@am_shork/attest 0.7.4 → 0.9.0

package/dist/core/merge.js

@@ -4,8 +4,11 @@
 // until now a human then transcribed it by hand with nothing checking the
 // transcription. This is that step, and the whole of why it is allowed to exist
 // where the `AGENTS.md` merge tool was not: the registry is a literal Attest
-// defines, so the result of an edit is checkable by re-reading it, and the edit
-// itself is a pure insertion (`splice.ts`).
+// defines, so the result of an edit is checkable by re-reading it — and this
+// re-reads it (`verifyWritten`), rather than resting on the sentence. The edits
+// are bounded to match: an ADDED requirement is a pure insertion, and a MODIFIED
+// one replaces the span of a single value inside an entry it never rewrites
+// (`splice.ts`).
 //
 // **It is re-runnable, not atomic.** No primitive spans one edit, N renames and
 // a directory move, and a scratch copy of the project root would have to be
@@ -30,10 +33,11 @@
 // at runtime on the happy path, and a later reordering would look harmless.
 import { mkdir, readFile, rename, stat } from 'node:fs/promises';
 import { join, dirname, basename } from 'node:path';
-import { repointImport, spliceRequirements, UnwritableValue } from './splice.js';
+import { repointImport, spliceModifications, spliceRequirements, UnwritableValue, } from './splice.js';
+import { readRegistrySource } from './static-registry.js';
 import { writeAtomic } from './write.js';
 import { idPrefix } from './locate.js';
-import { addedIds } from './apply.js';
+import { addedIds, modifiedIds, sameRequirement } from './apply.js';
 import { byCodeUnit } from './order.js';
 import { relativePath } from './paths.js';
 /** `x.proposed.spec.ts` -> `x.spec.ts`, in place. */
@@ -48,8 +52,8 @@ export function mergedSpecPath(proposed) {
  * acting on it, and a merge that did the half it understood would put the file
  * into a state no verdict describes.
  */
-async function refusals(input, stamp) {
-    const issues = [];
+async function refusals(input, stamp, planned) {
+    const issues = [...planned];
     const { delta, root, changeName } = input;
     const archive = archivePath(input, stamp);
     // 0) The destination already exists. Checked here, before anything is
@@ -67,28 +71,34 @@ async function refusals(input, stamp) {
         });
     }
     // 1) Operations this does not perform. The gate applies all four in memory to
-    // reach its verdict; only writing them back is limited to ADDED, because
-    // REMOVED cannot say which comments belonged to the entry it deletes and
-    // MODIFIED is a formatting-preserving edit inside an existing literal. Both
-    // are the "destructive on a file the user cannot regenerate" shape.
+    // reach its verdict; writing them back covers ADDED and MODIFIED, and stops
+    // there because REMOVED cannot say which comments belonged to the entry it
+    // deletes — the "destructive on a file the user cannot regenerate" shape.
+    // MODIFIED was refused by this same clause until it was written at the
+    // granularity of a *value* rather than an entry, which is where that sentence
+    // stops applying and REMOVED's does not: an entry being deleted has no smaller
+    // span to fall back to (`splice.ts`).
     const unsupported = [
         delta.renamed?.length ? 'renamed' : '',
         delta.removed?.length ? 'removed' : '',
-        Object.keys(delta.modified ?? {}).length ? 'modified' : '',
     ].filter(Boolean);
     if (unsupported.length > 0) {
         issues.push({
             level: 'ERROR',
             code: 'apply-unsupported-delta',
             file: relativePath(root, join(root, 'changes', changeName)),
-            message: `--apply writes back ADDED requirements only, and this change's delta also carries ${unsupported.join(', ')}. ` +
+            message: `--apply writes back ADDED and MODIFIED requirements, and this change's delta also carries ${unsupported.join(', ')}. ` +
                 `The gate above still checked all of it — merge the remaining operations into the registry by hand, then run this command again to confirm.`,
         });
     }
-    // 2) An added id whose prefix no registry file claims. Which file it belongs
+    // 2) An id whose prefix no registry file claims. Which file it belongs
     // in — or whether a file should be created for it — is not something the gate
-    // verified, and guessing would file a requirement somewhere nobody chose.
-    for (const id of unmergedAdded(input)) {
+    // verified, and guessing would file a requirement somewhere nobody chose. Over
+    // modified ids as well as added ones: an unowned prefix is why the merge cannot
+    // find the file, and reporting it as "no entry to modify" would send the reader
+    // to look inside a file this never opened.
+    const unowned = new Set([...unmergedAdded(input), ...modifiedIds(input.delta)]);
+    for (const id of [...unowned].sort(byCodeUnit)) {
         if (input.prefixOwners[idPrefix(id)] === undefined) {
             issues.push({
                 level: 'ERROR',
@@ -146,6 +156,182 @@ function registryTargets(input, reqIds) {
 function unmergedAdded(input) {
     return addedIds(input.delta).filter((id) => !Object.hasOwn(input.base, id));
 }
+/**
+ * The requirements this change modifies that the registry on disk does not
+ * already hold in its end state.
+ *
+ * The MODIFIED half of re-runnability, and deliberately the same shape as
+ * `unmergedAdded`: derived from the tree as it currently is rather than from a
+ * list of what a previous run meant to do. An entry already equal to `applied`
+ * is not edited, so a re-run after a crash writes what is left and nothing else
+ * — and a delta restating a value it does not change writes nothing at all.
+ */
+function unmergedModified(input) {
+    const out = [];
+    for (const id of modifiedIds(input.delta)) {
+        const before = input.base[id];
+        const after = input.applied[id];
+        // A modified id the base does not have is `modify-missing`, which the gate
+        // reports and this never reaches; skipped rather than diagnosed a second
+        // time, because two commands answering for one condition is how they come to
+        // disagree.
+        if (!before || !after || sameRequirement(before, after))
+            continue;
+        out.push({ id, before, after });
+    }
+    return out;
+}
+/**
+ * What every registry file should end up holding, or why it cannot — computed
+ * without writing anything.
+ *
+ * Split from the write for one reason: a refusal that fires after two files have
+ * landed makes "refused whole" a claim with an exception in it, which is the
+ * kind of claim nobody can rely on (the note on `refusals` step 0 says the same
+ * thing about the archive destination). Both edits to a file are composed here,
+ * modification before splice, and the splice re-reads the text the modification
+ * produced rather than an offset taken before it — an insertion point is a
+ * position in a file, and the modification has just moved bytes in front of it.
+ */
+async function planRegistries(input) {
+    const { root } = input;
+    const issues = [];
+    const added = new Map();
+    const modified = new Map();
+    for (const id of unmergedAdded(input)) {
+        const file = input.prefixOwners[idPrefix(id)];
+        if (!file)
+            continue; // Refused as `apply-no-prefix-owner`; not diagnosed twice.
+        const group = added.get(file) ?? {};
+        group[id] = input.applied[id];
+        added.set(file, group);
+    }
+    for (const change of unmergedModified(input)) {
+        const file = input.prefixOwners[idPrefix(change.id)];
+        if (!file)
+            continue;
+        modified.set(file, [...(modified.get(file) ?? []), change]);
+    }
+    const files = [];
+    for (const file of [...new Set([...added.keys(), ...modified.keys()])].sort(byCodeUnit)) {
+        const source = await readFile(file, 'utf8');
+        const mods = modified.get(file) ?? [];
+        const adds = added.get(file);
+        const ids = [...mods.map((m) => m.id), ...Object.keys(adds ?? {})].sort(byCodeUnit);
+        const changed = spliceModifications(file, source, mods);
+        if (!changed) {
+            issues.push(unreadable(root, file));
+            continue;
+        }
+        if (!changed.ok) {
+            issues.push(...changed.refusals.map((r) => modifyRefusal(root, file, r)));
+            continue;
+        }
+        let text = changed.source;
+        if (adds) {
+            try {
+                const spliced = spliceRequirements(file, text, adds);
+                if (spliced === undefined) {
+                    issues.push(unreadable(root, file));
+                    continue;
+                }
+                text = spliced;
+            }
+            catch (err) {
+                // The emitter refused a value it cannot write as source — today only a
+                // `__proto__` param key, which the schema rejects before `--apply` runs.
+                // Caught rather than left to the CLI's crash envelope because `--apply`
+                // is destructive and a bare stack is the shape a resume cannot read.
+                if (!(err instanceof UnwritableValue))
+                    throw err;
+                issues.push({
+                    level: 'ERROR',
+                    code: 'internal-error',
+                    file: relativePath(root, file),
+                    message: `${relativePath(root, file)} could not be written: ${err.message}.`,
+                });
+                continue;
+            }
+        }
+        files.push({ file, source, text, ids });
+    }
+    return { files, issues };
+}
+/**
+ * Whether the file just written reads back as the requirements it was written
+ * from — the check the whole argument for editing a hand-written registry rests
+ * on, performed rather than argued.
+ *
+ * "The result of an edit is checkable by re-reading it" is the clause that
+ * separates this from the merge tool the `AGENTS.md` proposal was rejected for,
+ * and until MODIFIED existed nothing did the re-reading: a pure insertion is
+ * right by construction, so the sentence was load-bearing without being
+ * exercised. A replacement is not, so the re-read is here for both — the added
+ * entries included, because a check that covered only the newer half would leave
+ * the older claim in exactly the state this is fixing.
+ *
+ * What it cannot see is the other half, and saying so is the point: a re-read
+ * compares *values*, and a comment or a blank line that went missing does not
+ * appear in a `Registry` at all. That is why the edit is bounded to the span of
+ * one value rather than trusted to this (`splice.ts`).
+ */
+async function verifyWritten(input, plan) {
+    const { root } = input;
+    const back = readRegistrySource(plan.file, await readFile(plan.file, 'utf8'));
+    const wrong = back.ok
+        ? plan.ids.filter((id) => {
+            const written = back.registry[id];
+            const proved = input.applied[id];
+            return !written || !proved || !sameRequirement(written, proved);
+        })
+        : plan.ids;
+    if (wrong.length === 0)
+        return undefined;
+    return {
+        level: 'ERROR',
+        code: 'internal-error',
+        file: relativePath(root, plan.file),
+        message: `${relativePath(root, plan.file)} was written, but reading it back does not give the requirements the gate proved (${wrong.join(', ')}). ` +
+            `Check that file against the change's delta before running anything else — the merge stopped here, so the steps after it have not run.`,
+    };
+}
+/** The registry the gate read a moment ago, unreadable to the merge. */
+function unreadable(root, file) {
+    // Unreachable through the command, so it is reported as the internal
+    // inconsistency it is rather than as a diagnosis about the user's registry.
+    return {
+        level: 'ERROR',
+        code: 'internal-error',
+        file: relativePath(root, file),
+        message: `${relativePath(root, file)} read as a registry for the gate but not for the merge.`,
+    };
+}
+/**
+ * One value the merge declined to write over, as a diagnostic.
+ *
+ * The code is the one an unsupported operation already carries: to a consumer
+ * branching on `code`, "this delta has a part `--apply` does not write" is the
+ * same fact whichever part it is, and the narrowing that made most MODIFIED
+ * deltas writable should not cost anyone a new string to handle. The `reqId` and
+ * the field are what changed, and both are in the message where the reader is.
+ */
+function modifyRefusal(root, file, refusal) {
+    const where = refusal.field ? `${refusal.reqId}.${refusal.field}` : refusal.reqId;
+    const why = {
+        comment: `a comment sits inside the value it would replace, and which side of that edit the comment belongs to is not something --apply can decide`,
+        'entry-not-found': `the registry file that owns its prefix holds no entry for it`,
+        'not-a-literal': `the value it would replace is not written as a literal`,
+        'param-dropped': `the proved end state does not carry that param, and a delta has no way to say one was removed`,
+    };
+    return {
+        level: 'ERROR',
+        code: 'apply-unsupported-delta',
+        reqId: refusal.reqId,
+        file: relativePath(root, file),
+        message: `--apply cannot write "${where}" into ${relativePath(root, file)}: ${why[refusal.reason]}. ` +
+            `Merge this requirement by hand, then run this command again to confirm — nothing has been written.`,
+    };
+}
 /**
  * Perform the merge, or refuse it whole.
  *
@@ -163,67 +349,27 @@ export async function applyMerge(input) {
     // another — rare, and silent when it happens, which is the combination this
     // repository treats as worth the line.
     const stamp = new Date().toISOString().slice(0, 10);
-    const refused = await refusals(input, stamp);
+    // Every registry edit is computed before any of them is written, which is what
+    // makes "refused whole" true of the write-back and not only of the delta's
+    // shape: a comment sitting where a modification would land, or a value the
+    // emitter cannot write, is now found with the tree still untouched. Before
+    // MODIFIED existed the text generation could only fail on a `__proto__` key
+    // and it failed one file at a time, so this was the same claim by luck.
+    const planned = await planRegistries(input);
+    const refused = await refusals(input, stamp, planned.issues);
     if (refused.length > 0)
         return { issues: refused, written: [] };
     const { root } = input;
     const written = [];
-    // --- 1) Splice, first. See the note at the top of this file.
-    const byFile = new Map();
-    for (const id of unmergedAdded(input)) {
-        const file = input.prefixOwners[idPrefix(id)];
-        const group = byFile.get(file) ?? {};
-        group[id] = input.applied[id];
-        byFile.set(file, group);
-    }
-    for (const file of [...byFile.keys()].sort(byCodeUnit)) {
-        const source = await readFile(file, 'utf8');
-        let spliced;
-        try {
-            spliced = spliceRequirements(file, source, byFile.get(file));
-        }
-        catch (err) {
-            // The emitter refused a value it cannot write as source — today only a
-            // `__proto__` param key, which the schema rejects before `--apply` runs.
-            // Caught rather than left to the CLI's crash envelope so the account of
-            // what this merge had already written survives: `--apply` is destructive
-            // and half a merge reported as a bare stack is the shape a resume cannot
-            // read. The write for *this* file has not happened — the throw is in the
-            // text generation, above `writeAtomic`.
-            if (!(err instanceof UnwritableValue))
-                throw err;
-            return {
-                issues: [
-                    {
-                        level: 'ERROR',
-                        code: 'internal-error',
-                        file: relativePath(root, file),
-                        message: `${relativePath(root, file)} could not be written: ${err.message}.`,
-                    },
-                ],
-                written,
-            };
-        }
-        if (spliced === undefined) {
-            // Unreachable through the command — the gate read this file as a literal
-            // moments ago — so it is reported as the internal inconsistency it is
-            // rather than as a diagnosis about the user's registry.
-            return {
-                issues: [
-                    {
-                        level: 'ERROR',
-                        code: 'internal-error',
-                        file: relativePath(root, file),
-                        message: `${relativePath(root, file)} read as a registry for the gate but not for the merge.`,
-                    },
-                ],
-                written,
-            };
-        }
-        if (spliced !== source) {
-            await writeAtomic(file, spliced);
-            written.push(relativePath(root, file));
-        }
+    // --- 1) Write the registries, first. See the note at the top of this file.
+    for (const plan of planned.files) {
+        if (plan.text === plan.source)
+            continue;
+        await writeAtomic(plan.file, plan.text);
+        written.push(relativePath(root, plan.file));
+        const mismatch = await verifyWritten(input, plan);
+        if (mismatch)
+            return { issues: [mismatch], written };
     }
     // --- 2) Repoint each claimed spec's delta import, then rename it in place.
     //

package/dist/core/pipeline.d.ts

@@ -81,6 +81,20 @@ export interface RenderResult {
     markdown: string;
     /** Registry-loading issues — rendering a half-loaded registry would lie. */
     issues: Issue[];
+    /** Whether the document reached `out.file`. False whenever `out` is absent. */
+    wrote: boolean;
+}
+/**
+ * A destination `render` was asked to write, as the two spellings it needs.
+ *
+ * `file` is resolved against the caller's working directory and is what the
+ * filesystem is given; `display` is the string the user typed, and is what a
+ * diagnostic has to echo so the path in the report is the path they can act on.
+ * They travel together because a destination is not usable without both.
+ */
+export interface RenderOut {
+    file: string;
+    display: string;
 }
 /**
  * Markdown projection of the intent layer (design §9: `attest render`).
@@ -90,7 +104,9 @@ export interface RenderResult {
  * `*.reqs.ts` files, so a committed rendering can be gated without going stale
  * every time a line moves in a test file.
  */
-export declare function runRender(root: string, options?: ReadOptions): Promise<RenderResult>;
+export declare function runRender(root: string, options?: ReadOptions & {
+    out?: RenderOut | undefined;
+}): Promise<RenderResult>;
 /**
  * Freshness gate for a committed rendering (`attest render --check`).
  *

package/dist/core/pipeline.js

@@ -14,7 +14,7 @@ import { writeAtomic } from './write.js';
 import { applyMerge, mergedSpecPath } from './merge.js';
 import { compilerIssue } from './compiler.js';
 import { mkdir, readFile, realpath } from 'node:fs/promises';
-import { basename, dirname, join } from 'node:path';
+import { basename, dirname, join, resolve } from 'node:path';
 import { isInside, relativePath } from './paths.js';
 import { hasError } from './types.js';
 // The runner half of the engine, reached only when a command actually needs it.
@@ -316,21 +316,13 @@ export async function runVerify(root, options = {}) {
         specFiles: scan.specFiles.length,
         attesting: attesting.length,
     };
-    // A run with nothing to attest used to print "✓ No issues." and exit 0,
-    // because "no failing tests" was read as passed. An empty registry is the
-    // only shape of that which no other check already catches: with at least one
-    // requirement, an absent scenario is `uncovered-requirement` and a declared
-    // scenario that never executed is `declared-not-run`, both ERRORs. So this is
-    // narrower than "zero scenarios ran" — and firing on that too would only
-    // double-report a run that is already red.
-    if (counts.requirements === 0) {
-        issues.push({
-            level: 'ERROR',
-            code: 'empty-spec',
-            message: `No requirements found under this root, so this run attested nothing. ` +
-                `Point attest at the directory holding your *.reqs.ts files, or add one.`,
-        });
-    }
+    // `empty-spec` belongs to `validateStructure` above, not here: the registry
+    // alone decides it, so it is owed by every command performing §5.3 rather than
+    // by the one that executes. The guard a reader is most likely to want here is
+    // "zero scenarios ran", and it is deliberately not that — with at least one
+    // requirement, an absent scenario is already `uncovered-requirement` and a
+    // declared scenario that never executed is already `declared-not-run`, both
+    // ERRORs, so the wider rule would only double-report a run that is red anyway.
     // Nothing declares intent, so there is nothing for Attest to run. Skipping
     // the child run keeps an incumbent suite untouched; the verdict comes from
     // empty-spec or uncovered-requirement, both already ERRORs above.
@@ -405,15 +397,38 @@ export async function runCover(root, options = {}) {
  * every time a line moves in a test file.
  */
 export async function runRender(root, options = {}) {
+    // The compiler guard stays the first statement, as it is in every other entry
+    // point (ATX-56): a TypeScript with no AST API is a refusal about the
+    // toolchain, and it outranks anything this run could say about the caller's
+    // paths or registry.
     const unusable = compilerIssue();
     if (unusable)
-        return { markdown: '', issues: [unusable] };
+        return { markdown: '', issues: [unusable], wrote: false };
+    // Then the destination, before the registry is read, so a refused path is the
+    // only thing reported: a run that cannot write anywhere has no reason to also
+    // tell the user about their registry, and the report a pipeline reads should
+    // name the one thing that has to change.
+    const dest = options.out ? await resolveOutFile(root, options.out) : undefined;
+    if (dest && !dest.ok)
+        return { markdown: '', issues: [dest.issue], wrote: false };
     const { registry, issues } = await readRegistry(root, options);
     // A registry that failed to load yields a document that silently omits
-    // requirements. An incomplete spec doc is worse than none, so refuse.
+    // requirements. An incomplete spec doc is worse than none, so refuse — and
+    // since the write is below this line, refusing is also what keeps a broken
+    // registry from overwriting a good committed document.
     if (hasError(issues))
-        return { markdown: '', issues };
-    return { markdown: renderMarkdown(registry), issues };
+        return { markdown: '', issues, wrote: false };
+    const markdown = renderMarkdown(registry);
+    // The write lives here rather than in the CLI, and that is the whole of what
+    // ATX-73 is structurally about: while it sat in the shell it was the one
+    // `writeAtomic` call outside this layer, and it reached the filesystem
+    // without the resolution `runInit` had performed since ATX-66. Resolving and
+    // writing in one function is what stops the two from coming apart again —
+    // a later caller cannot forget a step it never had to take.
+    if (!dest)
+        return { markdown, issues, wrote: false };
+    await writeAtomic(dest.dest, markdown);
+    return { markdown, issues, wrote: true };
 }
 /**
  * Freshness gate for a committed rendering (`attest render --check`).
@@ -423,10 +438,29 @@ export async function runRender(root, options = {}) {
  * alongside a gate that fails when the file no longer matches its source.
  */
 export async function runRenderCheck(root, outFile, target, options = {}) {
+    // Called here despite the delegation further down, because the resolution
+    // below it runs first: the guard has to be the first statement of an entry
+    // point (ATX-56), and delegation cannot supply that once anything precedes
+    // it. Same precedence in both, for the reason `runRender` states.
+    const unusable = compilerIssue();
+    if (unusable)
+        return [unusable];
+    // Resolved before it is read, not only before it is written. A link along the
+    // path makes this compare a fresh document against a file outside the project
+    // — and both verdicts that can produce are ones the gate reports normally, so
+    // the wrong answer is indistinguishable from a right one.
+    //
+    // `target` already carries the spelling a diagnostic must echo, so the pair
+    // `resolveOutFile` wants is assembled here rather than asked of the caller:
+    // taking a `RenderOut` beside a `RenderTarget` would make the shell pass the
+    // same string twice, which is a clump waiting to disagree with itself.
+    const dest = await resolveOutFile(root, { file: outFile, display: target.display });
+    if (!dest.ok)
+        return [dest.issue];
     const { markdown, issues } = await runRender(root, options);
     if (hasError(issues))
         return issues;
-    const current = await readFile(outFile, 'utf8').catch(() => undefined);
+    const current = await readFile(dest.dest, 'utf8').catch(() => undefined);
     const stale = staleIssue(target, current, markdown);
     return stale ? [...issues, stale] : issues;
 }
@@ -467,12 +501,7 @@ export async function runInit(root, names) {
             writes.push({ target, dest: resolved.dest });
         }
         else {
-            refusals.push({
-                level: 'ERROR',
-                code: 'unsafe-target-path',
-                file: target.file,
-                message: `Refusing to write ${target.file}: it resolves to ${resolved.escape}, outside the project. Remove the link at that path and re-run.`,
-            });
+            refusals.push(unsafeTargetPathIssue(target.file, resolved.escape));
         }
     }
     if (refusals.length > 0)
@@ -485,6 +514,61 @@ export async function runInit(root, names) {
     }
     return { files, issues };
 }
+/**
+ * Where a `render` destination really lands, or the refusal that a link
+ * redirected it (design §9: ownership of the path is checked, and who named the
+ * path decides what the refusal is about).
+ *
+ * `init` names its own destinations, so every one of them is checked; `--out`
+ * is the caller's path, and that is the whole of the difference between the two
+ * callers. A path spelled outside the project is the user asking for a file
+ * outside the project — `--out ../site/SPEC.md` is a destination, not an
+ * escape, and refusing it would be refusing the flag. What is not visible in
+ * the argument is a *link* along a path that reads as staying inside, which is
+ * the one a checkout can plant: the victim's `--out` is the string their README
+ * or CI already documents, and the content redirected is the document their
+ * repository wrote.
+ *
+ * So the check applies exactly when the destination is lexically inside the
+ * root, and it is `resolveDest`'s, unchanged. The leaf needs no separate
+ * defence and never did — `writeAtomic` lands by `rename`, which replaces a
+ * symlink rather than following it — but it is resolved with the rest anyway,
+ * because a link there is still a file the user made deliberately and this
+ * refuses rather than destroys it.
+ *
+ * Both entry points that name a destination come through here — the one that
+ * writes it and the one that reads it back to date it — which is why this is
+ * private to this module rather than something a shell is trusted to call.
+ */
+async function resolveOutFile(root, out) {
+    const dest = resolve(out.file);
+    const realRoot = await realpath(root).catch(() => root);
+    // Asked against both spellings of the root, because they differ whenever the
+    // project itself sits under a link: `dest` is built from the caller's cwd, so
+    // it is lexical, and testing only the resolved root would skip the check for
+    // every such checkout — failing open on exactly the layout that has links in
+    // it. `''` is the root itself, which is a directory and not a destination.
+    const rel = isInside(root, dest)
+        ? relativePath(root, dest)
+        : isInside(realRoot, dest)
+            ? relativePath(realRoot, dest)
+            : undefined;
+    if (rel === undefined || rel === '')
+        return { ok: true, dest };
+    const resolved = await resolveDest(realRoot, rel);
+    return resolved.ok
+        ? { ok: true, dest: resolved.dest }
+        : { ok: false, issue: unsafeTargetPathIssue(out.display, resolved.escape) };
+}
+/** The one refusal both destination checks report (design §9). */
+function unsafeTargetPathIssue(display, escape) {
+    return {
+        level: 'ERROR',
+        code: 'unsafe-target-path',
+        file: display,
+        message: `Refusing to write ${display}: it resolves to ${escape}, outside the project. Remove the link at that path and re-run.`,
+    };
+}
 /**
  * Where a target's file really goes, or the path outside the project that
  * asking put it at (design §9: ownership of the path is checked, not assumed).
@@ -721,14 +805,44 @@ export async function runStatus(root, changeName, options = {}) {
         return nothing([invalidChangeNameIssue(changeName)]);
     if (unusable)
         return nothing([unusable]);
-    const read = await readDelta(root, changeName, options);
-    if ('issue' in read)
-        return nothing([read.issue]);
-    const scan = await scanProject(root);
-    const { merged: plan } = await changeMergedPlan(root, read.delta, scan);
-    const firstRun = await readRedRecord(root, changeName);
-    const rows = statusRows(addedIds(read.delta), plan, firstRun);
-    return { change: changeName, rows, counts: statusCounts(rows), issues: [] };
+    // One loader for the whole command, or none at all. Both reads below take the
+    // reader `options` asks for, so the escape hatch moves them together: the
+    // default path evaluates nothing, which is what puts this command on ATX-16's
+    // roster, and `--eval` is one named decision rather than one per file.
+    return withLoader(options, async (loader) => {
+        const read = await readDelta(root, changeName, options, loader);
+        if ('issue' in read)
+            return nothing([read.issue]);
+        const scan = await scanProject(root);
+        const { registry: base, issues: registryIssues } = await readRegistry(root, options, scan.reqsFiles, loader);
+        // `hasError`, the gate's own predicate over the same list, because the
+        // registry is what the delta is applied *to*: without it there is no end
+        // state to describe, and a report computed against half a registry would
+        // answer about a change nobody proposed.
+        if (hasError(registryIssues))
+            return nothing(registryIssues);
+        // The gate's own call, made here for its diagnosis rather than its result:
+        // the rows below stay decided by the delta, the specs and the record alone
+        // (ATX-32), and what this adds is the refusal. A delta that cannot be
+        // applied describes an end state that does not exist, so there is no
+        // progress toward it to report — an `unproven` against it would be a
+        // true-looking sentence about a change that cannot exist.
+        const { issues: deltaIssues } = applyDelta(base, read.delta);
+        if (deltaIssues.length > 0)
+            return nothing(deltaIssues);
+        const { merged: plan, issues: unreadableSpecs } = await changeMergedPlan(root, read.delta, scan);
+        // The same refusal the gate makes, from the same list and on the same
+        // argument (ATX-65): every state this command reports is computed *from* the
+        // plan, so a spec the parser could not read does not shrink the report — it
+        // changes what the remaining rows say. A requirement whose only scenario is
+        // in that file reads as having none, which is the opposite of the truth and
+        // is advice to redo work already on disk.
+        if (unreadableSpecs.length > 0)
+            return nothing(unreadableSpecs);
+        const firstRun = await readRedRecord(root, changeName);
+        const rows = statusRows(addedIds(read.delta), plan, firstRun);
+        return { change: changeName, rows, counts: statusCounts(rows), issues: [] };
+    });
 }
 /** Archive gate for a change (design §8, §9: `attest archive <change>`). */
 export async function runArchive(root, changeName, options = {}) {