.git.remote || 'origin'}/${defaultBranch}`)) {
+            // Same reasoning as canonical-root: this repo ships a ref, and the guarantee that
+            // matters is that the ref only moves forward. A tip that already contains the
+            // remote's is exactly the fast-forward paybot's deploy doc allows from a delivery
+            // worktree. The remote-tracking ref can be stale, which is why this is the softer
+            // half — git itself refuses a non-fast-forward push, and that is the hard backstop.
+            add('branch', 'pass', `${branch} — not ${defaultBranch}, but a fast-forward of it, so the push only moves the ref forward`);
+        }
+        else {
+            add('branch', 'fail', `refusing to deploy branch ${branch}. Merge to ${defaultBranch}, then deploy from ${canonicalRoot || 'the canonical checkout'}.`);
+        }
+    }
+    catch (error) {
+        add('branch', 'fail', message(error));
+    }
+    if (options.ignoreLock) {
+        add('lock', 'skip', 'caller holds the lock for this target');
+    }
+    else {
+        try {
+            const held = (0, deploy_locks_1.readLock)((0, deploy_locks_1.deployLockPath)(cwd, target));
+            if (!held)
+                add('lock', 'pass', 'no deploy lock held');
+            else if (held.stale)
+                add('lock', 'pass', 'a stale lock is present and would be reclaimed');
+            else {
+                add('lock', 'fail', `another build or deploy is running in this checkout (pid ${held.record.pid}, session ${(0, deploy_locks_1.describeLockOwner)(held.record)}, started ${held.record.startedAt}).`);
+            }
+        }
+        catch (error) {
+            add('lock', 'pass', `no readable deploy lock (${message(error)})`);
+        }
+    }
+    // A merge in progress means the working tree is mid-resolution: a deploy from
+    // here ships neither side cleanly. Git knows this exactly, and on 2026-09-04
+    // nothing asked it — a dead chip left the canonical checkout conflicted and
+    // three sessions rediscovered it one at a time.
+    try {
+        const merge = (0, deploy_locks_1.readMergeState)(cwd);
+        const mergeHeld = (0, deploy_locks_1.readMergeLock)(cwd);
+        if (!merge.inProgress) {
+            add('merge-state', 'pass', 'no merge, rebase, cherry-pick or revert in progress');
+        }
+        else {
+            const unresolved = merge.unresolved.length
+                ? `${merge.unresolved.length} unresolved path(s): ${merge.unresolved.slice(0, 5).join(', ')}`
+                : 'resolved but not committed';
+            // No lock behind an open merge is the abandoned signature: either its owner
+            // died, or it was started by hand and nobody can be asked about it.
+            const owner = mergeHeld && !mergeHeld.stale
+                ? `held by pid ${mergeHeld.record.pid}, session ${(0, deploy_locks_1.describeLockOwner)(mergeHeld.record)}`
+                : 'NOBODY HOLDS THE MERGE LOCK — the owner died or never took one';
+            add('merge-state', 'fail', `a ${merge.kind} has been open in this checkout for ${minutes(merge.ageMs)} (${unresolved}). ${owner}. Finish or abort it before deploying.`);
+        }
+        if (mergeHeld && !mergeHeld.stale) {
+            // Says how to clear it: this check BLOCKS deploys as of the flip, and the
+            // lock is session-held, so a session that dies without releasing would
+            // otherwise stop every deploy in this checkout until the hour ceiling.
+            add('merge-lock', 'fail', `a merge is running in this checkout (pid ${mergeHeld.record.pid}, session ${(0, deploy_locks_1.describeLockOwner)(mergeHeld.record)}, started ${mergeHeld.record.startedAt}, ${minutes(mergeHeld.ageMs)}). Deploying now would ship a half-integrated tree. Wait for it, or if you know that session is gone: greprag merge-lock release`);
+        }
+        else {
+            add('merge-lock', 'pass', mergeHeld ? 'a stale merge lock is present and would be reclaimed' : 'no merge lock held');
+        }
+    }
+    catch (error) {
+        add('merge-state', 'fail', `could not read merge state: ${message(error)}`);
+    }
+    // PROVENANCE. Every other check asks whether this deploy may run. This one asks a
+    // different question: is the work somebody merged actually IN it?
+    //
+    // On 2026-09-04 a session merged, a peer resolved the same conflicted checkout and
+    // completed the merge itself under a new sha, and the first session's merge commit
+    // stopped existing on any branch. Its deploy exited 0 honestly — production really
+    // was serving HEAD — and it reported shipping work that was not there. Nothing in
+    // the deploy path asked. A deploy proving production serves HEAD says nothing about
+    // whether HEAD contains what you meant to ship.
+    try {
+        const unshipped = (0, deploy_locks_1.openClaims)(cwd, (0, deploy_locks_1.readLandedClaims)(cwd));
+        if (unshipped.length === 0) {
+            add('provenance', 'pass', 'no unshipped landed claims');
+        }
+        else {
+            for (const claim of unshipped) {
+                // The two states read identically to a session and mean different things: a
+                // commit still in the object store was rewritten or orphaned and its CONTENT
+                // may well have landed under another sha, while one that is gone never landed
+                // at all. Say which, because the next move differs.
+                const fate = (0, deploy_locks_1.commitExists)(cwd, claim.sha)
+                    ? 'it still exists but is on no branch — it was rewritten or its merge was redone, so the CONTENT may have landed under a different sha. Confirm, then: greprag merge-lock claim --drop ' + claim.sha.slice(0, 10)
+                    : 'it is not in this repository at all — that work never landed.';
+                add('provenance', 'fail', `${claim.label} (${claim.sha.slice(0, 10)}, claimed ${claim.at}) is NOT in what is about to ship: ${fate}`);
+            }
+        }
+    }
+    catch (error) {
+        add('provenance', 'fail', `could not check landed claims: ${message(error)}`);
+    }
+    // Named so its absence is visible. The gate does not know how this repo's
+    // artifact is produced and must never guess.
+    add('artifact', 'skip', 'artifact proof is repo-owned; the caller supplies it');
+    try {
+        shipping = shippingSummary(cwd, target);
+    }
+    catch (error) {
+        shipping = [`could not summarise what is shipping: ${message(error)}`];
+    }
+    return finish();
+    function finish() {
+        const failed = checks.filter(c => c.status === 'fail');
+        const locationFailed = failed.filter(c => exports.LOCATION_CHECKS.includes(c.id));
+        return {
+            gateVersion: exports.DEPLOY_GATE_VERSION,
+            verdict: failed.length === 0 ? 'pass' : 'refuse',
+            locationVerdict: locationFailed.length === 0 ? 'pass' : 'refuse',
+            target, cwd, canonicalRoot, defaultBranch, branch, head,
+            checks, reasons: failed.map(c => `${c.id}: ${c.detail}`), shipping,
+        };
+    }
+}
+function message(error) {
+    return error instanceof Error ? error.message : String(error);
+}