@sdd-method/sdd-cli 1.12.1 → 1.20.0

package/dist/lib/catalogue/canonical-schema.yaml

@@ -8,12 +8,21 @@
 #   - Downstream tools (DuckDB, pandas) for type information.
 #   - sdd-mcp `sdd://catalogue/schema` resource (Phase 8).
 #
-# Distribution: ships in every method baseline (platform-baseline,
-# app-baseline, integration-baseline) via the seed-file lists at
-# docs/method/foundations/*-method-seed-files.txt. Consumers receive it
-# through `sdd-cli sync`. Drift detection comes for free from the
-# refuse-or-overwrite model in M-ADR 0114 — the schema is in
-# MANAGED_PATHS.txt; consumer-side modification fails the next sync.
+# Distribution: NOT via a baseline bundle. This file relocated into sdd-cli at
+# v0.9.0 and is in NO seed list — the three forward seed lists record the
+# relocation in their own comments. Verified in-tarball (2026-08-09): absent from
+# platform-baseline, app-baseline, integration-baseline and
+# reverse-extension-baseline; present in the installed CLI at
+# dist/lib/catalogue/canonical-schema.yaml. So a schema change reaches estates
+# through a CLI RELEASE, not through a cut or a sync, and the M-ADR 0114
+# refuse-or-overwrite/MANAGED_PATHS drift model does NOT apply to it.
+#
+# ⚠ The stale form of this note claimed the opposite on all three counts
+# (ships in every baseline / arrives via `sdd-cli sync` / guarded by
+# MANAGED_PATHS.txt). That claim mis-scoped a release plan once — it makes a
+# schema minor look like a multi-repo bundle wave when it is a CLI publish.
+# Truth direction for the copies: canonical HERE → vendored in sdd-cli via
+# scripts/sync-canonical-schema.sh. Never author into the vendored copy.
 #
 # Schema versioning: every structural change increments schema_version.
 #
@@ -62,9 +71,144 @@
 # Builder contract: see docs/method/methods/guides/catalogue-builder-specification.md.
 # Category taxonomy: see docs/method/methods/standards/product-category-taxonomy.md.
 
-schema_version: "3.4.0"
+schema_version: "3.8.0"
 schema_owner: "sdd-method"
 schema_status: "canonical"
+# Bump rationale (3.8.0 — additive minor, per M-ADR 0157 §4.3 and M-ADR 0143 §4.4 as
+# amended): `capability_service.role` gains a closed enum (`enums.capability_service_role`,
+# bound via column_enums) carrying the four values the capability traceability manifest
+# template has documented since it offered the field — primary | related | dependency |
+# backend-gateway. Until now the catalogue column was an undescribed free string, so no
+# builder could filter on a role and no consumer could be told what one meant. Why now:
+# `repo_capability` is described as "repo CONTRIBUTES to capability" but its universal
+# reverse path (capability_service ⋈ services.primary_repo_id) emitted an edge for EVERY
+# role, so a capability's declared `dependency` on a service surfaced downstream as that
+# service's repo implementing the capability. Measured before the fix: 102 of 165
+# repo_capability rows in the forward reference estate (62%) rested only on non-primary
+# roles (dependency 55, related 47); one row in the reverse reference estate. The builder
+# now excludes `dependency` from Path X and keeps `related` and `backend-gateway`, which
+# participate in delivering the capability (`related` was realising in every measured
+# use). Nullable stays true — the enum validator checks values, not presence. Also in this
+# bump: the 3.7.0 rationale below says "43 catalogues"; the count is 44 (every catalogue
+# carrying `source_sdd_id`), and the 45th `platform_sdd_id` — on
+# `cross_sdd_platform_capability` — is that edge's own platform leg (schema 2.9.0), not
+# the 0208 stamp (M-ADR 0208 §4.4 as corrected). Zero authored-content change.
+# Bump rationale (3.7.0 — additive minor, 2026-09-02, per M-ADR 0208): every node
+# catalogue that carries `source_sdd_id` gains `platform_sdd_id` — the platform a row
+# belongs to, stamped by the aggregator from its own identity with preserve-if-set
+# semantics (M-ADR 0134 §4.5 step 4 applied to a second column), per the fill rule in
+# 0208 §4.4. Nullable; per-SDD builders leave it empty. Why: every aggregate the method
+# had produced held exactly one platform-root, so "which platform does this row belong
+# to" was answered by membership and never stored. The reference adopter's
+# organisation-tier aggregate holds 96 platform-roots, and there the question has no
+# answer in the data: the federation edge for members, and the org-tier key of
+# `domains` (`(platform_sdd_id, id)` — two platforms may each own `identity`), both
+# need this column. 43 catalogues; measured on the org rollup that 1,959 rows carry a
+# domain reference across 13 FK columns and 20 member capability rows reference a
+# platform domain in the second adopter, so the column is needed on member rows now,
+# not later. Zero authored-content change. Also corrected in this bump: the 2.28.0
+# rationale below says the platform cardinality is "an invariant nothing yet enforces"
+# — stale since M-ADR 0189 §4.4 shipped checkPlatformKindUniqueness; 0208 §4.2 gives
+# that check its tier. And the `subsystem` enum text "estate model" -> "platform model".
+#
+# Bump rationale (3.6.0 — additive-narrowing minor, 2026-08-09): 3.5.0 admitted TWO
+# ORTHOGONAL AXES into `capabilities.status`, and this corrects it. Raised by the
+# forward estate against the producer, one release later.
+#
+# M-ADR 0201 §1, verbatim: "The spec-lifecycle gate validates a `**Status:**`
+# vocabulary of `placeholder | first-draft | detailed-pre-lock` — FORWARD-AUTHORING
+# STAGES, each with structural requirements." §4.1 extends that ladder with
+# `reverse-derived`. So `placeholder` and `detailed-pre-lock` are rungs on the
+# SPEC-AUTHORING ladder, which lives in the spec header and is already gated there.
+# 3.5.0 admitted both into a LIFECYCLE column, so one field carried two axes.
+#
+# Measured at the forward estate (78 canonical manifests / 74 capability rows):
+# every capability spec carries a `**Status:**` header — detailed-pre-lock 57,
+# placeholder 15, first-draft 2, ZERO missing, and NOT ONE of those is a lifecycle
+# word. The two surfaces disagree on 61 of 78 rows. That is NOT 61 defects: it is
+# two axes disagreeing because they ARE two axes, and reading it as defects is the
+# error the figure invites.
+#
+# So `capabilities.status` narrows to LIFECYCLE ONLY:
+#   active | planned | exploration | deprecated
+# `exploration` stays — it is NOT on M-ADR 0201's authoring ladder, it has M-ADR
+# 0089's workflow and gates behind it, and it describes the capability rather than
+# its document. `placeholder` and `detailed-pre-lock` are RETRACTED from this column.
+#
+# ⚠ THE SYMMETRY THAT SETTLED IT: 3.5.0 added `contract_provenance` precisely so a
+# PROVENANCE claim would stop being written into a MATURITY ladder — and in the same
+# change-set wrote an AUTHORING-STAGE claim into a LIFECYCLE ladder, one field over.
+# Same defect class, same change-set, opposite directions. The fix for one is the
+# argument for the other.
+#
+# ⚠ Why this is a correction and not an amendment of 3.5.0: 3.5.0 was never
+# published to the registry, but it WAS vendored, built into a locally-installed CLI,
+# and cited by an estate's committed work. A version that means two different things
+# is the defect this programme keeps paying for, so the vocabulary change gets its
+# own number.
+#
+# COST, stated because it lands on an estate rather than here: the forward estate's
+# re-authoring goes from 1 row back to 18 (11 `placeholder` + 6 `detailed-pre-lock`
+# + 1 `first-draft`). No information is lost — the authoring stage those 17 rows were
+# expressing is ALREADY declared in each spec's own header, where the spec-lifecycle
+# gate validates it. What changes is that the lifecycle column stops carrying a
+# second axis, so a reader can finally tell what `capabilities.status` is claiming.
+# Nothing is enforced: still no `column_enums` binding, so the 18 surface as
+# non-gating convention findings and no build breaks.
+# Bump rationale (3.5.0 — additive minor, 2026-08-09): the capability lifecycle
+# vocabulary is widened to what estates measurably author, and contract-set
+# PROVENANCE gains a column so it stops being written into a maturity field.
+# Both halves come from estates executing the method rather than reading it.
+#
+# 1. `capabilities.status` gains `exploration`, `placeholder`, `detailed-pre-lock`
+#    alongside active | planned | deprecated. Measured: 44 of one estate's 78
+#    manifests were outside the old three-member set (exploration 26,
+#    placeholder 11, detailed-pre-lock 6, first-draft 1). Each admitted value
+#    VARIES WITHIN a domain — the ruled discriminator separating a genuine phase
+#    from an authoring convention — and `exploration` additionally has M-ADR 0089's
+#    workflow and a named gate behind it. Admitting the three takes that estate's
+#    re-authoring from 38 rows to 1; the earlier plan of admitting only
+#    `detailed-pre-lock` would have re-authored 37 rows that were declaring
+#    something TRUE.
+#    STILL NOT BOUND via column_enums, deliberately and stagedly — see the column
+#    description. Out-of-vocabulary values are carried and reported, never emptied
+#    and never rejected; `nullable` stays false so no cell is emptied and the
+#    empty-means-unauthored-or-rejected ambiguity does not arise. Bind only when
+#    the convention-finding count is measured ZERO at both estates. Measured at
+#    3.5.0: forward estate 1 residual row (`first-draft`, n=1, referred to that
+#    estate); reverse estate ZERO. So binding is one row away, not a distant goal.
+#
+#    ⚠ A correction recorded because the wrong figure nearly shipped in this very
+#    comment: an earlier draft claimed the reverse estate held 20 out-of-vocabulary
+#    `capability.status` rows (`reverse-first-draft`). It does not. That value lives
+#    at `legacy.status`, a different field in a legacy block, and the 20 was
+#    produced by an indentation-matched text search rather than a structural read.
+#    Structurally, the reverse estate's `capability.status` is 100% in-vocabulary
+#    across 180 manifests. Read a key by its PATH, never by its indentation.
+#
+# 2. `capabilities.contract_provenance` (nullable) added, reusing the shipped
+#    `authoring-mode` vocabulary (hand-authored | reverse-extracted | generated)
+#    rather than inventing a second provenance vocabulary. Strictly orthogonal to
+#    `traceability.contracts.status`. Evidence: 2 reverse-estate manifests wrote
+#    `reverse-extracted` into contracts.status, where it is invalid, because a
+#    COMPLETE reverse-derived contract surface could not say both true things at
+#    once.
+#
+# ⚠ Recorded because it bounds what this bump achieves: the maturity ladder the new
+# column is orthogonal to has NO catalogue column — `traceability.contracts.status`
+# is validator-enforced but uncatalogued, and therefore queryable by nothing. The
+# provenance half is given a column so it does not join that class; giving the
+# ladder one is a candidate follow-on, deliberately not bundled here.
+#
+# ⚠ One rule was MEASURED FALSE during design and is NOT shipped: "a `placeholder`
+# capability has no authored features" — 10 of 11 carry 1–5 features. `placeholder`
+# is admitted with its rule explicitly OPEN, referred to the estate. An admitted
+# value with an honestly-open rule beats an invented rule that the data refutes.
+#
+# Additive and backward-compatible; SCHEMA_COMPAT unchanged at "^3.0.0". No
+# existing check changes verdict, no column changes nullability, no value is
+# retired. Reaches estates via a CLI RELEASE, not a cut — this file is in no
+# bundle.
 # Bump rationale (3.4.0 — additive minor, 2026-08-08, per M-ADR 0207): the
 # forward scaffold declaration joins the metamodel. Two new derived catalogues
 # (`scaffolds`, `scaffold_items`) and three new bound enums (`scaffold_status`,
@@ -590,7 +734,8 @@ schema_status: "canonical"
 # no c4_containers rows, and no finding for exactly the SDDs the promotion
 # path creates (adopter finding F5 / gov WS6). `platform` is NOT reused for
 # these rows: the enum documents it as "exactly one per ecosystem after
-# federation aggregation", an invariant nothing yet enforces — reuse would
+# federation aggregation" — enforced since M-ADR 0189 §4.4 by
+# checkPlatformKindUniqueness, and tier-scoped per M-ADR 0208 §4.2 — reuse would
 # have broken it silently. Backward-compatible; SCHEMA_COMPAT stays "^2.0.0".
 # Bump rationale (2.26.0 — additive minor, per the repo-registry federation,
 # 2026-06-18): marks `repo_contract.contract_id` external_for_profiles
@@ -753,6 +898,24 @@ enums:
       - { value: weighted, description: "Weighted 1-5 dimensions rolled into a weighted_score against a pass threshold, with flags and hard gates. The forward house form; all fifteen method-side registries use it." }
       - { value: banded, description: "Dimensions summed to an integer total and mapped to a named band. The reverse family's form. Added in 3.3.0. The band vocabulary is PER-RUBRIC and deliberately unbound — see the band column." }
 
+  capability_service_role:
+    description: >
+      The part a service plays in delivering ONE capability. A property of
+      the capability↔service RELATIONSHIP, never of the service: the same
+      service is legitimately `primary` for capabilities in its own domain
+      and `backend-gateway` for capabilities elsewhere. Authored in the
+      capability traceability manifest services[].role (see the
+      capability-traceability-manifest-template). Bound in 3.8.0; the
+      values and their meanings are the template's, unchanged. Consumers
+      deriving "which repos realise this capability" MUST read this column
+      or use repo_capability, which excludes `dependency` (M-ADR 0157 §4.3
+      as amended) — a repo_capability row is a contribution claim.
+    values:
+      - { value: primary, description: "Realises this capability." }
+      - { value: related, description: "Participates in delivering this capability without being its primary realiser. Contributes; kept in repo_capability." }
+      - { value: dependency, description: "This capability DEPENDS ON the service — the inverse direction of contribution. The relationship is real and catalogued here; it does NOT produce a repo_capability row." }
+      - { value: backend-gateway, description: "Owned by ANOTHER domain and the sanctioned entry point into that domain's data for this capability — not merely a dependency, the door in. Expect it on cross-domain rows only. Contributes; kept in repo_capability." }
+
   c4_system_kind:
     description: >
       Architectural kind of a C4 system. Derived 1:1 from the originating
@@ -767,8 +930,8 @@ enums:
         application-product  → application
         integration-provider → integration
     values:
-      - { value: platform, description: "The ecosystem's platform-root system. Exactly one per ecosystem after federation aggregation (an invariant `subsystem` exists to protect — do not reuse `platform` for subsystem rows)." }
-      - { value: subsystem, description: "A promoted platform subsystem (M-ADR 0170 §4.2) — a separate deployable that is a peer System in the estate model, federated under the platform root. Added 2.28.0 per M-ADR 0133 §4.2c." }
+      - { value: platform, description: "A platform-root system — the one system that identifies a platform (M-ADR 0208 §4.1; 'platform-ecosystem' is the long form, 1:1 with the root). Exactly one per PLATFORM; an organisation-tier aggregate legitimately carries one per constituent platform, keyed by platform_sdd_id (0208 §4.2). An invariant `subsystem` exists to protect — do not reuse `platform` for subsystem rows." }
+      - { value: subsystem, description: "A promoted platform subsystem (M-ADR 0170 §4.2) — a separate deployable that is a peer System in the platform model, contained by the platform root on the same footing as application and integration (M-ADR 0208 §4.1). Added 2.28.0 per M-ADR 0133 §4.2c." }
       - { value: application, description: "An application-product system, consumes platform services and contracts." }
       - { value: integration, description: "An integration-provider system, bridges an external provider into the platform." }
 
@@ -931,6 +1094,7 @@ catalogues:
       - { name: status, type: string, nullable: false, description: "active | deferred | absent. The builder emits 'active' for every discovered domain directory — a domain that exists on disk is active by definition; deferred/absent rows have no authoring source yet (would come from roadmap/archetype declarations, not discovery)." }
       - { name: repo_count, type: int, nullable: false }
       - { name: source_sdd_id, type: string, nullable: true, description: "Originating SDD slug. Populated by the aggregator at merge time per M-ADR 0134; left empty by per-SDD builders." }
+      - { name: platform_sdd_id, type: string, nullable: true, description: "The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0." }
 
   products: &products_def
     primary_key: id
@@ -956,6 +1120,7 @@ catalogues:
       - { name: highest_snapshot_impact, type: string, nullable: true }
       - { name: repo_count, type: int, nullable: false, description: "Number of repos mapped to this product." }
       - { name: source_sdd_id, type: string, nullable: true, description: "Originating SDD slug. Populated by the aggregator per M-ADR 0134." }
+      - { name: platform_sdd_id, type: string, nullable: true, description: "The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0." }
 
   applications:
     <<: *products_def
@@ -980,6 +1145,7 @@ catalogues:
       - { name: pattern_qualifier, type: string, nullable: true, description: "Free-text sub-variant from `patternQualifier` where delivery semantics differ materially within a pattern (e.g. poll as a provider-issued ordered cursor vs a client-built window). Deliberately unconstrained — the method owns the pattern vocabulary, not every provider's delivery nuance. Added in 2.45.0." }
       - { name: exemplar, type: string, nullable: true, description: "`true` when the emitting SDD is a reference exemplar (demonstrates a profile shape rather than modelling a real provider relationship); empty otherwise. Derived from the SDD manifest's `exemplar:` field (sdd-manifest-schema 1.8.0), same source as `products.exemplar` — neither column is independently authorable. Carried on `sub_integrations` rows too, INHERITED from the emitting SDD. That deliberately differs from `ingestion_pattern`/`invocation_pattern`, which are empty on sub rows, and the difference is the point: a pattern is a MECHANISM (how this integration acquires data), genuinely one per SDD, whereas `exemplar` is a REALITY STATUS that propagates to everything the SDD emits — if the SDD is a demonstration then every provider relationship it declares is a demonstration. Leaving sub rows empty would flag the umbrella and count its demonstration sub-providers as real, reproducing the rollup overcount this column exists to fix one level down. Do not normalise it to match the pattern columns. The trade accepted: a real SDD with one demonstration sub-provider is unexpressible — a state that should not exist. Added in 2.46.0." }
       - { name: source_sdd_id, type: string, nullable: true, description: "Originating SDD slug. Populated by the aggregator per M-ADR 0134." }
+      - { name: platform_sdd_id, type: string, nullable: true, description: "The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0." }
 
   integration_component:
     primary_key: id
@@ -1027,6 +1193,7 @@ catalogues:
       - { name: primary_entities, type: string, nullable: true, description: "Semicolon-joined `dataFlow.primaryEntities`. Adopter-tier entity names; joined rather than normalised because the tier is descriptive, not an FK surface." }
       - { name: declared_in, type: string, nullable: false, description: "components-array | component-manifest — WHICH of M-ADR 0171 §9.1's two homes declared this component. Added in 2.49.0, when the second home became catalogued. Required because §10.1 states that any coverage reasoning MUST say which form it counts, and once one table holds both, a consumer cannot tell them apart: merging them without this recreates the reference-exemplar problem — well-formed rows that do not mean what a consumer assumes. Measured at the time of wiring: the array form was 15 components across 5 SDDs, the per-component form 86 across 21, and the two are DISJOINT (no id collision, no SDD using both). `resolution` also reads differently by form — for the array form `componentRepo` is an optional declaration (0 of 15 declared it); for the per-component form the containing `repos/<component>/` directory IS the repo, so linkage is structural rather than declared." }
       - { name: source_sdd_id, type: string, nullable: true, description: "Originating SDD slug. Populated by the aggregator per M-ADR 0134." }
+      - { name: platform_sdd_id, type: string, nullable: true, description: "The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0." }
 
   adrs:
     primary_key: id
@@ -1044,6 +1211,7 @@ catalogues:
       - { name: inference_confidence, type: string, nullable: true, description: "high | medium | low (reverse-inferred ADRs only)." }
       - { name: supersedes_raw, type: string, nullable: true, description: "Raw text from Supersedes bullet for later parsing." }
       - { name: source_sdd_id, type: string, nullable: true, description: "Originating SDD slug. Populated by the aggregator per M-ADR 0134." }
+      - { name: platform_sdd_id, type: string, nullable: true, description: "The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0." }
 
   glossary_items:
     primary_key: id
@@ -1060,6 +1228,7 @@ catalogues:
       - { name: evidence, type: string, nullable: true }
       - { name: notes, type: string, nullable: true }
       - { name: source_sdd_id, type: string, nullable: true, description: "Originating SDD slug. Populated by the aggregator per M-ADR 0134." }
+      - { name: platform_sdd_id, type: string, nullable: true, description: "The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0." }
 
   glossary_xref:
     primary_key: id
@@ -1086,6 +1255,7 @@ catalogues:
       - { name: glossary_item_id, type: string, nullable: false }
       - { name: status, type: string, nullable: false, description: "aligned | matched_direct. Conflicting statuses within a domain resolve matched_direct > aligned with a divergence finding." }
       - { name: source_sdd_id, type: string, nullable: true, description: "Originating SDD slug. Populated by the aggregator per M-ADR 0134." }
+      - { name: platform_sdd_id, type: string, nullable: true, description: "The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0." }
 
   services:
     primary_key: id
@@ -1107,6 +1277,7 @@ catalogues:
       - { name: context, type: string, nullable: true, description: "Bounded-context membership (per M-ADR 0170 §4.6). Free-form adopter label, orthogonal to domain_id. Not an FK. Carried for forward-parity; awaits a derivation source (e.g. from the service's contracts' x-context). Added in schema 2.19.0." }
       - { name: description, type: string, nullable: true }
       - { name: source_sdd_id, type: string, nullable: true, description: "Originating SDD slug. Populated by the aggregator per M-ADR 0134." }
+      - { name: platform_sdd_id, type: string, nullable: true, description: "The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0." }
     column_enums:
       component_type: enums.service_type  # canonical builder validates against the service_type enum above
 
@@ -1128,13 +1299,15 @@ catalogues:
       - { name: evidence_class, type: string, nullable: true, description: "Evidence class of the capability's claims, from `capability.evidence_class` in the traceability manifest. Free-form; conventional values code-reverse | vendor-doc | operational (M-ADR 0175). Empty when undeclared. Added in schema 2.20.0." }
       - { name: context, type: string, nullable: true, description: "Bounded-context membership from `capability.context` in the traceability manifest (per M-ADR 0170 §4.6) — completes the context dimension across screens/contracts/services/entities (2.19.0). Free-form adopter label, orthogonal to domain_id. Not an FK. Enables the screen↔capability context cross-check (convention finding, not FK). Empty when undeclared. Added in schema 2.21.0." }
       - { name: description, type: string, nullable: true }
-      - { name: status, type: string, nullable: false, description: "active | planned | deprecated. Default 'active'." }
+      - { name: status, type: string, nullable: false, description: "Capability LIFECYCLE phase — this column carries ONE axis and the reader may rely on that. active | planned | exploration | deprecated. Default 'active'. History, because the shape of the mistake is the useful part: the prior three-member set (active|planned|deprecated) could not express what estates authored, so 3.5.0 widened it to six on measured evidence — 44 of one estate's 78 manifests were outside it (exploration 26, placeholder 11, detailed-pre-lock 6, first-draft 1), each recurring value varying WITHIN a domain, which is the ruled discriminator for a genuine phase over an authoring convention. But 3.6.0 RETRACTED `placeholder` and `detailed-pre-lock`: per M-ADR 0201 §1 those are rungs on the SPEC-AUTHORING ladder (`placeholder | first-draft | detailed-pre-lock`, plus §4.1's `reverse-derived`), declared in each spec's own `**Status:**` header and gated there by the spec-lifecycle gate. Admitting them here made one column carry two orthogonal axes, so a reader could not tell whether `placeholder` described the capability or its document. **Where the other axis lives: the spec header. Do not re-import it here.** `exploration` stays and is NOT authoring vocabulary — it is absent from 0201's ladder, has M-ADR 0089's workflow and named gates behind it, and describes the capability rather than its spec; a capability declaring it must carry a populated `traceability.exploration` block, and one that does not is a loud contradiction (validate-traceability enforces this; measured 0 of 26 violations). ⚠ A rule this column deliberately does NOT carry: `placeholder`'s. The obvious one (no authored features) was MEASURED FALSE — 4 of 11 carried features, one of them 9 — and the deeper reason no rule fit is that `placeholder` was never making a claim about the capability at all. That unwritable rule was the first symptom of the axis error, before anyone had named it. ⚠ DELIBERATELY NOT BOUND via column_enums, and this is staged rather than permanent: binding carries hard-fail teeth, and at 3.5.0 one out-of-vocabulary row remains (forward estate, `first-draft`, n=1, referred to that estate; the reverse estate measures ZERO across 180 manifests). An out-of-vocabulary value is CARRIED, not emptied and not rejected, and is reported as a convention finding by validate-traceability — nullable stays false and no cell is ever emptied, so the empty-means-unauthored-or-rejected ambiguity of the products.synthesis_band / quality_scores.gate precedents does not arise here. Bind only once that count is ZERO at both estates; binding a set not proven to cover what estates author is how synthesis_band earned its deprecation. On drift and enforcement, stated with its confound rather than as a slogan: the enforced sibling `contracts.status` drifted 1.2% (2 of 172) while this unenforced field drifted 56% (44 of 78) at the SAME estate — but the other estate's copy of this same unenforced field drifted 0% of 180, so enforcement is not the only variable. The difference is authoring shape: the forward estate hand-authors per capability across 13 domains and explores vocabulary doing it, while the reverse estate's manifests come from one largely uniform extraction process. That uniformity is itself the phase-vs-convention discriminator firing — a value uniform across a whole estate is tracking the process that wrote it." }
       - { name: spec_path, type: string, nullable: true, description: "Path to capability spec file when one exists." }
+      - { name: contract_provenance, type: string, nullable: true, description: "How this capability's declared contract SET was produced, from `traceability.contracts.provenance`. hand-authored | reverse-extracted | generated — the vocabulary the method already ships for `authoring-mode`, reused deliberately so provenance has one vocabulary and not two. Empty means undeclared, and undeclared reads as `hand-authored` by convention. Added at 3.5.0. ⚠ STRICTLY ORTHOGONAL to the contract-set maturity ladder (`traceability.contracts.status`: planned | provisional | partial | complete | locked | none): provenance never constrains status and status never constrains provenance, and `reverse-extracted` + `complete` is the legitimate pair that motivated the field. Evidence: 2 reverse-estate manifests had written `reverse-extracted` INTO contracts.status, where it is invalid, because a complete reverse-derived contract surface had no way to say both true things at once and the author picked the provenance one. A rule here that constrained maturity would re-create exactly that defect. ⚠ Note the asymmetry this column exposes and does not fix: the maturity ladder it is orthogonal to has NO catalogue column at all — `traceability.contracts.status` is validator-enforced but uncatalogued, so it is queryable by no consumer. That is the authored-but-uncatalogued class (a block with no column has no automated reader, so nothing can notice when it is absent or wrong); this column is given one precisely so the provenance half does not join it. Giving the ladder a column is a candidate follow-on, not done here." }
       - { name: source, type: string, nullable: false, description: "capability-tree | product-map | capability-spec." }
       - { name: runway_classification, type: string, nullable: true, description: "Business | Enabler-Runway | Hybrid (forward declares; reverse nullable until backfilled)." }
       - { name: data_subset, type: string, nullable: true, description: "Keying-axis marker for foundational-tier / synthesis-tier capabilities whose evidence is keyed by ownership boundary or data subset rather than app group. Populated from `capability.data_subset` in the traceability manifest. Empty for implementing-tier capabilities (those use app_group on per-evidence rows). See `docs/method/methods/reverse/rubrics/reverse-platform-evidence-quality.md` §`app_group:` → `data_subset:` rename. Added in schema 2.9.0." }
       - { name: slice_scope, type: string, nullable: true, description: "Per-slice marker when one capability legitimately covers multiple app groups or data subsets (e.g. a compliance capability spanning several regulated-fleet sub-groups). Same capability_id may appear across multiple rows when sliced; row identity is then `(id, slice_scope)`. Empty when the capability is not sliced. Per-slice AC numbering convention: AC1-ACN unsuffixed for the first slice; subsequent slices use AC numbering suffixed by slice. See `docs/method/methods/reverse/rubrics/reverse-platform-evidence-quality.md` §`slice_scope:` and `docs/method/methods/capability-spec-template.md` Guideline 9. Added in schema 2.9.0." }
       - { name: source_sdd_id, type: string, nullable: true, description: "Originating SDD slug. Populated by the aggregator per M-ADR 0134." }
+      - { name: platform_sdd_id, type: string, nullable: true, description: "The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0." }
 
   feature_groups:
     primary_key: id
@@ -1160,6 +1333,7 @@ catalogues:
       - { name: description, type: string, nullable: true, description: "Authored description (when group has explicit metadata) or null when derived from heading only." }
       - { name: source, type: string, nullable: false, description: "feature-tree-h2 | feature-tree-h3 | feature-spec-explicit (when an authored feature spec declares group membership) | capability-spec-explicit." }
       - { name: source_sdd_id, type: string, nullable: true, description: "Originating SDD slug. Populated by the aggregator per M-ADR 0134." }
+      - { name: platform_sdd_id, type: string, nullable: true, description: "The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0." }
 
   features:
     primary_key: id
@@ -1181,6 +1355,7 @@ catalogues:
       - { name: source, type: string, nullable: false, description: "feature-tree | feature-set | capability-spec | feature-spec | feature-grounding. NOTE: feature-tree-group source removed in 1.3.0 — groups are now first-class in feature_groups.csv. As of schema 2.2.0, source: feature-tree is emitted by the canonical builder for rows derived from feature-tree.md bullets. As of schema 2.5.0, source: feature-grounding is emitted for rows derived from `docs/domains/<dom>/design/<capability>/feature-grounding.md` markdown tables (per M-ADR 0143). As of schema 2.7.0, source: capability-spec is emitted by the canonical builder for rows derived from `## Feature Grounding (code-path trace)` tables in `docs/domains/<dom>/product/<capability>.md` capability spec markdown (per M-ADR 0145). Feature-grounding and capability-spec rows are both capability-owned: product_id is empty; capability_id resolves from the file path." }
       - { name: runway, type: string, nullable: true, description: "Optional adopter-owned lifecycle / migration marker. Free string at method level — the schema declares no enum and ships no controlled vocabulary. Adopters MAY declare a per-SDD `feature-runway-vocabulary.yaml` at their SDD root; when present, the canonical builder validates captured values against it and emits a `convention` finding for unknown values. Empty when the adopter does not track migration state. Comparability across SDDs requires ecosystem-level vocabulary alignment as an explicit pre-step. Added in schema 2.2.0." }
       - { name: source_sdd_id, type: string, nullable: true, description: "Originating SDD slug. Populated by the aggregator per M-ADR 0134." }
+      - { name: platform_sdd_id, type: string, nullable: true, description: "The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0." }
 
   personas:
     primary_key: id
@@ -1193,6 +1368,7 @@ catalogues:
       - { name: role, type: string, nullable: true }
       - { name: description, type: string, nullable: true }
       - { name: source_sdd_id, type: string, nullable: true, description: "Originating SDD slug. Populated by the aggregator per M-ADR 0134." }
+      - { name: platform_sdd_id, type: string, nullable: true, description: "The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0." }
 
   user_journeys:
     primary_key: id
@@ -1207,6 +1383,7 @@ catalogues:
       - { name: trigger, type: string, nullable: true }
       - { name: goal, type: string, nullable: true }
       - { name: source_sdd_id, type: string, nullable: true, description: "Originating SDD slug. Populated by the aggregator per M-ADR 0134." }
+      - { name: platform_sdd_id, type: string, nullable: true, description: "The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0." }
 
   contracts:
     primary_key: id
@@ -1228,6 +1405,7 @@ catalogues:
       - { name: description, type: string, nullable: true }
       - { name: discovery, type: string, nullable: true, description: "discovered | declared-external. `discovered` (default) means the builder walked the spec file and parsed it, so title/version/context/evidence_class are trustworthy. `declared-external` means the row exists ONLY because a capability traceability manifest declared it with an explicit external marker and the file was never read — so those columns are necessarily EMPTY and their emptiness carries no information. A consumer that cannot tell the two apart will treat a declaration as a validated contract. Added in schema 2.51.0 (D13)." }
       - { name: source_sdd_id, type: string, nullable: true, description: "Originating SDD slug. Populated by the aggregator per M-ADR 0134." }
+      - { name: platform_sdd_id, type: string, nullable: true, description: "The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0." }
 
   events:
     primary_key: id
@@ -1245,6 +1423,7 @@ catalogues:
       - { name: version, type: string, nullable: true }
       - { name: evidence_class, type: string, nullable: true, description: "Evidence class of the event claim, from the per-event `evidence_class` key (alias `evidence-class`) in event-catalog.yaml, falling back to a file-level `evidence_class`/`evidence-class` top-level key in the same catalog YAML. Free-form; conventional values code-reverse | vendor-doc | operational (M-ADR 0175). Empty for avsc-only events and when undeclared. Added in schema 2.20.0." }
       - { name: source_sdd_id, type: string, nullable: true, description: "Originating SDD slug. Populated by the aggregator per M-ADR 0134." }
+      - { name: platform_sdd_id, type: string, nullable: true, description: "The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0." }
 
   c4_systems:
     primary_key: id
@@ -1258,6 +1437,7 @@ catalogues:
       - { name: diagram_path, type: string, nullable: true, description: "Path to L1 mermaid/markdown. Nullable — row exists for any architectural Product even if no L1 diagram has been authored yet (visible coverage gap)." }
       - { name: description, type: string, nullable: true }
       - { name: source_sdd_id, type: string, nullable: true, description: "Originating SDD slug. Populated by the aggregator per M-ADR 0134." }
+      - { name: platform_sdd_id, type: string, nullable: true, description: "The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0." }
     column_enums:
       kind: enums.c4_system_kind
 
@@ -1283,6 +1463,7 @@ catalogues:
       - { name: technology, type: string, nullable: true }
       - { name: description, type: string, nullable: true }
       - { name: source_sdd_id, type: string, nullable: true, description: "Originating SDD slug. Populated by the aggregator per M-ADR 0134." }
+      - { name: platform_sdd_id, type: string, nullable: true, description: "The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0." }
     column_enums:
       type: enums.c4_container_type
 
@@ -1304,6 +1485,7 @@ catalogues:
       - { name: path, type: string, nullable: true }
       - { name: responsibility, type: string, nullable: true }
       - { name: source_sdd_id, type: string, nullable: true, description: "Originating SDD slug. Populated by the aggregator per M-ADR 0134." }
+      - { name: platform_sdd_id, type: string, nullable: true, description: "The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0." }
 
   c4_external_systems:
     primary_key: id
@@ -1326,6 +1508,7 @@ catalogues:
       - { name: declared_id, type: string, nullable: true, description: "The diagram entry id of the first-seen declaration (M-ADR 0189 §4.2) — the declared identity the aggregator resolves against estate identifiers at adjudication, and the source of the row id since 3.0.0. Added 2.30.0." }
       - { name: source_scope, type: string, nullable: true, description: "Scope of the first-seen declaration: l1 (context diagram) or l2 (container diagram — scope-relative per M-ADR 0189 §4.1). Added 2.30.0." }
       - { name: source_sdd_id, type: string, nullable: true, description: "Originating SDD slug. Populated by the aggregator per M-ADR 0134." }
+      - { name: platform_sdd_id, type: string, nullable: true, description: "The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0." }
 
   repositories:
     primary_key: id
@@ -1350,6 +1533,7 @@ catalogues:
       - { name: languages, type: string, nullable: true, description: "';'-separated." }
       - { name: doc_path, type: string, nullable: false }
       - { name: source_sdd_id, type: string, nullable: true, description: "Originating SDD slug. Populated by the aggregator per M-ADR 0134." }
+      - { name: platform_sdd_id, type: string, nullable: true, description: "The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0." }
     column_enums:
       component_type: enums.service_type  # the repo-config `service_type` value lands in THIS column (3.1.3 — the binding previously named the authoring field and checked nothing)
 
@@ -1366,6 +1550,7 @@ catalogues:
       - { name: version, type: string, nullable: true, description: "Optional explicit version; null until the domain model is formally versioned (typically at first contract lock-in)." }
       - { name: evidence_class, type: string, nullable: true, description: "Evidence class of the domain model, from a leading ```yaml fence in the data-model markdown carrying `evidence-class:` (documentation-reverse anchor convention). Free-form; conventional values code-reverse | vendor-doc | operational (M-ADR 0175). Empty when undeclared. Added in schema 2.20.0." }
       - { name: source_sdd_id, type: string, nullable: true, description: "Originating SDD slug. Populated by the aggregator per M-ADR 0134." }
+      - { name: platform_sdd_id, type: string, nullable: true, description: "The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0." }
 
   entities:
     primary_key: id
@@ -1385,6 +1570,7 @@ catalogues:
       - { name: notes, type: string, nullable: true, description: "Free-form notes preserved from the authoring source. Carries `status=...`, `superseded_by=...`, and column count for diagnostic value." }
       - { name: evidence_class, type: string, nullable: true, description: "Evidence class inherited from the owning domain model's file-level declaration (the leading ```yaml fence's `evidence-class:` in data-model markdown). Free-form; conventional values code-reverse | vendor-doc | operational (M-ADR 0175). Empty when the source file declares none, and for manifest-sourced rows (the glossary-alignment manifest has no evidence slot). Added in schema 2.20.0." }
       - { name: source_sdd_id, type: string, nullable: true, description: "Originating SDD slug. Populated by the aggregator per M-ADR 0134." }
+      - { name: platform_sdd_id, type: string, nullable: true, description: "The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0." }
 
   # ---- Edge catalogues ----
   # Edge catalogues do not carry source_sdd_id — provenance is recoverable
@@ -1568,6 +1754,7 @@ catalogues:
       - { name: relation, type: string, nullable: false, description: "Open string; recommended values: owns | reads | writes | references. Data Store Mapping table source emits `owns`. Values outside the recommended set fire `[finding] convention`." }
       - { name: evidence_path, type: string, nullable: true, description: "Source markdown path or feature-grounding row that produced the edge. Audit aid." }
       - { name: source_sdd_id, type: string, nullable: true, description: "Originating SDD slug. Populated by the aggregator per M-ADR 0134." }
+      - { name: platform_sdd_id, type: string, nullable: true, description: "The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0." }
 
   capability_feature:
     primary_key: id
@@ -1599,7 +1786,9 @@ catalogues:
       - { name: id, type: string, nullable: false }
       - { name: capability_id, type: string, nullable: false }
       - { name: service_id, type: string, nullable: false }
-      - { name: role, type: string, nullable: true }
+      - { name: role, type: string, nullable: true, description: "The part the service plays in delivering THIS capability — a property of the relationship, not of the service (capability-traceability-manifest-template). Closed enum, see enums.capability_service_role. Nullable: legacy rows may carry no role; the enum validator checks values, not presence. `dependency` rows are excluded from repo_capability Path X (M-ADR 0157 §4.3 as amended). Enum bound in 3.8.0." }
+    column_enums:
+      role: enums.capability_service_role
 
   capability_event:
     primary_key: id
@@ -1708,6 +1897,7 @@ catalogues:
       - { name: evidence, type: string, nullable: true, description: "Evidence-file citation (`<sub-repo>/<path>:<line>`) anchoring the channel declaration. Mirrors the citation pattern used elsewhere in evidence yamls." }
       - { name: payload_ref, type: string, nullable: true, description: "Optional reference to a payload-contract event (`{event-name}` in the `events` catalogue) when the channel carries a contract-shaped payload. Empty when the payload is channel-private." }
       - { name: source_sdd_id, type: string, nullable: true, description: "Originating SDD slug. Populated by the aggregator per M-ADR 0134." }
+      - { name: platform_sdd_id, type: string, nullable: true, description: "The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0." }
 
   capability_domain_model:
     primary_key: id
@@ -1821,6 +2011,7 @@ catalogues:
       - { name: to_container_id, type: string, nullable: false }
       - { name: interaction, type: string, nullable: true, description: "Label carried over from the originating Rel(...) line." }
       - { name: source_sdd_id, type: string, nullable: true, description: "SDD whose diagram declared the originating reference. Member-emitted rows set it directly (F19); adjudication-derived rows are stamped by the aggregator." }
+      - { name: platform_sdd_id, type: string, nullable: true, description: "The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0." }
 
   system_system_dependency:
     primary_key: id
@@ -1843,6 +2034,7 @@ catalogues:
       - { name: to_system_id, type: string, nullable: false }
       - { name: interaction, type: string, nullable: true, description: "Optional label/protocol carried over from the originating Rel(...) line." }
       - { name: source_sdd_id, type: string, nullable: true, description: "SDD whose diagram declared the originating reference. Populated by the aggregator." }
+      - { name: platform_sdd_id, type: string, nullable: true, description: "The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0." }
 
   c4_container_entity:
     primary_key: id
@@ -1856,6 +2048,7 @@ catalogues:
       - { name: entity_id, type: string, nullable: false }
       - { name: relation, type: string, nullable: false, description: "Inherits from upstream service_entity.relation when derived." }
       - { name: source_sdd_id, type: string, nullable: true }
+      - { name: platform_sdd_id, type: string, nullable: true, description: "The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0." }
 
   c4_system_entity:
     primary_key: id
@@ -1869,6 +2062,7 @@ catalogues:
       - { name: entity_id, type: string, nullable: false }
       - { name: container_count, type: integer, nullable: false, description: "Number of the system's containers that touch this entity. Aggregated from c4_container_entity." }
       - { name: source_sdd_id, type: string, nullable: true }
+      - { name: platform_sdd_id, type: string, nullable: true, description: "The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0." }
 
   capability_adr:
     primary_key: id
@@ -1928,6 +2122,7 @@ catalogues:
       - { name: contract_path, type: string, nullable: true, description: "Path to the contract file the dependency is against, as declared in the consuming SDD's evidence. External — resolution happens at aggregation if it happens at all." }
       - { name: consumed_by_services, type: string, nullable: true, description: "Comma-separated list of service names within the consuming product that consume the dependency. Free-text; not FK-validated (services are within-product and resolution is owner-side concern)." }
       - { name: source_sdd_id, type: string, nullable: true, description: "Originating SDD slug. Populated by the aggregator per M-ADR 0134." }
+      - { name: platform_sdd_id, type: string, nullable: true, description: "The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0." }
 
   cross_sdd_platform_capability:
     primary_key: id
@@ -1998,6 +2193,7 @@ catalogues:
       - { name: target, type: string, nullable: true, description: "Free adopter-tier field — the specific counterpart (a platform service id, an upstream domain service, a named vendor). Instance identity; keeps locality a small class enum." }
       - { name: notes, type: string, nullable: true, description: "Optional free-text annotation." }
       - { name: source_sdd_id, type: string, nullable: true, description: "Originating SDD slug. Populated by the aggregator per M-ADR 0134." }
+      - { name: platform_sdd_id, type: string, nullable: true, description: "The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0." }
 
   application_data_plane_deviations:
     primary_key: id
@@ -2022,6 +2218,7 @@ catalogues:
       - { name: expectation, type: string, nullable: false, description: "The bare data-plane pattern token the product diverges from (retrieve | own-store | stream-ingest | project | generate | publish). Must match the WARN's pattern key. Spans both directions per M-ADR 0193 §4.7 rule 2." }
       - { name: rationale, type: string, nullable: false, description: "Why the deviation is correct. Non-empty (enforced at manifest load)." }
       - { name: source_sdd_id, type: string, nullable: true, description: "Originating SDD slug. Populated by the aggregator per M-ADR 0134." }
+      - { name: platform_sdd_id, type: string, nullable: true, description: "The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0." }
 
   application_conformance_coverage:
     primary_key: id
@@ -2045,6 +2242,7 @@ catalogues:
       - { name: status, type: string, nullable: false, description: "covered (the product's suite exercises it) | deviated (deliberately not covered, with a rationale)." }
       - { name: rationale, type: string, nullable: true, description: "Why the tag is deviated. Present (non-empty) only when status=deviated." }
       - { name: source_sdd_id, type: string, nullable: true, description: "Originating SDD slug. Populated by the aggregator per M-ADR 0134." }
+      - { name: platform_sdd_id, type: string, nullable: true, description: "The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0." }
 
   # ---- UI screens family (schema 2.16.0, per M-ADR 0166) ----
   # Application-product profile. Builder reads authored screen-spec artefacts
@@ -2069,6 +2267,7 @@ catalogues:
       - { name: context, type: string, nullable: true, description: "Bounded-context membership from frontmatter `context:` (per M-ADR 0170 §4.6). Free-form adopter label, orthogonal to domain/group — the consumed bounded context for a surface that spans several. Not an FK. Empty when unauthored. Added in schema 2.19.0." }
       - { name: evidence_class, type: string, nullable: true, description: "Evidence class of the screen's claims, from frontmatter `evidence_class:` (alias `evidence-class:`). Free-form; conventional values code-reverse | vendor-doc | operational (M-ADR 0175). Empty when undeclared. Completes the evidence-class dimension for the packaged-SaaS case: a packaged-SaaS SDD catalogues the vendor's STANDARD screens (documentation-reversed from vendor publications, `vendor-doc`) alongside the organisation's CUSTOMISED screens (code-reversed, `code-reverse`) per M-ADR 0175 §3.1 — without this column the two are indistinguishable, and doc-derived UI claims masquerade as code-verified. Orthogonal to `source` (`screen-spec` | `screen-extraction`), which records the authoring DIRECTION, not the evidence's strength: a `screen-extraction` screen can be either class, since a vendor's documented UI is extracted-but-not-code-verified. Added in schema 2.42.0." }
       - { name: source_sdd_id, type: string, nullable: true, description: "Originating SDD slug. Populated by the aggregator per M-ADR 0134." }
+      - { name: platform_sdd_id, type: string, nullable: true, description: "The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0." }
 
   ui_components:
     primary_key: id
@@ -2082,6 +2281,7 @@ catalogues:
       - { name: kind, type: string, nullable: true, description: "Optional classification: layout | display | input | chart | element | composite | remote | remote-iframe | remote-webcomponent. A `remote*` kind marks a micro-frontend federation seam (M-ADR 0166 §4.7)." }
       - { name: source, type: string, nullable: false, description: "screen-spec (forward) | design-system-import (reverse)." }
       - { name: source_sdd_id, type: string, nullable: true, description: "Originating SDD slug. Populated by the aggregator per M-ADR 0134." }
+      - { name: platform_sdd_id, type: string, nullable: true, description: "The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0." }
 
   screen_component:
     primary_key: id
@@ -2094,6 +2294,7 @@ catalogues:
       - { name: screen_id, type: string, nullable: false }
       - { name: component_id, type: string, nullable: false }
       - { name: source_sdd_id, type: string, nullable: true, description: "Originating SDD slug. Populated by the aggregator per M-ADR 0134." }
+      - { name: platform_sdd_id, type: string, nullable: true, description: "The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0." }
 
   screen_feature:
     primary_key: id
@@ -2110,6 +2311,7 @@ catalogues:
       - { name: screen_id, type: string, nullable: false }
       - { name: feature_id, type: string, nullable: false }
       - { name: source_sdd_id, type: string, nullable: true, description: "Originating SDD slug. Populated by the aggregator per M-ADR 0134." }
+      - { name: platform_sdd_id, type: string, nullable: true, description: "The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0." }
 
   persona_screen:
     primary_key: id
@@ -2122,6 +2324,7 @@ catalogues:
       - { name: persona_id, type: string, nullable: false }
       - { name: screen_id, type: string, nullable: false }
       - { name: source_sdd_id, type: string, nullable: true, description: "Originating SDD slug. Populated by the aggregator per M-ADR 0134." }
+      - { name: platform_sdd_id, type: string, nullable: true, description: "The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0." }
 
   screen_action:
     primary_key: id
@@ -2135,6 +2338,7 @@ catalogues:
       - { name: action, type: string, nullable: false, description: "Declared action label emitted by the screen." }
       - { name: event_id, type: string, nullable: true, description: "Catalogued event the action maps to (per M-ADR 0156). External-capable; empty when the action does not resolve to a domain event." }
       - { name: source_sdd_id, type: string, nullable: true, description: "Originating SDD slug. Populated by the aggregator per M-ADR 0134." }
+      - { name: platform_sdd_id, type: string, nullable: true, description: "The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0." }
 
   conformance_finding:
     primary_key: id
@@ -2155,6 +2359,7 @@ catalogues:
       - { name: needs_triage, type: boolean, nullable: false, description: "True when any asymmetry exists. Triage, not auto-fail (M-ADR 0180 §2.3)." }
       - { name: run_date, type: string, nullable: false, description: "ISO date of the conformance run — the snapshot stamp enabling trend over time." }
       - { name: source_sdd_id, type: string, nullable: true, description: "Originating SDD slug. Populated by the aggregator per M-ADR 0134." }
+      - { name: platform_sdd_id, type: string, nullable: true, description: "The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0." }
 
   quality_scores:
     primary_key: id
@@ -2216,6 +2421,7 @@ catalogues:
       - { name: required_actions_count, type: int, nullable: false, description: "Number of remediation actions the assessment recorded." }
       - { name: sdd_id, type: string, nullable: true, description: "SDD whose gate-registry authored this row. Soft FK to products.id — nullable because a registry can score targets in an SDD that emits no product row." }
       - { name: source_sdd_id, type: string, nullable: true, description: "Originating SDD slug. Populated by the aggregator per M-ADR 0134; left empty by per-SDD builders." }
+      - { name: platform_sdd_id, type: string, nullable: true, description: "The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0." }
 
   quality_score_dimensions:
     primary_key: id
@@ -2245,6 +2451,7 @@ catalogues:
       - { name: dimension_score, type: number, nullable: true, description: "Score on that dimension. Empty for an unscored entry (the templates author explicit nulls)." }
       - { name: dimension_weight, type: number, nullable: true, description: "Weight the rubric assigns the dimension, where discoverable. Usually EMPTY: weights live in the rubric document and the registry header comment, not per entry — so this column is honest about the fact that a weighted_score cannot currently be recomputed from these rows alone." }
       - { name: source_sdd_id, type: string, nullable: true, description: "Originating SDD slug. Populated by the aggregator per M-ADR 0134." }
+      - { name: platform_sdd_id, type: string, nullable: true, description: "The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0." }
 
   scaffolds:
     primary_key: id
@@ -2279,6 +2486,7 @@ catalogues:
       - { name: manifest_schema, type: string, nullable: false, description: "The scaffold manifest format version the file declared (scaffold_schema field), so format evolution is diffable and a future migration can state its denominator." }
       - { name: sdd_id, type: string, nullable: true, description: "SDD whose manifest authored this row. Soft FK to products.id — nullable because a scaffold can be declared in an SDD that emits no product row." }
       - { name: source_sdd_id, type: string, nullable: true, description: "Originating SDD slug. Populated by the aggregator per M-ADR 0134; left empty by per-SDD builders." }
+      - { name: platform_sdd_id, type: string, nullable: true, description: "The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0." }
     column_enums:
       status: enums.scaffold_status
 
@@ -2320,6 +2528,7 @@ catalogues:
       - { name: edge_target_ref, type: string, nullable: true, description: "For edge items: the declared target endpoint, second FK column. Empty for entity and contract items." }
       - { name: state, type: string, nullable: false, description: "Resolution verdict — see the scaffold_item_state enum. Derived, never authored; recomputed on every build, so realisation flips rows exactly when the target lands." }
       - { name: source_sdd_id, type: string, nullable: true, description: "Originating SDD slug. Populated by the aggregator per M-ADR 0134." }
+      - { name: platform_sdd_id, type: string, nullable: true, description: "The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0." }
     column_enums:
       item_kind: enums.scaffold_item_kind
       state: enums.scaffold_item_state