@cspeach/cli 1.1.31 → 1.1.33

package/dist/register/decision-rules.js

@@ -0,0 +1,35 @@
+/**
+ * Decision rules for the joined team project (step 2, D6): which rule decides
+ * each object, read from the same register and findings team_findings shows,
+ * with the project's own rules or the defaults. The row cards use it to say
+ * "Rule <id>: …" or "Differs from rule <id>: …". Read only; never writes the
+ * rules to the file.
+ */
+import { evaluateRules, readDecisionRules } from '@cspeach/register-core';
+import { findingsByObject } from './findings.js';
+import { registerFor } from './picture.js';
+import { readProjectFile } from './store.js';
+/** The rule that decides one register object, from its latest counted run's findings. */
+export function ruleProposalOf(o, f, rules) {
+    return evaluateRules(o, rules, f ? { findings: f.latest } : {});
+}
+/** "TYPE|NAME" → the deciding rule (or null), for every object of the team project; `warning` when the file's rules could not be read. */
+export function ruleProposalsFor(projectDir, outboxDir) {
+    const rules = readDecisionRules(readProjectFile(projectDir));
+    const { register } = registerFor(projectDir, outboxDir);
+    const findings = findingsByObject(projectDir, outboxDir);
+    const byKey = new Map(register.objects.map((o) => [o.key.toUpperCase(), o]));
+    const cache = new Map();
+    return {
+        lookup: (key) => {
+            const k = key.trim().toUpperCase();
+            if (cache.has(k))
+                return cache.get(k);
+            const o = byKey.get(k);
+            const p = o ? ruleProposalOf(o, findings.get(o.key), rules.rules) : null;
+            cache.set(k, p);
+            return p;
+        },
+        ...(rules.warning ? { warning: rules.warning } : {}),
+    };
+}

package/dist/register/discover.js

@@ -20,8 +20,12 @@ import { CODE_OBJECT_TYPES, LOCAL_PACKAGE } from './baseline.js';
 import { callersFromIndex, reposrcNameFor } from './xref.js';
 import { outsideUsageWindowLine, shortUsageWindow, usageUnknownLineOf } from '@cspeach/register-core';
 // ── Fixed values ──
-/** Rows per keyset page (steps 5, 6, 8, 9, 10). */
+/** Rows per keyset page (steps 5, 6, 7, 8, 9, 10, 11) — the data preview's own cap. */
 const PAGE = 5000;
+/** A COUNT or GROUP BY statement: its totalRows may count the rows before aggregation (final review I4). */
+const AGGREGATE = /\bCOUNT\s*\(|\bGROUP\s+BY\b/i;
+/** An answer that may be cut is never counted as the whole truth (review I14). */
+export const POSSIBLY_CUT = 'possibly cut at 5,000 rows — counted as unknown';
 /** Namespaces that are SAP's or a product's, never treated as customer even with role P. */
 const NOT_CUSTOMER_NAMESPACES = [
     '/BI0/', '/BIC/', '/IWBEP/', '/IWFND/', '/UI2/', '/UI5/', '/SDF/', '/BOBF/', '/OSP/', '/SCWM/', '/SCMB/', '/S4PPM/',
@@ -74,7 +78,7 @@ export const SQL = {
     localCount: (p) => `SELECT COUNT(*) AS CNT FROM TADIR WHERE PGMID = 'R3TR' AND DELFLAG = ' ' AND DEVCLASS = '${LOCAL_PACKAGE}' AND OBJ_NAME LIKE '${p}%'`,
     localObjects: (p, a) => `SELECT OBJECT, OBJ_NAME, DEVCLASS, AUTHOR, GENFLAG, CREATED_ON FROM TADIR WHERE PGMID = 'R3TR' AND DELFLAG = ' ' AND DEVCLASS = '${LOCAL_PACKAGE}' AND OBJ_NAME LIKE '${p}%'${after('OBJ_NAME', a)} ORDER BY OBJ_NAME, OBJECT`,
     changes: (p, a) => `SELECT PROGNAME, R3STATE, UNAM, UDAT, CNAM, CDAT FROM REPOSRC WHERE R3STATE = 'A' AND PROGNAME LIKE '${p}%'${after('PROGNAME', a)} ORDER BY PROGNAME`,
-    batch: (p) => `SELECT p~PROGNAME, COUNT(*) AS RUNS, MAX( o~STRTDATE ) AS LAST_RUN FROM TBTCP AS p INNER JOIN TBTCO AS o ON p~JOBNAME = o~JOBNAME AND p~JOBCOUNT = o~JOBCOUNT WHERE o~STATUS = 'F' AND p~PROGNAME LIKE '${p}%' GROUP BY p~PROGNAME`,
+    batch: (p, a) => `SELECT p~PROGNAME, COUNT(*) AS RUNS, MAX( o~STRTDATE ) AS LAST_RUN FROM TBTCP AS p INNER JOIN TBTCO AS o ON p~JOBNAME = o~JOBNAME AND p~JOBCOUNT = o~JOBCOUNT WHERE o~STATUS = 'F' AND p~PROGNAME LIKE '${p}%'${after('p~PROGNAME', a)} GROUP BY p~PROGNAME ORDER BY p~PROGNAME`,
     batchWindow: () => `SELECT MIN( STRTDATE ) AS FIRST_RUN, MAX( STRTDATE ) AS LAST_RUN, COUNT(*) AS CNT FROM TBTCO WHERE STATUS = 'F'`,
     scmonConfig: () => 'SELECT CONFIG_KEY, CONFIG_VALUE FROM SCMON_CONFIG',
     scmonData: () => 'SELECT COUNT(*) AS CNT FROM SCMON_DATA',
@@ -91,7 +95,8 @@ export const SQL = {
     wbcrossgt: (p, a, strict) => `SELECT OTYPE, NAME, INCLUDE FROM WBCROSSGT WHERE NAME LIKE '${p}%'${after('NAME', a, strict)} ORDER BY NAME, INCLUDE`,
     cross: (p, a, strict) => `SELECT TYPE, NAME, INCLUDE FROM CROSS WHERE NAME LIKE '${p}%'${after('NAME', a, strict)} ORDER BY NAME, INCLUDE`,
     masters: (p, a) => `SELECT MASTER, INCLUDE FROM D010INC WHERE INCLUDE LIKE '${p}%'${after('INCLUDE', a)} ORDER BY INCLUDE, MASTER`,
-    modifications: (op) => `SELECT OBJ_TYPE, OBJ_NAME, SUB_TYPE, SUB_NAME, OPERATION, MOD_USER, MOD_DATE FROM SMODILOG WHERE OPERATION = '${op}'`,
+    // INT_TYPE/INT_NAME (live DD03L 2026-10-06): two rows that differ only there are two rows, kept apart while paging.
+    modifications: (op, a) => `SELECT OBJ_TYPE, OBJ_NAME, SUB_TYPE, SUB_NAME, INT_TYPE, INT_NAME, OPERATION, MOD_USER, MOD_DATE FROM SMODILOG WHERE OPERATION = '${op}'${after('OBJ_NAME', a)} ORDER BY OBJ_NAME, OBJ_TYPE, SUB_TYPE, SUB_NAME, INT_TYPE, INT_NAME`,
     modificationCount: (op) => `SELECT COUNT(*) AS CNT FROM SMODILOG WHERE OPERATION = '${op}'`,
     successors: () => 'SELECT COUNT(*) AS CNT FROM ARS_W_API_STATE',
 };
@@ -111,7 +116,7 @@ export const DISCOVER_STATEMENTS = (o) => {
         { step: 5, sql: SQL.localObjects(p, a) },
         { step: 6, sql: SQL.changes(p, a) },
         ...fugrPrefixes(p, 'SAPL').map((fp) => ({ step: 6, sql: SQL.changes(fp, a) })),
-        { step: 7, sql: SQL.batch(p) },
+        { step: 7, sql: SQL.batch(p, a) },
         { step: 7, sql: SQL.batchWindow() },
         { step: 8, sql: SQL.scmonConfig() },
         { step: 8, sql: SQL.scmonData() },
@@ -131,9 +136,9 @@ export const DISCOVER_STATEMENTS = (o) => {
         ...(a === undefined ? [] : [{ step: 9, sql: SQL.cross(p, a, true) }, { step: 9, sql: SQL.wbcrossgt(p, a, true) }]),
         { step: 10, sql: SQL.masters(p, a) },
         ...fugrPrefixes(p, 'L').map((fp) => ({ step: 10, sql: SQL.masters(fp, a) })),
-        { step: 11, sql: SQL.modifications('MOD') },
-        { step: 11, sql: SQL.modifications('NEW') },
-        { step: 11, sql: SQL.modifications('IMP') },
+        { step: 11, sql: SQL.modifications('MOD', a) },
+        { step: 11, sql: SQL.modifications('NEW', a) },
+        { step: 11, sql: SQL.modifications('IMP', a) },
         { step: 11, sql: SQL.modificationCount('NOTE') },
         { step: 11, sql: SQL.modificationCount('ALL') },
         { step: 12, sql: SQL.successors() },
@@ -147,13 +152,27 @@ export async function discover(sql, opts) {
     const unknowns = [];
     const aborted = () => opts.signal?.aborted === true;
     const codeTypes = new Set(CODE_OBJECT_TYPES);
-    /** The one wrapper every statement runs through. Never throws. */
-    const run = async (step, statement, maxRows, what) => {
+    /**
+     * The one wrapper every statement runs through. Never throws. An answer that
+     * may be cut (sap-client's `possiblyCut`, or a full 5,000-row page) is marked
+     * on `queries[]` and named under unknowns — unless the caller pages past it
+     * (`paging`), where a full page is expected and the next page follows.
+     */
+    const run = async (step, statement, maxRows, what, paging = false) => {
         const t0 = Date.now();
         try {
             const res = await sql(statement, maxRows);
             const rows = res.rows ?? [];
-            queries.push({ step, statement, rows: rows.length, ms: Date.now() - t0, ok: true });
+            // Final review I4: SAP may count totalRows before aggregation, so a COUNT /
+            // GROUP BY answer is "possibly cut" only when it fills the page it asked for.
+            const possiblyCut = AGGREGATE.test(statement)
+                ? rows.length >= Math.min(maxRows, PAGE)
+                : res.possiblyCut === true || rows.length >= PAGE;
+            queries.push({ step, statement, rows: rows.length, ms: Date.now() - t0, ok: true, ...(possiblyCut && !paging ? { possiblyCut: true } : {}) });
+            if (possiblyCut && !paging) {
+                unknowns.push({ what: what ?? `step ${step}: ${STEP_LABELS[step]}`, why: POSSIBLY_CUT });
+                return { rows, possiblyCut: true };
+            }
             return { rows };
         }
         catch (err) {
@@ -175,7 +194,7 @@ export async function discover(sql, opts) {
             const why = stop();
             if (why)
                 return { rows, complete: false, boundary: a, stop: why };
-            const res = await run(step, build(a, strict), PAGE, what);
+            const res = await run(step, build(a, strict), PAGE, what, true);
             if ('error' in res)
                 return { rows, complete: false, boundary: a, stop: 'error', error: res.error };
             let fresh = 0;
@@ -295,7 +314,9 @@ export async function discover(sql, opts) {
             const res = await run(3, SQL.counts(p), 50000);
             if (!('rows' in res))
                 continue;
-            countedPrefixes.add(p);
+            // A cut count is no control total: step 4 then pulls those packages without one.
+            if (!res.possiblyCut)
+                countedPrefixes.add(p);
             for (const r of res.rows) {
                 const pkg = clean(r.DEVCLASS).toUpperCase();
                 const t = clean(r.OBJECT).toUpperCase();
@@ -438,11 +459,14 @@ export async function discover(sql, opts) {
                 cut.add(7);
                 break;
             }
-            const res = await run(7, SQL.batch(p), 50000);
-            if (!('rows' in res)) {
-                failed = failed ?? res.error;
-                continue;
+            const res = await paged(7, (a) => SQL.batch(p, a), 'PROGNAME', (r) => clean(r.PROGNAME), abortOnly);
+            if (res.stop === 'abort') {
+                cut.add(7);
             }
+            else if (res.stop === 'error')
+                failed = failed ?? res.error;
+            else if (!res.complete)
+                unknowns.push({ what: `step 7: ${STEP_LABELS[7]}`, why: POSSIBLY_CUT });
             for (const r of res.rows) {
                 const o = byKey.get(`PROG|${clean(r.PROGNAME).toUpperCase()}`);
                 if (!o)
@@ -819,9 +843,15 @@ export async function discover(sql, opts) {
     let otherRows = null;
     if (step(11)) {
         for (const op of ['MOD', 'NEW', 'IMP']) {
-            const res = await run(11, SQL.modifications(op), 50000);
-            if (!('rows' in res))
-                continue;
+            if (aborted()) {
+                cut.add(11);
+                break;
+            }
+            const res = await paged(11, (a) => SQL.modifications(op, a), 'OBJ_NAME', (r) => [r.OBJ_TYPE, r.OBJ_NAME, r.SUB_TYPE, r.SUB_NAME, r.INT_TYPE, r.INT_NAME, r.OPERATION].map(clean).join('|'), abortOnly, `step 11: modifications (${op})`);
+            if (res.stop === 'abort')
+                cut.add(11);
+            else if (!res.complete && res.stop !== 'error')
+                unknowns.push({ what: `step 11: modifications (${op})`, why: POSSIBLY_CUT });
             for (const r of res.rows) {
                 const objectName = clean(r.OBJ_NAME).toUpperCase();
                 if (customerNamed(objectName))

package/dist/register/export-files.js

@@ -0,0 +1,58 @@
+/**
+ * The CSV export on disk (step 2, Task 4; spec 2026-10-08 §3.4, D2). The
+ * tables come from register-core (`exportSet`, pure); this file writes them:
+ * each file whole, then renamed, so a sync tool never picks up half of one;
+ * CSV as UTF-8 with a BOM (Excel then reads umlauts right), CRLF line ends,
+ * RFC 4180 quoting (`csvText`).
+ *
+ * The switch is visible JSON in the team project file — `"exports": { "csv": true }`
+ * — set by `cspeach team export --always` or the journey's report card. No
+ * hidden state. Default off.
+ */
+import path from 'node:path';
+import { csvText, exportSet } from '@cspeach/register-core';
+import { HELD } from './workbooks.js';
+import { readProjectFile, TEAM_FILE } from './store.js';
+import { writeWhole } from './write-whole.js';
+/** The folder the export goes into, under the reports folder (or the folder `--out` named for a report). */
+export const EXPORTS_DIR = 'exports';
+/** True only when the team project file says exactly `"exports": { "csv": true }`. */
+export function exportsOn(project) {
+    const e = project.exports;
+    return !!e && typeof e === 'object' && e.csv === true;
+}
+/** Set the switch on or off: the whole project file, then renamed. Every other field stays as it is. */
+export function setExports(projectDir, on) {
+    const project = readProjectFile(projectDir);
+    const had = project.exports && typeof project.exports === 'object' ? project.exports : {};
+    const next = { ...project, exports: { ...had, csv: on } };
+    writeWhole(path.join(projectDir, TEAM_FILE), `${JSON.stringify(next, null, 2)}\n`);
+}
+/** Turn the switch on (`team export --always`, the card's "Every time"). */
+export const setExportsAlways = (projectDir) => setExports(projectDir, true);
+/**
+ * Every file of the export into `dir`. Each file is tried on its own: one held
+ * open in Excel never costs the others, and the caller names it.
+ */
+export function writeExportFiles(register, project, dir, generatedAt) {
+    const set = exportSet(register, project, { generatedAt });
+    const files = [
+        ...set.tables.map((t) => [t.file, csvText(t)]),
+        ['manifest.json', `${JSON.stringify(set.manifest, null, 2)}\n`],
+        ['SCHEMA.md', set.schema],
+    ];
+    const saved = [];
+    const held = [];
+    for (const [name, text] of files) {
+        try {
+            writeWhole(path.join(dir, name), Buffer.from(text, 'utf8'));
+            saved.push(name);
+        }
+        catch (e) {
+            if (!HELD.has(e?.code ?? ''))
+                throw e;
+            held.push(name);
+        }
+    }
+    return { saved, held };
+}

package/dist/register/measure.js

@@ -98,18 +98,169 @@ function apiNameIn(text) {
  *
  * The TITLE is read first: it is where SAP names the API, while the long text
  * can quote source code and would otherwise hand a token like `TABLE` to the
- * record. The wording is STILL ASSUMED: the 2026-09-20 capture ran DEFAULT and
- * S4HANA_READINESS_2022 only, and neither produced an unreleased-API finding
- * (README answer 9, still open). This function is the only place that wording
- * is read, and it must be re-checked against a clean-core variant run.
+ * record.
+ *
+ * READINESS WORDING: VERIFIED-NO-API-NAME (live, S4H, 2026-10-08). On a real
+ * ABAP_CLOUD_READINESS worklist the message TEXT is empty on every finding and
+ * the title says only "Usage of not released ABAP Platform APIs." — SAP's
+ * wording names no API (`__tests__/fixtures/atc-readiness-worklist.xml`). So
+ * this rule names nothing on a real system, and it is KEPT ONLY AS A FALLBACK
+ * for a text that ever does name one. The API of a USAGE_OF_RELEASED_APIS
+ * finding comes from the finding itself instead: its REF_OBJ_NAME /
+ * REF_OBJ_TYPE tags, or its document (`apiNamesFor`), and it only feeds
+ * `uses` — the finding keeps its check's own rule id.
  */
 export function unreleasedApiRule(f) {
+    const name = unreleasedApiName(f);
+    return name ? `UNRELEASED_API:${name}` : null;
+}
+/** The API an unreleased-API finding names, by the same (unverified) reading as `unreleasedApiRule`. */
+function unreleasedApiName(f) {
     const title = f.messageTitle ?? '';
     const body = f.messageText ?? '';
     if (!NOT_RELEASED.test(`${title} ${body}`))
         return null;
-    const name = apiNameIn(title) ?? apiNameIn(body);
-    return name ? `UNRELEASED_API:${name}` : null;
+    return apiNameIn(title) ?? apiNameIn(body);
+}
+/**
+ * A finding of SAP's "Usage of Released APIs" check (USAGE_OF_RELEASED_APIS),
+ * read by its rule id exactly the way register-core's `classifyFinding` reads
+ * it. Only such a finding's referenced object is "the API it uses": the syntax
+ * check also tags a REF_OBJ_NAME, and that names a statement.
+ */
+export function isReleasedApiFinding(f) {
+    return [ruleIdFromAtc(f), ...ruleAliasesFromAtc(f)]
+        .some((id) => normalizeRuleId(id).split(':')[0] === 'USAGE_OF_RELEASED_APIS');
+}
+const apiRef = (o) => {
+    const name = typeof o?.name === 'string' ? o.name.trim().toUpperCase() : '';
+    const type = typeof o?.type === 'string' ? o.type.trim().toUpperCase() : '';
+    return name ? { name, ...(type ? { type } : {}) } : undefined;
+};
+/** Finding documents one run reads, at most. The rest are left without `uses`, counted and said. */
+export const MAX_API_DOCUMENTS = 200;
+/** Finding documents read at the same time. */
+export const API_DOCUMENT_CONCURRENCY = 4;
+/**
+ * The API each USAGE_OF_RELEASED_APIS finding uses, by finding.
+ *
+ * The worklist's own REF_OBJ_NAME / REF_OBJ_TYPE tags first — they cost
+ * nothing. A finding without them has its document read (distinct links, at
+ * most `API_DOCUMENT_CONCURRENCY` at a time, at most `cap` per run). A
+ * document that fails, names nothing, or was past the cap leaves its finding
+ * without a name: no `uses`, so it stays open for B. Never a guess.
+ */
+async function apiNamesFor(findings, read, cap, signal) {
+    const named = new Map();
+    const needDoc = new Map();
+    let namedNone = 0;
+    let notLookedUp = 0;
+    for (const f of findings) {
+        const tag = apiRef(f.referencedObject);
+        if (tag) {
+            named.set(f, tag);
+            continue;
+        }
+        if (!f.documentation)
+            namedNone += 1;
+        else if (!read)
+            notLookedUp += 1;
+        else
+            needDoc.set(f.documentation, [...(needDoc.get(f.documentation) ?? []), f]);
+    }
+    const hrefs = [...needDoc.keys()];
+    const toRead = hrefs.slice(0, Math.max(0, cap));
+    const overCap = hrefs.slice(toRead.length).reduce((n, h) => n + needDoc.get(h).length, 0);
+    let unreadable = 0;
+    let documents = 0;
+    const started = Date.now();
+    let next = 0;
+    const worker = async () => {
+        while (next < toRead.length && !signal?.aborted) {
+            const href = toRead[next++];
+            documents += 1;
+            try {
+                const ref = apiRef((await read(href))?.referencedObject);
+                if (ref)
+                    for (const f of needDoc.get(href))
+                        named.set(f, ref);
+                else
+                    namedNone += needDoc.get(href).length;
+            }
+            catch {
+                unreadable += needDoc.get(href).length;
+            }
+        }
+    };
+    await Promise.all(Array.from({ length: Math.min(API_DOCUMENT_CONCURRENCY, toRead.length) }, worker));
+    // Within the cap but never asked for: the run was stopped.
+    const stopped = toRead.slice(next).reduce((n, h) => n + needDoc.get(h).length, 0);
+    return {
+        named,
+        report: {
+            findings: findings.length, named: named.size, documents, ms: documents ? Date.now() - started : 0,
+            unnamed: findings.length - named.size, overCap, unreadable, namedNone, stopped, notLookedUp,
+        },
+    };
+}
+/* ── `uses`: what SAP says about the API a finding names (step 2, F8) ────── */
+/** API names per `ARS_W_API_STATE` read. */
+export const ARS_CHUNK = 50;
+/** At most this many type/state pairs are kept for one API name. */
+export const MAX_USES = 10;
+/**
+ * Rows asked for per ARS read. ARS holds a row per sub-object too, so a read
+ * that comes back FULL may have been cut, and the row cut off may be the one
+ * that is not stable: a full page is read as unreadable (review 3).
+ */
+export const ARS_MAX_ROWS = ARS_CHUNK * 20;
+/**
+ * One batched read of `ARS_W_API_STATE` per run, by `OBJECT_NAME`, in chunks
+ * of 50 distinct names (F8). Every distinct type/state SAP returns for a name
+ * is kept, as SAP spells it, so one entry that is not stable keeps the finding
+ * open for B (register-core `stateOfUses`). A name SAP returns nothing for
+ * gets no entry: the finding then has no `uses` and stays open — honest, not
+ * guessed. A read that fails reads nothing, and the measurement is written as
+ * it always was.
+ *
+ * The names come from the USAGE_OF_RELEASED_APIS findings themselves
+ * (`apiNamesFor`) and, as a fallback, from a message text that names an API
+ * (`unreleasedApiRule`): `uses` is written only on a finding one of them named.
+ */
+async function apiStatesOf(sql, names) {
+    const out = new Map();
+    // A name goes into the statement only when it can hold no quote or bracket.
+    const safe = [...new Set(names)].filter((n) => SAP_NAME.test(n));
+    for (let i = 0; i < safe.length; i += ARS_CHUNK) {
+        const chunk = safe.slice(i, i + ARS_CHUNK);
+        let rows;
+        try {
+            ({ rows } = await sql(`SELECT DISTINCT OBJECT_TYPE, OBJECT_NAME, RELEASE_STATE FROM ARS_W_API_STATE WHERE OBJECT_NAME IN (${chunk.map((n) => `'${n}'`).join(',')})`, ARS_MAX_ROWS));
+        }
+        catch {
+            return new Map(); // unreadable: no `uses` at all, never half of them
+        }
+        const list = Array.isArray(rows) ? rows : [];
+        if (list.length >= ARS_MAX_ROWS)
+            return new Map(); // possibly cut: no `uses` at all, never a wrong state
+        for (const r of list) {
+            const name = String(r?.OBJECT_NAME ?? '').trim().toUpperCase();
+            const type = String(r?.OBJECT_TYPE ?? '').trim().toUpperCase();
+            const state = String(r?.RELEASE_STATE ?? '').trim().toUpperCase();
+            if (!name || !type || !state || !chunk.includes(name))
+                continue;
+            const seen = out.get(name) ?? [];
+            if (!seen.some((u) => u.type === type && u.state === state))
+                seen.push({ type, name, state });
+            out.set(name, seen);
+        }
+    }
+    // More pairs than a finding carries: the name gets none, never a cut list whose
+    // missing entry could be the one that is not stable (review 3).
+    for (const [name, list] of out)
+        if (list.length > MAX_USES)
+            out.delete(name);
+    return out;
 }
 /**
  * SAP writes some check names as `ID / text` — `SLIN_DB / SELECT without ORDER
@@ -144,7 +295,11 @@ function halvesOf(src) {
  * `coverage.absent` goes to 0, an absent-clean row renders a plain "Clean", and
  * nothing anywhere says that nothing actually looked at the object.
  */
-export function findingsToRows(measured, findings, projectType) {
+export function findingsToRows(measured, findings, projectType, 
+/** What `ARS_W_API_STATE` said about each API name (`apiStatesOf`). Absent: no `uses` are written. */
+usesByName, 
+/** The API each USAGE_OF_RELEASED_APIS finding uses (`apiNamesFor`), by finding. */
+apiNameOf) {
     const byKey = new Map();
     const evidenceOf = new Map();
     for (const o of measured) {
@@ -160,7 +315,13 @@ export function findingsToRows(measured, findings, projectType) {
         if (!list)
             continue; // a finding for an object that was not measured is never written
         const atcRule = ruleIdFromAtc(f);
-        const api = projectType === 'clean-core' ? unreleasedApiRule(f) : null;
+        const apiName = projectType === 'clean-core' ? unreleasedApiName(f) : null;
+        const api = apiName ? `UNRELEASED_API:${apiName}` : null;
+        // The finding's own referenced object first; the text's name only as a fallback.
+        // When SAP said the TYPE, only ARS rows of that type are its state: ARS is read by
+        // name, and a function group SCAL is not the table SCAL (live, 2026-10-08).
+        const ref = (projectType === 'clean-core' ? apiNameOf?.get(f) : undefined) ?? (apiName ? { name: apiName } : undefined);
+        const uses = ref ? usesByName?.get(ref.name)?.filter((u) => !ref.type || u.type === ref.type) : undefined;
         // A finding nobody can name still counts: dropping it would make the object look cleaner than it is.
         const rule = api ?? (atcRule || UNNAMED_FINDING);
         const aliases = [...new Set([...(api && atcRule ? [atcRule] : []), ...ruleAliasesFromAtc(f), ...halvesOf(f)])]
@@ -182,6 +343,8 @@ export function findingsToRows(measured, findings, projectType) {
             ...(f.line ? { line: f.line } : {}),
             // The title only. The long text can quote source, and the record promises: no source code.
             ...(title ? { message: title.slice(0, 200) } : {}),
+            // F8: only on a finding whose API was named, and only what SAP returned for that name.
+            ...(uses?.length ? { uses: uses.map((u) => ({ ...u })) } : {}),
         });
     }
     return [...byKey.entries()].map(([key, list]) => {
@@ -408,7 +571,25 @@ export async function measure(input) {
     };
     if (!rowRefs.length)
         return { ...counts, file: null, withFindings: 0, refusedRows };
-    const rows = findingsToRows(rowRefs, [...outcome.findings, ...ownFindings], input.project.type);
+    const allFindings = [...outcome.findings, ...ownFindings];
+    // F8: the APIs the findings of measured objects use, read once for the whole run.
+    let usesByName;
+    let apiNameOf;
+    let apiNames;
+    if (input.sql && input.project.type === 'clean-core') {
+        const rowKeys = new Set(rowRefs.map((o) => objectKey(o.type, o.name)));
+        const inRows = allFindings.filter((f) => typeof f?.key === 'string' && rowKeys.has(normalizeKey(f.key)));
+        const releasedApi = inRows.filter(isReleasedApiFinding);
+        if (releasedApi.length) {
+            const got = await apiNamesFor(releasedApi, input.atc.findingDocument?.bind(input.atc), input.apiDocumentCap ?? MAX_API_DOCUMENTS, input.signal);
+            apiNameOf = got.named;
+            apiNames = got.report;
+        }
+        const names = [...[...(apiNameOf?.values() ?? [])].map((r) => r.name), ...inRows.map((f) => unreleasedApiName(f)).filter((n) => !!n)];
+        if (names.length)
+            usesByName = await apiStatesOf(input.sql, names);
+    }
+    const rows = findingsToRows(rowRefs, allFindings, input.project.type, usesByName, apiNameOf);
     const res = writeRecord(input.joined, 'measurement', rows, input.by, {
         ...(input.now ? { now: input.now } : {}), ...(input.dir ? { dir: input.dir } : {}),
         ...(input.fileName ? { fileName: input.fileName } : {}), ...(input.rand ? { rand: input.rand } : {}),
@@ -435,5 +616,6 @@ export async function measure(input) {
     return {
         ...counts, ...coverageNow(), file: res.file, refusedRows,
         withFindings: rows.filter((r) => r.findings.length > 0).length,
+        ...(apiNames ? { apiNames } : {}),
     };
 }

package/dist/register/plan-import.js

@@ -31,6 +31,8 @@ const DASH = PLAN_COLUMNS.indexOf('—');
 const FACT_COLUMNS = PLAN_COLUMNS.slice(DASH + 1);
 const lower = (s) => s.trim().toLowerCase();
 const CANONICAL = new Map(PLAN_COLUMNS.map((c) => [lower(c), c]));
+// The Objects sheet (1.1.32) heads the decided level "Level decided", beside its "Level now".
+CANONICAL.set('level decided', 'Level');
 /**
  * The Plan sheet and the export stamp of a workbook `team report` wrote.
  * Throws the one sentence for anything else: not an .xlsx, no Plan sheet, no
@@ -44,9 +46,10 @@ export function readPlanSheet(buffer) {
     catch {
         throw new RegisterError(NOT_A_PLAN_SHEET);
     }
-    const plan = sheets.find((s) => lower(s.name) === 'plan');
-    const readMe = sheets.find((s) => lower(s.name) === 'read me');
-    const stampCell = readMe?.rows.flat().find((c) => lower(c).startsWith(lower(EXPORT_STAMP)));
+    // 1.1.32 writes "Objects" with the stamp on "Summary"; a 1.1.31 workbook has "Plan" and "Read me".
+    const plan = sheets.find((s) => lower(s.name) === 'objects') ?? sheets.find((s) => lower(s.name) === 'plan');
+    const stampCell = sheets.filter((s) => lower(s.name) === 'summary' || lower(s.name) === 'read me')
+        .flatMap((s) => s.rows.flat()).find((c) => lower(c).startsWith(lower(EXPORT_STAMP)));
     const exportStamp = stampCell ? stampCell.trim().slice(EXPORT_STAMP.length).trim() : '';
     if (!plan || !STAMP.test(exportStamp) || Number.isNaN(Date.parse(exportStamp)))
         throw new RegisterError(NOT_A_PLAN_SHEET);

package/dist/register/records.js

@@ -167,7 +167,15 @@ export function fixRowsFromUpgradeProgress(content, baseline) {
  * per row, clean-core-confirm.ts). The five words map onto the four
  * classifications (spec §4.2); a fix or a rebuild with no target reaches A.
  */
-export function decisionRowsFromCleanCore(content) {
+export function decisionRowsFromCleanCore(content, 
+/**
+ * Who said Yes, and when. With it, a confirmed row whose proposal NAMED the
+ * level its target is read from — a fix/rebuild target, a keep/exception
+ * level — carries `targetBy` (F3, M19): the person's Yes set that target.
+ * A fix with no target in the proposal still records the legacy A, and that
+ * is no target. Absent: rows exactly as before.
+ */
+by) {
     const rows = [];
     for (const r of content.adjudications ?? []) {
         if (r?.confirmed !== true)
@@ -181,11 +189,13 @@ export function decisionRowsFromCleanCore(content) {
         if (!base)
             continue;
         const reason = typeof r.reason === 'string' ? r.reason.trim().slice(0, 300) : '';
+        const named = moves ? !!r.targetLevel : base.classification === 'keep' && !!r.level;
         rows.push({
             key: objectKey(r.objectType, r.objectName), ...base,
             ...(r.level ? { level: r.level } : {}),
             ...(moves ? { targetLevel: r.targetLevel ?? 'A' } : {}),
             ...(reason ? { reason } : {}),
+            ...(by && named ? { targetBy: { name: by.name, at: by.at } } : {}),
         });
     }
     return rows;
@@ -214,8 +224,10 @@ opts = {}) {
         return { ...res, refused: [...res.refused, ...ambiguous.map((n) => `${n} (name matches more than one object type)`)] };
     }
     if (env.artefactType === 'clean-core-decision') {
-        const rows = decisionRowsFromCleanCore(env.content);
-        return writeRecord(joined, 'decision', rows, by, { source, ...opts });
+        // Every row here had a person's Yes (confirmCleanCoreRows / the journey's row card).
+        const at = (opts.now ?? new Date()).toISOString();
+        const rows = decisionRowsFromCleanCore(env.content, { name: by.name, at });
+        return writeRecord(joined, 'decision', rows, by, { source, ...opts, now: opts.now ?? new Date(at) });
     }
     return null;
 }

package/dist/register/rule-proposal.js

@@ -0,0 +1,4 @@
+let slot = null;
+export const setRuleProposal = (p) => { slot = JSON.parse(JSON.stringify(p)); };
+export const ruleProposalFor = (projectId) => (slot && slot.projectId === projectId ? slot : null);
+export const clearRuleProposal = () => { slot = null; };