@sdd-method/author-cli 0.2.0 → 0.3.0

package/dist/lib/catalogue/builders/external-system-exemption.js

@@ -1,4 +1,4 @@
-// external_system_exemption builder — M-ADR 0189 §4.6 (gov WS15).
+// external_system_exemption builder — M-ADR 0189 §4.6.
 //
 // Emits one row per entry in `orchestration/external-system-exemptions.yaml`:
 //

package/dist/lib/catalogue/builders/feature-contract.js

@@ -7,9 +7,7 @@
 // pairs are deduplicated with a `[finding] inferred` log line recording that
 // both paths produced the same edge.
 //
-// Added in schema 2.3.0 — see catalogue-metamodel.md §"Edge catalogue status"
-// and the companion plan
-// `content/plans/document-non-catalogued-artefacts-and-add-feature-contract.md`.
+// Added in schema 2.3.0 — see catalogue-metamodel.md §"Edge catalogue status".
 export function buildFeatureContract(inputs) {
     const seen = new Map();
     // Path 1 (forward): capability_feature ⋈ capability_contract on capability_id.

package/dist/lib/catalogue/builders/feature-grounding.js

@@ -107,8 +107,7 @@ export async function buildFeatureGrounding(inputs) {
             // feature_repo and feature_service edges: emit unconditionally per
             // ADR 0143 §2 (these are the source's unique contribution; nothing
             // else carries per-row code-mapping). Pre-0.30.2 the collision skip
-            // dropped these edges too — bug fixed per
-            // `coordination/feature-grounding-collision-edges-coordination.md`.
+            // dropped these edges too — bug fixed.
             if (featureRowCollides) {
                 // ONE CHECK, TWO MEANINGS — split them, because they are not the same
                 // event and only one of them is a defect.

package/dist/lib/catalogue/builders/feature-groups.js

@@ -1,7 +1,6 @@
 // FeatureGroups discoverer — emits `feature_groups.csv` rows from
 // hierarchical `feature-tree.md` files.
 //
-// Per Q7.2 resolution (adopt-canonical-catalogue-builder.md §7.2),
 // FeatureGroups are first-class entities. This builder consumes the
 // shared `feature-tree-walker` and emits one row per H2/H3 heading
 // outside fenced code blocks.

package/dist/lib/catalogue/builders/feature-subscription-channels.js

@@ -2,9 +2,8 @@
 // `subscription_channels:` entry in any `reverse-evidence/feature-grounding-evidence.yaml`
 // file in the SDD. Added in schema 2.9.0.
 //
-// Per resolved decision §1 of `content/plans/v0-9-0-cohort-sweep-derived-bundle.md`
-// (see also `docs/method/methods/reverse/rubrics/reverse-application-evidence-quality.md`
-// per-feature slot vocabulary): `subscription_channels:` is a peer of
+// Per the per-feature slot vocabulary in
+// `docs/method/methods/reverse/rubrics/reverse-application-evidence-quality.md`: `subscription_channels:` is a peer of
 // `graphql_operations:` in the per-feature evidence shape — `graphql_operations:`
 // carries the operation names declared in the GraphQL schema; this builder
 // captures the channel/topic layer (AppSync WebSocket, Pekko WS, MQTT, SSE,

package/dist/lib/catalogue/builders/feature-tree-walker.js

@@ -162,7 +162,7 @@ const SERVICE_ID_RE = /^[a-z0-9][a-z0-9_-]*$/;
 /**
  * Parse the `## Feature Services` section of a `feature-tree.md` body (the
  * application-product authoring surface for `feature_service`, per M-ADR
- * 0157 — see WS0c of `catalogue-coverage-invariants.md`). Table shape:
+ * 0157). Table shape:
  *
  *     | Feature | Services |
  *     |---------|----------|

package/dist/lib/catalogue/builders/features.js

@@ -4,8 +4,8 @@
 //      Folder→capability mapping uses (a) the traceability manifest's
 //      `capability.feature_directory` field — authoritative when a
 //      capability spec uses a folder name that differs from the
-//      canonical capability_id (e.g. capability_id "alerts-rules-engine"
-//      with feature_directory pointing at "features/alerts-rules/") —
+//      canonical capability_id (e.g. capability_id "gift-card-rules-engine"
+//      with feature_directory pointing at "features/gift-card-rules/") —
 //      then (b) the folder name itself when it equals a known capability_id.
 //      id format: `{capability_id}-{feature-slug}`.
 //
@@ -26,8 +26,7 @@
 // then walker (2) (standalone specs), then walker (3) (bullets). When
 // a bullet's id is already in `seen` from a standalone spec the spec
 // wins — divergence finding fires for the bullet. This matches the
-// "standalone is more authoritative than bullet inventory" rule from
-// plan extract-feature-tree-bullets.md §1.4.
+// "standalone is more authoritative than bullet inventory" rule.
 import { readdir, readFile } from "node:fs/promises";
 import { basename, join, relative, sep } from "node:path";
 import { featureGroupId, findFeatureTreeFile, walkFeatureTree, } from "./feature-tree-walker.js";

package/dist/lib/catalogue/builders/glossary-xref.js

@@ -342,7 +342,7 @@ function collectPairs(raw) {
     return out;
 }
 function resolveTerm(raw, inputs) {
-    // Direct id (e.g. "asset-vehicle")
+    // Direct id (e.g. "stock-sku")
     if (inputs.knownGlossaryIds.has(raw))
         return raw;
     // domain:term lookup

package/dist/lib/catalogue/builders/persona-c4system.js

@@ -9,19 +9,19 @@
 // are skipped (no dangling FK). The optional interaction label comes from a
 // `Rel(person, system, "label")` line.
 //
-// `Person_Ext(...)` is discriminated by EVIDENCE, not notation (F10; F9's
-// first fix keyed on notation and broke the external-human case): the
+// `Person_Ext(...)` is discriminated by EVIDENCE, not notation (a
+// discriminator keyed on notation breaks the external-human case): the
 // notation is idiomatic both for a non-human external actor (a device) and
 // for a human legitimately outside the boundary. Whether a persona row
 // resolves is the declaration of humanity — a Person_Ext that resolves
 // emits its edge; one that doesn't is silent (a device is not an authoring
-// gap, and a typo'd human still surfaces through F8's reverse finding on
+// gap, and a typo'd human still surfaces through the reverse finding on
 // the edgeless persona row).
 //
 // `Person(...)` asserts a human, so an unresolved one stays a forward
 // coverage finding.
 //
-// Both directions report (F8, M-ADR 0157 parity + M-ADR 0133 §4.2c
+// Both directions report (M-ADR 0157 parity + M-ADR 0133 §4.2c
 // no-silent-drop): a Person with no persona row is a coverage finding
 // (forward), and a persona with no edge is a coverage finding stating WHY —
 // no system row, no identity-sourcing L1, no Person actors, or no actor
@@ -31,7 +31,7 @@ import { readFile } from "node:fs/promises";
 import { join } from "node:path";
 import { resolveIdentityL1 } from "./c4-l1-candidates.js";
 // `Person(id, "name", "desc")` / `Person_Ext(id, "name", "desc")` — the
-// _Ext capture drives the evidence discriminator (F10; see header).
+// _Ext capture drives the evidence discriminator (see header).
 const PERSON_RE = /Person(_Ext)?\s*\(\s*(\w+)\s*,\s*"([^"]+)"\s*(?:,\s*"([^"]*)")?\s*\)/;
 const REL_RE = /^(?:Bi)?Rel(?:_[A-Za-z]+)?\s*\(\s*(\w+)\s*,\s*(\w+)\s*(?:,\s*"([^"]*)")?/;
 export async function buildPersonaC4System(inputs) {
@@ -65,7 +65,7 @@ export async function buildPersonaC4System(inputs) {
         if (personaId === undefined) {
             // Person_Ext with no persona row: a device or other non-human external
             // actor — silence is correct, and a typo'd human surfaces through the
-            // reverse finding on its edgeless persona row (F10).
+            // reverse finding on its edgeless persona row.
             if (person.external)
                 continue;
             inputs.findings.add("coverage", `persona_c4system: Person "${person.name}" on the L1 diagram has no matching persona row — edge skipped`);
@@ -87,7 +87,7 @@ export async function buildPersonaC4System(inputs) {
     rows.sort((a, b) => String(a["id"]).localeCompare(String(b["id"])));
     return rows;
 }
-// F8 — the reverse direction (M-ADR 0157 parity): every persona that ends
+// The reverse direction (M-ADR 0157 parity): every persona that ends
 // the build without an edge is reported, with the reason. A persona with
 // neither an edge nor a finding is indistinguishable from one that was
 // never considered.

package/dist/lib/catalogue/builders/persona-container.js

@@ -1,17 +1,17 @@
-// persona_container edge builder — M-ADR 0189 F26 §3 (schema 2.34.0).
+// persona_container edge builder — M-ADR 0189 (schema 2.34.0).
 //
 // The L2-granularity companion to persona_c4system: a Rel(...) between a
-// Person and a container had no catalogue and, until F26, no finding —
+// Person and a container had neither a catalogue nor a finding —
 // eleven of one estate's L2s and the bulk of another's 81 unroutable Rels
-// were exactly this class. F26 made the silence loud; this gives the
+// were exactly this class. The unroutable-Rel finding made the silence loud; this gives the
 // loudness a destination.
 //
 // Person entries are file-local (a Person declared in the same diagram as
-// the Rel); containers resolve SDD-wide (F20's rule). Either Rel direction
+// the Rel); containers resolve SDD-wide (container-first). Either Rel direction
 // normalises to persona→container. A Person that matches no persona row is
 // a coverage finding, never a silent skip (the persona_c4system precedent).
-// The syndicated platform L1 is skipped for non-root SDDs (F14); parallel
-// labels concatenate loudly (F25).
+// The syndicated platform L1 is skipped for non-root SDDs; parallel
+// labels concatenate loudly.
 import { readFile } from "node:fs/promises";
 import { collectC4DiagramFiles } from "./c4-external-systems.js";
 import { mergeEdgeLabel } from "./edge-label-merge.js";
@@ -37,11 +37,11 @@ export async function buildPersonaContainer(inputs) {
         }
         if (personNameByEntry.size === 0)
             continue;
-        // F31: only the SDD's OWN system entry is persona_c4system's domain —
+        // Only the SDD's OWN system entry is persona_c4system's domain —
         // that catalogue emits one edge per persona to THE system, nothing
         // else. The 0.89.0 skip silenced person Rels to ANY System(...) entry,
         // a silence delegated to a catalogue that never held those edges
-        // (F5's shape, one tier over): four of an estate's best-authored
+        // (a delegated silence one tier over): four of an estate's best-authored
         // persona edges vanished, while the same file's person→external edge
         // was announced. Own entry = the first System(...) line, mirroring
         // c4-systems' parseSystemLine; every other target takes exits 1/3/4.
@@ -58,17 +58,17 @@ export async function buildPersonaContainer(inputs) {
             if (!m)
                 continue;
             const [, fromEntry, toEntry, label] = m;
-            // F29/F30 — the person tier's exits, designed once. Identify the
+            // The person tier's exits, designed once. Identify the
             // person endpoint (file-local; container resolution wins on a
-            // dual-use id per F20), then route by the OTHER endpoint's kind:
+            // dual-use id), then route by the OTHER endpoint's kind:
             //   local container      → persona_container row
             //   own System(...)      → persona_c4system's domain; silent here
-            //   external             → announced skip (F30): a human using an
+            //   external             → announced skip: a human using an
             //                          external system has no persona-tier
             //                          catalogue YET — it must never transmute
             //                          into sed/ssd, whose semantics are runtime
             //                          calls between software
-            //   anything else        → announced skip (F29): claimed by no
+            //   anything else        → announced skip: claimed by no
             //                          catalogue is said, never silent
             const fromIsContainer = inputs.containerIdByEntryId.has(fromEntry ?? "");
             const toIsContainer = inputs.containerIdByEntryId.has(toEntry ?? "");
@@ -100,8 +100,8 @@ export async function buildPersonaContainer(inputs) {
             if (targetContainer === undefined) {
                 const isExternal = inputs.externalIdByEntryId?.has(targetEntry ?? "") ?? false;
                 inputs.findings.add("coverage", isExternal
-                    ? `persona_container: persona "${personaId}" → external "${inputs.externalIdByEntryId.get(targetEntry ?? "")}"${label ? ` ("${label}")` : ""} — a human using an external system has no persona-tier catalogue; skipped, never transmuted into a system edge (F30)`
-                    : `persona_container: persona "${personaId}" → "${targetEntry}"${label ? ` ("${label}")` : ""} resolves to no container — claimed by no catalogue; skipped (F29)`);
+                    ? `persona_container: persona "${personaId}" → external "${inputs.externalIdByEntryId.get(targetEntry ?? "")}"${label ? ` ("${label}")` : ""} — a human using an external system has no persona-tier catalogue; skipped, never transmuted into a system edge`
+                    : `persona_container: persona "${personaId}" → "${targetEntry}"${label ? ` ("${label}")` : ""} resolves to no container — claimed by no catalogue; skipped`);
                 continue;
             }
             const id = `${personaId}__${targetContainer}`;

package/dist/lib/catalogue/builders/personas.js

@@ -9,8 +9,7 @@
 //   ## Summary
 //   {1-2 sentences}
 //
-// Cross-profile path (per coordination/persona-walker-platform-product-gap-
-// coordination.md, 2026-05-29): the walker reads `personas/` at SDD root
+// Cross-profile path: the walker reads `personas/` at SDD root
 // for every profile. Each SDD's personas/ carries personas at that SDD's
 // scope — for application-product that's app-specific personas, for
 // platform-product that's platform-wide / cross-app personas surfaced as

package/dist/lib/catalogue/builders/product-platform-dependencies.js

@@ -32,7 +32,7 @@
 // The aggregator subsequently joins synchronous rows against platform-side
 // `capability_service` to derive `cross_sdd_platform_capability` edges (per
 // ADR 0134, federation); async rows resolve via the capability leg (no
-// realiser service to join on) and skip the F18 realiser-join.
+// realiser service to join on) and skip the realiser-join.
 //
 // Cross-SDD references (target_capability_id, target_service_id) are
 // declared `external: true` in the schema — per-SDD FK validation
@@ -62,7 +62,7 @@ const FORWARD_REL_PATH = "app-platform-dependencies.yaml";
  * Contract types that denote an ASYNC shared-stream dependency (M-ADR 0192).
  * A dependency of one of these kinds binds to a stream contract published by a
  * capability, not to a synchronous realiser service — so it characteristically
- * has no `service_id`, and the F18 realiser-join does not apply to it at
+ * has no `service_id`, and the realiser-join does not apply to it at
  * aggregation. Kept lowercase; callers normalise before testing.
  */
 export const ASYNC_CONTRACT_TYPES = new Set([

package/dist/lib/catalogue/builders/quality-scores.js

@@ -468,7 +468,7 @@ export async function buildQualityScores(inputs) {
             }
             // Flat headline keys beside a `current:` block are a compatibility
             // shim, and a shim that DISAGREES with the effective record is the
-            // silent-failure shape found live (ledger §3am): an ingestion updated
+            // silent-failure shape found live: an ingestion updated
             // the flat score and left `current:` stale, and the catalogue published
             // the stale value with the right one inches away in the same entry —
             // no complaint anywhere. The disagreement is loud now. scored_at is

package/dist/lib/catalogue/builders/repositories.js

@@ -83,7 +83,7 @@ const ServiceCapabilityExemptionSchema = z
 const ServicesBlockSchema = z.unknown().optional();
 // `additional_context` accepts strings OR loosely-parsed key:value
 // objects (which arise when adopters leave colons unquoted in their
-// YAML — e.g. `- docs/.../ADR 0017: Use WorkOS for Auth.md`). The
+// YAML — e.g. `- docs/.../ADR 0017: Use Acme IdP for Auth.md`). The
 // canonical builder reconstructs the original string downstream.
 const RepoConfigSchema = z.object({
     repo: z.string(),
@@ -117,7 +117,7 @@ const RepoConfigSchema = z.object({
  * Reconstruct a string from a possibly-mis-parsed YAML list entry.
  *
  * Adopters sometimes write list entries with unquoted colons like:
- *   - docs/.../ADR 0017: Use WorkOS for Auth.md
+ *   - docs/.../ADR 0017: Use Acme IdP for Auth.md
  *
  * The YAML parser reads each such entry as a single-key object whose key
  * is the part before the first colon and whose value is the part after.

package/dist/lib/catalogue/builders/screen-tree.js

@@ -112,7 +112,7 @@ function parseStatements(cleanBlock) {
         const id = m[1];
         const rhs = m[2];
         // A component statement's RHS is a call (`Text("Q4")`) or a reference — never a
-        // bare string literal. A line like `action="user-details-changed"` (the block-level
+        // bare string literal. A line like `action="basket-updated"` (the block-level
         // screen_action messaging contract, ADR 0166) matches the statement shape with
         // id=`action`; skip it so it isn't lexed as a phantom component (and so a node
         // carrying an `action=` attr doesn't pick it up as a spurious child).

package/dist/lib/catalogue/builders/screens.js

@@ -23,8 +23,7 @@
 // `action="..."` declarations -> screen_action. The frontmatter supplies the
 // catalogue keys + FK lists. This is the forward / authored path; the reverse
 // toolkit projects an app's router + component tree into the same shape (the
-// upstream step that produces these artefacts — see
-// research/adr-0166-prototypes/ for the Phase Pre validation).
+// upstream step that produces these artefacts).
 //
 // Per ADR 0135 the rows are identical regardless of authoring direction; only
 // the `source` discriminator differs (screen-spec vs screen-extraction).
@@ -305,8 +304,8 @@ function isTemplate(name) {
         lower.endsWith("-spec-template.md"));
 }
 // entity-style slug: ALLCAPS-then-Pascal split so naming variation across
-// `MyEcoDrive` / `map_tracking_container` / `TE_driver` resolves stably
-// (per the Phase Pre real-menu finding; mirrors entitySlug).
+// `GiftCardHub` / `order_tracking_container` / `POS_checkout` resolves stably
+// (a measured real-menu finding; mirrors entitySlug).
 function screenSlug(s) {
     return s
         .replace(/([A-Z]+)([A-Z][a-z])/g, "$1-$2")

package/dist/lib/catalogue/builders/system-external-dependency.js

@@ -14,7 +14,7 @@ import { mergeEdgeLabel } from "./edge-label-merge.js";
 // Any C4-PlantUML relationship macro: Rel, Rel_U/D/L/R, BiRel, Rel_Back, etc.
 // Capture the first two positional args (from, to) and an optional label.
 const REL_RE = /^(?:Bi)?Rel(?:_[A-Za-z]+)?\s*\(\s*(\w+)\s*,\s*(\w+)\s*(?:,\s*"([^"]*)")?/;
-// Diagram files come from the shared collector (F11c) — see
+// Diagram files come from the shared collector — see
 // c4-external-systems.ts / c4-l1-candidates.ts. This builder previously
 // kept a private, pre-0.30.1-ordered copy missing the domain-scoped L1
 // path, so Rel(...) lines there were never harvested.
@@ -30,7 +30,7 @@ export async function buildSystemExternalDependency(inputs) {
     const rows = [];
     const seen = new Set();
     const rowsById = new Map();
-    // F14: a Rel in the syndicated platform L1 is a statement about the
+    // A Rel in the syndicated platform L1 is a statement about the
     // PLATFORM. For any other SDD those lines minted the platform's
     // dependencies (and even its persona interactions) as the sibling's own
     // edges — measured at 28% of one estate's dependency graph and 35/35
@@ -42,11 +42,11 @@ export async function buildSystemExternalDependency(inputs) {
     for (const { abs, syndicated } of files) {
         if (syndicated && !isRoot)
             continue;
-        // (F17) the non-external Rel endpoint may be a local container — carry
+        // the non-external Rel endpoint may be a local container — carry
         // its id so adjudication can rewrite this edge onto container_dependency
         // instead of destroying it when the external endpoint proves internal.
         const content = await readFile(abs, "utf-8");
-        // F30: a Person-sourced Rel must never enter this catalogue — its
+        // A Person-sourced Rel must never enter this catalogue — its
         // semantics are runtime calls between software, and attributing a
         // human's Rel to the system erases the person-ness (which adjudication
         // then launders into system_system_dependency). The persona-container
@@ -60,14 +60,14 @@ export async function buildSystemExternalDependency(inputs) {
         for (const rel of parseRels(content)) {
             if (personEntries.has(rel.from) || personEntries.has(rel.to))
                 continue;
-            // F28: classification is CONTAINER-FIRST, uniformly with the
-            // container-dependency builder (F20 / ledger L6). An entry-id that
+            // Classification is CONTAINER-FIRST, uniformly with the
+            // container-dependency builder. An entry-id that
             // resolves to a local container IS a container, whatever a sibling
             // diagram called it — the old external-first read here meant a
             // dual-use SOURCE made the pair look external↔external to this
             // builder while looking container→external to its sibling, and the
             // edge fell between them: claimed by neither, reported by nothing.
-            // L6's fix was applied to one builder and not swept into this one.
+            // A fix applied to one builder must be swept into this one too.
             const fromIsContainer = inputs.containerIdByEntryId?.has(rel.from) ?? false;
             const toIsContainer = inputs.containerIdByEntryId?.has(rel.to) ?? false;
             const fromExt = fromIsContainer

package/dist/lib/catalogue/canonical-schema.yaml

@@ -134,7 +134,7 @@ enums:
       runtime: true
       emits_service_row: false
     description: |
-      Type of repository, declared in `orchestration/repo-config/*.yaml` as `service_type` and surfaced in `repositories.component_type` and `services.component_type`. The canonical builder uses this to decide which repos are runtime services (api_service, worker, gateway, frontend, mobile) and which are non-runtime (library, infrastructure, documentation); firmware runs, but on a device, so it is runtime without a service row (M-ADR 0215) — service emission follows emits_service_row, not runtime. Whether a repo is a vertical-domain application is conveyed by its SDD manifest's `profile: application-product`, not by a service_type tag — this enum is strictly about runtime artefact shape (per resolution of adopt-canonical-catalogue-builder.md §7.1).
+      Type of repository, declared in `orchestration/repo-config/*.yaml` as `service_type` and surfaced in `repositories.component_type` and `services.component_type`. The canonical builder uses this to decide which repos are runtime services (api_service, worker, gateway, frontend, mobile) and which are non-runtime (library, infrastructure, documentation); firmware runs, but on a device, so it is runtime without a service row (M-ADR 0215) — service emission follows emits_service_row, not runtime. Whether a repo is a vertical-domain application is conveyed by its SDD manifest's `profile: application-product`, not by a service_type tag — this enum is strictly about runtime artefact shape.
   capability_exemption_reason:
     values:
     - value: infrastructure
@@ -174,11 +174,11 @@ enums:
     - value: public-infrastructure
       description: Public networks, registries, or services no party in the estate operates.
     - value: estate-owned-unmodelled
-      description: "Operated by this estate but with no SDD or container home yet — the row is an accounted-for stand-in, and this population is the estate's modelling backlog, countable (F16, 2.32.0). Not an assertion of externality: an assertion of accountability for a boundary row."
+      description: "Operated by this estate but with no SDD or container home yet — the row is an accounted-for stand-in, and this population is the estate's modelling backlog, countable (2.32.0). Not an assertion of externality: an assertion of accountability for a boundary row."
     - value: organisation-internal
-      description: Owned elsewhere in the same organisation, outside this estate's modelling boundary (F16, 2.32.0).
+      description: Owned elsewhere in the same organisation, outside this estate's modelling boundary (2.32.0).
     description: |
-      Why an external-system candidate is ACCOUNTED FOR at the estate boundary, per M-ADR 0189 §4.6 (WS15; wording corrected by F16, 2.32.0): five values assert another party owns the system, and two assert the estate/organisation owns it but it has no model home yet — forcing the latter through the former would demand a false reason, and a false reason is worse than silence. The adjudicator can prove a candidate internal; it cannot prove one accounted-for — that is an assertion the author is accountable for, in the shape M-ADR 0188 ratified for repositories. Closed vocabulary, method-owned, extended only by ADR amendment, so adopters cannot locally widen the exemption surface to silence the unverified-candidate coverage finding.
+      Why an external-system candidate is ACCOUNTED FOR at the estate boundary, per M-ADR 0189 §4.6 (wording corrected in 2.32.0): five values assert another party owns the system, and two assert the estate/organisation owns it but it has no model home yet — forcing the latter through the former would demand a false reason, and a false reason is worse than silence. The adjudicator can prove a candidate internal; it cannot prove one accounted-for — that is an assertion the author is accountable for, in the shape M-ADR 0188 ratified for repositories. Closed vocabulary, method-owned, extended only by ADR amendment, so adopters cannot locally widen the exemption surface to silence the unverified-candidate coverage finding.
       ENFORCED, not advisory: the builder drops a row whose reason is outside this vocabulary (convention finding) and the candidate stays unverified — which is the point. An unrecognised reason must not succeed at the one thing an exemption does.
   scaffold_status:
     values:
@@ -1353,7 +1353,7 @@ catalogues:
       nullable: true
       description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
     description: |
-      Hierarchical grouping for features. First-class entity per resolution of adopt-canonical-catalogue-builder.md §7.2 — replaces the previous reverse-only synthetic `feature-tree-group` rows in features.csv. Both forward and reverse can use feature_groups: forward application-product SDDs whose `feature-tree.md` has H2/H3 structure, reverse SDDs whose extracted feature trees are inherently hierarchical, and any SDD that promotes groups to first-class with authored metadata. Groups can nest via `parent_group_id`.
+      Hierarchical grouping for features. First-class entity — replaces the previous reverse-only synthetic `feature-tree-group` rows in features.csv. Both forward and reverse can use feature_groups: forward application-product SDDs whose `feature-tree.md` has H2/H3 structure, reverse SDDs whose extracted feature trees are inherently hierarchical, and any SDD that promotes groups to first-class with authored metadata. Groups can nest via `parent_group_id`.
     foreign_keys:
     - column: product_id
       references: products.id
@@ -2062,8 +2062,8 @@ catalogues:
       nullable: false
       description: Mandatory, non-empty. The reason makes exemptions countable; the note makes them reviewable (M-ADR 0188 §4.2 pattern).
     description: |
-      A declared, reasoned assertion that an external-system candidate is GENUINELY external (M-ADR 0189 §4.6 / WS15). Annotation catalogue (M-ADR 0133 §4.2b): one FK, declared never derived, closed reason enum. Sourced from `orchestration/external-system-exemptions.yaml`.
-      The invariant it completes: c4_external_systems was the one catalogue family with no coverage predicate — a candidate producing no adjudication outcome was silent, and that silence hid a 28% dependency -graph distortion (ledger L4). Every candidate now either resolves at adjudication, or carries an exemption here, or is reported unverified. An exemption retires only the unverified finding — never an adjudication outcome (a converted candidate's exemption is a contradiction, reported and dropped). Shared entities may be exempted by multiple SDDs: identical rows dedup at aggregation (same exception class as c4_external_systems); conflicting rows keep first-seen with a convention finding.
+      A declared, reasoned assertion that an external-system candidate is GENUINELY external (M-ADR 0189 §4.6). Annotation catalogue (M-ADR 0133 §4.2b): one FK, declared never derived, closed reason enum. Sourced from `orchestration/external-system-exemptions.yaml`.
+      The invariant it completes: c4_external_systems was the one catalogue family with no coverage predicate — a candidate producing no adjudication outcome was silent, and that silence hid a 28% dependency -graph distortion. Every candidate now either resolves at adjudication, or carries an exemption here, or is reported unverified. An exemption retires only the unverified finding — never an adjudication outcome (a converted candidate's exemption is a contradiction, reported and dropped). Shared entities may be exempted by multiple SDDs: identical rows dedup at aggregation (same exception class as c4_external_systems); conflicting rows keep first-seen with a convention finding.
     foreign_keys:
     - column: external_system_id
       references: c4_external_systems.id
@@ -2172,7 +2172,7 @@ catalogues:
       type: string
       nullable: false
       description: exposes | consumes.
-    description: "Edge: service exposes or consumes contract. Both FKs are external (per M-ADR 0147): federated SDDs that walk per-repo service-architecture tables emit consumes rows where service_id resolves to the platform-root catalogue's services.csv (post-aggregation) and contract_id resolves to the platform-root contracts.csv. Internal builds (e.g. connect-mono) still optimistically validate locally. Schema 2.8.0."
+    description: "Edge: service exposes or consumes contract. Both FKs are external (per M-ADR 0147): federated SDDs that walk per-repo service-architecture tables emit consumes rows where service_id resolves to the platform-root catalogue's services.csv (post-aggregation) and contract_id resolves to the platform-root contracts.csv. Internal builds (a single-SDD platform) still optimistically validate locally. Schema 2.8.0."
     foreign_keys:
     - column: service_id
       references: services.id
@@ -2303,7 +2303,7 @@ catalogues:
       nullable: true
       description: Where the coupling is evidenced — a path or anchor in the SDD, from `evidence:` on the services[] entry. Prose about the coupling stays in dependency_notes; this is the pointer a reviewer follows.
     description: |
-      Edge: capability is realised by services. Sourced from the capability traceability manifest services[] block. service_id is an external FK (schema 2.29.0, F4): a traceability entry marked `owner_sdd:` declares a cross-SDD reference (e.g. the service moved to a sibling SDD at an M-ADR 0170 §4.2 carve) — the per-SDD builder emits the edge, logs it `[finding] external`, and aggregation validates it hard against the owning sibling's rows. An UNMARKED id that does not resolve locally is NOT emitted — it stays a member-tier orphan finding (or convention, when it names a known external system).
+      Edge: capability is realised by services. Sourced from the capability traceability manifest services[] block. service_id is an external FK (schema 2.29.0): a traceability entry marked `owner_sdd:` declares a cross-SDD reference (e.g. the service moved to a sibling SDD at an M-ADR 0170 §4.2 carve) — the per-SDD builder emits the edge, logs it `[finding] external`, and aggregation validates it hard against the owning sibling's rows. An UNMARKED id that does not resolve locally is NOT emitted — it stays a member-tier orphan finding (or convention, when it names a known external system).
     foreign_keys:
     - column: capability_id
       references: capabilities.id
@@ -2365,8 +2365,8 @@ catalogues:
     - name: source
       type: string
       nullable: false
-      description: "declared — the only emitted value. `derived` is reserved vocabulary: the reverse derivation it anticipated was never built (0 rows across 105 measured units) and the claim was corrected at 3.0.0 (M-ADR 0203 §4.5 / F2); the value re-enters if a decision builds a reverse source."
-    description: "Edge: capability is bound to a contract. Whether the capability exposes or depends on it is not stated by the source (traceability.contracts), so this description asserts no direction (M-ADR 0211 §1). Forward-declared only. Forward-declared only (traceability.contracts). The reverse derivation this description long claimed (service_contract ⋈ capability_service) was measured nonexistent — 0 `source: derived` rows across 105 units, builder references neither catalogue — and the CLAIM was corrected at 3.0.0 (M-ADR 0203 §4.5 / F2, gap class absent-derivation per M-ADR 0196 §4.1). The edge is forward-one-directional until a decision builds a reverse source."
+      description: "declared — the only emitted value. `derived` is reserved vocabulary: the reverse derivation it anticipated was never built (0 rows across 105 measured units) and the claim was corrected at 3.0.0 (M-ADR 0203 §4.5); the value re-enters if a decision builds a reverse source."
+    description: "Edge: capability is bound to a contract. Whether the capability exposes or depends on it is not stated by the source (traceability.contracts), so this description asserts no direction (M-ADR 0211 §1). Forward-declared only. Forward-declared only (traceability.contracts). The reverse derivation this description long claimed (service_contract ⋈ capability_service) was measured nonexistent — 0 `source: derived` rows across 105 units, builder references neither catalogue — and the CLAIM was corrected at 3.0.0 (M-ADR 0203 §4.5, gap class absent-derivation per M-ADR 0196 §4.1). The edge is forward-one-directional until a decision builds a reverse source."
     foreign_keys:
     - column: capability_id
       references: capabilities.id
@@ -2546,7 +2546,7 @@ catalogues:
       type: string
       nullable: true
       description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
-    description: "Edge: feature delivers async push via a named channel/topic. Peer of `graphql_operations:` in the per-feature evidence shape — `graphql_operations:` carries the GraphQL operation names declared in the schema (Queries / Mutations / Subscriptions); `feature_subscription_channels` rows carry the channel/topic layer that physically delivers the push events (AppSync WebSocket endpoints, Pekko WS channels, MQTT topics, server-sent-event streams). Per resolved decision §1 of `content/plans/v0-9-0-cohort-sweep-derived-bundle.md`: a single GraphQL Subscription operation may listen on multiple channels; one channel may be consumed by multiple operations — modelling as a separate edge catalogue (not as a feature column) accommodates the many-to-many. Built per-SDD from `reverse-evidence/feature-grounding-evidence.yaml` `subscription_channels:` entries on each feature. Added in schema 2.9.0."
+    description: "Edge: feature delivers async push via a named channel/topic. Peer of `graphql_operations:` in the per-feature evidence shape — `graphql_operations:` carries the GraphQL operation names declared in the schema (Queries / Mutations / Subscriptions); `feature_subscription_channels` rows carry the channel/topic layer that physically delivers the push events (AppSync WebSocket endpoints, Pekko WS channels, MQTT topics, server-sent-event streams). A single GraphQL Subscription operation may listen on multiple channels; one channel may be consumed by multiple operations — modelling as a separate edge catalogue (not as a feature column) accommodates the many-to-many. Built per-SDD from `reverse-evidence/feature-grounding-evidence.yaml` `subscription_channels:` entries on each feature. Added in schema 2.9.0."
     foreign_keys:
     - column: feature_id
       references: features.id
@@ -2672,9 +2672,9 @@ catalogues:
     - name: interaction
       type: string
       nullable: true
-      description: Optional interaction label from the Rel(...) line. May hold multiple '; '-joined labels (F25).
+      description: Optional interaction label from the Rel(...) line. May hold multiple '; '-joined labels.
     description: |
-      Edge: a persona uses a C4 container — the L2-granularity companion to persona_c4system (M-ADR 0189 F26 §3, ratified 2026-07-10). Eleven of one estate's L2 diagrams and the bulk of another's 81 unroutable Rels drew Person→Container relationships that had no catalogue and, until F26, no finding. Harvested at member tier from Rel(...) lines whose endpoints resolve to a file-local Person and a local container (either direction; the row is normalised persona→container). A Person that matches no persona row is a coverage finding, never a silent skip. Both authoring directions feed from the same diagram surface (M-ADR 0157 parity). Added in schema 2.34.0.
+      Edge: a persona uses a C4 container — the L2-granularity companion to persona_c4system (M-ADR 0189, ratified 2026-07-10). Eleven of one estate's L2 diagrams and the bulk of another's 81 unroutable Rels drew Person→Container relationships that had no catalogue and raised no finding. Harvested at member tier from Rel(...) lines whose endpoints resolve to a file-local Person and a local container (either direction; the row is normalised persona→container). A Person that matches no persona row is a coverage finding, never a silent skip. Both authoring directions feed from the same diagram surface (M-ADR 0157 parity). Added in schema 2.34.0.
     foreign_keys:
     - column: persona_id
       references: personas.id
@@ -2698,11 +2698,11 @@ catalogues:
     - name: interaction
       type: string
       nullable: true
-      description: Optional integration label/protocol from the Rel(...) line. May hold multiple '; '-joined labels when one pair is declared with distinct labels (F25, 2.33.2).
+      description: Optional integration label/protocol from the Rel(...) line. May hold multiple '; '-joined labels when one pair is declared with distinct labels (2.33.2).
     - name: from_container_id
       type: string
       nullable: true
-      description: The Rel's non-external endpoint resolved to a local container at member tier, when it is one (F17, 2.33.0) — the datum that lets adjudication rewrite this edge onto container_dependency instead of destroying it. Empty when the endpoint is the system itself or unresolvable.
+      description: The Rel's non-external endpoint resolved to a local container at member tier, when it is one (2.33.0) — the datum that lets adjudication rewrite this edge onto container_dependency instead of destroying it. Empty when the endpoint is the system itself or unresolvable.
     description: "Edge: a C4 system integrates with an external software system. Captures the L1 context 'System integrates with External System' relationship, extracted from System_Ext(...) + Rel(...) on L1/L2 diagrams. Per M-ADR 0155. Container-level external dependencies are out of scope (system-level only). Added in schema 2.10.0. From 2.30.0 (M-ADR 0189 §4.4): edges whose external endpoint the aggregator adjudicates as an INTERNAL system are rewritten onto system_system_dependency and removed from this catalogue."
     foreign_keys:
     - column: c4_system_id
@@ -2734,13 +2734,13 @@ catalogues:
     - name: source_sdd_id
       type: string
       nullable: true
-      description: SDD whose diagram declared the originating reference. Member-emitted rows set it directly (F19); adjudication-derived rows are stamped by the aggregator.
+      description: SDD whose diagram declared the originating reference. Member-emitted rows set it directly; adjudication-derived rows are stamped by the aggregator.
     - name: platform_sdd_id
       type: string
       nullable: true
       description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
     description: |
-      Edge: a C4 container depends on another INTERNAL container (adopter finding F17 — F6 exactly one tier down: "no edge for internal" at L2). Derived by the aggregator at adjudication: an external-system candidate that resolves to an internal container was never external — each of its dependency edges whose member-resolved `from_container_id` is known is rewritten here, and a candidate with no remaining edges is dropped (it was a phantom duplicate of the container). A candidate with unconvertible edges is kept with the tier-contradiction finding, so no edge is ever destroyed to make a build quieter — the measured cost that stopped an adopter remediating 22 contradictions was eight real edges. ALSO emitted at member tier (F19, 2.33.1): the C4-correct authoring — Rel(container_a, container_b) between two Container(...) nodes — emits its edge directly; adjudication merges into a catalogue that already has content rather than being its only source, so the metamodel no longer rewards mis-declaration over correct authoring. Added in schema 2.33.0.
+      Edge: a C4 container depends on another INTERNAL container (the system-tier gap exactly one tier down: "no edge for internal" at L2). Derived by the aggregator at adjudication: an external-system candidate that resolves to an internal container was never external — each of its dependency edges whose member-resolved `from_container_id` is known is rewritten here, and a candidate with no remaining edges is dropped (it was a phantom duplicate of the container). A candidate with unconvertible edges is kept with the tier-contradiction finding, so no edge is ever destroyed to make a build quieter — the measured cost that stopped an adopter remediating 22 contradictions was eight real edges. ALSO emitted at member tier (2.33.1): the C4-correct authoring — Rel(container_a, container_b) between two Container(...) nodes — emits its edge directly; adjudication merges into a catalogue that already has content rather than being its only source, so the metamodel no longer rewards mis-declaration over correct authoring. Added in schema 2.33.0.
     foreign_keys:
     - column: from_container_id
       references: c4_containers.id
@@ -2910,7 +2910,7 @@ catalogues:
     - name: target_locus
       type: string
       nullable: true
-      description: platform | external | legacy (M-ADR 0204; closed enum, absent/empty = platform). A statement about the TARGET only — never about the consuming product, and never a stability, lifecycle or quality claim. platform rows behave exactly as before this column existed. external/legacy rows carry empty target_capability_id and target_service_id and name their target in target_external_system_id; they skip platform resolution and the F18 realiser-join, with every skip named.
+      description: platform | external | legacy (M-ADR 0204; closed enum, absent/empty = platform). A statement about the TARGET only — never about the consuming product, and never a stability, lifecycle or quality claim. platform rows behave exactly as before this column existed. external/legacy rows carry empty target_capability_id and target_service_id and name their target in target_external_system_id; they skip platform resolution and the synchronous realiser-join, with every skip named.
     - name: target_external_system_id
       type: string
       nullable: true
@@ -2926,7 +2926,7 @@ catalogues:
     - name: contract_type
       type: string
       nullable: true
-      description: rest | graphql | openapi | grpc | event | event-stream | stream | other. Optional; reflects what the consuming SDD declares. The async set (`event`/`event-stream`/`stream`) marks a shared-stream subscription that binds to a stream contract rather than a realiser service (M-ADR 0192) — such rows skip the F18 synchronous realiser-join at aggregation.
+      description: rest | graphql | openapi | grpc | event | event-stream | stream | other. Optional; reflects what the consuming SDD declares. The async set (`event`/`event-stream`/`stream`) marks a shared-stream subscription that binds to a stream contract rather than a realiser service (M-ADR 0192) — such rows skip the synchronous realiser-join at aggregation.
     - name: required_stability
       type: string
       nullable: true
@@ -2948,7 +2948,7 @@ catalogues:
       nullable: true
       description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
     description: |
-      Per-SDD edge: an application-side or integration-side SDD declares that its product depends on a platform-side capability + service pair. Built from `reverse-evidence/feature-grounding-evidence.yaml` `platform_dependencies:` block (product-level — the cohort source shape carries product-scoped dependency rows with a `consumed_by:` list naming which services within the consuming product depend on the target). Each row records one (consuming product, target capability, target service) triple. The aggregator then joins these rows against platform-side `capability_service` to emit `cross_sdd_platform_capability` edges at aggregation time. Cross- SDD references (target_capability_id, target_service_id) are external — they're not expected to resolve in the per-SDD build, only at aggregation. Added in schema 2.9.0; see `content/plans/v0-9-0-cohort-sweep-derived-bundle.md` §"Cross-SDD platform-capability-edge".
+      Per-SDD edge: an application-side or integration-side SDD declares that its product depends on a platform-side capability + service pair. Built from `reverse-evidence/feature-grounding-evidence.yaml` `platform_dependencies:` block (product-level — the cohort source shape carries product-scoped dependency rows with a `consumed_by:` list naming which services within the consuming product depend on the target). Each row records one (consuming product, target capability, target service) triple. The aggregator then joins these rows against platform-side `capability_service` to emit `cross_sdd_platform_capability` edges at aggregation time. Cross- SDD references (target_capability_id, target_service_id) are external — they're not expected to resolve in the per-SDD build, only at aggregation. Added in schema 2.9.0.
     foreign_keys:
     - column: product_id
       references: products.id
@@ -2993,7 +2993,7 @@ catalogues:
       nullable: false
       description: Service identifier the consuming SDD references and the platform SDD owns. The join key.
     description: |
-      Federated edge: an application-side or integration-side SDD's `product_platform_dependencies` reference resolves against a platform-side SDD's capability spec via the platform capability's `capability_service` roster. Surfaces ecosystem-wide platform- consumer relationships at product → capability granularity. Built **only at aggregation time** — `sdd-cli catalogue aggregate` joins each consuming SDD's `product_platform_dependencies` rows against every other SDD's `capability_service` rows on `target_service_id == service_id`, emitting one row per resolved (consuming-product, platform-capability) pair. Per-SDD builders emit nothing for this catalogue; the aggregator owns it entirely. A platform-dependency whose target_service_id doesn't resolve to any platform-side capability_service row is logged as an `orphan` finding and produces no row. Cross-SDD references are external by definition. Added in schema 2.9.0; see `content/plans/v0-9-0-cohort-sweep-derived-bundle.md` §"Cross-SDD platform-capability-edge" and M-ADR 0134.
+      Federated edge: an application-side or integration-side SDD's `product_platform_dependencies` reference resolves against a platform-side SDD's capability spec via the platform capability's `capability_service` roster. Surfaces ecosystem-wide platform- consumer relationships at product → capability granularity. Built **only at aggregation time** — `sdd-cli catalogue aggregate` joins each consuming SDD's `product_platform_dependencies` rows against every other SDD's `capability_service` rows on `target_service_id == service_id`, emitting one row per resolved (consuming-product, platform-capability) pair. Per-SDD builders emit nothing for this catalogue; the aggregator owns it entirely. A platform-dependency whose target_service_id doesn't resolve to any platform-side capability_service row is logged as an `orphan` finding and produces no row. Cross-SDD references are external by definition. Added in schema 2.9.0; see M-ADR 0134.
     foreign_keys:
     - column: consuming_product_id
       references: products.id
@@ -3131,7 +3131,7 @@ catalogues:
       nullable: true
       description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
     description: |
-      Application-product annotation (M-ADR 0191 §4.3 overlay, second element — WS4): one row per conformance tag the product asserts about its archetype's conformance expectations. Built per-SDD from the manifest's `conformance` block so the AGGREGATION-tier conformance GATE can read it. `status=covered` means the product's own conformance suite exercises the tag; `status=deviated` means the product declares (with a rationale) that it deliberately does not. At aggregation, an archetype-expected conformance tag that is neither covered nor deviated raises a deviation-visible WARN. The method gates the DECLARATION — it does not run the adopter's conformance suite. Added in schema 2.39.0.
+      Application-product annotation (M-ADR 0191 §4.3 overlay, second element): one row per conformance tag the product asserts about its archetype's conformance expectations. Built per-SDD from the manifest's `conformance` block so the AGGREGATION-tier conformance GATE can read it. `status=covered` means the product's own conformance suite exercises the tag; `status=deviated` means the product declares (with a rationale) that it deliberately does not. At aggregation, an archetype-expected conformance tag that is neither covered nor deviated raises a deviation-visible WARN. The method gates the DECLARATION — it does not run the adopter's conformance suite. Added in schema 2.39.0.
     foreign_keys:
     - column: product_id
       references: products.id

package/dist/lib/catalogue/coverage-predicates.js

@@ -13,12 +13,12 @@
  *     §4.3 (`orphaned` is aggregate-only; member tier reports
  *     `unresolved-locally`, cause-agnostic); the Path-X leverage axis is
  *     reported separately and only when repo_capability.csv exists.
- *   - event_coverage    (WS3): every catalogued event is attributed to a
+ *   - event_coverage:    every catalogued event is attributed to a
  *     runtime — service_event edge or resolving publisher column — with
  *     the contract-twin alternative route, the column-vs-edge disagreement
  *     controls, and the chain-readout/consumer-enumerability metric lines
  *     that are never verdicts.
- *   - contract_coverage (WS2): every catalogued contract is reachable —
+ *   - contract_coverage: every catalogued contract is reachable —
  *     capability_contract or service_contract — with the three computed
  *     exclusions (deprecated / provider-surface / not-an-interface, the
  *     last a positive READ of the spec file), the covered-as-event
@@ -178,8 +178,8 @@ FROM "services" s
 WHERE s."id" IS NOT NULL AND s."id" <> ''
 ORDER BY service_id, primary_repo;`;
 export async function runServiceCapabilityCoverage(session, options) {
-    // Known-bad probe, carried over from the reference implementation
-    // (WS11's third requirement): a synthetic claimed service must classify
+    // Known-bad probe, carried over from the reference implementation:
+    // a synthetic claimed service must classify
     // as claimed BEFORE any real data is reported — a run whose
     // classification never executed must not be able to report a healthy
     // estate.

package/dist/lib/catalogue/coverage-run.js

@@ -89,7 +89,7 @@ export async function runCatalogueCoverage(inputs, write) {
         const available = new Set(schema.catalogues.map((c) => c.name).filter((n) => present(n)));
         lines.push(...renderScoresCoverage(await runScoresCoverage(session, { tier, available, sddRoot }), tier));
         // Staleness VERDICTS — the second half of the fourteenth check's §4.5
-        // scope (ledger §3o), member-tier only with the aggregate skip stated.
+        // scope, member-tier only with the aggregate skip stated.
         // Same coverage class, same reporting-only staging as the rest of the
         // scores family.
         lines.push(...renderStalenessVerdicts(await runStalenessVerdicts(session, { tier, available, sddRoot }), tier));

package/dist/lib/catalogue/dedupe-keyed-tables.js

@@ -20,10 +20,9 @@
  *     `build` (where the offending SDD is unambiguous) instead of only at
  *     `aggregate`.
  *
- * Background: the method's coordination record feature-edge-cross-source-duplicate.
  * Sibling precedents (the unconditional-emit fixes whose per-walker dedup this
- * generalises across sources): `feature-grounding-collision-edges-coordination.md`
- * (0.30.2) and `capability-spec-collision-edges-coordination.md` (0.30.3).
+ * generalises across sources): the feature-grounding collision-edge fix
+ * (0.30.2) and the capability-spec collision-edge fix (0.30.3).
  */
 /**
  * Render a cell exactly as the CSV writer will, so two rows count as identical