@sdd-method/sdd-cli 0.123.0 → 1.0.0

package/dist/lib/catalogue/aggregate.d.ts

@@ -1,4 +1,4 @@
-import { type CatalogueDef } from "./schema-loader.js";
+import { type CanonicalSchema, type CatalogueDef } from "./schema-loader.js";
 import { parseCatalogueCsv } from "./csv-reader.js";
 import { type CatalogueRow } from "./csv-writer.js";
 import { FindingsLog } from "./findings.js";
@@ -31,6 +31,7 @@ export interface AggregateResult {
 }
 export type Writer = (s: string) => void;
 export declare function runCatalogueAggregate(inputs: AggregateInputs, write: Writer): Promise<AggregateResult>;
+export declare function dedupExternalSystems(rowsByCatalogue: Map<string, CatalogueRow[]>, findings: FindingsLog): void;
 declare function stampSourceSddId(catalogue: CatalogueDef, rows: readonly Record<string, string>[], sourceSddId: string): CatalogueRow[];
 /**
  * Resolve cross-SDD `screen_feature` edges (schema 2.24.0, R3).
@@ -99,7 +100,9 @@ export interface AdjudicationSummary {
  * REFERENCE (§4.1), and even L1 declarations may name something the estate
  * owns (measured: 39% of one estate's dependency edges pointed at an
  * external-system row denoting its own platform). Identity is the declared
- * diagram entry id (§4.2), with the display-name slug as fallback.
+ * diagram entry id (§4.2) — at schema 3.0.0 the row id derives from it
+ * (M-ADR 0203 §4.2) — with the display name only as a unique-match
+ * fallback.
  *
  * Outcomes per candidate:
  *  - resolves to an internal system of kind platform/subsystem/application:
@@ -119,6 +122,27 @@ export interface AdjudicationSummary {
  * Exported for testing.
  */
 export declare function adjudicateExternalSystems(rowsByCatalogue: Map<string, CatalogueRow[]>, findings: FindingsLog): AdjudicationSummary;
+export interface ContractRekeySummary {
+    readonly rekeyed: number;
+    readonly deduped: number;
+    readonly ambiguous: number;
+}
+/**
+ * M-ADR 0203 §4.4's cross-SDD detector-and-re-key, cut window only.
+ *
+ * Every FK referencing `contracts.id` (schema-driven, so a future contract
+ * edge is covered without touching this) is scanned over the merged rows: a
+ * value that resolves to no contract, but whose `${value}-${kind}` form
+ * resolves via the legacy map built from the MERGED contracts rows, is a
+ * provably tool-authored 2.x id — regenerable, not drift. The value re-keys
+ * and the composite row id's embedded `__`-delimited component re-keys with
+ * it. A re-keyed row whose id then collides with an existing row is the
+ * same fact asserted under both eras — deduped, counted. An old id that was
+ * a 2.x cross-family collision maps to several contracts: loud and left
+ * dangling for FK validation to report (the author qualifies; never a
+ * guess). Exported for testing.
+ */
+export declare function rekeyLegacyContractRefs(schema: CanonicalSchema, rowsByCatalogue: Map<string, CatalogueRow[]>, findings: FindingsLog): ContractRekeySummary;
 /**
  * M-ADR 0133 §4.2c open hygiene, shipped with M-ADR 0189 §4.4: the
  * `platform` kind is documented "exactly one per ecosystem after federation

package/dist/lib/catalogue/aggregate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"aggregate.d.ts","sourceRoot":"","sources":["../../../src/lib/catalogue/aggregate.ts"],"names":[],"mappings":"AA+BA,OAAO,EAA6C,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClG,OAAO,EAAoB,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACtE,OAAO,EAAkB,KAAK,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAEpE,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAc5C,MAAM,WAAW,eAAe;IAC9B,6DAA6D;IAC7D,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;OAKG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,qEAAqE;IACrE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,sDAAsD;IACtD,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChD,mEAAmE;IACnE,QAAQ,CAAC,gBAAgB,EAAE,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC5E,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;IACnC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;AAEzC,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,eAAe,EACvB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,eAAe,CAAC,CAyV1B;AAsUD,iBAAS,gBAAgB,CACvB,SAAS,EAAE,YAAY,EACvB,IAAI,EAAE,SAAS,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EACvC,WAAW,EAAE,MAAM,GAClB,YAAY,EAAE,CAUhB;AA2MD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,4BAA4B,CAC1C,cAAc,EAAE,SAAS,YAAY,EAAE,EACvC,QAAQ,EAAE,SAAS,YAAY,EAAE,EACjC,QAAQ,EAAE,WAAW,GACpB,YAAY,EAAE,CAiDhB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,SAAS,YAAY,EAAE,EACjC,iBAAiB,EAAE,WAAW,CAAC,MAAM,CAAC,EACtC,QAAQ,EAAE,WAAW,GACpB,IAAI,CAoBN;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC;;;;;OAKG;IACH,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,qGAAqG;IACrG,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,sEAAsE;IACtE,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,mFAAmF;IACnF,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,yGAAyG;IACzG,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,+EAA+E;IAC/E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,+GAA+G;IAC/G,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,kEAAkE;IAClE,QAAQ,CAAC,uBAAuB,EAAE,MAAM,CAAC;IACzC,oFAAoF;IACpF,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;CACtC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,yBAAyB,CACvC,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,EAAE,CAAC,EAC5C,QAAQ,EAAE,WAAW,GACpB,mBAAmB,CAylBrB;AAED;;;;GAIG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,SAAS,YAAY,EAAE,EAChC,QAAQ,EAAE,WAAW,GACpB,IAAI,CAYN;AAED;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,SAAS,YAAY,EAAE,EAChC,QAAQ,EAAE,WAAW,GACpB,IAAI,CAoBN;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,gCAAgC,CAC9C,mBAAmB,EAAE,SAAS,YAAY,EAAE,EAC5C,kBAAkB,EAAE,SAAS,YAAY,EAAE,EAC3C,QAAQ,EAAE,WAAW,GACpB,YAAY,EAAE,CAqIhB;AAID,eAAO,MAAM,aAAa;;;CAA0C,CAAC"}
+{"version":3,"file":"aggregate.d.ts","sourceRoot":"","sources":["../../../src/lib/catalogue/aggregate.ts"],"names":[],"mappings":"AA+BA,OAAO,EAAuB,KAAK,eAAe,EAAE,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClG,OAAO,EAAoB,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACtE,OAAO,EAAkB,KAAK,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAGpE,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAc5C,MAAM,WAAW,eAAe;IAC9B,6DAA6D;IAC7D,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;OAKG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,qEAAqE;IACrE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,sDAAsD;IACtD,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChD,mEAAmE;IACnE,QAAQ,CAAC,gBAAgB,EAAE,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC5E,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;IACnC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;AAEzC,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,eAAe,EACvB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,eAAe,CAAC,CAyW1B;AA2DD,wBAAgB,oBAAoB,CAClC,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,EAAE,CAAC,EAC5C,QAAQ,EAAE,WAAW,GACpB,IAAI,CAkFN;AAgPD,iBAAS,gBAAgB,CACvB,SAAS,EAAE,YAAY,EACvB,IAAI,EAAE,SAAS,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EACvC,WAAW,EAAE,MAAM,GAClB,YAAY,EAAE,CAUhB;AA2MD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,4BAA4B,CAC1C,cAAc,EAAE,SAAS,YAAY,EAAE,EACvC,QAAQ,EAAE,SAAS,YAAY,EAAE,EACjC,QAAQ,EAAE,WAAW,GACpB,YAAY,EAAE,CAiDhB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,SAAS,YAAY,EAAE,EACjC,iBAAiB,EAAE,WAAW,CAAC,MAAM,CAAC,EACtC,QAAQ,EAAE,WAAW,GACpB,IAAI,CAoBN;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC;;;;;OAKG;IACH,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,qGAAqG;IACrG,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,sEAAsE;IACtE,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,mFAAmF;IACnF,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,yGAAyG;IACzG,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,+EAA+E;IAC/E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,+GAA+G;IAC/G,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,kEAAkE;IAClE,QAAQ,CAAC,uBAAuB,EAAE,MAAM,CAAC;IACzC,oFAAoF;IACpF,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;CACtC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,yBAAyB,CACvC,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,EAAE,CAAC,EAC5C,QAAQ,EAAE,WAAW,GACpB,mBAAmB,CA6oBrB;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,eAAe,EACvB,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,EAAE,CAAC,EAC5C,QAAQ,EAAE,WAAW,GACpB,oBAAoB,CAgFtB;AAED;;;;GAIG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,SAAS,YAAY,EAAE,EAChC,QAAQ,EAAE,WAAW,GACpB,IAAI,CAYN;AAED;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,SAAS,YAAY,EAAE,EAChC,QAAQ,EAAE,WAAW,GACpB,IAAI,CAoBN;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,gCAAgC,CAC9C,mBAAmB,EAAE,SAAS,YAAY,EAAE,EAC5C,kBAAkB,EAAE,SAAS,YAAY,EAAE,EAC3C,QAAQ,EAAE,WAAW,GACpB,YAAY,EAAE,CAqIhB;AAID,eAAO,MAAM,aAAa;;;CAA0C,CAAC"}

package/dist/lib/catalogue/aggregate.js

@@ -27,6 +27,7 @@ import { SCHEMA_COMPAT } from "./schema-compat.js";
 import { loadCanonicalSchema } from "./schema-loader.js";
 import { readCatalogueCsv, parseCatalogueCsv } from "./csv-reader.js";
 import { writeCatalogue } from "./csv-writer.js";
+import { buildLegacyContractIdMap } from "./contract-id.js";
 import { validateForeignKeys } from "./fk-validator.js";
 import { FindingsLog } from "./findings.js";
 import { mergeEdgeLabel } from "./builders/edge-label-merge.js";
@@ -220,6 +221,19 @@ export async function runCatalogueAggregate(inputs, write) {
         `${adjudication.exempted} exempted, ${adjudication.unverified} unverified\n`);
     // 5g. Platform-kind uniqueness (M-ADR 0133 §4.2c open hygiene).
     checkPlatformKindUniqueness(rowsByCatalogue.get("c4_systems") ?? [], findings);
+    // 5h. M-ADR 0203 §4.4 cross-SDD re-key: the contract-id migration derives
+    // per-SDD, but contract-FK edges cross SDD boundaries — a federated SDD
+    // that owns no contracts has an empty map, so its references keep the 2.x
+    // kindless ids (measured on the first rehearsal probe: 170 dangling FKs
+    // over 6 old ids). This tier sees every contract row, so the old form is
+    // decidable here and nowhere earlier.
+    const contractRekey = rekeyLegacyContractRefs(schema, rowsByCatalogue, findings);
+    // Always emitted: an absent line is indistinguishable from a check that
+    // never ran (M-ADR 0200 §4.3 — a zero must be affirmable). Measured: the
+    // first all-zero estate correctly refused to report "0" for a line that
+    // was never printed.
+    write(`  contract-id cut window (M-ADR 0203 §4.4): ${contractRekey.rekeyed} cross-SDD reference(s) re-keyed, ` +
+        `${contractRekey.deduped} duplicate fact(s) dropped, ${contractRekey.ambiguous} ambiguous left dangling\n`);
     // 6. Duplicate primary key check.
     const duplicates = findDuplicatePrimaryKeys(schema, rowsByCatalogue);
     if (duplicates.length > 0) {
@@ -335,21 +349,31 @@ function rederiveAppend(rowsByCatalogue, catalogueName, rederivedRows) {
     const added = rederivedRows.filter((r) => !existingIds.has(String(r["id"])));
     rowsByCatalogue.set(catalogueName, [...concatenated, ...added]);
 }
-function dedupExternalSystems(rowsByCatalogue, findings) {
+export function dedupExternalSystems(rowsByCatalogue, findings) {
     const rows = rowsByCatalogue.get("c4_external_systems");
     if (rows === undefined || rows.length === 0)
         return;
     const byId = new Map();
+    const namesById = new Map();
     for (const row of rows) {
         const id = String(row["id"] ?? "");
         if (id === "")
             continue;
+        const name = String(row["name"] ?? "");
+        const names = namesById.get(id);
+        if (names) {
+            if (name !== "" && !names.includes(name))
+                names.push(name);
+        }
+        else {
+            namesById.set(id, name === "" ? [] : [name]);
+        }
         const existing = byId.get(id);
         if (existing === undefined) {
             byId.set(id, row);
             continue;
         }
-        for (const attr of ["name", "technology", "description"]) {
+        for (const attr of ["technology", "description"]) {
             const a = String(existing[attr] ?? "");
             const b = String(row[attr] ?? "");
             if (a !== "" && b !== "" && a !== b) {
@@ -357,6 +381,47 @@ function dedupExternalSystems(rowsByCatalogue, findings) {
             }
         }
     }
+    // M-ADR 0203 §4.2's second fallout detector — the mirror image of the
+    // same-name split. With identity now the DECLARED entry id, a generic
+    // diagram-local mnemonic shared across SDDs merges DIFFERENT real-world
+    // systems into one row (measured before this shipped: 17 integration
+    // SDDs each declaring their provider under one shared mnemonic — 17
+    // providers, one surviving row). A merge whose display names corroborate
+    // (compact-equal or token-subset — benign label variance on one
+    // referent) stays the quiet dedup this catalogue is designed for; a
+    // merge whose names DON'T corroborate is likely N referents under one
+    // entry id, and every hidden referent is named. Rename the diagram entry
+    // ids apart — a diagram edit, the M-ADR 0189 §4.2 sanctioned opt-out.
+    const compactName = (s) => s.toLowerCase().replace(/[^a-z0-9]/g, "");
+    const nameTokens = (s) => new Set(s
+        .replace(/([a-z0-9])([A-Z])/g, "$1 $2")
+        .toLowerCase()
+        .split(/[^a-z0-9]+/)
+        .filter((t) => t !== ""));
+    const namesCorroborate = (a, b) => {
+        if (compactName(a) === compactName(b))
+            return true;
+        const ta = nameTokens(a);
+        const tb = nameTokens(b);
+        const subset = (x, y) => x.size > 0 && [...x].every((t) => y.has(t));
+        return subset(ta, tb) || subset(tb, ta);
+    };
+    for (const [id, names] of namesById) {
+        if (names.length < 2)
+            continue;
+        const anchor = names[0];
+        const strangers = names.slice(1).filter((n) => !namesCorroborate(anchor, n));
+        if (strangers.length === 0) {
+            // Corroborating label variance — keep the plain per-attr conflict
+            // shape the pre-3.0.0 dedup reported.
+            findings.add("convention", `c4_external_systems: id "${id}" has conflicting name across SDDs [${names.join(", ")}] — first-seen kept`);
+            continue;
+        }
+        findings.add("divergence", `c4_external_systems: declared id "${id}" merges ${names.length} rows whose display names do not corroborate ` +
+            `[${names.join(" | ")}] — likely DIFFERENT systems under one shared diagram entry id; ` +
+            `first-seen kept and ${names.length - 1} referent(s) are hidden by this merge. ` +
+            `Rename the diagram entry ids apart (M-ADR 0203 §4.2 / M-ADR 0189 §4.2)`);
+    }
     rowsByCatalogue.set("c4_external_systems", [...byId.values()]);
 }
 // Method-scoped ADRs (doc_path under docs/method/adr/) are the shared method
@@ -833,7 +898,9 @@ export function checkSuccessorReferences(products, contributorSddIds, findings)
  * REFERENCE (§4.1), and even L1 declarations may name something the estate
  * owns (measured: 39% of one estate's dependency edges pointed at an
  * external-system row denoting its own platform). Identity is the declared
- * diagram entry id (§4.2), with the display-name slug as fallback.
+ * diagram entry id (§4.2) — at schema 3.0.0 the row id derives from it
+ * (M-ADR 0203 §4.2) — with the display name only as a unique-match
+ * fallback.
  *
  * Outcomes per candidate:
  *  - resolves to an internal system of kind platform/subsystem/application:
@@ -915,7 +982,11 @@ export function adjudicateExternalSystems(rowsByCatalogue, findings) {
         }
     }
     const resolveSystem = (ext) => {
-        const declared = norm(String(ext["declared_id"] ?? ""));
+        // Schema 3.0.0: the row id itself derives from the declared entry id
+        // (M-ADR 0203 §4.2), so the id-slug IS declared identity — it backstops
+        // an empty declared_id cell, and a hit through it is a declared hit
+        // (corroboration-gated), never a label-keyed one.
+        const declared = norm(String(ext["declared_id"] ?? "")) || String(ext["id"]).replace(/^ext-/, "");
         if (declared !== "") {
             for (const cand of [declared, `${declared}-system`]) {
                 if (systemIds.has(cand))
@@ -925,14 +996,26 @@ export function adjudicateExternalSystems(rowsByCatalogue, findings) {
             if (viaProduct !== undefined)
                 return { id: viaProduct, method: "declared" };
         }
-        const slug = String(ext["id"]).replace(/^ext-/, "");
-        for (const cand of [slug, `${slug}-system`]) {
-            if (systemIds.has(cand))
-                return { id: cand, method: "name" };
+        // NAME evidence, per M-ADR 0189 §4.2's ratified fallback ("the
+        // display-name slug remains only as a fallback for entries whose id
+        // resolves to nothing"). Under 2.x the row id WAS the name slug, so
+        // the id-slug path carried this; at 3.0.0 the slug must be derived
+        // from the name itself or the fallback silently narrows — measured on
+        // the first forward-estate probe: 35 of 38 internal platform edges
+        // reclassified external because `System_Ext(platform, "Acme
+        // Platform", …)` stopped resolving against the `acme-platform`
+        // product. Every hit here is method "name" (label-keyed — the
+        // conversion emits the §4.2 convention finding).
+        const nameSlug = norm(String(ext["name"] ?? ""));
+        if (nameSlug !== "") {
+            for (const cand of [nameSlug, `${nameSlug}-system`]) {
+                if (systemIds.has(cand))
+                    return { id: cand, method: "name" };
+            }
+            const viaNameProduct = systemByProduct.get(nameSlug);
+            if (viaNameProduct !== undefined)
+                return { id: viaNameProduct, method: "name" };
         }
-        const viaSlugProduct = systemByProduct.get(slug);
-        if (viaSlugProduct !== undefined)
-            return { id: viaSlugProduct, method: "name" };
         const byName = systemsByName.get(compact(String(ext["name"] ?? "")));
         if (byName !== undefined && byName.length === 1) {
             return { id: byName[0], method: "name" };
@@ -965,6 +1048,8 @@ export function adjudicateExternalSystems(rowsByCatalogue, findings) {
         if (declarerSystem !== undefined) {
             const own = containerKeysBySystem.get(declarerSystem);
             if (own !== undefined) {
+                // The id-slug key duplicates the declared key at 3.0.0 (the row id
+                // derives from the entry id) but backstops an empty declared_id.
                 for (const key of [
                     compact(String(ext["declared_id"] ?? "")),
                     compact(String(ext["id"]).replace(/^ext-/, "")),
@@ -977,7 +1062,8 @@ export function adjudicateExternalSystems(rowsByCatalogue, findings) {
             }
         }
         const extName = String(ext["name"] ?? "");
-        const declaredKey = compact(String(ext["declared_id"] ?? ""));
+        const declaredKey = compact(String(ext["declared_id"] ?? "")) ||
+            compact(String(ext["id"]).replace(/^ext-/, ""));
         const byKey = declaredKey !== "" ? containersByKey.get(declaredKey) : undefined;
         if (byKey !== undefined) {
             const corroborating = byKey.filter((cid) => corroboratesLabel(extName, containerNameById.get(cid) ?? "", ""));
@@ -1367,6 +1453,35 @@ export function adjudicateExternalSystems(rowsByCatalogue, findings) {
         if (!existingIds.has(String(row["id"])))
             merged.push(row);
     }
+    // M-ADR 0203 §4.2's detector for its own fallout: with row identity now
+    // the DECLARED entry id, SDDs that declared different entry ids for one
+    // real-world external system split into distinct rows — where the 2.x
+    // name-slug ids silently merged them. Measured before this shipped: 5 old
+    // ids deriving 2-3 conflicting new ids across one estate's SDDs. The
+    // split must be loud, not latent: one display name held by several kept
+    // declared identities is either one estate entity (converge the diagram
+    // entry ids — the rename is a diagram edit, the sanctioned opt-out) or
+    // genuinely several (rename the labels apart). Convention, not an error:
+    // the aggregator cannot know which.
+    const keptByName = new Map();
+    for (const ext of keptExts) {
+        const key = compact(String(ext["name"] ?? ""));
+        if (key === "")
+            continue;
+        const ids = keptByName.get(key);
+        if (ids)
+            ids.push(String(ext["id"]));
+        else
+            keptByName.set(key, [String(ext["id"])]);
+    }
+    for (const [, ids] of [...keptByName.entries()].sort((a, b) => a[0].localeCompare(b[0]))) {
+        if (ids.length < 2)
+            continue;
+        const sorted = [...ids].sort((a, b) => a.localeCompare(b));
+        findings.add("convention", `c4_external_systems: one display name "${String(keptExts.find((e) => String(e["id"]) === sorted[0])?.["name"] ?? "")}" is held by ${sorted.length} declared identities [${sorted.join(", ")}] — ` +
+            `either one estate entity split by divergent diagram entry ids (converge the entry ids) ` +
+            `or several entities sharing a label (rename the labels apart) (M-ADR 0203 §4.2)`);
+    }
     rowsByCatalogue.set("c4_external_systems", keptExts);
     rowsByCatalogue.set("system_external_dependency", keptDeps);
     rowsByCatalogue.set("system_system_dependency", merged);
@@ -1385,6 +1500,99 @@ export function adjudicateExternalSystems(rowsByCatalogue, findings) {
         systemFallbackEdges,
     };
 }
+/**
+ * M-ADR 0203 §4.4's cross-SDD detector-and-re-key, cut window only.
+ *
+ * Every FK referencing `contracts.id` (schema-driven, so a future contract
+ * edge is covered without touching this) is scanned over the merged rows: a
+ * value that resolves to no contract, but whose `${value}-${kind}` form
+ * resolves via the legacy map built from the MERGED contracts rows, is a
+ * provably tool-authored 2.x id — regenerable, not drift. The value re-keys
+ * and the composite row id's embedded `__`-delimited component re-keys with
+ * it. A re-keyed row whose id then collides with an existing row is the
+ * same fact asserted under both eras — deduped, counted. An old id that was
+ * a 2.x cross-family collision maps to several contracts: loud and left
+ * dangling for FK validation to report (the author qualifies; never a
+ * guess). Exported for testing.
+ */
+export function rekeyLegacyContractRefs(schema, rowsByCatalogue, findings) {
+    const contracts = rowsByCatalogue.get("contracts") ?? [];
+    const contractIds = new Set(contracts.map((r) => String(r["id"])));
+    const legacyMap = buildLegacyContractIdMap(contracts);
+    let rekeyed = 0;
+    let deduped = 0;
+    let ambiguous = 0;
+    if (legacyMap.size === 0)
+        return { rekeyed, deduped, ambiguous };
+    for (const cat of schema.catalogues) {
+        const fkCols = cat.foreignKeys
+            .filter((fk) => fk.references === "contracts.id")
+            .map((fk) => fk.column);
+        if (fkCols.length === 0 || cat.name === "contracts")
+            continue;
+        const rows = rowsByCatalogue.get(cat.name) ?? [];
+        if (rows.length === 0)
+            continue;
+        const perOldId = new Map();
+        const ambiguousOld = new Map();
+        const kept = [];
+        const idsAfter = new Set(rows.map((r) => String(r["id"])));
+        for (const row of rows) {
+            let dropped = false;
+            let current = row;
+            for (const col of fkCols) {
+                const value = String(current[col] ?? "");
+                if (value === "" || contractIds.has(value))
+                    continue;
+                const mapped = legacyMap.get(value);
+                if (mapped === undefined)
+                    continue;
+                if (mapped.length > 1) {
+                    ambiguousOld.set(value, mapped);
+                    continue;
+                }
+                const newVal = mapped[0];
+                const oldRowId = String(current["id"] ?? "");
+                const newRowId = oldRowId
+                    .split("__")
+                    .map((part) => (part === value ? newVal : part))
+                    .join("__");
+                if (newRowId !== oldRowId && idsAfter.has(newRowId)) {
+                    // The same edge fact already exists under the new id (typically
+                    // the owning SDD's own re-keyed row) — one fact, two eras.
+                    deduped++;
+                    dropped = true;
+                    break;
+                }
+                const replaced = {
+                    ...current,
+                    [col]: newVal,
+                };
+                if (newRowId !== oldRowId) {
+                    idsAfter.delete(oldRowId);
+                    idsAfter.add(newRowId);
+                    replaced["id"] = newRowId;
+                }
+                current = replaced;
+                perOldId.set(value, (perOldId.get(value) ?? 0) + 1);
+                rekeyed++;
+            }
+            if (!dropped)
+                kept.push(current);
+        }
+        rowsByCatalogue.set(cat.name, kept);
+        for (const [oldId, count] of [...perOldId.entries()].sort((a, b) => a[0].localeCompare(b[0]))) {
+            findings.add("inferred", `${cat.name}: ${count} cross-SDD reference(s) to "${oldId}" re-keyed to "${legacyMap.get(oldId)[0]}" — ` +
+                `2.x kindless contract id migrated per the 3.0.0 map (regenerable, not drift; M-ADR 0203 §4.4)`);
+        }
+        for (const [oldId, targets] of [...ambiguousOld.entries()].sort((a, b) => a[0].localeCompare(b[0]))) {
+            ambiguous++;
+            findings.add("convention", `${cat.name}: references to "${oldId}" map to ${targets.length} contracts at 3.0.0 [${targets.join(", ")}] — ` +
+                `a 2.x cross-family collision; the referencing SDD must qualify with the kind-suffixed id; left dangling (M-ADR 0203 §4.4)`);
+        }
+    }
+    return { rekeyed, deduped, ambiguous };
+}
 /**
  * M-ADR 0133 §4.2c open hygiene, shipped with M-ADR 0189 §4.4: the
  * `platform` kind is documented "exactly one per ecosystem after federation