@tiphys/kernel 0.1.0 → 0.2.0

package/dist/src/checks.d.ts

@@ -755,6 +755,620 @@ export declare function unresolvableCitationTree(contextDirectory: string, path:
 export declare const DECORRELATION_DIMENSIONS: readonly string[];
 /** The merge-authority value that makes decorrelation a precondition of merge. */
 export declare const DELEGATED_MERGE_AUTHORITY = "delegated-under-conditions";
+/**
+ * SAY WHAT `produced-by` ACTUALLY COMPARED, ON THE GREEN LINE (CR-VS-003).
+ *
+ * The comparison is `canonicalScalar`: NFKC, whitespace collapse, lowercase,
+ * then `!==`. Reproduced at the swept head with one variable changed: two
+ * `produced-by` strings naming two different MODELS of one vendor, in the
+ * vendor-plus-model-plus-organisation form this project's own reviews use, are
+ * certified "distinct on produced-by", green, exit 0. Two models of ONE family
+ * pass as decorrelated, which is T-001's own property failing inside the
+ * kernel's decorrelation check. The two strings are quoted verbatim in the
+ * sweep evidence rather than here, because no vendor model name may appear in
+ * the kernel's shipped surface (test/schemas.test.ts:800).
+ *
+ * WHY THIS IS A SENTENCE AND NOT A FAMILY VOCABULARY, and the reason is a
+ * settled one rather than an omission. M4-P10 deferred the family comparison to
+ * M4-P11 (delivery/work-history/m4-p10.md:654); M4-P11 DECLINED the mechanism in
+ * its own words, "a closed enum of family names was rejected: no such vocabulary
+ * can be kept current" (delivery/work-history/m4-p11.md:142). That reason holds
+ * and shipping the enum that phase rejected would be reopening it by the back
+ * door. What was never done is the OTHER half of the reviewer's own proposal:
+ * stop the green line reading as a cross-family assertion. A bundle-level green
+ * saying "distinct on produced-by" is read as "two families reviewed this", and
+ * nothing here establishes that. So the line now says what it measured.
+ *
+ * WHAT WOULD CLOSE IT, named rather than left open: a `produced-by-family`
+ * field in `schemas/verdict.schema.json`, required, compared instead of the free
+ * string, with the vocabulary OPEN (any two distinct values decorrelate) so no
+ * list has to be kept current. That is a schema change and a decision record,
+ * both outside this fix round's declared files.
+ */
+export declare function producedByCaveat(compared: readonly string[]): string;
+export interface LoadedVerdict {
+    path: string;
+    record: Record<string, unknown>;
+}
+/**
+ * What reading a candidate document's own `kind` produced, in the THREE
+ * outcomes that fix round 2 exists to keep apart.
+ *
+ * THE MECHANISM FIX ROUND 2 CLOSES: `establishField` already separates ABSENT
+ * from UNUSABLE from UNCANONICAL, and both selection sites consumed it with a
+ * single `!== "established"`, which folds those outcomes back into one silent
+ * skip. So "this document declares no type" and "this document declares a type
+ * nobody could read" printed as the same fact, and that fact is the determinate
+ * negative "not a verdict". Measured at the round-1 head: a third review
+ * reading `verdict: FIX-ROUND-NEEDED` whose `kind:` was a one-element YAML list
+ * was dropped and `scripts/check-dual-review.mjs` reported that the pair
+ * approves. Eight deformations of one refusing document reached that same
+ * green, and the table is in delivery/work-history/m4-p10.md's section 13.
+ *
+ * WHERE THE LINE IS DRAWN, and it is drawn at the PRESENCE OF THE KEY rather
+ * than at the validity of its value:
+ *
+ *   `verdict`     the key is there and canonicalises to the word. A member.
+ *   `other`       the document ANSWERED and the answer is not `verdict`. That
+ *                 is a mapping carrying no `kind` key at all, a document that
+ *                 is not a mapping (a list, a scalar, an empty file), and a
+ *                 `kind` that reads as some other word. Each is a determinate
+ *                 negative: nothing here claims to be a typed document, or it
+ *                 claims to be a different one.
+ *   `unreadable`  the key IS there and its reading failed: a list, a map, a
+ *                 number, a boolean, null, an empty or whitespace-only string,
+ *                 or a string carrying a character outside printable ASCII.
+ *                 Writing a `kind` key is the claim to be a typed document, so
+ *                 a failed reading of it is a failed claim, not an absent one.
+ *
+ * WHY NOT REFUSE EVERY DOCUMENT THAT IS NOT A VERDICT. Because a project is
+ * entitled to keep other YAML beside its reviews, and a check that errored on
+ * it would be unusable. The property is not that every file is a verdict; it is
+ * that a file which LOOKS LIKE a verdict and could not be read as one is NAMED.
+ *
+ * EXPORTED, and that is the other half of the fix. `scripts/check-dual-review.mjs`
+ * had its OWN selection rule, a raw `value["kind"] !== "verdict"`, which is a
+ * second reader of one fact: it dropped `kind: Verdict` and `kind: "  verdict  "`
+ * that this file's canonicalisation admits. Two readers of one fact is the shape
+ * this repository's fix-round contract calls fixing the INSTANCE rather than the
+ * MECHANISM, and the sibling `establishDelegatedRegime` one screen down was
+ * lifted for exactly that reason. There is now one reader.
+ */
+export type VerdictKindReading = {
+    kind: "verdict";
+    record: Record<string, unknown>;
+} | {
+    kind: "other";
+} | {
+    kind: "unreadable";
+    found: string;
+};
+export declare function readVerdictKind(value: unknown): VerdictKindReading;
+/**
+ * WHERE A CORPUS WAS READ FROM, carried WITH the corpus and never assumed.
+ *
+ * THE MECHANISM THIS TYPE EXISTS TO CLOSE (M4-P11 fix round 1, CR-M4P11-001
+ * and CR-M4P11-002). One decision was assembled out of TWO SOURCES OF TRUTH:
+ * the declaration was read from the git object database by
+ * `readReviewFamilies`, and the corpus that is supposed to refute it was read
+ * from the WORKING TREE. Two sources means the two halves can be made to
+ * disagree, and the actor the check exists to guard against controls the half
+ * that is not committed.
+ *
+ * Measured by the reviewer at ONE commit, three arms, only the working tree
+ * changing: all verdicts present gave red exit 1; an UNCOMMITTED `rm` of the
+ * contradicting verdict gave not-applicable exit 20 with the exception
+ * GRANTED; copying the file back gave red again. `git ls-tree` listed the file
+ * throughout and `git show` still read `produced-by: family-b` from it. The
+ * declaration was tamper-EVIDENT and the evidence that refutes it was not.
+ *
+ * So the source is decided ONCE per load and travels with the result, and
+ * every sentence a check prints about a corpus ends with the source it was
+ * actually read from. A reader can tell a claim about a commit from a claim
+ * about somebody's working tree, which is SC-011 applied to the CORPUS rather
+ * than to a single check's verdict.
+ */
+export type VerdictCorpusSource = {
+    kind: "commit";
+    ref: string;
+    refSha: string;
+    scope: string;
+} | {
+    kind: "worktree";
+    reason: string;
+    scope: string;
+};
+/**
+ * The corpus, plus the source it was read from. Never one without the other.
+ *
+ * `unexaminable` IS M4-P10 FIX ROUND 2's CHANNEL, CARRIED ACROSS M4-P11's
+ * RESTRUCTURE RATHER THAN DROPPED. M4-P10 added it to the single filesystem
+ * loop this phase replaced with a commit arm and a worktree arm, and every
+ * caller seeds its violation list from it. A candidate that passed the
+ * extension filter and could not be read, did not decode, or declares a `kind`
+ * whose reading failed is NOT the determinate answer "not a verdict": it is
+ * "nobody knows whether this is a verdict", and dropping it SHRINKS the set the
+ * merge predicates reason over, which is the fail-open direction for a
+ * predicate that approves when the set is clean.
+ */
+export interface LoadedVerdictCorpus {
+    verdicts: LoadedVerdict[];
+    unexaminable: Diagnostic[];
+    source: VerdictCorpusSource;
+}
+/**
+ * How to name the set a check just looked at, in the check's own output.
+ *
+ * SC-011 one scope out: "every verdict this project has committed" and "every
+ * file that happens to be sitting in one directory right now" are different
+ * claims and must not print the same sentence. This renders a TRAILING
+ * parenthetical rather than a clause in the middle of one, so a sentence that
+ * already names its subject keeps its shape and gains a provenance tail.
+ */
+export declare function describeVerdictCorpusSource(source: VerdictCorpusSource): string;
+/**
+ * How to name the source ONE context document was looked for in.
+ *
+ * FIX ROUND 2, DV-001. The regime report line used to say "no charter.yaml"
+ * about a directory with a `charter.yaml` sitting in it, because the probe had
+ * moved to the commit and the sentence had not. A record that names a document
+ * and not the SOURCE it was looked for in is unfalsifiable by the person
+ * reading it, which is the same SC-011 property `describeVerdictCorpusSource`
+ * exists for one scope out.
+ */
+export declare function describeContextDocumentSource(source: VerdictCorpusSource): string;
+/**
+ * The verdict documents a PAIR decision is made over: `delivery/review/`.
+ *
+ * TWO ARMS, AND WHICH ONE RAN IS REPORTED RATHER THAN INFERRED.
+ *
+ * THE COMMIT ARM is taken whenever `<context>` resolves `ref`, and it reads
+ * the directory's entries out of the git object database. The filesystem is
+ * not consulted at all, so an uncommitted addition, deletion or edit cannot
+ * change what this returns. That is the anti-widening rule
+ * `readReviewFamilies` and `loadDeclaration` (src/gates/release.ts:817)
+ * already apply to a DECLARATION, now applied to the evidence beside it. It
+ * closes both directions of the same hole: an uncommitted DELETION can no
+ * longer remove a verdict that contradicts a declaration, and an uncommitted
+ * ADDITION can no longer manufacture the pair DR-0012 condition 2 requires.
+ *
+ * THE WORKTREE ARM is taken only when there is no resolvable ref, which is the
+ * pre-existing behaviour for a context that is not a git repository at all,
+ * and it SAYS SO in every sentence it produces. No exception can be granted on
+ * this arm, because `readReviewFamilies` resolves the same ref and returns
+ * absent or error when it cannot: with no git there is one source of truth and
+ * nothing to disagree.
+ *
+ * THE SCOPE STAYS `delivery/review/` HERE, and widening it was measured wrong.
+ * `headGroupFor` turns this set into the reviews of one `(phase, head)`, and
+ * five of the seven verdict documents in this repository's tree are fixtures
+ * for this check's own tests. See `PAPERWORK_ROOT` above; the widest set is
+ * what the FALSIFIERS use, and it is a different question.
+ *
+ * A file that does not carry `kind: verdict` is SKIPPED rather than reported,
+ * because that directory also holds this project's prose reviews and a check
+ * that reddened on a markdown file would be unusable. What is NOT skipped is
+ * the directory being unreadable, which the caller turns into a violation:
+ * "nothing to compare" and "could not look" are different facts.
+ *
+ * AND A CANDIDATE THAT COULD NOT BE LOOKED AT IS THE SECOND HALF OF THAT SAME
+ * SENTENCE, WHICH THE FIRST ROUND WROTE AND APPLIED AT ONE SITE ONLY. A
+ * `.yaml`, `.yml` or `.json` file here has passed the only filter that
+ * separates a candidate verdict from a prose review, so bytes that cannot be
+ * READ and bytes that do not DECODE are not "this is not a verdict", they are
+ * "nobody knows whether this is a verdict". Dropping such a file SHRINKS the
+ * set the merge predicates reason over, which is the fail-open direction for a
+ * predicate that approves when the set is clean: measured at the reviewed head,
+ * a third review reading FIX-ROUND-NEEDED with one malformed line left
+ * `verdict-pair-approves` printing that the pair approves. So they are returned
+ * as diagnostics and every caller seeds its violation list with them, exactly
+ * as `headGroupFor` already does for a sibling with no usable head.
+ */
+export declare function loadCommittedVerdicts(contextDirectory: string, source?: VerdictCorpusSource): ({
+    ok: true;
+} & LoadedVerdictCorpus) | {
+    ok: false;
+    reason: string;
+};
+/**
+ * Resolve, ONCE, the source every document of one decision is read from.
+ *
+ * EXPORTED because the two merge-precondition checks each resolve it at the
+ * top of their own run and hand the SAME value to the regime reader, the
+ * declaration reader and both corpus loaders. One resolution is what makes
+ * "the halves disagree" unrepresentable rather than merely unlikely.
+ */
+export declare function resolveCorpusSource(contextDirectory: string, ref?: string): VerdictCorpusSource;
+/**
+ * THE MECHANISM THIS SECTION CLOSES, STATED ONE LEVEL UP FROM THE FINDING:
+ * a gate whose verdict is about EVIDENCE THE CALLER SUPPLIED, with no check
+ * that the evidence is about the thing being audited.
+ *
+ * `headGroupFor` above groups by the head THE VERDICT DOCUMENTS THEMSELVES
+ * DECLARE. Before this section nothing compared that value to the commit the
+ * gate was running against, and nothing established that it named a commit at
+ * all. Both arms were reproduced end to end through the shipped script:
+ *
+ *   ARM A  two decorrelated APPROVE verdicts naming
+ *          deadbeefdeadbeefdeadbeefdeadbeefdeadbeef, which
+ *          `git cat-file -t` reports as not an object, in a repository whose
+ *          HEAD is a real commit          -> GREEN, 2 units, exit 0
+ *   ARM B  the same verdicts plus a further commit of work no verdict
+ *          mentions                       -> GREEN, exit 0
+ *
+ * So ONE committed approving pair turned this gate green for that phase at
+ * every later head, indefinitely, on evidence about one old commit. That is
+ * T-009's own rule ("a gate result is evidence only for the configuration it
+ * ran under") failing inside the gate that carries DR-0012's merge grant.
+ *
+ * THE ASYMMETRY THAT MAKES THE FIX SOUND, and it is the whole of the design.
+ * The AUDITED head comes from the CALLER: the gate runner passes `--head` from
+ * the pull-request event (the registry entry now declares `parameters: [head]`,
+ * the same mechanism `scope` has always used), and with no `--head` it is the
+ * commit the context's own `HEAD` resolves to, which is what the checkout put
+ * there. The DECLARED head comes from a document an agent under review wrote.
+ * One of those two is a fact about the run and the other is a claim in the
+ * evidence, and the claim must be measured against the fact rather than
+ * replacing it.
+ */
+/** Resolve one ref to a full commit sha inside a context directory. */
+export declare function resolveCommitIn(contextDirectory: string, ref: string): {
+    ok: true;
+    sha: string;
+} | {
+    ok: false;
+    reason: string;
+};
+/**
+ * The commit a merge gate's verdict is ABOUT.
+ *
+ * THREE OUTCOMES AND NOT TWO, for the same reason `RegimeOutcome` has three:
+ * "there is no commit to anchor to" and "the anchor could not be established"
+ * are different facts. `unanchored` is reached only on the WORKTREE arm with
+ * no `--head`, which is a context that is not a git repository at all, and
+ * every sentence built from it says so rather than implying an anchor that was
+ * never taken.
+ */
+export type AuditedHead = {
+    kind: "anchored";
+    head: string;
+    how: string;
+} | {
+    kind: "unanchored";
+    reason: string;
+} | {
+    kind: "error";
+    reason: string;
+};
+export declare function resolveAuditedHead(contextDirectory: string, requested: string | undefined, source: VerdictCorpusSource): AuditedHead;
+/**
+ * THE MECHANISM THIS SECTION CLOSES, and it is the anchor above written one
+ * relation too narrow: AN ANCHOR EXPRESSED AS EQUALITY WHERE THE RELATION THAT
+ * CAN ACTUALLY HOLD IS ANCESTRY PLUS A CONSTRAINT ON WHAT CHANGED IN BETWEEN.
+ *
+ * `partitionByAuditedHead` compared the declared head to the audited one with
+ * `===`, and no real flow can satisfy that. A reviewer reads commit X and
+ * writes a verdict naming X; COMMITTING that verdict produces X+1; CI audits
+ * X+1, or a merge commit above it. The declared head is therefore ALWAYS a
+ * strict ancestor of the audited one, so under equality every real run reported
+ * not-applicable. Measured on the branch that introduced the anchor, at
+ * 5867a918cda809f7c5d4bc366fc7940458c140c0: the verdicts declared that commit,
+ * the gate audited its DIRECT CHILD 0ddd06a73d49c1910449d01303bc9c2579f5f492,
+ * and the record read not-applicable, exit 21, "is a review of other work and
+ * is not evidence about this head".
+ *
+ * That is the same cannot-do-its-job shape one status along from the defect the
+ * anchor fixed: "green forever once fed" became "never green", and a gate that
+ * cannot go green is as uninformative as one that cannot go red (T-008's own
+ * rule, applied to the other pole).
+ *
+ * WHAT MAKES THE RELAXATION SAFE, AND IT IS THE WHOLE DESIGN. Ancestry ALONE
+ * would restore the original defect wearing a different hat: an approving pair
+ * lands, and every later descendant carries it, including descendants full of
+ * unreviewed source. So ancestry is admitted only when the TREES agree
+ * everywhere except the project's own paperwork root. A verdict is evidence
+ * about the SHIPPED CONTENT it read, and if that content is byte-identical in
+ * the audited commit then the audited commit is the thing the reviewer
+ * approved, whatever paperwork was committed on top of it.
+ *
+ * IT IS A CLAIM ABOUT THE TWO TREES, NOT ABOUT EACH INTERVENING COMMIT, and
+ * the difference is stated rather than left to be discovered. `git diff
+ * --name-only <declared>..<audited>` compares the endpoints, so a commit that
+ * adds `src/x.ts` and a later one that removes it leave no entry and are
+ * admitted, where a per-commit enumeration would refuse them. That case is
+ * admitted DELIBERATELY: the audited tree's shipped content is then exactly
+ * what the reviewers read, which is the property the gate is protecting. A
+ * per-commit walk would refuse an ordinary revert-before-merge and buy nothing,
+ * because there is no shipped byte in the audited tree that no verdict covers.
+ *
+ * `--no-renames` IS LOAD-BEARING. With rename detection on (git's default for
+ * `git diff` since 2.9) a rename from `src/a.ts` to `delivery/b.md` prints the
+ * DESTINATION ONLY, so the deletion of a source file would be invisible and the
+ * gap would read as paperwork. Disabling it prints both sides.
+ */
+/** How a verdict's declared head stands to the commit under audit. */
+export type HeadRelation = 
+/** The verdict names the audited commit itself. */
+{
+    kind: "same";
+}
+/** A strict ancestor whose gap to the audited commit is paperwork only. */
+ | {
+    kind: "evidence-only-ancestor";
+    changed: string[];
+}
+/** A strict ancestor, but shipped content changed in between. */
+ | {
+    kind: "shipped-change";
+    shipped: string[];
+}
+/** A real commit here that the audited commit is an ancestor OF. */
+ | {
+    kind: "descendant";
+}
+/** A real commit here on neither side of the audited one. */
+ | {
+    kind: "unrelated";
+}
+/** Forty hex digits naming no commit in this repository. */
+ | {
+    kind: "unresolvable";
+    reason: string;
+}
+/** git could not answer, so the relation is not known. Never admitted. */
+ | {
+    kind: "undetermined";
+    reason: string;
+};
+/**
+ * Place one declared head against the commit under audit.
+ *
+ * EQUAL PASSES, unchanged, and it is checked first so a context git cannot be
+ * questioned about still answers the one relation that needs no git at all.
+ *
+ * A DESCENDANT IS REFUSED, and it has its own sentence rather than being folded
+ * into "not an ancestor". A verdict naming a commit BELOW the audited one is a
+ * review of work the audited commit does not contain, which is the fail-open
+ * direction stated backwards: the reviewers saw more than is being merged, and
+ * nothing here establishes that what they approved about the extra work says
+ * anything about the tree without it.
+ */
+export declare function relateDeclaredHead(contextDirectory: string, declared: string, auditedHead: string): HeadRelation;
+/** A verdict admitted to the audited corpus, and the relation that admitted it. */
+export interface AdmittedVerdict {
+    path: string;
+    declared: string;
+    relation: HeadRelation;
+}
+/** One verdict that is not about the audited commit, and why it is not. */
+export interface OffHeadVerdict {
+    path: string;
+    declared: string;
+    /** Which route refused it. Printed, never summarised to a boolean. */
+    relation: HeadRelation;
+}
+/** The corpus split by the commit under audit. */
+export interface HeadPartition {
+    onHead: LoadedVerdict[];
+    /**
+     * The same verdicts, with the relation that admitted each one.
+     *
+     * CARRIED SEPARATELY RATHER THAN ATTACHED TO `onHead`, because `onHead` is
+     * the set the checks are RUN OVER and its element type is what every other
+     * caller of the loader consumes. This is the DISCLOSURE half: a green reached
+     * through ancestry and a green reached through equality are different facts,
+     * and a gate that printed one sentence for both would be the unfalsifiable
+     * record `describeVerdictCorpusSource` exists to stop, one relation along.
+     */
+    admitted: AdmittedVerdict[];
+    offHead: OffHeadVerdict[];
+    /**
+     * Verdicts whose own `head` could not be established at all, as DOCUMENTS
+     * and as the sentences that name them.
+     *
+     * BOTH SHAPES, because the two callers need different halves and deriving one
+     * from the other by matching on a message prefix is the string-parsing shape
+     * this file refuses everywhere else. A caller that keeps them in the corpus
+     * needs the documents; a caller that reports them needs the sentences.
+     */
+    unkeyed: Diagnostic[];
+    unkeyedVerdicts: LoadedVerdict[];
+}
+/**
+ * Split a loaded corpus into the verdicts that are about the audited commit
+ * and the ones that are not.
+ *
+ * FIVE REFUSAL ROUTES, AND THEY ARE STRUCTURALLY DIFFERENT RATHER THAN ONE
+ * SHAPE FIVE TIMES, which is what makes them members of a class instead of
+ * instances of a finding:
+ *
+ *   RESOLUTION   the declared head is not a commit in this repository. The
+ *                document is evidence about an object nobody can produce.
+ *   SHIPPED GAP  the declared head IS an ancestor, and shipped content changed
+ *                between it and the audited commit. Unreviewed work is riding
+ *                in on a review of something else.
+ *   DESCENDANT   the declared head is BELOW the audited commit. The reviewers
+ *                read a tree the audited commit does not contain.
+ *   UNRELATED    a real commit on neither side. A review of another line.
+ *   UNDETERMINED git could not place it. Never admitted, because a relation
+ *                nobody established must not read as the one that passes.
+ *
+ * ADMISSION IS TWO ROUTES AND THEY ARE ALSO PRINTED: the declared head IS the
+ * audited commit, or it is an ancestor whose whole gap is paperwork. See
+ * `relateDeclaredHead` for why the second is safe and for what it deliberately
+ * does not refuse.
+ *
+ * Every refusal leaves the verdict out of the audited group and IS PRINTED with
+ * the route it took, because a document silently dropped from a merge
+ * corpus is the fail-open direction this file has already been bitten by at
+ * `loadCommittedVerdicts`, at the `phase` canonicalisation and at
+ * `headGroupFor`. A reader is owed the fact that the corpus holds two
+ * approving reviews of something else.
+ */
+export declare function partitionByAuditedHead(contextDirectory: string, verdicts: readonly LoadedVerdict[], auditedHead: string): HeadPartition;
+/** One operator-facing line per verdict the audit excluded, naming its route. */
+export declare function describeOffHeadVerdicts(offHead: readonly OffHeadVerdict[], auditedHead: string): string[];
+/** One operator-facing line per verdict the audit ADMITTED, naming its route. */
+export declare function describeAdmittedVerdicts(admitted: readonly AdmittedVerdict[], auditedHead: string): string[];
+/** The charter field DR-0038's declaration lives in (M4-D-28). */
+export declare const REVIEW_FAMILIES_FIELD = "review-families";
+/** The document that carries it. */
+export declare const CHARTER_DOCUMENT = "charter.yaml";
+/**
+ * The documents that say WHICH merge-authority regime is in force.
+ *
+ * MOVED HERE FROM `scripts/check-dual-review.mjs` (FIX ROUND 2, DV-001). The
+ * script held its own copy of this list AND its own presence probe, and the
+ * probe read the WORKING TREE while `establishDelegatedRegime` read the
+ * COMMIT. Two probes of one fact against two sources is the mechanism this
+ * phase has now paid for twice: each answered correctly about its own source,
+ * so nothing ever reported a disagreement, and an uncommitted `charter.yaml`
+ * took the gate from error to GREEN on a correlated committed pair.
+ */
+export declare const REGIME_DOCUMENTS: string[];
+/**
+ * The first regime document that is NOT present at the source a decision over
+ * this context would be made from, or `undefined` when both are.
+ *
+ * WHY THE REFUSAL LIVES AT THE MERGE GATE AND THE REPORT LIVES IN THE CHECK,
+ * unchanged from M3-P9 and restated because this round moved the probe: the
+ * derived check runs on ANY verdict with ANY context, and M3-P7's verdict
+ * contexts carry a plan and a work history and no charter, so a check that
+ * reddened on an absent charter reddened eight of that phase's tests. The
+ * check therefore REPORTS, and `scripts/check-dual-review.mjs`, which is the
+ * command DR-0012's grant runs through, refuses. What changed is that the
+ * refusal and the report are now ONE probe with two callers, so they cannot
+ * answer about different sources.
+ *
+ * THE SOURCE IS A PARAMETER, not resolved here, so a caller that has already
+ * resolved one (the gate script resolves it when it loads the corpus) refuses
+ * against the SAME commit it read the verdicts from rather than a second
+ * `rev-parse` that could land elsewhere.
+ */
+export declare function missingRegimeDocument(contextDirectory: string, source?: VerdictCorpusSource): {
+    document: string;
+    source: VerdictCorpusSource;
+    reason: string;
+} | undefined;
+/**
+ * Where a declaration was read from, so a claim nobody can refute is at least
+ * ATTRIBUTABLE AND DATED.
+ *
+ * This is the honest half of DR-0038's third constraint. Two falsifiers below
+ * catch a project whose own record contradicts the declaration. NEITHER of
+ * them catches a project that HAS a second family available and has simply
+ * never used it, and nothing inside the record can: the record holds what was
+ * used, not what was reachable. So the countermeasure for that residue is
+ * provenance rather than detection, on the src/gates/release.ts:1028 pattern,
+ * and the gap is stated here rather than left to be found.
+ */
+export interface ReviewFamiliesProvenance {
+    /** The path inside the commit, as `git show` was asked for it. */
+    path: string;
+    /** The ref the declaration was read from, as the caller spelled it. */
+    ref: string;
+    /** That ref resolved to a commit sha. */
+    refSha: string;
+    /** sha256 of the exact blob bytes the declaration was decoded from. */
+    sha256: string;
+}
+/**
+ * What reading `review-families` produced.
+ *
+ * THREE OUTCOMES AND NOT TWO, for the reason `RegimeOutcome` gives one screen
+ * up: "no declaration" and "a declaration that could not be established" are
+ * different facts. The first leaves DR-0012 condition 1 applying unchanged,
+ * which is a REPORT-nothing. The second is an ERROR, because a check that
+ * cannot establish whether an exception applies must never decide that it does
+ * not apply and carry on (M2-C-3).
+ */
+export type ReviewFamiliesReading = {
+    kind: "absent";
+} | {
+    kind: "error";
+    reason: string;
+} | {
+    kind: "declared";
+    /** Canonicalised, deduplicated by construction, sorted. Compared. */
+    families: string[];
+    /** The operator's own spelling, in document order. Printed. */
+    declaredAs: string[];
+    reason: string;
+    provenance: ReviewFamiliesProvenance;
+};
+/**
+ * Read DR-0038's declaration OUT OF THE GIT OBJECT DATABASE, never out of the
+ * working tree.
+ *
+ * WHY THE COMMITTED BLOB IS THE ONLY ONE THAT COUNTS. This is the anti-widening
+ * rule the scope auditor and `loadDeclaration` (src/gates/release.ts:817) both
+ * already apply, one condition along: a phase must not be able to switch off,
+ * inside its own working tree, the condition that would otherwise have refused
+ * its merge. A declaration read from disk is one an implementer can add,
+ * merge under, and delete, leaving a merged head whose record says the
+ * cross-family requirement was met.
+ *
+ * `HEAD:./charter.yaml` AND NOT `HEAD:charter.yaml`, and the difference is not
+ * cosmetic. A path without the leading `./` is resolved against the repository
+ * ROOT, so a context directory that happens to sit inside a larger repository
+ * (which every fixture staged under a checkout does) would silently read that
+ * repository's charter instead of its own. With `./` git resolves relative to
+ * the directory it was run in, which is the one the caller named.
+ */
+export declare function readReviewFamilies(contextDirectory: string, ref?: string): ReviewFamiliesReading;
+/** One line naming where a declaration came from, for a detail or a report. */
+export declare function reviewFamiliesProvenanceLine(provenance: ReviewFamiliesProvenance): string;
+/** What the single-family arm concluded about one committed corpus. */
+export type SingleFamilyOutcome = {
+    kind: "not-declared";
+} | {
+    kind: "error";
+    reason: string;
+} | {
+    kind: "refused";
+    violations: Diagnostic[];
+} | {
+    kind: "exempt";
+    family: string;
+    reading: Extract<ReviewFamiliesReading, {
+        kind: "declared";
+    }>;
+    reports: string[];
+};
+/**
+ * DR-0038's exception, and its two falsifiers, over one committed corpus.
+ *
+ * THE EXCEPTION NARROWS EXACTLY ONE DIMENSION. `produced-by` stops being
+ * required to differ. `framing` and `review-contract` are untouched, because
+ * T-007's whole finding is that model decorrelation and CONTRACT decorrelation
+ * are different properties: a single-family environment still has two framings
+ * and two contracts available to it, so relaxing those would be relaxing
+ * something the environment does not force.
+ *
+ * FALSIFIER 1, CONTRADICTION BY THE CORPUS. If the project's own committed
+ * verdicts carry two or more distinct canonicalised `produced-by` values, the
+ * declaration is contradicted by the project's own record and this is RED. A
+ * project that has demonstrably used two cannot claim one.
+ *
+ * FALSIFIER 2, THE NAME MUST MATCH. A verdict whose `produced-by` canonicalises
+ * to anything other than the declared family is RED. Without this, a
+ * declaration could name a family nothing in the record uses and still buy the
+ * relaxation.
+ *
+ * THE SCOPE IS THE WHOLE COMMITTED CORPUS, NOT THE ONE (phase, head) GROUP,
+ * and that is deliberate. "This project has one family available" is a claim
+ * about the project, so the widest set of its own verdicts is what can refute
+ * it. Scoping the falsifiers to the group under review would let a project
+ * whose history carries three families declare one, provided the two reviews
+ * in front of the check happened to agree.
+ *
+ * WHAT IT DOES NOT CATCH, said here and not only in the plan: a project with a
+ * second family AVAILABLE that has simply never used it. Nothing in a record of
+ * what WAS used reaches what COULD have been used. `readReviewFamilies` answers
+ * that with provenance rather than detection: the claim is attributable to a
+ * commit and a blob, so it is dated and signed even where it is not refutable.
+ */
+export declare function singleFamilyException(contextDirectory: string, loaded: LoadedVerdictCorpus): SingleFamilyOutcome;
 /**
  * DR-0012's merge precondition, made into a comparison a command can make
  * against the verdict FILES rather than against a session's memory (M3R-004).
@@ -790,17 +1404,114 @@ export declare const DELEGATED_MERGE_AUTHORITY = "delegated-under-conditions";
  * criteria contract. So `review-contract` is compared separately and is
  * witnessed separately (criterion 7b).
  *
- * WHAT IT DOES NOT REACH, named rather than left to be found. Condition (d) of
- * step 3b, that neither verdict carries an unresolved high or medium finding,
- * is NOT checked here: the verdict schema's own root `if`/`then` already
- * forbids APPROVE beside a high or critical finding, and "unresolved" is a
- * state of the review thread rather than of the document. Nothing here decides
- * whether the two verdicts describe the same HEAD either: the verdict schema
- * carries no head field, so `phase` is the join key and the DIRECTORY is what
- * scopes a set of verdicts to one head. Both are stated in
- * delivery/work-history/m3-p9.md as declared readings rather than absorbed.
+ * WHAT IT DOES NOT REACH, named rather than left to be found, AND BOTH ITEMS
+ * THIS PARAGRAPH USED TO NAME HAVE BEEN CLOSED BY M4-P10. The first was
+ * condition (d) of step 3b, that neither verdict carries an unresolved high or
+ * medium finding; that is now the sibling check `verdict-pair-approves`, and
+ * the schema's own root `if`/`then` was widened from [high, critical] to
+ * [medium, high, critical] at the same time, because it had been one severity
+ * narrower than DR-0012 condition 2 ever since it shipped. The second was that
+ * nothing decided whether two verdicts describe the same HEAD; the schema now
+ * requires `head` and this check groups by `(phase, head)`.
+ *
+ * WHAT IS STILL NOT REACHED, so the paragraph does not read as complete. This
+ * check compares `produced-by` as a canonicalised STRING, never as a model
+ * FAMILY, so two values naming one vendor pass as decorrelated; that was
+ * measured twice against this repository's own reviews and recorded at
+ * delivery/verification/m4-prototype-probes.md:1. THE DEFERRAL CHAIN FOR IT
+ * TERMINATED WITH NO OWNER, which is what CR-VS-003 found and what this
+ * paragraph used to hide: it said "closing it is M4-P11's declared scope", and
+ * M4-P11 declined the mechanism (delivery/work-history/m4-p11.md:142) and
+ * shipped the single-family EXCEPTION instead, which is a different question.
+ * No later phase picked it up. The string comparison therefore STANDS, and what
+ * the DR-0047 sweep changed is that the green line now says so: see
+ * `producedByCaveat`, which also names what would close it. And a
+ * `produced-by` line is written BY the reviewing agent, so it is forgeable; an
+ * observed alternative exists and is M4-D-06's business, not this check's.
  */
 export declare const dualReviewDecorrelation: DerivedCheck;
+/**
+ * The severities DR-0012 condition 2 bars an APPROVE from sitting beside.
+ *
+ * `low` is absent DELIBERATELY and the record says why:
+ * delivery/decisions/DR-0012-delegated-merge-authority.md:23 permits merging
+ * with a low finding provided it is fixed or tracked with a reason. The same
+ * three words are the escalation enum in `schemas/verdict.schema.json`, and the
+ * two must agree; M4-P10 widened both together, because the shipped pair had
+ * the schema stopping at `high` while the decision said `medium`.
+ */
+export declare const BLOCKING_SEVERITIES: readonly string[];
+/**
+ * DR-0012 CONDITION 2, MADE INTO A PREDICATE
+ * (delivery/decisions/DR-0012-delegated-merge-authority.md:23).
+ *
+ * WHAT WAS MISSING, stated as the gap rather than as a feature. Before this
+ * check, `scripts/check-dual-review.mjs` could not see a verdict's VALUE at
+ * all: measured against the whole of that script, `grep -c` returned 0 for
+ * `APPROVE`, 0 for `severity` and 0 for `findings`. So two properly
+ * decorrelated reviews that both REFUSED the merge passed the gate green, and
+ * so did an APPROVE sitting beside a finding the review itself ranked medium.
+ * Condition 1 looked checked and condition 2 was asserted by a human, which is
+ * the worse of the two states because it reads as progress.
+ *
+ * WHY IT IS A SEPARATE CHECK RATHER THAN MORE OF `dual-review-decorrelation`.
+ * They are different predicates over the same set, and section 2.3 rule 3's
+ * Kind B falsification is per-check: DEREGISTERING this one must make a
+ * refusing pair pass, which is only a witness if there is one id to deregister.
+ * Folding condition 2 into the decorrelation check would have made that
+ * witness unavailable and would have made one red indistinguishable from the
+ * other in the gate's output.
+ *
+ * WHY IT EVALUATES THE COMMITTED GROUP AND NEVER THE INSTANCE'S OWN FIELDS,
+ * which is the one place its shape differs from its sibling's. DR-0012
+ * condition 2 is a property of the two reviews WRITTEN TO `delivery/review/`
+ * AND COMMITTED. A document handed to this check that is not among them is not
+ * a review the grant can be satisfied by, and it also cannot break the
+ * predicate: what is asserted is about the committed set, which the stray
+ * document is not a member of. So there is no membership test here, and the
+ * empty case is not a hole: a `(phase, head)` selecting fewer than two
+ * committed verdicts is refused by the pair-size rule below.
+ *
+ * WHAT IT DOES NOT REACH, named rather than left to be found. "Unresolved" is
+ * a state of the review THREAD, and this check reads documents: a finding that
+ * was raised, fixed in a later round and left in the file still reddens here.
+ * That is the fail-closed direction and it is a real cost, paid deliberately,
+ * because the alternative is a resolution field an author sets on their own
+ * finding. Nothing here decides whether a `severity` was ranked honestly
+ * either; a review that calls a critical defect `low` passes, and no keyword
+ * reaches that.
+ */
+export declare const verdictPairApproves: DerivedCheck;
+/**
+ * THE SUBJECT ECHO AGREES WITH THE RESOLUTION IT SITS BESIDE, THE RECORD WAS
+ * WRITTEN AFTER THE TURN ENDED, AND AN OVERRIDE WAS PERMITTED BEFORE IT WAS
+ * APPLIED.
+ *
+ * All three compare SIBLING FIELDS of one document, so all three are Kind B
+ * and none of them is reachable from a keyword (schemas/README.md's Kind A and
+ * Kind B section, DR-0013 clause 8). The schema next door can require that
+ * `subject`, `turnEnd` and `resolution` are all PRESENT, which is what makes a
+ * launch-time record unrepresentable, and it stops exactly there: it cannot
+ * say that two present values agree.
+ *
+ * WHY THE ECHO MATTERS AT ALL, since a record that echoes itself sounds
+ * circular. It is not the record checking itself against itself. `subject` is
+ * a VERBATIM copy of the launch request the adapter was handed and
+ * `resolution` is what the adapter's resolver actually consumed, and the
+ * hazard is that those two diverge silently: a resolver that read the wrong
+ * role's row produces a perfectly well-formed record whose family token is
+ * then attributed to a task it was never about. That is the misattribution
+ * guard src/gates/schemas/release-record.schema.json:26 exists for, one seam
+ * along, and the kernel-side half of it is in src/model-resolution.ts where
+ * the request is compared against a copy the kernel itself holds.
+ *
+ * THE OVERRIDE DIRECTION IS THE ONE MOST LIKELY TO BE GOT WRONG. M4-P7
+ * criterion 7 wants BOTH directions: a role whose `charter-override` is
+ * `allowed` takes the charter's tier, and a role whose permission is anything
+ * else does not. The second direction is the one a resolver written from the
+ * happy path silently drops, because nothing about it looks like a failure.
+ */
+export declare const modelResolutionSubjectEcho: DerivedCheck;
 /** Register a check. Later phases append their own (section 2.3's table). */
 export declare function registerCheck(check: DerivedCheck): void;
 /** Remove a check by id. Returns whether one was removed. */