@holmes-lab/holmes-kit 0.1.8 → 0.1.10

package/dist/holmes/spec/approval-blockers.d.ts

@@ -2,12 +2,28 @@ import { Spec } from './spec-parser';
 /**
  * Sections that still hold nothing but a generated placeholder.
  *
- * Two generators plant placeholders and both are judged here:
- *  - `reverse_draft` writes `TODO — <prompt>` plus the INFERRED marker comment. Both are
- *    required together: 11 of this repository's 257 approved specs use the word "TODO" in
- *    legitimate prose ("남아 있는 TODO 주석을 제거한다"), and a word search refuses every one.
+ * Three shapes are judged, and the last two are a UNION rather than a replacement:
  *  - `spec_create` writes the bare literal `TODO` (`FIELD_PLACEHOLDER`) into each required section.
- *    That one is unambiguous on its own — an entire section equal to the string is never prose.
+ *    Unambiguous on its own — an entire section equal to that string is never prose.
+ *  - `reverse_draft` writes `TODO — <prompt>` plus the INFERRED marker. Requiring both together is
+ *    what lets a section that is FILLED with scan evidence and still carries a TODO count as
+ *    unfinished (`evidenceThenTodo`, the main brownfield shape REQ-181 created).
+ *  - A `TODO` line with nothing but furniture around it, marker or no marker.
+ *
+ * @implements A-SPEC-240
+ * WHY THE THIRD SHAPE EXISTS. Measured 2026-08-23 against the installed package: an H-SPEC whose
+ * eight prose sections all read `TODO — 사람이 쓸 것` — title and owner placeholders too — received
+ * `status: approved` and an `approved_digest`. The marker was absent, so nothing looked. `INFERRED`
+ * is an HTML comment: invisible when rendered, and easy to strip while editing the section around
+ * it. Keying the judgement on it means the protection can vanish silently.
+ *
+ * WHY IT IS A UNION AND NOT A REPLACEMENT. The first cut replaced the marker rule with the emptiness
+ * rule, and `evidenceThenTodo` walked through it — a file list reads as substance. Measured across
+ * 482 approved specs the two rules disagree on nothing, so the union costs no false refusals while
+ * each covers what the other cannot.
+ *
+ * The word "TODO" in ordinary prose is still safe: 37 approved sections use it that way
+ * ("남아 있는 TODO 주석을 제거한다"), and every one carries real content beside it.
  */
 export declare function placeholderSections(spec: Spec): string[];
 /**

package/dist/holmes/spec/approval-blockers.js

@@ -79,15 +79,56 @@ const stripFences = (s) => {
  * emptiness matters most.
  */
 const TODO_LINE = /^TODO\s*[—-]/m;
+/**
+ * Furniture a generator writes around the prose a human still owes.
+ *
+ * @implements A-SPEC-240
+ * Deliberately a closed, short list: an HTML comment (the markers), the reverse-engineering note,
+ * and the prompt line itself. Lengthening it widens what counts as "empty", which is a decision to
+ * refuse more documents — not one to make without measuring.
+ */
+const FURNITURE = [/^TODO\s*[—-]/, /^NOTE: this spec was REVERSE-ENGINEERED/];
+/**
+ * Is there anything left once the generator's furniture is removed?
+ *
+ * @implements A-SPEC-240
+ * A `TODO` line is the precondition for asking at all — see `placeholderSections`. What counts as
+ * adequate prose is a question a machine cannot answer, so a short but genuine section is left
+ * alone; only a section that is nothing BUT scaffolding is judged empty.
+ */
+function hasNoSubstance(text) {
+    const rest = stripFences(text)
+        .replace(/<!--[\s\S]*?-->/g, '')
+        .split('\n')
+        .map((l) => l.trim())
+        .filter((l) => l !== '' && !FURNITURE.some((re) => re.test(l)));
+    return rest.length === 0;
+}
 /**
  * Sections that still hold nothing but a generated placeholder.
  *
- * Two generators plant placeholders and both are judged here:
- *  - `reverse_draft` writes `TODO — <prompt>` plus the INFERRED marker comment. Both are
- *    required together: 11 of this repository's 257 approved specs use the word "TODO" in
- *    legitimate prose ("남아 있는 TODO 주석을 제거한다"), and a word search refuses every one.
+ * Three shapes are judged, and the last two are a UNION rather than a replacement:
  *  - `spec_create` writes the bare literal `TODO` (`FIELD_PLACEHOLDER`) into each required section.
- *    That one is unambiguous on its own — an entire section equal to the string is never prose.
+ *    Unambiguous on its own — an entire section equal to that string is never prose.
+ *  - `reverse_draft` writes `TODO — <prompt>` plus the INFERRED marker. Requiring both together is
+ *    what lets a section that is FILLED with scan evidence and still carries a TODO count as
+ *    unfinished (`evidenceThenTodo`, the main brownfield shape REQ-181 created).
+ *  - A `TODO` line with nothing but furniture around it, marker or no marker.
+ *
+ * @implements A-SPEC-240
+ * WHY THE THIRD SHAPE EXISTS. Measured 2026-08-23 against the installed package: an H-SPEC whose
+ * eight prose sections all read `TODO — 사람이 쓸 것` — title and owner placeholders too — received
+ * `status: approved` and an `approved_digest`. The marker was absent, so nothing looked. `INFERRED`
+ * is an HTML comment: invisible when rendered, and easy to strip while editing the section around
+ * it. Keying the judgement on it means the protection can vanish silently.
+ *
+ * WHY IT IS A UNION AND NOT A REPLACEMENT. The first cut replaced the marker rule with the emptiness
+ * rule, and `evidenceThenTodo` walked through it — a file list reads as substance. Measured across
+ * 482 approved specs the two rules disagree on nothing, so the union costs no false refusals while
+ * each covers what the other cannot.
+ *
+ * The word "TODO" in ordinary prose is still safe: 37 approved sections use it that way
+ * ("남아 있는 TODO 주석을 제거한다"), and every one carries real content beside it.
  */
 function placeholderSections(spec) {
     const out = [];
@@ -98,7 +139,9 @@ function placeholderSections(spec) {
             continue;
         }
         const prose = stripFences(text);
-        if (TODO_LINE.test(prose) && prose.includes(draft_1.INFERRED))
+        if (!TODO_LINE.test(prose))
+            continue;
+        if (prose.includes(draft_1.INFERRED) || hasNoSubstance(text))
             out.push(name);
     }
     return out;

package/dist/holmes/spec/legacy-format.d.ts

@@ -35,6 +35,20 @@ export type FormatState =
 };
 /** Frontmatter key that preserves the pre-upgrade status. Named once so writer and reader agree. */
 export declare const LEGACY_STATUS_FIELD = "legacy_status";
+/**
+ * Where a legacy `depends_on` string is kept verbatim.
+ *
+ * @implements A-SPEC-221
+ * The old format wrote the parent as `REQ-001:<hash>`. The parser only understood arrays, so the
+ * whole value became `[]` — measured on H-SPEC-001, the upgrade destroyed the parent edge and then
+ * reported `orphan: H-SPEC requires a parent of type REQ` about the edge it had just removed.
+ *
+ * The digest is preserved rather than promoted. Writing it into `parent_digests` would assert that
+ * a `version_token`-era value is an approval digest, and there is no evidence the two are the same
+ * computation — asserting it anyway is the fabrication this repository keeps removing. Verbatim
+ * preservation leaves the judgement to a person who can actually make it.
+ */
+export declare const LEGACY_DEPENDS_FIELD = "legacy_depends_on";
 /**
  * Classify a document by FORMAT, not by validity.
  *

package/dist/holmes/spec/legacy-format.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.LEGACY_STATUS_FIELD = void 0;
+exports.LEGACY_DEPENDS_FIELD = exports.LEGACY_STATUS_FIELD = void 0;
 exports.formatStateOf = formatStateOf;
 exports.legacyMessage = legacyMessage;
 exports.upgradePlan = upgradePlan;
@@ -8,6 +8,20 @@ exports.upgradedFrontmatter = upgradedFrontmatter;
 const spec_types_1 = require("./spec-types");
 /** Frontmatter key that preserves the pre-upgrade status. Named once so writer and reader agree. */
 exports.LEGACY_STATUS_FIELD = 'legacy_status';
+/**
+ * Where a legacy `depends_on` string is kept verbatim.
+ *
+ * @implements A-SPEC-221
+ * The old format wrote the parent as `REQ-001:<hash>`. The parser only understood arrays, so the
+ * whole value became `[]` — measured on H-SPEC-001, the upgrade destroyed the parent edge and then
+ * reported `orphan: H-SPEC requires a parent of type REQ` about the edge it had just removed.
+ *
+ * The digest is preserved rather than promoted. Writing it into `parent_digests` would assert that
+ * a `version_token`-era value is an approval digest, and there is no evidence the two are the same
+ * computation — asserting it anyway is the fabrication this repository keeps removing. Verbatim
+ * preservation leaves the judgement to a person who can actually make it.
+ */
+exports.LEGACY_DEPENDS_FIELD = 'legacy_depends_on';
 /**
  * Classify a document by FORMAT, not by validity.
  *

package/dist/holmes/spec/nonfunctional.d.ts

@@ -0,0 +1,70 @@
+/**
+ * One non-functional obligation, read from an H-SPEC's `## Non-Functional`.
+ *
+ * @implements A-SPEC-234
+ * WHY THIS EXISTS. `## Non-Functional` is a REQUIRED section — measured 2026-08-22, all 105 approved
+ * H-SPECs in this repository have one filled in. Nothing read it. The T-SPEC approval gate asks only
+ * for the four input quadrants (Normal/Corner/Negative/Boundary), which are an input-selection
+ * taxonomy: equivalence partitioning, boundary values, negative cases. Concurrency, resource
+ * exhaustion and partial failure are not kinds of INPUT but kinds of EXECUTION CONDITION, so they
+ * never belonged to that question and no gate ever asked about them.
+ *
+ * The cost is on record in this session: an H-SPEC declared a cost obligation, its T-SPEC was green
+ * on all four quadrants, and 10,558ms shipped for a 2KB file.
+ */
+export interface NonFunctionalObligation {
+    /** Author-chosen, lower-cased. The vocabulary is NOT fixed — see `parseNonFunctional`. */
+    tag: string;
+    /** The obligation as written, minus the tag. */
+    text: string;
+    /** The line as written, so a report can quote it. */
+    line: string;
+}
+/**
+ * Read the obligations out of a `## Non-Functional` section.
+ *
+ * @implements A-SPEC-234
+ * A malformed list item is RETURNED, never dropped. A typo that silently parses to nothing reads as
+ * "the rule passed" — the shape this repository has paid for in A-SPEC-191 §17, §29 and again in
+ * A-SPEC-222.2. Prose and blank lines are neither: a section is allowed to explain itself.
+ *
+ * THE TAG VOCABULARY IS NOT FIXED, AND THAT IS THE POINT. A closed set of allowed tags becomes a
+ * thing to maintain and then falls behind — the enumeration-chasing this repository already rejected
+ * for tool names (`write-target.ts`). Whatever the author writes IS the vocabulary; the machine
+ * judges CORRESPONDENCE between an H-SPEC tag and a T-SPEC tag, never meaning.
+ *
+ * WHAT THIS DOES NOT SEE. Whether the obligation is a good one. Whether the case tagged with it
+ * actually exercises it — a case reading `- [perf] Given nothing When nothing Then nothing` counts
+ * as met. Obligations written as prose without a tag (the other 105 documents). Those are human
+ * judgements, and simulating them would recreate the "documented but unenforced" state this slice
+ * exists to remove.
+ */
+export declare function parseNonFunctional(section: unknown): {
+    obligations: NonFunctionalObligation[];
+    malformed: string[];
+};
+/**
+ * The obligation tags a T-SPEC's CASES carry.
+ *
+ * @implements A-SPEC-234
+ * Only the four case sections count, and the section names are read from the type table rather than
+ * spelled here — a second spelling of a location is a second thing to keep in step, and this
+ * repository has already paid for that twice (`isTestFile` drifted into two copies; a restated
+ * section-splitting regex returned an empty section while the check using it went green).
+ *
+ * A tag anywhere else in the document states an INTENTION. Only a case is evidence that something
+ * was tested.
+ */
+export declare function caseObligationTags(sections: unknown): Set<string>;
+/**
+ * Obligations an H-SPEC declares that no child T-SPEC case answers.
+ *
+ * @implements A-SPEC-234
+ * Matching is EXACT after lower-casing. A prefix match would let `perf` be satisfied by
+ * `performance`, and a false "met" is a gate switched off that says nothing — the same asymmetry
+ * that made `call` targets exact in `forbidden-edges.ts`.
+ *
+ * `malformed` lines are NOT reported here. Flagging syntax errors and judging fulfilment are
+ * different questions; mixed together, one typo invents an obligation nobody declared.
+ */
+export declare function unmetObligations(nonFunctional: unknown, tspecSections: unknown[]): NonFunctionalObligation[];

package/dist/holmes/spec/nonfunctional.js

@@ -0,0 +1,119 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseNonFunctional = parseNonFunctional;
+exports.caseObligationTags = caseObligationTags;
+exports.unmetObligations = unmetObligations;
+// @implements A-SPEC-234
+const spec_types_1 = require("./spec-types");
+/**
+ * `- [tag] text` — the whole grammar.
+ *
+ * WHY THIS SPELLING. Measured 2026-08-22 across the approved corpus: a leading `- [tag]` appears in
+ * 0 of the 174 `## Non-Functional` lines and 0 of the 1,511 T-SPEC case lines. The obvious
+ * alternative, `- name: text`, already appears 21 times (13%) — adopting it would have invented 21
+ * false obligations on the day it shipped, breaking the rule this repository keeps: the first rule
+ * applied must be one that is ALREADY TRUE.
+ *
+ * The tag is only recognised at the START of a line. Eleven approved T-SPEC case lines contain
+ * brackets mid-prose (`[f1]`, `[V]`, `[REQ-007]`) and every one is a code fragment; counting those
+ * would invent coverage nobody wrote.
+ */
+const OBLIGATION = /^\[([A-Za-z][A-Za-z0-9-]*)\]\s+(\S.*)$/;
+/** A line that reaches for the grammar: `- [` … and then gets it wrong. */
+const IMITATES = /^\[/;
+const clean = (s) => s.replace(/`/g, '').trim().replace(/\s+/g, ' ');
+/**
+ * Read the obligations out of a `## Non-Functional` section.
+ *
+ * @implements A-SPEC-234
+ * A malformed list item is RETURNED, never dropped. A typo that silently parses to nothing reads as
+ * "the rule passed" — the shape this repository has paid for in A-SPEC-191 §17, §29 and again in
+ * A-SPEC-222.2. Prose and blank lines are neither: a section is allowed to explain itself.
+ *
+ * THE TAG VOCABULARY IS NOT FIXED, AND THAT IS THE POINT. A closed set of allowed tags becomes a
+ * thing to maintain and then falls behind — the enumeration-chasing this repository already rejected
+ * for tool names (`write-target.ts`). Whatever the author writes IS the vocabulary; the machine
+ * judges CORRESPONDENCE between an H-SPEC tag and a T-SPEC tag, never meaning.
+ *
+ * WHAT THIS DOES NOT SEE. Whether the obligation is a good one. Whether the case tagged with it
+ * actually exercises it — a case reading `- [perf] Given nothing When nothing Then nothing` counts
+ * as met. Obligations written as prose without a tag (the other 105 documents). Those are human
+ * judgements, and simulating them would recreate the "documented but unenforced" state this slice
+ * exists to remove.
+ */
+function parseNonFunctional(section) {
+    const obligations = [];
+    const malformed = [];
+    if (typeof section !== 'string')
+        return { obligations, malformed };
+    for (const raw of section.split('\n')) {
+        const line = raw.trim();
+        if (!line.startsWith('- '))
+            continue; // prose, blank, or a non-list line
+        const body = clean(line.slice(2));
+        const m = OBLIGATION.exec(body);
+        if (m) {
+            obligations.push({ tag: m[1].toLowerCase(), text: m[2].trim(), line });
+            continue;
+        }
+        // Only lines that REACH for the grammar are errors. Every other list item is ordinary prose and
+        // reporting it would bury the real typos in noise.
+        if (IMITATES.test(body))
+            malformed.push(line);
+    }
+    return { obligations, malformed };
+}
+/**
+ * The obligation tags a T-SPEC's CASES carry.
+ *
+ * @implements A-SPEC-234
+ * Only the four case sections count, and the section names are read from the type table rather than
+ * spelled here — a second spelling of a location is a second thing to keep in step, and this
+ * repository has already paid for that twice (`isTestFile` drifted into two copies; a restated
+ * section-splitting regex returned an empty section while the check using it went green).
+ *
+ * A tag anywhere else in the document states an INTENTION. Only a case is evidence that something
+ * was tested.
+ */
+function caseObligationTags(sections) {
+    const tags = new Set();
+    if (!sections || typeof sections !== 'object')
+        return tags;
+    const map = sections;
+    for (const name of spec_types_1.SPEC_TYPES['T-SPEC'].requiredSections) {
+        const body = map[name];
+        if (typeof body !== 'string')
+            continue;
+        for (const raw of body.split('\n')) {
+            const line = raw.trim();
+            if (!line.startsWith('- '))
+                continue;
+            const m = OBLIGATION.exec(clean(line.slice(2)));
+            if (m)
+                tags.add(m[1].toLowerCase());
+        }
+    }
+    return tags;
+}
+/**
+ * Obligations an H-SPEC declares that no child T-SPEC case answers.
+ *
+ * @implements A-SPEC-234
+ * Matching is EXACT after lower-casing. A prefix match would let `perf` be satisfied by
+ * `performance`, and a false "met" is a gate switched off that says nothing — the same asymmetry
+ * that made `call` targets exact in `forbidden-edges.ts`.
+ *
+ * `malformed` lines are NOT reported here. Flagging syntax errors and judging fulfilment are
+ * different questions; mixed together, one typo invents an obligation nobody declared.
+ */
+function unmetObligations(nonFunctional, tspecSections) {
+    const { obligations } = parseNonFunctional(nonFunctional);
+    if (obligations.length === 0)
+        return [];
+    const covered = new Set();
+    for (const s of Array.isArray(tspecSections) ? tspecSections : []) {
+        for (const t of caseObligationTags(s))
+            covered.add(t);
+    }
+    return obligations.filter((o) => !covered.has(o.tag));
+}

package/dist/holmes/spec/spec-parser.d.ts

@@ -7,6 +7,31 @@ export interface Spec {
     dependsOn: string[];
     frontmatter: Record<string, unknown>;
     sections: Record<string, string>;
+    /**
+     * Body text before the first `##`, or `''`.
+     *
+     * @implements A-SPEC-221
+     * `splitSections` keys on `## ` because the heading IS the key, which is right — but serialization
+     * rebuilt the body from those sections alone, so a legacy document's opening `# 개요` section was
+     * dropped on every write. Captured separately so it can be put back without changing what a
+     * section means.
+     *
+     * Optional so the four call sites that BUILD a Spec (reverse drafts, the conformance fixture,
+     * spec_create) need no change: they have no preamble, and serialization treats absent and empty
+     * identically. `parseSpec` always sets it.
+     */
+    preamble?: string;
 }
+/**
+ * Read `depends_on` in every spelling the corpus contains, keeping what cannot be represented.
+ *
+ * @implements A-SPEC-221
+ * Three forms exist: the current array, a bare string, and the legacy `ID:digest` string. Only the
+ * first was understood; the other two silently became no parents at all.
+ */
+export declare function parseDependsOn(raw: unknown): {
+    ids: string[];
+    legacy: string | null;
+};
 export declare function parseSpec(input: string): Spec;
 export declare function serializeSpec(spec: Spec): string;

package/dist/holmes/spec/spec-parser.js

@@ -33,9 +33,38 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseDependsOn = parseDependsOn;
 exports.parseSpec = parseSpec;
 exports.serializeSpec = serializeSpec;
 const yaml = __importStar(require("js-yaml"));
+const legacy_format_1 = require("./legacy-format");
+/**
+ * Read `depends_on` in every spelling the corpus contains, keeping what cannot be represented.
+ *
+ * @implements A-SPEC-221
+ * Three forms exist: the current array, a bare string, and the legacy `ID:digest` string. Only the
+ * first was understood; the other two silently became no parents at all.
+ */
+function parseDependsOn(raw) {
+    if (Array.isArray(raw))
+        return { ids: raw, legacy: null };
+    if (typeof raw !== 'string' || raw.length === 0)
+        return { ids: [], legacy: null };
+    const colon = raw.indexOf(':');
+    // The id ends at the FIRST colon — `REQ-001:sha256:abcd` names REQ-001, not `REQ-001:sha256`.
+    const id = colon === -1 ? raw : raw.slice(0, colon);
+    if (id.length === 0)
+        return { ids: [], legacy: null };
+    return { ids: [id], legacy: colon === -1 ? null : raw };
+}
+function splitPreamble(body) {
+    const idx = body.search(/^##\s+/m);
+    const head = idx === -1 ? body : body.slice(0, idx);
+    // Whitespace is not a preamble. The frontmatter delimiter is followed by a blank line, so nearly
+    // every document has a stray newline here; treating it as content would add one blank line to the
+    // file on every single write, forever.
+    return head.trim().length === 0 ? '' : head;
+}
 function splitSections(body) {
     const out = {};
     const lines = body.split('\n');
@@ -89,18 +118,33 @@ function parseSpec(input) {
     const m = /^---\n([\s\S]*?)\n---\n?([\s\S]*)$/.exec(raw);
     const fm = ((m ? yaml.load(m[1]) : {}) ?? {});
     const body = m ? m[2] : raw;
+    const deps = parseDependsOn(fm.depends_on);
+    // @implements A-SPEC-221 — never overwrite an existing preservation: a second round trip must not
+    // chew up what the first one saved, the same rule `legacy_status` follows.
+    if (deps.legacy !== null && fm[legacy_format_1.LEGACY_DEPENDS_FIELD] === undefined) {
+        fm[legacy_format_1.LEGACY_DEPENDS_FIELD] = deps.legacy;
+    }
     return {
         id: String(fm.id ?? ''),
         type: fm.type,
         title: String(fm.title ?? ''),
         status: (fm.status ?? 'draft'),
-        dependsOn: Array.isArray(fm.depends_on) ? fm.depends_on : [],
+        dependsOn: deps.ids,
         frontmatter: fm,
         sections: splitSections(body),
+        preamble: splitPreamble(body),
     };
 }
 function serializeSpec(spec) {
     const fm = { ...spec.frontmatter, id: spec.id, type: spec.type, title: spec.title, status: spec.status, depends_on: spec.dependsOn };
     const body = Object.entries(spec.sections).map(([h, t]) => `## ${h}\n${t}\n`).join('\n');
-    return `---\n${yaml.dump(fm)}---\n\n${body}`;
+    // @implements A-SPEC-221 — an empty preamble must contribute NOTHING, and a non-empty one must
+    // contribute the SAME thing every time. The delimiter below already supplies the blank line, so
+    // emitting the preamble's own leading newlines on top of it grew the file by one line on every
+    // write — measured: 2 → 3 → 4 → 5 blank lines over three round trips, unbounded. Trimming the
+    // leading whitespace makes serialization idempotent; the trailing blank line is restored so the
+    // preamble stays separated from the first section.
+    const head = (spec.preamble ?? '').replace(/^\s+/, '');
+    const preamble = head ? `${head.replace(/\s+$/, '')}\n\n` : '';
+    return `---\n${yaml.dump(fm)}---\n\n${preamble}${body}`;
 }

package/dist/holmes/spec/spec-types.d.ts

@@ -97,7 +97,8 @@ export declare const SPEC_TYPES: Record<SpecType, SpecTypeDef>;
  * The GOVERNED set is defined by the modern spec format: a spec is governed
  * iff it carries a `type` field naming a known SpecType. This deliberately
  * excludes (a) pre-`type` legacy specs retained only as archived history, and
- * (b) the `06_job/JOB-*` runtime ledger, which is not a governed spec type.
+ * (b) any document that is not a governed spec type. `06_job/JOB-*` was the historical case and
+ * was removed under REQ-223; `spec-store-boundary.test.ts` now fails the build if another appears.
  * Validation and RTM integrity checks operate on the governed set — validating
  * archived legacy or runtime-ledger entries is a category error (audit C1).
  * Generic over `{ type?: SpecType }` to stay free of an import cycle with the
@@ -113,9 +114,11 @@ export declare const SPEC_TYPES: Record<SpecType, SpecTypeDef>;
 export declare function specTypeDef(type: string | undefined | null): SpecTypeDef | undefined;
 export declare function isGoverned(spec: {
     type?: SpecType;
+    status?: SpecStatus;
 }): boolean;
 export declare function filterGoverned<T extends {
     type?: SpecType;
+    status?: SpecStatus;
 }>(specs: T[]): T[];
 /**
  * @implements A-SPEC-174

package/dist/holmes/spec/spec-types.js

@@ -106,7 +106,8 @@ exports.SPEC_TYPES = {
  * The GOVERNED set is defined by the modern spec format: a spec is governed
  * iff it carries a `type` field naming a known SpecType. This deliberately
  * excludes (a) pre-`type` legacy specs retained only as archived history, and
- * (b) the `06_job/JOB-*` runtime ledger, which is not a governed spec type.
+ * (b) any document that is not a governed spec type. `06_job/JOB-*` was the historical case and
+ * was removed under REQ-223; `spec-store-boundary.test.ts` now fails the build if another appears.
  * Validation and RTM integrity checks operate on the governed set — validating
  * archived legacy or runtime-ledger entries is a category error (audit C1).
  * Generic over `{ type?: SpecType }` to stay free of an import cycle with the
@@ -127,6 +128,17 @@ function specTypeDef(type) {
         : undefined;
 }
 function isGoverned(spec) {
+    // @implements A-SPEC-222.1 — a retired document is the canonical form of "archived", which the
+    // comment above already excludes as a category error. The rule was expressed as `type` alone only
+    // because no document had ever carried `outdated`: it was in SPEC_STATUSES with nothing able to
+    // write it. Measured the day retirement shipped — moving 23 legacy REQs to `outdated` surfaced 24
+    // constitution violations, among them `missing section: ## Success Criteria` and
+    // `root-has-parent`. Demanding those of a retired document is demanding that history be rewritten,
+    // and `root-has-parent` was not a violation at all under the 2026-04 model the document was
+    // written in. Retirement has to mean removal from the ACTIVE graph, or it means nothing beyond a
+    // changed string.
+    if (spec.status === 'outdated')
+        return false;
     return specTypeDef(spec.type) !== undefined;
 }
 function filterGoverned(specs) {

package/dist/holmes/testing/effects.d.ts

@@ -0,0 +1,54 @@
+/**
+ * What a function actually touched while it ran.
+ *
+ * @implements A-SPEC-238
+ * WHY OBSERVATION RATHER THAN SOURCE READING. Sixteen approved H-SPECs claim "순수", "I/O 없음",
+ * "파일시스템 접근 0". Measured 2026-08-23, every one of those claims is TRUE — but nothing held
+ * them true, and the `[purity]` cases written earlier in this session were weak in a specific way:
+ *
+ *     expect(fn.toString()).not.toMatch(/readFileSync/)   // reads the function's TEXT
+ *     expect(input).toEqual(copy)                         // proves only that input is unchanged
+ *
+ * Both ask how the function is WRITTEN, not what it DOES. One helper call into another module and
+ * the first passes; a file-reading function that mutates nothing passes the second. This session has
+ * corrected that same shape twice already — ADR-016's off-switch check guessed at flag names and
+ * missed its mutation, and A-SPEC-237's `[symmetry]` check grepped for `try` and passed before the
+ * fix existed.
+ */
+export interface ObservedEffects {
+    /** Names of the filesystem methods called, in order. */
+    fs: string[];
+    /** How many times the clock was read. */
+    clock: number;
+    /** How many times randomness was drawn. */
+    random: number;
+    /** What the body threw, if anything — returned rather than propagated. */
+    threw?: unknown;
+    /**
+     * Read methods that could NOT be wrapped, so the caller knows the observation has holes.
+     *
+     * Silence about what a tool could not watch is the same defect as a gate that passes because it
+     * saw nothing. Under normal Node this is empty; it is reported rather than assumed.
+     */
+    unwatched: string[];
+}
+/**
+ * Run `fn` and report what it touched.
+ *
+ * @implements A-SPEC-238
+ * The body's exception is RETURNED in `threw`, not re-thrown. "Why did it fail" and "what did it
+ * touch" are different pieces of information and a caller usually needs both; re-throwing would
+ * restore the globals but discard the observation.
+ *
+ * WHAT THIS DOES NOT SEE. Network calls and child processes — no claim in this repository's
+ * `## Non-Functional` sections mentions them, and offering coverage would recreate the
+ * "documented but unenforced" state. Asynchronous work that lands after `fn` returns: every function
+ * making a purity claim here is synchronous. Reads through a handle obtained before observation
+ * began. And a grammar loaded once per process — measured 2026-08-23, `extractSymbols` performs 26
+ * filesystem calls on the FIRST call in a process and zero on every call after, including the first
+ * call for a different language. That is one-time lazy loading, not per-call I/O, and this tool
+ * cannot tell them apart: warm the callee first.
+ */
+export declare function observeEffects(fn: () => unknown): ObservedEffects;
+/** Assert that `fn` touched nothing, naming what it touched when it did. */
+export declare function expectPure(fn: () => unknown): void;