@sdd-method/author-cli 0.10.0 → 0.12.0

package/dist/lib/validate/behaviour-store.js

@@ -8,18 +8,37 @@
 //
 //   1. records:  every agreement record has the shape the checks below read.
 //   2. agreement: an open change with any completed task has an agreed record and a Gate 0 that
-//                 ends CLEAR (the pre-apply check, M-ADR 0223 §4.3).
-//   3. stale:    for each open, agreed change that MODIFIES, REMOVES or RENAMES requirements, the
-//                 targeted living specs are unchanged since the agreed commit (M-ADR 0223 §4.5).
-//                 With no such targets the check is vacuous, and says so.
-//   4. verdicts: every archived change except a baseline has a verdict.md and a record whose
-//                 verdict is PASS and names it (M-ADR 0223 §4.6).
+//                 ends CLEAR (the pre-apply check, M-ADR 0223 §4.3). A record for an open change must
+//                 declare agreement-record schema 1.1.0 or later.
+//   3. stale:    for each open, agreed change, each requirement it MODIFIES, REMOVES or RENAMES is, block by
+//                 block, as it was at the agreed commit (the latest amendment's, else sdd.commit; M-ADR 0223
+//                 §4.5). Another requirement of the same spec moving does not stale it. With no targets the
+//                 check is vacuous, and says so.
+//      agreed content: the change's proposal, deltas, Gate 0, design, tasks (checkboxes ignored), test
+//                 plan (its execution results ignored) and structural deltas equal their state at that commit
+//                 (M-ADR 0222 §4.6; a structural delta's change is a [WARN] while M-ADR 0230 is Proposed).
+//      kinds:    on a record held to 1.1.0, each test-plan row's Kind (changed or carried) is the one computed
+//                 from the deltas and the living spec, a row naming no scenario of the deltas fails, and a
+//                 filled Before is a fail for changed and a pass for carried (M-ADR 0223 §4.4).
+//   4. verdicts: every archived change except a baseline has a verdict.md whose verdict line agrees with
+//                 its record's PASS (M-ADR 0223 §4.6). A record held to 1.1.0 (by its own history, or by the
+//                 schema the SDD shipped when the change archived) also needs: an agreed record; archived
+//                 content equal to the agreed content; its targeted requirements as agreed just before the
+//                 archive entered HEAD's history; an independent judge; a work order for each tasks.md group
+//                 and each added or modified requirement; judged and merged commits that are commits, resolve
+//                 in a checkout beside the SDD where there is one, and match; and a ledger naming each
+//                 implementing repository. A pin no checkout resolves is a [WARN], failed under --strict.
+//   conditions: each agreement condition is recorded in full, and an open one past its date fails unless the
+//                 change was withdrawn or replaced (M-ADR 0222 §4.6).
 //   5. surfaces: every archived baseline's evidence lists, under **Surfaces:**, each contract the
 //                 repositories it was observed in serve, as covered at transport or excluded with a
 //                 reason, and the list is checked against the catalogue (catalogues/repo_contract.csv),
 //                 never against itself (M-ADR 0222 §4.3, §4.4). A list the catalogue gives nothing to
 //                 check against (no Observed in line, or a repository with no catalogue contracts) fails:
 //                 a cross-check of zero contracts is unresolved, not a pass.
+//                 A baseline whose every requirement has since left the living specs (removed, or its
+//                 spec retired) is history: its list is not checked, so a retired surface can drop its
+//                 contract (M-ADR 0222 §4.4).
 //   7. features: every living spec is keyed by a catalogue feature (M-ADR 0221 §4.7). A spec keyed by no
 //                 feature is dropped from the catalogue by the requirements builder, which reports it only as a
 //                 build finding; this check makes it a failure, so a shipped requirement cannot vanish from the
@@ -48,8 +67,10 @@ import { tmpdir } from "node:os";
 import { basename, join } from "node:path";
 import { promisify } from "node:util";
 import { parseDocument } from "yaml";
-import { observedIn, orderArchives, parseRequirements, parseSurfaces, renamedFrom, surfaceMatches } from "../behaviour-store/archive.js";
+import { observedIn, orderArchives, parseRequirements, parseSurfaces, renamedFrom, renamePairs, resolveImplements, surfaceMatches } from "../behaviour-store/archive.js";
 import { parseCatalogueCsv } from "../catalogue/csv-reader.js";
+import { boundFile, conditionProblems, structuralFile, isCommit, normaliseBound, requirementBlock, sameCommit, scenarioKind, taskGroups, testPlanHeader, testPlanMapping, verdictLine, versionAtLeast } from "./agreement-evidence.js";
+import { ENFORCED as STRUCTURE_ENFORCED } from "./structural-model.js";
 import { compareStoreSchema, SCHEMA_NAME, SHIPPED_SCHEMA_DIR, STORE_CONFIG, STORE_SCHEMA_DIR, storeSchemaName } from "../behaviour-store/schema.js";
 const execFileAsync = promisify(execFile);
 /** The OpenSpec release the method depends on (M-ADR 0223 ruling 2). The module installs exactly this. */
@@ -138,6 +159,33 @@ export function parseAgreementRecord(file, text) {
         }
     }
     const verdict = r.verdict && typeof r.verdict === "object" ? r.verdict : undefined;
+    if (r.schema_version !== undefined && typeof r.schema_version !== "string")
+        problems.push(`${file}: schema_version must be a quoted string`);
+    const amendments = Array.isArray(r.amendments) ? r.amendments : [];
+    let amendCommit;
+    for (const a of amendments) {
+        if (a && typeof a.commit === "string" && typeof a.approved_by === "string" && a.approved_by.trim() !== "")
+            amendCommit = a.commit;
+    }
+    const workOrders = (Array.isArray(r.work_orders) ? r.work_orders : [])
+        .filter((w) => w && typeof w.repo === "string")
+        .map((w) => ({ repo: w.repo, implements: Array.isArray(w.implements) ? w.implements.map(String) : [] }));
+    const conditions = Array.isArray(r.conditions) ? r.conditions : [];
+    if (r.conditions !== undefined && !Array.isArray(r.conditions))
+        problems.push(`${file}: conditions must be a list`);
+    const noLongerImplements = [];
+    if (r.no_longer_implements !== undefined) {
+        if (!Array.isArray(r.no_longer_implements))
+            problems.push(`${file}: no_longer_implements must be a list of {repo, requirement}`);
+        else
+            for (const [i, x] of r.no_longer_implements.entries()) {
+                const e = x;
+                if (!e || typeof e.repo !== "string" || typeof e.requirement !== "string")
+                    problems.push(`${file}: no_longer_implements[${i}] names a repo and a requirement`);
+                else
+                    noLongerImplements.push({ repo: e.repo, requirement: e.requirement });
+            }
+    }
     if (problems.length > 0)
         return { problems };
     return {
@@ -145,9 +193,14 @@ export function parseAgreementRecord(file, text) {
             file,
             change: expected,
             status,
+            ...(typeof r.schema_version === "string" ? { schemaVersion: r.schema_version } : {}),
             ...(typeof sdd.commit === "string" ? { commit: sdd.commit } : {}),
+            ...(amendCommit ? { amendCommit } : {}),
             ...(typeof gate0?.result === "string" ? { gate0: gate0.result } : {}),
             ...(verdict ? { verdict } : {}),
+            workOrders,
+            conditions,
+            noLongerImplements,
         },
         problems,
     };
@@ -176,21 +229,39 @@ function lastGateLine(text) {
     const lines = text.split("\n").map((l) => l.trim()).filter((l) => l !== "");
     return lines.at(-1) ?? "";
 }
-async function gitDiffQuiet(repo, commit, path) {
+async function commitResolves(repo, commit) {
     try {
         await execFileAsync("git", ["-C", repo, "cat-file", "-e", `${commit}^{commit}`]);
+        return true;
     }
     catch {
-        return "unresolved";
+        return false;
     }
+}
+/** A file's text at a commit; null when the commit holds no such file. The caller has resolved the commit. */
+async function gitShow(repo, commit, path) {
     try {
-        await execFileAsync("git", ["-C", repo, "diff", "--quiet", commit, "HEAD", "--", path]);
-        return "same";
+        return (await execFileAsync("git", ["-C", repo, "show", `${commit}:${path}`], { maxBuffer: 64 * 1024 * 1024 })).stdout;
     }
-    catch (err) {
-        return err.code === 1 ? "changed" : "unresolved";
+    catch {
+        return null;
+    }
+}
+/** Paths under a directory at a commit, relative to that directory. */
+async function gitFiles(repo, commit, dir) {
+    try {
+        const out = (await execFileAsync("git", ["-C", repo, "ls-tree", "-r", "--name-only", commit, "--", `${dir}/`], { maxBuffer: 64 * 1024 * 1024 })).stdout;
+        return out.split("\n").filter(Boolean).map((p) => p.slice(dir.length + 1));
+    }
+    catch {
+        return [];
     }
 }
+/** Requirement names a delta targets: MODIFIED and REMOVED, and the former name of each RENAMED. */
+function targetNames(delta) {
+    const names = parseRequirements(delta).filter((r) => r.operation === "MODIFIED" || r.operation === "REMOVED").map((r) => r.name);
+    return [...new Set([...names, ...renamedFrom(delta)])];
+}
 /** The living specs an open change's deltas modify, remove or rename: openspec/specs/<capability>/spec.md. */
 async function targetedSpecs(repo, changeDir) {
     const out = [];
@@ -217,12 +288,116 @@ async function targetedSpecs(repo, changeDir) {
     await walk("");
     return out.sort();
 }
-export async function checkBehaviourStore(repo) {
+/**
+ * The highest schema_version a record has ever been committed with, from every commit that touched it, or null when
+ * the record has no history here. Applicability is monotonic: once a record entered the 1.1.0 rules, no later
+ * declaration takes it out, and a record with no history is unresolved rather than taken to be legacy.
+ */
+async function recordVersionEver(repo, file) {
+    let commits;
+    try {
+        commits = (await execFileAsync("git", ["-C", repo, "log", "--format=%H", "--", file], { maxBuffer: 64 * 1024 * 1024 })).stdout.split("\n").filter(Boolean);
+    }
+    catch {
+        return null;
+    }
+    if (commits.length === 0)
+        return null;
+    let highest;
+    for (const c of commits) {
+        const text = await gitShow(repo, c, file);
+        const m = text ? /^\s*schema_version:\s*["']?([0-9.]+)["']?/m.exec(text) ?? /"schema_version":\s*"([0-9.]+)"/.exec(text) : null;
+        if (m && (highest === undefined || versionAtLeast(m[1], highest)))
+            highest = m[1];
+    }
+    return { highest };
+}
+/**
+ * The commit at which an archive entered the history HEAD integrates: the oldest commit on HEAD's first-parent chain
+ * that adds it. A change archived on a branch and merged in enters at the merge, so its first parent is the target
+ * state the change was integrated over, not the branch's own older parent. Null when the archive is not committed.
+ */
+async function integratedAt(repo, path) {
+    try {
+        const out = (await execFileAsync("git", ["-C", repo, "log", "--first-parent", "--diff-filter=A", "--format=%H", "--", path], { maxBuffer: 64 * 1024 * 1024 })).stdout.trim();
+        return out === "" ? null : out.split("\n").at(-1);
+    }
+    catch {
+        return null;
+    }
+}
+/** The agreement-record schema this SDD shipped at a commit (its working tree when the commit is null). */
+async function shippedRecordSchema(repo, commit) {
+    const path = "docs/method/foundations/schemas/agreement-record-schema.yaml";
+    const text = commit ? await gitShow(repo, commit, path) : await readText(join(repo, path));
+    return text ? /^schema_version:\s*"([0-9.]+)"/m.exec(text)?.[1] : undefined;
+}
+/** Files under a directory, relative to it. */
+async function listFiles(dir, rel = "") {
+    const out = [];
+    let entries;
+    try {
+        entries = await readdir(join(dir, rel), { withFileTypes: true });
+    }
+    catch {
+        return out;
+    }
+    for (const e of entries) {
+        const r = rel === "" ? e.name : `${rel}/${e.name}`;
+        if (e.isDirectory())
+            out.push(...(await listFiles(dir, r)));
+        else
+            out.push(r);
+    }
+    return out;
+}
+/**
+ * Where a work order's repository is checked out: the SDD itself for the SDD's own work order (its repository id is
+ * the SDD's sdd_id), else a checkout beside the SDD (../<repo>). The SDD's own commits are always at hand, wherever
+ * the SDD is mounted, so its work order never depends on a sibling directory's name.
+ */
+function checkoutDir(sddRepo, codeRepo, ownId) {
+    return ownId !== "" && codeRepo === ownId ? sddRepo : join(sddRepo, "..", codeRepo);
+}
+/** A work order repository's checkout, when there is one. */
+async function codeCheckout(sddRepo, codeRepo, ownId) {
+    const dir = checkoutDir(sddRepo, codeRepo, ownId);
+    try {
+        await execFileAsync("git", ["-C", dir, "rev-parse", "--git-dir"]);
+        return dir;
+    }
+    catch {
+        return null;
+    }
+}
+/** Whether two commits of a work order's repository, in its checkout, have one tree. */
+async function sameTree(sddRepo, codeRepo, ownId, a, b) {
+    const dir = checkoutDir(sddRepo, codeRepo, ownId);
+    try {
+        const [x, y] = await Promise.all([a, b].map(async (c) => (await execFileAsync("git", ["-C", dir, "rev-parse", `${c}^{tree}`])).stdout.trim()));
+        return x === y ? "same" : "differs";
+    }
+    catch {
+        return "unresolved";
+    }
+}
+export async function checkBehaviourStore(repo, options = {}) {
+    const today = options.today ?? new Date().toISOString().slice(0, 10);
     if (!(await exists(join(repo, STORE_DIR)))) {
         return { exitCode: 0, stdout: `[N/A] no behaviour store (${STORE_DIR}/) in this repository\n` };
     }
     const lines = [];
     const failures = [];
+    const warnings = [];
+    // The SDD's own id: a work order for the SDD's own repository is checked in the SDD itself.
+    let ownId = "";
+    try {
+        const m = parseDocument((await readText(join(repo, ".sdd", "sdd-manifest.yaml"))) ?? "").toJS();
+        ownId = String(m?.sdd_id ?? "");
+    }
+    catch {
+        // the manifest check reports an unreadable manifest
+    }
     // 1. records
     const records = new Map();
     let recordFiles = [];
@@ -244,6 +419,8 @@ export async function checkBehaviourStore(repo) {
     const open = (await dirs(join(repo, STORE_DIR, "changes"))).filter((d) => d !== "archive");
     let started = 0;
     let staleChecked = 0;
+    let contentChecked = 0;
+    let kindsChecked = 0;
     for (const change of open) {
         const dir = `${STORE_DIR}/changes/${change}`;
         const tasks = await readText(join(repo, dir, "tasks.md"));
@@ -262,19 +439,115 @@ export async function checkBehaviourStore(repo) {
             else if (lastGateLine(gate) !== "GATE: CLEAR")
                 failures.push(`${dir}: has completed tasks but gate-0.md ends "${lastGateLine(gate)}", not "GATE: CLEAR"`);
         }
+        if (record && !versionAtLeast(record.schemaVersion, "1.1.0") && (record.status === "agreed" || record.status === "proposed")) {
+            failures.push(`${record.file}: an open change's record must declare schema_version "1.1.0" or later (it has ${JSON.stringify(record.schemaVersion ?? null)}); the agreed-content, test-plan and verdict-evidence rules read it (agreement-record schema 1.1.0)`);
+        }
         if (record?.status === "agreed" && record.commit) {
-            for (const spec of await targetedSpecs(repo, dir)) {
-                staleChecked++;
-                const r = await gitDiffQuiet(repo, record.commit, spec);
-                if (r === "changed")
-                    failures.push(`${dir}: STALE: ${spec} changed since the agreed commit ${record.commit}`);
-                if (r === "unresolved")
-                    failures.push(`${dir}: stale check unresolved: commit ${record.commit} is not in this clone's history (a shallow clone cannot run it)`);
+            // One baseline for both checks: what was agreed, at the latest amendment's commit where one re-bound the content.
+            const agreedAt = record.amendCommit ?? record.commit;
+            const resolves = await commitResolves(repo, agreedAt);
+            const targeted = await targetedSpecs(repo, dir);
+            if (!resolves && targeted.length > 0) {
+                failures.push(`${dir}: stale check unresolved: commit ${agreedAt} is not in this clone's history (a shallow clone cannot run it)`);
+            }
+            // 3. stale, per requirement (M-ADR 0223 §4.5, §4.10): a change is stale when a requirement it targets moved since
+            // agreement, not when another requirement of the same spec did.
+            if (resolves) {
+                for (const spec of targeted) {
+                    const feature = spec.split("/").at(-2);
+                    const delta = (await readText(join(repo, dir, "specs", feature, "spec.md"))) ?? "";
+                    const then = (await gitShow(repo, agreedAt, spec)) ?? "";
+                    const now = (await gitShow(repo, "HEAD", spec)) ?? "";
+                    for (const name of targetNames(delta)) {
+                        staleChecked++;
+                        const before = requirementBlock(then, name);
+                        const after = requirementBlock(now, name);
+                        if (before === null)
+                            failures.push(`${dir}: stale check unresolved: requirement "${name}" of ${feature} is not in the living spec at the agreed commit ${agreedAt}`);
+                        else if (after !== before)
+                            failures.push(`${dir}: STALE: requirement "${name}" of ${feature} ${after === null ? "has left" : "changed in"} ${spec} since the agreed commit ${agreedAt}`);
+                    }
+                }
+            }
+            // Agreement binds the content approved (M-ADR 0222 §4.6 as amended): the change's own artefacts equal their state
+            // at the pinned commit, the latest recorded amendment's or the agreement's.
+            const base = record.amendCommit ?? record.commit;
+            if (!(await commitResolves(repo, base))) {
+                failures.push(`${dir}: agreed content unresolved: commit ${base} is not in this clone's history`);
+            }
+            else {
+                const then = (await gitFiles(repo, base, dir)).filter(boundFile);
+                const now = (await gitFiles(repo, "HEAD", dir)).filter(boundFile);
+                if (then.length === 0) {
+                    failures.push(`${dir}: agreed content unresolved: the pinned commit ${base} holds no ${dir}/; pin the commit that holds the agreed change`);
+                }
+                else {
+                    contentChecked++;
+                    for (const f of [...new Set([...then, ...now])].sort()) {
+                        const a = await gitShow(repo, base, `${dir}/${f}`);
+                        const b = await gitShow(repo, "HEAD", `${dir}/${f}`);
+                        if (a === null || b === null || normaliseBound(f, a) !== normaliseBound(f, b)) {
+                            const what = `${dir}: AGREED CONTENT CHANGED: ${f} ${a === null ? "was added" : b === null ? "was removed" : "differs"} since ${base}, with no amendment recording a commit and an approver; amend the agreement or renew it (M-ADR 0222 §4.6)`;
+                            if (structuralFile(f) && !STRUCTURE_ENFORCED)
+                                warnings.push(`${what}; a structural delta, report only while M-ADR 0230 is Proposed`);
+                            else
+                                failures.push(what);
+                        }
+                    }
+                }
+            }
+        }
+        // A test plan's kinds (M-ADR 0223 §4.4 as amended): changed scenarios go red then green, carried ones stay green.
+        if (versionAtLeast(record?.schemaVersion, "1.1.0") && record?.status === "agreed") {
+            const plan = await readText(join(repo, dir, "test-plan.md"));
+            if (plan !== null) {
+                const header = testPlanHeader(plan);
+                const col = (name) => header.indexOf(name);
+                if (col("kind") < 0)
+                    failures.push(`${dir}/test-plan.md: the scenario table has no Kind column (changed | carried)`);
+                else {
+                    for (const row of testPlanMapping(plan)) {
+                        const cell = row[col("requirement")] ?? "";
+                        const scen = row[col("scenario")] ?? "";
+                        const kind = (row[col("kind")] ?? "").toLowerCase();
+                        // `<feature>::<name>` names one feature's requirement; a bare name is read in every feature the change touches.
+                        const q = /^(.+?)::(.+)$/.exec(cell);
+                        const req = q ? q[2] : cell;
+                        let expected = null;
+                        const kinds = new Map();
+                        for (const feature of await dirs(join(repo, dir, "specs"))) {
+                            if (q && feature !== q[1])
+                                continue;
+                            const delta = (await readText(join(repo, dir, "specs", feature, "spec.md"))) ?? "";
+                            const k = scenarioKind(delta, await readText(join(repo, STORE_DIR, "specs", feature, "spec.md")), req, scen);
+                            if (k)
+                                kinds.set(feature, k);
+                        }
+                        if (kinds.size > 1) {
+                            failures.push(`${dir}/test-plan.md: "${cell}" / "${scen}" names a requirement ${kinds.size} features in the change have (${[...kinds.keys()].join(", ")}); qualify it as <feature>::<name>`);
+                            continue;
+                        }
+                        expected = [...kinds.values()][0] ?? null;
+                        if (expected === null) {
+                            failures.push(`${dir}/test-plan.md: "${cell}" / "${scen}" names no scenario the change's deltas hold; a misnamed row is not checked, so it fails`);
+                            continue;
+                        }
+                        kindsChecked++;
+                        if (kind !== expected)
+                            failures.push(`${dir}/test-plan.md: "${req}" / "${scen}" is ${expected} against the living spec, and the plan says ${JSON.stringify(kind)}`);
+                        const before = col("before") >= 0 ? (row[col("before")] ?? "") : "";
+                        if (before !== "" && expected === "changed" && !/fail|red/i.test(before))
+                            failures.push(`${dir}/test-plan.md: "${req}" / "${scen}" is changed, so its test fails before the code; the scenario table's Before cell says ${JSON.stringify(before)}`);
+                        if (before !== "" && expected === "carried" && !/pass|green/i.test(before))
+                            failures.push(`${dir}/test-plan.md: "${req}" / "${scen}" is carried, so its test passes before the code as regression; the scenario table's Before cell says ${JSON.stringify(before)}`);
+                    }
+                }
             }
         }
     }
     lines.push(`agreement: ${open.length} open change(s), ${started} with completed tasks`);
-    lines.push(staleChecked === 0 ? "stale: vacuous (no open agreed change modifies, removes or renames a requirement)" : `stale: ${staleChecked} targeted living spec(s) checked against their agreed commits`);
+    lines.push(staleChecked === 0 ? "stale: vacuous (no open agreed change modifies, removes or renames a requirement)" : `stale: ${staleChecked} targeted requirement(s) checked against their agreed commits`);
+    lines.push(`agreed content: ${contentChecked} open agreed change(s) compared with their pinned commits; ${kindsChecked} test-plan scenario kind(s) checked`);
     // 8. overlap: two open, agreed changes never name the same requirement of one living spec (M-ADR 0223 §4.10).
     // A name counts whether the delta adds, modifies, removes or renames it (both FROM and TO). Proposals may overlap.
     const claimed = new Map();
@@ -301,6 +574,8 @@ export async function checkBehaviourStore(repo) {
     // 4. archived changes
     const archived = await dirs(join(repo, STORE_DIR, "changes", "archive"));
     let baselines = 0;
+    let verdictsEvidenced = 0;
+    let pinsUnverified = 0;
     for (const name of archived) {
         const dir = `${STORE_DIR}/changes/archive/${name}`;
         if (await exists(join(repo, dir, "baseline-evidence.md"))) {
@@ -318,10 +593,167 @@ export async function checkBehaviourStore(repo) {
         if (record.verdict?.result !== "PASS")
             failures.push(`${record.file}: change is archived but verdict.result is ${JSON.stringify(record.verdict?.result)}, not PASS`);
         const vr = record.verdict?.record;
-        if (typeof vr !== "string" || !(await exists(join(repo, vr))))
+        const verdictText = typeof vr === "string" ? await readText(join(repo, vr)) : null;
+        if (verdictText === null)
             failures.push(`${record.file}: verdict.record ${JSON.stringify(vr)} does not name an existing file`);
+        // The record's verdict and the verdict file's agree (M-ADR 0223 §4.6 as amended), for every archived change.
+        const stated = verdictText === null ? null : verdictLine(verdictText);
+        if (stated !== null && stated !== record.verdict?.result)
+            failures.push(`${record.file}: the record says ${JSON.stringify(record.verdict?.result)} and ${vr} says ${stated}`);
+        // Which rules hold this record is decided from history, not from what the record says of itself now: the highest
+        // version any committed version of it declared, and the agreement-record schema the SDD shipped when the change
+        // was archived. A record cannot leave the 1.1.0 rules by declaring an older version.
+        const archivedAt = await integratedAt(repo, dir);
+        const ever = await recordVersionEver(repo, record.file);
+        if (ever === null) {
+            failures.push(`${record.file}: has no history in this clone, so which record rules hold it is unresolved (a record with no history is not taken to be legacy); run from a full clone`);
+            continue;
+        }
+        const everVersion = ever.highest;
+        const shipped = await shippedRecordSchema(repo, archivedAt);
+        if (versionAtLeast(everVersion, "1.1.0") && !versionAtLeast(record.schemaVersion, "1.1.0")) {
+            failures.push(`${record.file}: must declare schema_version "1.1.0" or later (it declares ${JSON.stringify(record.schemaVersion ?? null)}), because a committed version of it declared ${everVersion}; once a record has entered the 1.1.0 rules, declaring an older version does not take it out`);
+        }
+        else if (versionAtLeast(shipped, "1.1.0") && !versionAtLeast(record.schemaVersion, "1.1.0")) {
+            failures.push(`${record.file}: the change was archived when this SDD shipped agreement-record schema ${shipped}, so its record must declare schema_version "1.1.0" or later and carry the evidence`);
+        }
+        if (!(versionAtLeast(record.schemaVersion, "1.1.0") || versionAtLeast(everVersion, "1.1.0") || versionAtLeast(shipped, "1.1.0")))
+            continue;
+        verdictsEvidenced++;
+        // An archived change was agreed: the archive is not a way round the agreement checks.
+        if (record.status !== "agreed")
+            failures.push(`${record.file}: the change is archived, but its record is ${JSON.stringify(record.status)}, not agreed; an archive needs an approval, a pinned commit and a CLEAR Gate 0`);
+        const base = record.amendCommit ?? record.commit;
+        if (base && (await commitResolves(repo, base))) {
+            // The archived content is the agreed content (M-ADR 0222 §4.6): an edit made after agreement and carried into the
+            // archive fails as it would have while the change was open.
+            const openDir = `${STORE_DIR}/changes/${change}`;
+            const then = (await gitFiles(repo, base, openDir)).filter(boundFile);
+            const nowFiles = (await listFiles(join(repo, dir))).filter(boundFile);
+            if (then.length === 0)
+                failures.push(`${dir}: agreed content unresolved: the pinned commit ${base} holds no ${openDir}/`);
+            for (const f of [...new Set([...then, ...nowFiles])].sort()) {
+                if (then.length === 0)
+                    break;
+                const a = await gitShow(repo, base, `${openDir}/${f}`);
+                const b = await readText(join(repo, dir, f));
+                if (a === null || b === null || normaliseBound(f, a) !== normaliseBound(f, b)) {
+                    const what = `${dir}: AGREED CONTENT CHANGED: ${f} ${a === null ? "was added" : b === null ? "was removed" : "differs"} from what was agreed at ${base}, with no amendment recording a commit and an approver (M-ADR 0222 §4.6)`;
+                    if (structuralFile(f) && !STRUCTURE_ENFORCED)
+                        warnings.push(`${what}; a structural delta, report only while M-ADR 0230 is Proposed`);
+                    else
+                        failures.push(what);
+                }
+            }
+            // Stale at archive: the requirements the change targets, just before it archived, are as they were agreed. After
+            // the archive the living specs hold the change's own deltas, so the comparison is with the state before it.
+            const before = archivedAt ? `${archivedAt}^` : "HEAD";
+            for (const feature of await dirs(join(repo, dir, "specs"))) {
+                const delta = (await readText(join(repo, dir, "specs", feature, "spec.md"))) ?? "";
+                const spec = `${STORE_DIR}/specs/${feature}/spec.md`;
+                const agreedSpec = (await gitShow(repo, base, spec)) ?? "";
+                const priorSpec = (await gitShow(repo, before, spec)) ?? "";
+                for (const name of targetNames(delta)) {
+                    const x = requirementBlock(agreedSpec, name);
+                    const y = requirementBlock(priorSpec, name);
+                    if (x !== null && y !== x)
+                        failures.push(`${dir}: STALE AT ARCHIVE: requirement "${name}" of ${feature} had changed since the agreed commit ${base} when the change archived`);
+                }
+            }
+        }
+        else if (base) {
+            failures.push(`${dir}: agreed content unresolved: commit ${base} is not in this clone's history`);
+        }
+        // Records on schema 1.1.0 carry the evidence, checked here, not declared.
+        if (verdictText !== null && stated === null)
+            failures.push(`${vr}: states no verdict line (\`Verdict: PASS\` or \`Verdict: FAIL\`)`);
+        const v = record.verdict ?? {};
+        const by = typeof v.judged_by === "string" ? v.judged_by.trim() : "";
+        const applier = typeof v.applied_by === "string" ? v.applied_by.trim() : "";
+        if (by === "" || applier === "")
+            failures.push(`${record.file}: verdict names ${by === "" ? "no judged_by" : ""}${by === "" && applier === "" ? " and " : ""}${applier === "" ? "no applied_by" : ""} (M-ADR 0223 §4.5: the judge is independent of the applier)`);
+        else if (by.toLowerCase() === applier.toLowerCase())
+            failures.push(`${record.file}: verdict.judged_by and verdict.applied_by are both "${by}"; the judge is independent of the applier (M-ADR 0223 §4.5)`);
+        // The repositories whose evidence is required come from the change itself, not from the record's list: each task
+        // group's repository, and a work order for every requirement the deltas add or modify.
+        const groups = taskGroups((await readText(join(repo, dir, "tasks.md"))) ?? "");
+        const recorded = new Set(record.workOrders.map((w) => w.repo));
+        for (const g of groups)
+            if (!recorded.has(g.repo))
+                failures.push(`${record.file}: tasks.md has a work order for ${g.repo} and the record's work_orders do not; its evidence cannot be checked`);
+        // Requirement names are unique within a feature, not across a change: a work order names `<feature>::<name>`,
+        // or a bare name only one feature in the change has (schema 5.0.0). An ambiguous bare name implements nothing.
+        const built = [];
+        for (const feature of await dirs(join(repo, dir, "specs"))) {
+            const delta = (await readText(join(repo, dir, "specs", feature, "spec.md"))) ?? "";
+            for (const r of parseRequirements(delta))
+                if (r.operation === "ADDED" || r.operation === "MODIFIED")
+                    built.push({ feature, name: r.name, operation: r.operation });
+        }
+        const covers = (entries, d) => entries.some((e) => resolveImplements(built, e).matches.some((m) => m.feature === d.feature && m.name === d.name));
+        for (const w of record.workOrders) {
+            for (const e of w.implements) {
+                const { ambiguous } = resolveImplements(built, e);
+                if (ambiguous.length > 0)
+                    failures.push(`${record.file}: the work order for ${w.repo} implements "${e}", a name ${ambiguous.length} features in the change share (${ambiguous.join(", ")}); qualify it as <feature>::<name>`);
+            }
+        }
+        for (const d of built) {
+            if (!covers(record.workOrders.flatMap((w) => w.implements), d)) {
+                failures.push(`${record.file}: requirement "${d.name}" (${d.feature}) is ${d.operation} by the change and no work order implements it${covers(groups.flatMap((g) => g.implements), d) ? " (tasks.md says one does; the record's work_orders do not)" : ""}`);
+            }
+        }
+        const workOrders = [...record.workOrders, ...groups.filter((g) => !recorded.has(g.repo))];
+        const judged = (v.judged && typeof v.judged === "object" ? v.judged : {});
+        const merged = (v.merged && typeof v.merged === "object" ? v.merged : {});
+        const plan = (await readText(join(repo, dir, "test-plan.md"))) ?? "";
+        const ledger = plan.split(/^##\s+Ledger\b/m)[1]?.split(/^##\s/m)[0] ?? "";
+        for (const wo of workOrders) {
+            const j = judged[wo.repo];
+            const mList = merged[wo.repo];
+            const m = Array.isArray(mList) ? mList.at(-1) : mList;
+            if (wo.implements.length > 0 && !ledger.includes(wo.repo))
+                failures.push(`${dir}/test-plan.md: the ledger does not name ${wo.repo}, which implements requirements; the verdict has no red/green evidence for it`);
+            if (!isCommit(j)) {
+                failures.push(`${record.file}: verdict.judged ${j === undefined ? "names no commit" : `names ${JSON.stringify(j)}, not a commit`} for ${wo.repo}; the judge judges each repository's candidate commit before it merges (M-ADR 0223 §4.5)`);
+                continue;
+            }
+            if (!isCommit(m)) {
+                failures.push(`${record.file}: verdict.merged ${m === undefined ? "names no commit" : `names ${JSON.stringify(m)}, not a commit`} for ${wo.repo}`);
+                continue;
+            }
+            const checkout = await codeCheckout(repo, wo.repo, ownId);
+            if (checkout) {
+                for (const c of [j, m])
+                    if (!(await commitResolves(checkout, c)))
+                        failures.push(`${record.file}: ${wo.repo} has no commit ${c} in the checkout beside the SDD`);
+            }
+            else if (sameCommit(j, m))
+                pinsUnverified++;
+            if (!sameCommit(j, m)) {
+                const cmp = await sameTree(repo, wo.repo, ownId, j, m);
+                if (cmp === "differs")
+                    failures.push(`${record.file}: ${wo.repo} merged ${m}, whose tree differs from the judged ${j}: what merged is not what was judged`);
+                if (cmp === "unresolved")
+                    failures.push(`${record.file}: ${wo.repo} merged ${m}, not the judged ${j}, and their trees could not be compared (no checkout beside the SDD holds both): unresolved`);
+            }
+        }
     }
-    lines.push(`verdicts: ${archived.length} archived change(s), ${baselines} baseline(s), ${archived.length - baselines} needing a PASS verdict`);
+    lines.push(`verdicts: ${archived.length} archived change(s), ${baselines} baseline(s), ${archived.length - baselines} needing a PASS verdict, ${verdictsEvidenced} held to record schema 1.1.0 with their evidence checked`);
+    // A pin that cannot be resolved is a partial result, never a pass: a [WARN] the run counts as warned, and a failure
+    // under --strict, which is how the judge runs it, with the code repositories checked out (M-ADR 0223 §4.6).
+    if (pinsUnverified > 0)
+        warnings.push(`verdict pins: ${pinsUnverified} repository pin pair(s) are well-formed and consistent, but no checkout beside the SDD resolves them, so the verified-commit claim is unconfirmed here; run with the code repositories checked out beside the SDD, and with --strict where the claim must hold`);
+    // Conditions an agreement was made on (M-ADR 0222 §4.6 as amended): each recorded in full, none open past its date.
+    let conditions = 0;
+    for (const rec of records.values()) {
+        for (const [i, c] of rec.conditions.entries()) {
+            conditions++;
+            for (const p of conditionProblems(c ?? {}, today, rec.status))
+                failures.push(`${rec.file}: conditions[${i}]: ${p}`);
+        }
+    }
+    lines.push(`conditions: ${conditions} agreement condition(s)`);
     // 5. surfaces, and 6. what each baseline may change, in archive order
     const archiveRel = `${STORE_DIR}/changes/archive`;
     const { order, ties, history } = await orderArchives(repo, archiveRel, archived);
@@ -351,6 +783,10 @@ export async function checkBehaviourStore(repo) {
     let scopeUnresolved = 0;
     const servedBy = baselines > 0 ? await catalogueContracts(repo) : null;
     let surfacesChecked = 0;
+    // A baseline whose every requirement has since left the living specs (removed, or its spec retired) records a
+    // surface that no longer exists; its Surfaces list is history, not checked against today's catalogue, or a
+    // retired surface could never drop its contract.
+    const historical = await historicalBaselines(repo, archiveRel, order);
     const lastTouch = new Map();
     let scopeChecked = 0;
     for (const name of order) {
@@ -363,7 +799,10 @@ export async function checkBehaviourStore(repo) {
                 failures.push(`${dir}/baseline-evidence.md: no **Surfaces:** list; name every contract the observed repositories serve, covered at transport or excluded with a reason`);
             for (const p of parsed.problems)
                 failures.push(`${dir}/baseline-evidence.md: Surfaces: ${p}`);
-            if (parsed.present) {
+            if (parsed.present && historical.has(name)) {
+                // history: see historicalBaselines
+            }
+            else if (parsed.present) {
                 if (servedBy === null) {
                     failures.push(`${dir}/baseline-evidence.md: Surfaces cannot be cross-checked: catalogues/repo_contract.csv or catalogues/contracts.csv is missing; build the catalogue`);
                 }
@@ -417,7 +856,7 @@ export async function checkBehaviourStore(repo) {
         }
     }
     const unseen = servedBy === null ? "" : `; repositories with no catalogue contracts: ${[...new Set(await observedInAll(repo, archiveRel, order))].filter((r) => (servedBy.get(r) ?? []).length === 0).join(", ") || "none"}`;
-    lines.push(baselines === 0 ? "surfaces: vacuous (no baseline)" : `surfaces: ${baselines} baseline(s), ${surfacesChecked} served contract(s) checked against catalogues/repo_contract.csv${unseen}`);
+    lines.push(baselines === 0 ? "surfaces: vacuous (no baseline)" : `surfaces: ${baselines} baseline(s), ${surfacesChecked} served contract(s) checked against catalogues/repo_contract.csv${unseen}${historical.size ? `; ${historical.size} historical baseline(s) not checked (every requirement they baselined has left the living specs)` : ""}`);
     lines.push(scopeChecked === 0 ? "scope: vacuous (no baseline removes, modifies or renames a requirement)" : `scope: ${scopeChecked} requirement(s) a baseline removes, modifies or renames, checked against their lineage`);
     if (!history && archived.length > 0)
         lines.push("order: no git history (not a git work tree, or git log failed), so same-day archives cannot be ordered");
@@ -471,11 +910,60 @@ export async function checkBehaviourStore(repo) {
     const population = recordFiles.length + open.length + archived.length;
     const body = lines.map((l) => `  ${l}`).join("\n") + "\n";
     if (failures.length > 0) {
-        return { exitCode: 1, stdout: body + failures.map((f) => `[FAIL] ${f}`).join("\n") + "\n" };
+        return { exitCode: 1, stdout: body + warnings.map((w) => `[WARN] ${w}\n`).join("") + failures.map((f) => `[FAIL] ${f}`).join("\n") + "\n" };
     }
     if (population === 0)
         return { exitCode: 0, stdout: body + `[N/A] the behaviour store has no changes and no agreement records yet\n` };
-    return { exitCode: 0, stdout: body + "[PASS] behaviour store: records, agreement, stale, overlap, verdict, surfaces, scope, feature and schema checks hold\n" };
+    const warned = warnings.map((w) => `[WARN] ${w}\n`).join("");
+    return { exitCode: 0, stdout: body + warned + "[PASS] behaviour store: records, agreement, stale, overlap, verdict, surfaces, scope, feature and schema checks hold" + (warnings.length ? ", with the warnings above" : "") + "\n" };
+}
+/**
+ * Baselines whose requirements have all left the living specs. Each baseline's requirements are followed forward
+ * through every later archive in order (a REMOVED drops one, a RENAMED carries it to its new name); the baseline is
+ * historical when none of what remains is a requirement of a living spec today. A baseline that names no
+ * requirement is never historical.
+ */
+async function historicalBaselines(repo, archiveRel, order) {
+    const living = new Set();
+    for (const feature of await dirs(join(repo, STORE_DIR, "specs"))) {
+        const text = (await readText(join(repo, STORE_DIR, "specs", feature, "spec.md"))) ?? "";
+        for (const r of parseRequirements(text))
+            living.add(`${feature}::${r.name}`);
+    }
+    const deltas = [];
+    for (const name of order) {
+        const specs = [];
+        for (const feature of await dirs(join(repo, archiveRel, name, "specs"))) {
+            specs.push({ feature, text: (await readText(join(repo, archiveRel, name, "specs", feature, "spec.md"))) ?? "" });
+        }
+        deltas.push({ name, baseline: await exists(join(repo, archiveRel, name, "baseline-evidence.md")), specs });
+    }
+    const out = new Set();
+    deltas.forEach((d, i) => {
+        if (!d.baseline)
+            return;
+        const keys = new Set();
+        for (const sp of d.specs)
+            for (const r of parseRequirements(sp.text))
+                if (r.operation !== "REMOVED")
+                    keys.add(`${sp.feature}::${r.name}`);
+        if (keys.size === 0)
+            return;
+        for (const later of deltas.slice(i + 1)) {
+            for (const sp of later.specs) {
+                for (const r of parseRequirements(sp.text))
+                    if (r.operation === "REMOVED")
+                        keys.delete(`${sp.feature}::${r.name}`);
+                for (const p of renamePairs(sp.text)) {
+                    if (keys.delete(`${sp.feature}::${p.from}`))
+                        keys.add(`${sp.feature}::${p.to}`);
+                }
+            }
+        }
+        if (![...keys].some((k) => living.has(k)))
+            out.add(d.name);
+    });
+    return out;
 }
 /** Per repository, the contracts the catalogue says it serves (repo_contract ⋈ contracts.spec_path); null when either file is missing. */
 async function catalogueContracts(repo) {