@sdd-method/verify-cli 0.1.1 → 0.2.0

package/dist/lib/catalogue/baseline-check.js

@@ -63,6 +63,16 @@ export async function runBaselineCheck(options, write) {
         write("[error] baseline-check: no findings source (--findings <path>, or pipe them in)\n");
         return { exitCode: 2 };
     }
+    // An input with no lines at all is not "zero findings": every real findings
+    // stream (build, coverage, validate output) carries at least its own metric
+    // and verdict lines. The default source is stdin, so an empty pipe arrives
+    // here as nothing — refused, never compared (empty-set sweep, R2).
+    if (findingsText.trim() === "") {
+        write(`[error] baseline-check: the findings stream is EMPTY — no lines of any kind. ` +
+            `This is not zero findings; it is no measurement (an empty pipe, or the wrong ` +
+            `file). Pass --findings <path> to the captured stream\n`);
+        return { exitCode: 2 };
+    }
     let baselineText;
     try {
         baselineText = await readFile(baselinePath, "utf-8");
@@ -102,7 +112,8 @@ export async function runBaselineCheck(options, write) {
     // The condition is deliberately narrow: live gate-acting findings ZERO, baseline
     // non-empty, and EVERY entry closed. That triple cannot arise from ordinary
     // remediation without also being worth a human look.
-    if (live.lines.length === 0 && base.lines.length > 0 && cmp.stale.length === base.lines.length) {
+    const allClosed = live.lines.length === 0 && base.lines.length > 0 && cmp.stale.length === base.lines.length;
+    if (allClosed) {
         write(`[finding] divergence: baseline_check compared ZERO live gate-acting findings ` +
             `against ${base.lines.length} baseline entr(ies) and reported ALL of them closed. ` +
             `This is reported as a DEFECT rather than a pass: an all-closed baseline is far ` +
@@ -131,6 +142,10 @@ export async function runBaselineCheck(options, write) {
     // Only genuinely unbaselined findings fail. A reworded finding is the case
     // this whole mechanism exists to stop failing, and a closed one is good news
     // that a re-take tidies — neither is a regression.
-    return { exitCode: cmp.unbaselined.length > 0 ? 1 : 0 };
+    // The all-closed guard FAILS the gate (empty-set sweep, R2, ruled 2026-09-29):
+    // it used to print "a DEFECT rather than a pass" and exit 0, so the regression
+    // gate still passed on exactly the empty/wrong stream it was written to catch.
+    // A genuinely all-fixed estate re-takes its baseline once, deliberately.
+    return { exitCode: cmp.unbaselined.length > 0 || allClosed ? 1 : 0 };
 }
 //# sourceMappingURL=baseline-check.js.map

package/dist/lib/catalogue/canonical-schema.yaml

@@ -7,7 +7,7 @@
 # Emitted by sdd-cli's YAML emitter with no line folding; the three header scalars are quoted for the
 # textual readers downstream. The one deliberate difference from the authored form is schema_status:
 # the authored form says canonical; a projection never does.
-schema_version: "3.13.0"
+schema_version: "3.18.0"
 schema_owner: "sdd-method"
 schema_status: "generated"
 enums:
@@ -129,8 +129,12 @@ enums:
       description: Docs-only repo.
       runtime: false
       emits_service_row: false
+    - value: firmware
+      description: "Firmware that runs on a device: the application image, bootloader, loader, on-device plug-ins (M-ADR 0215). Runtime, but emits no service row — a device is not a node in the platform's service graph. Its tooling, test benches and libraries keep their own kinds."
+      runtime: true
+      emits_service_row: false
     description: |
-      Type of repository, declared in `orchestration/repo-config/*.yaml` as `service_type` and surfaced in `repositories.component_type` and `services.component_type`. The canonical builder uses this to decide which repos are runtime services (api_service, worker, gateway, frontend, mobile) and which are non-runtime (library, infrastructure, documentation). Whether a repo is a vertical-domain application is conveyed by its SDD manifest's `profile: application-product`, not by a service_type tag — this enum is strictly about runtime artefact shape (per resolution of adopt-canonical-catalogue-builder.md §7.1).
+      Type of repository, declared in `orchestration/repo-config/*.yaml` as `service_type` and surfaced in `repositories.component_type` and `services.component_type`. The canonical builder uses this to decide which repos are runtime services (api_service, worker, gateway, frontend, mobile) and which are non-runtime (library, infrastructure, documentation); firmware runs, but on a device, so it is runtime without a service row (M-ADR 0215) — service emission follows emits_service_row, not runtime. Whether a repo is a vertical-domain application is conveyed by its SDD manifest's `profile: application-product`, not by a service_type tag — this enum is strictly about runtime artefact shape (per resolution of adopt-canonical-catalogue-builder.md §7.1).
   capability_exemption_reason:
     values:
     - value: infrastructure
@@ -246,7 +250,7 @@ enums:
       description: A persona the journey passes to or from.
     - value: supporting
       description: A persona present in the journey without owning it.
-    description: "The kind of participation a persona has in a user journey, in `persona_journey.role` — the ADR 0210 worked example's `participation`. Bound at 3.9.0 (M-ADR 0210 §4.5): parsed from the persona spec's declared `Roles:` line, a method template surface; every row at both estates was in-vocabulary when bound."
+    description: "The kind of participation a persona has in a user journey, in `persona_journey.role` — the M-ADR 0210 worked example's `participation`. Bound at 3.9.0 (M-ADR 0210 §4.5): parsed from the persona spec's declared `Roles:` line, a method template surface; every row at both estates was in-vocabulary when bound."
   model_notation:
     values:
     - value: mermaid-erd
@@ -474,20 +478,134 @@ enums:
     - value: code-vs-contract
     - value: binding-vs-reality
     description: M-ADR 0194 conformance finding target. Bound at 3.13.0 from the column descriptions; measured against both reference estates before binding (M-ADR 0205 §4.4).
-  conformance_role:
+  implementation_role:
     values:
     - value: as-is
+      description: The existing implementation.
     - value: to-be
-    description: M-ADR 0194 conformance finding role. Bound at 3.13.0 from the column descriptions; measured against both reference estates before binding (M-ADR 0205 §4.4).
-  conformance_lifecycle:
+      description: The target implementation the spec is migrating toward.
+    description: An implementation member's role against its spec (M-ADR 0181 §2.1). Bound at 3.13.0 on conformance_finding as conformance_role; renamed at 3.15.0, when implementation_members became its owner (M-ADR 0214 §4.2) — the values did not change.
+  implementation_lifecycle:
     values:
     - value: active
+      description: In service and the current implementation.
     - value: planned
+      description: "Not yet built: the repository may not exist yet."
     - value: deprecated
+      description: "Still running, scheduled for retirement (M-ADR 0214 §4.7: what some bindings called sunset)."
     - value: migrating
+      description: Being moved onto, or off, while both sides run.
     - value: legacy-active
+      description: The as-is implementation, still serving while a to-be replaces it.
     - value: decommissioned
-    description: M-ADR 0194 conformance finding lifecycle. Bound at 3.13.0 from the column descriptions; measured against both reference estates before binding (M-ADR 0205 §4.4).
+      description: "Retired: no longer running."
+    description: An implementation member's lifecycle (M-ADR 0181 §2.1). Bound at 3.13.0 on conformance_finding as conformance_lifecycle; renamed at 3.15.0, when implementation_members became its owner (M-ADR 0214 §4.2) — the values did not change.
+  repo_scope:
+    values:
+    - value: component
+      description: "Part of what this SDD specifies: the SDD's artefact stack applies, and its capabilities or other services depend on it."
+    - value: support
+      description: "Supports a component without being one: its operational configuration, tooling, tests, collections, or a library it consumes."
+    description: Whether a mirrored repository is inside the scope of what its SDD specifies (M-ADR 0213). Deliberately neither a profile (profile is the SDD's) nor a role (role is M-ADR 0181's as-is | to-be); a repository's kind is component_type.
+  evidence_direction:
+    values:
+    - value: forward-authored
+      description: The spec came first and the code was built from it.
+    - value: seeding-reverse
+      description: A spec that never existed, recovered from pre-existing internal code.
+    - value: external-doc-reverse
+      description: The external surface a product consumes, grounded in a third party's published API or documentation.
+    - value: conformance-reverse
+      description: Own forward or maintained code, verified against its spec, with legitimate evolution fed back.
+    description: How an implementation member is evidenced (M-ADR 0180 §2.1; forward-authored added by M-ADR 0181 §2.1).
+  member_presence:
+    values:
+    - value: observed
+      description: Exported and observed in this baseline.
+    - value: carried
+      description: "Not re-exported: carried from an earlier baseline (carried_from), with its reason."
+    - value: removed
+      description: In the prior baseline and not in this one (members_removed), with its reason.
+    description: A snapshot member's presence in its baseline — the three states the snapshot conventions record (M-ADR 0214 §4.4).
+  conformance_disposition:
+    values:
+    - value: conformant
+      description: Code matches spec.
+    - value: conformant-open
+      description: "Both sides agree the item is deferred or absent: an open decision, not drift."
+    - value: code-defect
+      description: "The spec is authority: fix the code."
+    - value: spec-stale
+      description: "The code legitimately evolved: update the spec."
+    - value: divergence
+      description: "A genuine design question: triage, don't fail."
+    description: The triage outcome of a conformance-reverse delta (M-ADR 0180 §2.3). Bound so every file that records an outcome records one of these; the triage records are not yet catalogued (M-ADR 0214 §4.8).
+  delta_disposition:
+    values:
+    - value: capability-added
+      description: The code gained a capability the spec does not have.
+    - value: capability-removed
+      description: The code lost a capability the spec still has.
+    - value: spec-update
+      description: "The code legitimately evolved within a capability: the spec follows."
+    - value: refactor-only-no-spec-change
+      description: "The code changed and its behaviour did not: no spec change."
+    - value: ambiguous
+      description: "Cannot be classified from the delta alone: triage."
+    description: The classification of a delta-reverse finding between two snapshots (M-ADR 0180 §2.7). Bound so every file that records one records one of these; delta findings are not yet catalogued (M-ADR 0214 §4.8).
+  supply_verdict:
+    values:
+    - value: supported
+      description: The item reaches the canonical boundary from this integration.
+    - value: partial
+      description: It reaches it with a stated limitation (rate, scope, accuracy).
+    - value: source-absent
+      description: "The provider cannot supply it: nobody's work."
+    - value: gateway-gap
+      description: "The provider can and this integration does not: the integration's work."
+    - value: not-applicable
+      description: The item does not apply to this integration.
+    description: "What an integration states about a data item (M-ADR 0216 §4.2). unknown is NOT a member: it is the reading of no row."
+  supply_basis:
+    values:
+    - value: code
+      description: Read from the integration's code.
+    - value: grounded
+      description: Grounded in a vendor or source artefact.
+    - value: declared
+      description: Declared by the integration's own configuration.
+    - value: inferred
+      description: Inferred, with no artefact stating it.
+    description: The evidence class of a supply statement.
+  data_necessity:
+    values:
+    - value: required
+      description: The feature cannot work without it (or without one member of its alternative_group).
+    - value: enhances
+      description: The feature works without it, less well. Never decides coverage.
+    description: How a feature needs a data item.
+  support_verdict:
+    values:
+    - value: supported
+      description: Every requirement is met.
+    - value: partial
+      description: Every requirement is met or partly met, and one only partly.
+    - value: unknown
+      description: No requirement is unmet, and one is undecided because no supply row exists.
+    - value: unsupported
+      description: A requirement is unmet; limiting_item_id and limiting_reason name it.
+    - value: not-applicable
+      description: Every required item is not-applicable to this integration.
+    description: Whether one integration supports one feature at the canonical boundary (M-ADR 0216 §4.4).
+  limiting_reason:
+    values:
+    - value: source-absent
+      description: "The provider cannot supply the item: nobody's work."
+    - value: gateway-gap
+      description: "The integration does not supply what the provider has: the integration's work."
+    - value: no-canonical-home
+      description: "The platform has no canonical field for the item: platform contract work."
+    description: Why an unsupported feature is unsupported, and so whose work the gap is.
 catalogues:
   domains:
     primary_key: id
@@ -875,7 +993,7 @@ catalogues:
     - name: domain_id
       type: string
       nullable: true
-      description: "Domain slug for a domain-scoped ADR (docs/domains/<slug>/…); 'platform' for a platform-scoped ADR (docs/platform/adr/), whose owner has that domain by construction; EMPTY for a method-scoped ADR (docs/method/adr/, docs/method/platform-adr/) — method ADRs are cross-cutting governance and belong to no domain. Nullable since 3.10.0 (M-ADR 0136 §4.3 amendment): before it, method ADRs were pinned to 'platform' and dangled in every platform-root without a domain of that name."
+      description: "Domain slug for a domain-scoped ADR (docs/domains/<slug>/…); 'platform' for a platform-scoped ADR (docs/platform/adr/), whose owner has that domain by construction; EMPTY for a method-scoped ADR (docs/method/adr/, docs/method/platform-adr/) — method ADRs are cross-cutting governance and belong to no domain. Nullable since 3.10.0 (M-ADR 0136 §4.3 amendment): before it, method ADRs were pinned to 'platform' and dangled in every platform-root without a domain of that name. External for application- and integration-product SDDs since 3.17.0, as capabilities.domain_id is: an app or integration SDD files its own domain-scoped decisions under a platform-side domain (e.g. integrations) it does not declare, so its build logs an external finding naming the value, and the owning platform's aggregate validates it — and fails there if that platform declares no such domain."
     - name: decision_date
       type: date
       nullable: true
@@ -905,6 +1023,9 @@ catalogues:
     - column: domain_id
       references: domains.id
       nullable: true
+      external_for_profiles:
+      - application-product
+      - integration-product
     - column: superseded_by_id
       references: adrs.id
       nullable: true
@@ -1670,6 +1791,7 @@ catalogues:
     - name: profile
       type: string
       nullable: false
+      description: "DEPRECATED (removal at 4.0.0): not an SDD profile. The per-repo field reused sdd_profile's values to record only whether a mirrored repository is one of the SDD's own components or a supporting one — see repo_scope (M-ADR 0213)."
     - name: group
       type: string
       nullable: true
@@ -1713,6 +1835,10 @@ catalogues:
       type: string
       nullable: true
       description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
+    - name: repo_scope
+      type: string
+      nullable: true
+      description: "Whether the repository is inside the scope of what THIS SDD specifies, from its reverse-metadata.yaml (M-ADR 0213 §4.2): component (part of what the SDD specifies) or support (supports a component without being one). Empty for a repository with no reverse metadata. Its kind is component_type; the SDD's profile is products/applications.profile."
     foreign_keys:
     - column: domain_id
       references: domains.id
@@ -1722,6 +1848,7 @@ catalogues:
       nullable: true
     column_enums:
       component_type: enums.service_type
+      repo_scope: enums.repo_scope
   domain_models:
     primary_key: id
     columns:
@@ -3279,8 +3406,8 @@ catalogues:
     description: "Conformance-reverse drift summary, one row per check (method M-ADR 0180). NOT produced by `catalogue build` (it reads the spec repo) — produced by `sdd-cli conformance --emit-finding` (which has the code repo) and federated here by the aggregator. Each row is a run-dated snapshot of declared-vs-observed drift for an implementation member (M-ADR 0181 role/lifecycle), so estate-wide conformance is queryable (aggregate union) and trendable (snapshot diff across runs/commits). Verdicts are PROVISIONAL — disposition (code-defect | spec-stale | divergence) is triage, recorded elsewhere. No enforced FK on implementation_repo: the code repo is frequently cross-repo and not in this SDD's repositories.csv. Added in schema 2.25.0."
     column_enums:
       target: enums.conformance_target
-      role: enums.conformance_role
-      lifecycle: enums.conformance_lifecycle
+      role: enums.implementation_role
+      lifecycle: enums.implementation_lifecycle
   quality_scores:
     primary_key: id
     columns:
@@ -3555,3 +3682,342 @@ catalogues:
     column_enums:
       item_kind: enums.scaffold_item_kind
       state: enums.scaffold_item_state
+  implementations:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+      description: The binding's implementation key — the same value every snapshot manifest of this implementation carries as implementation.
+    - name: name
+      type: string
+      nullable: false
+      description: The binding's name key, else the id.
+    - name: spec
+      type: string
+      nullable: false
+      description: The spec this implementation implements — the binding's spec key.
+    - name: snapshot_area
+      type: string
+      nullable: true
+      description: Store-relative path of this implementation's snapshot area (M-ADR 0214 §4.4), from the binding. Empty when the implementation has none.
+    - name: doc_path
+      type: string
+      nullable: false
+      description: Path of the binding file, relative to the SDD root.
+    - name: source_sdd_id
+      type: string
+      nullable: true
+      description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+    - name: platform_sdd_id
+      type: string
+      nullable: true
+      description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4.
+    description: "An implementation of this SDD's spec: the durable system identity whose snapshots are its versions (M-ADR 0181 §2.5, M-ADR 0214 §4.1). One row per .sdd/implementation-binding.yaml that names its implementation; a binding without an implementation key emits nothing and a finding, because there is no identity to key on."
+  implementation_members:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+      description: <implementation_id>::<repo_key>.
+    - name: implementation_id
+      type: string
+      nullable: false
+    - name: repo_id
+      type: string
+      nullable: true
+      description: The member's repository when it resolves in this SDD's repositories. Empty for a planned member whose repository does not exist yet; a member of any other lifecycle that does not resolve is a builder finding.
+    - name: repo_key
+      type: string
+      nullable: false
+      description: The repository the binding names (its member repo key), resolved or not.
+    - name: role
+      type: string
+      nullable: true
+    - name: lifecycle
+      type: string
+      nullable: true
+    - name: evidence_direction
+      type: string
+      nullable: true
+      description: How this member is evidenced (M-ADR 0180 §2.1, placed on the member by M-ADR 0181 §2.1). Empty when the binding does not say.
+    - name: source_sdd_id
+      type: string
+      nullable: true
+      description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+    - name: platform_sdd_id
+      type: string
+      nullable: true
+      description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4.
+    description: "Edge: a repository is a member of an implementation, with the member's role, lifecycle and evidence direction (M-ADR 0181 §2.1, M-ADR 0214 §4.2). Role and lifecycle live here once: repo_capability, repo_contract and feature_repo resolve their repository to this row rather than copying them (M-ADR 0214 §4.3). Membership is independent of the repository's repo_scope (M-ADR 0213): a shared library under conformance checks is a support member."
+    foreign_keys:
+    - column: implementation_id
+      references: implementations.id
+      nullable: false
+    - column: repo_id
+      references: repositories.id
+      nullable: true
+    column_enums:
+      role: enums.implementation_role
+      lifecycle: enums.implementation_lifecycle
+      evidence_direction: enums.evidence_direction
+  snapshots:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+      description: <implementation_id>@<baseline_id>.
+    - name: implementation_id
+      type: string
+      nullable: false
+    - name: baseline_id
+      type: string
+      nullable: false
+      description: The observation date (YYYY-MM-DD) — the baseline folder and the manifest's snapshot_id.
+    - name: prior_snapshot_id
+      type: string
+      nullable: true
+      description: The snapshot this one was diffed from — <implementation_id>@<prior_snapshot>. Empty for the first.
+    - name: credential_scan_result
+      type: string
+      nullable: true
+      description: The manifest's credential_scan.result (clean, or what was found). Empty when no scan is recorded.
+    - name: source_sdd_id
+      type: string
+      nullable: true
+      description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+    - name: platform_sdd_id
+      type: string
+      nullable: true
+      description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4.
+    description: One implementation's member set pinned at one observation (M-ADR 0181 §2.5, M-ADR 0214 §4.4). One row per dated baseline in the implementation's snapshot area whose snapshot.yaml names the same implementation. Needs the snapshot store root (build --snapshot-store or SDD_SNAPSHOT_STORE); without it the catalogue is empty and the build says so.
+    foreign_keys:
+    - column: implementation_id
+      references: implementations.id
+      nullable: false
+    - column: prior_snapshot_id
+      references: snapshots.id
+      nullable: true
+  snapshot_members:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+      description: <snapshot_id>::<repo_key>.
+    - name: snapshot_id
+      type: string
+      nullable: false
+    - name: repo_id
+      type: string
+      nullable: true
+      description: The member's repository when it resolves in this SDD's repositories; empty otherwise (a removed member's repository may be gone).
+    - name: repo_key
+      type: string
+      nullable: false
+      description: The manifest's canonical_repo_key.
+    - name: source_revision
+      type: string
+      nullable: false
+      description: The revision observed (for a removed member, its last revision).
+    - name: observed_at
+      type: string
+      nullable: true
+      description: "The member's own observation date: the baseline's for an observed member, the earlier one for a carried member, the last observed for a removed one."
+    - name: presence
+      type: string
+      nullable: false
+    - name: source_sdd_id
+      type: string
+      nullable: true
+      description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+    - name: platform_sdd_id
+      type: string
+      nullable: true
+      description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4.
+    description: "Edge: a repository at one revision in one snapshot, with its presence — observed in this baseline, carried from an earlier one, or removed since the prior (M-ADR 0214 §4.4)."
+    foreign_keys:
+    - column: snapshot_id
+      references: snapshots.id
+      nullable: false
+    - column: repo_id
+      references: repositories.id
+      nullable: true
+    column_enums:
+      presence: enums.member_presence
+  data_items:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+      description: di.<category>.<name>, e.g. di.motion.speed.
+    - name: name
+      type: string
+      nullable: false
+    - name: category
+      type: string
+      nullable: false
+      description: Open grouping (motion, behaviour, tyre, energy, …).
+    - name: canonical_field
+      type: string
+      nullable: true
+      description: The integration-facing canonical contract field that carries the item. EMPTY means the platform has no canonical home for it, and coverage reads every requirement on it as unmet (no-canonical-home).
+    - name: description
+      type: string
+      nullable: true
+    - name: source_sdd_id
+      type: string
+      nullable: true
+      description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+    - name: platform_sdd_id
+      type: string
+      nullable: true
+      description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator (M-ADR 0208 §4.4).
+    description: "A unit of data an integration may supply and a feature may need, at the canonical boundary (M-ADR 0216 §4.1). Platform-owned, like events. Not a wire signal: payload grammar stays adopter territory."
+  integration_data_item:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+      description: <integration_id>::<data_item_id>::<evidence_ref>.
+    - name: integration_id
+      type: string
+      nullable: false
+    - name: data_item_id
+      type: string
+      nullable: false
+    - name: verdict
+      type: string
+      nullable: false
+      description: Bound to supply_verdict. A mapping-table row is supported, or partial when its Notes begin with partial; the Data Items Not Supplied section carries the rest.
+    - name: basis
+      type: string
+      nullable: true
+      description: "Bound to supply_basis: the evidence class of the statement."
+    - name: evidence_ref
+      type: string
+      nullable: false
+      description: Path and line of the statement.
+    - name: checked_at
+      type: string
+      nullable: true
+      description: "The governing Checked: line of the section, verbatim (a date, or a source revision). Reported for age; never read as a verdict."
+    - name: source_sdd_id
+      type: string
+      nullable: true
+      description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+    - name: platform_sdd_id
+      type: string
+      nullable: true
+      description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator (M-ADR 0208 §4.4).
+    description: "Supply: what one integration states about one data item, from its feature-grounding (M-ADR 0216 §4.2). Several rows per item are normal (one per evidence_ref); coverage reads the best. No row reads unknown, and unknown is never written."
+    foreign_keys:
+    - column: integration_id
+      references: integrations.id
+      nullable: false
+    - column: data_item_id
+      references: data_items.id
+      nullable: false
+      external_for_profiles:
+      - application-product
+      - integration-product
+    column_enums:
+      verdict: enums.supply_verdict
+      basis: enums.supply_basis
+  feature_data_requirement:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+      description: <feature_id>::<data_item_id>.
+    - name: feature_id
+      type: string
+      nullable: false
+    - name: data_item_id
+      type: string
+      nullable: false
+    - name: necessity
+      type: string
+      nullable: false
+      description: Bound to data_necessity.
+    - name: alternative_group
+      type: string
+      nullable: true
+      description: "Empty, or a label: required rows sharing a label are satisfied by any one of them."
+    - name: basis_ref
+      type: string
+      nullable: true
+      description: Where the need is stated (path and line).
+    - name: source_sdd_id
+      type: string
+      nullable: true
+      description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+    - name: platform_sdd_id
+      type: string
+      nullable: true
+      description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator (M-ADR 0208 §4.4).
+    description: "Demand: a data item one feature needs, from the feature spec's Data Requirements table (M-ADR 0216 §4.3). Feature grain only: a capability's need is the union of its features'."
+    foreign_keys:
+    - column: feature_id
+      references: features.id
+      nullable: false
+    - column: data_item_id
+      references: data_items.id
+      nullable: false
+      external_for_profiles:
+      - application-product
+      - integration-product
+    column_enums:
+      necessity: enums.data_necessity
+  feature_integration_support:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+      description: <feature_id>::<integration_id>.
+    - name: feature_id
+      type: string
+      nullable: false
+    - name: integration_id
+      type: string
+      nullable: false
+    - name: verdict
+      type: string
+      nullable: false
+      description: "Bound to support_verdict. Each requirement is decided first (an alternative_group is unmet only when every member is); the feature takes the worst: unsupported > unknown > partial > supported. not-applicable only when every required item is."
+    - name: limiting_item_id
+      type: string
+      nullable: true
+      description: "For unsupported: the deciding requirement's item. Empty otherwise."
+    - name: limiting_reason
+      type: string
+      nullable: true
+      description: "For unsupported: bound to limiting_reason. Empty otherwise."
+    - name: source_sdd_id
+      type: string
+      nullable: true
+      description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+    - name: platform_sdd_id
+      type: string
+      nullable: true
+      description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator (M-ADR 0208 §4.4).
+    description: "Coverage: whether one integration can support one feature, DERIVED at aggregation from supply and demand (M-ADR 0216 §4.4); empty in a member build. SUPPORTED MEANS THE ITEMS REACH THE CANONICAL BOUNDARY, NOT THAT THE FEATURE WORKS END TO END: routing past that boundary is not checked."
+    foreign_keys:
+    - column: feature_id
+      references: features.id
+      nullable: false
+    - column: integration_id
+      references: integrations.id
+      nullable: false
+    - column: limiting_item_id
+      references: data_items.id
+      nullable: true
+    column_enums:
+      verdict: enums.support_verdict
+      limiting_reason: enums.limiting_reason

package/dist/lib/catalogue/coverage-render.js

@@ -78,6 +78,9 @@ export function renderRepoCapability(findings, metrics) {
             }));
         }
     }
+    if (metrics.total === 0 && findings.length === 0) {
+        lines.push(`[metric] repo_capability_resolution: n/a — 0 repository rows, nothing to resolve`);
+    }
     if (metrics.total > 0) {
         const resolved = metrics.byCapability + metrics.byExemption;
         const pct = fmt1f((100.0 * resolved) / metrics.total);
@@ -125,6 +128,9 @@ export function renderServiceCapability(findings, metrics, tier) {
                 `capability_service.csv); check the aggregate next${leverageNote(f)}`);
         }
     }
+    if (metrics.total === 0 && findings.length === 0) {
+        lines.push(`[metric] service_capability_resolution (tier=${tier}): n/a — 0 service rows, nothing to resolve`);
+    }
     if (metrics.total > 0) {
         const resolved = metrics.claimed + metrics.exempt;
         const pct = fmt1f((100.0 * resolved) / metrics.total);
@@ -426,6 +432,14 @@ export function renderScoresCoverage(res, tier) {
                 `catalogue row — the assessment describes something the model no longer ` +
                 `holds; re-key the registry entry or withdraw the score`);
         }
+        else if (f.kind === "recorded-path-mismatch") {
+            // COVERAGE class — report-only by ruling (decision #3, 2026-09-29): it
+            // becomes gate-acting only once both estates read zero, and that is a
+            // deliberate later change to this one word, as for orphaned-score above.
+            out.push(`[finding] coverage: ${f.rubricId} score for ${f.subject} — the recorded file ` +
+                `is not the target's catalogue path, so the assessment may describe a copy the ` +
+                `catalogue cannot see; re-score against the catalogue path or re-point file_path`);
+        }
         else {
             out.push(`[finding] coverage: ${f.subject}`);
         }
@@ -470,6 +484,22 @@ export function renderScoresCoverage(res, tier) {
         out.push(`[metric] scores_coverage.${m.rubricId}: ${m.covered}/${m.eligible} ` +
             `${m.targetKind}(s) scored, ${m.scored} score(s) present, ${m.orphaned} orphaned`);
     }
+    // Recorded-path check (decision #3): stated for every rubric with scores,
+    // including the ones it cannot check — n/a is named, never read as agreement.
+    const scoredMetrics = res.metrics.filter((m) => m.scored > 0);
+    const checkable = scoredMetrics.filter((m) => m.recordedPath !== null);
+    const notCheckable = scoredMetrics.filter((m) => m.recordedPath === null);
+    if (scoredMetrics.length > 0) {
+        const sum = (k) => checkable.reduce((a, m) => a + (m.recordedPath?.[k] ?? 0), 0);
+        out.push(`[metric] scores_coverage.recorded_path: ${sum("agree")} agree, ${sum("mismatch")} mismatch, ` +
+            `${sum("noRecordedPath")} with no recorded path — across ${checkable.length} rubric(s) whose ` +
+            `catalogue holds the scored file's path` +
+            (notCheckable.length > 0
+                ? `; n/a for ${notCheckable.length} (${notCheckable.map((m) => m.rubricId).join(", ")}) — ` +
+                    `the catalogue does not hold the path of the file those rubrics score`
+                : "") +
+            ` (report-only; a path filled in from the catalogue agrees by construction)`);
+    }
     // The excluded population is printed BESIDE the denominator it shrank, never
     // folded into it. A reader comparing this run against a pre-filter baseline
     // must be able to see why the denominator moved without re-deriving it, and