@sdd-method/author-cli 0.0.0-stage → 0.1.0

package/dist/lib/catalogue/canonical-schema.yaml

@@ -0,0 +1,4117 @@
+# GENERATED — DO NOT EDIT. This file is a projection of the authored model (M-ADR 0210 §4.6, flip 1):
+#   docs/method/foundations/schemas/catalogue-schema.tql        (the type system; header carries the bump log)
+#   docs/method/foundations/schemas/catalogue-schema-meta.tql   (what a type system cannot say)
+# Regenerate:  sdd-cli metamodel roundtrip --write
+# Guard:       sdd-cli metamodel roundtrip   (any difference fails the build)
+# Direction of truth: authored .tql -> this projection (round-trip gate) -> vendored copies (digest hook).
+# Emitted by sdd-cli's YAML emitter with no line folding; the three header scalars are quoted for the
+# textual readers downstream. The one deliberate difference from the authored form is schema_status:
+# the authored form says canonical; a projection never does.
+schema_version: "3.20.0"
+schema_owner: "sdd-method"
+schema_status: "generated"
+enums:
+  quality_gate:
+    values:
+    - value: pass
+      description: Meets the rubric's pass threshold with no hard gate triggered.
+    - value: pass-with-waiver
+      description: A pass granted despite a known dimension shortfall, with the waiver RECORDED (granted_by + expires; see the scoring-registry guide). Passing for gate purposes, flagged for review purposes; an expired waiver reads as conditional. Adopted 2026-08-07, generalising the domain-architecture rubric's waiver machinery.
+    - value: conditional
+      description: Below threshold or carrying flags — remediation required, not a failure.
+    - value: fail
+      description: Below the fail threshold, or a hard gate triggered.
+    - value: unscored
+      description: "The entry exists but carries no assessment. Distinct from absent: an unscored row asserts that nothing has been judged, which is exactly the silence M-ADR 0205 §4.5's coverage instrument exists to make loud."
+    description: |
+      Gate verdict a rubric assessment records for a target, in `quality_scores.gate` (per M-ADR 0205 §4.5). The vocabulary all fifteen method-side gate registries declare.
+      DELIBERATELY NOT BOUND via `column_enums`, and the reason is measured rather than assumed — do not "fix" this by binding it. These values come from hand-authored score registries written by scoring runs, not from a method-mandated authoring surface, and one estate's `domain-architecture-scores.yaml` declared `pass-with-waiver` before the method did, and uses it — the extension was RULED INTO this vocabulary (2026-08-07); the next estate extension would meet the same choice, and binding would hard-fail a build over a deliberate, self-documented row. This follows the `products.synthesis_band` precedent — the other column fed from a rubric registry — where an out-of-vocabulary value is reported as a convention finding and the cell left EMPTY, rather than emitting a value no consumer can interpret. The builder names the file, the entry, the value and the remedy, which is better diagnosis than a generic enum violation could give. Contrast `service_type`, which IS bound: it comes from repo-config, an authoring surface the method mandates.
+  score_selection_method:
+    values:
+    - value: latest
+      description: Most recent review by scored_at. The default and, at 2026-08-06, the only value in use across either estate.
+    - value: human-selected
+      description: A human chose the effective review over the automatic pick.
+    - value: consensus
+      description: Effective score reconciled across several reviews.
+    - value: highest-severity
+      description: The most severe review wins — the conservative policy for gate-blocking rubrics.
+    description: |
+      How the effective review was chosen from a target's review history, in `quality_scores.selection_method` — the `selection_policy.method` field every gate registry carries. The catalogue models only the EFFECTIVE score (one row per target/rubric); this column makes the row say WHICH review it is rather than implying there was only one. Not bound, for the same registry-authored reason as `quality_gate`.
+  staleness_basis:
+    values:
+    - value: corpus_ref
+      description: The row carries the commit the assessment read — the precise anchor. Authored; introduced by the M-ADR 0205 §4.5 change-set, so absent from every score written before it.
+    - value: scored_at
+      description: No corpus_ref; staleness computed from the assessment date against the target's last content change, resolved through target_path. Correct but coarser — it cannot distinguish a re-commit that changed nothing from a real edit.
+    - value: none
+      description: Neither anchor available (no corpus_ref and no resolvable target_path). Staleness is UNKNOWN for this row and must be reported as unknown, never as fresh.
+    description: |
+      Which anchor a `quality_scores` row's staleness verdict can be computed from, in `quality_scores.staleness_basis`. This column exists because a staleness verdict whose basis is unstated is not a measurement — the basis-error class that produced six wrong figures in a single day of this method's own arc. The coverage predicate MUST NOT be able to emit a staleness claim without naming which of these it used.
+  scoring_form:
+    values:
+    - value: weighted
+      description: Weighted 1-5 dimensions rolled into a weighted_score against a pass threshold, with flags and hard gates. The forward house form; all fifteen method-side registries use it.
+    - value: banded
+      description: Dimensions summed to an integer total and mapped to a named band. The reverse family's form. Added in 3.3.0. The band vocabulary is PER-RUBRIC and deliberately unbound — see the band column.
+    description: |
+      The scoring shape a rubric uses, in `quality_scores.scoring_form`. Reserved by M-ADR 0205 §4.5 so the banded reverse family can arrive additively without reshaping rows.
+      Both forms are now declared. `banded` was added in 3.3.0 once the reverse family was modelled; before that it was deliberately absent so a premature banded row would fail loudly rather than pass against an unemitted value.
+      The two forms are NOT interchangeable and must not be averaged together — which is why they never share a score column. A weighted row carries `weighted_score` (1-5) and leaves `band`/`band_total` empty; a banded row carries `band` + `band_total` and leaves `weighted_score` empty. Any aggregate over `weighted_score` is therefore correct by construction rather than by the caller remembering to filter.
+  capability_service_role:
+    values:
+    - value: primary
+      description: Realises this capability.
+    - value: related
+      description: Participates in delivering this capability without being its primary realiser. Contributes; kept in repo_capability.
+    - value: dependency
+      description: This capability DEPENDS ON the service — the inverse direction of contribution. The relationship is real and catalogued here; it does NOT produce a repo_capability row.
+    - value: backend-gateway
+      description: Owned by ANOTHER domain and the sanctioned entry point into that domain's data for this capability — not merely a dependency, the door in. Expect it on cross-domain rows only. Contributes; kept in repo_capability.
+    description: |
+      The part a service plays in delivering ONE capability. A property of the capability↔service RELATIONSHIP, never of the service: the same service is legitimately `primary` for capabilities in its own domain and `backend-gateway` for capabilities elsewhere. Authored in the capability traceability manifest services[].role (see the capability-traceability-manifest-template). Bound in 3.8.0; the values and their meanings are the template's, unchanged. Consumers deriving "which repos realise this capability" MUST read this column or use repo_capability, which excludes `dependency` (M-ADR 0157 §4.3 as amended) — a repo_capability row is a contribution claim.
+  c4_system_kind:
+    values:
+    - value: platform
+      description: A platform-root system — the one system that identifies a platform (M-ADR 0208 §4.1; 'platform-ecosystem' is the long form, 1:1 with the root). Exactly one per PLATFORM; an organisation-tier aggregate legitimately carries one per constituent platform, keyed by platform_sdd_id (0208 §4.2). An invariant `subsystem` exists to protect — do not reuse `platform` for subsystem rows.
+    - value: subsystem
+      description: A promoted platform subsystem (M-ADR 0170 §4.2) — a separate deployable that is a peer System in the platform model, contained by the platform root on the same footing as application and integration (M-ADR 0208 §4.1). Added 2.28.0 per M-ADR 0133 §4.2c.
+    - value: application
+      description: An application-product system, consumes platform services and contracts.
+    - value: integration
+      description: An integration-provider system, bridges an external provider into the platform.
+    description: |
+      Architectural kind of a C4 system. Derived 1:1 from the originating SDD manifest's category — every architectural product (the only ones that get a c4_systems row) maps to exactly one of these four kinds. Non-architectural categories (integration-umbrella, support-repo) emit no c4_systems row — and the builder MUST say so with a coverage finding, never silently (M-ADR 0133 §4.2c). Mapping table:
+        platform-root        → platform
+        platform-subsystem   → subsystem
+        application-product  → application
+        integration-provider → integration
+  c4_container_type:
+    values:
+    - value: Application
+      description: A separately deployable/runnable application — a service, BFF, UI, consumer, worker, etc.
+    - value: Data Store
+      description: A database or persistence layer (also covers running stores like a message broker when modelled as a container).
+    description: |
+      Canonical C4 container kind for `c4_containers.type`, aligned with c4model.com/abstractions (per M-ADR 0155). A C4 container is something that must be running for the system to work — an application or a data store.
+      BOUND via `c4_containers.column_enums` since 3.0.0 (M-ADR 0203 §4.1, completing 0155's staged enforcement): a non-member value hard-fails build and validate. The 2.x-era legacy values are removed; their migration rule (0155's own): `External System` boxes belong in `c4_external_systems` (C4 L1 peer systems, not L2 containers); running infrastructure (broker, gateway, cache) retypes to Application or Data Store; pure deployment infrastructure (load balancer, DNS) leaves the container catalogue (it belongs in a C4 deployment diagram, which is not catalogued).
+  service_type:
+    values:
+    - value: api_service
+      description: REST/GraphQL/RPC service exposing an API.
+      runtime: true
+      emits_service_row: true
+    - value: worker
+      description: Background event/queue processor.
+      runtime: true
+      emits_service_row: true
+    - value: gateway
+      description: Edge or API gateway (Zuplo, Apigee, etc.).
+      runtime: true
+      emits_service_row: true
+    - value: frontend
+      description: Web UI deployable (Vue, React, Svelte, etc.). Includes vertical-domain application frontends — the SDD profile distinguishes platform-frontends from app-frontends.
+      runtime: true
+      emits_service_row: true
+    - value: mobile
+      description: Mobile app deployable (iOS, Android).
+      runtime: true
+      emits_service_row: true
+    - value: library
+      description: Shared package shipped to consumers (npm, PyPI, Maven, etc.).
+      runtime: false
+      emits_service_row: false
+    - value: infrastructure
+      description: IaC, CI/CD, build tooling — not a runtime deployable.
+      runtime: false
+      emits_service_row: false
+    - value: documentation
+      description: Docs-only repo.
+      runtime: false
+      emits_service_row: false
+    - value: firmware
+      description: "Firmware that runs on a device: the application image, bootloader, loader, on-device plug-ins (M-ADR 0215). Runtime, but emits no service row — a device is not a node in the platform's service graph. Its tooling, test benches and libraries keep their own kinds."
+      runtime: true
+      emits_service_row: false
+    description: |
+      Type of repository, declared in `orchestration/repo-config/*.yaml` as `service_type` and surfaced in `repositories.component_type` and `services.component_type`. The canonical builder uses this to decide which repos are runtime services (api_service, worker, gateway, frontend, mobile) and which are non-runtime (library, infrastructure, documentation); firmware runs, but on a device, so it is runtime without a service row (M-ADR 0215) — service emission follows emits_service_row, not runtime. Whether a repo is a vertical-domain application is conveyed by its SDD manifest's `profile: application-product`, not by a service_type tag — this enum is strictly about runtime artefact shape (per resolution of adopt-canonical-catalogue-builder.md §7.1).
+  capability_exemption_reason:
+    values:
+    - value: infrastructure
+      description: Provisions or operates the estate; realises no product capability.
+    - value: build-tooling
+      description: Build, release, CI or repository-management machinery.
+    - value: test-scaffolding
+      description: Test helpers and fixtures with no runtime role.
+    - value: vendored
+      description: Third-party or forked code the SDD does not model.
+    - value: prototype
+      description: Exploratory; not part of the product model.
+    - value: archived
+      description: Retained for reference; no longer live.
+    description: |
+      Why a catalogued repository deliberately bears no capability, per M-ADR 0188 §4.2. Closed vocabulary: reason codes make exemptions countable and trendable (a growing `prototype` or `archived` population is itself an estate signal), where free text would bury them. Extensions are method-owned and proceed by ADR amendment, so that adopters cannot locally widen the exemption surface to silence findings.
+      ENFORCED, not advisory. The builder drops a `repo_capability_exemption` row whose reason is outside this vocabulary and emits a `convention` finding. The repository then resolves to nothing and is reported as an orphan — which is the point. If an unrecognised reason still exempted the repo, `reason: whatever` would be a universal silencer.
+  service_capability_exemption_reason:
+    values:
+    - value: platform-internal
+      description: Runs, but serves the platform's own operation rather than a product capability (e.g. an internal control-plane or ops service).
+    - value: deprecated
+      description: No longer live; retained for reference or wind-down.
+    description: |
+      Why a catalogued service deliberately bears no capability, per M-ADR 0133 §4.2b. Closed vocabulary — narrower than `capability_exemption_reason` by design: a repository can be exempt for six reasons (packaging, tooling, provenance), but a SERVICE, by definition, already runs something — the repository-tier distinctions that don't reproduce at the service tier (pure IaC, build tooling, test scaffolding, vendored code) fold into `platform-internal`, since a service that exists at all is doing platform-internal work if it isn't product-facing.
+      ENFORCED, not advisory. The builder drops a `service_capability_exemption` row whose reason is outside this vocabulary and emits a `convention` finding. The service then resolves to nothing and is reported per the coverage predicate's tier-scoped verdict set — which is the point.
+  external_system_exemption_reason:
+    values:
+    - value: third-party-saas
+      description: An operated vendor service the estate consumes (billing, auth, maps, email…).
+    - value: partner-system
+      description: Another organisation's system integrated across an agreed boundary.
+    - value: customer-system
+      description: A customer-owned system the estate serves or consumes.
+    - value: device-hardware
+      description: Physical devices or device fleets at the estate boundary.
+    - value: public-infrastructure
+      description: Public networks, registries, or services no party in the estate operates.
+    - value: estate-owned-unmodelled
+      description: "Operated by this estate but with no SDD or container home yet — the row is an accounted-for stand-in, and this population is the estate's modelling backlog, countable (F16, 2.32.0). Not an assertion of externality: an assertion of accountability for a boundary row."
+    - value: organisation-internal
+      description: Owned elsewhere in the same organisation, outside this estate's modelling boundary (F16, 2.32.0).
+    description: |
+      Why an external-system candidate is ACCOUNTED FOR at the estate boundary, per M-ADR 0189 §4.6 (WS15; wording corrected by F16, 2.32.0): five values assert another party owns the system, and two assert the estate/organisation owns it but it has no model home yet — forcing the latter through the former would demand a false reason, and a false reason is worse than silence. The adjudicator can prove a candidate internal; it cannot prove one accounted-for — that is an assertion the author is accountable for, in the shape M-ADR 0188 ratified for repositories. Closed vocabulary, method-owned, extended only by ADR amendment, so adopters cannot locally widen the exemption surface to silence the unverified-candidate coverage finding.
+      ENFORCED, not advisory: the builder drops a row whose reason is outside this vocabulary (convention finding) and the candidate stays unverified — which is the point. An unrecognised reason must not succeed at the one thing an exemption does.
+  scaffold_status:
+    values:
+    - value: open
+      description: The unit of work is in flight. `declared` items are a state, not a defect (M-ADR 0207 §4.2).
+    - value: closed
+      description: The author has recorded the unit of work as done. A `declared` item under a closed scaffold presumes the scaffold right — the work is incomplete — and is reported (M-ADR 0207 §4.3).
+    description: |
+      Lifecycle of a scaffold declaration, in `scaffolds.status`. AUTHORED in the manifest, copied by the builder: closing a scaffold is a recorded act of the unit of work finishing (M-ADR 0207 §4.3), not a computed consequence — the delta instrument reports a closed scaffold whose delta is not zero as a finding, it never closes one itself.
+  scaffold_item_kind:
+    values:
+    - value: entity
+      description: A node catalogue row the work will add (a service, capability, feature, screen, …). target_ref is the declared id in that catalogue's vocabulary.
+    - value: edge
+      description: An edge catalogue row the work will add. Endpoints are declared in edge_source_ref/edge_target_ref, mapped to the edge catalogue's FK columns in schema declaration order.
+    - value: contract
+      description: A contract artefact the work will introduce or amend. target_ref is the repo-relative spec path, matching `contracts.spec_path`.
+    description: |
+      The grain of a scaffold declaration item, in `scaffold_items.item_kind`. Declares which family of catalogue surface the item promises; `target_kind` names the specific catalogue.
+  scaffold_item_state:
+    values:
+    - value: declared
+      description: The target does not (yet) resolve in the built catalogues. Under an open scaffold this is the computable backlog; under a closed one it is a reported finding (M-ADR 0207 §4.2/§4.3).
+    - value: realised
+      description: The target resolves in the built catalogues. The declaration is met for this item.
+    description: |
+      Realisation state of a scaffold item, in `scaffold_items.state`. DERIVED by the builder's resolution pass against the same build's catalogue rows — never authored. The manifest declares intent; this column records whether the intent is realised in the corpus the build read. Staleness is deliberately NOT a value here: it is a coverage-time verdict against `scaffolds.corpus_ref` (M-ADR 0207 §4.6), because a git-derived value in a derived row would break rebuild determinism against unchanged authored inputs.
+  interaction_pattern:
+    values:
+    - value: event-stream-consume
+      description: Subscribe to and drain a broker / stream / feed the provider produces; the consumer drains a durable, ordered channel (Event-Driven / Polling Consumer over a Message Channel).
+    - value: webhook
+      description: Expose an endpoint the other side pushes events to as they occur (Event-Driven Consumer, HTTP push).
+    - value: socket-listen
+      description: Accept connection-oriented sessions the source initiates and read framed data (Channel Adapter, transport listener).
+    - value: poll
+      description: Periodically request current or incremental state from the source (Polling Consumer).
+    - value: request-response
+      description: Synchronous call-and-wait; the result returns in the same exchange (Request-Reply, synchronous).
+    - value: async-request
+      description: Submit a request; the result returns later via a separate channel, correlated by identifier (Request-Reply, asynchronous + Correlation Identifier).
+    - value: publish
+      description: Fire-and-forget write to a broker / queue / endpoint with no awaited response (Publish-Subscribe / fire-and-forget Message).
+    description: "How a capability's declared dependency on a service is coupled at RUNTIME — M-ADR 0171's closed interaction-pattern vocabulary (the union of its ingestion and invocation sets), reused on `capability_service.interaction_pattern` per M-ADR 0211 §4.1 and not widened. BOUND because the value comes from the traceability manifest, a method-mandated authoring surface (M-ADR 0210 §4.5). A NON-RUNTIME coupling — build-time code generation, a load-time singleton, packaging, an authoring sequence — leaves the column EMPTY and states its kind in the manifest's dependency_notes; that is T4's excluded-by-class case and reaches no band 5. An entry declares ONE coupling: two tokens in one entry is two entries. Measured at two estates before binding: 17 of 18 runtime couplings mapped onto exactly one token; none needed a token the vocabulary lacks."
+  event_participation:
+    values:
+    - value: publishes
+      description: The participant emits the event.
+    - value: consumes
+      description: The participant receives the event.
+    description: "The part a service, capability or feature plays toward an event, in `service_event.role`, `capability_event.role` and `feature_event.role`. `service_event.role` is also M-ADR 0206 §4.2's role-conditional impact flow (publishes → toward-target, consumes → toward-source). Bound at 3.9.0 (M-ADR 0210 §4.5): the values come from repo-config and derived edges, method-mandated surfaces; every row at both adopter estates' committed aggregates was in-vocabulary when bound."
+  contract_participation:
+    values:
+    - value: exposes
+      description: The service publishes the contract as its own surface.
+    - value: consumes
+      description: The service depends on a contract another service exposes.
+    description: The part a service plays toward a contract, in `service_contract.role`. Bound at 3.9.0 (M-ADR 0210 §4.5); one estate's rows were all `exposes`, the other's all `consumes` — the union is the vocabulary, and each estate's usage was in it.
+  consumption_role:
+    values:
+    - value: consumes
+      description: The product depends on / consumes the target.
+    description: "The part a product plays toward a capability or service it depends on, in `product_capability.role` and `product_service.role`. EXACTLY ONE VALUE, deliberately: every row at both estates carries `consumes`, and a column with one value is a population of one (M-ADR 0200 §4.10). Bound so the constant is DECLARED rather than accidental — a second value arriving is then a vocabulary decision with a finding, not a silent widening."
+  journey_participation:
+    values:
+    - value: primary
+      description: The persona the journey is designed around.
+    - value: handoff
+      description: A persona the journey passes to or from.
+    - value: supporting
+      description: A persona present in the journey without owning it.
+    description: "The kind of participation a persona has in a user journey, in `persona_journey.role` — the M-ADR 0210 worked example's `participation`. Bound at 3.9.0 (M-ADR 0210 §4.5): parsed from the persona spec's declared `Roles:` line, a method template surface; every row at both estates was in-vocabulary when bound."
+  model_notation:
+    values:
+    - value: mermaid-erd
+      description: M-ADR 0042's diagram grammar (data-model.mermaid.md) — the pre-Decision-1 form; migrates at the model's next requirements pass.
+    - value: typeql
+      description: The documented TypeQL subset of M-ADR 0210 §4.2 (data-model.tql) — the canonical form of every model authored from 2026-09-17 and of every migrated model.
+    description: "The notation a domain-model artefact is written in. Bound at 3.11.0 as the instrument of M-ADR 0210 §4.6 Decision 2: the builder derives it from the file, the metric line counts it, and a mermaid-erd row becomes an error at the first rebuild after the sunset 2027-03-31."
+  sdd_profile:
+    values:
+    - value: application-product
+    - value: integration-product
+    - value: platform-profile
+    - value: support-repo
+    description: "The SDD profile vocabulary (M-ADR 0135: one method, four profiles), as products/applications.profile and domains.method_profile carry it. Bound at 3.13.0 from the column descriptions; measured against both reference estates before binding (M-ADR 0205 §4.4)."
+  sdd_category:
+    values:
+    - value: application-product
+    - value: integration-provider
+    - value: integration-umbrella
+    - value: platform-root
+    - value: platform-subsystem
+    - value: support-repo
+    description: "The product category taxonomy (M-ADR 0131 / 0170): the architectural classification a products row carries. Bound at 3.13.0 from the column descriptions; measured against both reference estates before binding (M-ADR 0205 §4.4)."
+  product_lifecycle:
+    values:
+    - value: active
+    - value: planned
+    - value: deprecated
+    description: Product lifecycle (M-ADR 0201). Bound at 3.13.0 from the column descriptions; measured against both reference estates before binding (M-ADR 0205 §4.4).
+  product_surface:
+    values:
+    - value: ui
+    - value: api
+    description: "M-ADR 0167: an application-product's surface trait. Bound at 3.13.0 from the column descriptions; measured against both reference estates before binding (M-ADR 0205 §4.4)."
+  product_packaging:
+    values:
+    - value: self-operated
+    - value: vendor-saas
+    description: "M-ADR 0175: the packaging axis. Bound at 3.13.0 from the column descriptions; measured against both reference estates before binding (M-ADR 0205 §4.4)."
+  domain_status:
+    values:
+    - value: active
+    - value: deferred
+    - value: absent
+    description: Domain lifecycle as domains.status carries it. Bound at 3.13.0 from the column descriptions; measured against both reference estates before binding (M-ADR 0205 §4.4).
+  invocation_pattern:
+    values:
+    - value: request-response
+    - value: async-request
+    - value: publish
+    description: M-ADR 0171's invocation half of the interaction vocabulary (the ingestion half is event-stream-consume | webhook | socket-listen | poll; both halves together are enums.interaction_pattern). Bound at 3.13.0 from the column descriptions; measured against both reference estates before binding (M-ADR 0205 §4.4).
+  integration_component_resolution:
+    values:
+    - value: repository
+    - value: service
+    - value: undeclared
+    - value: unresolved
+    description: How an integration component's implementation was resolved. Bound at 3.13.0 from the column descriptions; measured against both reference estates before binding (M-ADR 0205 §4.4).
+  integration_component_declared_in:
+    values:
+    - value: component-manifest
+    - value: components-array
+    description: Where the component was declared in the integration manifest. Bound at 3.13.0 from the column descriptions; measured against both reference estates before binding (M-ADR 0205 §4.4).
+  confidence_level:
+    values:
+    - value: high
+    - value: medium
+    - value: low
+    description: Three-level confidence used by reverse-derived rows. Bound at 3.13.0 from the column descriptions; measured against both reference estates before binding (M-ADR 0205 §4.4).
+  capability_adr_confidence:
+    values:
+    - value: spec
+    - value: high
+    - value: medium
+    description: "capability_adr edge confidence: spec when the capability spec cites the ADR; high | medium when inferred. Bound at 3.13.0 from the column descriptions; measured against both reference estates before binding (M-ADR 0205 §4.4)."
+  glossary_xref_relation:
+    values:
+    - value: references
+    - value: supersedes
+    - value: alias-of
+    - value: conflicts-with
+    description: M-ADR 0158 glossary cross-reference relations. Bound at 3.13.0 from the column descriptions; measured against both reference estates before binding (M-ADR 0205 §4.4).
+  capability_source:
+    values:
+    - value: capability-spec
+    - value: capability-tree
+    - value: product-map
+    description: Which artefact a capabilities row was derived from. Bound at 3.13.0 from the column descriptions; measured against both reference estates before binding (M-ADR 0205 §4.4).
+  feature_source:
+    values:
+    - value: feature-spec
+    - value: feature-set
+    - value: feature-tree
+    - value: feature-grounding
+    - value: capability-spec
+    description: Which artefact a features row was derived from (M-ADR 0145). Bound at 3.13.0 from the column descriptions; measured against both reference estates before binding (M-ADR 0205 §4.4).
+  artefact_maturity:
+    values:
+    - value: absent
+    - value: provisional
+    - value: working
+    - value: unknown
+    description: Maturity of a feature or screen as its grounding declares it. Bound at 3.13.0 from the column descriptions; measured against both reference estates before binding (M-ADR 0205 §4.4).
+  contract_kind:
+    values:
+    - value: rest
+    - value: event
+    - value: graphql
+    - value: rpc
+    - value: authz
+    description: Contract kind. Bound at 3.13.0 from the column descriptions; measured against both reference estates before binding (M-ADR 0205 §4.4).
+  contract_status:
+    values:
+    - value: active
+    - value: deprecated
+    description: Contract lifecycle status. Bound at 3.13.0 from the column descriptions; measured against both reference estates before binding (M-ADR 0205 §4.4).
+  contract_visibility:
+    values:
+    - value: public
+    - value: internal
+    - value: private
+    description: Contract visibility. Bound at 3.13.0 from the column descriptions; measured against both reference estates before binding (M-ADR 0205 §4.4).
+  contract_discovery:
+    values:
+    - value: discovered
+    - value: declared-external
+    description: Whether the contract was discovered in the SDD or declared as external. Bound at 3.13.0 from the column descriptions; measured against both reference estates before binding (M-ADR 0205 §4.4).
+  persistence_kind:
+    values:
+    - value: relational-table
+    - value: document-collection
+    - value: event-payload
+    - value: dto
+    - value: view
+    - value: other
+    description: M-ADR 0159 entity persistence kind. Bound at 3.13.0 from the column descriptions; measured against both reference estates before binding (M-ADR 0205 §4.4).
+  required_stability:
+    values:
+    - value: locked
+    - value: provisional
+    - value: unknown
+    description: "M-ADR 0204: the stability a consumer requires of a target; external | legacy live in target_locus, not here. Bound at 3.13.0 from the column descriptions; measured against both reference estates before binding (M-ADR 0205 §4.4)."
+  service_entity_relation:
+    values:
+    - value: owns
+    - value: reads
+    - value: writes
+    - value: references
+    description: How a service relates to a data-model entity. Bound at 3.13.0 from the column descriptions; measured against both reference estates before binding (M-ADR 0205 §4.4).
+  edge_source:
+    values:
+    - value: authored
+    - value: derived
+    description: Whether an edge row was authored in a manifest or derived by the builder. Bound at 3.13.0 from the column descriptions; measured against both reference estates before binding (M-ADR 0205 §4.4).
+  feature_contract_derivation_path:
+    values:
+    - value: cap-feature-cap-contract
+    - value: feature-service-service-contract
+    description: The join path a feature_contract row was derived through. Bound at 3.13.0 from the column descriptions; measured against both reference estates before binding (M-ADR 0205 §4.4).
+  subscription_channel_transport:
+    values:
+    - value: sse
+    - value: appsync-websocket
+    - value: pekko-ws
+    - value: mqtt
+    - value: webhook-push
+    - value: other
+    description: Transport of a feature subscription channel. Bound at 3.13.0 from the column descriptions; measured against both reference estates before binding (M-ADR 0205 §4.4).
+  capability_domain_model_source:
+    values:
+    - value: traceability-manifest
+    - value: inferred
+    description: "M-ADR 0142: whether the capability→domain-model edge was declared or inferred. Bound at 3.13.0 from the column descriptions; measured against both reference estates before binding (M-ADR 0205 §4.4)."
+  target_locus:
+    values:
+    - value: platform
+    - value: external
+    - value: legacy
+    description: "M-ADR 0204 §4.1: a statement about the dependency TARGET only. Bound at 3.13.0 from the column descriptions; measured against both reference estates before binding (M-ADR 0205 §4.4)."
+  dependency_contract_type:
+    values:
+    - value: openapi
+    - value: graphql
+    - value: grpc
+    - value: event
+    - value: event-stream
+    - value: stream
+    - value: rest
+    - value: other
+    description: Contract type of a platform dependency. Bound at 3.13.0 from the column descriptions; measured against both reference estates before binding (M-ADR 0205 §4.4).
+  data_plane_pattern:
+    values:
+    - value: own-store
+    - value: project
+    - value: retrieve
+    - value: stream-ingest
+    - value: publish
+    - value: generate
+    description: M-ADR 0193 / 0194 data-plane patterns, both sides. Bound at 3.13.0 from the column descriptions; measured against both reference estates before binding (M-ADR 0205 §4.4).
+  data_plane_direction:
+    values:
+    - value: inbound
+    - value: output
+    description: "M-ADR 0193 §4.7: the side of the data plane a binding is on. Bound at 3.13.0 from the column descriptions; measured against both reference estates before binding (M-ADR 0205 §4.4)."
+  data_plane_locality:
+    values:
+    - value: internal-platform
+    - value: internal-domain
+    - value: external-vendor
+    description: M-ADR 0193 locality of a data-plane binding's source. Bound at 3.13.0 from the column descriptions; measured against both reference estates before binding (M-ADR 0205 §4.4).
+  ui_component_kind:
+    values:
+    - value: element
+    - value: layout
+    - value: input
+    - value: display
+    - value: chart
+    - value: composite
+    - value: remote
+    - value: remote-iframe
+    - value: remote-webcomponent
+    description: M-ADR 0166 UI component kinds. Bound at 3.13.0 from the column descriptions; measured against both reference estates before binding (M-ADR 0205 §4.4).
+  conformance_target:
+    values:
+    - value: code-vs-contract
+    - value: binding-vs-reality
+    description: M-ADR 0194 conformance finding target. Bound at 3.13.0 from the column descriptions; measured against both reference estates before binding (M-ADR 0205 §4.4).
+  implementation_role:
+    values:
+    - value: as-is
+      description: The existing implementation.
+    - value: to-be
+      description: The target implementation the spec is migrating toward.
+    description: An implementation member's role against its spec (M-ADR 0181 §2.1). Bound at 3.13.0 on conformance_finding as conformance_role; renamed at 3.15.0, when implementation_members became its owner (M-ADR 0214 §4.2) — the values did not change.
+  implementation_lifecycle:
+    values:
+    - value: active
+      description: In service and the current implementation.
+    - value: planned
+      description: "Not yet built: the repository may not exist yet."
+    - value: deprecated
+      description: "Still running, scheduled for retirement (M-ADR 0214 §4.7: what some bindings called sunset)."
+    - value: migrating
+      description: Being moved onto, or off, while both sides run.
+    - value: legacy-active
+      description: The as-is implementation, still serving while a to-be replaces it.
+    - value: decommissioned
+      description: "Retired: no longer running."
+    description: An implementation member's lifecycle (M-ADR 0181 §2.1). Bound at 3.13.0 on conformance_finding as conformance_lifecycle; renamed at 3.15.0, when implementation_members became its owner (M-ADR 0214 §4.2) — the values did not change.
+  repo_scope:
+    values:
+    - value: component
+      description: "Part of what this SDD specifies: the SDD's artefact stack applies, and its capabilities or other services depend on it."
+    - value: support
+      description: "Supports a component without being one: its operational configuration, tooling, tests, collections, or a library it consumes."
+    description: Whether a mirrored repository is inside the scope of what its SDD specifies (M-ADR 0213). Deliberately neither a profile (profile is the SDD's) nor a role (role is M-ADR 0181's as-is | to-be); a repository's kind is component_type.
+  evidence_direction:
+    values:
+    - value: forward-authored
+      description: The spec came first and the code was built from it.
+    - value: seeding-reverse
+      description: A spec that never existed, recovered from pre-existing internal code.
+    - value: external-doc-reverse
+      description: The external surface a product consumes, grounded in a third party's published API or documentation.
+    - value: conformance-reverse
+      description: Own forward or maintained code, verified against its spec, with legitimate evolution fed back.
+    description: How an implementation member is evidenced (M-ADR 0180 §2.1; forward-authored added by M-ADR 0181 §2.1).
+  member_presence:
+    values:
+    - value: observed
+      description: Exported and observed in this baseline.
+    - value: carried
+      description: "Not re-exported: carried from an earlier baseline (carried_from), with its reason."
+    - value: removed
+      description: In the prior baseline and not in this one (members_removed), with its reason.
+    description: A snapshot member's presence in its baseline — the three states the snapshot conventions record (M-ADR 0214 §4.4).
+  conformance_disposition:
+    values:
+    - value: conformant
+      description: Code matches spec.
+    - value: conformant-open
+      description: "Both sides agree the item is deferred or absent: an open decision, not drift."
+    - value: code-defect
+      description: "The spec is authority: fix the code."
+    - value: spec-stale
+      description: "The code legitimately evolved: update the spec."
+    - value: divergence
+      description: "A genuine design question: triage, don't fail."
+    description: The triage outcome of a conformance-reverse delta (M-ADR 0180 §2.3). Bound so every file that records an outcome records one of these; the triage records are not yet catalogued (M-ADR 0214 §4.8).
+  delta_disposition:
+    values:
+    - value: capability-added
+      description: The code gained a capability the spec does not have.
+    - value: capability-removed
+      description: The code lost a capability the spec still has.
+    - value: spec-update
+      description: "The code legitimately evolved within a capability: the spec follows."
+    - value: refactor-only-no-spec-change
+      description: "The code changed and its behaviour did not: no spec change."
+    - value: ambiguous
+      description: "Cannot be classified from the delta alone: triage."
+    description: The classification of a delta-reverse finding between two snapshots (M-ADR 0180 §2.7). Bound so every file that records one records one of these; delta findings are not yet catalogued (M-ADR 0214 §4.8).
+  supply_verdict:
+    values:
+    - value: supported
+      description: The item reaches the canonical boundary from this integration.
+    - value: partial
+      description: It reaches it with a stated limitation (rate, scope, accuracy).
+    - value: source-absent
+      description: "The provider cannot supply it: nobody's work."
+    - value: gateway-gap
+      description: "The provider can and this integration does not: the integration's work."
+    - value: not-applicable
+      description: The item does not apply to this integration.
+    description: "What an integration states about a data item (M-ADR 0216 §4.2). unknown is NOT a member: it is the reading of no row."
+  supply_basis:
+    values:
+    - value: code
+      description: Read from the integration's code.
+    - value: grounded
+      description: Grounded in a vendor or source artefact.
+    - value: declared
+      description: Declared by the integration's own configuration.
+    - value: inferred
+      description: Inferred, with no artefact stating it.
+    description: The evidence class of a supply statement.
+  data_necessity:
+    values:
+    - value: required
+      description: The feature cannot work without it (or without one member of its alternative_group).
+    - value: enhances
+      description: The feature works without it, less well. Never decides coverage.
+    description: How a feature needs a data item.
+  support_verdict:
+    values:
+    - value: supported
+      description: Every requirement is met.
+    - value: partial
+      description: Every requirement is met or partly met, and one only partly.
+    - value: unknown
+      description: No requirement is unmet, and one is undecided because no supply row exists.
+    - value: unsupported
+      description: A requirement is unmet; limiting_item_id and limiting_reason name it.
+    - value: not-applicable
+      description: Every required item is not-applicable to this integration.
+    description: Whether one integration supports one feature at the canonical boundary (M-ADR 0216 §4.4).
+  limiting_reason:
+    values:
+    - value: source-absent
+      description: "The provider cannot supply the item: nobody's work."
+    - value: gateway-gap
+      description: "The integration does not supply what the provider has: the integration's work."
+    - value: no-canonical-home
+      description: "The platform has no canonical field for the item: platform contract work."
+    description: Why an unsupported feature is unsupported, and so whose work the gap is.
+  repo_dependency_kind:
+    values:
+    - value: library
+      description: Linked or packaged at build time.
+    - value: generated-from
+      description: Its content was produced from the other repository's templates.
+    description: How one repository depends on another's code (M-ADR 0217 §4.1).
+catalogues:
+  domains:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+      description: Slug, e.g. identity, asset.
+    - name: name
+      type: string
+      nullable: false
+      description: Display name.
+    - name: description
+      type: string
+      nullable: false
+    - name: method_profile
+      type: string
+      nullable: false
+      description: platform-profile | application-product | integration-product.
+    - name: reference_architecture_equivalent
+      type: string
+      nullable: true
+    - name: status
+      type: string
+      nullable: false
+      description: active | deferred | absent. The builder emits 'active' for every discovered domain directory — a domain that exists on disk is active by definition; deferred/absent rows have no authoring source yet (would come from roadmap/archetype declarations, not discovery).
+    - name: repo_count
+      type: int
+      nullable: false
+    - name: source_sdd_id
+      type: string
+      nullable: true
+      description: Originating SDD slug. Populated by the aggregator at merge time per M-ADR 0134; left empty by per-SDD builders.
+    - name: platform_sdd_id
+      type: string
+      nullable: true
+      description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
+    column_enums:
+      method_profile: enums.sdd_profile
+      status: enums.domain_status
+  products:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+      description: product_id slug.
+    - name: name
+      type: string
+      nullable: false
+    - name: domain_id
+      type: string
+      nullable: true
+      description: Owning capability domain. Populated for platform-profile products (platform-root, platform-subsystem). App and integration products do not have a primary domain — see M-ADR 0136.
+    - name: profile
+      type: string
+      nullable: false
+      description: platform-profile | application-product | integration-product | support-repo.
+    - name: category
+      type: string
+      nullable: true
+      description: "Architectural classification per docs/method/methods/standards/product-category-taxonomy.md. Values: platform-root | platform-subsystem | application-product | integration-provider | integration-umbrella | support-repo. Determines whether the Product gets a c4_systems row."
+    - name: doc_path
+      type: string
+      nullable: false
+      description: Path to _product/ directory, relative to docs/.
+    - name: lifecycle
+      type: string
+      nullable: true
+      description: "planned | active | deprecated (default active when empty). Owner-declared product lifecycle from the SDD manifest's lifecycle: field (sdd-manifest-schema 1.1.0; `planned` added 1.9.0 / catalogue 2.47.0). `planned` = the product is real and intended but does not exist yet, which is the normal opening state of a forward-authored product — so a forward estate that has generated nothing should read `planned`, not the `active` the empty default implies. Distinct from status (documentation maturity): lifecycle is a fact about the PRODUCT, status about the DOCUMENT, and both can hold at once — a product can be reviewed AND deprecated, or planned AND thinly documented. Added in 2.22.0."
+    - name: deprecated_date
+      type: date
+      nullable: true
+      description: Date the deprecation decision took effect. Only meaningful when lifecycle=deprecated. From the manifest's deprecated_date:. Added in 2.22.0.
+    - name: successor_sdd_id
+      type: string
+      nullable: true
+      description: "For deprecated products: sdd_id of the superseding SDD. Same vocabulary as sdd_id/source_sdd_id (NOT products.id). Soft reference — the aggregator orphan-checks it against contributing sdd_ids ([finding] orphan when unresolved), never a hard FK: the successor may live outside the aggregation scope. Added in 2.22.0."
+    - name: exemplar
+      type: string
+      nullable: true
+      description: "`true` when this SDD is a reference exemplar — it demonstrates a profile shape rather than modelling a real product or provider relationship. Empty otherwise, which is the unmarked norm (absent in the manifest = a real SDD, no finding). From the manifest's `exemplar:` field (sdd-manifest-schema 1.8.0). PROFILE-AGNOSTIC, unlike surface/packaging/application_archetype which are application-product-only — the first exemplar cohort found was integration-products. DERIVED, not authorable: this column and `integrations.exemplar` both come from the one manifest field, so they cannot disagree; two independently authored copies could, which is the failure mode the trait exists to remove. No builder branches on it — it is emitted to be filterable and nothing consumes it, because an implicit exclusion inside a rollup is much harder to remove than to add. Added in 2.46.0."
+    - name: shared_library
+      type: string
+      nullable: true
+      description: "`true` when this SDD exists to provide code other SDDs build from or generate from (M-ADR 0217 §4.4). Empty otherwise, the unmarked norm. From the SDD manifest's `shared_library:` field. PROFILE-AGNOSTIC, like `exemplar`. DERIVED, not authorable: this column and its twin on the other catalogue come from the one manifest field, so they cannot disagree. No builder branches on it; a rollup filters on it. Added in 3.20.0."
+    - name: surface
+      type: string
+      nullable: true
+      description: "ui | api (empty for non-application-product). Application-product surface trait from the manifest's surface: field (M-ADR 0167, sdd-manifest-schema 1.2.0). Empty on non-application products. Added in 2.35.0."
+    - name: packaging
+      type: string
+      nullable: true
+      description: "vendor-saas | self-operated (empty for non-application-product). Application-product packaging trait from the manifest's packaging: field (M-ADR 0175, sdd-manifest-schema 1.7.0). `vendor-saas` marks a packaged-SaaS product — vendor-operated runtime (no own deployment evidence) and a vendor-versioned base capability set. Absent in the manifest resolves to `self-operated`, the unmarked norm. Per M-ADR 0175 §4 no builder may branch on this trait beyond evidence/deployment handling. Column position follows the M-ADR 0194 §3.1 canonical axis order (surface, packaging, application_archetype). Added in 2.41.0."
+    - name: application_archetype
+      type: string
+      nullable: true
+      description: "Application-product shape classification from the manifest's application_archetype: field (M-ADR 0191, sdd-manifest-schema 1.2.0). Resolved-enum over a tiered vocabulary (method: unclassified; reference-architecture bundle; adopter). Defaults to 'unclassified' for application-product (with a coverage finding), empty for other profiles. Distinct from the M-ADR 0173 domain archetype and M-ADR 0169 openui archetype. Added in 2.35.0."
+    - name: synthesis_quality
+      type: int
+      nullable: true
+      description: "DEPRECATED at 3.3.0, for removal at 4.0.0 — superseded by `quality_scores` (rubric_id `reverse-product-quality.product_synthesis_quality`). Score 0-10 from the product-synthesis rubric (reverse method only). WIRED in 2.47.0 from `orchestration/gate-registry/reverse-product-quality-scores.yaml` — the registry family at product granularity — via the SELF-PRODUCT rule: the unit whose `product_path` is '.' AND whose key equals the SDD's sdd_id. Both conditions are required; product_path alone admits synthetic gate fixtures, key-matching alone admits covered sub-products. Backfill only: it fills an empty cell and never overwrites an emitted value. Empty on a forward estate by design — a forward-authored product has no reverse rubric score, and residue-based authoring signals deliberately do NOT write here (see status)."
+    - name: synthesis_band
+      type: string
+      nullable: true
+      description: "DEPRECATED at 3.3.0, for removal at 4.0.0 — superseded by `quality_scores.band`, which is UNBOUND because the vocabulary is per-rubric. This column's closed set accepts only three of the SEVEN band values the reverse estate actually authors (measured 3.3.0: strong, working, weak, moderate, easy, hard, very-hard), silently emptying the rest. developing | working | strong — a CLOSED vocabulary; a band outside it is reported as a convention finding and the cell left empty rather than emitting a value no consumer can interpret. Wired in 2.47.0 alongside synthesis_quality."
+    - name: last_assessed
+      type: date
+      nullable: true
+    - name: highest_snapshot_impact
+      type: string
+      nullable: true
+    - name: repo_count
+      type: int
+      nullable: false
+      description: Number of repos mapped to this product.
+    - name: source_sdd_id
+      type: string
+      nullable: true
+      description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+    - name: platform_sdd_id
+      type: string
+      nullable: true
+      description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
+    foreign_keys:
+    - column: domain_id
+      references: domains.id
+      nullable: true
+    column_enums:
+      profile: enums.sdd_profile
+      category: enums.sdd_category
+      lifecycle: enums.product_lifecycle
+      surface: enums.product_surface
+      packaging: enums.product_packaging
+  applications:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+      description: product_id slug.
+    - name: name
+      type: string
+      nullable: false
+    - name: domain_id
+      type: string
+      nullable: true
+      description: Owning capability domain. Populated for platform-profile products (platform-root, platform-subsystem). App and integration products do not have a primary domain — see M-ADR 0136.
+    - name: profile
+      type: string
+      nullable: false
+      description: platform-profile | application-product | integration-product | support-repo.
+    - name: category
+      type: string
+      nullable: true
+      description: "Architectural classification per docs/method/methods/standards/product-category-taxonomy.md. Values: platform-root | platform-subsystem | application-product | integration-provider | integration-umbrella | support-repo. Determines whether the Product gets a c4_systems row."
+    - name: doc_path
+      type: string
+      nullable: false
+      description: Path to _product/ directory, relative to docs/.
+    - name: lifecycle
+      type: string
+      nullable: true
+      description: "planned | active | deprecated (default active when empty). Owner-declared product lifecycle from the SDD manifest's lifecycle: field (sdd-manifest-schema 1.1.0; `planned` added 1.9.0 / catalogue 2.47.0). `planned` = the product is real and intended but does not exist yet, which is the normal opening state of a forward-authored product — so a forward estate that has generated nothing should read `planned`, not the `active` the empty default implies. Distinct from status (documentation maturity): lifecycle is a fact about the PRODUCT, status about the DOCUMENT, and both can hold at once — a product can be reviewed AND deprecated, or planned AND thinly documented. Added in 2.22.0."
+    - name: deprecated_date
+      type: date
+      nullable: true
+      description: Date the deprecation decision took effect. Only meaningful when lifecycle=deprecated. From the manifest's deprecated_date:. Added in 2.22.0.
+    - name: successor_sdd_id
+      type: string
+      nullable: true
+      description: "For deprecated products: sdd_id of the superseding SDD. Same vocabulary as sdd_id/source_sdd_id (NOT products.id). Soft reference — the aggregator orphan-checks it against contributing sdd_ids ([finding] orphan when unresolved), never a hard FK: the successor may live outside the aggregation scope. Added in 2.22.0."
+    - name: exemplar
+      type: string
+      nullable: true
+      description: "`true` when this SDD is a reference exemplar — it demonstrates a profile shape rather than modelling a real product or provider relationship. Empty otherwise, which is the unmarked norm (absent in the manifest = a real SDD, no finding). From the manifest's `exemplar:` field (sdd-manifest-schema 1.8.0). PROFILE-AGNOSTIC, unlike surface/packaging/application_archetype which are application-product-only — the first exemplar cohort found was integration-products. DERIVED, not authorable: this column and `integrations.exemplar` both come from the one manifest field, so they cannot disagree; two independently authored copies could, which is the failure mode the trait exists to remove. No builder branches on it — it is emitted to be filterable and nothing consumes it, because an implicit exclusion inside a rollup is much harder to remove than to add. Added in 2.46.0."
+    - name: shared_library
+      type: string
+      nullable: true
+      description: "`true` when this SDD exists to provide code other SDDs build from or generate from (M-ADR 0217 §4.4). Empty otherwise, the unmarked norm. From the SDD manifest's `shared_library:` field. PROFILE-AGNOSTIC, like `exemplar`. DERIVED, not authorable: this column and its twin on the other catalogue come from the one manifest field, so they cannot disagree. No builder branches on it; a rollup filters on it. Added in 3.20.0."
+    - name: surface
+      type: string
+      nullable: true
+      description: "ui | api (empty for non-application-product). Application-product surface trait from the manifest's surface: field (M-ADR 0167, sdd-manifest-schema 1.2.0). Empty on non-application products. Added in 2.35.0."
+    - name: packaging
+      type: string
+      nullable: true
+      description: "vendor-saas | self-operated (empty for non-application-product). Application-product packaging trait from the manifest's packaging: field (M-ADR 0175, sdd-manifest-schema 1.7.0). `vendor-saas` marks a packaged-SaaS product — vendor-operated runtime (no own deployment evidence) and a vendor-versioned base capability set. Absent in the manifest resolves to `self-operated`, the unmarked norm. Per M-ADR 0175 §4 no builder may branch on this trait beyond evidence/deployment handling. Column position follows the M-ADR 0194 §3.1 canonical axis order (surface, packaging, application_archetype). Added in 2.41.0."
+    - name: application_archetype
+      type: string
+      nullable: true
+      description: "Application-product shape classification from the manifest's application_archetype: field (M-ADR 0191, sdd-manifest-schema 1.2.0). Resolved-enum over a tiered vocabulary (method: unclassified; reference-architecture bundle; adopter). Defaults to 'unclassified' for application-product (with a coverage finding), empty for other profiles. Distinct from the M-ADR 0173 domain archetype and M-ADR 0169 openui archetype. Added in 2.35.0."
+    - name: synthesis_quality
+      type: int
+      nullable: true
+      description: "DEPRECATED at 3.3.0, for removal at 4.0.0 — superseded by `quality_scores` (rubric_id `reverse-product-quality.product_synthesis_quality`). Score 0-10 from the product-synthesis rubric (reverse method only). WIRED in 2.47.0 from `orchestration/gate-registry/reverse-product-quality-scores.yaml` — the registry family at product granularity — via the SELF-PRODUCT rule: the unit whose `product_path` is '.' AND whose key equals the SDD's sdd_id. Both conditions are required; product_path alone admits synthetic gate fixtures, key-matching alone admits covered sub-products. Backfill only: it fills an empty cell and never overwrites an emitted value. Empty on a forward estate by design — a forward-authored product has no reverse rubric score, and residue-based authoring signals deliberately do NOT write here (see status)."
+    - name: synthesis_band
+      type: string
+      nullable: true
+      description: "DEPRECATED at 3.3.0, for removal at 4.0.0 — superseded by `quality_scores.band`, which is UNBOUND because the vocabulary is per-rubric. This column's closed set accepts only three of the SEVEN band values the reverse estate actually authors (measured 3.3.0: strong, working, weak, moderate, easy, hard, very-hard), silently emptying the rest. developing | working | strong — a CLOSED vocabulary; a band outside it is reported as a convention finding and the cell left empty rather than emitting a value no consumer can interpret. Wired in 2.47.0 alongside synthesis_quality."
+    - name: last_assessed
+      type: date
+      nullable: true
+    - name: highest_snapshot_impact
+      type: string
+      nullable: true
+    - name: repo_count
+      type: int
+      nullable: false
+      description: Number of repos mapped to this product.
+    - name: source_sdd_id
+      type: string
+      nullable: true
+      description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+    - name: platform_sdd_id
+      type: string
+      nullable: true
+      description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
+    description: Filtered view of products where profile = application-product.
+    foreign_keys:
+    - column: domain_id
+      references: domains.id
+      nullable: true
+    column_enums:
+      profile: enums.sdd_profile
+      category: enums.sdd_category
+      lifecycle: enums.product_lifecycle
+      surface: enums.product_surface
+      packaging: enums.product_packaging
+  integrations:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+      description: Provider slug.
+    - name: name
+      type: string
+      nullable: false
+    - name: domain_id
+      type: string
+      nullable: true
+      description: Provider adapters are federation nodes, not capability-domain members. Left empty per M-ADR 0136.
+    - name: parent_product_id
+      type: string
+      nullable: true
+      description: Umbrella integration-product. Empty for an SDD's own row; set to the SDD's integrationId for sub-integration rows declared via integration-manifest.yaml `sub_integrations:` (per M-ADR 0144, schema 2.6.0).
+    - name: category
+      type: string
+      nullable: false
+      description: oem | device | fleet | camera | legacy | data-sharing | gateway-framework (extensible per ecosystem).
+    - name: doc_path
+      type: string
+      nullable: false
+    - name: repo_count
+      type: int
+      nullable: false
+    - name: ingestion_pattern
+      type: string
+      nullable: true
+      description: "Closed method-tier enum (event-stream-consume | webhook | socket-listen | poll) from the manifest's SDD-level `ingestionPattern` — HOW the integration acquires data (M-ADR 0171 §4.2). SCALAR: §9.3's multi-valued allowance was withdrawn in §10.5. Empty when undeclared or on an outbound-only integration. Empty on `sub_integrations` rows — the patterns are declared once at SDD level and are not per-provider. Added in 2.45.0."
+    - name: invocation_pattern
+      type: string
+      nullable: true
+      description: Closed method-tier enum (request-response | async-request | publish) from the manifest's SDD-level `invocationPattern` — HOW the integration invokes the provider (M-ADR 0171 §4.3). Scalar; empty when undeclared, on an inbound-only integration, or on a sub_integrations row. Added in 2.45.0.
+    - name: pattern_qualifier
+      type: string
+      nullable: true
+      description: Free-text sub-variant from `patternQualifier` where delivery semantics differ materially within a pattern (e.g. poll as a provider-issued ordered cursor vs a client-built window). Deliberately unconstrained — the method owns the pattern vocabulary, not every provider's delivery nuance. Added in 2.45.0.
+    - name: exemplar
+      type: string
+      nullable: true
+      description: "`true` when the emitting SDD is a reference exemplar (demonstrates a profile shape rather than modelling a real provider relationship); empty otherwise. Derived from the SDD manifest's `exemplar:` field (sdd-manifest-schema 1.8.0), same source as `products.exemplar` — neither column is independently authorable. Carried on `sub_integrations` rows too, INHERITED from the emitting SDD. That deliberately differs from `ingestion_pattern`/`invocation_pattern`, which are empty on sub rows, and the difference is the point: a pattern is a MECHANISM (how this integration acquires data), genuinely one per SDD, whereas `exemplar` is a REALITY STATUS that propagates to everything the SDD emits — if the SDD is a demonstration then every provider relationship it declares is a demonstration. Leaving sub rows empty would flag the umbrella and count its demonstration sub-providers as real, reproducing the rollup overcount this column exists to fix one level down. Do not normalise it to match the pattern columns. The trade accepted: a real SDD with one demonstration sub-provider is unexpressible — a state that should not exist. Added in 2.46.0."
+    - name: shared_library
+      type: string
+      nullable: true
+      description: "`true` when this SDD exists to provide code other SDDs build from or generate from (M-ADR 0217 §4.4). Empty otherwise, the unmarked norm. From the SDD manifest's `shared_library:` field. PROFILE-AGNOSTIC, like `exemplar`. DERIVED, not authorable: this column and its twin on the other catalogue come from the one manifest field, so they cannot disagree. No builder branches on it; a rollup filters on it. Added in 3.20.0."
+    - name: source_sdd_id
+      type: string
+      nullable: true
+      description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+    - name: platform_sdd_id
+      type: string
+      nullable: true
+      description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
+    description: Granular provider adapters. Each row is either (a) an integration-product SDD's own row (one per SDD; parent_product_id empty), or (b) a manifest-declared sub-integration of a multi-provider monolith (parent_product_id = umbrella SDD's id). Per M-ADR 0144 (schema 2.6.0), sub-integrations are declared via the optional `sub_integrations:` array in `integration-manifest.yaml`.
+    foreign_keys:
+    - column: domain_id
+      references: domains.id
+      nullable: true
+    - column: parent_product_id
+      references: products.id
+      nullable: true
+    column_enums:
+      invocation_pattern: enums.invocation_pattern
+  integration_component:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+      description: "{integration_id}__{component_id}. A duplicate emits a divergence finding and is dropped — two components of one integration cannot share an id."
+    - name: integration_id
+      type: string
+      nullable: false
+      description: The integration-product declaring this component (this SDD's integrationId).
+    - name: component_id
+      type: string
+      nullable: false
+      description: The component's declared id, from `components[].id`. Unique within its manifest (a duplicate is dropped with a divergence finding). Names an INTERACTION SURFACE — commonly one provider feed — not necessarily a deployable; the optional `component_repo` carries the code linkage where one is asserted (M-ADR 0171 §10.2).
+    - name: component_repo
+      type: string
+      nullable: true
+      description: "OPTIONAL explicit code linkage from `components[].componentRepo` — the deployable (repositories.id / services.id) that realises this component. Empty is the normal case for a feed-level component: the tier is at interaction-surface granularity, not deployable granularity, and the method does not require a component to name a deployable (M-ADR 0171 §10.2). When declared it MUST resolve, since a declared link is a positive assertion the method can check. Added in 2.44.0."
+    - name: resolution
+      type: string
+      nullable: false
+      description: undeclared | repository | service | unresolved. `undeclared` = no `componentRepo` given (normal, no finding). `repository`/`service` = the declared linkage resolved. `unresolved` = declared but matched no repositories.id or services.id of this SDD, which carries a coverage finding. Re-based on `component_repo` in 2.44.0 — it previously described resolution of `component_id` itself.
+    - name: component_type
+      type: string
+      nullable: true
+      description: Optional adopter-defined framework-role label from `componentType` (e.g. the adopter's archetype name). NOT enumerated or validated by the method (M-ADR 0171 §9.1/§9.5) — it exists so an adopter's role→pattern mapping is traceable. Empty when unauthored.
+    - name: direction
+      type: string
+      nullable: true
+      description: "inbound | outbound | bidirectional, from `dataFlow.direction`. Determines which pattern field is meaningful: inbound → ingestion_pattern, outbound → invocation_pattern, internal components declare neither (M-ADR 0171 §9.1)."
+    - name: frequency
+      type: string
+      nullable: true
+      description: real-time | on-demand | batch, from `dataFlow.frequency`. Open string — adopters carry finer cadences in prose.
+    - name: transport
+      type: string
+      nullable: true
+      description: Concrete wire mechanism from `protocol.transport` (kafka | sns | sqs | kinesis | amqp | tcp | udp | https | grpc | ...). Open string. Insufficient alone to determine the pattern — https may be webhook, poll or request-response; direction + initiator disambiguate (M-ADR 0171 §9.2).
+    - name: format
+      type: string
+      nullable: true
+      description: Payload format from `protocol.format` (json | protobuf | binary | avro | ...). Open string.
+    - name: auth
+      type: string
+      nullable: true
+      description: Auth mechanism from `protocol.auth` (tls | sasl | oauth2 | api-key | mtls | none | ...). Open string — real estates carry vendor-specific grant variants here.
+    - name: ingestion_pattern
+      type: string
+      nullable: true
+      description: Closed method-tier enum (event-stream-consume | webhook | socket-listen | poll) from `components[].ingestionPattern`. Meaningful on inbound components; empty otherwise (M-ADR 0171 §4.2).
+    - name: invocation_pattern
+      type: string
+      nullable: true
+      description: Closed method-tier enum (request-response | async-request | publish) from `components[].invocationPattern`. Meaningful on outbound components; empty otherwise (M-ADR 0171 §4.3).
+    - name: pattern_qualifier
+      type: string
+      nullable: true
+      description: Free-text sub-variant from `patternQualifier` where delivery semantics differ materially within a pattern (e.g. poll as token-feed vs windowed). Deliberately unconstrained.
+    - name: primary_entities
+      type: string
+      nullable: true
+      description: Semicolon-joined `dataFlow.primaryEntities`. Adopter-tier entity names; joined rather than normalised because the tier is descriptive, not an FK surface.
+    - name: declared_in
+      type: string
+      nullable: false
+      description: "components-array | component-manifest — WHICH of M-ADR 0171 §9.1's two homes declared this component. Added in 2.49.0, when the second home became catalogued. Required because §10.1 states that any coverage reasoning MUST say which form it counts, and once one table holds both, a consumer cannot tell them apart: merging them without this recreates the reference-exemplar problem — well-formed rows that do not mean what a consumer assumes. Measured at the time of wiring: the array form was 15 components across 5 SDDs, the per-component form 86 across 21, and the two are DISJOINT (no id collision, no SDD using both). `resolution` also reads differently by form — for the array form `componentRepo` is an optional declaration (0 of 15 declared it); for the per-component form the containing `repos/<component>/` directory IS the repo, so linkage is structural rather than declared."
+    - name: source_sdd_id
+      type: string
+      nullable: true
+      description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+    - name: platform_sdd_id
+      type: string
+      nullable: true
+      description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
+    description: |
+      Integration-product edge (M-ADR 0171 §9, catalogued per §10.1): one row per component declared in the SDD's `integration-manifest.yaml` `components:` array. A component is one of the integration's component code repos (M-ADR 0106) — an integration SDD is a one-to-many spec→code unit — and the tier is the source of truth for the interaction pattern, with the SDD-level `ingestionPattern`/`invocationPattern` as its aggregate (§9.3).
+      Built per-SDD, integration-product only (other profiles emit headers-only). A component id is unique within its manifest and names an **interaction surface** — commonly one provider feed — which is NOT necessarily a deployable (§10.2). The optional `component_repo` carries an explicit code linkage; when declared it MUST resolve to a `repositories.id` or `services.id` of the same SDD, and a declared-but-unresolvable linkage is a **coverage finding, not a load failure**. `resolution` records the outcome inline, including `undeclared` for the normal feed-level case, so a consumer filters on it rather than inferring from a join miss.
+      The method deliberately does NOT enumerate `component_type` — that is the adopter's own framework-role label (§9.1/§9.5), carried so an adopter's role→pattern mapping stays machine-traceable. `transport`/`format`/`auth` are open strings for the same reason: they describe the wire, and the portable semantic is the pattern. Added in schema 2.43.0.
+    foreign_keys:
+    - column: integration_id
+      references: integrations.id
+      nullable: false
+    column_enums:
+      invocation_pattern: enums.invocation_pattern
+      resolution: enums.integration_component_resolution
+      declared_in: enums.integration_component_declared_in
+  adrs:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+      description: ADR id, e.g. ADR-0001 or {domain}-D001.
+    - name: title
+      type: string
+      nullable: false
+    - name: status
+      type: string
+      nullable: true
+      description: Accepted | Proposed | Superseded | Deprecated | Deferred (forward) plus reverse-inferred | reverse-adapted (reverse).
+    - name: domain_id
+      type: string
+      nullable: true
+      description: "Domain slug for a domain-scoped ADR (docs/domains/<slug>/…); 'platform' for a platform-scoped ADR (docs/platform/adr/), whose owner has that domain by construction; EMPTY for a method-scoped ADR (docs/method/adr/, docs/method/platform-adr/) — method ADRs are cross-cutting governance and belong to no domain. Nullable since 3.10.0 (M-ADR 0136 §4.3 amendment): before it, method ADRs were pinned to 'platform' and dangled in every platform-root without a domain of that name. External for application- and integration-product SDDs since 3.17.0, as capabilities.domain_id is: an app or integration SDD files its own domain-scoped decisions under a platform-side domain (e.g. integrations) it does not declare, so its build logs an external finding naming the value, and the owning platform's aggregate validates it — and fails there if that platform declares no such domain."
+    - name: decision_date
+      type: date
+      nullable: true
+    - name: doc_path
+      type: string
+      nullable: false
+    - name: superseded_by_id
+      type: string
+      nullable: true
+    - name: inference_confidence
+      type: string
+      nullable: true
+      description: high | medium | low (reverse-inferred ADRs only).
+    - name: supersedes_raw
+      type: string
+      nullable: true
+      description: Raw text from Supersedes bullet for later parsing.
+    - name: source_sdd_id
+      type: string
+      nullable: true
+      description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+    - name: platform_sdd_id
+      type: string
+      nullable: true
+      description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
+    foreign_keys:
+    - column: domain_id
+      references: domains.id
+      nullable: true
+      external_for_profiles:
+      - application-product
+      - integration-product
+    - column: superseded_by_id
+      references: adrs.id
+      nullable: true
+    column_enums:
+      inference_confidence: enums.confidence_level
+  glossary_items:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+      description: "Slug: {domain}-{term-slug} for uniqueness."
+    - name: term
+      type: string
+      nullable: false
+    - name: definition
+      type: string
+      nullable: false
+    - name: owning_domain_id
+      type: string
+      nullable: true
+      description: Null for platform-level terms.
+    - name: canonical_term_id
+      type: string
+      nullable: true
+      description: Set when this term is an alias for another.
+    - name: aliases
+      type: string
+      nullable: true
+      description: "';'-separated list."
+    - name: evidence
+      type: string
+      nullable: true
+    - name: notes
+      type: string
+      nullable: true
+    - name: source_sdd_id
+      type: string
+      nullable: true
+      description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+    - name: platform_sdd_id
+      type: string
+      nullable: true
+      description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
+    foreign_keys:
+    - column: owning_domain_id
+      references: domains.id
+      nullable: true
+    - column: canonical_term_id
+      references: glossary_items.id
+      nullable: true
+  glossary_xref:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+      description: "Composite: {source_id}__{relation}__{target_id}."
+    - name: source_id
+      type: string
+      nullable: false
+    - name: target_id
+      type: string
+      nullable: false
+    - name: relation
+      type: string
+      nullable: false
+      description: alias-of | conflicts-with | references | supersedes (extended in schema 2.12.0 per M-ADR 0158).
+    description: "Edge: cross-domain glossary relationships from glossary-alignment-manifest.yaml. Per M-ADR 0158, four walkers ingest into this catalogue: (a) forward declared pair-form {source, target} entries under aliases/conflicts, (b) reverse-method cross_domain_terms (emits references edges per referencer→owner), (c) reverse-method multi-domain conflicts (pair-wise expansion across domains[]), (d) forward-method supersedes (status: superseded entries with superseded_by back-link)."
+    foreign_keys:
+    - column: source_id
+      references: glossary_items.id
+      nullable: false
+    - column: target_id
+      references: glossary_items.id
+      nullable: false
+    column_enums:
+      relation: enums.glossary_xref_relation
+  entity_glossary:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+      description: "Composite: {domain_id}__{entity_name_slug}__{glossary_item_id}."
+    - name: domain_id
+      type: string
+      nullable: false
+    - name: entity_name
+      type: string
+      nullable: false
+    - name: glossary_item_id
+      type: string
+      nullable: false
+    - name: status
+      type: string
+      nullable: false
+      description: aligned | matched_direct. Conflicting statuses within a domain resolve matched_direct > aligned with a divergence finding.
+    - name: source_sdd_id
+      type: string
+      nullable: true
+      description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+    - name: platform_sdd_id
+      type: string
+      nullable: true
+      description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
+    - name: entity_id
+      type: string
+      nullable: true
+      description: The data-model entity this glossary mapping is about — an entities.id. The edge was always emitted per (domain, entity, glossary_term) and this end was missing from its keys (found at M-ADR 0210 flip 2; added at 3.9.0). Nullable until every builder populates it.
+    description: "Edge: data-model entity → canonical glossary term. Added in schema 2.12.0 per M-ADR 0158. Source: glossary-alignment-manifest.yaml `models[].entities[]` with status ∈ {aligned, matched_direct} and non-empty glossary_term. PK derives from (domain, entity_name, glossary_item) so same-domain multi-diagram entries collapse to one row; cross-domain entries (e.g. platform-wide conceptual model + domain-specific model) emit one row per domain — legitimate cross-level cataloguing."
+    foreign_keys:
+    - column: domain_id
+      references: domains.id
+      nullable: false
+    - column: glossary_item_id
+      references: glossary_items.id
+      nullable: false
+    - column: entity_id
+      references: entities.id
+      nullable: true
+  services:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+      description: Service id, derived from artifact_id where artifact_type=service.
+    - name: name
+      type: string
+      nullable: false
+    - name: product_id
+      type: string
+      nullable: false
+    - name: domain_id
+      type: string
+      nullable: true
+      description: Owning capability domain. Populated when the repo-config declared domain resolves to a docs/domains/<slug>/ in the local SDD; left empty otherwise per M-ADR 0136.
+    - name: primary_repo_id
+      type: string
+      nullable: true
+      description: Main contributing repo. Nullable when service spans repos. Per M-ADR 0197, a repository MAY declare a `services:` block naming more than one service it builds — every declared entry's primary_repo_id equals the declaring repository's id, so this column is m:n (several services legitimately sharing one repository), not the 1:1 identity it holds when no repository declares the block.
+    - name: runtime_type
+      type: string
+      nullable: true
+      description: serverless-framework | jvm-service | lambda | k8s | ...
+    - name: language
+      type: string
+      nullable: true
+    - name: component_type
+      type: string
+      nullable: true
+      description: bff | api | consumer | ui | collector | processor | ...
+    - name: status
+      type: string
+      nullable: true
+      description: production-wired | non-production | library.
+    - name: confidence
+      type: string
+      nullable: true
+      description: high | medium | low (reverse-method classification).
+    - name: context
+      type: string
+      nullable: true
+      description: Bounded-context membership (per M-ADR 0170 §4.6). Free-form adopter label, orthogonal to domain_id. Not an FK. Carried for forward-parity; awaits a derivation source (e.g. from the service's contracts' x-context). Added in schema 2.19.0.
+    - name: description
+      type: string
+      nullable: true
+    - name: source_sdd_id
+      type: string
+      nullable: true
+      description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+    - name: platform_sdd_id
+      type: string
+      nullable: true
+      description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
+    foreign_keys:
+    - column: product_id
+      references: products.id
+      nullable: false
+    - column: domain_id
+      references: domains.id
+      nullable: true
+    - column: primary_repo_id
+      references: repositories.id
+      nullable: true
+    column_enums:
+      component_type: enums.service_type
+      confidence: enums.confidence_level
+  capabilities:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+      description: Capability slug.
+    - name: name
+      type: string
+      nullable: false
+    - name: domain_id
+      type: string
+      nullable: false
+    - name: tree_category
+      type: string
+      nullable: true
+      description: Top-level grouping when capability comes from a capability tree (reverse).
+    - name: parent_capability_id
+      type: string
+      nullable: true
+    - name: evidence_class
+      type: string
+      nullable: true
+      description: Evidence class of the capability's claims, from `capability.evidence_class` in the traceability manifest. Free-form; conventional values code-reverse | vendor-doc | operational (M-ADR 0175). Empty when undeclared. Added in schema 2.20.0.
+    - name: context
+      type: string
+      nullable: true
+      description: Bounded-context membership from `capability.context` in the traceability manifest (per M-ADR 0170 §4.6) — completes the context dimension across screens/contracts/services/entities (2.19.0). Free-form adopter label, orthogonal to domain_id. Not an FK. Enables the screen↔capability context cross-check (convention finding, not FK). Empty when undeclared. Added in schema 2.21.0.
+    - name: description
+      type: string
+      nullable: true
+    - name: status
+      type: string
+      nullable: false
+      description: "Capability LIFECYCLE phase — this column carries ONE axis and the reader may rely on that. active | planned | exploration | deprecated. Default 'active'. History, because the shape of the mistake is the useful part: the prior three-member set (active|planned|deprecated) could not express what estates authored, so 3.5.0 widened it to six on measured evidence — 44 of one estate's 78 manifests were outside it (exploration 26, placeholder 11, detailed-pre-lock 6, first-draft 1), each recurring value varying WITHIN a domain, which is the ruled discriminator for a genuine phase over an authoring convention. But 3.6.0 RETRACTED `placeholder` and `detailed-pre-lock`: per M-ADR 0201 §1 those are rungs on the SPEC-AUTHORING ladder (`placeholder | first-draft | detailed-pre-lock`, plus §4.1's `reverse-derived`), declared in each spec's own `**Status:**` header and gated there by the spec-lifecycle gate. Admitting them here made one column carry two orthogonal axes, so a reader could not tell whether `placeholder` described the capability or its document. **Where the other axis lives: the spec header. Do not re-import it here.** `exploration` stays and is NOT authoring vocabulary — it is absent from 0201's ladder, has M-ADR 0089's workflow and named gates behind it, and describes the capability rather than its spec; a capability declaring it must carry a populated `traceability.exploration` block, and one that does not is a loud contradiction (validate-traceability enforces this; measured 0 of 26 violations). ⚠ A rule this column deliberately does NOT carry: `placeholder`'s. The obvious one (no authored features) was MEASURED FALSE — 4 of 11 carried features, one of them 9 — and the deeper reason no rule fit is that `placeholder` was never making a claim about the capability at all. That unwritable rule was the first symptom of the axis error, before anyone had named it. ⚠ DELIBERATELY NOT BOUND via column_enums, and this is staged rather than permanent: binding carries hard-fail teeth, and at 3.5.0 one out-of-vocabulary row remains (forward estate, `first-draft`, n=1, referred to that estate; the reverse estate measures ZERO across 180 manifests). An out-of-vocabulary value is CARRIED, not emptied and not rejected, and is reported as a convention finding by validate-traceability — nullable stays false and no cell is ever emptied, so the empty-means-unauthored-or-rejected ambiguity of the products.synthesis_band / quality_scores.gate precedents does not arise here. Bind only once that count is ZERO at both estates; binding a set not proven to cover what estates author is how synthesis_band earned its deprecation. On drift and enforcement, stated with its confound rather than as a slogan: the enforced sibling `contracts.status` drifted 1.2% (2 of 172) while this unenforced field drifted 56% (44 of 78) at the SAME estate — but the other estate's copy of this same unenforced field drifted 0% of 180, so enforcement is not the only variable. The difference is authoring shape: the forward estate hand-authors per capability across 13 domains and explores vocabulary doing it, while the reverse estate's manifests come from one largely uniform extraction process. That uniformity is itself the phase-vs-convention discriminator firing — a value uniform across a whole estate is tracking the process that wrote it."
+    - name: spec_path
+      type: string
+      nullable: true
+      description: Path to capability spec file when one exists.
+    - name: contract_provenance
+      type: string
+      nullable: true
+      description: "How this capability's declared contract SET was produced, from `traceability.contracts.provenance`. hand-authored | reverse-extracted | generated — the vocabulary the method already ships for `authoring-mode`, reused deliberately so provenance has one vocabulary and not two. Empty means undeclared, and undeclared reads as `hand-authored` by convention. Added at 3.5.0. ⚠ STRICTLY ORTHOGONAL to the contract-set maturity ladder (`traceability.contracts.status`: planned | provisional | partial | complete | locked | none): provenance never constrains status and status never constrains provenance, and `reverse-extracted` + `complete` is the legitimate pair that motivated the field. Evidence: 2 reverse-estate manifests had written `reverse-extracted` INTO contracts.status, where it is invalid, because a complete reverse-derived contract surface had no way to say both true things at once and the author picked the provenance one. A rule here that constrained maturity would re-create exactly that defect. ⚠ Note the asymmetry this column exposes and does not fix: the maturity ladder it is orthogonal to has NO catalogue column at all — `traceability.contracts.status` is validator-enforced but uncatalogued, so it is queryable by no consumer. That is the authored-but-uncatalogued class (a block with no column has no automated reader, so nothing can notice when it is absent or wrong); this column is given one precisely so the provenance half does not join it. Giving the ladder a column is a candidate follow-on, not done here."
+    - name: source
+      type: string
+      nullable: false
+      description: capability-tree | product-map | capability-spec.
+    - name: runway_classification
+      type: string
+      nullable: true
+      description: Business | Enabler-Runway | Hybrid (forward declares; reverse nullable until backfilled).
+    - name: data_subset
+      type: string
+      nullable: true
+      description: Keying-axis marker for foundational-tier / synthesis-tier capabilities whose evidence is keyed by ownership boundary or data subset rather than app group. Populated from `capability.data_subset` in the traceability manifest. Empty for implementing-tier capabilities (those use app_group on per-evidence rows). See `docs/method/methods/reverse/rubrics/reverse-platform-evidence-quality.md` §`app_group:` → `data_subset:` rename. Added in schema 2.9.0.
+    - name: slice_scope
+      type: string
+      nullable: true
+      description: "Per-slice marker when one capability legitimately covers multiple app groups or data subsets (e.g. a compliance capability spanning several regulated-fleet sub-groups). Same capability_id may appear across multiple rows when sliced; row identity is then `(id, slice_scope)`. Empty when the capability is not sliced. Per-slice AC numbering convention: AC1-ACN unsuffixed for the first slice; subsequent slices use AC numbering suffixed by slice. See `docs/method/methods/reverse/rubrics/reverse-platform-evidence-quality.md` §`slice_scope:` and `docs/method/methods/capability-spec-template.md` Guideline 9. Added in schema 2.9.0."
+    - name: source_sdd_id
+      type: string
+      nullable: true
+      description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+    - name: platform_sdd_id
+      type: string
+      nullable: true
+      description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
+    foreign_keys:
+    - column: domain_id
+      references: domains.id
+      nullable: false
+      external_for_profiles:
+      - application-product
+      - integration-product
+    - column: parent_capability_id
+      references: capabilities.id
+      nullable: true
+    column_enums:
+      source: enums.capability_source
+  feature_groups:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+      description: "{product_id|capability_id}-group-{slug}[-{nested-slug}]."
+    - name: name
+      type: string
+      nullable: false
+      description: Display name from H2/H3 heading or authored.
+    - name: product_id
+      type: string
+      nullable: true
+      description: Owning product (when group is product-scoped).
+    - name: capability_id
+      type: string
+      nullable: true
+      description: Owning capability (when group is capability-scoped).
+    - name: parent_group_id
+      type: string
+      nullable: true
+      description: Self-reference for nested groups (H3 within H2).
+    - name: description
+      type: string
+      nullable: true
+      description: Authored description (when group has explicit metadata) or null when derived from heading only.
+    - name: source
+      type: string
+      nullable: false
+      description: feature-tree-h2 | feature-tree-h3 | feature-spec-explicit (when an authored feature spec declares group membership) | capability-spec-explicit.
+    - name: source_sdd_id
+      type: string
+      nullable: true
+      description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+    - name: platform_sdd_id
+      type: string
+      nullable: true
+      description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
+    description: |
+      Hierarchical grouping for features. First-class entity per resolution of adopt-canonical-catalogue-builder.md §7.2 — replaces the previous reverse-only synthetic `feature-tree-group` rows in features.csv. Both forward and reverse can use feature_groups: forward application-product SDDs whose `feature-tree.md` has H2/H3 structure, reverse SDDs whose extracted feature trees are inherently hierarchical, and any SDD that promotes groups to first-class with authored metadata. Groups can nest via `parent_group_id`.
+    foreign_keys:
+    - column: product_id
+      references: products.id
+      nullable: true
+    - column: capability_id
+      references: capabilities.id
+      nullable: true
+    - column: parent_group_id
+      references: feature_groups.id
+      nullable: true
+  features:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+      description: "{product_id|capability_id}-{feature-slug}."
+    - name: name
+      type: string
+      nullable: false
+    - name: product_id
+      type: string
+      nullable: true
+      description: Owning product (null for capability-spec-sourced features).
+    - name: capability_id
+      type: string
+      nullable: true
+    - name: parent_group_id
+      type: string
+      nullable: true
+      description: Owning feature_group (typical when feature comes from a hierarchical feature-tree.md). Use this OR parent_feature_id, not both.
+    - name: parent_feature_id
+      type: string
+      nullable: true
+      description: Self-reference for explicit feature nesting (rare — most hierarchies are group-based via parent_group_id).
+    - name: description
+      type: string
+      nullable: true
+    - name: maturity
+      type: string
+      nullable: true
+      description: "Standard: working | provisional | unknown | absent. Ecosystem-specific values may be added with parser awareness."
+    - name: status
+      type: string
+      nullable: false
+      description: Default 'active'.
+    - name: source
+      type: string
+      nullable: false
+      description: "feature-tree | feature-set | capability-spec | feature-spec | feature-grounding. NOTE: feature-tree-group source removed in 1.3.0 — groups are now first-class in feature_groups.csv. As of schema 2.2.0, source: feature-tree is emitted by the canonical builder for rows derived from feature-tree.md bullets. As of schema 2.5.0, source: feature-grounding is emitted for rows derived from `docs/domains/<dom>/design/<capability>/feature-grounding.md` markdown tables (per M-ADR 0143). As of schema 2.7.0, source: capability-spec is emitted by the canonical builder for rows derived from `## Feature Grounding (code-path trace)` tables in `docs/domains/<dom>/product/<capability>.md` capability spec markdown (per M-ADR 0145). Feature-grounding and capability-spec rows are both capability-owned: product_id is empty; capability_id resolves from the file path."
+    - name: runway
+      type: string
+      nullable: true
+      description: Optional adopter-owned lifecycle / migration marker. Free string at method level — the schema declares no enum and ships no controlled vocabulary. Adopters MAY declare a per-SDD `feature-runway-vocabulary.yaml` at their SDD root; when present, the canonical builder validates captured values against it and emits a `convention` finding for unknown values. Empty when the adopter does not track migration state. Comparability across SDDs requires ecosystem-level vocabulary alignment as an explicit pre-step. Added in schema 2.2.0.
+    - name: source_sdd_id
+      type: string
+      nullable: true
+      description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+    - name: platform_sdd_id
+      type: string
+      nullable: true
+      description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
+    foreign_keys:
+    - column: product_id
+      references: products.id
+      nullable: true
+    - column: capability_id
+      references: capabilities.id
+      nullable: true
+    - column: parent_group_id
+      references: feature_groups.id
+      nullable: true
+    - column: parent_feature_id
+      references: features.id
+      nullable: true
+    column_enums:
+      source: enums.feature_source
+      maturity: enums.artefact_maturity
+  personas:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+      description: "{product_id}-{persona-slug}."
+    - name: name
+      type: string
+      nullable: false
+    - name: product_id
+      type: string
+      nullable: false
+    - name: role
+      type: string
+      nullable: true
+    - name: description
+      type: string
+      nullable: true
+    - name: source_sdd_id
+      type: string
+      nullable: true
+      description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+    - name: platform_sdd_id
+      type: string
+      nullable: true
+      description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
+    foreign_keys:
+    - column: product_id
+      references: products.id
+      nullable: false
+  user_journeys:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+      description: "{product_id}-{journey-slug}."
+    - name: name
+      type: string
+      nullable: false
+    - name: product_id
+      type: string
+      nullable: false
+    - name: primary_persona
+      type: string
+      nullable: true
+      description: Free-text. Supports 'X → Y (handoff)'.
+    - name: supporting_personas
+      type: string
+      nullable: true
+    - name: trigger
+      type: string
+      nullable: true
+    - name: goal
+      type: string
+      nullable: true
+    - name: source_sdd_id
+      type: string
+      nullable: true
+      description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+    - name: platform_sdd_id
+      type: string
+      nullable: true
+      description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
+    foreign_keys:
+    - column: product_id
+      references: products.id
+      nullable: false
+  contracts:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+      description: "{domain}-{stem}-{kind} — the kind component joined the id at schema 3.0.0 (M-ADR 0203 §4.4), ending the kindless collision class where one service published as two contract families (openapi + proto) minted one id (measured cost: 1 row + 2 edges permanently unrepresentable, plus legitimate shared-contract citation flagged as divergence). Mechanical migration: new id = old id + '-' + kind; `sdd-cli catalogue migration-map` emits the pairs, and authored alias targets (M-ADR 0147) re-key automatically during the cut window."
+    - name: name
+      type: string
+      nullable: false
+      description: Display name from info.title or artifact_id.
+    - name: service_id
+      type: string
+      nullable: true
+      description: Exposing service; resolved via primary_repo_id ↔ OpenAPI x-source-repo.
+    - name: source_repo_id
+      type: string
+      nullable: true
+      description: Repo owning the contract source. Distinct from exposing service's repo per M-ADR 0110 (sibling-repo pattern).
+    - name: kind
+      type: string
+      nullable: false
+      description: rest | graphql | rpc | event | authz. rpc covers Proto/gRPC; event covers Avro schemas; authz covers authorization/policy schemas (SpiceDB .zed and equivalents), added because an adopter contract lock-in gate certified .zed schemas as contracts while no kind could represent them.
+    - name: version
+      type: string
+      nullable: true
+    - name: status
+      type: string
+      nullable: false
+      description: active | deprecated. Default 'active'. As of 2.22.0 the builder wires 'deprecated' from BASELINE.md deprecation-runway entries (contracts.{openapi|proto|avro}[].status, matched on path == spec_path; per M-ADR 0073 §4.8) when a BASELINE.md exists at the SDD root.
+    - name: spec_path
+      type: string
+      nullable: true
+    - name: visibility
+      type: string
+      nullable: true
+      description: public | private | internal.
+    - name: context
+      type: string
+      nullable: true
+      description: Bounded-context membership from OpenAPI `info.x-context` (per M-ADR 0170 §4.6). Free-form adopter label, orthogonal to the contract's domain folder. Not an FK. Empty when untagged. Added in schema 2.19.0.
+    - name: evidence_class
+      type: string
+      nullable: true
+      description: Evidence class of the contract surface, from OpenAPI `info.x-evidence-class` (document root accepted as fallback, exactly like x-context). Free-form; conventional values code-reverse | vendor-doc | operational (M-ADR 0175). Empty when untagged. Added in schema 2.20.0.
+    - name: description
+      type: string
+      nullable: true
+    - name: discovery
+      type: string
+      nullable: true
+      description: discovered | declared-external. `discovered` (default) means the builder walked the spec file and parsed it, so title/version/context/evidence_class are trustworthy. `declared-external` means the row exists ONLY because a capability traceability manifest declared it with an explicit external marker and the file was never read — so those columns are necessarily EMPTY and their emptiness carries no information. A consumer that cannot tell the two apart will treat a declaration as a validated contract. Added in schema 2.51.0 (D13).
+    - name: source_sdd_id
+      type: string
+      nullable: true
+      description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+    - name: platform_sdd_id
+      type: string
+      nullable: true
+      description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
+    foreign_keys:
+    - column: service_id
+      references: services.id
+      nullable: true
+    - column: source_repo_id
+      references: repositories.id
+      nullable: true
+    column_enums:
+      kind: enums.contract_kind
+      status: enums.contract_status
+      visibility: enums.contract_visibility
+      discovery: enums.contract_discovery
+  events:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+    - name: name
+      type: string
+      nullable: false
+    - name: publisher_service_id
+      type: string
+      nullable: true
+    - name: domain_id
+      type: string
+      nullable: true
+    - name: transport
+      type: string
+      nullable: true
+      description: "Open string per M-ADR 0156. Recommended values: kafka | sns | sqs | kinesis | eventbridge | mongodb-change-stream | nats | activemq | rabbitmq | jms | other. Values outside the recommended set emit [finding] convention."
+    - name: schema_path
+      type: string
+      nullable: true
+      description: "Path to event schema (Avro .avsc or JSON-Schema .json/.schema.json). Nullable — leave empty for loosely-typed events (e.g. ActiveMQ JMS, NATS with payload_schema: {type: object}). Per M-ADR 0156."
+    - name: version
+      type: string
+      nullable: true
+    - name: evidence_class
+      type: string
+      nullable: true
+      description: Evidence class of the event claim, from the per-event `evidence_class` key (alias `evidence-class`) in event-catalog.yaml, falling back to a file-level `evidence_class`/`evidence-class` top-level key in the same catalog YAML. Free-form; conventional values code-reverse | vendor-doc | operational (M-ADR 0175). Empty for avsc-only events and when undeclared. Added in schema 2.20.0.
+    - name: source_sdd_id
+      type: string
+      nullable: true
+      description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+    - name: platform_sdd_id
+      type: string
+      nullable: true
+      description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
+    description: "Asynchronous messages. Cross-domain events (e.g. shared envelopes) leave domain_id empty. Per M-ADR 0156 (multi-source ingestion, schema 2.12.0): forward-method canonical source is `contracts/avro/*.avsc` files; reverse-method canonical source is `docs/domains/{domain}/contracts/events/event-catalog.yaml`. YAML wins on name/domain/publisher/transport/consumers; avsc augments schema_path/version. Both paths run and merge by id slug."
+    foreign_keys:
+    - column: publisher_service_id
+      references: services.id
+      nullable: true
+    - column: domain_id
+      references: domains.id
+      nullable: true
+  c4_systems:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+      description: Typically {product_id}-system.
+    - name: name
+      type: string
+      nullable: false
+    - name: product_id
+      type: string
+      nullable: true
+      description: "Owning product, when the system corresponds to one. Nullable: every product is a system, but not every system is a product (external/SaaS systems have no owning product). Architectural products only (per category taxonomy). Relaxed to nullable in schema 2.11.0."
+    - name: kind
+      type: string
+      nullable: false
+      description: platform | subsystem | application | integration. Derived 1:1 from manifest.category — see enums.c4_system_kind.
+    - name: diagram_path
+      type: string
+      nullable: true
+      description: Path to L1 mermaid/markdown. Nullable — row exists for any architectural Product even if no L1 diagram has been authored yet (visible coverage gap).
+    - name: description
+      type: string
+      nullable: true
+    - name: source_sdd_id
+      type: string
+      nullable: true
+      description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+    - name: platform_sdd_id
+      type: string
+      nullable: true
+      description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
+    foreign_keys:
+    - column: product_id
+      references: products.id
+      nullable: true
+    column_enums:
+      kind: enums.c4_system_kind
+  c4_containers:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+      description: "{system_id}-{container-slug}."
+    - name: name
+      type: string
+      nullable: false
+    - name: system_id
+      type: string
+      nullable: false
+      description: Owning C4 system (every container is in exactly one system).
+    - name: domain_id
+      type: string
+      nullable: true
+      description: Optional organisational domain tag (denormalised; not C4-structural).
+    - name: service_id
+      type: string
+      nullable: true
+      description: Matched by container name ↔ service name/repo where possible.
+    - name: type
+      type: string
+      nullable: true
+      description: "Canonical C4 container kind — bound to enums.c4_container_type (Application | Data Store) since 3.0.0, hard-fail (M-ADR 0203 §4.1 completing M-ADR 0155). The 2.x legacy values are removed: External System boxes belong in c4_external_systems; running infrastructure retypes; deployment infrastructure leaves the catalogue."
+    - name: technology
+      type: string
+      nullable: true
+    - name: description
+      type: string
+      nullable: true
+    - name: source_sdd_id
+      type: string
+      nullable: true
+      description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+    - name: platform_sdd_id
+      type: string
+      nullable: true
+      description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
+    description: |
+      C4 L2. Each container belongs to exactly one C4 system. `domain_id` is a denormalised organisational tag, not a C4-structural attribute — multi-domain ecosystems use it for filtering/reporting. `service_id` is the optional "may represent" link to a runtime service when the container is a deployable application.
+    foreign_keys:
+    - column: system_id
+      references: c4_systems.id
+      nullable: false
+    - column: domain_id
+      references: domains.id
+      nullable: true
+    - column: service_id
+      references: services.id
+      nullable: true
+    column_enums:
+      type: enums.c4_container_type
+  c4_components:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+      description: "{container_id}-{component-slug}."
+    - name: name
+      type: string
+      nullable: false
+    - name: container_id
+      type: string
+      nullable: false
+      description: Owning C4 container.
+    - name: service_id
+      type: string
+      nullable: true
+      description: "Denormalised: the service the parent container represents, when applicable."
+    - name: path
+      type: string
+      nullable: true
+    - name: responsibility
+      type: string
+      nullable: true
+    - name: source_sdd_id
+      type: string
+      nullable: true
+      description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+    - name: platform_sdd_id
+      type: string
+      nullable: true
+      description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
+    description: |
+      C4 L3. Each component belongs to exactly one C4 container. `service_id` is denormalised from `c4_containers.service_id` for query convenience — populated when the parent container represents a runtime service.
+    foreign_keys:
+    - column: container_id
+      references: c4_containers.id
+      nullable: false
+    - column: service_id
+      references: services.id
+      nullable: true
+  c4_external_systems:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+      description: ext-{slug(diagram entry id)} — derived from the DECLARED identity (the first argument of System_Ext/Container_Ext), not from the display name, since 3.0.0 (M-ADR 0203 §4.2 completing M-ADR 0189 §4.2). The 2.x name-slug ids map to these mechanically; `sdd-cli catalogue migration-map` emits the old→new map, and authored exemption files keyed by a mapped old id re-key automatically during the cut window (regenerable, not drift).
+    - name: name
+      type: string
+      nullable: false
+      description: Display name from the System_Ext label.
+    - name: technology
+      type: string
+      nullable: true
+      description: Optional stack/protocol hint.
+    - name: description
+      type: string
+      nullable: true
+      description: What the external system provides.
+    - name: declared_id
+      type: string
+      nullable: true
+      description: The diagram entry id of the first-seen declaration (M-ADR 0189 §4.2) — the declared identity the aggregator resolves against estate identifiers at adjudication, and the source of the row id since 3.0.0. Added 2.30.0.
+    - name: source_scope
+      type: string
+      nullable: true
+      description: "Scope of the first-seen declaration: l1 (context diagram) or l2 (container diagram — scope-relative per M-ADR 0189 §4.1). Added 2.30.0."
+    - name: source_sdd_id
+      type: string
+      nullable: true
+      description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+    - name: platform_sdd_id
+      type: string
+      nullable: true
+      description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
+    description: |
+      C4 external software systems — peer systems at the L1 context level that the ecosystem integrates with but does not own (per M-ADR 0155). Rendered `System_Ext(...)` on L1/L2 diagrams. NOT a c4_container (external systems are not inside your system) and NOT a c4_system (they have no owning Product). External systems are inherently shared references: the same external system may be declared by multiple SDDs, so the aggregator dedups identical rows by PK rather than failing on duplicate (the one narrowly-scoped exception to M-ADR 0134's duplicate-PK rule); conflicting attributes on the same id surface as a `convention` finding.
+  repositories:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+      description: canonical_repo_key.
+    - name: name
+      type: string
+      nullable: false
+    - name: domain_id
+      type: string
+      nullable: true
+      description: Owning capability domain. Populated when the repo-config declared domain resolves to a docs/domains/<slug>/ in the local SDD; left empty otherwise per M-ADR 0136.
+    - name: product_id
+      type: string
+      nullable: true
+    - name: profile
+      type: string
+      nullable: false
+      description: "DEPRECATED (removal at 4.0.0): not an SDD profile. The per-repo field reused sdd_profile's values to record only whether a mirrored repository is one of the SDD's own components or a supporting one — see repo_scope (M-ADR 0213)."
+    - name: group
+      type: string
+      nullable: true
+    - name: category
+      type: string
+      nullable: true
+    - name: tier
+      type: string
+      nullable: true
+      description: S1..S4 for support repos, else null.
+    - name: component_type
+      type: string
+      nullable: true
+    - name: files
+      type: int
+      nullable: true
+    - name: code
+      type: int
+      nullable: true
+    - name: comment
+      type: int
+      nullable: true
+    - name: blank
+      type: int
+      nullable: true
+    - name: total_lines
+      type: int
+      nullable: true
+    - name: languages
+      type: string
+      nullable: true
+      description: "';'-separated."
+    - name: doc_path
+      type: string
+      nullable: false
+    - name: source_sdd_id
+      type: string
+      nullable: true
+      description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+    - name: platform_sdd_id
+      type: string
+      nullable: true
+      description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
+    - name: repo_scope
+      type: string
+      nullable: true
+      description: "Whether the repository is inside the scope of what THIS SDD specifies, from its reverse-metadata.yaml (M-ADR 0213 §4.2): component (part of what the SDD specifies) or support (supports a component without being one). Empty for a repository with no reverse metadata. Its kind is component_type; the SDD's profile is products/applications.profile."
+    foreign_keys:
+    - column: domain_id
+      references: domains.id
+      nullable: true
+    - column: product_id
+      references: products.id
+      nullable: true
+    column_enums:
+      component_type: enums.service_type
+      repo_scope: enums.repo_scope
+  domain_models:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+      description: "{domain_id}-data-model."
+    - name: name
+      type: string
+      nullable: false
+    - name: domain_id
+      type: string
+      nullable: false
+    - name: doc_path
+      type: string
+      nullable: false
+      description: Path to data-model.mermaid.md.
+    - name: version
+      type: string
+      nullable: true
+      description: Optional explicit version; null until the domain model is formally versioned (typically at first contract lock-in).
+    - name: evidence_class
+      type: string
+      nullable: true
+      description: Evidence class of the domain model, from a leading ```yaml fence in the data-model markdown carrying `evidence-class:` (documentation-reverse anchor convention). Free-form; conventional values code-reverse | vendor-doc | operational (M-ADR 0175). Empty when undeclared. Added in schema 2.20.0.
+    - name: source_sdd_id
+      type: string
+      nullable: true
+      description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+    - name: platform_sdd_id
+      type: string
+      nullable: true
+      description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
+    - name: notation
+      type: string
+      nullable: true
+      description: "The notation the model artefact is written in — one of enums.model_notation (mermaid-erd | typeql), DERIVED by the builder from the file (data-model.mermaid.md → mermaid-erd; data-model.tql → typeql), never authored. The compliance instrument of M-ADR 0210 §4.6 Decision 2 (as amended): a mermaid-erd row is advisory until the sunset 2027-03-31 and an error after it. Added in 3.11.0."
+    description: "Per-domain ER diagram modelling the domain's aggregates, entities, and domain events. Platform-profile only — application and integration profiles emit headers-only. Forward source: `traceability.domain_model.path` in capability traceability manifests. Reverse source: file-system scan of `docs/domains/*/architecture/data-model.mermaid.md`. Added in schema 2.4.0; see M-ADR 0142."
+    foreign_keys:
+    - column: domain_id
+      references: domains.id
+      nullable: false
+    column_enums:
+      notation: enums.model_notation
+  entities:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+      description: "Slugged PK: {domain_id}-{entitySlug(name)}. For manifest-sourced rows with domain=platform-wide, the leading domain segment is empty (`-{entitySlug(name)}`) and the row carries a [finding] convention."
+    - name: name
+      type: string
+      nullable: false
+      description: Entity name as authored. Preserves the original case/style (UPPER_SNAKE_CASE, PascalCase, lowercase camelCase all observed in the wild).
+    - name: domain_id
+      type: string
+      nullable: true
+      description: Owning domain. Nullable when the source is a non-canonical domain hint such as `platform-wide`; the walker emits a finding in that case.
+    - name: source_domain_model_id
+      type: string
+      nullable: true
+      description: FK to domain_models.csv — the file the entity was extracted from. Populated by the reverse-method walker (Mermaid parse); empty when authored only via the forward-method manifest.
+    - name: persistence_kind
+      type: string
+      nullable: true
+      description: "Open string; recommended values: relational-table | document-collection | event-payload | dto | view | other. Values outside the recommended set fire `[finding] convention`."
+    - name: context
+      type: string
+      nullable: true
+      description: Bounded-context membership (per M-ADR 0170 §4.6). Free-form adopter label, orthogonal to domain_id. Not an FK. Carried for forward-parity; awaits a derivation source (Mermaid ER has no per-entity slot — populate via a sidecar classification or owning-service derivation). Added in schema 2.19.0.
+    - name: glossary_term
+      type: string
+      nullable: true
+      description: FK to glossary_items.id when the entity name resolves to a canonical glossary term (by entity-aware slug). Drives entity_glossary edge emission.
+    - name: notes
+      type: string
+      nullable: true
+      description: Free-form notes preserved from the authoring source. Carries `status=...`, `superseded_by=...`, and column count for diagnostic value.
+    - name: evidence_class
+      type: string
+      nullable: true
+      description: Evidence class inherited from the owning domain model's file-level declaration (the leading ```yaml fence's `evidence-class:` in data-model markdown). Free-form; conventional values code-reverse | vendor-doc | operational (M-ADR 0175). Empty when the source file declares none, and for manifest-sourced rows (the glossary-alignment manifest has no evidence slot). Added in schema 2.20.0.
+    - name: source_sdd_id
+      type: string
+      nullable: true
+      description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+    - name: platform_sdd_id
+      type: string
+      nullable: true
+      description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
+    description: "Data-model entity (a structural realisation of a concept inside a domain's data model). Distinct from glossary_items (vocabulary-level) and from domain_models (file-level). Added in schema 2.13.0 per M-ADR 0159. Forward source: `models[].entities[]` in glossary-alignment-manifest.yaml. Reverse source: `EntityName { ... }` declarations inside `erDiagram` fences in `docs/domains/{domain}/architecture/data-model.mermaid.md`. PK uses an entity-aware slug that normalises across UPPER_SNAKE and PascalCase authoring styles."
+    foreign_keys:
+    - column: domain_id
+      references: domains.id
+      nullable: true
+    - column: source_domain_model_id
+      references: domain_models.id
+      nullable: true
+    - column: glossary_term
+      references: glossary_items.id
+      nullable: true
+    column_enums:
+      persistence_kind: enums.persistence_kind
+  repo_capability:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+    - name: repo_id
+      type: string
+      nullable: false
+    - name: capability_id
+      type: string
+      nullable: false
+    description: "Edge: repo contributes to capability. Forward-declared via repo-config `capabilities[]` (M-ADR 0188 §6.1) or the legacy multi-purpose `additional_context[]`; reverse-derived via capability_service ⋈ services.primary_repo_id and capability_feature ⋈ feature_repo."
+    foreign_keys:
+    - column: repo_id
+      references: repositories.id
+      nullable: false
+    - column: capability_id
+      references: capabilities.id
+      nullable: false
+  repo_capability_exemption:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+    - name: repo_id
+      type: string
+      nullable: false
+    - name: reason
+      type: string
+      nullable: false
+    - name: note
+      type: string
+      nullable: false
+      description: Mandatory, non-empty. The reason code makes exemptions countable; the note makes them reviewable. A row with an empty note is dropped with a `convention` finding.
+    description: |
+      A repository's declared, reasoned statement that it bears no product capability (M-ADR 0188 §4.3). Emitted from the repo-config `capability_exemption:` block.
+      This is deliberately a catalogue row rather than an inert YAML aside. An exemption is a modelling assertion and belongs in the model: it is then queryable at the aggregate tier, reviewable in the same surface as the capabilities it stands in for, and countable — so that a reviewer watching the exemption population grow can see it happen. Never net exemptions off against orphans in a metric.
+      The invariant it participates in (M-ADR 0188 §4.1): every `repositories` row must resolve, either by carrying a `repo_capability` edge or by declaring an exemption here. A row satisfying both is a declaration conflict, reported as a `divergence` finding.
+    foreign_keys:
+    - column: repo_id
+      references: repositories.id
+      nullable: false
+    column_enums:
+      reason: enums.capability_exemption_reason
+  service_capability_exemption:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+    - name: service_id
+      type: string
+      nullable: false
+    - name: reason
+      type: string
+      nullable: false
+    - name: note
+      type: string
+      nullable: false
+      description: Mandatory, non-empty. The reason code makes exemptions countable; the note makes them reviewable. A row with an empty note is dropped with a `convention` finding.
+    description: |
+      A service's declared, reasoned statement that it bears no product capability (M-ADR 0133 §4.2b). The services-tier equivalent of `repo_capability_exemption`, one tier down: `repo_capability_exemption` exists because M-ADR 0197 gave a repository a `services:` block, so a repository resolving under M-ADR 0188 no longer implies its services do. Emitted from the repo-config `service_capability_exemption:` block, keyed to the repo's own default/primary service id — a declared, non-primary `services:` entry has no per-entry authoring surface yet (M-ADR 0197 §4.7, design-only) and cannot be exempted through this block.
+      Two reasons only (`enums.service_capability_exemption_reason`): `platform-internal` and `deprecated`. Narrower than the repository vocabulary by design — a service, by definition, already runs something, so the repository-tier packaging/tooling/provenance distinctions don't reproduce here.
+      The invariant it participates in: every catalogued `services` row must resolve, either by carrying a `capability_service` edge or by declaring an exemption here — checked by a coverage predicate whose verdict set is tier-scoped (member tier cannot assert an unclaimed service is genuinely orphaned, only that it is unresolved locally; a cross-SDD claim on the service may exist in a sibling SDD's own capability_service.csv, invisible to this SDD's own build).
+    foreign_keys:
+    - column: service_id
+      references: services.id
+      nullable: false
+    column_enums:
+      reason: enums.service_capability_exemption_reason
+  external_system_exemption:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+      description: Equals external_system_id (one assertion per candidate).
+    - name: external_system_id
+      type: string
+      nullable: false
+    - name: reason
+      type: string
+      nullable: false
+    - name: note
+      type: string
+      nullable: false
+      description: Mandatory, non-empty. The reason makes exemptions countable; the note makes them reviewable (M-ADR 0188 §4.2 pattern).
+    description: |
+      A declared, reasoned assertion that an external-system candidate is GENUINELY external (M-ADR 0189 §4.6 / WS15). Annotation catalogue (M-ADR 0133 §4.2b): one FK, declared never derived, closed reason enum. Sourced from `orchestration/external-system-exemptions.yaml`.
+      The invariant it completes: c4_external_systems was the one catalogue family with no coverage predicate — a candidate producing no adjudication outcome was silent, and that silence hid a 28% dependency -graph distortion (ledger L4). Every candidate now either resolves at adjudication, or carries an exemption here, or is reported unverified. An exemption retires only the unverified finding — never an adjudication outcome (a converted candidate's exemption is a contradiction, reported and dropped). Shared entities may be exempted by multiple SDDs: identical rows dedup at aggregation (same exception class as c4_external_systems); conflicting rows keep first-seen with a convention finding.
+    foreign_keys:
+    - column: external_system_id
+      references: c4_external_systems.id
+      nullable: false
+    column_enums:
+      reason: enums.external_system_exemption_reason
+  repo_contract:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+    - name: repo_id
+      type: string
+      nullable: false
+    - name: contract_id
+      type: string
+      nullable: false
+    description: "Edge: repo is bound to a contract — implements or consumes; the source (contributes_to.artifact_type=contract-surface) does not distinguish, so this description asserts no direction (M-ADR 0211 §1). From contributes_to.artifact_type=contract-surface. Per M-ADR 0147 service-architecture external interfaces are a contract-consumes source; contract_id is external_for_profiles app/integration because their repos reference platform-resident (or platform-held BFF) contracts — resolved at aggregation, staying internal for platform-profile."
+    foreign_keys:
+    - column: repo_id
+      references: repositories.id
+      nullable: false
+    - column: contract_id
+      references: contracts.id
+      nullable: false
+      external_for_profiles:
+      - application-product
+      - integration-product
+  product_capability:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+    - name: product_id
+      type: string
+      nullable: false
+    - name: capability_id
+      type: string
+      nullable: false
+    - name: role
+      type: string
+      nullable: false
+      description: consumes.
+    - name: notes
+      type: string
+      nullable: true
+    description: "Edge: product depends on / consumes capability. Forward sources from app-platform-dependencies.yaml. capability_id is external because the consuming product (an application-product SDD) references a capability owned by the platform SDD."
+    foreign_keys:
+    - column: product_id
+      references: products.id
+      nullable: false
+    - column: capability_id
+      references: capabilities.id
+      nullable: false
+      external: true
+    column_enums:
+      role: enums.consumption_role
+  product_service:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+    - name: product_id
+      type: string
+      nullable: false
+    - name: service_id
+      type: string
+      nullable: false
+    - name: role
+      type: string
+      nullable: false
+      description: consumes.
+    - name: required_stability
+      type: string
+      nullable: true
+      description: "provisional | locked | unknown. The consuming SDD's expectation of contract stability, carried verbatim from app-platform-dependencies.yaml. Not a bound enum: an out-of-vocabulary value is carried, not rejected, and is reported by validate-app-dependencies.sh."
+    description: "Edge: product depends on / consumes service. Forward sources from app-platform-dependencies.yaml. service_id is external because the consuming product (an application-product SDD) references a service owned by the platform SDD."
+    foreign_keys:
+    - column: product_id
+      references: products.id
+      nullable: false
+    - column: service_id
+      references: services.id
+      nullable: false
+      external: true
+    column_enums:
+      role: enums.consumption_role
+      required_stability: enums.required_stability
+  service_contract:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+      description: "{service_id}__{contract_id}__{role}."
+    - name: service_id
+      type: string
+      nullable: false
+    - name: contract_id
+      type: string
+      nullable: false
+    - name: role
+      type: string
+      nullable: false
+      description: exposes | consumes.
+    description: "Edge: service exposes or consumes contract. Both FKs are external (per M-ADR 0147): federated SDDs that walk per-repo service-architecture tables emit consumes rows where service_id resolves to the platform-root catalogue's services.csv (post-aggregation) and contract_id resolves to the platform-root contracts.csv. Internal builds (e.g. connect-mono) still optimistically validate locally. Schema 2.8.0."
+    foreign_keys:
+    - column: service_id
+      references: services.id
+      nullable: false
+      external: true
+    - column: contract_id
+      references: contracts.id
+      nullable: false
+      external: true
+    column_enums:
+      role: enums.contract_participation
+  service_event:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+      description: "{service_id}__{event_id}__{role}."
+    - name: service_id
+      type: string
+      nullable: false
+    - name: event_id
+      type: string
+      nullable: false
+    - name: role
+      type: string
+      nullable: false
+      description: publishes | consumes.
+    description: "Edge: service publishes or consumes event."
+    foreign_keys:
+    - column: service_id
+      references: services.id
+      nullable: false
+    - column: event_id
+      references: events.id
+      nullable: false
+    column_enums:
+      role: enums.event_participation
+  service_entity:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+      description: "Composite PK: {service_id}__{entity_id}__{relation}."
+    - name: service_id
+      type: string
+      nullable: false
+    - name: entity_id
+      type: string
+      nullable: false
+    - name: relation
+      type: string
+      nullable: false
+      description: "Open string; recommended values: owns | reads | writes | references. Data Store Mapping table source emits `owns`. Values outside the recommended set fire `[finding] convention`."
+    - name: evidence_path
+      type: string
+      nullable: true
+      description: Source markdown path or feature-grounding row that produced the edge. Audit aid.
+    - name: source_sdd_id
+      type: string
+      nullable: true
+      description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+    - name: platform_sdd_id
+      type: string
+      nullable: true
+      description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
+    description: "Edge: service touches data-model entity. Added in schema 2.13.0 per M-ADR 0159. Primary source: per-domain `## Data Store Mapping` markdown table in `docs/domains/{domain}/architecture/data-model.mermaid.md` (relation=owns). Optional forward source (Phase 5 deferred): `entities:` block in `orchestration/repo-config/<repo>.yaml`. Service names resolve via heuristic (slug-of-name; trailing-id-segment) with optional adopter-authored alias map at `docs/platform/reference/service-name-aliases.yaml`."
+    foreign_keys:
+    - column: service_id
+      references: services.id
+      nullable: false
+    - column: entity_id
+      references: entities.id
+      nullable: false
+    column_enums:
+      relation: enums.service_entity_relation
+  capability_feature:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+    - name: capability_id
+      type: string
+      nullable: false
+    - name: feature_id
+      type: string
+      nullable: false
+    description: "Edge: capability decomposes into features. Forward: traceability.runway.enables. Reverse: parsed from spec Feature Grounding."
+    foreign_keys:
+    - column: capability_id
+      references: capabilities.id
+      nullable: false
+    - column: feature_id
+      references: features.id
+      nullable: false
+  capability_service:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+    - name: capability_id
+      type: string
+      nullable: false
+    - name: service_id
+      type: string
+      nullable: false
+    - name: role
+      type: string
+      nullable: true
+      description: "The part the service plays in delivering THIS capability — a property of the relationship, not of the service (capability-traceability-manifest-template). Closed enum, see enums.capability_service_role. Nullable: legacy rows may carry no role; the enum validator checks values, not presence. `dependency` rows are excluded from repo_capability Path X (M-ADR 0157 §4.3 as amended). Enum bound in 3.8.0."
+    - name: contract_id
+      type: string
+      nullable: true
+      description: "The contract this dependency is against — a contracts.id declared as `contract:` on the services[] entry (M-ADR 0211 §4.1). External FK on the pattern of feature_contract: resolved at aggregation. Empty when the entry declares none; a `dependency`-role entry that reaches T4 band 5 carries it."
+    - name: interaction_pattern
+      type: string
+      nullable: true
+      description: How the capability is coupled to the service at runtime — one of enums.interaction_pattern (M-ADR 0171 vocabulary, bound), from `interaction_pattern:` on the services[] entry. EMPTY for a non-runtime coupling (build-time, load-time, packaging, sequencing), whose kind the manifest states in dependency_notes; that entry is excluded by class from T4's dependency set and does not reach band 5.
+    - name: qualifier
+      type: string
+      nullable: true
+      description: Free-text qualifier on the interaction pattern per M-ADR 0171 §4.4 (e.g. idempotent, batched, cached, proxy, an auth scheme, a protocol version) — never a new pattern token. From `qualifier:` on the services[] entry.
+    - name: evidence_ref
+      type: string
+      nullable: true
+      description: Where the coupling is evidenced — a path or anchor in the SDD, from `evidence:` on the services[] entry. Prose about the coupling stays in dependency_notes; this is the pointer a reviewer follows.
+    description: |
+      Edge: capability is realised by services. Sourced from the capability traceability manifest services[] block. service_id is an external FK (schema 2.29.0, F4): a traceability entry marked `owner_sdd:` declares a cross-SDD reference (e.g. the service moved to a sibling SDD at an M-ADR 0170 §4.2 carve) — the per-SDD builder emits the edge, logs it `[finding] external`, and aggregation validates it hard against the owning sibling's rows. An UNMARKED id that does not resolve locally is NOT emitted — it stays a member-tier orphan finding (or convention, when it names a known external system).
+    foreign_keys:
+    - column: capability_id
+      references: capabilities.id
+      nullable: false
+    - column: service_id
+      references: services.id
+      nullable: false
+      external: true
+    - column: contract_id
+      references: contracts.id
+      nullable: true
+      external: true
+    column_enums:
+      role: enums.capability_service_role
+      interaction_pattern: enums.interaction_pattern
+  capability_event:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+    - name: capability_id
+      type: string
+      nullable: false
+    - name: event_id
+      type: string
+      nullable: false
+    - name: role
+      type: string
+      nullable: false
+      description: publishes | consumes.
+    - name: source
+      type: string
+      nullable: false
+      description: authored | derived. `authored` rows come from a traceability declaration (shape A or shape B); `derived` rows come from `capability_service ⋈ service_event` and represent associative coupling, not ownership. Schema 2.14.0 per M-ADR 0160.
+    description: "Edge: capability publishes or consumes event. Schema 2.14.0 (per M-ADR 0160) multi-source ingestion: (1) forward shape A — `traceability.events[{id, role}]` (legacy aspirational shape, unauthored across observed adopters); (2) forward shape B — `traceability.contracts.published_events[]` / `consumed_events[]` with `{event, status, notes}` (the observed forward-method shape; event name slug-resolves against events.csv); (3) derived — `capability_service ⋈ service_event` join (zero authoring; associative not authoritative). Authored rows win on PK conflict with derived. The `source` column distinguishes the two so governance queries can filter to authoritative ownership. The earlier `## Related Events` capability-spec heading is retired (no adopter authored it; the template never carried the section)."
+    foreign_keys:
+    - column: capability_id
+      references: capabilities.id
+      nullable: false
+    - column: event_id
+      references: events.id
+      nullable: false
+    column_enums:
+      role: enums.event_participation
+      source: enums.edge_source
+  capability_contract:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+    - name: capability_id
+      type: string
+      nullable: false
+    - name: contract_id
+      type: string
+      nullable: false
+    - name: source
+      type: string
+      nullable: false
+      description: "declared — the only emitted value. `derived` is reserved vocabulary: the reverse derivation it anticipated was never built (0 rows across 105 measured units) and the claim was corrected at 3.0.0 (M-ADR 0203 §4.5 / F2); the value re-enters if a decision builds a reverse source."
+    description: "Edge: capability is bound to a contract. Whether the capability exposes or depends on it is not stated by the source (traceability.contracts), so this description asserts no direction (M-ADR 0211 §1). Forward-declared only. Forward-declared only (traceability.contracts). The reverse derivation this description long claimed (service_contract ⋈ capability_service) was measured nonexistent — 0 `source: derived` rows across 105 units, builder references neither catalogue — and the CLAIM was corrected at 3.0.0 (M-ADR 0203 §4.5 / F2, gap class absent-derivation per M-ADR 0196 §4.1). The edge is forward-one-directional until a decision builds a reverse source."
+    foreign_keys:
+    - column: capability_id
+      references: capabilities.id
+      nullable: false
+    - column: contract_id
+      references: contracts.id
+      nullable: false
+  journey_feature:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+    - name: journey_id
+      type: string
+      nullable: false
+    - name: feature_id
+      type: string
+      nullable: false
+    description: "Edge: journey touches features. Parsed from Related features bullet."
+    foreign_keys:
+    - column: journey_id
+      references: user_journeys.id
+      nullable: false
+    - column: feature_id
+      references: features.id
+      nullable: false
+  persona_feature:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+    - name: persona_id
+      type: string
+      nullable: false
+    - name: feature_id
+      type: string
+      nullable: false
+    description: "Edge: persona uses features. Parsed from Related features bullet."
+    foreign_keys:
+    - column: persona_id
+      references: personas.id
+      nullable: false
+    - column: feature_id
+      references: features.id
+      nullable: false
+  feature_service:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+    - name: feature_id
+      type: string
+      nullable: false
+    - name: service_id
+      type: string
+      nullable: false
+    description: "Edge: feature is implemented by service. Parsed from Feature Services table in feature-tree.md."
+    foreign_keys:
+    - column: feature_id
+      references: features.id
+      nullable: false
+    - column: service_id
+      references: services.id
+      nullable: false
+  feature_event:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+    - name: feature_id
+      type: string
+      nullable: false
+    - name: event_id
+      type: string
+      nullable: false
+    - name: role
+      type: string
+      nullable: false
+      description: publishes | consumes — mirrors the role on the source service_event row.
+    - name: source
+      type: string
+      nullable: false
+      description: Always `derived` (schema 2.15.0). The column is retained for symmetry with `capability_event.source` and to keep the door open for an authored shape if one surfaces; today every row is derived.
+    description: "Edge: feature publishes or consumes event. Derived only — emitted from the `feature_service ⋈ service_event` join, mirroring M-ADR 0160's capability_event derived path one rung lower in the capability/feature/service hierarchy. Every row carries `source=derived`; there is no authored shape (the authored signal lives at the service level via `service_event`, which the feature inherits through `feature_service`). PK is `{feature_id}__{event_id}__{role}` so the same feature can carry both publishes + consumes rows for the same event without collision. Schema 2.15.0 per M-ADR 0161."
+    foreign_keys:
+    - column: feature_id
+      references: features.id
+      nullable: false
+    - column: event_id
+      references: events.id
+      nullable: false
+    column_enums:
+      role: enums.event_participation
+  feature_repo:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+    - name: feature_id
+      type: string
+      nullable: false
+    - name: repo_id
+      type: string
+      nullable: false
+    description: "Edge: feature is implemented in repo. From contributes_to.artifact_type=feature-set."
+    foreign_keys:
+    - column: feature_id
+      references: features.id
+      nullable: false
+    - column: repo_id
+      references: repositories.id
+      nullable: false
+  feature_contract:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+      description: "{feature_id}__{contract_id}."
+    - name: feature_id
+      type: string
+      nullable: false
+    - name: contract_id
+      type: string
+      nullable: false
+    - name: derivation_path
+      type: string
+      nullable: true
+      description: cap-feature-cap-contract | feature-service-service-contract. Diagnostic only — records which join path produced the row.
+    description: "Edge: feature is exposed via contract. Derived — forward: capability_feature ⋈ capability_contract (on capability_id); reverse: feature_service ⋈ service_contract (on service_id). Both join paths are run and merged; duplicate (feature_id, contract_id) pairs are deduplicated. contract_id is external for app/integration profiles where contracts live in the platform SDD. Added in schema 2.3.0."
+    foreign_keys:
+    - column: feature_id
+      references: features.id
+      nullable: false
+    - column: contract_id
+      references: contracts.id
+      nullable: false
+      external: true
+    column_enums:
+      derivation_path: enums.feature_contract_derivation_path
+  feature_subscription_channels:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+      description: "{feature_id}__{channel_name}."
+    - name: feature_id
+      type: string
+      nullable: false
+    - name: channel_name
+      type: string
+      nullable: false
+      description: Channel identifier (kebab-case slug, namespaced as the source evidence carries it — e.g. `customer.<customerId>.tracking-points` for AppSync subscription channels).
+    - name: transport
+      type: string
+      nullable: false
+      description: "Delivery protocol: `appsync-websocket | pekko-ws | mqtt | sse | webhook-push | other`. The `other` value is escape-valve; adopters using it SHOULD record the actual transport in evidence."
+    - name: evidence
+      type: string
+      nullable: true
+      description: Evidence-file citation (`<sub-repo>/<path>:<line>`) anchoring the channel declaration. Mirrors the citation pattern used elsewhere in evidence yamls.
+    - name: payload_ref
+      type: string
+      nullable: true
+      description: Optional reference to a payload-contract event (`{event-name}` in the `events` catalogue) when the channel carries a contract-shaped payload. Empty when the payload is channel-private.
+    - name: source_sdd_id
+      type: string
+      nullable: true
+      description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+    - name: platform_sdd_id
+      type: string
+      nullable: true
+      description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
+    description: "Edge: feature delivers async push via a named channel/topic. Peer of `graphql_operations:` in the per-feature evidence shape — `graphql_operations:` carries the GraphQL operation names declared in the schema (Queries / Mutations / Subscriptions); `feature_subscription_channels` rows carry the channel/topic layer that physically delivers the push events (AppSync WebSocket endpoints, Pekko WS channels, MQTT topics, server-sent-event streams). Per resolved decision §1 of `content/plans/v0-9-0-cohort-sweep-derived-bundle.md`: a single GraphQL Subscription operation may listen on multiple channels; one channel may be consumed by multiple operations — modelling as a separate edge catalogue (not as a feature column) accommodates the many-to-many. Built per-SDD from `reverse-evidence/feature-grounding-evidence.yaml` `subscription_channels:` entries on each feature. Added in schema 2.9.0."
+    foreign_keys:
+    - column: feature_id
+      references: features.id
+      nullable: false
+    column_enums:
+      transport: enums.subscription_channel_transport
+  capability_domain_model:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+      description: "{capability_id}__{domain_model_id}."
+    - name: capability_id
+      type: string
+      nullable: false
+    - name: domain_model_id
+      type: string
+      nullable: false
+    - name: source
+      type: string
+      nullable: false
+      description: traceability-manifest | inferred.
+    description: "Edge: capability references a domain model. Forward: declared in `traceability.domain_model` field of the capability traceability manifest. Reverse: inferred via capability → domain → domain_model. Platform-profile only. Added in schema 2.4.0; see M-ADR 0142."
+    foreign_keys:
+    - column: capability_id
+      references: capabilities.id
+      nullable: false
+    - column: domain_model_id
+      references: domain_models.id
+      nullable: false
+    column_enums:
+      source: enums.capability_domain_model_source
+  feature_domain_model:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+      description: "{feature_id}__{domain_model_id}."
+    - name: feature_id
+      type: string
+      nullable: false
+    - name: domain_model_id
+      type: string
+      nullable: false
+    - name: derivation_path
+      type: string
+      nullable: true
+      description: cap-feature-cap-domain-model. Diagnostic only.
+    description: "Edge: feature operates on a domain model. Derived from capability_feature ⋈ capability_domain_model (on capability_id). Platform-profile only. Orphan features (no capability link) get no row. Added in schema 2.4.0; see M-ADR 0142."
+    foreign_keys:
+    - column: feature_id
+      references: features.id
+      nullable: false
+    - column: domain_model_id
+      references: domain_models.id
+      nullable: false
+  persona_journey:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+    - name: persona_id
+      type: string
+      nullable: false
+    - name: journey_id
+      type: string
+      nullable: false
+    - name: role
+      type: string
+      nullable: false
+      description: primary | handoff | supporting.
+    description: "Edge: persona participates in journey. Roles: primary | handoff | supporting."
+    foreign_keys:
+    - column: persona_id
+      references: personas.id
+      nullable: false
+    - column: journey_id
+      references: user_journeys.id
+      nullable: false
+    column_enums:
+      role: enums.journey_participation
+  persona_c4system:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+      description: "{persona_id}__{c4_system_id}."
+    - name: persona_id
+      type: string
+      nullable: false
+    - name: c4_system_id
+      type: string
+      nullable: false
+    - name: interaction
+      type: string
+      nullable: true
+      description: Optional interaction label from the Rel(...) line, e.g. 'Web browser' / 'Mobile app'.
+    description: "Edge: persona (C4 Person) uses a C4 system. Captures the L1 context 'Person uses System' relationship, extracted from Person(...) macros on the L1 context diagram and matched to personas rows. Per M-ADR 0155. Added in schema 2.10.0."
+    foreign_keys:
+    - column: persona_id
+      references: personas.id
+      nullable: false
+    - column: c4_system_id
+      references: c4_systems.id
+      nullable: false
+  persona_container:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+      description: "{persona_id}__{container_id}."
+    - name: persona_id
+      type: string
+      nullable: false
+    - name: container_id
+      type: string
+      nullable: false
+    - name: interaction
+      type: string
+      nullable: true
+      description: Optional interaction label from the Rel(...) line. May hold multiple '; '-joined labels (F25).
+    description: |
+      Edge: a persona uses a C4 container — the L2-granularity companion to persona_c4system (M-ADR 0189 F26 §3, ratified 2026-07-10). Eleven of one estate's L2 diagrams and the bulk of another's 81 unroutable Rels drew Person→Container relationships that had no catalogue and, until F26, no finding. Harvested at member tier from Rel(...) lines whose endpoints resolve to a file-local Person and a local container (either direction; the row is normalised persona→container). A Person that matches no persona row is a coverage finding, never a silent skip. Both authoring directions feed from the same diagram surface (M-ADR 0157 parity). Added in schema 2.34.0.
+    foreign_keys:
+    - column: persona_id
+      references: personas.id
+      nullable: false
+    - column: container_id
+      references: c4_containers.id
+      nullable: false
+  system_external_dependency:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+      description: "{c4_system_id}__{external_system_id}."
+    - name: c4_system_id
+      type: string
+      nullable: false
+    - name: external_system_id
+      type: string
+      nullable: false
+    - name: interaction
+      type: string
+      nullable: true
+      description: Optional integration label/protocol from the Rel(...) line. May hold multiple '; '-joined labels when one pair is declared with distinct labels (F25, 2.33.2).
+    - name: from_container_id
+      type: string
+      nullable: true
+      description: The Rel's non-external endpoint resolved to a local container at member tier, when it is one (F17, 2.33.0) — the datum that lets adjudication rewrite this edge onto container_dependency instead of destroying it. Empty when the endpoint is the system itself or unresolvable.
+    description: "Edge: a C4 system integrates with an external software system. Captures the L1 context 'System integrates with External System' relationship, extracted from System_Ext(...) + Rel(...) on L1/L2 diagrams. Per M-ADR 0155. Container-level external dependencies are out of scope (system-level only). Added in schema 2.10.0. From 2.30.0 (M-ADR 0189 §4.4): edges whose external endpoint the aggregator adjudicates as an INTERNAL system are rewritten onto system_system_dependency and removed from this catalogue."
+    foreign_keys:
+    - column: c4_system_id
+      references: c4_systems.id
+      nullable: false
+    - column: external_system_id
+      references: c4_external_systems.id
+      nullable: false
+    - column: from_container_id
+      references: c4_containers.id
+      nullable: true
+  container_dependency:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+      description: "{from_container_id}__{to_container_id}."
+    - name: from_container_id
+      type: string
+      nullable: false
+    - name: to_container_id
+      type: string
+      nullable: false
+    - name: interaction
+      type: string
+      nullable: true
+      description: Label carried over from the originating Rel(...) line.
+    - name: source_sdd_id
+      type: string
+      nullable: true
+      description: SDD whose diagram declared the originating reference. Member-emitted rows set it directly (F19); adjudication-derived rows are stamped by the aggregator.
+    - name: platform_sdd_id
+      type: string
+      nullable: true
+      description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
+    description: |
+      Edge: a C4 container depends on another INTERNAL container (adopter finding F17 — F6 exactly one tier down: "no edge for internal" at L2). Derived by the aggregator at adjudication: an external-system candidate that resolves to an internal container was never external — each of its dependency edges whose member-resolved `from_container_id` is known is rewritten here, and a candidate with no remaining edges is dropped (it was a phantom duplicate of the container). A candidate with unconvertible edges is kept with the tier-contradiction finding, so no edge is ever destroyed to make a build quieter — the measured cost that stopped an adopter remediating 22 contradictions was eight real edges. ALSO emitted at member tier (F19, 2.33.1): the C4-correct authoring — Rel(container_a, container_b) between two Container(...) nodes — emits its edge directly; adjudication merges into a catalogue that already has content rather than being its only source, so the metamodel no longer rewards mis-declaration over correct authoring. Added in schema 2.33.0.
+    foreign_keys:
+    - column: from_container_id
+      references: c4_containers.id
+      nullable: false
+    - column: to_container_id
+      references: c4_containers.id
+      nullable: false
+  system_system_dependency:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+      description: "{from_system_id}__{to_system_id}."
+    - name: from_system_id
+      type: string
+      nullable: false
+    - name: to_system_id
+      type: string
+      nullable: false
+    - name: interaction
+      type: string
+      nullable: true
+      description: Optional label/protocol carried over from the originating Rel(...) line.
+    - name: source_sdd_id
+      type: string
+      nullable: true
+      description: SDD whose diagram declared the originating reference. Populated by the aggregator.
+    - name: platform_sdd_id
+      type: string
+      nullable: true
+      description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
+    description: |
+      Edge: a C4 system depends on another INTERNAL system (M-ADR 0189 §4.3). Derived by the aggregator at adjudication (§4.4): an external-system candidate whose declared identity resolves to an internal system was never external — its Rel(...) dependency edges are rewritten onto this catalogue and the candidate row is dropped. Not emitted at member tier (a member cannot see sibling systems); headers-only there, like cross_sdd_platform_capability. Both authoring directions feed it from the same diagram surface (M-ADR 0157 parity). Added in schema 2.30.0.
+    foreign_keys:
+    - column: from_system_id
+      references: c4_systems.id
+      nullable: false
+    - column: to_system_id
+      references: c4_systems.id
+      nullable: false
+  c4_container_entity:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+      description: "Composite PK: {container_id}__{entity_id}."
+    - name: container_id
+      type: string
+      nullable: false
+    - name: entity_id
+      type: string
+      nullable: false
+    - name: relation
+      type: string
+      nullable: false
+      description: Inherits from upstream service_entity.relation when derived.
+    - name: source_sdd_id
+      type: string
+      nullable: true
+    - name: platform_sdd_id
+      type: string
+      nullable: true
+      description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
+    description: "Derived edge: C4 container is responsible for data-model entity. Added in schema 2.13.0 per M-ADR 0159 §4.8. Pure transitive derivation: `service_entity ⋈ c4_containers.service_id`. Only the subset of containers with `service_id` populated contribute edges (per M-ADR 0155 the container ↔ service cardinality is o-or-1; data-store containers and infra-umbrella containers without a service mapping legitimately emit no rows)."
+    foreign_keys:
+    - column: container_id
+      references: c4_containers.id
+      nullable: false
+    - column: entity_id
+      references: entities.id
+      nullable: false
+  c4_system_entity:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+      description: "Composite PK: {system_id}__{entity_id}."
+    - name: system_id
+      type: string
+      nullable: false
+    - name: entity_id
+      type: string
+      nullable: false
+    - name: container_count
+      type: integer
+      nullable: false
+      description: Number of the system's containers that touch this entity. Aggregated from c4_container_entity.
+    - name: source_sdd_id
+      type: string
+      nullable: true
+    - name: platform_sdd_id
+      type: string
+      nullable: true
+      description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
+    description: "Derived edge: C4 system is responsible for data-model entity. Added in schema 2.13.0 per M-ADR 0159 §4.8. Pure aggregation roll-up: `c4_container_entity ⋈ c4_containers.system_id`, with container_count recording how many of the system's containers touch the entity (governance signal for cross-container concerns)."
+    foreign_keys:
+    - column: system_id
+      references: c4_systems.id
+      nullable: false
+    - column: entity_id
+      references: entities.id
+      nullable: false
+  capability_adr:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+    - name: capability_id
+      type: string
+      nullable: false
+    - name: adr_id
+      type: string
+      nullable: false
+    - name: confidence
+      type: string
+      nullable: false
+      description: spec | high | medium.
+    description: "Edge: ADR informs capability. Forward: declared in capability spec Architecture Decisions. Reverse: same plus heuristic match supplements with confidence."
+    foreign_keys:
+    - column: capability_id
+      references: capabilities.id
+      nullable: false
+    - column: adr_id
+      references: adrs.id
+      nullable: false
+    column_enums:
+      confidence: enums.capability_adr_confidence
+  adr_supersedes:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+    - name: superseding_adr_id
+      type: string
+      nullable: false
+    - name: superseded_adr_id
+      type: string
+      nullable: false
+    description: "Edge: superseding ADR → superseded ADR. Parsed from Supersedes bullets where prose references a known ADR id."
+    foreign_keys:
+    - column: superseding_adr_id
+      references: adrs.id
+      nullable: false
+    - column: superseded_adr_id
+      references: adrs.id
+      nullable: false
+  product_platform_dependencies:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+      description: "{product_id}__{target_capability_id}__{target_service_id}, EXCEPT for async shared-stream rows (M-ADR 0192) where there is no realiser service: the third component falls back to the stream contract_path, i.e. {product_id}__{target_capability_id}__{contract_path}. For OFF-PLATFORM rows (M-ADR 0204, target_locus external|legacy) there is no platform capability either: id = {product_id}__{target_locus}__{target_external_system_id}, falling back to contract_path as the third component when no external-system id is named. This keeps the PK stable and collision-free when a product depends on the same capability via two distinct streams."
+    - name: product_id
+      type: string
+      nullable: false
+      description: Consuming product (this SDD's product id).
+    - name: target_capability_id
+      type: string
+      nullable: true
+      description: "Capability the consuming product depends on. Resolves at aggregation against a sibling SDD's capabilities.id; external by definition. Conditionally nullable (M-ADR 0204 §4.3): EMPTY when target_locus is external|legacy — there is no platform capability to name on an off-platform row, and demanding a value is what put a product's own feature slug in this column. A platform-locus row still requires it."
+    - name: target_locus
+      type: string
+      nullable: true
+      description: platform | external | legacy (M-ADR 0204; closed enum, absent/empty = platform). A statement about the TARGET only — never about the consuming product, and never a stability, lifecycle or quality claim. platform rows behave exactly as before this column existed. external/legacy rows carry empty target_capability_id and target_service_id and name their target in target_external_system_id; they skip platform resolution and the F18 realiser-join, with every skip named.
+    - name: target_external_system_id
+      type: string
+      nullable: true
+      description: "For target_locus external|legacy rows only: the M-ADR 0189 external-system entry id the dependency targets (authored in the source file's service_id slot; the builder routes it here so the FK columns stay clean). Deliberately NOT a declared FK: corroboration against c4_external_systems is WARNING-severity at aggregation (M-ADR 0204 §4.2), because the C4 surface may legitimately lag discovery, and a declared FK can only fail."
+    - name: target_service_id
+      type: string
+      nullable: true
+      description: "Service identifier the consuming product depends on. Resolves at aggregation against a sibling SDD's services.id; external by definition. The join key the aggregator uses to derive cross_sdd_platform_capability for SYNCHRONOUS dependencies. Conditionally nullable (M-ADR 0192): for an async shared-stream dependency (contract_type in the async set — `event`/`event-stream`/`stream`) there is no single realiser service, so this is empty and the dependency binds to the stream contract_path + target_capability_id instead. A synchronous contract_type still requires it. Made nullable in schema 2.36.0."
+    - name: target_domain
+      type: string
+      nullable: true
+      description: Domain hint as declared in the consuming SDD's evidence (free-form; reviewer-facing annotation). May be a comma-separated list when the target spans multiple domains.
+    - name: contract_type
+      type: string
+      nullable: true
+      description: rest | graphql | openapi | grpc | event | event-stream | stream | other. Optional; reflects what the consuming SDD declares. The async set (`event`/`event-stream`/`stream`) marks a shared-stream subscription that binds to a stream contract rather than a realiser service (M-ADR 0192) — such rows skip the F18 synchronous realiser-join at aggregation.
+    - name: required_stability
+      type: string
+      nullable: true
+      description: "provisional | locked | unknown. Optional; the consuming SDD's expectation of contract stability — and only that: where the target lives and what lifecycle its implementation is in are separate concerns that do not belong in this field. Not a bound enum: an out-of-vocabulary value is carried, not rejected, and is reported by validate-app-dependencies.sh."
+    - name: contract_path
+      type: string
+      nullable: true
+      description: Path to the contract file the dependency is against, as declared in the consuming SDD's evidence. External — resolution happens at aggregation if it happens at all.
+    - name: consumed_by_services
+      type: string
+      nullable: true
+      description: Comma-separated list of service names within the consuming product that consume the dependency. Free-text; not FK-validated (services are within-product and resolution is owner-side concern).
+    - name: source_sdd_id
+      type: string
+      nullable: true
+      description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+    - name: platform_sdd_id
+      type: string
+      nullable: true
+      description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
+    description: |
+      Per-SDD edge: an application-side or integration-side SDD declares that its product depends on a platform-side capability + service pair. Built from `reverse-evidence/feature-grounding-evidence.yaml` `platform_dependencies:` block (product-level — the cohort source shape carries product-scoped dependency rows with a `consumed_by:` list naming which services within the consuming product depend on the target). Each row records one (consuming product, target capability, target service) triple. The aggregator then joins these rows against platform-side `capability_service` to emit `cross_sdd_platform_capability` edges at aggregation time. Cross- SDD references (target_capability_id, target_service_id) are external — they're not expected to resolve in the per-SDD build, only at aggregation. Added in schema 2.9.0; see `content/plans/v0-9-0-cohort-sweep-derived-bundle.md` §"Cross-SDD platform-capability-edge".
+    foreign_keys:
+    - column: product_id
+      references: products.id
+      nullable: false
+    - column: target_capability_id
+      references: capabilities.id
+      nullable: true
+      external: true
+    - column: target_service_id
+      references: services.id
+      nullable: true
+      external: true
+    column_enums:
+      required_stability: enums.required_stability
+      target_locus: enums.target_locus
+      contract_type: enums.dependency_contract_type
+  cross_sdd_platform_capability:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+      description: "{consuming_sdd_id}__{consuming_product_id}__{platform_sdd_id}__{platform_capability_id}__{service_id}. Composite encoding so the same (consuming product, platform capability) pair can appear once per resolving service when a product depends on multiple services owned by the same capability."
+    - name: consuming_sdd_id
+      type: string
+      nullable: false
+      description: SDD slug of the consuming side (application-product or integration-product SDD).
+    - name: consuming_product_id
+      type: string
+      nullable: false
+      description: Product in the consuming SDD that declares the platform_dependencies entry.
+    - name: platform_sdd_id
+      type: string
+      nullable: false
+      description: SDD slug of the platform side that owns the resolved capability.
+    - name: platform_capability_id
+      type: string
+      nullable: false
+      description: Capability in the platform SDD whose capability_service includes the resolved service.
+    - name: service_id
+      type: string
+      nullable: false
+      description: Service identifier the consuming SDD references and the platform SDD owns. The join key.
+    description: |
+      Federated edge: an application-side or integration-side SDD's `product_platform_dependencies` reference resolves against a platform-side SDD's capability spec via the platform capability's `capability_service` roster. Surfaces ecosystem-wide platform- consumer relationships at product → capability granularity. Built **only at aggregation time** — `sdd-cli catalogue aggregate` joins each consuming SDD's `product_platform_dependencies` rows against every other SDD's `capability_service` rows on `target_service_id == service_id`, emitting one row per resolved (consuming-product, platform-capability) pair. Per-SDD builders emit nothing for this catalogue; the aggregator owns it entirely. A platform-dependency whose target_service_id doesn't resolve to any platform-side capability_service row is logged as an `orphan` finding and produces no row. Cross-SDD references are external by definition. Added in schema 2.9.0; see `content/plans/v0-9-0-cohort-sweep-derived-bundle.md` §"Cross-SDD platform-capability-edge" and M-ADR 0134.
+    foreign_keys:
+    - column: consuming_product_id
+      references: products.id
+      nullable: false
+      external: true
+    - column: platform_capability_id
+      references: capabilities.id
+      nullable: false
+      external: true
+    - column: service_id
+      references: services.id
+      nullable: false
+      external: true
+  application_data_plane_bindings:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+      description: "{product_id}__{pattern}__{locality}__{target} (empty components collapse to blanks). A duplicate emits a divergence finding and is dropped. `direction` is NOT a component — it is derived from `pattern`, so it adds nothing to identity."
+    - name: product_id
+      type: string
+      nullable: false
+      description: The application-product declaring this binding (this SDD's product id).
+    - name: pattern
+      type: string
+      nullable: false
+      description: "Closed method-tier enum: retrieve | own-store | stream-ingest | project (inbound, data-sourcing) | generate | publish (output-side, per M-ADR 0193 §4.7). How the data relates to the service (§4.1)."
+    - name: direction
+      type: string
+      nullable: false
+      description: "inbound | output. DERIVED from `pattern` by a single method-tier mapping — not authored, and not a manifest field, so it cannot disagree with `pattern`. Materialises the output-side sub-set §4.7 declares (generate/publish => output; everything else => inbound). Exists because three §4.7 rules branch on direction: platform-dep reconciliation is inbound-only, the archetype WARN must compare like with like, and the M-ADR 0187 convergence reasoning differs by direction. Added in 2.40.0."
+    - name: locality
+      type: string
+      nullable: true
+      description: "Closed enum: internal-platform | internal-domain | external-vendor. Where the other end sits. REQUIRED on the inbound data-sourcing patterns (retrieve/stream-ingest/project); may be empty for own-store (a self-binding with no other end) and for the output-side patterns (generate/publish), which may carry one but do not require it (M-ADR 0193 §4.7)."
+    - name: transport
+      type: string
+      nullable: true
+      description: Open string — the wire (rest | graphql | grpc | appsync | kinesis | kafka | eventhub | cdc | ...). Values outside the recommended set emit a convention finding.
+    - name: runtime
+      type: string
+      nullable: true
+      description: Free adopter-tier field — backend-compute runtime (e.g. java | node). Only on compute-bearing patterns (stream-ingest | project | generate — `generate` is compute-bearing per M-ADR 0193 §4.7); empty otherwise. A runtime on retrieve/own-store/publish is malformed and FAILs at manifest load.
+    - name: target
+      type: string
+      nullable: true
+      description: Free adopter-tier field — the specific counterpart (a platform service id, an upstream domain service, a named vendor). Instance identity; keeps locality a small class enum.
+    - name: notes
+      type: string
+      nullable: true
+      description: Optional free-text annotation.
+    - name: source_sdd_id
+      type: string
+      nullable: true
+      description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+    - name: platform_sdd_id
+      type: string
+      nullable: true
+      description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
+    description: |
+      Application-product edge (M-ADR 0193): one row per declared data-plane binding — a typed way the service sources, holds, produces or exposes data. The data-plane is a COMPOSITION of these bindings, a second axis orthogonal to `application_archetype` (0191). Built per-SDD from the manifest's `data_plane.bindings` block (application-product only; other profiles emit headers-only). The `pattern` vocabulary splits by DIRECTION (§4.7): an INBOUND data-sourcing sub-set (retrieve | own-store | stream-ingest | project) and an OUTPUT-side sub-set (generate | publish), materialised as the derived `direction` column. An INBOUND binding whose `target` is a platform capability/service reconciles with `product_platform_dependencies` — a `retrieve@internal` binding is a synchronous platform dependency and a `stream-ingest@internal` binding is the M-ADR 0192 `contract_type: event` async dependency; the genuinely new inbound rows are `own-store` (a self-binding) and any `external-vendor` binding. OUTPUT-side rows do NOT participate in that reconciliation (§4.7 rule 1): `publish` is a contract the service PROVIDES, not one it consumes, so it has no inbound counterpart to cross-check — consumers must filter on `direction` before reconciling, which is what the column is for. The archetype-default-vs-declared WARN keys on the bare `pattern` token and so spans both directions (§4.7 rule 2). Added in schema 2.37.0; `direction` added in 2.40.0.
+    foreign_keys:
+    - column: product_id
+      references: products.id
+      nullable: false
+    column_enums:
+      pattern: enums.data_plane_pattern
+      direction: enums.data_plane_direction
+      locality: enums.data_plane_locality
+  application_data_plane_deviations:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+      description: "{product_id}__{expectation}. A duplicate emits a divergence finding and is dropped."
+    - name: product_id
+      type: string
+      nullable: false
+      description: The application-product declaring this deviation (this SDD's product id).
+    - name: expectation
+      type: string
+      nullable: false
+      description: The bare data-plane pattern token the product diverges from (retrieve | own-store | stream-ingest | project | generate | publish). Must match the WARN's pattern key. Spans both directions per M-ADR 0193 §4.7 rule 2.
+    - name: rationale
+      type: string
+      nullable: false
+      description: Why the deviation is correct. Non-empty (enforced at manifest load).
+    - name: source_sdd_id
+      type: string
+      nullable: true
+      description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+    - name: platform_sdd_id
+      type: string
+      nullable: true
+      description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
+    description: |
+      Application-product annotation (M-ADR 0191 §4.3 overlay): one row per declared departure from the archetype's default data-plane composition. Built per-SDD from the manifest's `data_plane.deviations` block so the overlay WARN — which runs at AGGREGATION tier, where the reference- architecture bundle (and its `expected_bindings`) resolves — can suppress a mismatch it is told is sanctioned variance. The `expectation` value is the **bare pattern token** (`retrieve` | `own-store` | `stream-ingest` | `project` | `generate` | `publish`) that the product knowingly diverges from; it must match the pattern the WARN keys on. The token set spans both directions — the WARN keys on the bare pattern, so an output-side expectation is deviated exactly like an inbound one (M-ADR 0193 §4.7 rule 2). Added in schema 2.38.0; output-side tokens documented in 2.40.0.
+    foreign_keys:
+    - column: product_id
+      references: products.id
+      nullable: false
+    column_enums:
+      expectation: enums.data_plane_pattern
+  application_conformance_coverage:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+      description: "{product_id}__{tag}. A duplicate emits a divergence finding and is dropped."
+    - name: product_id
+      type: string
+      nullable: false
+      description: The application-product declaring this coverage (this SDD's product id).
+    - name: tag
+      type: string
+      nullable: false
+      description: The conformance-expectation tag (opaque; matches an archetype's `conformance` tag in the reference-architecture vocabulary).
+    - name: status
+      type: string
+      nullable: false
+      description: covered (the product's suite exercises it) | deviated (deliberately not covered, with a rationale).
+    - name: rationale
+      type: string
+      nullable: true
+      description: Why the tag is deviated. Present (non-empty) only when status=deviated.
+    - name: source_sdd_id
+      type: string
+      nullable: true
+      description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+    - name: platform_sdd_id
+      type: string
+      nullable: true
+      description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
+    description: |
+      Application-product annotation (M-ADR 0191 §4.3 overlay, second element — WS4): one row per conformance tag the product asserts about its archetype's conformance expectations. Built per-SDD from the manifest's `conformance` block so the AGGREGATION-tier conformance GATE can read it. `status=covered` means the product's own conformance suite exercises the tag; `status=deviated` means the product declares (with a rationale) that it deliberately does not. At aggregation, an archetype-expected conformance tag that is neither covered nor deviated raises a deviation-visible WARN. The method gates the DECLARATION — it does not run the adopter's conformance suite. Added in schema 2.39.0.
+    foreign_keys:
+    - column: product_id
+      references: products.id
+      nullable: false
+  screens:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+      description: "Slugged PK: {product_id}-{screen-slug}."
+    - name: name
+      type: string
+      nullable: false
+      description: Screen slug / display name.
+    - name: product_id
+      type: string
+      nullable: false
+      description: Owning application-product.
+    - name: route
+      type: string
+      nullable: true
+      description: Route path the screen is mounted at, when applicable.
+    - name: status
+      type: string
+      nullable: true
+      description: Maturity marker; uses the standard working | provisional | unknown | absent vocabulary (per M-ADR 0165) where applicable.
+    - name: source
+      type: string
+      nullable: false
+      description: screen-spec (forward) | screen-extraction (reverse).
+    - name: domain
+      type: string
+      nullable: true
+      description: Authored owning-domain hint from frontmatter `domain:` (a docs/domains/<domain>/ slug). Organisational grouping for multi-domain (platform-profile) SDDs; the authoritative screen->domain relationship is still derived via realises -> feature -> capability.domain_id (screen_feature). Empty when unauthored.
+    - name: group
+      type: string
+      nullable: true
+      description: Authored sub-grouping hint from frontmatter `group:` — a finer organisational axis within (or orthogonal to) domain, e.g. shell | shell-embed | identity. Free-form adopter label; not an FK. Empty when unauthored.
+    - name: context
+      type: string
+      nullable: true
+      description: Bounded-context membership from frontmatter `context:` (per M-ADR 0170 §4.6). Free-form adopter label, orthogonal to domain/group — the consumed bounded context for a surface that spans several. Not an FK. Empty when unauthored. Added in schema 2.19.0.
+    - name: evidence_class
+      type: string
+      nullable: true
+      description: "Evidence class of the screen's claims, from frontmatter `evidence_class:` (alias `evidence-class:`). Free-form; conventional values code-reverse | vendor-doc | operational (M-ADR 0175). Empty when undeclared. Completes the evidence-class dimension for the packaged-SaaS case: a packaged-SaaS SDD catalogues the vendor's STANDARD screens (documentation-reversed from vendor publications, `vendor-doc`) alongside the organisation's CUSTOMISED screens (code-reversed, `code-reverse`) per M-ADR 0175 §3.1 — without this column the two are indistinguishable, and doc-derived UI claims masquerade as code-verified. Orthogonal to `source` (`screen-spec` | `screen-extraction`), which records the authoring DIRECTION, not the evidence's strength: a `screen-extraction` screen can be either class, since a vendor's documented UI is extracted-but-not-code-verified. Added in schema 2.42.0."
+    - name: source_sdd_id
+      type: string
+      nullable: true
+      description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+    - name: platform_sdd_id
+      type: string
+      nullable: true
+      description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
+    description: "UI screen specified in the OpenUI Lang grammar (per M-ADR 0166). One row per screen / coherent screen group. Application-product profile (other profiles emit headers-only). Source: authored `screens/*.md` (frontmatter + ```openui-lang block); the reverse toolkit produces these from a router + component-tree projection."
+    foreign_keys:
+    - column: product_id
+      references: products.id
+      nullable: false
+    column_enums:
+      status: enums.artefact_maturity
+  ui_components:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+      description: "Slugged PK: {product_id}-{component-slug}."
+    - name: name
+      type: string
+      nullable: false
+      description: Component identifier as used in the grammar.
+    - name: product_id
+      type: string
+      nullable: false
+      description: Owning application-product.
+    - name: kind
+      type: string
+      nullable: true
+      description: "Optional classification: layout | display | input | chart | element | composite | remote | remote-iframe | remote-webcomponent. A `remote*` kind marks a micro-frontend federation seam (M-ADR 0166 §4.7)."
+    - name: source
+      type: string
+      nullable: false
+      description: screen-spec (forward) | design-system-import (reverse).
+    - name: source_sdd_id
+      type: string
+      nullable: true
+      description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+    - name: platform_sdd_id
+      type: string
+      nullable: true
+      description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
+    description: "An entry in the adopter-owned component registry that screens compose against (per M-ADR 0166) — the UI-structure contract. A screen composes registry components but never defines one. Application-product profile. Source: components referenced across the SDD's screen-spec ```openui-lang blocks (registry projection); the reverse toolkit discovers the authoritative registry from the design-system import surface."
+    foreign_keys:
+    - column: product_id
+      references: products.id
+      nullable: false
+    column_enums:
+      kind: enums.ui_component_kind
+  screen_component:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+      description: "Composite PK: {screen_id}__{component_id}."
+    - name: screen_id
+      type: string
+      nullable: false
+    - name: component_id
+      type: string
+      nullable: false
+    - name: source_sdd_id
+      type: string
+      nullable: true
+      description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+    - name: platform_sdd_id
+      type: string
+      nullable: true
+      description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
+    description: "Edge: screen composes a UI component. Parsed from the screen-spec ```openui-lang block's component references (per M-ADR 0166)."
+    foreign_keys:
+    - column: screen_id
+      references: screens.id
+      nullable: false
+    - column: component_id
+      references: ui_components.id
+      nullable: false
+  screen_feature:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+      description: "Composite PK: {screen_id}__{feature_id}. For app/integration builds the feature_id may be a bare realises slug until the aggregator resolves it to the platform feature id (then the PK is regenerated)."
+    - name: screen_id
+      type: string
+      nullable: false
+    - name: feature_id
+      type: string
+      nullable: false
+    - name: source_sdd_id
+      type: string
+      nullable: true
+      description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+    - name: platform_sdd_id
+      type: string
+      nullable: true
+      description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
+    description: "Edge: screen realises a feature (traceability). Forward: `realises:` frontmatter on the screen-spec. Reverse: route → feature mapping. Per M-ADR 0166."
+    foreign_keys:
+    - column: screen_id
+      references: screens.id
+      nullable: false
+    - column: feature_id
+      references: features.id
+      nullable: false
+      external_for_profiles:
+      - application-product
+      - integration-product
+  persona_screen:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+      description: "Composite PK: {persona_id}__{screen_id}."
+    - name: persona_id
+      type: string
+      nullable: false
+    - name: screen_id
+      type: string
+      nullable: false
+    - name: source_sdd_id
+      type: string
+      nullable: true
+      description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+    - name: platform_sdd_id
+      type: string
+      nullable: true
+      description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
+    description: "Edge: persona can access a screen. Forward: `persona_access:` frontmatter. Reverse: route persona-access guards, permission/feature-flag config, or a host shell's per-persona menu (where the backend pre-filters visible screens). Per M-ADR 0166."
+    foreign_keys:
+    - column: persona_id
+      references: personas.id
+      nullable: false
+    - column: screen_id
+      references: screens.id
+      nullable: false
+  screen_action:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+      description: "Composite PK: {screen_id}__{action-slug}."
+    - name: screen_id
+      type: string
+      nullable: false
+    - name: action
+      type: string
+      nullable: false
+      description: Declared action label emitted by the screen.
+    - name: event_id
+      type: string
+      nullable: true
+      description: Catalogued event the action maps to (per M-ADR 0156). External-capable; empty when the action does not resolve to a domain event.
+    - name: source_sdd_id
+      type: string
+      nullable: true
+      description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+    - name: platform_sdd_id
+      type: string
+      nullable: true
+      description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
+    description: "Edge: screen emits an action, optionally resolved to a catalogued event. The behavioural MFE seam — inter-bundle communication as a catalogued contract, not an ad-hoc string. Forward: `action=` declarations in the ```openui-lang block. Reverse: emitted custom-event / event-bus wiring. event_id is external-capable (the event may live in the platform SDD). Per M-ADR 0166 + M-ADR 0156."
+    foreign_keys:
+    - column: screen_id
+      references: screens.id
+      nullable: false
+    - column: event_id
+      references: events.id
+      nullable: true
+      external: true
+  conformance_finding:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+      description: Check id (unique within the SDD; source_sdd_id disambiguates across the federation).
+    - name: check_id
+      type: string
+      nullable: false
+    - name: target
+      type: string
+      nullable: false
+      description: code-vs-contract | binding-vs-reality (M-ADR 0180 §2.5).
+    - name: implementation_repo
+      type: string
+      nullable: true
+      description: The implementation member the check is about (M-ADR 0181). Empty when checks were not binding-derived.
+    - name: role
+      type: string
+      nullable: true
+      description: as-is | to-be (M-ADR 0181). Empty when not binding-derived.
+    - name: lifecycle
+      type: string
+      nullable: true
+      description: planned | migrating | active | legacy-active | deprecated | decommissioned (M-ADR 0181).
+    - name: declared
+      type: number
+      nullable: false
+      description: Count of the declared surface (spec/binding/contract).
+    - name: observed
+      type: number
+      nullable: false
+      description: Count of the observed surface (code).
+    - name: matched
+      type: number
+      nullable: false
+    - name: conformance_pct
+      type: number
+      nullable: false
+      description: matched / denom * 100 (denom per the check).
+    - name: declared_not_observed
+      type: number
+      nullable: false
+      description: "Count declared but not observed (candidate: spec-stale / unimplemented / dangling)."
+    - name: observed_not_declared
+      type: number
+      nullable: false
+      description: "Count observed but not declared (candidate: binding-stale / code-defect)."
+    - name: needs_triage
+      type: boolean
+      nullable: false
+      description: True when any asymmetry exists. Triage, not auto-fail (M-ADR 0180 §2.3).
+    - name: run_date
+      type: string
+      nullable: false
+      description: ISO date of the conformance run — the snapshot stamp enabling trend over time.
+    - name: source_sdd_id
+      type: string
+      nullable: true
+      description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+    - name: platform_sdd_id
+      type: string
+      nullable: true
+      description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
+    description: "Conformance-reverse drift summary, one row per check (method M-ADR 0180). NOT produced by `catalogue build` (it reads the spec repo) — produced by `sdd-cli conformance --emit-finding` (which has the code repo) and federated here by the aggregator. Each row is a run-dated snapshot of declared-vs-observed drift for an implementation member (M-ADR 0181 role/lifecycle), so estate-wide conformance is queryable (aggregate union) and trendable (snapshot diff across runs/commits). Verdicts are PROVISIONAL — disposition (code-defect | spec-stale | divergence) is triage, recorded elsewhere. No enforced FK on implementation_repo: the code repo is frequently cross-repo and not in this SDD's repositories.csv. Added in schema 2.25.0."
+    column_enums:
+      target: enums.conformance_target
+      role: enums.implementation_role
+      lifecycle: enums.implementation_lifecycle
+  quality_scores:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+      description: "PK: {rubric_id}__{target_kind}__{target_ref}. Composite in one slug because the natural key is a triple and the rest of this schema keys on a single `id`."
+    - name: rubric_id
+      type: string
+      nullable: false
+      description: The rubric that produced the assessment, e.g. adr-quality, contract-quality. From the registry's `registry_type` when declared, else the filename stem minus `-scores`. A `registry_type` disagreeing with its filename is a convention finding, never a silent preference.
+    - name: scoring_form
+      type: string
+      nullable: false
+      description: Scoring shape — see the scoring_form enum. `weighted` for every row the current builder emits.
+    - name: target_kind
+      type: string
+      nullable: false
+      description: "What kind of thing was scored: adr | contract | c4_diagram | capability | domain | feature | product | repository | persona | screen | glossary | integration | user_story | work_order | strategic_doc. Polymorphic because scored units span catalogue entities and non-catalogued artefacts (M-ADR 0205 §4.5)."
+    - name: target_ref
+      type: string
+      nullable: false
+      description: Identifier of the scored target, in the vocabulary of its kind. For ADRs this is the prefix-stripped catalogue id (M-ADR 0186 §4.4), matching `adrs.id`.
+    - name: target_path
+      type: string
+      nullable: true
+      description: Repo-relative path to the scored artefact, from the entry's `file_path` where authored (7 of 15 registry shapes carry it). Doubles as the resolution anchor for `scored_at`-basis staleness — which is why its absence downgrades a row's staleness_basis to `none` rather than being cosmetic. Empty when the registry does not author it.
+    - name: gate
+      type: string
+      nullable: true
+      description: Verdict — see the quality_gate enum, which is deliberately UNBOUND. An out-of-vocabulary value leaves this cell EMPTY and raises a convention finding naming the file, entry and value (the products.synthesis_band precedent). Empty therefore means either unauthored or out-of-vocabulary, and the finding distinguishes them.
+    - name: weighted_score
+      type: number
+      nullable: true
+      description: The rubric's rolled-up weighted score. Empty for an unscored entry — which is a real state the registries author deliberately, not a gap.
+    - name: score_denominator
+      type: number
+      nullable: true
+      description: Denominator the weighted_score was computed against, where the rubric records one (contract-quality does). Present so a score is never reported without its basis.
+    - name: band
+      type: string
+      nullable: true
+      description: "Named band for a `banded` row; empty for a weighted one. DELIBERATELY UNBOUND, and for the same reason `dimension_key` is not normalised: the vocabulary belongs to the rubric, not to the method. Measured across the reverse estate at 3.3.0 — `reverseability` uses easy | moderate | hard | very-hard (a DIFFICULTY scale, where a higher band is worse), while `repo_doc_quality`, `product_synthesis_quality`, `reverse_platform_evidence_quality` and `artifact_quality` use strong | working (a QUALITY scale). One closed enum over both would assert that `hard` and `working` are comparable, which they are not. A consumer comparing bands must therefore group by rubric_id first."
+    - name: band_total
+      type: int
+      nullable: true
+      description: "Integer total a `banded` rubric summed its dimensions to, before mapping to `band`; empty for a weighted row. Kept SEPARATE from weighted_score rather than sharing it: the scales are incompatible (a banded total ranges 0-13 against a weighted 1-5), and a single column holding both would make any average over it silently wrong. Separation makes an aggregate over weighted_score correct by construction rather than by the caller remembering to filter on scoring_form."
+    - name: scored_at
+      type: date
+      nullable: true
+      description: "Date of the effective assessment, from `scored_at` (the forward house form's field name — NOT `assessed_at`, which is the reverse family's file-level field). Date-typed: per the M-ADR 0205 §4.1 engine's TRY_CAST semantics, a prose value here is reported as a type nonconformance rather than aborting the load or being smoothed away — the `adrs.decision_date` case, which reverse practice already exercises."
+    - name: corpus_ref
+      type: string
+      nullable: true
+      description: "The commit the assessment read — the precise staleness anchor. NEW AUTHORING introduced by this change-set: no score written before it carries one, so this column is empty across both estates at introduction and fills forward as registries are rewritten. The reverse family already has the idea under a different name (`snapshot.source_revision`)."
+    - name: staleness_basis
+      type: string
+      nullable: false
+      description: Which anchor this row's staleness can be computed from — see the staleness_basis enum. Emitted by the builder, never authored. Exists so no consumer can state a staleness verdict without its basis.
+    - name: review_run_id
+      type: string
+      nullable: true
+      description: Identifier of the effective review run. Empty in the flat dialect, which records no run ids.
+    - name: selection_method
+      type: string
+      nullable: true
+      description: "How the effective review was chosen — see the score_selection_method enum. Empty in the flat dialect, which carries no selection_policy: absence means 'the only review', not 'policy unknown'."
+    - name: scorer_provider
+      type: string
+      nullable: true
+      description: Provider of the scoring agent (e.g. anthropic), from `current.scorer.provider`. Every score in this method is agent-produced, so which agent produced a judgment is part of the judgment, not metadata about it.
+    - name: scorer_tool
+      type: string
+      nullable: true
+      description: Tool the scoring agent ran in, from `current.scorer.tool`.
+    - name: scorer_model
+      type: string
+      nullable: true
+      description: Model that produced the assessment, from `current.scorer.model`. In the flat dialect the whole provenance block collapses to a free-text `scored_by:`, which lands here — so a value like 'intent-quality-review — rfms-connector-library' is expected and correct for flat-dialect rows, not a parse defect.
+    - name: scorer_model_family
+      type: string
+      nullable: true
+      description: Optional grouping field from `current.scorer.model_family`.
+    - name: scorer_prompt_version
+      type: string
+      nullable: true
+      description: Optional prompt-wrapper version from `current.scorer.prompt_version` — the input that makes a score reproducible.
+    - name: flag_count
+      type: int
+      nullable: false
+      description: "Number of heuristic flags raised. Normalises two authored dialects: `flags: {name: bool}` (count the true ones) and `flags_raised: [names]` (count the list). A per-flag child catalogue is deliberately NOT built — it arrives when a named query needs to filter by flag name, not by accretion."
+    - name: hard_gate_triggered
+      type: boolean
+      nullable: false
+      description: "Whether any hard gate fired. Normalises `hard_gates: {triggered, reasons}` and `hard_gates_triggered: [reasons]`."
+    - name: required_actions_count
+      type: int
+      nullable: false
+      description: Number of remediation actions the assessment recorded.
+    - name: sdd_id
+      type: string
+      nullable: true
+      description: SDD whose gate-registry authored this row. Soft FK to products.id — nullable because a registry can score targets in an SDD that emits no product row.
+    - name: source_sdd_id
+      type: string
+      nullable: true
+      description: Originating SDD slug. Populated by the aggregator per M-ADR 0134; left empty by per-SDD builders.
+    - name: platform_sdd_id
+      type: string
+      nullable: true
+      description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
+    description: |
+      Rubric assessment of a target artefact, one row per (target, rubric), per M-ADR 0205 §4.5. Source: `orchestration/gate-registry/<rubric>-scores.yaml` — the authored surface stays YAML because a score is a judgment, authored where it asserts intent; these rows are DERIVED and never edited.
+      Models the EFFECTIVE score only — `current`, as chosen by the registry's `selection_policy`. The authored `reviews[]` history is deliberately not catalogued: variable-length history in a fixed-grain catalogue would give two answers to "what is the score". `review_run_id` and `selection_method` make each row name which review it is.
+      THE BUILDER MUST READ TWO AUTHORED DIALECTS. All fifteen method-side templates specify a nested shape (`selection_policy` / `current` / `reviews`), but the live forward-estate data is overwhelmingly FLAT — `gate`/`weighted_score`/`scored_at`/`scored_by`/`scores`/`flags` directly on the entry. Measured 2026-08-06: reading only the template shape would catalogue 6 entries out of 204. The templates were modernised; the data was not migrated, and both are legitimate.
+      `rubric_id` comes from the file's `registry_type` when declared, else the filename stem minus `-scores` — NEVER the container key, which is unreliable (4 of 10 forward registries drift from the method template) and non-unique (`domains` names both domain-architecture and intent-quality; `capabilities` names both feature-grounding and traceability-manifest).
+      Scope: the weighted house form only. The banded reverse family is additive later via `scoring_form` (see that enum).
+    foreign_keys:
+    - column: sdd_id
+      references: products.id
+      nullable: true
+  quality_score_dimensions:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+      description: "PK: {quality_score_id}__{dimension_key}."
+    - name: quality_score_id
+      type: string
+      nullable: false
+      description: The assessment this dimension belongs to.
+    - name: rubric_id
+      type: string
+      nullable: false
+      description: Denormalised from the parent so per-rubric dimension queries need no join.
+    - name: target_kind
+      type: string
+      nullable: false
+      description: Denormalised from the parent.
+    - name: target_ref
+      type: string
+      nullable: false
+      description: Denormalised from the parent.
+    - name: dimension_key
+      type: string
+      nullable: false
+      description: "The rubric's own dimension identifier, verbatim — `A1` where the rubric uses codes, `definition_precision` where it uses names. NOT normalised into a method-wide vocabulary: the key is how the rubric and its registry refer to the dimension, and rewriting it here would make the row untraceable to the rubric that produced it."
+    - name: dimension_score
+      type: number
+      nullable: true
+      description: Score on that dimension. Empty for an unscored entry (the templates author explicit nulls).
+    - name: dimension_weight
+      type: number
+      nullable: true
+      description: "Weight the rubric assigns the dimension, where discoverable. Usually EMPTY: weights live in the rubric document and the registry header comment, not per entry — so this column is honest about the fact that a weighted_score cannot currently be recomputed from these rows alone."
+    - name: source_sdd_id
+      type: string
+      nullable: true
+      description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+    - name: platform_sdd_id
+      type: string
+      nullable: true
+      description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
+    description: |
+      One row per (target, rubric, dimension) — the per-dimension detail behind a `quality_scores` row, per M-ADR 0205 §4.5.
+      A child catalogue rather than columns, and this is forced rather than stylistic: the fifteen rubrics carry FIFTEEN DISJOINT dimension vocabularies (`A1`-`A8`, `C1`-`C8`, `G1`-`G7`, `T1`-`T7`, `D1`-`D6`, `S1`-`S6`, `I1`-`I6`, plus five fully-named sets such as `definition_precision` and `intent_fidelity`) — 45 distinct keys measured in one estate alone. No fixed column set can hold them; serialised JSON in a cell would be unjoinable and break the relational metamodel; generic `d1..d8` columns would be lossy and re-create the positional-index failure class. A child table is what this metamodel already does for every one-to-many, and it joins natively on the M-ADR 0205 §4.1 engine.
+    foreign_keys:
+    - column: quality_score_id
+      references: quality_scores.id
+      nullable: false
+  scaffolds:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+      description: "PK: the manifest's declared unit id (kebab-case slug). Unique per SDD; the aggregator namespaces cross-SDD ids exactly as for every other catalogue."
+    - name: name
+      type: string
+      nullable: false
+      description: Human-readable name of the unit of work, from the manifest.
+    - name: status
+      type: string
+      nullable: false
+      description: Authored lifecycle — see the scaffold_status enum. `closed` is a recorded act of the author (M-ADR 0207 §4.3); the delta instrument reports a closed scaffold whose delta is not zero, it never closes one.
+    - name: source_path
+      type: string
+      nullable: false
+      description: Repo-relative path of the manifest this row derives from, e.g. orchestration/scaffolds/payments-settlement.yaml.
+    - name: corpus_ref
+      type: string
+      nullable: false
+      description: "The commit the scaffold was declared against — the staleness anchor, mirroring quality_scores.corpus_ref (M-ADR 0207 §4.6: one staleness idiom, not two). Required: a manifest without one fails validation rather than emitting an unanchorable row."
+    - name: manifest_schema
+      type: string
+      nullable: false
+      description: The scaffold manifest format version the file declared (scaffold_schema field), so format evolution is diffable and a future migration can state its denominator.
+    - name: sdd_id
+      type: string
+      nullable: true
+      description: SDD whose manifest authored this row. Soft FK to products.id — nullable because a scaffold can be declared in an SDD that emits no product row.
+    - name: source_sdd_id
+      type: string
+      nullable: true
+      description: Originating SDD slug. Populated by the aggregator per M-ADR 0134; left empty by per-SDD builders.
+    - name: platform_sdd_id
+      type: string
+      nullable: true
+      description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
+    description: |
+      Forward scaffold declaration, one row per unit of work, per M-ADR 0207 §4.1. Source: `orchestration/scaffolds/*.yaml` — the authored surface stays YAML because a scaffold is a declaration of intent, authored where the work is scoped; these rows are DERIVED and never edited (M-ADR 0205 §4.0 governs unchanged).
+      The scaffold states the catalogue shape a unit of work will comprise — its items are `scaffold_items` rows — and the declared-vs-derived delta against the built catalogues is the unit's definition of done: delta zero (structural) AND every realised artefact score-current (content, via `quality_scores`), per M-ADR 0207 §4.5. The unit is the change-set's declared delta; estate-level scaffold totality is an explicit non-goal (M-ADR 0207 §4.4), so an estate region no scaffold covers produces no finding.
+      `corpus_ref` is REQUIRED — a scaffold without an anchor cannot carry a staleness verdict, and M-ADR 0207 §4.6 makes the anchor part of the declaration, not an optional refinement. Staleness itself is computed at coverage time (the scores idiom), never stored here.
+    foreign_keys:
+    - column: sdd_id
+      references: products.id
+      nullable: true
+    column_enums:
+      status: enums.scaffold_status
+  scaffold_items:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+      description: "PK: {scaffold_id}__{item_kind}__{target_kind}__{target_ref}. Composite in one slug because the natural key is a quadruple and the rest of this schema keys on a single `id`."
+    - name: scaffold_id
+      type: string
+      nullable: false
+      description: The scaffold this item belongs to.
+    - name: item_kind
+      type: string
+      nullable: false
+      description: Grain of the declaration — see the scaffold_item_kind enum.
+    - name: target_kind
+      type: string
+      nullable: false
+      description: Catalogue the target should appear in, in the schema's own catalogue vocabulary. Validated against the schema by the builder; unknown values are convention findings carrying file, item and value.
+    - name: target_ref
+      type: string
+      nullable: false
+      description: "Identifier of the declared target in the vocabulary of its catalogue: the declared id for entity items, the repo-relative spec path for contract items (matching contracts.spec_path), the builder-computed {source}__{target} endpoint slug for edge items."
+    - name: edge_source_ref
+      type: string
+      nullable: true
+      description: "For edge items: the declared source endpoint, in the vocabulary of the edge catalogue's first FK column (schema declaration order). Empty for entity and contract items."
+    - name: edge_target_ref
+      type: string
+      nullable: true
+      description: "For edge items: the declared target endpoint, second FK column. Empty for entity and contract items."
+    - name: state
+      type: string
+      nullable: false
+      description: Resolution verdict — see the scaffold_item_state enum. Derived, never authored; recomputed on every build, so realisation flips rows exactly when the target lands.
+    - name: source_sdd_id
+      type: string
+      nullable: true
+      description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+    - name: platform_sdd_id
+      type: string
+      nullable: true
+      description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
+    description: |
+      One declared item of a scaffold — an entity, edge, or contract the unit of work promises — per M-ADR 0207 §4.1. Derived from the manifest's item list; `state` is the builder's resolution verdict against the same build's catalogue rows.
+      THE POLYMORPHIC TARGET DECLARES NO FOREIGN KEY, by design (the quality_scores.target_ref precedent, taken further): a scaffold exists to reference targets BEFORE they exist. FK truth here is CONDITIONAL ON STATE — a `declared` item's (target_kind, target_ref) MUST NOT resolve in the built catalogues, a `realised` item's MUST — and the builder's resolution pass is what enforces it: it computes `state` FROM resolution, so a disagreement between state and resolution cannot be emitted by a conforming builder. The M-ADR 0207 §4.8 delta instrument re-derives the same verdict on the engine as its self-check.
+      `target_kind` is the CATALOGUE NAME the target should appear in (services, capabilities, repo_contract, contracts, …) — bound to the schema's own catalogue list by the builder: an unknown target_kind is a loud convention finding, never a silently-dropped item (M-ADR 0207 §4.1). For `edge` items the endpoints are declared in edge_source_ref/edge_target_ref, mapped to the edge catalogue's FK columns in schema declaration order; target_ref then carries the builder-computed endpoint slug so the PK stays single-column.
+    foreign_keys:
+    - column: scaffold_id
+      references: scaffolds.id
+      nullable: false
+    column_enums:
+      item_kind: enums.scaffold_item_kind
+      state: enums.scaffold_item_state
+  implementations:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+      description: The binding's implementation key — the same value every snapshot manifest of this implementation carries as implementation.
+    - name: name
+      type: string
+      nullable: false
+      description: The binding's name key, else the id.
+    - name: spec
+      type: string
+      nullable: false
+      description: The spec this implementation implements — the binding's spec key.
+    - name: snapshot_area
+      type: string
+      nullable: true
+      description: Store-relative path of this implementation's snapshot area (M-ADR 0214 §4.4), from the binding. Empty when the implementation has none.
+    - name: doc_path
+      type: string
+      nullable: false
+      description: Path of the binding file, relative to the SDD root.
+    - name: source_sdd_id
+      type: string
+      nullable: true
+      description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+    - name: platform_sdd_id
+      type: string
+      nullable: true
+      description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4.
+    description: "An implementation of this SDD's spec: the durable system identity whose snapshots are its versions (M-ADR 0181 §2.5, M-ADR 0214 §4.1). One row per .sdd/implementation-binding.yaml that names its implementation; a binding without an implementation key emits nothing and a finding, because there is no identity to key on."
+  implementation_members:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+      description: <implementation_id>::<repo_key>.
+    - name: implementation_id
+      type: string
+      nullable: false
+    - name: repo_id
+      type: string
+      nullable: true
+      description: The member's repository when it resolves in this SDD's repositories. Empty for a planned member whose repository does not exist yet; a member of any other lifecycle that does not resolve is a builder finding.
+    - name: repo_key
+      type: string
+      nullable: false
+      description: The repository the binding names (its member repo key), resolved or not.
+    - name: role
+      type: string
+      nullable: true
+    - name: lifecycle
+      type: string
+      nullable: true
+    - name: evidence_direction
+      type: string
+      nullable: true
+      description: How this member is evidenced (M-ADR 0180 §2.1, placed on the member by M-ADR 0181 §2.1). Empty when the binding does not say.
+    - name: source_sdd_id
+      type: string
+      nullable: true
+      description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+    - name: platform_sdd_id
+      type: string
+      nullable: true
+      description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4.
+    description: "Edge: a repository is a member of an implementation, with the member's role, lifecycle and evidence direction (M-ADR 0181 §2.1, M-ADR 0214 §4.2). Role and lifecycle live here once: repo_capability, repo_contract and feature_repo resolve their repository to this row rather than copying them (M-ADR 0214 §4.3). Membership is independent of the repository's repo_scope (M-ADR 0213): a shared library under conformance checks is a support member."
+    foreign_keys:
+    - column: implementation_id
+      references: implementations.id
+      nullable: false
+    - column: repo_id
+      references: repositories.id
+      nullable: true
+    column_enums:
+      role: enums.implementation_role
+      lifecycle: enums.implementation_lifecycle
+      evidence_direction: enums.evidence_direction
+  snapshots:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+      description: <implementation_id>@<baseline_id>.
+    - name: implementation_id
+      type: string
+      nullable: false
+    - name: baseline_id
+      type: string
+      nullable: false
+      description: The observation date (YYYY-MM-DD) — the baseline folder and the manifest's snapshot_id.
+    - name: prior_snapshot_id
+      type: string
+      nullable: true
+      description: The snapshot this one was diffed from — <implementation_id>@<prior_snapshot>. Empty for the first.
+    - name: credential_scan_result
+      type: string
+      nullable: true
+      description: The manifest's credential_scan.result (clean, or what was found). Empty when no scan is recorded.
+    - name: source_sdd_id
+      type: string
+      nullable: true
+      description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+    - name: platform_sdd_id
+      type: string
+      nullable: true
+      description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4.
+    description: One implementation's member set pinned at one observation (M-ADR 0181 §2.5, M-ADR 0214 §4.4). One row per dated baseline in the implementation's snapshot area whose snapshot.yaml names the same implementation. Needs the snapshot store root (build --snapshot-store or SDD_SNAPSHOT_STORE); without it the catalogue is empty and the build says so.
+    foreign_keys:
+    - column: implementation_id
+      references: implementations.id
+      nullable: false
+    - column: prior_snapshot_id
+      references: snapshots.id
+      nullable: true
+  snapshot_members:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+      description: <snapshot_id>::<repo_key>.
+    - name: snapshot_id
+      type: string
+      nullable: false
+    - name: repo_id
+      type: string
+      nullable: true
+      description: The member's repository when it resolves in this SDD's repositories; empty otherwise (a removed member's repository may be gone).
+    - name: repo_key
+      type: string
+      nullable: false
+      description: The manifest's canonical_repo_key.
+    - name: source_revision
+      type: string
+      nullable: false
+      description: The revision observed (for a removed member, its last revision).
+    - name: observed_at
+      type: string
+      nullable: true
+      description: "The member's own observation date: the baseline's for an observed member, the earlier one for a carried member, the last observed for a removed one."
+    - name: presence
+      type: string
+      nullable: false
+    - name: source_sdd_id
+      type: string
+      nullable: true
+      description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+    - name: platform_sdd_id
+      type: string
+      nullable: true
+      description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4.
+    description: "Edge: a repository at one revision in one snapshot, with its presence — observed in this baseline, carried from an earlier one, or removed since the prior (M-ADR 0214 §4.4)."
+    foreign_keys:
+    - column: snapshot_id
+      references: snapshots.id
+      nullable: false
+    - column: repo_id
+      references: repositories.id
+      nullable: true
+    column_enums:
+      presence: enums.member_presence
+  data_items:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+      description: di.<category>.<name>, e.g. di.motion.speed.
+    - name: name
+      type: string
+      nullable: false
+    - name: category
+      type: string
+      nullable: false
+      description: Open grouping (motion, behaviour, tyre, energy, …).
+    - name: canonical_field
+      type: string
+      nullable: true
+      description: The integration-facing canonical contract field that carries the item. EMPTY means the platform has no canonical home for it, and coverage reads every requirement on it as unmet (no-canonical-home).
+    - name: description
+      type: string
+      nullable: true
+    - name: source_sdd_id
+      type: string
+      nullable: true
+      description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+    - name: platform_sdd_id
+      type: string
+      nullable: true
+      description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator (M-ADR 0208 §4.4).
+    description: "A unit of data an integration may supply and a feature may need, at the canonical boundary (M-ADR 0216 §4.1). Platform-owned, like events. Not a wire signal: payload grammar stays adopter territory."
+  integration_data_item:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+      description: <integration_id>::<data_item_id>::<evidence_ref>.
+    - name: integration_id
+      type: string
+      nullable: false
+    - name: data_item_id
+      type: string
+      nullable: false
+    - name: verdict
+      type: string
+      nullable: false
+      description: Bound to supply_verdict. A mapping-table row is supported, or partial when its Notes begin with partial; the Data Items Not Supplied section carries the rest.
+    - name: basis
+      type: string
+      nullable: true
+      description: "Bound to supply_basis: the evidence class of the statement."
+    - name: evidence_ref
+      type: string
+      nullable: false
+      description: Path and line of the statement.
+    - name: checked_at
+      type: string
+      nullable: true
+      description: "The governing Checked: line of the section, verbatim (a date, or a source revision). Reported for age; never read as a verdict."
+    - name: source_sdd_id
+      type: string
+      nullable: true
+      description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+    - name: platform_sdd_id
+      type: string
+      nullable: true
+      description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator (M-ADR 0208 §4.4).
+    description: "Supply: what one integration states about one data item, from its feature-grounding (M-ADR 0216 §4.2). Several rows per item are normal (one per evidence_ref); coverage reads the best. No row reads unknown, and unknown is never written."
+    foreign_keys:
+    - column: integration_id
+      references: integrations.id
+      nullable: false
+    - column: data_item_id
+      references: data_items.id
+      nullable: false
+      external_for_profiles:
+      - application-product
+      - integration-product
+    column_enums:
+      verdict: enums.supply_verdict
+      basis: enums.supply_basis
+  feature_data_requirement:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+      description: <feature_id>::<data_item_id>.
+    - name: feature_id
+      type: string
+      nullable: false
+    - name: data_item_id
+      type: string
+      nullable: false
+    - name: necessity
+      type: string
+      nullable: false
+      description: Bound to data_necessity.
+    - name: alternative_group
+      type: string
+      nullable: true
+      description: "Empty, or a label: required rows sharing a label are satisfied by any one of them."
+    - name: basis_ref
+      type: string
+      nullable: true
+      description: Where the need is stated (path and line).
+    - name: source_sdd_id
+      type: string
+      nullable: true
+      description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+    - name: platform_sdd_id
+      type: string
+      nullable: true
+      description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator (M-ADR 0208 §4.4).
+    description: "Demand: a data item one feature needs, from the feature spec's Data Requirements table (M-ADR 0216 §4.3). Feature grain only: a capability's need is the union of its features'."
+    foreign_keys:
+    - column: feature_id
+      references: features.id
+      nullable: false
+    - column: data_item_id
+      references: data_items.id
+      nullable: false
+      external_for_profiles:
+      - application-product
+      - integration-product
+    column_enums:
+      necessity: enums.data_necessity
+  feature_integration_support:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+      description: <feature_id>::<integration_id>.
+    - name: feature_id
+      type: string
+      nullable: false
+    - name: integration_id
+      type: string
+      nullable: false
+    - name: verdict
+      type: string
+      nullable: false
+      description: "Bound to support_verdict. Each requirement is decided first (an alternative_group is unmet only when every member is); the feature takes the worst: unsupported > unknown > partial > supported. not-applicable only when every required item is."
+    - name: limiting_item_id
+      type: string
+      nullable: true
+      description: "For unsupported: the deciding requirement's item. Empty otherwise."
+    - name: limiting_reason
+      type: string
+      nullable: true
+      description: "For unsupported: bound to limiting_reason. Empty otherwise."
+    - name: source_sdd_id
+      type: string
+      nullable: true
+      description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+    - name: platform_sdd_id
+      type: string
+      nullable: true
+      description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator (M-ADR 0208 §4.4).
+    description: "Coverage: whether one integration can support one feature, DERIVED at aggregation from supply and demand (M-ADR 0216 §4.4); empty in a member build. SUPPORTED MEANS THE ITEMS REACH THE CANONICAL BOUNDARY, NOT THAT THE FEATURE WORKS END TO END: routing past that boundary is not checked."
+    foreign_keys:
+    - column: feature_id
+      references: features.id
+      nullable: false
+    - column: integration_id
+      references: integrations.id
+      nullable: false
+    - column: limiting_item_id
+      references: data_items.id
+      nullable: true
+    column_enums:
+      verdict: enums.support_verdict
+      limiting_reason: enums.limiting_reason
+  evidence_target_repo:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+      description: <evidence_path>::<repo_id>.
+    - name: evidence_path
+      type: string
+      nullable: false
+      description: The evidence file, relative to the SDD root.
+    - name: repo_id
+      type: string
+      nullable: false
+      description: The repository the evidence concerns. Another SDD's by definition, so external at build; it must resolve at aggregation.
+    - name: source_sdd_id
+      type: string
+      nullable: true
+      description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+    - name: platform_sdd_id
+      type: string
+      nullable: true
+      description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator (M-ADR 0208 §4.4).
+    description: "A reverse evidence file names a repository another SDD owns, through its top-level target_repo (M-ADR 0214 §4.10). A reference, never a claim: the repository is described by exactly one SDD, elsewhere."
+    foreign_keys:
+    - column: repo_id
+      references: repositories.id
+      nullable: false
+      external: true
+  repo_dependency:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+      description: <from_repo_id>__<to_repo_id>__<kind>.
+    - name: from_repo_id
+      type: string
+      nullable: false
+      description: The dependent repository; one of this SDD's own.
+    - name: to_repo_id
+      type: string
+      nullable: false
+      description: The repository depended on, in this SDD or another. External at build; it must resolve at aggregation, and is never renamed or guessed to make it resolve.
+    - name: kind
+      type: string
+      nullable: false
+      description: Bound to repo_dependency_kind.
+    - name: version
+      type: string
+      nullable: true
+      description: The version or reference depended on, where the source states one; empty otherwise. The declared source wins over the derived one.
+    - name: declared_in
+      type: string
+      nullable: false
+      description: The file the row came from, relative to the SDD root; the declared source when both name the dependency.
+    - name: source_sdd_id
+      type: string
+      nullable: true
+      description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+    - name: platform_sdd_id
+      type: string
+      nullable: true
+      description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator (M-ADR 0208 §4.4).
+    description: "Edge: a repository depends on another repository's code without either being a running service — a library linked at build time, or a template family it was generated from (M-ADR 0217). The depended-on repository may belong to another SDD, which describes it; this row only references it."
+    foreign_keys:
+    - column: from_repo_id
+      references: repositories.id
+      nullable: false
+    - column: to_repo_id
+      references: repositories.id
+      nullable: false
+      external: true
+    column_enums:
+      kind: enums.repo_dependency_kind