@sun-asterisk/sungen 3.2.25 → 3.2.27

package/dist/utils/ref-key.js

@@ -0,0 +1,48 @@
+"use strict";
+/**
+ * ONE vocabulary for what a `[Reference]` means.
+ *
+ * The compiler's documented key rule is "the lowercase of the `[Reference]` text, spaces
+ * preserved" (`SelectorResolver.generateKey`). The harness re-implemented that rule with its own
+ * regex — `/\[([a-z0-9_.-]+):/` — which has no space in it, so a multi-word screen such as
+ * `[Basic Info:Email]` compiled, ran and passed, and was NEVER seen by `touchesOutcome`,
+ * `reachesOutcome`, phase coverage, handoffs or the navigation-target check. A real project
+ * hyphenated every namespace with zero functional change and its audit went 6.9 → 8.9 (#660).
+ *
+ * Two rules, one place:
+ *  - `normalizeRefLabel` IS the compiler's key rule. The compiler delegates here.
+ *  - `screenKey` is the COMPARISON form the harness uses for a screen/namespace: separators are
+ *    equivalent (`basic info` ≡ `basic-info` ≡ `basic_info`), because a contract author writes
+ *    `outcome.screen: basic-info` as readily as the feature writes `[Basic Info:…]`, and the
+ *    harness only ever asks "is this the same screen?" — never "which YAML key resolves?".
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.normalizeRefLabel = normalizeRefLabel;
+exports.screenKey = screenKey;
+exports.refNamespaces = refNamespaces;
+/** The compiler's selector-key rule: NFC, lowercase, trimmed, inner whitespace collapsed. */
+function normalizeRefLabel(label) {
+    return label.normalize('NFC').toLowerCase().trim().replace(/\s+/g, ' ');
+}
+/** Comparison form for a screen / namespace name — separator-insensitive. */
+function screenKey(label) {
+    return normalizeRefLabel(label).replace(/[\s_-]+/g, ' ').trim();
+}
+/**
+ * Every namespace a piece of step text references, in order, as `screenKey`s.
+ * `[Screen:Element]` → `screen`; a bare `[Screen]` page reference is included too when `bare`
+ * is set (a `see [Done] page` assertion names the screen without an element).
+ */
+function refNamespaces(text, opts = {}) {
+    const out = [];
+    for (const m of text.matchAll(/\[([^\]]+)\]/g)) {
+        const inner = m[1];
+        const colon = inner.indexOf(':');
+        if (colon !== -1)
+            out.push(screenKey(inner.slice(0, colon)));
+        else if (opts.bare)
+            out.push(screenKey(inner));
+    }
+    return out;
+}
+//# sourceMappingURL=ref-key.js.map

package/dist/utils/ref-key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ref-key.js","sourceRoot":"","sources":["../../src/utils/ref-key.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;GAgBG;;AAGH,8CAEC;AAGD,8BAEC;AAOD,sCASC;AAxBD,6FAA6F;AAC7F,SAAgB,iBAAiB,CAAC,KAAa;IAC7C,OAAO,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAC1E,CAAC;AAED,6EAA6E;AAC7E,SAAgB,SAAS,CAAC,KAAa;IACrC,OAAO,iBAAiB,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AAClE,CAAC;AAED;;;;GAIG;AACH,SAAgB,aAAa,CAAC,IAAY,EAAE,OAA2B,EAAE;IACvE,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;QAC/C,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACnB,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,KAAK,KAAK,CAAC,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;aACxD,IAAI,IAAI,CAAC,IAAI;YAAE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sun-asterisk/sungen",
-  "version": "3.2.25",
+  "version": "3.2.27",
   "description": "Deterministic E2E Test Compiler - Gherkin + Selectors → Playwright tests",
   "main": "src/index.ts",
   "types": "src/index.ts",
@@ -40,8 +40,8 @@
     "@babel/types": "^7.28.5",
     "@cucumber/gherkin": "^37.0.0",
     "@cucumber/messages": "^31.0.0",
-    "@sungen/driver-data-factory": "3.2.25",
-    "@sungen/driver-ui": "3.2.25",
+    "@sungen/driver-data-factory": "3.2.27",
+    "@sungen/driver-ui": "3.2.27",
     "chalk": "^5.6.2",
     "commander": "^14.0.2",
     "dotenv": "^17.2.3",

package/src/cli/commands/audit.ts

@@ -32,7 +32,14 @@ function render(r: AuditReport): void {
     const label = a.key.padEnd(width);
     // Two different n/a: this unit supplied nothing, vs this axis does not apply to this KIND
     // of unit. Only the first is something an author can act on.
-    if (!a.applicable) { L(`    ${label} ${' '.repeat(20)}  n/a — ${a.byDesign ? 'not applicable to a contract flow' : 'no evidence'}`); continue; }
+    if (!a.applicable) {
+      // Three different states, three different remedies — collapsing them into "no evidence"
+      // contradicted the section right above, which printed the very number being called absent.
+      const why = a.byDesign ? 'not applicable to a contract flow'
+        : a.withheld ? `held — measured ${(a.value * 100).toFixed(0)}%, not counted until the viewpoint baseline is accepted`
+          : 'no evidence';
+      L(`    ${label} ${' '.repeat(20)}  n/a — ${why}`); continue;
+    }
     L(`    ${label} ${bar(a.value)} ${(a.value * 100).toFixed(0)}%${verdictOf[a.key] ?? ''}`);
   }
   L(`    (${r.score.formula})`);
@@ -46,6 +53,9 @@ function render(r: AuditReport): void {
     L(`  ①F Flow contract — goal: ${fq.contract!.goal}`);
     L(`      outcome [${fq.contract!.outcome.screen}]: ${fq.outcomeProven ? '✓ proven (automated data assertion)' : fq.outcomeManualOnly ? '⚠ manual-only' : '✗ UNPROVEN'}`);
     L(`      phases: ${fq.phases.map((p) => `${p.phase}=${p.covered ? (p.automated ? '✓' : 'manual') : '✗'}`).join('  ')}  → phase coverage ${(fq.phaseRatio * 100).toFixed(0)}%`);
+    for (const d of fq.danglingPhaseRefs) {
+      L(`      ⚠ PHASE-REF-DANGLING: phase "${d.phase}" names \`${d.ref}\` — no scenario carries it`);
+    }
     // The inventory, when declared, is the coverage that counts — phase coverage is only
     // "each of BF/AF/EF appears at least once" and printing it as `flowCoverage` next to a 89%
     // axis read as a contradiction.
@@ -103,7 +113,12 @@ function render(r: AuditReport): void {
     const ax = Object.entries(r.calibration.axes).map(([k, v]) => `${k}=${(v * 100).toFixed(0)}%`).join(' · ');
     L(`  ⑨ Calibration — ${ax}`);
     const na = r.calibration.notApplicable ?? [];
-    if (na.length) L(`      not scored (no evidence in this unit): ${na.join(', ')}`);
+    if (na.length) {
+      const held = new Set(r.score.axes.filter((x) => x.withheld).map((x) => x.key));
+      const absent = na.filter((k) => !held.has(k));
+      if (absent.length) L(`      not scored (no evidence in this unit): ${absent.join(', ')}`);
+      if (held.size) L(`      measured but held (viewpoint baseline changed — review, then --accept-viewpoint): ${[...held].join(', ')}`);
+    }
     L(`      weakest: ${r.calibration.weakest.axis} ${(r.calibration.weakest.value * 100).toFixed(0)}%${r.calibration.inflated ? '  ⚠ SCORE-INFLATED-BY-BREADTH' : ''}`);
     if (r.calibration.cappedAt !== undefined) {
       // Only blame the weakest axis when it IS weak. A cap for missing evidence printed
@@ -154,8 +169,12 @@ export function registerAuditCommand(program: Command): void {
         const unitId = catalogIdFromScreenDir(dir);
         const vb = report.viewpointBaseline;
         const postHoc = vb.status === 'new' && report.scenarioCount > 0;
+        // A re-parsed baseline is a CACHE migration, not an acceptance: the comparison already
+        // resolved to `unchanged`, and rewriting the record only lets the NEXT real edit be
+        // detected. Left unwritten it would re-migrate — and re-announce — on every run.
+        if (vb.reparsed) acceptViewpointBaseline(process.cwd(), unitId, { hash: vb.hash, ids: vb.ids, fileHash: vb.fileHash });
         if ((vb.status === 'new' && !postHoc) || (options.acceptViewpoint && (vb.status === 'changed' || postHoc))) {
-          acceptViewpointBaseline(process.cwd(), unitId, { hash: vb.hash, ids: vb.ids });
+          acceptViewpointBaseline(process.cwd(), unitId, { hash: vb.hash, ids: vb.ids, fileHash: vb.fileHash });
           if (options.acceptViewpoint && !options.json) {
             console.log(`\n  ✓ test-viewpoint.md accepted as the baseline for ${name} (${vb.ids.length} viewpoint id(s)).`);
             console.log('    Re-run the audit to score atomicLedger + traceability against it.\n');

package/src/cli/commands/next.ts

@@ -40,8 +40,8 @@ function render(s: UnitState): void {
   if (s.audit) L(`  audit: ${s.audit.overall}/10 [${s.audit.gateStatus}] · ${s.audit.findings.length} finding(s)`);
   L('');
   for (const st of s.steps) {
-    const mark = st.kind === 'blocked' ? '⛔' : st.kind === 'optional' ? '○' : '→';
-    L(`  ${mark} ${st.command}`);
+    const mark = st.kind === 'blocked' ? '⛔' : st.kind === 'optional' ? '○' : st.kind === 'decide' ? '⚖' : '→';
+    L(`  ${mark} ${st.command}${st.kind === 'decide' ? '   (a QA decision — ask, do not run)' : ''}`);
     L(`     ${st.because}`);
   }
   L('');

package/src/exporters/matrix/build.ts

@@ -559,7 +559,10 @@ export function buildMatrix(inputs: BuildInputs): MatrixModel {
       priority,
       mode: modes.size > 1 ? 'mixed' : (first?.mode ?? 'auto'),
       layers: Array.from(new Set(groupVariants.flatMap((v) => v.layers))),
-      traces: Array.from(new Set(groupVariants.flatMap((v) => v.traces))),
+      // The map's own `trace:` codes join the scenarios' `@spec:` ids on the SAME column: a
+      // reviewer wants one place to see what an item traces to, whether the id came from the spec
+      // or from the analysis. Map codes lead, because they are the ones a person chose for it.
+      traces: Array.from(new Set([...(g.trace ?? []), ...groupVariants.flatMap((v) => v.traces)])),
       dimensions: g.dimensions,
       // Only the preconditions COMMON to every variant belong on the parent —
       // copying the first variant's setup mis-states the start state of the

package/src/exporters/matrix/map-loader.ts

@@ -79,6 +79,10 @@ export function loadDeliveryMap(file: string): MapLoadResult {
         intent: String(grp.intent ?? ''),
         oracle: String(grp.oracle ?? ''),
         ...(grp.dimensions !== undefined ? { dimensions: String(grp.dimensions) } : {}),
+        // Free-form by design: these are the project's own analysis codes, not a fixed scheme.
+        ...(Array.isArray(grp.trace) && grp.trace.length
+          ? { trace: (grp.trace as unknown[]).map((t) => String(t).trim()).filter(Boolean) }
+          : {}),
         category: grp.category as MapCategory,
         review,
         variants: Array.isArray(variants) ? variants.map(String) : [],
@@ -150,6 +154,7 @@ export function writeDeliveryMap(file: string, map: DeliveryMap): void {
       intent: g.intent,
       oracle: g.oracle,
       ...(g.dimensions !== undefined ? { dimensions: g.dimensions } : {}),
+      ...(g.trace && g.trace.length ? { trace: g.trace } : {}),
       category: g.category,
       review: g.review,
       variants: g.variants,

package/src/exporters/matrix/types.ts

@@ -33,6 +33,17 @@ export interface MapGroup {
    *  (e.g. "required ×3 · format ×9 · full-width ×2"). Rendered on the parent row
    *  instead of concatenating every variant's title — the compact review view. */
   dimensions?: string;
+  /**
+   * Domain-logic reference ids this item traces to — a decision table, an algorithm, an internal
+   * business rule (`DEC-003`, `ALG-002`, `DISC-002`, `BR-001`).
+   *
+   * `requirements:` already traces to the FR/TR/NFR ids in `requirements/spec.md`. The codes a QA
+   * assigns while ANALYSING — which mechanism a case actually exercises — had no field, so they
+   * lived as comments in the `.feature` and never reached the Coverage sheet handed to the
+   * reviewer: the Trace column came out blank for exactly the items whose traceability mattered
+   * most (#651). Optional, and free-form on purpose: these ids are the project's own vocabulary.
+   */
+  trace?: string[];
   /** Variant refs: `VP-ID` (all @cases rows when the scenario has a dataset) or `VP-ID#label`. */
   variants: string[];
 }

package/src/generators/test-generator/utils/selector-resolver.ts

@@ -1,4 +1,5 @@
 import * as fs from 'fs';
+import { normalizeRefLabel } from '../../../utils/ref-key';
 import * as path from 'path';
 import yaml from 'yaml';
 import { readYaml, readYamlIfExists } from '../../../utils/yaml-io';
@@ -189,7 +190,7 @@ export class SelectorResolver {
    * "書類一覧"        → "書類一覧"
    */
   static generateKey(label: string): string {
-    return label.normalize('NFC').toLowerCase().trim().replace(/\s+/g, ' ');
+    return normalizeRefLabel(label);   // the one definition — the harness reads the same rule (#660)
   }
 
   /**

package/src/harness/audit.ts

@@ -27,6 +27,8 @@ import { specCoverage, SpecCoverageResult, parseSpecClauses, restatedRequirement
 import { downstreamScope, manualOracle, readText, DownstreamResult, ManualOracleResult,
   negativeSideEffect, sourceBacked, crossArtifactOwnership, isolationRisk, serialCascadeRisk } from './quality-gates';
 import { viewpointLedger, parseViewpointItems, browserGestureSubstitutions, viewpointIntegrity, LedgerResult } from './viewpoint-ledger';
+import { specBranches, unenumeratedBranches, sameOracleClusters, permissionPairGaps, awaitingSeedData, unconsideredRisks, MULTI_SCREEN_RISKS } from './spec-branches';
+const MULTI_SCREEN_RISK_COUNT = MULTI_SCREEN_RISKS.length;
 import { capabilityRegistry } from '../capabilities/registry';
 import { discoverAndRegisterCapabilities } from '../capabilities/discover';
 import { contextRouter } from '../capabilities/context-router';
@@ -65,6 +67,12 @@ export interface AuditReport {
   score: {
     overall: number;            // 0..10, business-weighted over the APPLICABLE axes
     notApplicable?: string[];   // axes with no evidence — excluded, not scored as 1.0
+    /**
+     * Why each excluded axis is excluded. "No evidence" and "evidence WITHHELD pending review"
+     * are different states with different remedies, and reporting both as "no evidence" told the
+     * author of a 93%-covered ledger to go write the viewpoint they had just written (#657).
+     */
+    naReasons?: Record<string, string>;
     cappedAt?: number;          // set when a weak critical axis holds the score down
     coverage: number;           // 0..1
     businessDepth: number;      // 0..1
@@ -76,7 +84,7 @@ export interface AuditReport {
      * `specFR` and `atomicLedger` entirely — so a flow's real coverage axis was never printed
      * while `balance`, which carried no weight, was.
      */
-    axes: Array<{ key: string; value: number; weight: number; applicable: boolean; critical: boolean; byDesign?: boolean }>;
+    axes: Array<{ key: string; value: number; weight: number; applicable: boolean; critical: boolean; byDesign?: boolean; withheld?: boolean }>;
     formula: string;
   };
   gateStatus: 'PASS' | 'FAIL';
@@ -196,7 +204,7 @@ export function runAudit(screenDir: string, screenName: string): AuditReport {
   const isUiFlowUnit = /^flows\//.test(catalogScreenName);
   const flowQ: FlowQualityResult = isUiFlowUnit
     ? flowQuality(screenDir, scenarios)
-    : { hasContract: false, errors: [], outcomeProven: false, outcomeManualOnly: false, offGoal: [], offGoalRatio: 0, offGoalCategories: [], phases: [], phaseRatio: 1, handoffs: { total: 0, asserted: 0, ratio: 1 }, sit: [] };
+    : { hasContract: false, errors: [], outcomeProven: false, outcomeManualOnly: false, offGoal: [], offGoalRatio: 0, offGoalCategories: [], phases: [], phaseRatio: 1, danglingPhaseRefs: [], handoffs: { total: 0, asserted: 0, ratio: 1 }, sit: [] };
   const gateCatalog = (flowQ.hasContract && !declaredPageType(viewpointText, catalog))
     ? { ...catalog, page_types: {} } as Catalog
     : catalog;
@@ -230,7 +238,7 @@ export function runAudit(screenDir: string, screenName: string): AuditReport {
   // #1 taxonomy-match: when the project defines a viewpoint taxonomy, scenarios must use it.
   const taxonomyMismatch = viewpoints.length > 0 && trace.withVpCode > 0 && trace.mappedRatio < 0.6;
   // #2 downstream-scope + #4 manual-oracle
-  const downstream = downstreamScope(readText(specPath), scenarios);
+  const downstream = downstreamScope(readText(specPath), scenarios, featureText);
   const manualOracleResult = manualOracle(featureText);
   const autoManual = automatableManual(scenarios); // TQ-2 — @manual that is really automatable
   const ledger = viewpointLedger(viewpointPath, scenarios, featureText);
@@ -331,7 +339,7 @@ export function runAudit(screenDir: string, screenName: string): AuditReport {
   // this KIND of unit". Only the first is a reason to cap the score: a contract flow can never
   // supply balance evidence, so capping for it held every flow at 8.9 forever and printed
   // "weakest: flowCoverage 100% — fix it to lift the number", which is not fixable advice (#595).
-  const axisDefs: Array<{ key: string; value: number; weight: number; applicable: boolean; critical: boolean; byDesign?: boolean }> = [
+  const axisDefs: Array<{ key: string; value: number; weight: number; applicable: boolean; critical: boolean; byDesign?: boolean; withheld?: boolean }> = [
     flowScored
       // A declared flow claimed only by @manual scenarios is ACCOUNTED FOR but nothing runs, so
       // it cannot count the same as an automated one — `covered` was collapsing three very
@@ -340,10 +348,10 @@ export function runAudit(screenDir: string, screenName: string): AuditReport {
       ? { key: 'flowCoverage', value: inventory ? Math.min((inventory.ratio + inventory.automatedRatio) / 2, flowQ.phaseRatio) : flowQ.phaseRatio, weight: 0.22, applicable: true, critical: true }
       : { key: 'coverage', value: coverage, weight: 0.22, applicable: !!gate.pageType && gate.themesTotal > 0, critical: true },
     { key: 'specFR', value: specRatio, weight: 0.15, applicable: spec.hasSpec && spec.frTotal > 0, critical: true },
-    { key: 'atomicLedger', value: ledger.ratio, weight: 0.13, applicable: ledger.hasViewpoint && ledger.total > 0 && !viewpointMoved, critical: true },
+    { key: 'atomicLedger', value: ledger.ratio, weight: 0.13, applicable: ledger.hasViewpoint && ledger.total > 0 && !viewpointMoved, critical: true, withheld: viewpointMoved && ledger.hasViewpoint && ledger.total > 0 },
     { key: 'businessDepth', value: businessDepth, weight: 0.20, applicable: true, critical: true },
     { key: 'claimProof', value: claim.ratio, weight: 0.15, applicable: claim.withClaims > 0, critical: true },
-    { key: 'traceability', value: traceScore, weight: 0.09, applicable: viewpoints.length > 0 && !viewpointMoved, critical: false },
+    { key: 'traceability', value: traceScore, weight: 0.09, applicable: viewpoints.length > 0 && !viewpointMoved, critical: false, withheld: viewpointMoved && viewpoints.length > 0 },
     // A use-case decomposition is EF-heavy by construction (1 basic flow, N alternates, N
     // exceptions) — that is the shape of a well-decomposed use case, not neglected business
     // core. `flowCoverage` already measures whether the journey's phases are covered, so
@@ -394,10 +402,24 @@ export function runAudit(screenDir: string, screenName: string): AuditReport {
   const overall = seniorBandedOverall(rawOverall, { flowStateful: flowDepth.stateful, flowRatio: flowDepth.ratio, oracleWeak: oracle.weak.length, isolationRisk: isoRisk });
 
   const findings: string[] = [];
+  // A baseline that could not be compared was re-recorded rather than reported as an edit.
+  // Migrating in silence would be the same sin one level down, so it is stated.
+  if (viewpointBaseline.reparsed) {
+    findings.push(`VIEWPOINT-BASELINE-REPARSED: the recorded baseline for this unit was written by an earlier version whose viewpoint parser had a different granularity, so its ids cannot be compared with today's. \`test-viewpoint.md\` itself is unchanged — the file is now fingerprinted by its own bytes, which no parser upgrade can move, and the baseline has been re-recorded against it. \`atomicLedger\` and \`traceability\` count normally. If you DID edit the viewpoint since ${viewpointBaseline.recordedAt?.slice(0, 10) ?? 'it was accepted'}, review that diff yourself — this one migration could not tell an edit from the parser change.`);
+  }
   if (capped) {
     const why = weakestCritical && weakestCritical.value < 0.7
       ? `"${weakestCritical.key}" is ${(weakestCritical.value * 100).toFixed(0)}% — a weak axis is a hole, not something the other axes can average away`
-      : `this unit supplies no evidence for [${missingEvidence.join(', ')}], and a top mark has to rest on complete evidence`;
+      : (() => {
+        const held = axisDefs.filter((a) => a.withheld).map((a) => a.key);
+        const absent = missingEvidence.filter((k) => !held.includes(k.replace(/ .*$/, '')));
+        const parts = [];
+        if (absent.length) parts.push(`supplies no evidence for [${absent.join(', ')}]`);
+        // An axis WAS measured and is being held — saying "no evidence" here sends the author
+        // to write a declaration that already exists, when the actual next move is to review a diff.
+        if (held.length) parts.push(`has [${held.join(', ')}] measured but WITHHELD until the changed viewpoint baseline is reviewed and accepted`);
+        return `this unit ${parts.join(', and ')}, and a top mark has to rest on complete evidence`;
+      })();
     findings.push(`SCORE-CAPPED: overall held at ${cap.toFixed(1)} because ${why}.`);
   }
   if (viewpointBaseline.status === 'changed') {
@@ -405,7 +427,7 @@ export function runAudit(screenDir: string, screenName: string): AuditReport {
       viewpointBaseline.removed?.length ? `removed [${viewpointBaseline.removed.join(', ')}]` : '',
       viewpointBaseline.added?.length ? `added [${viewpointBaseline.added.join(', ')}]` : '',
     ].filter(Boolean).join(', ');
-    findings.push(`VIEWPOINT-BASELINE-CHANGED: test-viewpoint.md no longer declares what it did when this unit was last accepted — ${moved || 'the declared ids were reordered or replaced'}. atomicLedger + traceability measure the suite AGAINST this file, so they are excluded from the score until the change is confirmed: a generator that rewrites the declaration scores both 100% by construction, and a viewpoint dropped from the file stops being missing from anything. Review the diff (a removed id means that coverage is now unclaimed), then run \`sungen audit --screen ${screenName} --accept-viewpoint\`.`);
+    findings.push(`VIEWPOINT-BASELINE-CHANGED: test-viewpoint.md no longer declares what it did when this unit was last accepted — ${moved || 'the declared ids were reordered or replaced'}. atomicLedger + traceability measure the suite AGAINST this file, so they are excluded from the score until the change is confirmed: a generator that rewrites the declaration scores both 100% by construction, and a viewpoint dropped from the file stops being missing from anything. Review the diff (a removed id means that coverage is now unclaimed), then run \`sungen audit --screen ${screenName} --accept-viewpoint\` — a QA decision: an agent presents it and does not run it, because a yardstick accepted by the process it measures reads 100% by construction.`);
   }
   // On a contract flow the page type is INTENTIONALLY not applied — the contract is the checklist.
   if (gate.pageTypeSource === 'undetermined' && !flowScored) {
@@ -423,7 +445,7 @@ export function runAudit(screenDir: string, screenName: string): AuditReport {
         : `FLOW-OUTCOME-UNPROVEN: no scenario asserts data on the outcome screen \`${flowQ.contract!.outcome.screen}\` — the flow never proves its own goal ("${flowQ.contract!.goal}"). Add the happy-path scenario that ends in the declared final assertion.`);
     }
     if (flowQ.offGoalRatio > 0.35) {
-      findings.push(`FLOW-SCOPE-CREEP: ${flowQ.offGoal.length}/${scenarios.length} scenarios never touch the outcome screen \`${flowQ.contract!.outcome.screen}\` and are not guards/error-recovery (categories: ${flowQ.offGoalCategories.join(', ')}) — evidence of a SECOND business goal in this flow. Split them into their own flow (one flow = one goal, one observable outcome).`);
+      findings.push(`FLOW-SCOPE-CREEP: ${flowQ.offGoal.length}/${scenarios.length} scenarios never touch the outcome screen \`${flowQ.contract!.outcome.screen}\` and are not guards/error-recovery (categories: ${flowQ.offGoalCategories.join(', ')}) — evidence of a SECOND business goal in this flow. Split them into their own flow (one flow = one goal, one observable outcome) — or, when the spec KEEPS a variant deliberately light (an entry variant that only proves it reaches the action bar), declare that flow in \`flows:\` with its own \`outcome:\` and it is judged against that, not against the use case's. Never widen a scenario to satisfy this finding: that trades a reviewer's "over-testing" for the gate's approval, and the gate is the one that is wrong.`);
     }
     for (const ph of flowQ.phases.filter((p) => !p.covered || !p.automated)) {
       findings.push(`FLOW-PHASE-${ph.phase}-MISSING: journey phase ${ph.phase} (${ph.phase === 'HP' ? 'happy path proving the outcome' : ph.phase === 'ER' ? 'error recovery — validation must not trap the journey' : 'guards — direct access / back / refresh'}) is ${ph.covered ? 'covered only by @manual' : 'not covered'} → it does not count toward flowCoverage until automated.`);
@@ -584,7 +606,7 @@ export function runAudit(screenDir: string, screenName: string): AuditReport {
     findings.push(`BALANCE: ${balance.note} Stop expanding secondary viewpoints until business-core gaps are filled.`);
   }
   if (adoptedPostHoc) {
-    findings.push(`VIEWPOINT-ADOPTED-POST-HOC: this is the first audit of \`requirements/test-viewpoint.md\` and the suite ALREADY has ${scenarios.length} scenarios, so the yardstick is being introduced against tests that already exist. A declaration written after the suite can only measure what its author already thought of — and if it was derived FROM the suite, \`atomicLedger\` and \`traceability\` read 100% by construction while anything dropped along the way stops being missing from anything. Both axes are held as unverified until you review the claims (add what you care about, delete what you do not) and confirm: \`sungen audit --screen ${screenName} --accept-viewpoint\`.`);
+    findings.push(`VIEWPOINT-ADOPTED-POST-HOC: this is the first audit of \`requirements/test-viewpoint.md\` and the suite ALREADY has ${scenarios.length} scenarios, so the yardstick is being introduced against tests that already exist. A declaration written after the suite can only measure what its author already thought of — and if it was derived FROM the suite, \`atomicLedger\` and \`traceability\` read 100% by construction while anything dropped along the way stops being missing from anything. Both axes are held as unverified until you review the claims (add what you care about, delete what you do not) and confirm: \`sungen audit --screen ${screenName} --accept-viewpoint\` — a QA decision: an agent presents it and does not run it.`);
   }
   if (!hasYardstick) {
     const lost = [
@@ -622,6 +644,9 @@ export function runAudit(screenDir: string, screenName: string): AuditReport {
   if (taxonomyMismatch) {
     findings.push(`VP-TAXONOMY-MISMATCH: only ${(trace.mappedRatio * 100).toFixed(0)}% of scenarios use the viewpoint IDs declared in test-viewpoint.md — scenarios invented a generic VP-<CAT> scheme. Re-tag to the project's viewpoint IDs so the coverage matrix is accurate.`);
   }
+  for (const a of downstream.absent.slice(0, 5)) {
+    findings.push(`NAV-TARGET-ABSENT: the spec declares "${a.route}" as a navigation target and NO scenario mentions it — not even a page assertion. Testing the render conditions of the region that links there does not test the link: a click-through case is what proves the destination. Add one, or record why this flow does not own it.`);
+  }
   for (const d of downstream.underCovered) {
     findings.push(`DOWNSTREAM-SCOPE-MISSING: "${d.route}" is a navigation target but is covered only by a page-nav assertion — cover its content/guards, or scaffold it (\`sungen add --screen ${d.slug}\`).`);
   }
@@ -670,6 +695,46 @@ export function runAudit(screenDir: string, screenName: string): AuditReport {
   if (depth.deferredBusinessCritical > 0 && depth.deferredBusinessCritical >= depth.businessCriticalTotal) {
     findings.push(`DEPTH-DEFERRED: businessDepth ${businessDepth.toFixed(2)} is computed over only ${depth.businessCriticalTotal} on-screen scenario(s); ${depth.deferredBusinessCritical} business-critical scenario(s) are deferred to @manual (excluded from the ratio). Automate them in a flow and verify with \`sungen flow-check\` — this ratio is NOT "all business depth covered".`);
   }
+  // #630 — the branches the spec ENUMERATES must each have a scenario. Narrative guidance for
+  // this already existed and was missed three times in three flows, so the check is an enforced
+  // enumeration rather than another sentence.
+  {
+    const branches = specBranches(readText(specPath) ?? '');
+    for (const b of unenumeratedBranches(branches, featureText).slice(0, 6)) {
+      findings.push(`SPEC-BRANCH-UNCOVERED: the spec enumerates "${b.label}" (${b.source}) and no scenario cites it. A mutually-exclusive branch is only covered when its OWN arm is verified — covering a sibling arm proves nothing about this one. Write it, or record the exclusion in the feature so the omission is a decision.`);
+    }
+    for (const c of sameOracleClusters(scenarios).slice(0, 4)) {
+      findings.push(`BRANCH-OVERCLAIMED: ${c.scenarios.length} scenarios assert an identical oracle (${c.scenarios.slice(0, 3).join(' | ')}${c.scenarios.length > 3 ? ' …' : ''}) — "${c.oracle}". They verify one branch several times while the coverage sheet counts them as ${c.scenarios.length}. Give each the assertion that distinguishes ITS branch, or merge them.`);
+    }
+  }
+  // #651 F1-7 — the fixed risk catalog, reconciled. SPEC-BRANCH-UNCOVERED enforces the branches a
+  // spec DECLARES; this is the half a spec is often silent about, which a reviewer catches and a
+  // generator does not. Consideration counts from anywhere the author reasons — a declared flow's
+  // branch point or reason, a scenario, the viewpoint — so "thought about, does not apply" is a
+  // one-line answer rather than a scenario nobody needs.
+  if (flowQ.hasContract) {
+    const unconsidered = unconsideredRisks(flowQ.contract!, scenarios, viewpointText);
+    if (unconsidered.length > 0) {
+      const list = unconsidered.map((r) => `${r.label} (${r.why})`).join(' · ');
+      findings.push(`RISK-FAMILY-UNCONSIDERED: ${unconsidered.length} of ${MULTI_SCREEN_RISK_COUNT} multi-screen risk families are not mentioned anywhere in this flow's contract, viewpoint or scenarios — ${list}. Each is a question, not a demand: if it does not apply here, record that in the \`flows:\` inventory as \`out-of-scope\` with the reason and it stops being asked. A flow is "enough" when every family has an answer, and a silent family is the one nobody weighed.`);
+    }
+  }
+  // #630 — a deny-side security case with no allow-side counterpart cannot tell a working guard
+  // from a feature that is broken for everyone.
+  for (const g of permissionPairGaps(scenarios).slice(0, 4)) {
+    findings.push(`PERMISSION-PAIR-MISSING: "${g.scenario}" proves the content is hidden when permission is denied, but no scenario proves it is SHOWN when permission is granted. If the code hid it unconditionally this would still pass — the pair is the test, the way min-1/min/max/max+1 is the test for a boundary. Add the allow-side case${g.subject.length ? ` for [${g.subject.join(', ')}]` : ''}.`);
+  }
+  // #630 — a scenario blocked on unseeded data is a DATA task, not unfinished test design.
+  {
+    const tdDir = path.join(screenDir, 'test-data');
+    let tdText = '';
+    try {
+      for (const f of fs.readdirSync(tdDir).filter((x) => x.endsWith('.yaml'))) tdText += `${readText(path.join(tdDir, f)) ?? ''}\n`;
+    } catch { /* no test-data yet */ }
+    for (const a of awaitingSeedData(tdText, scenarios).slice(0, 4)) {
+      findings.push(`AWAITING-SEED-DATA: \`${a.key}\` is still a placeholder and ${a.scenarios.length} scenario(s) reference it (${a.scenarios.slice(0, 2).join(' | ')}${a.scenarios.length > 2 ? ' …' : ''}). These are Pending for a DATA reason, not an unresolved design — seed the value (or move it to \`<unit>.<env>.yaml\`) and they become runnable as written.`);
+    }
+  }
   // #622 — a claim that names a count, proved by fewer assertions than it names. The count sits
   // in the viewpoint CLAIM, so both the title-level and the claim-level shape are checked.
   for (const g of ledger.partial.slice(0, 5)) {
@@ -791,7 +856,12 @@ export function runAudit(screenDir: string, screenName: string): AuditReport {
       // flow) that carried no weight at all.
       axes: axisDefs.map((a) => ({ ...a, weight: a.applicable ? a.weight / weightSum : 0 })),
       formula: `overall = (${scored.map((a) => `${(a.weight / weightSum).toFixed(2)}*${a.key}`).join(' + ')}) * 10`
-        + (missingEvidence.length ? ` — n/a (no evidence): ${missingEvidence.join(', ')}` : '')
+        + (() => {
+          const held = new Set(axisDefs.filter((a) => a.withheld).map((a) => a.key));
+          const absent = missingEvidence.filter((k) => !held.has(k.replace(/ .*$/, '')));
+          return (absent.length ? ` — n/a (no evidence): ${absent.join(', ')}` : '')
+            + (held.size ? ` — measured but held: ${[...held].join(', ')}` : '');
+        })()
         + (notApplicableByDesign.length ? ` — n/a for this unit kind: ${notApplicableByDesign.join(', ')}` : ''),
     },
     gateStatus,