@sdd-method/verify-cli 4.0.1 → 5.1.0

package/dist/lib/catalogue/canonical-schema.yaml

@@ -7,7 +7,7 @@
 # Emitted by sdd-cli's YAML emitter with no line folding; the three header scalars are quoted for the
 # textual readers downstream. The one deliberate difference from the authored form is schema_status:
 # the authored form says canonical; a projection never does.
-schema_version: "6.0.0"
+schema_version: "7.1.0"
 schema_owner: "sdd-method"
 schema_status: "generated"
 enums:
@@ -645,7 +645,7 @@ enums:
       description: Its change archived on a passing judge, with this repository's work order implementing it.
     - value: observed
       description: Independent evidence from this repository's code matches (a baseline's characterization tests or a reverse snapshot).
-    description: The kind of evidence an assertion is about one revision, in one repository (M-ADR 0230 §4.7, Proposed).
+    description: The kind of evidence an assertion is about one revision, in one repository (M-ADR 0230 §4.7).
   change_status:
     values:
     - value: proposed
@@ -685,15 +685,15 @@ enums:
     - value: obligation
       description: Behaviour every feature in a population depends on, owned as a feature of its own (M-ADR 0226, Proposed).
     - value: journey
-      description: A user journey's joint behaviour, held in the behaviour store (M-ADR 0229 §4.2, option B; Proposed).
-    description: What a catalogued feature is (M-ADR 0226 and M-ADR 0229, both Proposed).
+      description: A user journey's joint behaviour, held in the behaviour store (M-ADR 0229 §4.2, option B).
+    description: What a catalogued feature is (M-ADR 0226, Proposed, and M-ADR 0229).
   journey_requirement_basis:
     values:
     - value: tag
       description: A @req tag in the journey's end-to-end test file (option A).
     - value: citation
       description: A citation in the journey feature's living spec (option B).
-    description: Where a journey's citation of a requirement was read (M-ADR 0229 §4.4, Proposed).
+    description: Where a journey's citation of a requirement was read (M-ADR 0229 §4.4).
   source_of_truth:
     values:
     - value: structure
@@ -714,14 +714,14 @@ enums:
       description: Observations, scores and findings, about a named revision.
     - value: execution
       description: "The change records and the build itself: changes, work orders, lineage, and the provenance the build or aggregation stamps."
-    description: Where a catalogue's facts, or a column's, are authored (M-ADR 0230 §4.1, Proposed). Each catalogue carries one; a column carries one only where it differs.
+    description: Where a catalogue's facts, or a column's, are authored (M-ADR 0230 §4.1). Each catalogue carries one; a column carries one only where it differs.
   relationship_end_cardinality:
     values:
     - value: exactly-one
     - value: zero-or-one
     - value: one-or-more
     - value: zero-or-more
-    description: "How many entities one end of a relationship holds for one entity at the other end (M-ADR 0230 §4.3, Proposed): a Mermaid ER end marker (|| exactly one, |o or o| zero or one, }| or |{ one or more, }o or o{ zero or more). A TypeQL relationship is zero-or-more at both ends, because the subset admits no participation cardinality; a role's @card is a cardinality invariant (domain_invariants). Replaced entity_relationship_cardinality in schema 6.0.0."
+    description: "How many entities one end of a relationship holds for one entity at the other end (M-ADR 0230 §4.3): a Mermaid ER end marker (|| exactly one, |o or o| zero or one, }| or |{ one or more, }o or o{ zero or more). A TypeQL relationship is zero-or-more at both ends, because the subset admits no participation cardinality; a role's @card is a cardinality invariant (domain_invariants). Replaced entity_relationship_cardinality in schema 6.0.0."
   domain_invariant_kind:
     values:
     - value: unique
@@ -732,7 +732,7 @@ enums:
       description: A bound on how many entities the named relationship relates, stated in the statement.
     - value: rule
       description: Any other rule, stated in the statement.
-    description: The type of a domain invariant (M-ADR 0230 §4.3, Proposed).
+    description: The type of a domain invariant (M-ADR 0230 §4.3).
   revision_state:
     values:
     - value: current
@@ -741,14 +741,14 @@ enums:
       description: An agreed open change states it.
     - value: history
       description: Once published or stated, and no longer current.
-    description: Which view a revision belongs to (M-ADR 0230 §4.7, Proposed).
+    description: Which view a revision belongs to (M-ADR 0230 §4.7).
   change_effect_element_kind:
     values:
     - value: requirement
       description: A requirement, written by a behaviour delta.
     - value: structure
       description: An element of the structural model, written by a structural delta.
-    description: What kind of element a change effect writes (M-ADR 0230 §4.7, Proposed).
+    description: What kind of element a change effect writes (M-ADR 0230 §4.7).
   adr_governs:
     values:
     - value: current
@@ -757,7 +757,7 @@ enums:
       description: "The system as the agreed changes will leave it: the decision applies from its change's archive."
     - value: none
       description: "Neither: proposed, rejected, deprecated, superseded by a decision now in force, or its change withdrawn."
-    description: Which view a decision governs (M-ADR 0230 §4.2, Proposed).
+    description: Which view a decision governs (M-ADR 0230 §4.2).
   contract_revision_state:
     values:
     - value: agreed
@@ -768,7 +768,22 @@ enums:
       description: Applicable, with a sunset.
     - value: retired
       description: "No longer applicable: an archived change's revision the file no longer holds."
-    description: A contract revision's applicability in the published specification (M-ADR 0230 §4.2, Proposed).
+    description: A contract revision's applicability in the published specification (M-ADR 0230 §4.2).
+  ppt_archetype:
+    values:
+    - value: party
+      description: A person or an organisation.
+    - value: place
+      description: A location where things happen or are kept.
+    - value: thing
+      description: An object that is tracked individually.
+    - value: role
+      description: A way a party, place or thing takes part in something.
+    - value: moment-interval
+      description: Something that happens at a moment or over an interval, and is recorded.
+    - value: description
+      description: A catalogue-entry description that many things share.
+    description: An entity's Party-Place-Thing archetype, as the capability spec template classifies it (schema 7.1.0).
 catalogues:
   domains:
     primary_key: id
@@ -1220,7 +1235,7 @@ catalogues:
     - name: effective_change
       type: string
       nullable: true
-      description: "From the ADR's **Effective:** line (M-ADR 0230 §4.2, Proposed): the change whose archive makes the decision apply, by its undated name; empty when it applies on acceptance. Added in schema 6.0.0."
+      description: "From the ADR's **Effective:** line (M-ADR 0230 §4.2): the change whose archive makes the decision apply, by its undated name; empty when it applies on acceptance. Added in schema 6.0.0."
     - name: governs
       type: string
       nullable: true
@@ -1318,7 +1333,7 @@ catalogues:
     - name: relation
       type: string
       nullable: false
-      description: alias-of | conflicts-with | references | supersedes (extended in schema 2.12.0 per M-ADR 0158).
+      description: "alias-of | conflicts-with | references | supersedes (extended in schema 2.12.0 per M-ADR 0158). Read as source, relation, target: for supersedes the successor is the source and the superseded term the target."
     description: "Edge: cross-domain glossary relationships from glossary-alignment-manifest.yaml. Per M-ADR 0158, four walkers ingest into this catalogue: (a) forward declared pair-form {source, target} entries under aliases/conflicts, (b) reverse-method cross_domain_terms (emits references edges per referencer→owner), (c) reverse-method multi-domain conflicts (pair-wise expansion across domains[]), (d) forward-method supersedes (status: superseded entries with superseded_by back-link)."
     natural_key:
     - source_id
@@ -1503,7 +1518,7 @@ catalogues:
     - name: source
       type: string
       nullable: false
-      description: "capability-tree | product-map | capability-spec | structural-model. As of schema 6.0.0, source: structural-model is emitted for a capability only the structural model holds (M-ADR 0230 §4.3, Proposed)."
+      description: "capability-tree | product-map | capability-spec | structural-model. As of schema 6.0.0, source: structural-model is emitted for a capability only the structural model holds (M-ADR 0230 §4.3)."
       source_of_truth: derived
     - name: runway_classification
       type: string
@@ -1637,7 +1652,7 @@ catalogues:
     - name: source
       type: string
       nullable: false
-      description: "feature-tree | feature-set | capability-spec | feature-spec | feature-grounding | structural-model. As of schema 6.0.0, source: structural-model is emitted for a feature only the structural model holds (M-ADR 0230 §4.3, Proposed). NOTE: feature-tree-group source removed in 1.3.0 — groups are now first-class in feature_groups.csv. As of schema 2.2.0, source: feature-tree is emitted by the canonical builder for rows derived from feature-tree.md bullets. As of schema 2.5.0, source: feature-grounding is emitted for rows derived from `docs/domains/<dom>/design/<capability>/feature-grounding.md` markdown tables (per M-ADR 0143). As of schema 2.7.0, source: capability-spec is emitted by the canonical builder for rows derived from `## Feature Grounding (code-path trace)` tables in `docs/domains/<dom>/product/<capability>.md` capability spec markdown (per M-ADR 0145). Feature-grounding and capability-spec rows are both capability-owned: product_id is empty; capability_id resolves from the file path."
+      description: "feature-tree | feature-set | capability-spec | feature-spec | feature-grounding | structural-model. As of schema 6.0.0, source: structural-model is emitted for a feature only the structural model holds (M-ADR 0230 §4.3). NOTE: feature-tree-group source removed in 1.3.0 — groups are now first-class in feature_groups.csv. As of schema 2.2.0, source: feature-tree is emitted by the canonical builder for rows derived from feature-tree.md bullets. As of schema 2.5.0, source: feature-grounding is emitted for rows derived from `docs/domains/<dom>/design/<capability>/feature-grounding.md` markdown tables (per M-ADR 0143). As of schema 2.7.0, source: capability-spec is emitted by the canonical builder for rows derived from `## Feature Grounding (code-path trace)` tables in `docs/domains/<dom>/product/<capability>.md` capability spec markdown (per M-ADR 0145). Feature-grounding and capability-spec rows are both capability-owned: product_id is empty; capability_id resolves from the file path."
       source_of_truth: derived
     - name: runway
       type: string
@@ -1646,7 +1661,7 @@ catalogues:
     - name: kind
       type: string
       nullable: false
-      description: "Bound to feature_kind: feature (the default), obligation (M-ADR 0226, Proposed) or journey (M-ADR 0229 §4.2, Proposed), from the feature spec's **Kind:** line."
+      description: "Bound to feature_kind: feature (the default), obligation (M-ADR 0226, Proposed) or journey (M-ADR 0229 §4.2), from the feature spec's **Kind:** line."
     - name: source_sdd_id
       type: string
       nullable: true
@@ -1760,7 +1775,7 @@ catalogues:
     - name: id
       type: string
       nullable: false
-      description: "{domain}-{stem}-{kind} — the kind component joined the id at schema 3.0.0 (M-ADR 0203 §4.4), ending the kindless collision class where one service published as two contract families (openapi + proto) minted one id (measured cost: 1 row + 2 edges permanently unrepresentable, plus legitimate shared-contract citation flagged as divergence). Mechanical migration: new id = old id + '-' + kind; `sdd-cli catalogue migration-map` emits the pairs, and authored alias targets (M-ADR 0147) re-key automatically during the cut window."
+      description: "{domain}-{stem}-{kind} — the kind component joined the id at schema 3.0.0 (M-ADR 0203 §4.4), ending the kindless collision class where one service published as two contract families (openapi + proto) minted one id (measured cost: 1 row + 2 edges permanently unrepresentable, plus legitimate shared-contract citation flagged as divergence). Mechanical migration: new id = old id + '-' + kind; `sdd-cli catalogue migration-map` emits the pairs, and authored alias targets (M-ADR 0147) re-key automatically during the cut window. From schema 7.0.0 the stem is split at its CamelCase boundaries as an entity name is (`OrderPlaced` → `order-placed`), and references to the unsplit form re-key the same way, from id, kind and spec_path."
     - name: name
       type: string
       nullable: false
@@ -1946,7 +1961,7 @@ catalogues:
     - name: service_id
       type: string
       nullable: true
-      description: Matched by container name ↔ service name/repo where possible.
+      description: Matched to a service id by the container's diagram id or display-name slug, then by its display name through docs/platform/reference/service-name-aliases.yaml.
     - name: type
       type: string
       nullable: true
@@ -2211,7 +2226,7 @@ catalogues:
     - name: id
       type: string
       nullable: false
-      description: "Slugged PK: {domain_id}-{entitySlug(name)}. For manifest-sourced rows with domain=platform-wide, the leading domain segment is empty (`-{entitySlug(name)}`) and the row carries a [finding] convention."
+      description: "Slugged PK: {domain_id}-{entitySlug(name)}. A glossary-manifest entry with domain=platform-wide is the domain entity its slug names when exactly one does, and adds no row of its own; one naming none, or several, is kept as `_platform-wide-{entitySlug(name)}` with a finding. A superseded manifest entry is no entity: glossary_xref holds its supersedes edge."
     - name: name
       type: string
       nullable: false
@@ -2255,6 +2270,10 @@ catalogues:
       nullable: true
       description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
       source_of_truth: execution
+    - name: ppt_archetype
+      type: string
+      nullable: true
+      description: "The entity's Party-Place-Thing archetype (ppt_archetype). A structure fact: where the SDD has a structural model, the model holds it, and a change states it in its deltas. In an SDD without a model it is read from the capability specs' Entity Classification tables: the first archetype a row's archetype cell names, colour labels and qualifiers aside (Moment alone is moment-interval, PartyRole is role); a cell naming none, an entity no table row resolves to, and two tables disagreeing are reported. Added in schema 7.1.0 (M-ADR 0230)."
     description: "Data-model entity (a structural realisation of a concept inside a domain's data model). Distinct from glossary_items (vocabulary-level) and from domain_models (file-level). Added in schema 2.13.0 per M-ADR 0159. Forward source: `models[].entities[]` in glossary-alignment-manifest.yaml. Reverse source: `EntityName { ... }` declarations inside `erDiagram` fences in `docs/domains/{domain}/architecture/data-model.mermaid.md`. PK uses an entity-aware slug that normalises across UPPER_SNAKE and PascalCase authoring styles."
     foreign_keys:
     - column: domain_id
@@ -2268,6 +2287,7 @@ catalogues:
       nullable: true
     column_enums:
       persistence_kind: enums.persistence_kind
+      ppt_archetype: enums.ppt_archetype
   repo_capability:
     primary_key: id
     source_of_truth: derived
@@ -3933,7 +3953,7 @@ catalogues:
     - name: input_paths
       type: string
       nullable: true
-      description: "';'-separated paths of the review's other assessed inputs (its `inputs:` list, M-ADR 0230 §4.9, Proposed), beside target_path: a feature's UX evidence, say. Each is read at corpus_ref, so a later edit to any of them makes the score stale, as an edit to the target does. Added in schema 6.0.0."
+      description: "';'-separated paths of the review's other assessed inputs (its `inputs:` list, M-ADR 0230 §4.9), beside target_path: a feature's UX evidence, say. Each is read at corpus_ref, so a later edit to any of them makes the score stale, as an edit to the target does. Added in schema 6.0.0."
     - name: staleness_basis
       type: string
       nullable: false
@@ -4752,7 +4772,7 @@ catalogues:
       nullable: true
       description: The platform SDD the row belongs to (stamped at aggregation).
       source_of_truth: execution
-    description: "Edge: evidence about one revision of a requirement, in one repository that implements it (M-ADR 0230 §4.7, Proposed; replaces requirement_status in schema 6.0.0). Derived, never authored: observed from a baseline's **Observed in:** line, declared-shipped from an archived change's PASS verdict through its work orders' implements lists, each about the revision that change's delta states. An assertion is current while its revision is, and history once a later change moves the requirement, so evidence about one revision is never read as proof of another. An agreed change is not an assertion: it is an intended revision (requirement_revisions) and a change effect (change_effects). Per (revision, repository), the latest assertion wins."
+    description: "Edge: evidence about one revision of a requirement, in one repository that implements it (M-ADR 0230 §4.7; replaces requirement_status in schema 6.0.0). Derived, never authored: observed from a baseline's **Observed in:** line, declared-shipped from an archived change's PASS verdict through its work orders' implements lists, each about the revision that change's delta states. An assertion is current while its revision is, and history once a later change moves the requirement, so evidence about one revision is never read as proof of another. An agreed change is not an assertion: it is an intended revision (requirement_revisions) and a change effect (change_effects). Per (revision, repository), the latest assertion wins."
     natural_key:
     - revision_id
     - repo_id
@@ -4904,7 +4924,7 @@ catalogues:
       nullable: true
       description: The platform SDD the row belongs to (stamped at aggregation).
       source_of_truth: execution
-    description: "Edge: a requirement a user journey cites for one of its steps (M-ADR 0229 §4.4, Proposed). Derived, never authored: from the @req tags in the journey's end-to-end test file, or from the citations in its journey feature's living spec. A journey with no row is untraced."
+    description: "Edge: a requirement a user journey cites for one of its steps (M-ADR 0229 §4.4). Derived, never authored: from the @req tags in the journey's end-to-end test file, or from the citations in its journey feature's living spec. A journey with no row is untraced."
     foreign_keys:
     - column: journey_id
       references: user_journeys.id
@@ -4955,7 +4975,7 @@ catalogues:
       nullable: true
       description: The platform SDD the row belongs to (stamped at aggregation).
       source_of_truth: execution
-    description: "An attribute of a domain-model entity, an element of its own (M-ADR 0230 §4.3, Proposed): adding a field to an entity adds an attribute and does not modify the entity. Built from the domain model: a Mermaid ER diagram's attribute lines, or a TypeQL entity's owned attributes. Authored in the structural model (openspec/structure/) where an SDD has one. Added in schema 5.1.0; built from domain models since 6.0.0."
+    description: "An attribute of a domain-model entity, an element of its own (M-ADR 0230 §4.3): adding a field to an entity adds an attribute and does not modify the entity. Built from the domain model: a Mermaid ER diagram's attribute lines, or a TypeQL entity's owned attributes. Authored in the structural model (openspec/structure/) where an SDD has one. Added in schema 5.1.0; built from domain models since 6.0.0."
     natural_key:
     - entity_id
     - name
@@ -5012,7 +5032,7 @@ catalogues:
       nullable: true
       description: The platform SDD the row belongs to (stamped at aggregation).
       source_of_truth: execution
-    description: "A named relationship from one domain-model entity to another, an element of its own (M-ADR 0230 §4.3, Proposed). Built from the domain model: a Mermaid ER diagram's relationship lines, or a TypeQL binary relation, with each end's cardinality and role. Authored in the structural model (openspec/structure/) where an SDD has one. Added in schema 5.1.0; built from domain models since 6.0.0, when one cardinality became two, one per end."
+    description: "A named relationship from one domain-model entity to another, an element of its own (M-ADR 0230 §4.3). Built from the domain model: a Mermaid ER diagram's relationship lines, or a TypeQL binary relation, with each end's cardinality and role. Authored in the structural model (openspec/structure/) where an SDD has one. Added in schema 5.1.0; built from domain models since 6.0.0, when one cardinality became two, one per end."
     natural_key:
     - from_entity_id
     - to_entity_id
@@ -5065,7 +5085,7 @@ catalogues:
       nullable: true
       description: The platform SDD the row belongs to (stamped at aggregation).
       source_of_truth: execution
-    description: "A domain invariant, a typed element of the domain model (M-ADR 0230 §4.3, Proposed): a rule the entity's data always satisfies. It is structure, not intent, wherever it is first written. Built from the domain model's keys: a primary key (PK, or a TypeQL @key) or a unique key (UK) is a unique invariant over its attributes, and a TypeQL role's @card is a cardinality invariant on its relationship. Authored in the structural model (openspec/structure/) where an SDD has one, which can state every kind. Added in schema 5.1.0; built from domain models since 6.0.0."
+    description: "A domain invariant, a typed element of the domain model (M-ADR 0230 §4.3): a rule the entity's data always satisfies. It is structure, not intent, wherever it is first written. Built from the domain model's keys: a primary key (PK, or a TypeQL @key) or a unique key (UK) is a unique invariant over its attributes, and a TypeQL role's @card is a cardinality invariant on its relationship. Authored in the structural model (openspec/structure/) where an SDD has one, which can state every kind. Added in schema 5.1.0; built from domain models since 6.0.0."
     foreign_keys:
     - column: entity_id
       references: entities.id
@@ -5111,7 +5131,7 @@ catalogues:
       nullable: true
       description: The platform SDD the row belongs to (stamped at aggregation).
       source_of_truth: execution
-    description: "One row per distinct text of a requirement (M-ADR 0230 §4.7, Proposed; schema 6.0.0). Derived from the behaviour store: the living spec's text is current; an agreed open change's ADDED or MODIFIED block is intended; an archived change's block the living spec no longer holds is history. A revision is identified by its digest, so the same text is one revision wherever it appears."
+    description: "One row per distinct text of a requirement (M-ADR 0230 §4.7; schema 6.0.0). Derived from the behaviour store: the living spec's text is current; an agreed open change's ADDED or MODIFIED block is intended; an archived change's block the living spec no longer holds is history. A revision is identified by its digest, so the same text is one revision wherever it appears."
     foreign_keys:
     - column: requirement_id
       references: requirements.id
@@ -5160,7 +5180,7 @@ catalogues:
       type: string
       nullable: true
       description: The platform SDD the row belongs to (stamped at aggregation).
-    description: "One row per element a change writes (M-ADR 0230 §4.7, Proposed; schema 6.0.0): a requirement from its behaviour deltas, a structural element from its structural deltas (an archived change's from its effect record, structure/applied.yaml). Base and target are the revisions it moves the element between; a requirement's are revision ids (<requirement>@<12 hex digits of its digest>), catalogued in requirement_revisions except the target of a change not yet agreed; a structural element's are sha256 digests."
+    description: "One row per element a change writes (M-ADR 0230 §4.7; schema 6.0.0): a requirement from its behaviour deltas, a structural element from its structural deltas (an archived change's from its effect record, structure/applied.yaml). Base and target are the revisions it moves the element between; a requirement's are revision ids (<requirement>@<12 hex digits of its digest>), catalogued in requirement_revisions except the target of a change not yet agreed; a structural element's are sha256 digests."
     natural_key:
     - change_id
     - element_kind
@@ -5196,7 +5216,7 @@ catalogues:
     - name: sunset_date
       type: string
       nullable: true
-      description: "For a deprecated revision, the date it is retired. Not yet populated: the builder does not yet read a version's sunset date (BASELINE.md's optional sunset_date)."
+      description: "For a deprecated revision, the date it is retired: the sunset an archived change's agreement record states for the version (contracts[].deprecates.sunset, agreement-record schema 1.3.0). Empty for a version deprecated only in BASELINE.md, whose sunset is not read."
     - name: change_id
       type: string
       nullable: true
@@ -5212,7 +5232,7 @@ catalogues:
       nullable: true
       description: The platform SDD the row belongs to (stamped at aggregation).
       source_of_truth: execution
-    description: A contract version's content revisions, each identified by its content digest (M-ADR 0230 §4.2, Proposed; schema 6.0.0). The contract file's current content is active (deprecated where the contract is); a revision an agreed open change pins as the one it agrees (agreement record 1.2.0, contracts[].agrees) is agreed; one an archived change agreed that the file no longer holds is retired. A compatible amendment is a new revision at the same path, so an agreed revision and the active one coexist, both checked. Active is a claim about the published specification, not about deployment.
+    description: A contract version's content revisions, each identified by its content digest (M-ADR 0230 §4.2; schema 6.0.0). The contract file's current content is active (deprecated where the contract is); a revision an agreed open change pins as the one it agrees (agreement record 1.2.0, contracts[].agrees) is agreed; one an archived change agreed that the file no longer holds is retired. A compatible amendment is a new revision at the same path, so an agreed revision and the active one coexist, both checked. Active is a claim about the published specification, not about deployment.
     foreign_keys:
     - column: contract_id
       references: contracts.id

package/dist/lib/catalogue/manifest-loader.js

@@ -218,7 +218,7 @@ const ManifestSchema = z.object({
     // Shared-library trait (sdd-manifest-schema 1.12.0, M-ADR 0217 §4.4). Profile-agnostic,
     // like `exemplar`; absent is the unmarked norm, no finding.
     shared_library: z.boolean().optional(),
-    // Where this estate's journey behaviour is mastered (sdd-manifest-schema 1.13.0, M-ADR 0229 §4.2, Proposed).
+    // Where this estate's journey behaviour is mastered (sdd-manifest-schema 1.13.0, M-ADR 0229 §4.2).
     // `master` is declared at the root, and journey-impact treats a member naming its platform as inheriting it.
     // `test_paths` is never inherited: it is relative to this SDD, so an SDD that holds end-to-end files declares
     // its own block, with the master and its paths. Unknown values fail at load.

package/dist/lib/catalogue/rubric-coverage-map.yaml

@@ -954,7 +954,7 @@ coverage:
   entity_attributes:
     kind: entity
     scoring: scored-at-source
-    instrument: an element of the structural model (M-ADR 0230, Proposed); scored with its domain model by rubrics/domain-architecture-rubric.md
+    instrument: an element of the structural model (M-ADR 0230); scored with its domain model by rubrics/domain-architecture-rubric.md
     relationships:
       entity_id:
         class: membership
@@ -962,7 +962,7 @@ coverage:
   entity_relationships:
     kind: entity
     scoring: scored-at-source
-    instrument: an element of the structural model (M-ADR 0230, Proposed); scored with its domain model by rubrics/domain-architecture-rubric.md
+    instrument: an element of the structural model (M-ADR 0230); scored with its domain model by rubrics/domain-architecture-rubric.md
     relationships:
       from_entity_id:
         class: membership
@@ -973,7 +973,7 @@ coverage:
   domain_invariants:
     kind: entity
     scoring: scored-at-source
-    instrument: an element of the structural model (M-ADR 0230, Proposed); scored with its domain model by rubrics/domain-architecture-rubric.md
+    instrument: an element of the structural model (M-ADR 0230); scored with its domain model by rubrics/domain-architecture-rubric.md
     relationships:
       entity_id:
         class: membership
@@ -1039,3 +1039,7 @@ coverage:
     kind: enum
     scoring: not-applicable
     reason: closed vocabulary, not an artefact
+  ppt_archetype:
+    kind: enum
+    scoring: not-applicable
+    reason: closed vocabulary, not an artefact

package/dist/lib/catalogue/schema-compat.js

@@ -27,7 +27,7 @@
  * M-ADR 0134 §4.6 (canonical builder + aggregator).
  */
 export const SCHEMA_COMPAT = {
-    catalogue_schema: "^6.0.0",
+    catalogue_schema: "^7.0.0",
     sdd_manifest: "^1.0.0",
     aggregation_manifest: "^1.0.0",
 };

package/dist/lib/catalogue/staleness-verdicts.js

@@ -40,7 +40,7 @@
 //   none — already reported by scores-coverage as unknown currency; not
 //       re-reported here.
 //
-// ASSESSED INPUTS (M-ADR 0230 §4.9, Proposed): a review that names its other inputs (`input_paths`) is read with
+// ASSESSED INPUTS (M-ADR 0230 §4.9): a review that names its other inputs (`input_paths`) is read with
 //   each of them, once its target is current. An input that moved stales the score, with the input named. So does an
 //   input gone from HEAD, and one the corpus did not hold at the anchor: unlike a missing target, the score can still
 //   be re-reviewed against its target, and a review cannot have read an input that was not there, so both prescribe a
@@ -171,7 +171,7 @@ export async function runStalenessVerdicts(session, options) {
         };
     }
     const asStr = (v) => v === null || v === undefined ? "" : String(v).trim();
-    // input_paths (schema 6.0.0, M-ADR 0230 §4.9, Proposed): a catalogue built before it has no such column, and its
+    // input_paths (schema 6.0.0, M-ADR 0230 §4.9): a catalogue built before it has no such column, and its
     // scores are read as naming no other input.
     const query = (inputs) => `SELECT rubric_id, target_ref, target_path, corpus_ref, scored_at, staleness_basis, ${inputs}
      FROM "quality_scores"
@@ -191,7 +191,7 @@ export async function runStalenessVerdicts(session, options) {
         const rubricId = asStr(rubricIdRaw);
         const targetRef = asStr(targetRefRaw);
         const basis = asStr(basisRaw);
-        // The review's other assessed inputs (M-ADR 0230 §4.9, Proposed): read with the target, so an edit to any of
+        // The review's other assessed inputs (M-ADR 0230 §4.9): read with the target, so an edit to any of
         // them makes the score stale as an edit to the target does.
         const inputs = asStr(inputPathsRaw).split(";").map((x) => x.trim()).filter((x) => x !== "");
         // Counted for BOTH bases, before the branch. The first cut of this counter

package/dist/lib/structure/catalogue.js

@@ -1,13 +1,15 @@
-// The catalogue from the structural model, and the model a built catalogue implies (M-ADR 0230 §4.3, §5.3,
-// Proposed). Where an SDD has a model, it is the record of structure, so every structure catalogue is built from it whole:
+// The catalogue from the structural model, and the model a built catalogue implies (M-ADR 0230 §4.3, §5.3).
+// Where an SDD has a model, it is the record of structure, so every structure catalogue is built from it whole:
 //   a row per element of the current view, with the model's structure columns;
 //   its other columns (every class but structure: derived, declaration, evidence, intent, execution) from the
 //   source-built row with the same id;
 //   for an element only the model holds, the derived columns the model itself settles (MODEL_DERIVED).
 // What the sources hold and the model does not, and a structure column where they disagree, is reported once per
-// catalogue. The model wins: either finding means the sources moved outside a change. Pure: no file is read or written.
+// catalogue. The model wins: either finding means the sources moved outside a change. A source row that states an
+// element as an agreed open change adds or modifies it is that change's intended element, not a disagreement: it is
+// listed apart, and catalogued once the change archives. Pure: no file is read or written.
 import { stringify } from "yaml";
-import { FORMAT_VERSION } from "./model.js";
+import { elementKey, FORMAT_VERSION } from "./model.js";
 import { STRUCTURE } from "./view.js";
 /** The view each generated file renders, for a derived path column of an element only the model holds. */
 export const VIEW_PATHS = {
@@ -44,8 +46,10 @@ function sample(ids) {
 /**
  * Replace every structure catalogue's rows with the view's. Rows of other catalogues are returned as they are. Source
  * rows sharing an id are merged first, later values filling earlier gaps, as the keyed-table dedupe would.
+ * `intended` holds the elements agreed open changes add or modify (intendedWrites); a source row agreeing with one is
+ * pushed to `intendedOut` as `<key> (<change>)` instead of being reported.
  */
-export function overlayModel(schema, view, rows, findings) {
+export function overlayModel(schema, view, rows, findings, intended = new Map(), intendedOut = []) {
     const out = new Map(rows);
     for (const cat of schema.catalogues) {
         if (cat.sourceOfTruth !== STRUCTURE)
@@ -66,6 +70,20 @@ export function overlayModel(schema, view, rows, findings) {
         const elements = view.get(cat.name) ?? new Map();
         const built = [];
         const differ = [];
+        const disagree = (from, e) => structural.filter((c) => cell(from[c]) !== "" && cell(from[c]) !== cell(e.columns[c]));
+        // The source row states the element as an agreed open change does; one stating it otherwise is reported as such.
+        const differIntended = [];
+        const asIntended = (id, from) => {
+            const w = intended.get(elementKey(cat.name, id));
+            if (w === undefined)
+                return false;
+            const cols = disagree(from, w.element);
+            if (cols.length > 0)
+                differIntended.push(`${id} (${cols.join(", ")}; ${w.change})`);
+            else
+                intendedOut.push(`${elementKey(cat.name, id)} (${w.change})`);
+            return true;
+        };
         for (const e of elements.values()) {
             const from = source.get(e.id);
             const row = {};
@@ -73,8 +91,8 @@ export function overlayModel(schema, view, rows, findings) {
                 for (const [k, v] of Object.entries(from))
                     if (!structural.includes(k))
                         row[k] = v;
-                const cols = structural.filter((c) => cell(from[c]) !== "" && cell(from[c]) !== cell(e.columns[c]));
-                if (cols.length > 0)
+                const cols = disagree(from, e);
+                if (cols.length > 0 && !asIntended(e.id, from))
                     differ.push(`${e.id} (${cols.join(", ")})`);
             }
             else {
@@ -85,12 +103,15 @@ export function overlayModel(schema, view, rows, findings) {
                 row[c] = e.columns[c];
             built.push(row);
         }
-        const missing = [...source.keys()].filter((id) => id !== "" && !elements.has(id)).sort();
+        const missing = [...source.keys()].filter((id) => id !== "" && !elements.has(id) && !asIntended(id, source.get(id))).sort();
         if (missing.length > 0) {
-            findings.add("divergence", `${cat.name}: the sources hold ${missing.length} row(s) the structural model does not (${sample(missing)}); the model is the record of structure, so they are not catalogued. Add them through a change's structural deltas, or remove them from the sources (M-ADR 0230 §4.3, Proposed)`, "warn", `catalogue:${cat.name}`);
+            findings.add("divergence", `${cat.name}: the sources hold ${missing.length} row(s) the structural model does not (${sample(missing)}); the model is the record of structure, so they are not catalogued. Add them through a change's structural deltas, or remove them from the sources (M-ADR 0230 §4.3)`, "warn", `catalogue:${cat.name}`);
+        }
+        if (differIntended.length > 0) {
+            findings.add("divergence", `${cat.name}: ${differIntended.length} source row(s) state an element an agreed open change adds or modifies, and disagree with it: ${sample(differIntended.sort())}. The change's delta is what archives; bring the source into line with it, or the delta with the source (M-ADR 0230 §4.3, §4.7)`, "warn", `catalogue:${cat.name}`);
         }
         if (differ.length > 0) {
-            findings.add("divergence", `${cat.name}: ${differ.length} element(s) where the sources and the structural model disagree, catalogued as the model states them: ${sample(differ.sort())}. A source that is a generated view is rendered again; any other is brought into line through a change (M-ADR 0230 §4.3, Proposed)`, "warn", `catalogue:${cat.name}`);
+            findings.add("divergence", `${cat.name}: ${differ.length} element(s) where the sources and the structural model disagree, catalogued as the model states them: ${sample(differ.sort())}. A source that is a generated view is rendered again; any other is brought into line through a change (M-ADR 0230 §4.3)`, "warn", `catalogue:${cat.name}`);
         }
         out.set(cat.name, built);
     }

package/dist/lib/structure/compose.js

@@ -1,4 +1,4 @@
-// Views over the structural model, and how changes compose (M-ADR 0230 §4.5, §4.7, Proposed).
+// Views over the structural model, and how changes compose (M-ADR 0230 §4.5, §4.7).
 //   current       the model as published
 //   at a change   current with that change's deltas and those of its dependency closure, dependencies first
 //   intended      current with every agreed change's deltas

package/dist/lib/structure/intended.js

@@ -0,0 +1,194 @@
+// What an open change adds, for the references its own content makes (M-ADR 0230 §4.7, §4.11 proof 3).
+// A reference made by an open change resolves against the current view plus that change's additions: the elements its
+// structural deltas ADD, those of the changes in its depends_on closure, and the contracts its agreement record agrees
+// as new files. A reference made by anything else resolves against the current view only, so a current reference that
+// resolves only against an addition is still refused.
+// What ties content to a change is never the reference being resolved:
+//   a model element                        the change's own delta (validateDeltas, viewAt)
+//   a source-built row with a change_id    that change
+//   a contract row                         the change whose record agrees its file as new
+//   a row naming such a contract           that change
+// Pure but for reading agreement records.
+import { readdir, readFile } from "node:fs/promises";
+import { join } from "node:path";
+import { parseDocument } from "yaml";
+import { closure } from "./compose.js";
+import { elementKey, loadChangeStructure } from "./model.js";
+export const CONTRACTS = "contracts";
+const LIFECYCLES = ["proposed", "agreed", "withdrawn", "superseded"];
+/** The change's agreement record (docs/agreements/<change>.yaml): its status, or `unrecorded`, and its new contract files. */
+export async function readAgreement(repo, change) {
+    let text;
+    try {
+        text = await readFile(join(repo, "docs", "agreements", `${change}.yaml`), "utf8");
+    }
+    catch {
+        return { status: "unrecorded", newContracts: [] };
+    }
+    let record;
+    try {
+        record = parseDocument(text).toJS()?.agreement_record;
+    }
+    catch {
+        return { status: "unrecorded", newContracts: [] };
+    }
+    const status = LIFECYCLES.find((s) => s === String(record?.["status"] ?? "")) ?? "unrecorded";
+    const newContracts = [];
+    const entries = Array.isArray(record?.["contracts"]) ? record["contracts"] : [];
+    for (const raw of entries) {
+        if (raw === null || typeof raw !== "object")
+            continue;
+        const e = raw;
+        if (e["amended_by_this_change"] !== true)
+            continue;
+        const files = Array.isArray(e["files"]) ? e["files"].map(String) : e["file"] !== undefined ? [String(e["file"])] : [];
+        // agreement-record schema 1.2.0 and later: a file the change relies on carries relies_on, so an agreed file
+        // without one is new (1.3.0 states it). An entry with no agrees predates the digests and says nothing either way.
+        const digest = (field, f) => {
+            const v = e[field];
+            return v !== null && typeof v === "object" ? String(v[f] ?? "") : String(v ?? "");
+        };
+        for (const f of files)
+            if (digest("agrees", f) !== "" && digest("relies_on", f) === "")
+                newContracts.push(`${String(e["repo"] ?? "")}/${f}`);
+    }
+    return { status, newContracts };
+}
+/** The open changes (openspec/changes/<change>, not archive/), with their agreement records. */
+export async function loadOpenChanges(repo, problems) {
+    let names;
+    try {
+        names = (await readdir(join(repo, "openspec", "changes"), { withFileTypes: true }))
+            .filter((e) => e.isDirectory() && e.name !== "archive")
+            .map((e) => e.name)
+            .sort();
+    }
+    catch {
+        names = [];
+    }
+    const open = new Map();
+    const newContracts = new Map();
+    for (const name of names) {
+        const agreement = await readAgreement(repo, name);
+        open.set(name, { structure: await loadChangeStructure(repo, name, problems), status: agreement.status });
+        newContracts.set(name, agreement.newContracts);
+    }
+    return { open, newContracts };
+}
+const cell = (v) => (v === null || v === undefined ? "" : String(v));
+/**
+ * Each open change's additions, and the change that adds each. A contract is identified by its built row: the row
+ * whose spec_path is `<repo>/<file>` as the record names it. A new contract with no built row adds nothing, and a
+ * reference to it stays unresolved.
+ */
+export class Additions {
+    open;
+    own = new Map();
+    adder = new Map();
+    constructor(open, newContracts, contractRows) {
+        this.open = open;
+        const idByPath = new Map();
+        for (const r of contractRows)
+            if (cell(r["spec_path"]) !== "")
+                idByPath.set(cell(r["spec_path"]), cell(r["id"]));
+        for (const [name, oc] of open) {
+            const keys = new Set();
+            for (const d of oc.structure.deltas)
+                for (const e of d.added)
+                    keys.add(elementKey(e.catalogue, e.id));
+            for (const p of newContracts.get(name) ?? []) {
+                const id = idByPath.get(p);
+                if (id !== undefined && id !== "")
+                    keys.add(elementKey(CONTRACTS, id));
+            }
+            this.own.set(name, keys);
+            for (const k of keys)
+                if (!this.adder.has(k))
+                    this.adder.set(k, name);
+        }
+    }
+    /** The open change that adds the element or contract, if one does. */
+    addedBy(catalogue, id) {
+        return this.adder.get(elementKey(catalogue, id));
+    }
+    /** Whether the element or contract is the change's own addition or one of its dependency closure's. */
+    within(change, catalogue, id) {
+        const key = elementKey(catalogue, id);
+        return closure(change, this.open).some((c) => this.own.get(c)?.has(key) ?? false);
+    }
+    /** The contracts the given changes add. */
+    contracts(changes) {
+        const out = new Set();
+        for (const c of changes)
+            for (const k of this.own.get(c) ?? [])
+                if (k.startsWith(`${CONTRACTS}/`))
+                    out.add(k.slice(CONTRACTS.length + 1));
+        return out;
+    }
+    /** The open changes a source-built row belongs to: its change_id, or a new contract it is or names. */
+    ownersOf(schema, catalogue, row, sddId) {
+        const out = new Set();
+        const changeId = cell(row["change_id"]);
+        if (changeId !== "") {
+            const name = changeId.startsWith(`${sddId}::`) ? changeId.slice(sddId.length + 2) : changeId;
+            if (this.open.has(name))
+                out.add(name);
+        }
+        const contractOwner = (id) => {
+            const by = this.adder.get(elementKey(CONTRACTS, id));
+            if (by !== undefined)
+                out.add(by);
+        };
+        const cat = schema.catalogues.find((c) => c.name === catalogue);
+        if (catalogue === CONTRACTS && cat)
+            contractOwner(cell(row[cat.primaryKey]));
+        for (const fk of cat?.foreignKeys ?? [])
+            if (fk.references === `${CONTRACTS}.id` && cell(row[fk.column]) !== "")
+                contractOwner(cell(row[fk.column]));
+        return [...out].sort();
+    }
+}
+/**
+ * Sort a build's dangling references: a row an open change owns, naming that change's addition, resolves in that
+ * change's view. Every other stays dangling, including a row nothing ties to the change that adds its target.
+ */
+export function splitDangling(schema, rowsByCatalogue, failures, additions, sddId) {
+    const intended = [];
+    const dangling = [];
+    const index = new Map();
+    const rowOf = (catalogue, pk) => {
+        let byPk = index.get(catalogue);
+        if (!byPk) {
+            const key = schema.catalogues.find((c) => c.name === catalogue)?.primaryKey ?? "id";
+            byPk = new Map((rowsByCatalogue.get(catalogue) ?? []).map((r) => [cell(r[key]), r]));
+            index.set(catalogue, byPk);
+        }
+        return byPk.get(pk);
+    };
+    for (const f of failures) {
+        const [target, column] = f.target.split(".");
+        const targetPk = schema.catalogues.find((c) => c.name === target)?.primaryKey;
+        const row = rowOf(f.catalogue, f.referencingRow);
+        const owner = f.value === "" || column !== targetPk || row === undefined
+            ? undefined
+            : additions.ownersOf(schema, f.catalogue, row, sddId).find((c) => additions.within(c, target, f.value));
+        if (owner !== undefined)
+            intended.push({ failure: f, change: owner });
+        else {
+            const by = f.value === "" ? undefined : additions.addedBy(target, f.value);
+            dangling.push(by === undefined ? { failure: f } : { failure: f, addedBy: by });
+        }
+    }
+    return { intended, dangling };
+}
+/** Element key -> the agreed change that adds or modifies it, and the element as that change states it. */
+export function intendedWrites(open, agreed) {
+    const out = new Map();
+    for (const c of agreed) {
+        for (const d of open.get(c)?.structure.deltas ?? [])
+            for (const e of [...d.added, ...d.modified])
+                out.set(elementKey(e.catalogue, e.id), { change: c, element: e });
+    }
+    return out;
+}
+//# sourceMappingURL=intended.js.map

package/dist/lib/structure/model.js

@@ -1,4 +1,4 @@
-// The structural model and a change's structural deltas (M-ADR 0230 §4.3, §4.4, Proposed). Pure reads, so the
+// The structural model and a change's structural deltas (M-ADR 0230 §4.3, §4.4). Pure reads, so the
 // verify-only CLI can carry them. The format is docs/method/methods/guides/structural-model-format.md:
 //   openspec/structure/<partition>.yaml                    the model, one file per partition
 //   openspec/changes/<change>/structure/<partition>.yaml   a change's delta for that partition

package/dist/lib/structure/render.js

@@ -1,4 +1,4 @@
-// The generated views of the structural model (M-ADR 0230 §4.3, Proposed): projections, never edited. Each file is
+// The generated views of the structural model (M-ADR 0230 §4.3): projections, never edited. Each file is
 // rendered from the current view alone, in id order, so the same model renders the same bytes. Its first line names
 // the generator and the digest of the body below it, which tells three states apart:
 //   missing      the file is absent

package/dist/lib/structure/view.js

@@ -121,7 +121,12 @@ function naturalKey(cat, e) {
  * catalogue of another class, against its built rows), no cycle through a self-reference, natural keys unique, and
  * domain invariants naming their entity's own attributes and relationships.
  */
-export function validateView(schema, view, built, problems, unresolved) {
+export function validateView(schema, view, built, problems, unresolved, addedBy = () => undefined) {
+    // A reference to an open change's addition, from outside that change and its dependants (§4.11 proof 3).
+    const outside = (catalogue, id) => {
+        const by = addedBy(catalogue, id);
+        return by === undefined ? "" : `; open change ${by} adds it, and only that change and those depending on it can name it`;
+    };
     for (const [catalogue, byId] of view) {
         const cat = catalogueOf(schema, catalogue);
         for (const e of byId.values()) {
@@ -133,14 +138,14 @@ export function validateView(schema, view, built, problems, unresolved) {
             for (const r of referencesOf(schema, e)) {
                 if (r.structural) {
                     if (!find(view, r.catalogue, r.targetColumn, r.value))
-                        problems.push(`${e.file}: ${elementKey(catalogue, e.id)}: ${r.column} ${JSON.stringify(r.value)} names no ${r.catalogue} element in this view (${elementKey(r.catalogue, r.value)})`);
+                        problems.push(`${e.file}: ${elementKey(catalogue, e.id)}: ${r.column} ${JSON.stringify(r.value)} names no ${r.catalogue} element in this view (${elementKey(r.catalogue, r.value)})${r.targetColumn === "id" ? outside(r.catalogue, r.value) : ""}`);
                 }
                 else {
                     const rows = built(r.catalogue, r.targetColumn);
                     if (rows === null)
                         unresolved.add(r.catalogue);
                     else if (!rows.has(r.value))
-                        problems.push(`${e.file}: ${elementKey(catalogue, e.id)}: ${r.column} ${JSON.stringify(r.value)} names no row of ${r.catalogue} as built`);
+                        problems.push(`${e.file}: ${elementKey(catalogue, e.id)}: ${r.column} ${JSON.stringify(r.value)} names no row of ${r.catalogue} as built${outside(r.catalogue, r.value)}`);
                 }
             }
         }

package/dist/lib/validate/agreement-evidence.js

@@ -3,7 +3,7 @@
 //
 //   agreed content   the change's proposal, deltas, Gate 0, design, tasks (checkboxes ignored), the test plan's
 //                    scenario-to-test rows (its Before and After cells ignored) and its structural deltas with their
-//                    base revisions (M-ADR 0230 §4.4, Proposed; report only until it is accepted) are what was approved. Each is compared
+//                    base revisions (M-ADR 0230 §4.4; report only until it is accepted) are what was approved. Each is compared
 //                    with its state at the record's pinned commit: the latest amendment's commit, else sdd.commit.
 //   requirement      a requirement's block in a spec: its heading to the next requirement or section heading. The
 //                    stale check compares the blocks a change targets, not the whole file.
@@ -16,7 +16,7 @@ export function boundFile(rel) {
     return /^(proposal|design|gate-0|tasks|test-plan)\.md$/.test(rel) || /^specs\/.+\/spec\.md$/.test(rel) || structuralFile(rel);
 }
 /**
- * A change's structural artifact (M-ADR 0230 §4.4, Proposed): a partition delta or the no-op claim, both agreed
+ * A change's structural artifact (M-ADR 0230 §4.4): a partition delta or the no-op claim, both agreed
  * content, so a delta's base revisions are pinned with it. The effect record (structure/applied.yaml) is written by
  * the archive, after agreement, and is not.
  */

package/dist/lib/validate/behaviour-store.js

@@ -16,10 +16,12 @@
 //                 check is vacuous, and says so.
 //      agreed content: the change's proposal, deltas, Gate 0, design, tasks (checkboxes ignored), test
 //                 plan (its execution results ignored) and structural deltas equal their state at that commit
-//                 (M-ADR 0222 §4.6; a structural delta's change is a [WARN] while M-ADR 0230 is Proposed).
+//                 (M-ADR 0222 §4.6; a structural delta's change fails like the rest, a [WARN] only with ENFORCED false).
 //      kinds:    on a record held to 1.1.0, each test-plan row's Kind (changed or carried) is the one computed
-//                 from the deltas and the living spec, a row naming no scenario of the deltas fails, and a
-//                 filled Before is a fail for changed and a pass for carried (M-ADR 0223 §4.4).
+//                 from the deltas and the living spec, or repaired (declared, on a carried scenario); a row
+//                 naming no scenario of the deltas fails; and a filled Before, read as whole-word results, is a
+//                 fail for changed, a pass for carried, and a fail citing the test double's correcting commit
+//                 for repaired (M-ADR 0223 §4.4).
 //   4. verdicts: every archived change except a baseline has a verdict.md whose verdict line agrees with
 //                 its record's PASS (M-ADR 0223 §4.6). A record held to 1.1.0 (by its own history, or by the
 //                 schema the SDD shipped when the change archived) also needs: an agreed record; archived
@@ -186,6 +188,16 @@ export function parseAgreementRecord(file, text) {
                     noLongerImplements.push({ repo: e.repo, requirement: e.requirement });
             }
     }
+    // Record 1.3.0 (M-ADR 0230 §4.2): a contracts entry may deprecate its version, stating the sunset. A
+    // deprecation that names no date states no runway, so it is refused rather than read as a deprecation without one.
+    for (const [i, x] of (Array.isArray(r.contracts) ? r.contracts : []).entries()) {
+        const d = x?.deprecates;
+        if (d === undefined)
+            continue;
+        const sunset = d?.sunset;
+        if (typeof sunset !== "string" || !isCalendarDate(sunset))
+            problems.push(`${file}: contracts[${i}].deprecates must be {sunset: YYYY-MM-DD}, a calendar date as a string; found ${JSON.stringify(d)}`);
+    }
     if (problems.length > 0)
         return { problems };
     return {
@@ -205,6 +217,13 @@ export function parseAgreementRecord(file, text) {
         problems,
     };
 }
+/** A YYYY-MM-DD string naming a day that exists. */
+function isCalendarDate(s) {
+    if (!/^\d{4}-\d{2}-\d{2}$/.test(s))
+        return false;
+    const t = new Date(`${s}T00:00:00Z`);
+    return !Number.isNaN(t.getTime()) && t.toISOString().slice(0, 10) === s;
+}
 /** Every pinned commit in a record: any key named `commit` or ending `_commit`, and each value under verdict.merged and current. */
 function commitFields(r) {
     const out = [];
@@ -489,7 +508,7 @@ export async function checkBehaviourStore(repo, options = {}) {
                         if (a === null || b === null || normaliseBound(f, a) !== normaliseBound(f, b)) {
                             const what = `${dir}: AGREED CONTENT CHANGED: ${f} ${a === null ? "was added" : b === null ? "was removed" : "differs"} since ${base}, with no amendment recording a commit and an approver; amend the agreement or renew it (M-ADR 0222 §4.6)`;
                             if (structuralFile(f) && !STRUCTURE_ENFORCED)
-                                warnings.push(`${what}; a structural delta, report only while M-ADR 0230 is Proposed`);
+                                warnings.push(`${what}; a structural delta, reported only because ENFORCED is off`);
                             else
                                 failures.push(what);
                         }
@@ -497,14 +516,14 @@ export async function checkBehaviourStore(repo, options = {}) {
                 }
             }
         }
-        // A test plan's kinds (M-ADR 0223 §4.4 as amended): changed scenarios go red then green, carried ones stay green.
+        // A test plan's kinds (M-ADR 0223 §4.4 as amended): changed and repaired scenarios go red then green, carried ones stay green.
         if (versionAtLeast(record?.schemaVersion, "1.1.0") && record?.status === "agreed") {
             const plan = await readText(join(repo, dir, "test-plan.md"));
             if (plan !== null) {
                 const header = testPlanHeader(plan);
                 const col = (name) => header.indexOf(name);
                 if (col("kind") < 0)
-                    failures.push(`${dir}/test-plan.md: the scenario table has no Kind column (changed | carried)`);
+                    failures.push(`${dir}/test-plan.md: the scenario table has no Kind column (changed | carried | repaired)`);
                 else {
                     for (const row of testPlanMapping(plan)) {
                         const cell = row[col("requirement")] ?? "";
@@ -533,13 +552,31 @@ export async function checkBehaviourStore(repo, options = {}) {
                             continue;
                         }
                         kindsChecked++;
-                        if (kind !== expected)
+                        // `repaired` is declared, never computed: a carried scenario whose earlier pass was false-green.
+                        const repaired = kind === "repaired";
+                        if (repaired && expected === "changed")
+                            failures.push(`${dir}/test-plan.md: "${req}" / "${scen}" is changed against the living spec, so it cannot be repaired: repaired is a scenario carried as the living spec states it, whose code did not meet it`);
+                        else if (!repaired && kind !== expected)
                             failures.push(`${dir}/test-plan.md: "${req}" / "${scen}" is ${expected} against the living spec, and the plan says ${JSON.stringify(kind)}`);
                         const before = col("before") >= 0 ? (row[col("before")] ?? "") : "";
-                        if (before !== "" && expected === "changed" && !/fail|red/i.test(before))
-                            failures.push(`${dir}/test-plan.md: "${req}" / "${scen}" is changed, so its test fails before the code; the scenario table's Before cell says ${JSON.stringify(before)}`);
-                        if (before !== "" && expected === "carried" && !/pass|green/i.test(before))
-                            failures.push(`${dir}/test-plan.md: "${req}" / "${scen}" is carried, so its test passes before the code as regression; the scenario table's Before cell says ${JSON.stringify(before)}`);
+                        if (before !== "") {
+                            // The cell's results, as whole words: "PASS at x; FAIL at y" holds both, and "setup required" or "bypass" holds neither.
+                            const pass = /\b(?:pass(?:es|ed)?|green)\b/i.test(before);
+                            const fail = /\b(?:fail(?:s|ed)?|red)\b/i.test(before);
+                            const said = `the scenario table's Before cell says ${JSON.stringify(before)}`;
+                            if (repaired) {
+                                if (!fail)
+                                    failures.push(`${dir}/test-plan.md: "${req}" / "${scen}" is repaired, so its test fails before the code; ${said}`);
+                                else if (!/\b[0-9a-f]{7,40}\b/i.test(before))
+                                    failures.push(`${dir}/test-plan.md: "${req}" / "${scen}" is repaired, so its Before cell cites the commit that corrects the test double, with its own red run; ${said}`);
+                            }
+                            else if (expected === "changed" && (!fail || pass)) {
+                                failures.push(`${dir}/test-plan.md: "${req}" / "${scen}" is changed, so its test fails before the code${pass && fail ? ", and a cell holding both results is not a result" : ""}; ${said}`);
+                            }
+                            else if (expected === "carried" && (!pass || fail)) {
+                                failures.push(`${dir}/test-plan.md: "${req}" / "${scen}" is carried, so its test passes before the code as regression${fail ? "; if its earlier pass was false-green, declare it repaired and cite the commit that corrects the test double" : ""}; ${said}`);
+                            }
+                        }
                     }
                 }
             }
@@ -640,7 +677,7 @@ export async function checkBehaviourStore(repo, options = {}) {
                 if (a === null || b === null || normaliseBound(f, a) !== normaliseBound(f, b)) {
                     const what = `${dir}: AGREED CONTENT CHANGED: ${f} ${a === null ? "was added" : b === null ? "was removed" : "differs"} from what was agreed at ${base}, with no amendment recording a commit and an approver (M-ADR 0222 §4.6)`;
                     if (structuralFile(f) && !STRUCTURE_ENFORCED)
-                        warnings.push(`${what}; a structural delta, report only while M-ADR 0230 is Proposed`);
+                        warnings.push(`${what}; a structural delta, reported only because ENFORCED is off`);
                     else
                         failures.push(what);
                 }

package/dist/lib/validate/dispatch.js

@@ -37,13 +37,13 @@ const BEHAVIOUR_STORE_VALIDATORS = [
         source: { kind: "native", run: async (ctx) => checkFeatureSpecPointers(ctx.targetRepo) },
         build: () => ({ status: "run", args: [] }),
     },
-    // The journeys a change can break, and whether its proposal names them (M-ADR 0229 §4.5, Proposed). Report only; [N/A] without journeys.
+    // The journeys a change can break, and whether its proposal names them (M-ADR 0229 §4.5). Report only; [N/A] without journeys.
     {
         name: "journey-impact",
         source: { kind: "native", run: async (ctx) => checkJourneyImpact(ctx.targetRepo) },
         build: () => ({ status: "run", args: [] }),
     },
-    // The structural model and each open change's structural artifact (M-ADR 0230, Proposed). Report only; [N/A] without a model.
+    // The structural model and each open change's structural artifact (M-ADR 0230). Report only; [N/A] without a model.
     {
         name: "structural-model",
         source: { kind: "native", run: async (ctx) => checkStructuralModel(ctx.targetRepo) },

package/dist/lib/validate/journey-impact.js

@@ -1,5 +1,5 @@
-// journey-impact: the journeys a change can break, and whether its proposal names them (M-ADR 0229 §4.5, Proposed).
-// Report only (M-ADR 0229 §4.5, Proposed): every finding is a [WARN] and the check exits 0. Gate 0 carries this report; nothing
+// journey-impact: the journeys a change can break, and whether its proposal names them (M-ADR 0229 §4.5).
+// Report only (M-ADR 0229 §4.5): every finding is a [WARN] and the check exits 0. Gate 0 carries this report; nothing
 // blocks on it, and the judge does not fail a change for it.
 //
 // For each open change in the behaviour store (openspec/changes/<change>/, not the archive):
@@ -14,8 +14,8 @@
 // with no reason is reported too.
 //
 // Also reported: a journey citing a requirement of a feature its journey_feature rows do not name (one record or
-// the other is wrong, M-ADR 0229 §4.4, Proposed); and an SDD with catalogued journeys whose manifest declares no journey master and that names no
-// platform it inherits from (an unresolved root, M-ADR 0229 §4.2, Proposed). A member that names its platform inherits the
+// the other is wrong, M-ADR 0229 §4.4); and an SDD with catalogued journeys whose manifest declares no journey master and that names no
+// platform it inherits from (an unresolved root, M-ADR 0229 §4.2). A member that names its platform inherits the
 // root's declaration, which is checked at the root.
 //
 // Reads the aggregated catalogue (catalogues-aggregated/*.csv) where this SDD has one, since a root's changes can
@@ -100,7 +100,7 @@ export async function checkJourneyImpact(repo) {
     else if (platform)
         lines.push(`journey master: not declared here; inherited from platform ${platform}, where it is checked`);
     else
-        warnings.push(`.sdd/sdd-manifest.yaml: ${journeys.length} catalogued journey(s) and no journey master (journeys.master: test-file or store), and no platform to inherit one from: unresolved (M-ADR 0229 §4.2, Proposed)`);
+        warnings.push(`.sdd/sdd-manifest.yaml: ${journeys.length} catalogued journey(s) and no journey master (journeys.master: test-file or store), and no platform to inherit one from: unresolved (M-ADR 0229 §4.2)`);
     const jr = await csv(repo, "journey_requirement", dir);
     const jf = (await csv(repo, "journey_feature", dir)) ?? [];
     const featureKinds = new Map(((await csv(repo, "features", dir)) ?? []).map((f) => [f["id"], f["kind"] ?? ""]));
@@ -137,7 +137,7 @@ export async function checkJourneyImpact(repo) {
         if (touched.get(r["journey_id"])?.has(feature) || mismatched.has(key))
             continue;
         mismatched.add(key);
-        warnings.push(`journey ${r["journey_id"]} cites requirements of ${feature}, which its journey_feature rows do not name: the journey's related features or its tags are wrong (M-ADR 0229 §4.4, Proposed)`);
+        warnings.push(`journey ${r["journey_id"]} cites requirements of ${feature}, which its journey_feature rows do not name: the journey's related features or its tags are wrong (M-ADR 0229 §4.4)`);
     }
     const untracedCount = journeys.filter((j) => !traced.has(j["id"])).length;
     lines.push(`journeys: ${journeys.length} catalogued, ${journeys.length - untracedCount} traced to requirements, ${untracedCount} untraced`);
@@ -203,6 +203,6 @@ export async function checkJourneyImpact(repo) {
     const body = lines.map((l) => `${l}\n`).join("");
     if (warnings.length === 0)
         return { exitCode: 0, stdout: `journey-impact:\n${body}[PASS] journey-impact: every listed journey is named\n` };
-    return { exitCode: 0, stdout: `journey-impact:\n${body}${warnings.map((w) => `[WARN] ${w}\n`).join("")}[WARN] journey-impact: ${warnings.length} finding(s), report only (M-ADR 0229 §4.5, Proposed)\n` };
+    return { exitCode: 0, stdout: `journey-impact:\n${body}${warnings.map((w) => `[WARN] ${w}\n`).join("")}[WARN] journey-impact: ${warnings.length} finding(s), report only (M-ADR 0229 §4.5)\n` };
 }
 //# sourceMappingURL=journey-impact.js.map

package/dist/lib/validate/structural-model.js

@@ -1,4 +1,4 @@
-// structural-model: the structural model and each open change's structural artifact (M-ADR 0230 §4.3, §4.4, Proposed;
+// structural-model: the structural model and each open change's structural artifact (M-ADR 0230 §4.3, §4.4;
 // docs/method/methods/guides/structural-model-format.md).
 //
 // The model (openspec/structure/<partition>.yaml), as the current view:
@@ -6,11 +6,13 @@
 //               (a platform SDD: its domains and `platform`; an application or integration SDD: its sdd_id)
 //   elements    a `structure` catalogue, its `structure` columns only, an id held once, required columns,
 //               value types and vocabularies (the catalogue metamodel's)
-//   references  resolved in the view; into a catalogue of another class, against that catalogue as built
+//   references  resolved in the view; into a catalogue of another class, against that catalogue as built, less the
+//               contracts open changes' records agree as new (lib/structure/intended.ts): those are in their change's
+//               view, its dependants' and the intended one, so a current reference to one is refused (§4.11 proof 3)
 //   hierarchies no cycle through a self-reference; natural keys unique; domain invariants naming their entity's own
 //               attributes and relationships
-//   views       each generated view under docs/structure/ missing, stale (rendered from an earlier model) or edited by
-//               hand (its body no longer matches the digest in its header)
+//   views       docs/structure/ absent where the model is admitted, and each generated view under it missing, stale
+//               (rendered from an earlier model) or edited by hand (its body no longer matches the digest in its header)
 // Each open change (openspec/changes/<change>/structure/):
 //   artifact    where the model exists, a change has partition deltas or none.yaml, never both
 //   deltas      well formed; ADDED ids new; MODIFIED and REMOVED ids held by the delta's partition; a base
@@ -29,20 +31,22 @@
 //   archived    a change archived with structural deltas and no effect record (a raw `openspec archive`): its
 //               structure is not applied, so its transition is not shipped
 //
-// Report only while M-ADR 0230 is Proposed (ENFORCED): every finding is a [WARN] and the check exits 0. Without
-// openspec/structure/ and with no change carrying a structure/ directory it reports [N/A].
+// Enforced (the release that accepts M-ADR 0230): every finding is a [FAIL] and the check
+// exits 1; with ENFORCED false it reports them as [WARN] and exits 0. Without openspec/structure/ and with no change
+// carrying a structure/ directory it reports [N/A], so an SDD without a model is unaffected.
 import { readdir, readFile } from "node:fs/promises";
 import { join } from "node:path";
 import { parseDocument } from "yaml";
 import { parseCatalogueCsv } from "../catalogue/csv-reader.js";
 import { loadCanonicalSchema } from "../catalogue/schema-loader.js";
 import { APPLIED_FILE, elementKey, loadChangeStructure, loadModel, STRUCTURE_DIR } from "../structure/model.js";
-import { agreedOrder, attribute, checkDependencies, checkOverlap, intended, viewAt } from "../structure/compose.js";
+import { agreedOrder, attribute, checkDependencies, checkOverlap, closure, intended, viewAt } from "../structure/compose.js";
 import { describeState, renderViews, VIEW_PATHS, viewState } from "../structure/render.js";
+import { Additions, CONTRACTS, readAgreement } from "../structure/intended.js";
 import { validateDeltas, validateView, viewOf } from "../structure/view.js";
 const VIEW_COUNT = Object.keys(VIEW_PATHS).length;
-/** Flipped when M-ADR 0230 is accepted: findings then FAIL. */
-export const ENFORCED = false;
+/** Findings FAIL (from M-ADR 0230's acceptance); false reports them only, as while M-ADR 0230 was Proposed. Also binds a change's structural deltas as agreed content in the behaviour-store check. */
+export const ENFORCED = true;
 const CHANGES_DIR = join("openspec", "changes");
 async function readText(p) {
     try {
@@ -60,19 +64,6 @@ async function subdirs(p) {
         return [];
     }
 }
-/** The change's agreement record status (docs/agreements/<change>.yaml), or `unrecorded`. */
-async function agreementStatus(repo, change) {
-    const text = await readText(join(repo, "docs", "agreements", `${change}.yaml`));
-    if (text === null)
-        return "unrecorded";
-    try {
-        const status = String(parseDocument(text).toJS()?.agreement_record?.status ?? "");
-        return ["proposed", "agreed", "withdrawn", "superseded"].find((s) => s === status) ?? "unrecorded";
-    }
-    catch {
-        return "unrecorded";
-    }
-}
 /** Names of archived changes: openspec/changes/archive/<YYYY-MM-DD>-<name>. */
 async function archivedNames(repo) {
     return new Set((await subdirs(join(repo, CHANGES_DIR, "archive"))).map((d) => d.replace(/^\d{4}-\d{2}-\d{2}-/, "")));
@@ -91,8 +82,22 @@ function builtLookup(repo) {
         const text = await readText(join(repo, "catalogues", `${catalogue}.csv`));
         cache.set(catalogue, text === null ? null : parseCatalogueCsv(text).rows);
     };
+    fn.rows = (catalogue) => cache.get(catalogue) ?? [];
     return fn;
 }
+/**
+ * The built catalogues as one view sees them. A contract an open change's record agrees as new is built from the
+ * change's own sources, so it is in no view but that change's, its dependants' and, once agreed, the intended one.
+ */
+function builtIn(built, all, mine) {
+    return (catalogue, column) => {
+        const rows = built(catalogue, column);
+        if (rows === null || catalogue !== CONTRACTS || column !== "id")
+            return rows;
+        const out = new Set([...rows].filter((id) => !all.has(id) || mine.has(id)));
+        return out;
+    };
+}
 export async function checkStructuralModel(repo, options = {}) {
     const enforced = options.enforced ?? ENFORCED;
     const problems = [];
@@ -123,6 +128,16 @@ export async function checkStructuralModel(repo, options = {}) {
     for (const c of schema.catalogues)
         if (c.sourceOfTruth !== "structure")
             await built.load(c.name);
+    const open = new Map();
+    const newContracts = new Map();
+    for (const s of structures) {
+        const agreement = await readAgreement(repo, s.change);
+        open.set(s.change, { structure: s, status: agreement.status });
+        newContracts.set(s.change, agreement.newContracts);
+    }
+    const additions = new Additions(open, newContracts, built.rows(CONTRACTS));
+    const allNew = additions.contracts(open.keys());
+    const addedBy = (catalogue, id) => additions.addedBy(catalogue, id);
     let allowed = null;
     if (profile === "platform-profile") {
         allowed = new Set(["platform", ...(view.get("domains")?.keys() ?? []), ...(built("domains", "id") ?? [])]);
@@ -143,14 +158,14 @@ export async function checkStructuralModel(repo, options = {}) {
     // The current view.
     const unresolved = new Set();
     const currentProblems = [];
-    validateView(schema, view, built, currentProblems, unresolved);
+    validateView(schema, view, builtIn(built, allNew, new Set()), currentProblems, unresolved, addedBy);
     problems.push(...currentProblems);
     const elementCount = [...view.values()].reduce((n, m) => n + m.size, 0);
     lines.push(files === null ? `model: none (${STRUCTURE_DIR}/ absent)` : `model: ${files.length} partition file(s), ${elementCount} element(s) in ${view.size} catalogue(s)`);
     if (unresolved.size > 0)
         lines.push(`references into ${[...unresolved].sort().join(", ")}: unresolved (no built catalogue)`);
-    // The generated views, against a render of the current view. An SDD that has not rendered them yet (no
-    // docs/structure/) is adopting the model, which keeps its originals until the review is complete (§6 step 1).
+    // The generated views, against a render of the current view. Where a model is admitted they are required (M-ADR
+    // 0230 §4.3): an SDD reviews an extraction before writing it (§6 step 1), so none is mid-adoption with a model.
     if (files !== null && (await subdirs(join(repo, "docs"))).includes("structure")) {
         let current = 0;
         for (const [path, rendered] of renderViews(view)) {
@@ -163,14 +178,15 @@ export async function checkStructuralModel(repo, options = {}) {
         lines.push(`generated views: ${current} of ${VIEW_COUNT} current`);
     }
     else if (files !== null) {
-        lines.push("generated views: not rendered (no docs/structure/); `sdd-cli structure render` writes them");
+        problems.push("docs/structure/: the generated views are not rendered; where a structural model is admitted they are required. `structure render` writes them (sdd-maintain or sdd-cli)");
+        lines.push(`generated views: 0 of ${VIEW_COUNT} (no docs/structure/)`);
     }
     // Open changes.
-    const addedBy = new Map();
+    const addedByChange = new Map();
     for (const s of structures)
         for (const d of s.deltas)
             for (const e of d.added)
-                addedBy.set(elementKey(e.catalogue, e.id), s.change);
+                addedByChange.set(elementKey(e.catalogue, e.id), s.change);
     const features = new Set(view.get("features")?.keys() ?? []);
     let withDeltas = 0;
     let noOps = 0;
@@ -190,7 +206,7 @@ export async function checkStructuralModel(repo, options = {}) {
         }
         if (s.noOp && s.deltas.length > 0)
             problems.push(`${s.noOp.file}: a no-op claim beside ${s.deltas.length} partition delta(s); state one or the other`);
-        const elsewhere = new Map([...addedBy].filter(([, c]) => c !== s.change));
+        const elsewhere = new Map([...addedByChange].filter(([, c]) => c !== s.change));
         validateDeltas(schema, view, s.deltas, elsewhere, problems);
         // A behaviour delta for a feature the model does not hold needs that feature added here.
         const adds = new Set(s.deltas.flatMap((d) => d.added.filter((e) => e.catalogue === "features").map((e) => e.id)));
@@ -207,9 +223,6 @@ export async function checkStructuralModel(repo, options = {}) {
     }
     lines.push(`changes: ${changes.length} open, ${withDeltas} with structural deltas, ${noOps} claiming none, ${without} without the artifact`);
     // Composition (M-ADR 0230 §4.5): the three views and the three checks.
-    const open = new Map();
-    for (const s of structures)
-        open.set(s.change, { structure: s, status: await agreementStatus(repo, s.change) });
     const archived = await archivedNames(repo);
     checkOverlap(open, problems);
     checkDependencies(open, archived, problems);
@@ -219,7 +232,7 @@ export async function checkStructuralModel(repo, options = {}) {
         if (oc.structure.deltas.length === 0)
             continue;
         const at = [];
-        validateView(schema, viewAt(view, name, open), built, at, new Set());
+        validateView(schema, viewAt(view, name, open), builtIn(built, allNew, additions.contracts(closure(name, open))), at, new Set(), addedBy);
         for (const p of at) {
             if (known.has(p))
                 continue;
@@ -231,7 +244,7 @@ export async function checkStructuralModel(repo, options = {}) {
     const agreed = agreedOrder(open);
     if (agreed.length > 0) {
         const inIntended = [];
-        validateView(schema, intended(view, open), built, inIntended, new Set());
+        validateView(schema, intended(view, open), builtIn(built, allNew, additions.contracts(agreed)), inIntended, new Set(), addedBy);
         for (const p of inIntended) {
             if (known.has(p) || atAgreed.has(p))
                 continue;
@@ -259,7 +272,7 @@ export async function checkStructuralModel(repo, options = {}) {
     if (problems.length === 0)
         return { exitCode: 0, stdout: `structural-model:\n${body}[PASS] structural-model: ok\n` };
     const tag = enforced ? "FAIL" : "WARN";
-    const tail = enforced ? `[FAIL] structural-model: ${problems.length} finding(s)\n` : `[WARN] structural-model: ${problems.length} finding(s), report only (M-ADR 0230, Proposed)\n`;
+    const tail = enforced ? `[FAIL] structural-model: ${problems.length} finding(s)\n` : `[WARN] structural-model: ${problems.length} finding(s), report only (M-ADR 0230)\n`;
     return { exitCode: enforced ? 1 : 0, stdout: `structural-model:\n${body}${problems.map((p) => `[${tag}] ${p}\n`).join("")}${tail}` };
 }
 //# sourceMappingURL=structural-model.js.map

package/dist/maintain-version.json

@@ -1,4 +1,4 @@
 {
-  "version": "0.13.1",
-  "built_against_sdd_cli": "4.0.1"
+  "version": "0.15.0",
+  "built_against_sdd_cli": "5.1.0"
 }

package/dist/verify-version.json

@@ -1,4 +1,4 @@
 {
-  "version": "4.0.1",
-  "built_against_sdd_cli": "4.0.1"
+  "version": "5.1.0",
+  "built_against_sdd_cli": "5.1.0"
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@sdd-method/verify-cli",
-  "version": "4.0.1",
-  "sddCliVersion": "4.0.1",
+  "version": "5.1.0",
+  "sddCliVersion": "5.1.0",
   "description": "Verify an SDD repository without changing it — validate, list, and read-only catalogue and pack checks. Ships only the code those verbs reach; it cannot write to the repository it is pointed at. Authoring and maintenance are in @sdd-method/sdd-cli.",
   "license": "UNLICENSED",
   "type": "module",