@sdd-method/maintain-cli 0.16.1 → 0.17.0

package/dist/lib/behaviour-store/archive.js

@@ -196,6 +196,34 @@ export function parseSurfaces(evidence) {
         problems.push("the **Surfaces:** line lists no contract");
     return { present: true, entries, problems };
 }
+/**
+ * A structural delta's `moved: {contracts: [{from, to, from_path?}]}` block. A contract's id is derived from its path,
+ * so moving the file changes the id; the change that moves it records the move once, and what named the old
+ * identity (an archived baseline's Surfaces list) follows it rather than being edited.
+ */
+export function contractMoves(raw) {
+    const moves = [];
+    const problems = [];
+    if (raw === undefined || raw === null)
+        return { moves, problems };
+    const contracts = typeof raw === "object" && !Array.isArray(raw) ? raw["contracts"] : undefined;
+    const extra = typeof raw === "object" && raw !== null && !Array.isArray(raw) ? Object.keys(raw).filter((k) => k !== "contracts") : [];
+    if (!Array.isArray(contracts) || extra.length > 0) {
+        problems.push(`moved must be {contracts: [{from: <old contract id>, to: <new contract id>, from_path?: <old spec path>}]}`);
+        return { moves, problems };
+    }
+    for (const [i, m] of contracts.entries()) {
+        const e = (m ?? {});
+        const from = typeof e["from"] === "string" ? e["from"].trim() : "";
+        const to = typeof e["to"] === "string" ? e["to"].trim() : "";
+        const fromPath = typeof e["from_path"] === "string" ? e["from_path"].trim() : undefined;
+        if (from === "" || to === "" || from === to)
+            problems.push(`moved.contracts[${i}] needs a from and a to that differ`);
+        else
+            moves.push({ from, to, ...(fromPath ? { fromPath } : {}) });
+    }
+    return { moves, problems };
+}
 /** Whether a Surfaces entry names a catalogue contract: its id, or a path suffix of its spec_path on a segment boundary. */
 export function surfaceMatches(entry, contractId, specPath) {
     const e = entry.replace(/^\.\//, "");

package/dist/lib/behaviour-store/schema.js

@@ -14,6 +14,16 @@ export const SCHEMA_NAME = "sdd-change";
 export const SHIPPED_SCHEMA_DIR = "docs/method/foundations/openspec/sdd-change";
 export const SHIPPED_CONFIG_TEMPLATE = "docs/method/foundations/openspec/config-template.yaml";
 export const STORE_SCHEMA_DIR = `openspec/schemas/${SCHEMA_NAME}`;
+/**
+ * The baseline schema (M-ADR 0222 §4.3-4.4): a baseline change selects it in its own .openspec.yaml, the store's
+ * config.yaml keeping sdd-change as the default. Copied and checked as sdd-change is, where the SDD's bundle
+ * ships it; a bundle from before it shipped has none, and nothing is asked of the store.
+ */
+export const BASELINE_SCHEMA_NAME = "sdd-baseline";
+/** Every schema the method ships for a store, the default first. */
+export const STORE_SCHEMAS = [SCHEMA_NAME, BASELINE_SCHEMA_NAME];
+export const shippedSchemaDir = (name) => `docs/method/foundations/openspec/${name}`;
+export const storeSchemaDir = (name) => `openspec/schemas/${name}`;
 export const STORE_CONFIG = "openspec/config.yaml";
 async function files(dir) {
     const out = [];
@@ -50,36 +60,38 @@ export async function storeSchemaName(repo) {
     const v = parseDocument(text.toString("utf8")).toJS()?.schema;
     return typeof v === "string" ? v : "";
 }
-/** Compare the store's copy of the schema with the one the SDD's method bundle shipped, file by file. */
-export async function compareStoreSchema(repo) {
-    const shipped = await files(join(repo, SHIPPED_SCHEMA_DIR));
+/** Compare the store's copy of a schema with the one the SDD's method bundle shipped, file by file. */
+export async function compareStoreSchema(repo, name = SCHEMA_NAME) {
+    const shippedDir = shippedSchemaDir(name);
+    const storeDir = storeSchemaDir(name);
+    const shipped = await files(join(repo, shippedDir));
     if (shipped === null || shipped.length === 0)
         return { shipped: false, missing: [], differing: [], extra: [] };
-    const store = (await files(join(repo, STORE_SCHEMA_DIR))) ?? [];
+    const store = (await files(join(repo, storeDir))) ?? [];
     const missing = shipped.filter((f) => !store.includes(f));
     const extra = store.filter((f) => !shipped.includes(f));
     const differing = [];
     for (const f of shipped.filter((x) => store.includes(x))) {
-        const a = await read(join(repo, SHIPPED_SCHEMA_DIR, f));
-        const b = await read(join(repo, STORE_SCHEMA_DIR, f));
+        const a = await read(join(repo, shippedDir, f));
+        const b = await read(join(repo, storeDir, f));
         if (a === null || b === null || !a.equals(b))
             differing.push(f);
     }
     return { shipped: true, missing, differing, extra };
 }
 /**
- * Replace the store's copy of the schema with the shipped one. Returns what changed, as a
+ * Replace the store's copy of a schema with the shipped one. Returns what changed, as a
  * comparison taken before the write; a store already current returns empty lists.
  */
-export async function writeStoreSchema(repo) {
-    const before = await compareStoreSchema(repo);
+export async function writeStoreSchema(repo, name = SCHEMA_NAME) {
+    const before = await compareStoreSchema(repo, name);
     if (!before.shipped)
         return before;
     if (before.missing.length + before.differing.length + before.extra.length === 0)
         return before;
-    await rm(join(repo, STORE_SCHEMA_DIR), { recursive: true, force: true });
-    await mkdir(join(repo, STORE_SCHEMA_DIR), { recursive: true });
-    await cp(join(repo, SHIPPED_SCHEMA_DIR), join(repo, STORE_SCHEMA_DIR), { recursive: true });
+    await rm(join(repo, storeSchemaDir(name)), { recursive: true, force: true });
+    await mkdir(join(repo, storeSchemaDir(name)), { recursive: true });
+    await cp(join(repo, shippedSchemaDir(name)), join(repo, storeSchemaDir(name)), { recursive: true });
     return before;
 }
 //# sourceMappingURL=schema.js.map

package/dist/lib/catalogue/build.js

@@ -394,6 +394,9 @@ async function collectRows(schema, manifest, findings, sddPath, snapshotStore) {
         knownDomainIds,
         profile: manifest.profile,
         category: manifest.category,
+        domainExternal: schema.catalogues
+            .find((c) => c.name === "adrs")
+            ?.foreignKeys.some((fk) => fk.column === "domain_id" && (fk.external || (fk.externalForProfiles ?? []).includes(manifest.profile))) ?? false,
     });
     const supersedes = buildAdrSupersedes({ findings, adrs: adrResult.parsed });
     out.set("adr_supersedes", supersedes.rows);

package/dist/lib/catalogue/builders/adrs.js

@@ -88,7 +88,7 @@ export async function buildAdrs(inputs) {
             inputs.findings.add("convention", `${relPath}: **Effective:** is "${effectiveRaw}", neither "on acceptance" nor "on archive of <change>"; read as on acceptance (M-ADR 0230 §4.2)`);
         }
         const effectiveChange = onArchive?.[1] ?? "";
-        if (scope === "domain" && !inputs.knownDomainIds.has(domainId)) {
+        if (scope === "domain" && !inputs.knownDomainIds.has(domainId) && !inputs.domainExternal) {
             inputs.findings.add("orphan", `${relPath}: ADR is in domain "${domainId}" but no docs/domains/${domainId}/ exists`);
         }
         // Method-scoped ADRs are cross-cutting governance and belong to no

package/dist/lib/catalogue/builders/contracts.js

@@ -58,6 +58,10 @@ const KIND_SPECS = [
     // name as their surface (M-ADR 0222 §4.4). Reachable from every path at once, unlike graphql above: discovered here, mapped from a
     // traceability manifest's `cli:` block (DECLARED_KINDS), loaded (CONTRACT_LIST_KEYS) and keyed by repo-config.
     { subdir: "cli", extensions: [".yaml", ".yml"], kind: "cli" },
+    // `ui` — an embeddable UI surface's manifest (schema 7.2.0): its custom elements and the messages it sends and
+    // receives. A UI-only repository that other applications load serves no other contract, so its behaviour
+    // baselines had nothing to name as their surface (M-ADR 0222 §4.4). Reachable from every path, as `cli` is.
+    { subdir: "ui", extensions: [".yaml", ".yml"], kind: "ui" },
 ];
 export async function buildContracts(inputs) {
     const rows = [];
@@ -318,6 +322,7 @@ const DECLARED_KINDS = {
     spicedb: "authz",
     graphql: "graphql",
     cli: "cli",
+    ui: "ui",
 };
 export function buildDeclaredExternalContracts(inputs) {
     const rows = [];

package/dist/lib/catalogue/builders/repositories.js

@@ -33,10 +33,11 @@ const LOC_REPORT_REL = join("docs", "platform", "reference", "loc-report.csv");
 const REPOS_DIR_REL = "repos";
 const REVERSE_METADATA_BASENAME = "reverse-metadata.yaml";
 // The contract kinds a repo-config `contracts:` block keys, under `contracts/<kind>/`. The sdd-index reader
-// accepts the same five; `spicedb` (an `authz` contract) was once missing here, and zod strips an unknown key,
+// accepts the same six; `spicedb` (an `authz` contract) was once missing here, and zod strips an unknown key,
 // so a declared `.zed` schema vanished without a finding. `cli` (schema 4.1.0) declares the command manifest a
-// command-line repository serves. GraphQL is not keyed in repo-config: that is its own question, on this schema.
-export const REPO_CONFIG_CONTRACT_KINDS = ["openapi", "proto", "avro", "spicedb", "cli"];
+// command-line repository serves, and `ui` (schema 7.2.0) the manifest of an embeddable UI surface a UI-only
+// repository serves. GraphQL is not keyed in repo-config: that is its own question, on this schema.
+export const REPO_CONFIG_CONTRACT_KINDS = ["openapi", "proto", "avro", "spicedb", "cli", "ui"];
 const ContractsBlockSchema = z
     .object({
     openapi: z.array(z.string()).optional(),
@@ -44,6 +45,7 @@ const ContractsBlockSchema = z
     avro: z.array(z.string()).optional(),
     spicedb: z.array(z.string()).optional(),
     cli: z.array(z.string()).optional(),
+    ui: z.array(z.string()).optional(),
 })
     .optional();
 const EventEntrySchema = z.object({

package/dist/lib/catalogue/canonical-schema.yaml

@@ -7,7 +7,7 @@
 # Emitted by sdd-cli's YAML emitter with no line folding; the three header scalars are quoted for the
 # textual readers downstream. The one deliberate difference from the authored form is schema_status:
 # the authored form says canonical; a projection never does.
-schema_version: "7.1.0"
+schema_version: "7.2.0"
 schema_owner: "sdd-method"
 schema_status: "generated"
 enums:
@@ -364,6 +364,7 @@ enums:
     - value: rpc
     - value: authz
     - value: cli
+    - value: ui
     description: Contract kind. Bound at 3.13.0 from the column descriptions; measured against both reference estates before binding (M-ADR 0205 §4.4).
   contract_status:
     values:
@@ -1791,7 +1792,7 @@ catalogues:
     - name: kind
       type: string
       nullable: false
-      description: rest | graphql | rpc | event | authz | cli. rpc covers Proto/gRPC; event covers Avro schemas; authz covers authorization/policy schemas (SpiceDB .zed and equivalents), added because an adopter contract agreement gate certified .zed schemas as contracts while no kind could represent them; cli covers a command-line interface's command manifest (its commands, options and exit codes), added at 4.1.0 because a command-line tool often serves no REST, RPC, event or authorization contract, so its behaviour baselines had nothing to name as their surface.
+      description: rest | graphql | rpc | event | authz | cli | ui. rpc covers Proto/gRPC; event covers Avro schemas; authz covers authorization/policy schemas (SpiceDB .zed and equivalents), added because an adopter contract agreement gate certified .zed schemas as contracts while no kind could represent them; cli covers a command-line interface's command manifest (its commands, options and exit codes), added at 4.1.0 because a command-line tool often serves no REST, RPC, event or authorization contract, so its behaviour baselines had nothing to name as their surface; ui covers an embeddable UI surface's manifest (its custom elements with their attributes, properties and emitted events, and the messages it sends and receives), added at 7.2.0 because a UI-only repository that other applications load serves no other contract, so its behaviour baselines had nothing to name as their surface.
     - name: version
       type: string
       nullable: true

package/dist/lib/catalogue/contract-id.js

@@ -2,7 +2,7 @@
 // M-ADR 0203 §4.4, the cut's acid test.
 //
 // From 3.0.0 a contract id carries its KIND component: `{domain}-{stem}-{kind}`
-// (kind ∈ rest | graphql | rpc | event | authz | cli). The kindless 2.x form made one
+// (kind ∈ rest | graphql | rpc | event | authz | cli | ui). The kindless 2.x form made one
 // measured collision class unrepresentable: a service published as two contract
 // families (`calendar-service.yaml` + `calendar_service.proto`) minted one id,
 // costing a live estate one row and two edges permanently, and mislabelling

package/dist/lib/catalogue/impact-run.js

@@ -103,7 +103,12 @@ export function buildImpactPropagation(edges, semantics) {
     for (const [key, rec] of pairs) {
         const abOnly = [...rec.ab].filter((t) => !rec.ba.has(t));
         const baOnly = [...rec.ba].filter((t) => !rec.ab.has(t));
-        if (abOnly.length > 0 && baOnly.length > 0) {
+        // Every opposing type a foreign key of ONE catalogue: an entity-FK step runs between a row and what it
+        // references, so such a pair is one row naming the same node in two of its columns, a self-reference (an
+        // entity related to itself), and the opposition is that row's own two ends meeting, not drift.
+        const catalogues = new Set([...abOnly, ...baOnly].map((t) => (t.includes(".") ? t.slice(0, t.indexOf(".")) : `\u0000${t}`)));
+        const selfReference = catalogues.size === 1 && !([...catalogues][0].startsWith("\u0000"));
+        if (abOnly.length > 0 && baOnly.length > 0 && !selfReference) {
             const [a, b] = key.split("␟");
             throw new Error(`impact: counter-directional reciprocal pair (M-ADR 0206 §4.4): ` +
                 `${abOnly[0]} propagates ${a} -> ${b} while ${baOnly[0]} propagates ` +

package/dist/lib/catalogue/traceability-loader.js

@@ -48,6 +48,7 @@ export const CONTRACT_LIST_KEYS = [
     "spicedb",
     "graphql",
     "cli",
+    "ui",
 ];
 /**
  * Every contract path a contracts block declares, across all kinds and both
@@ -283,6 +284,7 @@ function extractContracts(raw) {
     const spicedb = arr("spicedb");
     const graphql = arr("graphql");
     const cli = arr("cli");
+    const ui = arr("ui");
     // `provenance` (3.5.0) MUST be extracted here or the builder that reads it
     // sees nothing — this function reconstructs the block key-by-key rather than
     // passing the parsed object through, which is precisely the shape the
@@ -300,6 +302,7 @@ function extractContracts(raw) {
         ...(spicedb ? { spicedb } : {}),
         ...(graphql ? { graphql } : {}),
         ...(cli ? { cli } : {}),
+        ...(ui ? { ui } : {}),
         ...(provenance ? { provenance } : {}),
     };
 }

package/dist/lib/contracts-availability/index.js

@@ -116,7 +116,7 @@ async function collectReferences(repo) {
         const block = m.traceability.contracts;
         if (!block)
             continue;
-        for (const list of [block.openapi, block.proto, block.avro, block.spicedb, block.graphql, block.cli]) {
+        for (const list of [block.openapi, block.proto, block.avro, block.spicedb, block.graphql, block.cli, block.ui]) {
             if (!Array.isArray(list))
                 continue;
             for (const entry of list) {
@@ -201,6 +201,9 @@ export function inferKind(ref) {
     // repository whose own name ends in -cli stays rest.
     if (/(^|\/)cli\/.*\.ya?ml$/.test(ref))
         return "cli";
+    // A UI surface manifest lives under a `ui/` contracts folder, tested after rest for the same reason.
+    if (/(^|\/)ui\/.*\.ya?ml$/.test(ref))
+        return "ui";
     return undefined;
 }
 /** The SDD's attested external artefacts (`.sdd/contract-availability.yaml`); none when it has no manifest. */

package/dist/lib/snapshot/manifest.js

@@ -9,7 +9,7 @@
 import { createHash } from "node:crypto";
 import { readdir, readFile, stat } from "node:fs/promises";
 import { join, relative, sep } from "node:path";
-import { parse } from "yaml";
+import { isScalar, parseDocument, visit } from "yaml";
 /** The line every later verb prints while a baseline carries unresolved credential findings. */
 export function credentialNotice(m) {
     const s = m.credential_scan;
@@ -60,6 +60,22 @@ export async function exists(p) {
         return false;
     }
 }
+/**
+ * Parse snapshot YAML with every `*revision` value read as the text written. A revision is an identifier, and YAML
+ * 1.2 reads an unquoted all-digit one as an integer: `08985180587` became 8985180587, losing the leading zero,
+ * so a pin no longer matched its folder's `@<rev>`. Writers quote such a value; this covers files written by hand.
+ */
+export function parseSnapshotYaml(text) {
+    const doc = parseDocument(text);
+    visit(doc, {
+        Pair(_, pair) {
+            if (isScalar(pair.key) && /(^|_)revision$/.test(String(pair.key.value)) && isScalar(pair.value) && typeof pair.value.value !== "string" && pair.value.value !== null) {
+                pair.value.value = pair.value.source ?? String(pair.value.value);
+            }
+        },
+    });
+    return doc.toJS();
+}
 export function manifestPath(areaRoot, id) {
     return join(areaRoot, id, "snapshot.yaml");
 }
@@ -67,7 +83,7 @@ export async function readManifest(areaRoot, id) {
     const p = manifestPath(areaRoot, id);
     if (!(await exists(p)))
         throw new SnapshotError(`no manifest at ${p}`);
-    const raw = parse(await readFile(p, "utf8"));
+    const raw = parseSnapshotYaml(await readFile(p, "utf8"));
     if (raw === null || typeof raw !== "object")
         throw new SnapshotError(`${p}: not a mapping`);
     const problems = [];

package/dist/lib/structure/model.js

@@ -5,6 +5,7 @@
 //   openspec/changes/<change>/structure/none.yaml          a change's typed claim of no structural effect
 // An element is a catalogue row of a `structure` catalogue, keyed by its immutable id. Its revision is the
 // SHA-256 of its canonical JSON, so two readers agree on it without agreeing on anything else.
+import { contractMoves } from "../behaviour-store/archive.js";
 import { createHash } from "node:crypto";
 import { readdir, readFile } from "node:fs/promises";
 import { join } from "node:path";
@@ -193,9 +194,12 @@ export async function loadChangeStructure(repo, change, problems) {
             removed.push({ catalogue: r.catalogue, id: r.id, reason: typeof reason === "string" ? reason : "" });
         }
         for (const k of Object.keys(m)) {
-            if (!["schema_version", "partition", "depends_on", "ADDED", "MODIFIED", "REMOVED", "base"].includes(k))
+            if (!["schema_version", "partition", "depends_on", "ADDED", "MODIFIED", "REMOVED", "base", "moved"].includes(k))
                 problems.push(`${file}: unknown key ${k}`);
         }
+        const moved = contractMoves(m["moved"]);
+        for (const p of moved.problems)
+            problems.push(`${file}: ${p}`);
         deltas.push({
             change,
             partition,
@@ -205,6 +209,7 @@ export async function loadChangeStructure(repo, change, problems) {
             modified: readElements(m["MODIFIED"], `${file}: MODIFIED`, partition, file, problems),
             removed,
             base,
+            ...(moved.moves.length > 0 ? { moved: moved.moves } : {}),
         });
     }
     return { change, deltas, noOp, present: true };

package/dist/lib/structure/removals.js

@@ -0,0 +1,121 @@
+// A removed id against what references it outside the view (M-ADR 0230 §4.3, §4.11 negative proof 1: "a removal
+// against a reference to it"). The view's own references are checked by validateView; these are the rest:
+//   this SDD   its catalogues built from its records, not its model: an archived change's work orders and declared
+//              assertions name repositories, and a row whose target is removed drops from the next build
+//   members    the catalogues of the SDDs its aggregation manifest names, where they are checked out: a member's row
+//              naming the removed id, and no row of its own holding it, dangles in the aggregate
+// A rename is not a removal: ids never change, so a rename keeps the id and modifies the element's name.
+import { access, readFile } from "node:fs/promises";
+import { join } from "node:path";
+import { parseDocument } from "yaml";
+import { loadAggregationManifest, DEFAULT_AGGREGATION_MANIFEST_REL } from "../catalogue/aggregation-manifest-loader.js";
+import { CLI_VERSION } from "../catalogue/cli-version.js";
+import { parseCatalogueCsv } from "../catalogue/csv-reader.js";
+async function exists(p) {
+    try {
+        await access(p);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** A catalogue directory's rows, read once each. */
+function reader(dir) {
+    const cache = new Map();
+    return async (catalogue) => {
+        if (!cache.has(catalogue)) {
+            let rows = null;
+            try {
+                rows = parseCatalogueCsv(await readFile(join(dir, `${catalogue}.csv`), "utf8")).rows;
+            }
+            catch {
+                rows = null;
+            }
+            cache.set(catalogue, rows);
+        }
+        return cache.get(catalogue) ?? null;
+    };
+}
+/** `<catalogue>.<column> (<n>)` for each foreign key into `<target>.id` whose rows name `id`. */
+async function referencesTo(schema, rows, target, id, include) {
+    const out = [];
+    for (const c of schema.catalogues) {
+        if (!include(c.name))
+            continue;
+        for (const fk of c.foreignKeys) {
+            if (fk.references !== `${target}.id`)
+                continue;
+            const rs = await rows(c.name);
+            const n = rs?.filter((r) => r[fk.column] === id).length ?? 0;
+            if (n > 0)
+                out.push(`${c.name}.${fk.column} (${n})`);
+        }
+    }
+    return out;
+}
+/** The aggregation manifest's path: .sdd/sdd-manifest.yaml#aggregation_manifest_path, or the default. */
+async function manifestPath(repo) {
+    try {
+        const m = parseDocument(await readFile(join(repo, ".sdd", "sdd-manifest.yaml"), "utf8")).toJS();
+        if (typeof m?.aggregation_manifest_path === "string" && m.aggregation_manifest_path !== "")
+            return join(repo, m.aggregation_manifest_path);
+    }
+    catch {
+        // the manifest check reports an unparseable manifest
+    }
+    return join(repo, DEFAULT_AGGREGATION_MANIFEST_REL);
+}
+/**
+ * Each open change's removals against their references outside the view. Returns the findings, one per removal with
+ * references, and the lines saying what was not looked at.
+ */
+export async function checkRemovals(repo, schema, structures) {
+    const findings = [];
+    const lines = [];
+    const removals = structures.flatMap((s) => s.deltas.flatMap((d) => d.removed.map((r) => ({ change: s.change, file: d.file, ...r }))));
+    if (removals.length === 0)
+        return { findings, lines };
+    const fromModel = new Set(schema.catalogues.filter((c) => c.sourceOfTruth === "structure").map((c) => c.name));
+    const own = reader(join(repo, "catalogues"));
+    const members = [];
+    const path = await manifestPath(repo);
+    if (await exists(path)) {
+        try {
+            const manifest = await loadAggregationManifest(path, { cliVersion: CLI_VERSION, ecosystemRootPath: repo });
+            const absent = [];
+            for (const s of manifest.siblings) {
+                if (await exists(s.cataloguesPath))
+                    members.push({ sddId: s.sddId, rows: reader(s.cataloguesPath) });
+                else
+                    absent.push(s.sddId);
+            }
+            if (absent.length > 0)
+                lines.push(`removed ids: ${absent.length} of ${manifest.siblings.length} member SDD(s) not checked, no checkout of their catalogues (${absent.join(", ")})`);
+        }
+        catch (e) {
+            lines.push(`removed ids: member SDDs not checked (${String(e.message).split("\n")[0]})`);
+        }
+    }
+    for (const r of removals) {
+        const where = [];
+        const mine = await referencesTo(schema, own, r.catalogue, r.id, (c) => !fromModel.has(c));
+        if (mine.length > 0)
+            where.push(`this SDD's ${mine.join(", ")}`);
+        for (const m of members) {
+            // A member that holds the id itself resolves its references to its own row.
+            if ((await m.rows(r.catalogue))?.some((row) => row.id === r.id))
+                continue;
+            const theirs = await referencesTo(schema, m.rows, r.catalogue, r.id, () => true);
+            if (theirs.length > 0)
+                where.push(`${m.sddId}'s ${theirs.join(", ")}`);
+        }
+        if (where.length === 0)
+            continue;
+        findings.push(`${r.file}: removes ${r.catalogue}/${r.id}, which rows outside the model still reference: ${where.join("; ")}. ` +
+            `A rename keeps the id and modifies the element's name (ids never change, M-ADR 0230 §4.3); a removal needs ` +
+            `those references gone, or each row naming it drops from the next build and dangles in the aggregate`);
+    }
+    return { findings, lines };
+}
+//# sourceMappingURL=removals.js.map

package/dist/lib/sync/index.js

@@ -16,7 +16,7 @@ import { syncBriefingFiles } from "./briefing-merge.js";
 import { DEFAULT_AGENT_HARNESS } from "../agent-harness.js";
 import { BLOCK_BEGIN, BLOCK_END } from "../init/ci-workflow.js";
 import { blockSha256, CI_BINDINGS, DEFAULT_CI_BINDING, isCiBinding, parseCiRunner, syncCiBinding, } from "../ci-binding/index.js";
-import { SCHEMA_NAME, STORE_SCHEMA_DIR, storeSchemaName, writeStoreSchema } from "../behaviour-store/schema.js";
+import { SCHEMA_NAME, STORE_SCHEMAS, storeSchemaDir, storeSchemaName, writeStoreSchema } from "../behaviour-store/schema.js";
 import { BRIEFING_TEMPLATE_ROOT, WRAPPER_BLOCK_BEGIN, WRAPPER_BLOCK_END, briefingWrappers, } from "../briefing/index.js";
 const SECTION_RULE = "═".repeat(59);
 /**
@@ -597,11 +597,14 @@ export async function runSync(opts, stdout = (line) => process.stdout.write(line
         // docs/method/foundations/openspec/, and OpenSpec reads only the store's copy, so a store inside this
         // SDD that selects the schema gets the shipped one. The copy is method-managed (the behaviour-store
         // validator fails a drifted copy); adopter guidance belongs in the store's config.yaml rules.
+        // The baseline schema (sdd-baseline) is refreshed beside it wherever the bundle ships it.
         if ((await storeSchemaName(opts.targetRepo)) === SCHEMA_NAME) {
-            const c = await writeStoreSchema(opts.targetRepo);
-            const changed = [...c.missing, ...c.differing, ...c.extra];
-            if (c.shipped && changed.length > 0) {
-                stdout(info(`Refreshed ${STORE_SCHEMA_DIR}/ from the shipped schema: ${changed.length} file(s) changed (${changed.join(", ")})`));
+            for (const name of STORE_SCHEMAS) {
+                const c = await writeStoreSchema(opts.targetRepo, name);
+                const changed = [...c.missing, ...c.differing, ...c.extra];
+                if (c.shipped && changed.length > 0) {
+                    stdout(info(`Refreshed ${storeSchemaDir(name)}/ from the shipped schema: ${changed.length} file(s) changed (${changed.join(", ")})`));
+                }
             }
         }
         // Record the wrapper block and the module exactly as they now stand on disk, so the next sync

package/dist/lib/validate/behaviour-store.js

@@ -34,13 +34,17 @@
 //                 change was withdrawn or replaced (M-ADR 0222 §4.6).
 //   5. surfaces: every archived baseline's evidence lists, under **Surfaces:**, each contract the
 //                 repositories it was observed in serve, as covered at transport or excluded with a
-//                 reason, and the list is checked against the catalogue (catalogues/repo_contract.csv),
-//                 never against itself (M-ADR 0222 §4.3, §4.4). A list the catalogue gives nothing to
+//                 reason, and the list is checked against the catalogue (catalogues/repo_contract.csv, less
+//                 a contract service_contract records the repository's services consuming and none exposing:
+//                 repo_contract has no direction), never against itself (M-ADR 0222 §4.3, §4.4). A list the catalogue gives nothing to
 //                 check against (no Observed in line, or a repository with no catalogue contracts) fails:
 //                 a cross-check of zero contracts is unresolved, not a pass.
 //                 A baseline whose every requirement has since left the living specs (removed, or its
 //                 spec retired) is history: its list is not checked, so a retired surface can drop its
-//                 contract (M-ADR 0222 §4.4).
+//                 contract (M-ADR 0222 §4.4). A baseline archived where the SDD ships record schema 1.4.0
+//                 or later records its gate's PASS (**Baseline gate:**), so `change archive` refuses one
+//                 that has not passed (M-ADR 0222 §4.3). An open baseline is asked these questions, and
+//                 what it may change and which features key it, as warnings while it can still be fixed.
 //   7. features: every living spec is keyed by a catalogue feature (M-ADR 0221 §4.7). A spec keyed by no
 //                 feature is dropped from the catalogue by the requirements builder, which reports it only as a
 //                 build finding; this check makes it a failure, so a shipped requirement cannot vanish from the
@@ -69,11 +73,11 @@ import { tmpdir } from "node:os";
 import { basename, join } from "node:path";
 import { promisify } from "node:util";
 import { parseDocument } from "yaml";
-import { observedIn, orderArchives, parseRequirements, parseSurfaces, renamedFrom, renamePairs, resolveImplements, surfaceMatches } from "../behaviour-store/archive.js";
+import { contractMoves, observedIn, orderArchives, parseRequirements, parseSurfaces, renamedFrom, renamePairs, resolveImplements, surfaceMatches } from "../behaviour-store/archive.js";
 import { parseCatalogueCsv } from "../catalogue/csv-reader.js";
 import { boundFile, conditionProblems, structuralFile, isCommit, normaliseBound, requirementBlock, sameCommit, scenarioKind, taskGroups, testPlanHeader, testPlanMapping, verdictLine, versionAtLeast } from "./agreement-evidence.js";
 import { ENFORCED as STRUCTURE_ENFORCED } from "./structural-model.js";
-import { compareStoreSchema, SCHEMA_NAME, SHIPPED_SCHEMA_DIR, STORE_CONFIG, STORE_SCHEMA_DIR, storeSchemaName } from "../behaviour-store/schema.js";
+import { BASELINE_SCHEMA_NAME, compareStoreSchema, SCHEMA_NAME, SHIPPED_SCHEMA_DIR, shippedSchemaDir, STORE_CONFIG, STORE_SCHEMA_DIR, storeSchemaDir, storeSchemaName } from "../behaviour-store/schema.js";
 const execFileAsync = promisify(execFile);
 /** The OpenSpec release the method depends on (M-ADR 0223 ruling 2). The module installs exactly this. */
 export const OPENSPEC_VERSION = "1.14.3";
@@ -828,8 +832,107 @@ export async function checkBehaviourStore(repo, options = {}) {
     }
     const orderDecides = (name, key) => [...(peers.get(name) ?? [])].some((p) => p !== name && touches.get(p)?.has(key));
     let scopeUnresolved = 0;
-    const servedBy = baselines > 0 ? await catalogueContracts(repo) : null;
+    const openBaselines = [];
+    for (const change of open)
+        if (await exists(join(repo, STORE_DIR, "changes", change, "baseline-evidence.md")))
+            openBaselines.push(change);
+    const servedBy = baselines + openBaselines.length > 0 ? await catalogueContracts(repo) : null;
     let surfacesChecked = 0;
+    // The contract moves each archived change records, in archive order. A contract's id derives from its path, so a
+    // move changes it; an archived baseline's list names the contract as it was, and is resolved through the moves
+    // archived after it rather than edited (M-ADR 0222 §4.4). A surface that vanished with no move still fails.
+    const movesAt = [];
+    for (const name of order) {
+        const found = [];
+        let names = [];
+        try {
+            names = (await readdir(join(repo, archiveRel, name, "structure"))).filter((f) => f.endsWith(".yaml")).sort();
+        }
+        catch {
+            names = [];
+        }
+        for (const f of names) {
+            try {
+                found.push(...contractMoves(parseDocument((await readText(join(repo, archiveRel, name, "structure", f))) ?? "").toJS()?.["moved"]).moves);
+            }
+            catch {
+                // the structural-model check reports an unreadable delta
+            }
+        }
+        movesAt.push(found);
+    }
+    // An open change's moves count too, after every archive: the catalogue it is built with already holds the new
+    // identity, so the lists that named the old one follow the move while it is open, not only once it archives.
+    const openMoves = [];
+    for (const change of open) {
+        let names = [];
+        try {
+            names = (await readdir(join(repo, STORE_DIR, "changes", change, "structure"))).filter((f) => f.endsWith(".yaml")).sort();
+        }
+        catch {
+            names = [];
+        }
+        for (const f of names) {
+            try {
+                openMoves.push(...contractMoves(parseDocument((await readText(join(repo, STORE_DIR, "changes", change, "structure", f))) ?? "").toJS()?.["moved"]).moves);
+            }
+            catch {
+                // the structural-model check reports an unreadable delta
+            }
+        }
+    }
+    /** The identities a contract had before the moves archived after position `after` (-1: every archived move). */
+    const formerIdentities = (id, after) => {
+        const back = new Map();
+        for (const m of [...movesAt.slice(after + 1).flat(), ...openMoves])
+            back.set(m.to, [...(back.get(m.to) ?? []), m]);
+        const out = [];
+        const seen = new Set([id]);
+        const queue = [id];
+        while (queue.length > 0) {
+            for (const m of back.get(queue.shift()) ?? []) {
+                if (seen.has(m.from))
+                    continue;
+                seen.add(m.from);
+                out.push({ id: m.from, path: m.fromPath ?? "" });
+                queue.push(m.from);
+            }
+        }
+        return out;
+    };
+    /** What is wrong with a baseline's Surfaces list against the catalogue (M-ADR 0222 §4.3, §4.4). */
+    const surfaceProblems = async (dir, evidence, after = -1) => {
+        const out = [];
+        const parsed = parseSurfaces(evidence);
+        if (!parsed.present)
+            out.push(`${dir}/baseline-evidence.md: no **Surfaces:** list; name every contract the observed repositories serve, covered at transport or excluded with a reason`);
+        for (const p of parsed.problems)
+            out.push(`${dir}/baseline-evidence.md: Surfaces: ${p}`);
+        if (!parsed.present)
+            return out;
+        if (servedBy === null) {
+            out.push(`${dir}/baseline-evidence.md: Surfaces cannot be cross-checked: catalogues/repo_contract.csv or catalogues/contracts.csv is missing; build the catalogue`);
+            return out;
+        }
+        const repos = observedIn(evidence);
+        if (repos.length === 0)
+            out.push(`${dir}/baseline-evidence.md: Surfaces cannot be cross-checked: no **Observed in:** line names a repository`);
+        for (const r of repos) {
+            const known = servedBy.get(r);
+            if ((known?.served ?? []).length === 0) {
+                const consumed = known?.consumed ? ` (it consumes ${known.consumed}, which a baseline does not list)` : "";
+                out.push(`${dir}/baseline-evidence.md: Surfaces cannot be cross-checked: the catalogue records no contract that ${r} serves${consumed}; declare the contracts it serves in its repo-config`);
+            }
+            for (const c of known?.served ?? []) {
+                surfacesChecked++;
+                const former = formerIdentities(c.id, after);
+                if (!parsed.entries.some((e) => surfaceMatches(e.contract, c.id, c.specPath) || former.some((f) => surfaceMatches(e.contract, f.id, f.path)))) {
+                    out.push(`${dir}/baseline-evidence.md: Surfaces does not list ${c.specPath || c.id} (${c.id}), which ${r} serves (catalogues/repo_contract.csv, less what service_contract records it only consuming); list it as covered at transport or excluded with a reason`);
+                }
+            }
+        }
+        return out;
+    };
     // A baseline whose every requirement has since left the living specs (removed, or its spec retired) records a
     // surface that no longer exists; its Surfaces list is history, not checked against today's catalogue, or a
     // retired surface could never drop its contract.
@@ -841,33 +944,23 @@ export async function checkBehaviourStore(repo, options = {}) {
         const evidence = await readText(join(repo, dir, "baseline-evidence.md"));
         const isBaseline = evidence !== null;
         if (isBaseline) {
-            const parsed = parseSurfaces(evidence);
-            if (!parsed.present)
-                failures.push(`${dir}/baseline-evidence.md: no **Surfaces:** list; name every contract the observed repositories serve, covered at transport or excluded with a reason`);
-            for (const p of parsed.problems)
-                failures.push(`${dir}/baseline-evidence.md: Surfaces: ${p}`);
-            if (parsed.present && historical.has(name)) {
-                // history: see historicalBaselines
+            if (historical.has(name)) {
+                // history: see historicalBaselines; its gate and Surfaces list are not checked
+                const parsed = parseSurfaces(evidence);
+                if (!parsed.present)
+                    failures.push(`${dir}/baseline-evidence.md: no **Surfaces:** list; name every contract the observed repositories serve, covered at transport or excluded with a reason`);
+                for (const p of parsed.problems)
+                    failures.push(`${dir}/baseline-evidence.md: Surfaces: ${p}`);
             }
-            else if (parsed.present) {
-                if (servedBy === null) {
-                    failures.push(`${dir}/baseline-evidence.md: Surfaces cannot be cross-checked: catalogues/repo_contract.csv or catalogues/contracts.csv is missing; build the catalogue`);
-                }
-                else {
-                    const repos = observedIn(evidence);
-                    if (repos.length === 0)
-                        failures.push(`${dir}/baseline-evidence.md: Surfaces cannot be cross-checked: no **Observed in:** line names a repository`);
-                    for (const r of repos) {
-                        if ((servedBy.get(r) ?? []).length === 0) {
-                            failures.push(`${dir}/baseline-evidence.md: Surfaces cannot be cross-checked: catalogues/repo_contract.csv records no contract for ${r}; declare the contracts it serves in its repo-config`);
-                        }
-                        for (const c of servedBy.get(r) ?? []) {
-                            surfacesChecked++;
-                            if (!parsed.entries.some((e) => surfaceMatches(e.contract, c.id, c.specPath))) {
-                                failures.push(`${dir}/baseline-evidence.md: Surfaces does not list ${c.specPath || c.id} (${c.id}), which ${r} serves (catalogues/repo_contract.csv); list it as covered at transport or excluded with a reason`);
-                            }
-                        }
-                    }
+            else {
+                failures.push(...(await surfaceProblems(dir, evidence, order.indexOf(name))));
+                // The gate's outcome is recorded where the SDD ships record schema 1.4.0 or later when the baseline archives;
+                // a baseline archived earlier carries none and is not held to it.
+                const archivedAt = await integratedAt(repo, dir);
+                if (versionAtLeast(await shippedRecordSchema(repo, archivedAt), "1.4.0")) {
+                    const gate = baselineGate(evidence);
+                    if (gate !== "PASS")
+                        failures.push(`${dir}/baseline-evidence.md: archived ${gate === null ? "with no **Baseline gate:** line" : `with **Baseline gate:** ${gate}`}; a baseline archives once its gate passes: every requirement cites its evidence, characterization tests exist where the code has none, and every covered surface is evidenced at its transport (M-ADR 0222 §4.3)`);
                 }
             }
         }
@@ -902,8 +995,34 @@ export async function checkBehaviourStore(repo, options = {}) {
                 lastTouch.delete(`${feature}::${from}`);
         }
     }
-    const unseen = servedBy === null ? "" : `; repositories with no catalogue contracts: ${[...new Set(await observedInAll(repo, archiveRel, order))].filter((r) => (servedBy.get(r) ?? []).length === 0).join(", ") || "none"}`;
-    lines.push(baselines === 0 ? "surfaces: vacuous (no baseline)" : `surfaces: ${baselines} baseline(s), ${surfacesChecked} served contract(s) checked against catalogues/repo_contract.csv${unseen}${historical.size ? `; ${historical.size} historical baseline(s) not checked (every requirement they baselined has left the living specs)` : ""}`);
+    // An open baseline is asked the archive's questions while it can still be fixed: its Surfaces list, what it may
+    // change given the lineage so far, the features its deltas are keyed by, and its gate. Warnings, since it is in
+    // progress; `change archive` refuses what is still wrong when it archives.
+    const featureIds = await readText(join(repo, "catalogues", "features.csv")).then((t) => (t === null ? null : new Set(parseCatalogueCsv(t).rows.map((r) => r["id"] ?? ""))));
+    for (const change of openBaselines) {
+        const dir = `${STORE_DIR}/changes/${change}`;
+        const evidence = (await readText(join(repo, dir, "baseline-evidence.md"))) ?? "";
+        const found = [...(await surfaceProblems(dir, evidence))];
+        for (const feature of await dirs(join(repo, dir, "specs"))) {
+            if (featureIds !== null && !featureIds.has(feature))
+                found.push(`${dir}/specs/${feature}: no catalogue feature has the id "${feature}"; give the behaviour a feature first (M-ADR 0222 §4.4)`);
+            const text = (await readText(join(repo, dir, "specs", feature, "spec.md"))) ?? "";
+            for (const target of [...parseRequirements(text).filter((r) => r.operation === "MODIFIED" || r.operation === "REMOVED").map((r) => r.name), ...renamedFrom(text)]) {
+                scopeChecked++;
+                const last = lastTouch.get(`${feature}::${target}`);
+                if (last !== "baseline")
+                    found.push(`${dir}: a baseline changes "${target}" (${feature}), which ${last === "change" ? "a judged change last shipped" : "no earlier archived change admitted"}; a baseline may remove or modify only what a baseline admitted (M-ADR 0222 §4.4)`);
+            }
+        }
+        const gate = baselineGate(evidence);
+        if (gate !== "PASS")
+            found.push(`${dir}/baseline-evidence.md: ${gate === null ? "no **Baseline gate:** line yet" : `**Baseline gate:** ${gate}`}; it archives once the gate passes (M-ADR 0222 §4.3)`);
+        warnings.push(...found.map((w) => `open baseline: ${w}`));
+    }
+    if (openBaselines.length > 0)
+        lines.push(`open baselines: ${openBaselines.length}, asked the archive's questions as warnings`);
+    const unseen = servedBy === null ? "" : `; repositories with no catalogue contracts: ${[...new Set(await observedInAll(repo, archiveRel, order))].filter((r) => (servedBy.get(r)?.served ?? []).length === 0).join(", ") || "none"}`;
+    lines.push(baselines === 0 ? "surfaces: vacuous (no baseline)" : `surfaces: ${baselines} baseline(s), ${surfacesChecked} served contract(s) checked against catalogues/repo_contract.csv less what service_contract records only consumed${unseen}${historical.size ? `; ${historical.size} historical baseline(s) not checked (every requirement they baselined has left the living specs)` : ""}`);
     lines.push(scopeChecked === 0 ? "scope: vacuous (no baseline removes, modifies or renames a requirement)" : `scope: ${scopeChecked} requirement(s) a baseline removes, modifies or renames, checked against their lineage`);
     if (!history && archived.length > 0)
         lines.push("order: no git history (not a git work tree, or git log failed), so same-day archives cannot be ordered");
@@ -954,6 +1073,29 @@ export async function checkBehaviourStore(repo, options = {}) {
             lines.push(drift === 0 ? `schema: ${SCHEMA_NAME}, identical to the shipped copy` : `schema: ${SCHEMA_NAME}, ${drift} file(s) differ from the shipped copy`);
         }
     }
+    // The baseline schema: checked as sdd-change is where the bundle ships it (a bundle from before it shipped has none),
+    // and an open baseline selects it rather than sdd-change, whose Gate 0, test plan and agreement a baseline lacks.
+    if (selected === SCHEMA_NAME) {
+        const b = await compareStoreSchema(repo, BASELINE_SCHEMA_NAME);
+        if (b.shipped) {
+            const fix = "sdd-cli sync refreshes it; put adopter guidance in the store's config.yaml rules, not in the schema";
+            for (const f of b.missing)
+                failures.push(`${storeSchemaDir(BASELINE_SCHEMA_NAME)}/${f}: missing from the store's copy of the schema; ${fix}`);
+            for (const f of b.differing)
+                failures.push(`${storeSchemaDir(BASELINE_SCHEMA_NAME)}/${f}: differs from the shipped ${shippedSchemaDir(BASELINE_SCHEMA_NAME)}/${f}; ${fix}`);
+            for (const f of b.extra)
+                failures.push(`${storeSchemaDir(BASELINE_SCHEMA_NAME)}/${f}: not in the shipped schema; ${fix}`);
+            const drift = b.missing.length + b.differing.length + b.extra.length;
+            lines.push(drift === 0 ? `schema: ${BASELINE_SCHEMA_NAME}, identical to the shipped copy` : `schema: ${BASELINE_SCHEMA_NAME}, ${drift} file(s) differ from the shipped copy`);
+            for (const change of openBaselines) {
+                const meta = await readText(join(repo, STORE_DIR, "changes", change, ".openspec.yaml"));
+                const chosen = meta === null ? null : parseDocument(meta).toJS()?.schema;
+                if (chosen !== BASELINE_SCHEMA_NAME) {
+                    warnings.push(`open baseline: ${STORE_DIR}/changes/${change}/.openspec.yaml selects ${chosen === null || chosen === undefined ? "no schema" : `"${String(chosen)}"`}; a baseline selects ${BASELINE_SCHEMA_NAME} (schema: ${BASELINE_SCHEMA_NAME}), whose artifacts are a baseline's rather than a change's Gate 0, test plan and agreement`);
+                }
+            }
+        }
+    }
     const population = recordFiles.length + open.length + archived.length;
     const body = lines.map((l) => `  ${l}`).join("\n") + "\n";
     if (failures.length > 0) {
@@ -1012,25 +1154,47 @@ async function historicalBaselines(repo, archiveRel, order) {
     });
     return out;
 }
-/** Per repository, the contracts the catalogue says it serves (repo_contract ⋈ contracts.spec_path); null when either file is missing. */
+/**
+ * Per repository, the contracts the catalogue says it serves, with how many it only consumes; null when repo_contract or
+ * contracts is missing. repo_contract binds a repository to a contract in either direction, so a row is dropped where
+ * service_contract records the repository's services consuming that contract and none exposing it. Rows
+ * service_contract says nothing about stay: a model that omits a service's exposes rows does not shrink what is checked.
+ */
 async function catalogueContracts(repo) {
     const rc = await readText(join(repo, "catalogues", "repo_contract.csv"));
     const cs = await readText(join(repo, "catalogues", "contracts.csv"));
     if (rc === null || cs === null)
         return null;
     const spec = new Map(parseCatalogueCsv(cs).rows.map((r) => [r["id"] ?? "", r["spec_path"] ?? ""]));
+    const repoOf = new Map(parseCatalogueCsv((await readText(join(repo, "catalogues", "services.csv"))) ?? "").rows.map((r) => [r["id"] ?? "", r["primary_repo_id"] ?? ""]));
+    const roles = new Map();
+    for (const r of parseCatalogueCsv((await readText(join(repo, "catalogues", "service_contract.csv"))) ?? "").rows) {
+        const key = `${repoOf.get(r["service_id"] ?? "") ?? ""}\u0000${r["contract_id"] ?? ""}`;
+        roles.set(key, (roles.get(key) ?? new Set()).add(r["role"] ?? ""));
+    }
     const out = new Map();
     for (const r of parseCatalogueCsv(rc).rows) {
         const repoId = r["repo_id"] ?? "";
         const id = r["contract_id"] ?? "";
         if (repoId === "" || id === "")
             continue;
-        const list = out.get(repoId) ?? [];
-        list.push({ id, specPath: spec.get(id) ?? "" });
-        out.set(repoId, list);
+        const entry = out.get(repoId) ?? { served: [], consumed: 0 };
+        const role = roles.get(`${repoId}\u0000${id}`);
+        if (role?.has("consumes") && !role.has("exposes"))
+            entry.consumed++;
+        else
+            entry.served.push({ id, specPath: spec.get(id) ?? "" });
+        out.set(repoId, entry);
     }
     return out;
 }
+/** A baseline's recorded gate outcome: the last `**Baseline gate:** <outcome>` line's first word, upper-cased; null when there is none. */
+function baselineGate(evidence) {
+    let out = null;
+    for (const m of evidence.matchAll(/^\s*\*\*Baseline gate:\*\*\s*(\S+)/gm))
+        out = m[1].replace(/[^A-Za-z]/g, "").toUpperCase();
+    return out;
+}
 async function observedInAll(repo, archiveRel, names) {
     const out = [];
     for (const n of names) {

package/dist/lib/validate/structural-model.js

@@ -20,6 +20,9 @@
 //               element another open change adds names that change in depends_on
 //   no-op       contradicted by a behaviour delta for a feature the model does not hold; a structural delta
 //               must add that feature
+//   removals    each id a delta removes, against the rows outside the model that still name it: this SDD's catalogues
+//               built from its records and its members' catalogues (lib/structure/removals.ts). Reported as [WARN],
+//               not counted as a finding: a removal may be meant, and the warning names what it owes before the push
 // Composition (§4.5; lib/structure/compose.ts), with a change agreed when its agreement record says so:
 //   overlap     two agreed changes writing one element or adding one id; a change overlapping an agreed one
 //   composed    each change's view (with its dependency closure) and the intended view (every agreed change)
@@ -44,6 +47,7 @@ import { agreedOrder, attribute, checkDependencies, checkOverlap, closure, inten
 import { describeState, renderViews, VIEW_PATHS, viewState } from "../structure/render.js";
 import { Additions, CONTRACTS, readAgreement } from "../structure/intended.js";
 import { validateDeltas, validateView, viewOf } from "../structure/view.js";
+import { checkRemovals } from "../structure/removals.js";
 const VIEW_COUNT = Object.keys(VIEW_PATHS).length;
 /** Findings FAIL (from M-ADR 0230's acceptance); false reports them only, as while M-ADR 0230 was Proposed. Also binds a change's structural deltas as agreed content in the behaviour-store check. */
 export const ENFORCED = true;
@@ -222,6 +226,8 @@ export async function checkStructuralModel(repo, options = {}) {
         }
     }
     lines.push(`changes: ${changes.length} open, ${withDeltas} with structural deltas, ${noOps} claiming none, ${without} without the artifact`);
+    const removals = await checkRemovals(repo, schema, structures);
+    lines.push(...removals.lines);
     // Composition (M-ADR 0230 §4.5): the three views and the three checks.
     const archived = await archivedNames(repo);
     checkOverlap(open, problems);
@@ -268,7 +274,7 @@ export async function checkStructuralModel(repo, options = {}) {
     if (raw > 0)
         lines.push(`archived changes whose structure is not applied: ${raw}`);
     lines.push(`views: current; at each of ${[...open.values()].filter((o) => o.structure.deltas.length > 0).length} change(s) with deltas; intended from ${agreed.length} agreed change(s)`);
-    const body = lines.map((l) => `${l}\n`).join("");
+    const body = lines.map((l) => `${l}\n`).join("") + removals.findings.map((w) => `[WARN] ${w}\n`).join("");
     if (problems.length === 0)
         return { exitCode: 0, stdout: `structural-model:\n${body}[PASS] structural-model: ok\n` };
     const tag = enforced ? "FAIL" : "WARN";

package/dist/maintain-version.json

@@ -1,4 +1,4 @@
 {
-  "version": "0.16.1",
-  "built_against_sdd_cli": "5.2.1"
+  "version": "0.17.0",
+  "built_against_sdd_cli": "5.3.0"
 }

package/dist/verify-version.json

@@ -1,4 +1,4 @@
 {
-  "version": "5.2.1",
-  "built_against_sdd_cli": "5.2.1"
+  "version": "5.3.0",
+  "built_against_sdd_cli": "5.3.0"
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@sdd-method/maintain-cli",
-  "version": "0.16.1",
-  "sddCliVersion": "5.2.1",
+  "version": "0.17.0",
+  "sddCliVersion": "5.3.0",
   "description": "Bring an SDD repository current and rebuild its derived model — sync, briefing, catalogue build and aggregate, pack build, context pull — plus every read-only verify verb. Ships only the code those verbs reach; it cannot author specification content. Authoring is in @sdd-method/sdd-cli.",
   "license": "UNLICENSED",
   "type": "module",