@sdd-method/sdd-cli 1.18.0 → 1.20.1

package/dist/lib/catalogue/aggregate.js

@@ -30,10 +30,14 @@ import { writeCatalogue } from "./csv-writer.js";
 import { buildLegacyContractIdMap } from "./contract-id.js";
 import { validateWithEngineToLog } from "./engine-validator.js";
 import { FindingsLog } from "./findings.js";
+import { readLockFile } from "../lock-file.js";
 import { mergeEdgeLabel } from "./builders/edge-label-merge.js";
 import { isAsyncContractType } from "./builders/product-platform-dependencies.js";
 import { resolveContractPaths } from "./contract-path-resolution.js";
 import { buildRepoEdges } from "./builders/repo-edges.js";
+import { buildCapabilitySpec } from "./builders/capability-spec.js";
+import { buildFeatureGrounding } from "./builders/feature-grounding.js";
+import { loadFeatureGroundingAliases } from "./feature-grounding-aliases-loader.js";
 import { buildFeatureContract } from "./builders/feature-contract.js";
 import { buildCapabilityEvent } from "./builders/event-edges.js";
 import { discoverVocabulary } from "./application-archetype/vocabulary.js";
@@ -49,7 +53,7 @@ export async function runCatalogueAggregate(inputs, write) {
     const rootManifest = await loadSddManifest(sddPath, {
         cliVersion: CLI_VERSION,
     });
-    write(`  ecosystem-root: ${rootManifest.sddId}  profile: ${rootManifest.profile}\n`);
+    write(`  root: ${rootManifest.sddId}  profile: ${rootManifest.profile}  tier: ${rootManifest.profile === "organisation-profile" ? "organisation" : "platform"}\n`);
     // 1. Resolve aggregation-manifest path + load.
     //
     // Two anchors, deliberately, because the terms are different KINDS of path:
@@ -75,8 +79,9 @@ export async function runCatalogueAggregate(inputs, write) {
         ecosystemRootPath: sddPath,
     });
     if (aggManifest.ecosystemRoot !== rootManifest.sddId) {
-        throw new Error(`aggregation manifest ecosystem_root="${aggManifest.ecosystemRoot}"\n` +
-            `  does not match ecosystem-root SDD's sdd_id="${rootManifest.sddId}"\n` +
+        throw new Error(`aggregation manifest root_sdd_id="${aggManifest.ecosystemRoot}"\n` +
+            `  does not match the owning SDD's sdd_id="${rootManifest.sddId}"\n` +
+            `  (rule: root_sdd_id_consistent, M-ADR 0208 §4.3)\n` +
             `  (manifest: ${manifestPath})`);
     }
     write(`  aggregation manifest: ${relative(sddPath, manifestPath)}\n`);
@@ -92,7 +97,12 @@ export async function runCatalogueAggregate(inputs, write) {
     // 2. Pull (filesystem only in v1) — pre-checked at manifest load. Now
     //    cross-check each sibling's own .sdd/sdd-manifest.yaml + its
     //    vendored schema vs the aggregator's.
-    await crossCheckSiblings(sddPath, aggManifest.siblings, schema, write);
+    const crossCheck = await crossCheckSiblings(sddPath, aggManifest.siblings, schema, write);
+    if (aggManifest.rootFieldDeprecated) {
+        findings.add("convention", `aggregation manifest uses deprecated key \`ecosystem_root\` — rename to \`root_sdd_id\` (M-ADR 0208 §4.3; alias removed at 2.0.0)`);
+    }
+    // M-ADR 0208 §4.2/§4.4: the tier decides the platform_sdd_id fill rule.
+    const rootIsOrganisation = rootManifest.profile === "organisation-profile";
     // 3. Schema-version alignment was checked in crossCheckSiblings.
     // 4 + 5. Concatenate per-catalogue rows from the ecosystem-root + every
     // sibling, stamping source_sdd_id on node catalogues as we go.
@@ -101,9 +111,47 @@ export async function runCatalogueAggregate(inputs, write) {
     for (const cat of schema.catalogues) {
         rowsByCatalogue.set(cat.name, []);
     }
-    perSiblingCounts.set(rootManifest.sddId, await mergeCatalogues(schema, rowsByCatalogue, join(sddPath, "catalogues"), rootManifest.sddId));
+    perSiblingCounts.set(rootManifest.sddId, await mergeCatalogues(schema, rowsByCatalogue, join(sddPath, "catalogues"), rootManifest.sddId, rootIsOrganisation ? null : rootManifest.sddId));
+    // source_sdd_id -> the platform the §4.4 fill rule assigned it. Kept for the final
+    // pass (fillDerivedPlatformStamps): rows the aggregator itself constructs AFTER the
+    // node loader (0189 adjudication conversions, re-derived edges) set source_sdd_id
+    // explicitly and would otherwise leave platform_sdd_id empty under FK PASS —
+    // the same silent shape as the empty platform leg on cross_sdd_platform_capability.
+    const platformBySource = new Map();
+    if (!rootIsOrganisation)
+        platformBySource.set(rootManifest.sddId, rootManifest.sddId);
     for (const sib of aggManifest.siblings) {
-        perSiblingCounts.set(sib.sddId, await mergeCatalogues(schema, rowsByCatalogue, sib.cataloguesPath, sib.sddId));
+        // M-ADR 0208 §4.4 fill rule, by pull path. An empty stamp is UNRESOLVED and is
+        // reported below by checkPlatformKindUniqueness; it is never a key value.
+        let platformSddId;
+        if (!rootIsOrganisation) {
+            platformSddId = rootManifest.sddId; // every row in a platform-tier aggregate belongs to it
+        }
+        else if (sib.level === "organisation") {
+            platformSddId = null; // arrived stamped from the child's own platform-tier run
+        }
+        else {
+            // CATEGORY decides root-ness, not profile: platform-subsystem is platform-profile
+            // too, but it is a MEMBER contained by exactly one platform (M-ADR 0208 §4.1).
+            const sibCategory = crossCheck.siblingCategories.get(sib.sddId);
+            const declared = crossCheck.siblingDeclaredPlatform.get(sib.sddId);
+            if (sibCategory === "platform-root") {
+                platformSddId = sib.sddId; // a platform-root is its own platform
+            }
+            else if (declared !== undefined) {
+                platformSddId = declared; // a member that declares its platform gets it
+            }
+            else {
+                platformSddId = null;
+                findings.add("coverage", `platform_sdd_id: sibling "${sib.sddId}" (${sibCategory ?? crossCheck.siblingProfiles.get(sib.sddId) ?? "?"}) is a MEMBER pulled directly at organisation tier with no declared platform — rows left unstamped (M-ADR 0208 §4.4; federate it under its platform's aggregate, or set platform_sdd_id in its manifest)`);
+            }
+        }
+        if (crossCheck.deprecatedPlatformField.has(sib.sddId)) {
+            findings.add("convention", `sibling "${sib.sddId}" manifest uses deprecated key \`ecosystem_root\` — rename to \`platform_sdd_id\` (M-ADR 0208 §4.3; alias removed at 2.0.0)`);
+        }
+        if (platformSddId !== null)
+            platformBySource.set(sib.sddId, platformSddId);
+        perSiblingCounts.set(sib.sddId, await mergeCatalogues(schema, rowsByCatalogue, sib.cataloguesPath, sib.sddId, platformSddId));
     }
     // 5a. Derive cross_sdd_platform_capability — federated edge, schema 2.9.0.
     // Joins each consuming SDD's product_platform_dependencies rows against
@@ -113,7 +161,7 @@ export async function runCatalogueAggregate(inputs, write) {
     // emit nothing for this catalogue; the aggregator owns it entirely.
     // See content/plans/v0-9-0-cohort-sweep-derived-bundle.md
     // §"Cross-SDD platform-capability-edge" + ADR 0134.
-    const crossSddRows = deriveCrossSddPlatformCapability(rowsByCatalogue.get("product_platform_dependencies") ?? [], rowsByCatalogue.get("capability_service") ?? [], findings);
+    const crossSddRows = deriveCrossSddPlatformCapability(rowsByCatalogue.get("product_platform_dependencies") ?? [], rowsByCatalogue.get("capability_service") ?? [], findings, rowsByCatalogue.get("capabilities") ?? []);
     rowsByCatalogue.set("cross_sdd_platform_capability", crossSddRows);
     // Every SDD root in this aggregation, by sdd_id: the ecosystem root plus each
     // sibling. This is precisely what the app tier does not have and cannot obtain.
@@ -190,15 +238,96 @@ export async function runCatalogueAggregate(inputs, write) {
     // it, and appending finished per-member joins never creates a row no input produced.
     //
     // §4.1's rule (a catalogue qualifies when it is derived AND at least one join input can
-    // carry a cross-SDD reference) currently selects four: repo_capability, repo_contract,
+    // carry a cross-SDD reference) selects five: feature_repo, repo_capability, repo_contract,
     // feature_contract, capability_event. One shared mechanism (rederiveAppend below) runs
-    // all four so a fifth qualifying catalogue is a new call, not new merge logic.
+    // all five so a sixth qualifying catalogue is a new call, not new merge logic.
+    //
+    // feature_repo moved into scope under §4.1's "automatic movement" clause: its derived leg
+    // resolves free-text evidence tokens (M-ADR 0143 §4.4) against `repositories.id`, and the
+    // merged repositories table carries every sibling's repos — a platform spec that names a
+    // repo registered by a MEMBER SDD can only resolve here. The spec text is not a catalogue,
+    // so the derived leg is re-run the way §4.2 describes for every builder: the two feature
+    // extractors are invoked over each manifest-read contributor's docs with the MERGED
+    // repository / service / capability id sets as their resolution inputs. Only their
+    // feature_repo output is kept; feature rows and their per-row findings were already
+    // emitted at member tier and are not repeated. level:organisation siblings expose no docs
+    // (pre-built catalogues-aggregated/ only) and are skipped — their rows arrived from their
+    // own platform-tier run, where this pass has already happened.
     //
     // §4.2: only the derived leg is re-run — each builder is invoked with its authored-leg
     // inputs (configs / manifests) empty, which runs zero iterations of that path and yields
     // the derived rows alone; the authored rows are already correct via concatenation and are
     // left untouched. §4.2/§4.3: rederiveAppend adds the result to what concatenation already
     // produced, keeping the concatenated row on any primary-key collision — never a replace.
+    {
+        const mergedRepoIds = new Set((rowsByCatalogue.get("repositories") ?? []).map((r) => String(r["id"])));
+        const mergedServiceIds = new Set((rowsByCatalogue.get("services") ?? []).map((r) => String(r["id"])));
+        const mergedCapabilityIds = new Set((rowsByCatalogue.get("capabilities") ?? []).map((r) => String(r["id"])));
+        const mergedFeatureIds = new Set((rowsByCatalogue.get("features") ?? []).map((r) => String(r["id"])));
+        // Re-derivation FILLS ABSENCES; it does not widen. A feature its own member
+        // build already anchored keeps exactly those anchors: re-running bare-token
+        // resolution against every sibling's repo ids over an already-resolved row
+        // mostly finds collisions (measured on one estate: 13 of the 43 rows it would
+        // have added to anchored features resolved to repo ids like `web`, `proxy`,
+        // `service`, `batch` owned by unrelated SDDs; of the 261 rows added to
+        // UNANCHORED features, 4 did). The motivating case — and §4.1's clause — is a
+        // row no member could produce, which is exactly an unanchored feature.
+        const anchoredFeatureIds = new Set((rowsByCatalogue.get("feature_repo") ?? []).map((r) => String(r["feature_id"])));
+        const contributors = [
+            { sddPath, profile: rootManifest.profile, sddId: rootManifest.sddId },
+        ];
+        for (const sib of aggManifest.siblings) {
+            if (sib.level === "organisation")
+                continue;
+            const profile = crossCheck.siblingProfiles.get(sib.sddId);
+            if (profile === undefined)
+                continue;
+            contributors.push({ sddPath: sib.sddRoot, profile, sddId: sib.sddId });
+        }
+        const rederivedFeatureRepo = [];
+        // Both extractors, over several contributors, can yield the same edge (the same
+        // feature grounded in the same repo from two tables); rederiveAppend dedups only
+        // against the CONCATENATED rows, so dedup the re-derived set itself here or the
+        // duplicate-PK check fails the aggregate on two copies of one correct fact.
+        const rederivedIds = new Set();
+        const scratch = new FindingsLog(); // member-tier findings already emitted; not repeated
+        for (const c of contributors) {
+            const aliases = await loadFeatureGroundingAliases(c.sddPath);
+            const common = {
+                sddPath: c.sddPath,
+                findings: scratch,
+                profile: c.profile,
+                productId: c.sddId,
+                knownCapabilityIds: mergedCapabilityIds,
+                knownServiceIds: mergedServiceIds,
+                knownRepoKeys: mergedRepoIds,
+                existingFeatureIds: new Set(),
+                aliases,
+            };
+            const [grounding, spec] = await Promise.all([
+                buildFeatureGrounding(common),
+                buildCapabilitySpec(common),
+            ]);
+            for (const fr of [...grounding.featureRepoRows, ...spec.featureRepoRows]) {
+                const featureId = String(fr["feature_id"] ?? "");
+                if (!mergedFeatureIds.has(featureId))
+                    continue;
+                if (anchoredFeatureIds.has(featureId))
+                    continue;
+                const id = String(fr["id"] ?? "");
+                if (id === "" || rederivedIds.has(id))
+                    continue;
+                rederivedIds.add(id);
+                rederivedFeatureRepo.push(fr);
+            }
+        }
+        const before = (rowsByCatalogue.get("feature_repo") ?? []).length;
+        rederiveAppend(rowsByCatalogue, "feature_repo", rederivedFeatureRepo);
+        const added = (rowsByCatalogue.get("feature_repo") ?? []).length - before;
+        if (added > 0) {
+            findings.add("coverage", `feature_repo: ${added} row(s) re-derived at aggregate tier for features that had NO anchor at member tier — evidence tokens naming a repo registered by another contributor resolve only against the merged repositories; already-anchored features are not widened (M-ADR 0198 §4.1 as amended; ${contributors.length} contributor doc trees scanned)`);
+        }
+    }
     const repoEdges = buildRepoEdges({
         findings,
         configs: [],
@@ -266,7 +395,7 @@ export async function runCatalogueAggregate(inputs, write) {
     // tier alongside an existing one), each contributes the same method ADR ids. Merge
     // them (first-seen wins) rather than failing the duplicate-PK check. Platform
     // / domain ADRs are NOT deduped — a collision there is a genuine error.
-    dedupMethodScopedAdrs(rowsByCatalogue, findings);
+    await dedupMethodScopedAdrs(rowsByCatalogue, findings, sddRootsById);
     // 5c. Federated reverse-metadata enrichment (ADR 0163 P2). Both reference
     // adopters centralise the service inventory in the platform-root, but for
     // reverse-method federations the per-service evidence (service-architecture.md)
@@ -305,8 +434,13 @@ export async function runCatalogueAggregate(inputs, write) {
         `${adjudication.containerConverted} container conversions (${adjudication.containerEdgesRewritten} edges → container_dependency, ` +
         `${adjudication.systemFallbackEdges} stuck edges → system_system_dependency at L1), ` +
         `${adjudication.exempted} exempted, ${adjudication.unverified} unverified\n`);
+    // 5f-bis. Rows constructed at THIS tier after the node loader (adjudication
+    // conversions, re-derived edges) carry source_sdd_id but no platform stamp.
+    // Fill them now that every derivation has run (M-ADR 0208 §4.4 as applied to
+    // aggregator-constructed rows); whatever stays empty is reported, never keyed on.
+    fillDerivedPlatformStamps(schema, rowsByCatalogue, platformBySource, findings);
     // 5g. Platform-kind uniqueness (M-ADR 0133 §4.2c open hygiene).
-    checkPlatformKindUniqueness(rowsByCatalogue.get("c4_systems") ?? [], findings);
+    checkPlatformKindUniqueness(rowsByCatalogue.get("c4_systems") ?? [], findings, rootIsOrganisation ? "organisation" : "platform");
     // 5h. M-ADR 0203 §4.4 cross-SDD re-key: the contract-id migration derives
     // per-SDD, but contract-FK edges cross SDD boundaries — a federated SDD
     // that owns no contracts has an empty map, so its references keep the 2.x
@@ -511,20 +645,58 @@ export function dedupExternalSystems(rowsByCatalogue, findings) {
     }
     rowsByCatalogue.set("c4_external_systems", [...byId.values()]);
 }
-// Method-scoped ADRs (doc_path under docs/method/adr/) are the shared method
-// baseline, identical across method-based SDDs. Dedupe by id (first-seen wins),
-// preserving order and leaving platform/domain ADRs untouched. A conflicting
-// title/status on the same id emits a finding. Mirrors dedupExternalSystems.
-function dedupMethodScopedAdrs(rowsByCatalogue, findings) {
+// Method-DISTRIBUTED ADRs are the shared method baseline, identical across
+// method-based SDDs. Dedupe by id (first-seen wins), preserving order and leaving
+// adopter-AUTHORED platform/domain ADRs untouched — a collision there is a genuine
+// error and MUST still fail the duplicate-PK check. Mirrors dedupExternalSystems.
+//
+// WHAT COUNTS AS METHOD-DISTRIBUTED (M-ADR 0208 / gov F-E): a row whose doc_path is
+// BUNDLE-MANAGED in the contributing SDD's method-baseline.lock. Provenance, not
+// path prefix. The earlier test `startsWith("docs/method/adr/")` was a proxy for
+// the same property and it failed the first time two platform-roots aggregated:
+// the baseline also distributes docs/method/platform-adr/ (13 ADR-emitting files
+// in platform-baseline v2.3.28), which the prefix missed, so identical
+// bundle-managed rows from two roots collided as if adopter-authored. A prefix
+// extension would have passed every test available that day and merged genuinely
+// authored platform ADRs the next time an adopter wrote a colliding one; the lock
+// already records exactly the property we mean.
+//
+// FALLBACK: a contributing SDD with no lock (fixtures; a repo that has never been
+// synced) keeps the historical prefix test, so it is never LESS deduped than before.
+async function dedupMethodScopedAdrs(rowsByCatalogue, findings, sddRootsById) {
     const rows = rowsByCatalogue.get("adrs");
     if (rows === undefined || rows.length === 0)
         return;
+    // source_sdd_id -> set of bundle-managed paths, or null when that SDD has no lock.
+    const managedBySdd = new Map();
+    for (const [sddId, root] of sddRootsById) {
+        const lock = await readLockFile(root);
+        if (lock === null) {
+            managedBySdd.set(sddId, null);
+            continue;
+        }
+        const managed = new Set();
+        for (const b of lock.bundles)
+            for (const mp of b.managedPaths)
+                managed.add(mp);
+        managedBySdd.set(sddId, managed);
+    }
+    const isMethodDistributed = (row) => {
+        const docPath = String(row["doc_path"] ?? "");
+        if (docPath === "")
+            return false;
+        const managed = managedBySdd.get(String(row["source_sdd_id"] ?? ""));
+        if (managed === undefined || managed === null) {
+            // No lock for this contributor: historical prefix test.
+            return docPath.startsWith("docs/method/adr/");
+        }
+        return managed.has(docPath);
+    };
     const seen = new Map();
     const out = [];
     for (const row of rows) {
-        const isMethod = String(row["doc_path"] ?? "").startsWith("docs/method/adr/");
         const id = String(row["id"] ?? "");
-        if (!isMethod || id === "") {
+        if (!isMethodDistributed(row) || id === "") {
             out.push(row);
             continue;
         }
@@ -538,10 +710,10 @@ function dedupMethodScopedAdrs(rowsByCatalogue, findings) {
             const a = String(existing[attr] ?? "");
             const b = String(row[attr] ?? "");
             if (a !== "" && b !== "" && a !== b) {
-                findings.add("convention", `adrs: method-scoped id "${id}" has conflicting ${attr} across SDDs [${String(existing["source_sdd_id"] ?? "?")}, ${String(row["source_sdd_id"] ?? "?")}] — first-seen kept`);
+                findings.add("convention", `adrs: method-distributed id "${id}" has conflicting ${attr} across SDDs [${String(existing["source_sdd_id"] ?? "?")}, ${String(row["source_sdd_id"] ?? "?")}] — first-seen kept`);
             }
         }
-        // duplicate method ADR — already kept first-seen; drop this copy.
+        // duplicate method-distributed ADR — already kept first-seen; drop this copy.
     }
     rowsByCatalogue.set("adrs", out);
 }
@@ -686,7 +858,9 @@ function findDuplicatePrimaryKeys(schema, rowsByCatalogue) {
     }
     return out;
 }
-async function mergeCatalogues(schema, rowsByCatalogue, cataloguesDir, sourceSddId) {
+async function mergeCatalogues(schema, rowsByCatalogue, cataloguesDir, sourceSddId, 
+/** M-ADR 0208 §4.4: value to fill into `platform_sdd_id` when empty; null = do not fill. */
+platformSddId) {
     const counts = new Map();
     let dirExists = true;
     try {
@@ -717,26 +891,35 @@ async function mergeCatalogues(schema, rowsByCatalogue, cataloguesDir, sourceSdd
             }
             throw err;
         }
-        const stamped = stampSourceSddId(cat, parsed.rows, sourceSddId);
+        const stamped = stampColumn(cat, stampColumn(cat, parsed.rows, "source_sdd_id", sourceSddId), "platform_sdd_id", platformSddId);
         rowsByCatalogue.get(cat.name).push(...stamped);
         counts.set(cat.name, stamped.length);
     }
     return counts;
 }
-function stampSourceSddId(catalogue, rows, sourceSddId) {
-    const hasColumn = catalogue.columns.some((c) => c.name === "source_sdd_id");
-    if (!hasColumn)
+/**
+ * Stamp `column` = `value` on every row that does not already carry one
+ * (preserve-if-set — chained aggregation, M-ADR 0134 §4.5 step 4). Used for
+ * `source_sdd_id` and, per M-ADR 0208 §4.4, for `platform_sdd_id`. A null value
+ * means "do not fill" (organisation tier, where the stamp arrived from below or
+ * is legitimately unresolved). No-op when the catalogue lacks the column.
+ */
+function stampColumn(catalogue, rows, column, value) {
+    const hasColumn = catalogue.columns.some((c) => c.name === column);
+    if (!hasColumn || value === null)
         return rows.map((r) => ({ ...r }));
     return rows.map((r) => {
-        if (r["source_sdd_id"] && r["source_sdd_id"].trim() !== "") {
-            // Already stamped — preserve (chained aggregation).
+        if (String(r[column] ?? "").trim() !== "")
             return { ...r };
-        }
-        return { ...r, source_sdd_id: sourceSddId };
+        return { ...r, [column]: value };
     });
 }
 async function crossCheckSiblings(ecosystemRootPath, siblings, aggregatorSchema, write) {
     const findings = new FindingsLog();
+    const siblingProfiles = new Map();
+    const siblingCategories = new Map();
+    const siblingDeclaredPlatform = new Map();
+    const deprecatedPlatformField = new Set();
     for (const sib of siblings) {
         let sibProfile;
         if (sib.level === "organisation") {
@@ -761,7 +944,13 @@ async function crossCheckSiblings(ecosystemRootPath, siblings, aggregatorSchema,
                     `  (rule: sibling_id_matches_sibling_manifest)`);
             }
             sibProfile = sibManifest.profile;
+            siblingCategories.set(sib.sddId, sibManifest.category);
+            if (sibManifest.platformSddId)
+                siblingDeclaredPlatform.set(sib.sddId, sibManifest.platformSddId);
+            if (sibManifest.platformFieldDeprecated)
+                deprecatedPlatformField.add(sib.sddId);
         }
+        siblingProfiles.set(sib.sddId, sibProfile);
         // Cross-check sibling's vendored catalogue-schema.yaml against the
         // declared compat range. The aggregator's own canonical schema is the
         // source of truth; the sibling's vendored copy is informational and
@@ -784,7 +973,7 @@ async function crossCheckSiblings(ecosystemRootPath, siblings, aggregatorSchema,
         }
         write(`    ✓ ${sib.sddId} (${sibProfile})\n`);
     }
-    return { findings };
+    return { findings, siblingProfiles, siblingCategories, siblingDeclaredPlatform, deprecatedPlatformField };
 }
 async function findVendoredSchema(sddRoot) {
     // Adopters typically vendor canonical schema indirectly via sdd-cli.
@@ -1681,18 +1870,113 @@ export function rekeyLegacyContractRefs(schema, rowsByCatalogue, findings) {
     return { rekeyed, deduped, ambiguous };
 }
 /**
- * M-ADR 0133 §4.2c open hygiene, shipped with M-ADR 0189 §4.4: the
- * `platform` kind is documented "exactly one per ecosystem after federation
- * aggregation" and nothing enforced it. Exported for testing.
+ * Fill `platform_sdd_id` on rows the aggregator constructed after the node
+ * loader stamped its inputs (M-ADR 0208 §4.4). The node loader stamps every
+ * row it MERGES; rows built at this tier from those inputs — 0189 §4.4
+ * adjudication conversions into system_system_dependency / container_dependency,
+ * re-derived edges — set source_sdd_id explicitly and were emitted with an empty
+ * platform stamp under FK PASS (measured: 38 of 38 system_system_dependency rows
+ * and 2 of 208 container_dependency rows on the forward reference estate, the
+ * other 206 stamped by the loader; 26 of 26 and 13 of 194 on the reverse estate's
+ * platform tier). Resolution order per row: the §4.4 fill-rule platform recorded
+ * for its source_sdd_id; else the single stamp already observed on that source's
+ * rows anywhere in the aggregate (a source whose rows carry two different stamps
+ * is ambiguous and is NOT guessed). Whatever remains empty is reported as
+ * coverage — an empty stamp is unresolved, never a key value. Exported for testing.
+ */
+export function fillDerivedPlatformStamps(schema, rowsByCatalogue, platformBySource, findings) {
+    const stamped = schema.catalogues.filter((c) => c.columns.some((col) => col.name === "platform_sdd_id") &&
+        c.columns.some((col) => col.name === "source_sdd_id"));
+    const observed = new Map();
+    for (const cat of stamped) {
+        for (const r of rowsByCatalogue.get(cat.name) ?? []) {
+            const src = String(r["source_sdd_id"] ?? "").trim();
+            const pf = String(r["platform_sdd_id"] ?? "").trim();
+            if (src === "" || pf === "")
+                continue;
+            if (!observed.has(src))
+                observed.set(src, new Set());
+            observed.get(src).add(pf);
+        }
+    }
+    const resolve = (src) => {
+        const ruled = platformBySource.get(src);
+        if (ruled !== undefined)
+            return ruled;
+        const seen = observed.get(src);
+        if (seen !== undefined && seen.size === 1)
+            return [...seen][0];
+        return null;
+    };
+    let filled = 0;
+    const unresolved = [];
+    for (const cat of stamped) {
+        const rows = rowsByCatalogue.get(cat.name);
+        if (rows === undefined || rows.length === 0)
+            continue;
+        let catEmpty = 0;
+        const next = rows.map((r) => {
+            if (String(r["platform_sdd_id"] ?? "").trim() !== "")
+                return r;
+            const src = String(r["source_sdd_id"] ?? "").trim();
+            const value = src === "" ? null : resolve(src);
+            if (value === null) {
+                catEmpty++;
+                return r;
+            }
+            filled++;
+            return { ...r, platform_sdd_id: value };
+        });
+        rowsByCatalogue.set(cat.name, next);
+        if (catEmpty > 0)
+            unresolved.push(`${cat.name} ${catEmpty}`);
+    }
+    if (filled > 0) {
+        findings.add("inferred", `platform_sdd_id: ${filled} aggregator-constructed row(s) stamped from their source_sdd_id after derivation (M-ADR 0208 §4.4) — the node loader stamps only the rows it merges`);
+    }
+    if (unresolved.length > 0) {
+        findings.add("coverage", `platform_sdd_id: rows still EMPTY after the final pass [${unresolved.join(", ")}] — source unknown to the fill rule, or its rows carry more than one stamp; unresolved, not a key (M-ADR 0208 §4.4)`);
+    }
+}
+/**
+ * M-ADR 0133 §4.2c open hygiene, shipped with M-ADR 0189 §4.4, TIER-GATED by
+ * M-ADR 0208 §4.2 — gated, not skipped: a skipped check fails toward success.
+ *   platform tier:      exactly one row with kind "platform" in the aggregate.
+ *   organisation tier:  exactly one "platform" row PER DISTINCT platform_sdd_id,
+ *                       and every "platform" row must carry a stamp — an empty
+ *                       stamp is unresolved, never a key (0208 §4.4).
+ * Exported for testing.
  */
-export function checkPlatformKindUniqueness(systems, findings) {
-    const plats = systems
-        .filter((s) => String(s["kind"]) === "platform")
+export function checkPlatformKindUniqueness(systems, findings, tier = "platform") {
+    const plats = systems.filter((s) => String(s["kind"]) === "platform");
+    if (tier === "platform") {
+        const ids = plats.map((s) => String(s["id"])).sort((a, b) => a.localeCompare(b));
+        if (ids.length > 1) {
+            findings.add("convention", `c4_systems: ${ids.length} rows with kind "platform" [${ids.join(", ")}] — ` +
+                `exactly one per platform (M-ADR 0208 §4.2); this is a platform-tier aggregate`);
+        }
+        return;
+    }
+    const unstamped = plats
+        .filter((s) => String(s["platform_sdd_id"] ?? "").trim() === "")
         .map((s) => String(s["id"]))
         .sort((a, b) => a.localeCompare(b));
-    if (plats.length > 1) {
-        findings.add("convention", `c4_systems: ${plats.length} rows with kind "platform" [${plats.join(", ")}] — ` +
-            `the metamodel expects exactly one per ecosystem after aggregation`);
+    if (unstamped.length > 0) {
+        findings.add("coverage", `c4_systems: ${unstamped.length} "platform" row(s) with EMPTY platform_sdd_id at organisation tier [${unstamped.join(", ")}] — unresolved, not a key (M-ADR 0208 §4.4)`);
+    }
+    const byPlatform = new Map();
+    for (const s of plats) {
+        const key = String(s["platform_sdd_id"] ?? "").trim();
+        if (key === "")
+            continue;
+        const list = byPlatform.get(key) ?? [];
+        list.push(String(s["id"]));
+        byPlatform.set(key, list);
+    }
+    for (const [platform, ids] of byPlatform) {
+        if (ids.length > 1) {
+            findings.add("convention", `c4_systems: platform "${platform}" has ${ids.length} rows with kind "platform" [${ids.sort((a, b) => a.localeCompare(b)).join(", ")}] — exactly one per platform (M-ADR 0208 §4.2)`);
+        }
     }
 }
 /**
@@ -1767,7 +2051,32 @@ async function fileExists(absPath) {
  *
  * Exported for testing.
  */
-export function deriveCrossSddPlatformCapability(productPlatformDeps, capabilityServices, findings) {
+export function deriveCrossSddPlatformCapability(productPlatformDeps, capabilityServices, findings, capabilities = []) {
+    // The edge's PLATFORM LEG. `capability_service` has no source_sdd_id column
+    // (schema: id, capability_id, service_id, role), so the row that knows which
+    // platform owns a capability is `capabilities` — its platform_sdd_id
+    // (M-ADR 0208 §4.4) or, on pre-0208 output, its source_sdd_id. From
+    // 2.9.0 (v0.22.0) until 1.19.2 this read `match["source_sdd_id"]` off the
+    // capability_service row and was therefore "" on every emitted row, in
+    // every estate — the id carried a visible empty slot (`a__b____cap__svc`).
+    const platformByCapability = new Map();
+    for (const cap of capabilities) {
+        const id = String(cap["id"] ?? "").trim();
+        if (id === "")
+            continue;
+        const leg = String(cap["platform_sdd_id"] ?? "").trim() ||
+            String(cap["source_sdd_id"] ?? "").trim();
+        if (leg !== "" && !platformByCapability.has(id))
+            platformByCapability.set(id, leg);
+    }
+    const unresolvedLegs = new Set();
+    const resolvePlatformLeg = (match) => {
+        const capId = String(match["capability_id"] ?? "");
+        const leg = platformByCapability.get(capId) ?? String(match["source_sdd_id"] ?? "").trim();
+        if (leg === "" && capId !== "")
+            unresolvedLegs.add(capId);
+        return leg;
+    };
     // Index capability_service rows by service_id for O(1) lookup. A service
     // may belong to multiple capabilities — keep them all so a dependency
     // can resolve into every capability that owns its service. Filter out
@@ -1827,7 +2136,7 @@ export function deriveCrossSddPlatformCapability(productPlatformDeps, capability
                 continue;
             }
             for (const match of capMatches) {
-                const platformSddId = String(match["source_sdd_id"] ?? "");
+                const platformSddId = resolvePlatformLeg(match);
                 const id = [
                     consumingSddId,
                     consumingProductId,
@@ -1875,7 +2184,7 @@ export function deriveCrossSddPlatformCapability(productPlatformDeps, capability
             }
         }
         for (const match of matches) {
-            const platformSddId = String(match["source_sdd_id"] ?? "");
+            const platformSddId = resolvePlatformLeg(match);
             const platformCapabilityId = String(match["capability_id"] ?? "");
             if (platformCapabilityId === "")
                 continue;
@@ -1899,9 +2208,13 @@ export function deriveCrossSddPlatformCapability(productPlatformDeps, capability
             });
         }
     }
+    if (unresolvedLegs.size > 0) {
+        const caps = [...unresolvedLegs].sort((a, b) => a.localeCompare(b));
+        findings.add("coverage", `cross_sdd_platform_capability: platform leg (platform_sdd_id) unresolved for ${caps.length} capability id(s) [${caps.join(", ")}] — no capabilities row carries platform_sdd_id or source_sdd_id for them; the edge id has an empty slot`);
+    }
     return rows;
 }
 // Used by tests that want to round-trip CSV through the aggregator's
 // stamping logic without writing files.
-export const __test_only__ = { stampSourceSddId, parseCatalogueCsv };
+export const __test_only__ = { stampColumn, parseCatalogueCsv };
 //# sourceMappingURL=aggregate.js.map