@ecoma-io/archkeep 0.26.0 → 0.27.1

package/src/corpus/goldens/debt.json

@@ -2,11 +2,11 @@
   "schemaVersion": 2,
   "tool": {
     "name": "@ecoma-io/archkeep",
-    "version": "0.26.0"
+    "version": "0.27.1"
   },
   "command": "debt",
   "workspace": {
-    "root": "/tmp/archkeep-golden-fixture",
+    "root": "<fixture-root>",
     "provider": "native",
     "marker": "archkeep.json",
     "provenance": {
@@ -31,10 +31,10 @@
     ]
   },
   "result": {
-    "dir": "/tmp/archkeep-golden-fixture/.archkeep-history",
+    "dir": "<fixture-root>/.archkeep-history",
     "snapshots": 1,
     "agings": false,
-    "sampleTime": "2026-09-07T06:50:29.512Z",
+    "sampleTime": "2026-09-08T10:33:14.692Z",
     "entries": [],
     "resolved": [],
     "total": 0,

package/src/corpus/goldens/debt.text

@@ -1,7 +1,7 @@
-debt  /tmp/archkeep-golden-fixture/.archkeep-history
+debt  <fixture-root>/.archkeep-history
 0 entries across 1 snapshot — ages not yet established (fewer than two snapshots)
 ✔ no architecture debt — no waivers, aspirational gaps, drift or unresolved intent
 no event store linked — lifecycle refs unavailable
 total 0 entries · byKind: waiver 0, expired-waiver 0, aspirational-gap 0, drift 0, unresolved 0 · bySeverity: high 0, medium 0, low 0
-sampled 2026-09-07T06:50:29.192Z
+sampled 2026-09-08T10:33:14.369Z
 ✔ complete (2 imports in 3 files across 3 projects)

package/src/corpus/goldens/decisions.json

@@ -2,11 +2,11 @@
   "schemaVersion": 2,
   "tool": {
     "name": "@ecoma-io/archkeep",
-    "version": "0.26.0"
+    "version": "0.27.1"
   },
   "command": "decisions",
   "workspace": {
-    "root": "/tmp/archkeep-golden-fixture",
+    "root": "<fixture-root>",
     "provider": "native",
     "marker": "docs/adr",
     "provenance": null

package/src/corpus/goldens/delta.json

@@ -2,11 +2,11 @@
   "schemaVersion": 2,
   "tool": {
     "name": "@ecoma-io/archkeep",
-    "version": "0.26.0"
+    "version": "0.27.1"
   },
   "command": "delta",
   "workspace": {
-    "root": "/tmp/archkeep-golden-fixture",
+    "root": "<fixture-root>",
     "provider": "native",
     "marker": "archkeep.json",
     "provenance": {
@@ -28,10 +28,10 @@
   },
   "result": {
     "baseline": {
-      "path": "/tmp/archkeep-golden-fixture/.archkeep-delta.json",
+      "path": "<fixture-root>/.archkeep-delta.json",
       "tool": {
         "name": "@ecoma-io/archkeep",
-        "version": "0.26.0"
+        "version": "0.27.1"
       },
       "provider": "native",
       "provenance": {

package/src/corpus/goldens/delta.text

@@ -1,4 +1,4 @@
-baseline  /tmp/archkeep-golden-fixture/.archkeep-delta.json — 1fd51709, 2 records, 3 projects
+baseline  <fixture-root>/.archkeep-delta.json — 1fd51709, 2 records, 3 projects
 head      1fd51709, 2 records, 3 projects
 ✔ no introduced violations — compared baseline 1fd51709 (2 records) against head 1fd51709 (2 records, 3 analyzed files, 3 projects)
 classifications  none

package/src/corpus/goldens/diff.json

@@ -2,11 +2,11 @@
   "schemaVersion": 2,
   "tool": {
     "name": "@ecoma-io/archkeep",
-    "version": "0.26.0"
+    "version": "0.27.1"
   },
   "command": "diff",
   "workspace": {
-    "root": "/tmp/archkeep-golden-fixture",
+    "root": "<fixture-root>",
     "provider": "native",
     "marker": "archkeep.json",
     "provenance": {
@@ -30,10 +30,10 @@
   },
   "result": {
     "baseline": {
-      "path": "/tmp/archkeep-golden-fixture/.archkeep-graph.json",
+      "path": "<fixture-root>/.archkeep-graph.json",
       "projects": 3,
       "edges": 2,
-      "toolVersion": "0.26.0",
+      "toolVersion": "0.27.1",
       "provenance": {
         "commit": "1fd51709c377d99a6139891e1200291cf08aede9",
         "remote": null,

package/src/corpus/goldens/diff.text

@@ -1,4 +1,4 @@
-baseline  /tmp/archkeep-golden-fixture/.archkeep-graph.json — 3 projects, 2 edges
+baseline  <fixture-root>/.archkeep-graph.json — 3 projects, 2 edges
 head      3 projects, 2 edges
 ✔ no boundary-rule impact
 ✔ no changes between baseline and head (2 imports in 3 files across 3 projects; per-edge rule-impact covers only depConstraints (3 of 15 violation types; standing edges adjacent to a tags-changed project are re-judged under both sides' tags). A dependency with no rule-impact may still violate npm-ban, circular-dependency, lazy-load, or other rules that require import-site details. Run check for the complete verdict.)

package/src/corpus/goldens/discover.json

@@ -2,11 +2,11 @@
   "schemaVersion": 2,
   "tool": {
     "name": "@ecoma-io/archkeep",
-    "version": "0.26.0"
+    "version": "0.27.1"
   },
   "command": "discover",
   "workspace": {
-    "root": "/tmp/archkeep-golden-fixture",
+    "root": "<fixture-root>",
     "provider": "native",
     "marker": "archkeep.json",
     "provenance": {

package/src/corpus/goldens/drift.json

@@ -2,11 +2,11 @@
   "schemaVersion": 2,
   "tool": {
     "name": "@ecoma-io/archkeep",
-    "version": "0.26.0"
+    "version": "0.27.1"
   },
   "command": "drift",
   "workspace": {
-    "root": "/tmp/archkeep-golden-fixture",
+    "root": "<fixture-root>",
     "provider": "native",
     "marker": "archkeep.json",
     "provenance": {

package/src/corpus/goldens/evolution.json

@@ -2,11 +2,11 @@
   "schemaVersion": 2,
   "tool": {
     "name": "@ecoma-io/archkeep",
-    "version": "0.26.0"
+    "version": "0.27.1"
   },
   "command": "evolution",
   "workspace": {
-    "root": "/tmp/archkeep-golden-fixture",
+    "root": "<fixture-root>",
     "provider": "native",
     "marker": "archkeep.json",
     "provenance": {
@@ -228,6 +228,7 @@
             "unknown": []
           },
           "debt": {
+            "judged": true,
             "introduced": [],
             "resolved": []
           },
@@ -309,6 +310,7 @@
         "unknown": []
       },
       "debt": {
+        "judged": true,
         "introduced": [],
         "resolved": []
       },

package/src/corpus/goldens/explain.json

@@ -2,11 +2,11 @@
   "schemaVersion": 2,
   "tool": {
     "name": "@ecoma-io/archkeep",
-    "version": "0.26.0"
+    "version": "0.27.1"
   },
   "command": "explain",
   "workspace": {
-    "root": "/tmp/archkeep-golden-fixture",
+    "root": "<fixture-root>",
     "provider": "native",
     "marker": "archkeep.json",
     "provenance": {

package/src/corpus/goldens/fitness.json

@@ -2,11 +2,11 @@
   "schemaVersion": 2,
   "tool": {
     "name": "@ecoma-io/archkeep",
-    "version": "0.26.0"
+    "version": "0.27.1"
   },
   "command": "fitness",
   "workspace": {
-    "root": "/tmp/archkeep-golden-fixture",
+    "root": "<fixture-root>",
     "provider": "native",
     "marker": "archkeep.json",
     "provenance": {

package/src/corpus/goldens/graph.json

@@ -2,11 +2,11 @@
   "schemaVersion": 2,
   "tool": {
     "name": "@ecoma-io/archkeep",
-    "version": "0.26.0"
+    "version": "0.27.1"
   },
   "command": "graph",
   "workspace": {
-    "root": "/tmp/archkeep-golden-fixture",
+    "root": "<fixture-root>",
     "provider": "native",
     "marker": "archkeep.json",
     "provenance": {

package/src/corpus/goldens/health.json

@@ -2,11 +2,11 @@
   "schemaVersion": 2,
   "tool": {
     "name": "@ecoma-io/archkeep",
-    "version": "0.26.0"
+    "version": "0.27.1"
   },
   "command": "health",
   "workspace": {
-    "root": "/tmp/archkeep-golden-fixture",
+    "root": "<fixture-root>",
     "provider": "native",
     "marker": "archkeep.json",
     "provenance": {

package/src/corpus/goldens/history.json

@@ -2,11 +2,11 @@
   "schemaVersion": 2,
   "tool": {
     "name": "@ecoma-io/archkeep",
-    "version": "0.26.0"
+    "version": "0.27.1"
   },
   "command": "history",
   "workspace": {
-    "root": "/tmp/archkeep-golden-fixture",
+    "root": "<fixture-root>",
     "provider": "native",
     "marker": "archkeep.json",
     "provenance": {
@@ -29,7 +29,7 @@
     ]
   },
   "result": {
-    "dir": "/tmp/archkeep-golden-fixture/.archkeep-history",
+    "dir": "<fixture-root>/.archkeep-history",
     "captured": null,
     "snapshots": [
       {

package/src/corpus/goldens/history.text

@@ -1,4 +1,4 @@
-history  /tmp/archkeep-golden-fixture/.archkeep-history
+history  <fixture-root>/.archkeep-history
 1 snapshot, 0 transitions (2 imports in 3 files across 3 projects)
 0  0001-71341a04.json  71341a04
 ✔ one snapshot, no transitions yet — capture again after an architectural change

package/src/corpus/goldens/impact.json

@@ -2,11 +2,11 @@
   "schemaVersion": 2,
   "tool": {
     "name": "@ecoma-io/archkeep",
-    "version": "0.26.0"
+    "version": "0.27.1"
   },
   "command": "impact",
   "workspace": {
-    "root": "/tmp/archkeep-golden-fixture",
+    "root": "<fixture-root>",
     "provider": "native",
     "marker": "archkeep.json",
     "provenance": {

package/src/corpus/goldens/provenance.json

@@ -2,11 +2,11 @@
   "schemaVersion": 2,
   "tool": {
     "name": "@ecoma-io/archkeep",
-    "version": "0.26.0"
+    "version": "0.27.1"
   },
   "command": "provenance",
   "workspace": {
-    "root": "/tmp/archkeep-golden-fixture",
+    "root": "<fixture-root>",
     "provider": "native",
     "marker": "archkeep.json",
     "provenance": {

package/src/corpus/goldens/reconcile.json

@@ -2,11 +2,11 @@
   "schemaVersion": 2,
   "tool": {
     "name": "@ecoma-io/archkeep",
-    "version": "0.26.0"
+    "version": "0.27.1"
   },
   "command": "reconcile",
   "workspace": {
-    "root": "/tmp/archkeep-golden-fixture",
+    "root": "<fixture-root>",
     "provider": "native",
     "marker": "archkeep.json",
     "provenance": {

package/src/corpus/goldens/report.json

@@ -2,11 +2,11 @@
   "schemaVersion": 2,
   "tool": {
     "name": "@ecoma-io/archkeep",
-    "version": "0.26.0"
+    "version": "0.27.1"
   },
   "command": "report",
   "workspace": {
-    "root": "/tmp/archkeep-golden-fixture",
+    "root": "<fixture-root>",
     "provider": "native",
     "marker": "archkeep.json",
     "provenance": {

package/src/corpus/goldens/report.text

@@ -1,7 +1,7 @@
 architecture governance report — every surface reached a verdict
 
 provenance
-  root        /tmp/archkeep-golden-fixture
+  root        <fixture-root>
   provider    native (archkeep.json)
   policy      module-boundaries.config.mjs
   commit      1fd51709c377d99a6139891e1200291cf08aede9

package/src/corpus/goldens/scenario.json

@@ -2,11 +2,11 @@
   "schemaVersion": 2,
   "tool": {
     "name": "@ecoma-io/archkeep",
-    "version": "0.26.0"
+    "version": "0.27.1"
   },
   "command": "scenario",
   "workspace": {
-    "root": "/tmp/archkeep-golden-fixture",
+    "root": "<fixture-root>",
     "provider": "native",
     "marker": "archkeep.json",
     "provenance": {

package/src/corpus/goldens/trajectory.json

@@ -2,11 +2,11 @@
   "schemaVersion": 2,
   "tool": {
     "name": "@ecoma-io/archkeep",
-    "version": "0.26.0"
+    "version": "0.27.1"
   },
   "command": "trajectory",
   "workspace": {
-    "root": "/tmp/archkeep-golden-fixture",
+    "root": "<fixture-root>",
     "provider": "native",
     "marker": "archkeep.json",
     "provenance": {
@@ -30,7 +30,7 @@
     ]
   },
   "result": {
-    "dir": "/tmp/archkeep-golden-fixture/.archkeep-history",
+    "dir": "<fixture-root>/.archkeep-history",
     "observations": {
       "count": 1,
       "basis": "graph_snapshots",

package/src/corpus/goldens/trajectory.text

@@ -1,4 +1,4 @@
-trajectory  /tmp/archkeep-golden-fixture/.archkeep-history
+trajectory  <fixture-root>/.archkeep-history
 1 observation (graph_snapshots), 0 transitions
 ✖ insufficient_history: a trajectory needs at least two observations — derived values are unavailable, not zero
 signals  architecture 0 · policy 0 · provider 0 · code drift 0 · incomparable 0 · unchanged 0

package/src/corpus/goldens/waivers.json

@@ -2,11 +2,11 @@
   "schemaVersion": 2,
   "tool": {
     "name": "@ecoma-io/archkeep",
-    "version": "0.26.0"
+    "version": "0.27.1"
   },
   "command": "waivers",
   "workspace": {
-    "root": "/tmp/archkeep-golden-fixture",
+    "root": "<fixture-root>",
     "provider": "native",
     "marker": "archkeep.json",
     "provenance": {

package/src/go-work.mjs

@@ -276,13 +276,12 @@ function useDirectory(usePath, workspaceRoot) {
  * - **`goWorkOutsideUse`** — a `use` entry above the workspace root. Whatever
  *   it builds, no run over this workspace can cover it.
  *
- * One of the FOUR finding families — PD-13 (2026-09-06) outcome (c): no
+ * One of the FOUR finding families: no
  * Finding supertype exists, and the relationship pin lives on
- * `./rules/index.mjs`'s `violationOf` header. These findings stay this
+ * `./rules/index.mjs`'s `violationOf` header (stated in
+ * `../../../docs/concepts/evidence.md`'s "Four finding families"). These findings stay this
  * family's own shape and fold into the one verdict lane as count keys into
- * `verdictFor` (`./verdict.mjs`). The canonical statement is the
- * "Finding — the unowned concept" section of
- * `../../../docs/architecture/refactor/SEMANTIC-MODEL.md`.
+ * `verdictFor` (`./verdict.mjs`).
  *
  * @param {{ uses: { path: string, line: number, column: number }[],
  *   workspaceRoot: string,

package/src/governance/debt-ledger.mjs

@@ -208,7 +208,10 @@ export function driftFactOf(finding) {
  *
  * @param {object} baseVerdict A `judgeIntent` result over the base graph.
  * @param {object} headVerdict A `judgeIntent` result over the head graph.
- * @returns {{introduced: string[], resolved: string[]}} Stable debt ids.
+ * @returns {{judged: true, introduced: string[], resolved: string[]}} Stable
+ *   debt ids, marked judged — the in-band complement of `judged: false`, so a
+ *   consumer can always distinguish "no debt existed" from "debt could not be
+ *   judged" (see `../../AGENTS.md`'s invariant).
  */
 export function debtChangeDiff(baseVerdict, headVerdict) {
   const driftOf = (v) => (v.findings ?? []).map((f) => debtFactId("drift", driftFactOf(f)));
@@ -218,7 +221,7 @@ export function debtChangeDiff(baseVerdict, headVerdict) {
   const headIds = new Set([...driftOf(headVerdict), ...gapOf(headVerdict)]);
   const introduced = [...headIds].filter((id) => !baseIds.has(id)).sort();
   const resolved = [...baseIds].filter((id) => !headIds.has(id)).sort();
-  return { introduced, resolved };
+  return { judged: true, introduced, resolved };
 }
 /**
  * Reduces an `opts.events` value to a loaded event array, or `null` when no

package/src/governance/evolution-event.mjs

@@ -198,8 +198,7 @@ export function escapeIdentityField(value) {
  * index maps, `trajectory`'s persistence sets — and is never stored. Different
  * media, one law: each family keeps exactly one identity constructor, and
  * consumers consume a constructor's output rather than re-deriving a second
- * spelling of it (`../../../../docs/adr/0008-snapshot-identity-per-family.md`,
- * INV-6 in `../../../../docs/architecture/refactor/INVARIANTS.md`). An edge
+ * spelling of it (`../../../../docs/adr/0008-snapshot-identity-per-family.md`). An edge
  * reaches this module only as its raw triple, never as a pre-built string
  * from either spelling (`evolutionBoundary` below refuses one), and a
  * `\0`-joined diff key written into an event would give one edge two

package/src/governance/reconcile-score.mjs

@@ -268,8 +268,13 @@ export function scoreEdge(edge, keys, intentForbiddenPairs, tagForbiddenPairs) {
  * Boundary `allowed`/`forbidden` rows are scored from the canonical judge's
  * findings (matched exactly by `from`/`to`): a `forbidden` row with an
  * `intentForbiddenEdge` finding is `unexpected`, an `allowed` row with an
- * `intentAllowedMissing` finding is `absent`. Project and dependency rows are
- * scored directly against the observed names and edges. A
+ * `intentAllowedMissing` finding is `absent`. Project rows are scored against
+ * the observed names, and the two forbidden drift planes are scored from the
+ * judge's findings as well — `dependencies.forbidden` through its
+ * `dependencyForbidden` findings, `forbiddenTags` through its
+ * `tagDependencyForbidden` witnesses attributed via `tagsByProject` — so a
+ * row's verdict IS the verdict `check` and `drift` render, including the
+ * transitive closure a direct-edge re-derivation would read as "match". A
  * `dependencies.allowed` row is an allowlist entry, not an existence claim —
  * its absence in the graph is not divergence, so it scores `match` either
  * way (the divergent direction is the observed edge outside the list, scored
@@ -285,7 +290,29 @@ export function scoreIntentRows(intent, judgeVerdict, observed, tagsByProject) {
   // used by its own test
   const rows = [];
   const observedNames = new Set(observed.projects.map((p) => p.name));
-  const observedEdgeKeys = new Set(observed.edges.map((e) => `${e.source} → ${e.target}`));
+  // The judge has already judged every forbidden plane on the any-path
+  // closure (`../architecture-intent/judge.mjs` emits `dependencyForbidden`
+  // and `tagDependencyForbidden` for direct AND transitive paths, as concrete
+  // `source`/`target` project names with `boundaryFrom: null`). These two
+  // projections score the drift rows from those findings — projecting the
+  // canonical verdict, never re-deriving reachability here: a re-walk of the
+  // direct-edge list would score a transitive violation the judge reported
+  // as a row "match", the divergence `check` and `drift` do report. The
+  // judge's pairless findings (`intentUnknownProject`, `intentUnknownTag`)
+  // carry no witness pair; the rows they belong to are scored below from the
+  // observed names and tags themselves — the same existence predicate the
+  // judge used to emit them: a row whose endpoint can never resolve is
+  // unknown/unverifiable, never a silent "match".
+  const dependencyForbiddenPairs = new Set();
+  const tagForbiddenWitnesses = [];
+  for (const finding of judgeVerdict.findings) {
+    if (finding.source === null || finding.target === null) continue;
+    if (finding.rule === "dependencyForbidden") {
+      dependencyForbiddenPairs.add(`${finding.source} → ${finding.target}`);
+    } else if (finding.rule === "tagDependencyForbidden") {
+      tagForbiddenWitnesses.push([finding.source, finding.target]);
+    }
+  }
 
   const boundaryFinding = new Map();
   for (const finding of judgeVerdict.findings) {
@@ -341,22 +368,45 @@ export function scoreIntentRows(intent, judgeVerdict, observed, tagsByProject) {
   }
   for (const forbidden of dependencies.forbidden ?? []) {
     const key = `${forbidden.source} → ${forbidden.target}`;
+    // A row naming a project the observed architecture does not have can
+    // never fire — the judge reports it as `intentUnknownProject` with no
+    // witness pair, so the projection above stays empty for it. Reading
+    // that as "match — the ban holds" would be the silent direction; score
+    // it unknown, mirroring the boundary plane (`reconcileScores`).
+    if (!observedNames.has(forbidden.source) || !observedNames.has(forbidden.target)) {
+      row("edge", key, "unknown", "intentUnknownProject", "forbidden", key);
+      continue;
+    }
+    const violated = dependencyForbiddenPairs.has(key);
     row(
       "edge",
       key,
-      observedEdgeKeys.has(key) ? "unexpected" : "match",
-      observedEdgeKeys.has(key) ? "dependencyForbidden" : "match",
+      violated ? "unexpected" : "match",
+      violated ? "dependencyForbidden" : "match",
       "forbidden",
       key,
     );
   }
 
+  // Every tag any observed project carries — the existence side of a
+  // `forbiddenTags` row, the same vocabulary the judge checks when it emits
+  // `intentUnknownTag`.
+  const allTags = new Set();
+  for (const tags of tagsByProject.values()) {
+    for (const tag of tags) allTags.add(tag);
+  }
   for (const tagRow of intent.forbiddenTags ?? []) {
     const key = `${tagRow.from} → ${tagRow.to}`;
-    const violated = observed.edges.some((e) => {
-      if (e.source === e.target) return false;
-      const sourceTags = tagsByProject.get(e.source) ?? [];
-      const targetTags = tagsByProject.get(e.target) ?? [];
+    // A row naming a tag no observed project carries can never fire — the
+    // judge reports it as `intentUnknownTag` with no witness pair. Score it
+    // unknown, never a silent "match".
+    if (!allTags.has(tagRow.from) || !allTags.has(tagRow.to)) {
+      row("tag", key, "unknown", "intentUnknownTag", "tag-forbidden", key);
+      continue;
+    }
+    const violated = tagForbiddenWitnesses.some(([source, target]) => {
+      const sourceTags = tagsByProject.get(source) ?? [];
+      const targetTags = tagsByProject.get(target) ?? [];
       return sourceTags.includes(tagRow.from) && targetTags.includes(tagRow.to);
     });
     row(

package/src/intent/intent-manifest.json

@@ -52,7 +52,7 @@
           "type": "source-evidence",
           "path": "cli.mjs",
           "assertion": "Exit codes 0/1/3 distinguish clean/findings/cannot-look",
-          "sha256": "2b6590f4039464d3569727d0a73db61dd86c18648a519ee034ebcc2d845ecfc7"
+          "sha256": "536fef05cdf8d6ec8a5c364819d2dcbf61cdcf75b638463e98b89d6073e27851"
         }
       ],
       "status": "proven"
@@ -66,13 +66,13 @@
           "type": "behavioral-test",
           "path": "src/intent/intent.test.mjs",
           "assertion": "analysis output conforms to the frozen contract schema (no extra verdict/policy fields); analysis output is invariant under project tag changes (three workspaces differing only in project tag fields compared byte-for-byte)",
-          "sha256": "749414363ef9991ae3697fc00ab5969751666867792d4bb4dbe528ec47ccd740"
+          "sha256": "8c481f1230ae8700469816018fba99017a0014920b12bebdf262ceb241cba745"
         },
         {
           "type": "architecture-test",
           "path": "src/intent/intent.test.mjs",
           "assertion": "the gate walks every production analysis module and fails when judging vocabulary (judge/forbid/permit/allow/ban) appears in code",
-          "sha256": "749414363ef9991ae3697fc00ab5969751666867792d4bb4dbe528ec47ccd740"
+          "sha256": "8c481f1230ae8700469816018fba99017a0014920b12bebdf262ceb241cba745"
         },
         {
           "type": "source-evidence",
@@ -84,7 +84,7 @@
           "type": "source-evidence",
           "path": "AGENTS.md",
           "assertion": "src/graph/ is a lossy view of analysis, on purpose; src/analysis/ never judges",
-          "sha256": "552b54c1956370f024ffeecec95c0e0941a0c66d4a14094045b444a25a27f913"
+          "sha256": "6ab8eef7a1ec2a8bde81393880cc6d29b1f089b01ffec403b31846c5d3a1a830"
         }
       ],
       "status": "proven"
@@ -136,7 +136,7 @@
           "type": "source-evidence",
           "path": "src/commands/diff.mjs",
           "assertion": "parseBaseline validates schemaVersion; refuses unknown versions",
-          "sha256": "4d44eea475cd4b06122a405718203d2e0018a163c1d42b17324400e7e4de5eea"
+          "sha256": "59e6e8f1cb0535cbec241f6daf99c10f5a679c798e66fcc1f4afb5329bc6497a"
         }
       ],
       "status": "proven"
@@ -156,7 +156,7 @@
           "type": "source-evidence",
           "path": "src/commands/diff.mjs",
           "assertion": "computeDiff returns structural diff; policyMismatch detected via fingerprint; computeRuleImpact for depConstraints-only context",
-          "sha256": "4d44eea475cd4b06122a405718203d2e0018a163c1d42b17324400e7e4de5eea"
+          "sha256": "59e6e8f1cb0535cbec241f6daf99c10f5a679c798e66fcc1f4afb5329bc6497a"
         }
       ],
       "status": "proven"
@@ -236,7 +236,7 @@
           "type": "behavioral-test",
           "path": "src/intent/intent.test.mjs",
           "assertion": "depConstraints verdicts from judgeEdge agree with evaluate in both directions (violating edge found by both, legal edge reported by neither); explain includes the same violations as evaluate at a given site",
-          "sha256": "749414363ef9991ae3697fc00ab5969751666867792d4bb4dbe528ec47ccd740"
+          "sha256": "8c481f1230ae8700469816018fba99017a0014920b12bebdf262ceb241cba745"
         },
         {
           "type": "behavioral-test",
@@ -266,7 +266,7 @@
           "type": "source-evidence",
           "path": "src/commands/diff.mjs",
           "assertion": "coverage.notes warns when ruleImpact is computed (depConstraints only, 3 of 15)",
-          "sha256": "4d44eea475cd4b06122a405718203d2e0018a163c1d42b17324400e7e4de5eea"
+          "sha256": "59e6e8f1cb0535cbec241f6daf99c10f5a679c798e66fcc1f4afb5329bc6497a"
         },
         {
           "type": "documentation",