@ybotok/loam 0.1.0-beta.3 → 0.2.0-alpha.13

package/dist/core/capabilities/delta/overlay.js

@@ -0,0 +1,129 @@
+/**
+ * The fleet's capability vocabulary AS THIS FEATURE'S MERGE WOULD LEAVE IT —
+ * the living declarations unioned with what the feature's own capability deltas
+ * add.
+ *
+ * WHY THIS EXISTS AT ALL. Without it the axis's headline flow is refused by an
+ * error code of its own making. `capabilityRequirementIndex` builds from
+ * `vocab.tree.docs`, the LIVING tree, and `realizesUnknownIssues` runs against
+ * it inside a feature delta as an ERROR that gates archive. So an author who
+ * writes `CHECKOUT-REFUND-ONCE` into
+ * `features/FEAT-9/capabilities/checkout/spec.md` and
+ * `Realizes: checkout#CHECKOUT-REFUND-ONCE` into
+ * `features/FEAT-9/specs/billing/spec.md` — the two halves of one change, in one
+ * feature — is told the target does not exist. It does not exist YET, and the
+ * same archive that would land the pointer lands the promise it points at.
+ *
+ * THE GRADE IS TAKEN AGAINST THE POST-MERGE FLEET, which is the only reading
+ * under which both directions of the join mean anything inside a feature. It is
+ * the same judgement the contract axis already makes one axis over, where
+ * `spec-api.op-undefined` is graded against feature ∪ living rather than living
+ * alone.
+ *
+ * IT WIDENS; IT MUST NOT BLIND. Every entry naming something neither side
+ * declares still fails, with the same message and the same close-name
+ * candidates — now drawn from the widened set, so a typo against a requirement
+ * the same feature is adding gets the useful suggestion rather than a list of
+ * ids the author was not writing about.
+ *
+ * THE LADDER SURVIVES. An unreadable `architecture/capabilities.yaml` is still
+ * `invalid`, and `declared: null` still suspends the whole family: a feature
+ * delta cannot make an unreadable vocabulary readable, and grading a hundred
+ * entries against a file nobody can parse is the cascade `../findings.ts`
+ * suppresses.
+ */
+import { requirementDigest } from "../../document/spec.js";
+/**
+ * The vocabulary a feature's deltas would leave behind: every living
+ * declaration, plus every capability id this feature introduces.
+ *
+ * `present` widens too, and that is the point rather than a side effect: a
+ * feature writing the fleet's FIRST capability document is what creates
+ * `capabilities/`, so it is the act of opting in. Grading its own joins against
+ * the vocabulary it is about to create catches the typo before the merge; the
+ * alternative — silence until the document is living — reports the same typo on
+ * somebody else's next `validate --all`, against a document they did not write.
+ *
+ * `tree` is deliberately NOT widened. It lists the LIVING documents under
+ * `capabilities/`, and `capabilityRequirementIndex` reads every one of them and
+ * declares every non-REMOVED requirement it finds. Splicing a feature's delta
+ * path into that list would apply the living rule to a delta — which is right
+ * for ADDED and wrong for BASE, the kind a delta uses to QUOTE living context
+ * and that the merge never writes. The feature side arrives through
+ * `withFeatureRequirements` below instead, where the delta kinds decide.
+ *
+ * An id a feature introduces is recorded `source: "tree"` with no `spec`: the
+ * tree is the side that will declare it once the merge lands, and there is no
+ * living document to name yet. Nothing in the feature-grading path reads either
+ * field — they exist for the fleet-scope messages, which never see this value.
+ */
+export function withFeatureCapabilities(vocab, ids) {
+    if (ids.length === 0)
+        return vocab;
+    const byId = new Map(vocab.byId);
+    for (const id of ids) {
+        if (byId.has(id))
+            continue;
+        byId.set(id, { id, source: "tree" });
+    }
+    return { ...vocab, present: true, byId };
+}
+/**
+ * The `Realizes:` index a feature's deltas would leave behind: the living
+ * requirement ids per capability, plus the ids this feature ADDS or MODIFIES.
+ *
+ * ADDED and MODIFIED, never REMOVED and never BASE.
+ *
+ * BASE is where the exclusion earns its keep: a `## Requirements` section
+ * inside a delta QUOTES living context for a reader, and the merge never writes
+ * it — so an id appearing only there will not exist after the archive either,
+ * and widening on it would resolve a `Realizes:` in silence and leave the fleet
+ * holding a pointer at a promise nobody ever wrote.
+ *
+ * REMOVED is excluded for honesty rather than for effect. A REMOVED requirement
+ * that names something living is already in the index through the LIVING half,
+ * so leaving it out changes no answer; what it must not do is make a delta that
+ * removes something absent — already `delta.removed-unknown` — look resolvable
+ * on top of that.
+ *
+ * WHAT THIS DOES NOT CLOSE, stated because the shape invites the assumption: a
+ * feature that REMOVES a capability requirement a LIVING service requirement
+ * realizes archives clean, and the next `validate --all` reports
+ * `capability.realizes-unknown` against a service document nobody touched.
+ * Catching that needs the join taken in the other direction — the living
+ * `Realizes:` corpus against this feature's removals — which is the mirror of
+ * the ROADMAP's `capability.uncovered` and belongs with it, not here.
+ *
+ * A capability the feature introduces gets an entry even when its delta adds no
+ * requirements, and the empty set is a real answer rather than a filler: it is
+ * what tells `resolveRealizes` to say "declares no requirements yet" instead of
+ * "has no document at all", which are two different fixes.
+ *
+ * `declared === null` returns the index untouched — the ladder, one level down.
+ */
+export function withFeatureRequirements(index, deltas) {
+    if (index.declared === null || deltas.length === 0)
+        return index;
+    const byCapability = new Map(index.byCapability);
+    const digests = new Map(index.digests);
+    for (const delta of deltas) {
+        const ids = new Set(byCapability.get(delta.id) ?? []);
+        // The delta's OWN digest wins for a MODIFIED id: inside a feature window,
+        // the version a `Realizes:` pin should agree with is the one this feature
+        // is about to merge, not the living one it is replacing. Overwriting is
+        // therefore the point, not a collision.
+        const withDigests = new Map(digests.get(delta.id) ?? []);
+        for (const r of delta.reqs) {
+            if (r.kind !== "ADDED" && r.kind !== "MODIFIED")
+                continue;
+            if (r.id === undefined)
+                continue;
+            ids.add(r.id);
+            withDigests.set(r.id, requirementDigest(r));
+        }
+        byCapability.set(delta.id, ids);
+        digests.set(delta.id, withDigests);
+    }
+    return { declared: index.declared, byCapability, digests };
+}
+//# sourceMappingURL=overlay.js.map

package/dist/core/capabilities/delta/overlay.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"overlay.js","sourceRoot":"","sources":["../../../../src/core/capabilities/delta/overlay.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,OAAO,EAAE,iBAAiB,EAAoB,MAAM,wBAAwB,CAAC;AAY7E;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,uBAAuB,CACrC,KAA2B,EAC3B,GAAsB;IAEtB,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAqB,KAAK,CAAC,IAAI,CAAC,CAAC;IACrD,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;QACrB,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,SAAS;QAC3B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAC3C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,UAAU,uBAAuB,CACrC,KAAiC,EACjC,MAAyC;IAEzC,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACjE,MAAM,YAAY,GAAG,IAAI,GAAG,CAA8B,KAAK,CAAC,YAAY,CAAC,CAAC;IAC9E,MAAM,OAAO,GAAG,IAAI,GAAG,CAAsC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5E,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;QACtD,0EAA0E;QAC1E,0EAA0E;QAC1E,wEAAwE;QACxE,wCAAwC;QACxC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAiB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;QACzE,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;YAC3B,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU;gBAAE,SAAS;YAC1D,IAAI,CAAC,CAAC,EAAE,KAAK,SAAS;gBAAE,SAAS;YACjC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACd,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9C,CAAC;QACD,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QAChC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;AAC7D,CAAC","sourcesContent":["/**\n * The fleet's capability vocabulary AS THIS FEATURE'S MERGE WOULD LEAVE IT —\n * the living declarations unioned with what the feature's own capability deltas\n * add.\n *\n * WHY THIS EXISTS AT ALL. Without it the axis's headline flow is refused by an\n * error code of its own making. `capabilityRequirementIndex` builds from\n * `vocab.tree.docs`, the LIVING tree, and `realizesUnknownIssues` runs against\n * it inside a feature delta as an ERROR that gates archive. So an author who\n * writes `CHECKOUT-REFUND-ONCE` into\n * `features/FEAT-9/capabilities/checkout/spec.md` and\n * `Realizes: checkout#CHECKOUT-REFUND-ONCE` into\n * `features/FEAT-9/specs/billing/spec.md` — the two halves of one change, in one\n * feature — is told the target does not exist. It does not exist YET, and the\n * same archive that would land the pointer lands the promise it points at.\n *\n * THE GRADE IS TAKEN AGAINST THE POST-MERGE FLEET, which is the only reading\n * under which both directions of the join mean anything inside a feature. It is\n * the same judgement the contract axis already makes one axis over, where\n * `spec-api.op-undefined` is graded against feature ∪ living rather than living\n * alone.\n *\n * IT WIDENS; IT MUST NOT BLIND. Every entry naming something neither side\n * declares still fails, with the same message and the same close-name\n * candidates — now drawn from the widened set, so a typo against a requirement\n * the same feature is adding gets the useful suggestion rather than a list of\n * ids the author was not writing about.\n *\n * THE LADDER SURVIVES. An unreadable `architecture/capabilities.yaml` is still\n * `invalid`, and `declared: null` still suspends the whole family: a feature\n * delta cannot make an unreadable vocabulary readable, and grading a hundred\n * entries against a file nobody can parse is the cascade `../findings.ts`\n * suppresses.\n */\nimport { requirementDigest, type Requirement } from \"../../document/spec.js\";\nimport type { Capability, CapabilityVocabulary } from \"../capabilities.js\";\nimport type { CapabilityRequirementIndex } from \"../realizes/join.js\";\n\n/** One capability document a feature's delta carries, already parsed. */\nexport interface FeatureCapabilityDelta {\n  /** The capability id — the directory chain under `features/<FEAT>/capabilities/`. */\n  id: string;\n  /** The delta document's requirements, kinds and all. */\n  reqs: Requirement[];\n}\n\n/**\n * The vocabulary a feature's deltas would leave behind: every living\n * declaration, plus every capability id this feature introduces.\n *\n * `present` widens too, and that is the point rather than a side effect: a\n * feature writing the fleet's FIRST capability document is what creates\n * `capabilities/`, so it is the act of opting in. Grading its own joins against\n * the vocabulary it is about to create catches the typo before the merge; the\n * alternative — silence until the document is living — reports the same typo on\n * somebody else's next `validate --all`, against a document they did not write.\n *\n * `tree` is deliberately NOT widened. It lists the LIVING documents under\n * `capabilities/`, and `capabilityRequirementIndex` reads every one of them and\n * declares every non-REMOVED requirement it finds. Splicing a feature's delta\n * path into that list would apply the living rule to a delta — which is right\n * for ADDED and wrong for BASE, the kind a delta uses to QUOTE living context\n * and that the merge never writes. The feature side arrives through\n * `withFeatureRequirements` below instead, where the delta kinds decide.\n *\n * An id a feature introduces is recorded `source: \"tree\"` with no `spec`: the\n * tree is the side that will declare it once the merge lands, and there is no\n * living document to name yet. Nothing in the feature-grading path reads either\n * field — they exist for the fleet-scope messages, which never see this value.\n */\nexport function withFeatureCapabilities(\n  vocab: CapabilityVocabulary,\n  ids: readonly string[],\n): CapabilityVocabulary {\n  if (ids.length === 0) return vocab;\n  const byId = new Map<string, Capability>(vocab.byId);\n  for (const id of ids) {\n    if (byId.has(id)) continue;\n    byId.set(id, { id, source: \"tree\" });\n  }\n  return { ...vocab, present: true, byId };\n}\n\n/**\n * The `Realizes:` index a feature's deltas would leave behind: the living\n * requirement ids per capability, plus the ids this feature ADDS or MODIFIES.\n *\n * ADDED and MODIFIED, never REMOVED and never BASE.\n *\n * BASE is where the exclusion earns its keep: a `## Requirements` section\n * inside a delta QUOTES living context for a reader, and the merge never writes\n * it — so an id appearing only there will not exist after the archive either,\n * and widening on it would resolve a `Realizes:` in silence and leave the fleet\n * holding a pointer at a promise nobody ever wrote.\n *\n * REMOVED is excluded for honesty rather than for effect. A REMOVED requirement\n * that names something living is already in the index through the LIVING half,\n * so leaving it out changes no answer; what it must not do is make a delta that\n * removes something absent — already `delta.removed-unknown` — look resolvable\n * on top of that.\n *\n * WHAT THIS DOES NOT CLOSE, stated because the shape invites the assumption: a\n * feature that REMOVES a capability requirement a LIVING service requirement\n * realizes archives clean, and the next `validate --all` reports\n * `capability.realizes-unknown` against a service document nobody touched.\n * Catching that needs the join taken in the other direction — the living\n * `Realizes:` corpus against this feature's removals — which is the mirror of\n * the ROADMAP's `capability.uncovered` and belongs with it, not here.\n *\n * A capability the feature introduces gets an entry even when its delta adds no\n * requirements, and the empty set is a real answer rather than a filler: it is\n * what tells `resolveRealizes` to say \"declares no requirements yet\" instead of\n * \"has no document at all\", which are two different fixes.\n *\n * `declared === null` returns the index untouched — the ladder, one level down.\n */\nexport function withFeatureRequirements(\n  index: CapabilityRequirementIndex,\n  deltas: readonly FeatureCapabilityDelta[],\n): CapabilityRequirementIndex {\n  if (index.declared === null || deltas.length === 0) return index;\n  const byCapability = new Map<string, ReadonlySet<string>>(index.byCapability);\n  const digests = new Map<string, ReadonlyMap<string, string>>(index.digests);\n  for (const delta of deltas) {\n    const ids = new Set(byCapability.get(delta.id) ?? []);\n    // The delta's OWN digest wins for a MODIFIED id: inside a feature window,\n    // the version a `Realizes:` pin should agree with is the one this feature\n    // is about to merge, not the living one it is replacing. Overwriting is\n    // therefore the point, not a collision.\n    const withDigests = new Map<string, string>(digests.get(delta.id) ?? []);\n    for (const r of delta.reqs) {\n      if (r.kind !== \"ADDED\" && r.kind !== \"MODIFIED\") continue;\n      if (r.id === undefined) continue;\n      ids.add(r.id);\n      withDigests.set(r.id, requirementDigest(r));\n    }\n    byCapability.set(delta.id, ids);\n    digests.set(delta.id, withDigests);\n  }\n  return { declared: index.declared, byCapability, digests };\n}\n"]}

package/dist/core/capabilities/delta/summary.js

@@ -0,0 +1,57 @@
+/**
+ * What one feature's capability deltas CHANGE, summarized once for the two
+ * commands a person reads before an archive.
+ *
+ * `loam show <FEAT>` and `loam delta <FEAT>` mentioned the business corpus
+ * nowhere, and the consequence was the worst shape an informational surface can
+ * have: a feature carrying ONLY a capability delta — which is the first thing an
+ * analyst writes, and exactly what `loam new --capability` now scaffolds —
+ * displayed as a feature that carries nothing. The two surfaces a reader
+ * consults before running `loam archive` therefore disagreed with the archive
+ * that would refuse it.
+ *
+ * ONE SHAPE FOR BOTH, and that is the reason this lives in core rather than in
+ * either command. `show` needs the counts (its service rows are `+N ~N -N`) and
+ * `delta` needs the promises themselves (it is a task brief, and the id in
+ * `Realizes: <capability>#<id>` is the one thing the implementer has to copy
+ * exactly). Two derivations would be two answers to "what does this feature
+ * change here", from the two commands most likely to be read side by side.
+ *
+ * THE READER IS INJECTED, exactly as `../rollup.ts`'s is and for the same
+ * package-graph reason: `core/fleet-context.ts` imports this package for its
+ * memo, so nothing under `src/core/capabilities/` may import it back.
+ *
+ * BASE requirements are counted by neither. A delta's `## Requirements` section
+ * QUOTES living context for a reader and the merge never writes it, so counting
+ * one as a change would report a feature as touching a promise it only cites.
+ * `delta.requirement-not-merged` is the grade for BASE requirements the author
+ * did NOT mean to quote — it exempts `## Requirements` precisely because that
+ * heading is the deliberate quotation — and this module owes the same reading:
+ * quoted or stranded, a BASE requirement merges nothing, so it is no part of
+ * what this feature changes.
+ */
+import { compareIds } from "../../repo/entries.js";
+/**
+ * Summarize each capability delta, ordered by capability id.
+ *
+ * `docs` comes from `featureCapabilityDeltas` (or a `FleetContext`'s memo of
+ * it), so it is already `compareIds`-ordered by the walk; the sort here is the
+ * statement that the order is part of the answer rather than a property of
+ * whoever happened to call.
+ */
+export async function capabilityDeltaSummaries(docs, read) {
+    const out = [];
+    for (const doc of docs) {
+        const reqs = await read(doc.spec);
+        out.push({
+            id: doc.id,
+            spec: doc.spec,
+            added: reqs.filter((r) => r.kind === "ADDED").length,
+            modified: reqs.filter((r) => r.kind === "MODIFIED").length,
+            removed: reqs.filter((r) => r.kind === "REMOVED").length,
+            promises: reqs.flatMap((r) => r.kind === "BASE" ? [] : [{ kind: r.kind, id: r.id ?? null, name: r.name }]),
+        });
+    }
+    return out.sort((a, b) => compareIds(a.id, b.id));
+}
+//# sourceMappingURL=summary.js.map

package/dist/core/capabilities/delta/summary.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"summary.js","sourceRoot":"","sources":["../../../../src/core/capabilities/delta/summary.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAgCnD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,IAA8B,EAC9B,IAA8C;IAE9C,MAAM,GAAG,GAA6B,EAAE,CAAC;IACzC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClC,GAAG,CAAC,IAAI,CAAC;YACP,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,MAAM;YACpD,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,MAAM;YAC1D,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,MAAM;YACxD,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAC3B,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAC5E;SACF,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACpD,CAAC","sourcesContent":["/**\n * What one feature's capability deltas CHANGE, summarized once for the two\n * commands a person reads before an archive.\n *\n * `loam show <FEAT>` and `loam delta <FEAT>` mentioned the business corpus\n * nowhere, and the consequence was the worst shape an informational surface can\n * have: a feature carrying ONLY a capability delta — which is the first thing an\n * analyst writes, and exactly what `loam new --capability` now scaffolds —\n * displayed as a feature that carries nothing. The two surfaces a reader\n * consults before running `loam archive` therefore disagreed with the archive\n * that would refuse it.\n *\n * ONE SHAPE FOR BOTH, and that is the reason this lives in core rather than in\n * either command. `show` needs the counts (its service rows are `+N ~N -N`) and\n * `delta` needs the promises themselves (it is a task brief, and the id in\n * `Realizes: <capability>#<id>` is the one thing the implementer has to copy\n * exactly). Two derivations would be two answers to \"what does this feature\n * change here\", from the two commands most likely to be read side by side.\n *\n * THE READER IS INJECTED, exactly as `../rollup.ts`'s is and for the same\n * package-graph reason: `core/fleet-context.ts` imports this package for its\n * memo, so nothing under `src/core/capabilities/` may import it back.\n *\n * BASE requirements are counted by neither. A delta's `## Requirements` section\n * QUOTES living context for a reader and the merge never writes it, so counting\n * one as a change would report a feature as touching a promise it only cites.\n * `delta.requirement-not-merged` is the grade for BASE requirements the author\n * did NOT mean to quote — it exempts `## Requirements` precisely because that\n * heading is the deliberate quotation — and this module owes the same reading:\n * quoted or stranded, a BASE requirement merges nothing, so it is no part of\n * what this feature changes.\n */\nimport { compareIds } from \"../../repo/entries.js\";\nimport type { Requirement } from \"../../document/spec.js\";\nimport type { CapabilityDoc } from \"../tree.js\";\n\n/** One promise a delta adds, restates or retires — the `Realizes:` target it creates or removes. */\nexport interface CapabilityDeltaPromise {\n  kind: \"ADDED\" | \"MODIFIED\" | \"REMOVED\";\n  /**\n   * Its `Requirement-ID:`, or null when the delta wrote none. Null rather than\n   * absent because it is a real and reportable state, not a missing field: an\n   * unidentified capability requirement is an ERROR\n   * (`capability.requirement-unidentified`) that gates the archive, and a brief\n   * that silently dropped the row would hide the requirement the author has to\n   * fix.\n   */\n  id: string | null;\n  /** Its `### Requirement:` heading. */\n  name: string;\n}\n\n/** One capability document a feature's delta carries, and what it would merge. */\nexport interface CapabilityDeltaSummary {\n  id: string;\n  /** The delta document, absolute. Callers make it repo-relative for their own payload. */\n  spec: string;\n  added: number;\n  modified: number;\n  removed: number;\n  /** Every non-BASE requirement, in document order — the promises this delta moves. */\n  promises: CapabilityDeltaPromise[];\n}\n\n/**\n * Summarize each capability delta, ordered by capability id.\n *\n * `docs` comes from `featureCapabilityDeltas` (or a `FleetContext`'s memo of\n * it), so it is already `compareIds`-ordered by the walk; the sort here is the\n * statement that the order is part of the answer rather than a property of\n * whoever happened to call.\n */\nexport async function capabilityDeltaSummaries(\n  docs: readonly CapabilityDoc[],\n  read: (path: string) => Promise<Requirement[]>,\n): Promise<CapabilityDeltaSummary[]> {\n  const out: CapabilityDeltaSummary[] = [];\n  for (const doc of docs) {\n    const reqs = await read(doc.spec);\n    out.push({\n      id: doc.id,\n      spec: doc.spec,\n      added: reqs.filter((r) => r.kind === \"ADDED\").length,\n      modified: reqs.filter((r) => r.kind === \"MODIFIED\").length,\n      removed: reqs.filter((r) => r.kind === \"REMOVED\").length,\n      promises: reqs.flatMap((r) =>\n        r.kind === \"BASE\" ? [] : [{ kind: r.kind, id: r.id ?? null, name: r.name }],\n      ),\n    });\n  }\n  return out.sort((a, b) => compareIds(a.id, b.id));\n}\n"]}

package/dist/core/capabilities/delta/tree.js

@@ -0,0 +1,43 @@
+/**
+ * A feature's own capability deltas: `features/<FEAT>/capabilities/<id>/spec.md`.
+ *
+ * The business axis's answer to `specs/<svc>/spec.md`. A capability document is
+ * a requirements document like any other, so a feature that changes one writes
+ * a DELTA against it rather than editing the living text in place — which buys
+ * the three things the living tree has never had: a `Based-On:` pin, so two PRs
+ * touching one capability collide loudly instead of silently overwriting each
+ * other; the delta algebra's refusals (`delta.added-duplicate`,
+ * `delta.modified-unknown`, …), so a diff that lands nothing says so; and a
+ * business change that ships and unships with the feature that made it.
+ *
+ * BOTH LIFECYCLES COEXIST AND MUST. Nothing here makes a direct edit of
+ * `capabilities/<id>/spec.md` illegal — a fleet mid-adoption edits the document
+ * and always has. What a feature-local delta adds is a second, safer route, and
+ * a direct edit racing one surfaces as `delta.baseline-stale` instead of as
+ * today's silent loss.
+ *
+ * ONE CALL, because the walk is already written: `readCapabilityTree`
+ * implements the presence-classifies rule, the symlink-cycle guard and the
+ * `compareIds` ordering over any root. Re-deriving it here for the feature side
+ * would be two walks free to disagree about what a capability directory is.
+ *
+ * NO `FleetContext` PARAMETER, and that is load-bearing rather than stylistic:
+ * `core/fleet-context.ts` imports `../capabilities.js`, so nothing under
+ * `src/core/capabilities/` may import it back — a core-root↔capabilities
+ * package cycle `import/no-cycle` cannot see. The memo lives on the class and
+ * calls this; callers holding a context use `context.featureCapabilityDeltas`.
+ */
+import { readCapabilityTree } from "../tree.js";
+import { featureCapabilityDeltasDir } from "../../repo/authored/paths.js";
+/**
+ * The capability documents one feature's delta carries, ordered by id.
+ *
+ * `present: false` — and zero readdirs — when the feature has no
+ * `capabilities/` directory, which is every feature in a fleet that has not
+ * adopted the axis. That short-circuit is `readCapabilityTree`'s own
+ * `existsSync` and it is the whole cost such a fleet pays.
+ */
+export function featureCapabilityDeltas(featureDir) {
+    return readCapabilityTree(featureCapabilityDeltasDir(featureDir));
+}
+//# sourceMappingURL=tree.js.map

package/dist/core/capabilities/delta/tree.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tree.js","sourceRoot":"","sources":["../../../../src/core/capabilities/delta/tree.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,EAAE,kBAAkB,EAAuB,MAAM,YAAY,CAAC;AACrE,OAAO,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAG1E;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CAAC,UAAsB;IAC5D,OAAO,kBAAkB,CAAC,0BAA0B,CAAC,UAAU,CAAC,CAAC,CAAC;AACpE,CAAC","sourcesContent":["/**\n * A feature's own capability deltas: `features/<FEAT>/capabilities/<id>/spec.md`.\n *\n * The business axis's answer to `specs/<svc>/spec.md`. A capability document is\n * a requirements document like any other, so a feature that changes one writes\n * a DELTA against it rather than editing the living text in place — which buys\n * the three things the living tree has never had: a `Based-On:` pin, so two PRs\n * touching one capability collide loudly instead of silently overwriting each\n * other; the delta algebra's refusals (`delta.added-duplicate`,\n * `delta.modified-unknown`, …), so a diff that lands nothing says so; and a\n * business change that ships and unships with the feature that made it.\n *\n * BOTH LIFECYCLES COEXIST AND MUST. Nothing here makes a direct edit of\n * `capabilities/<id>/spec.md` illegal — a fleet mid-adoption edits the document\n * and always has. What a feature-local delta adds is a second, safer route, and\n * a direct edit racing one surfaces as `delta.baseline-stale` instead of as\n * today's silent loss.\n *\n * ONE CALL, because the walk is already written: `readCapabilityTree`\n * implements the presence-classifies rule, the symlink-cycle guard and the\n * `compareIds` ordering over any root. Re-deriving it here for the feature side\n * would be two walks free to disagree about what a capability directory is.\n *\n * NO `FleetContext` PARAMETER, and that is load-bearing rather than stylistic:\n * `core/fleet-context.ts` imports `../capabilities.js`, so nothing under\n * `src/core/capabilities/` may import it back — a core-root↔capabilities\n * package cycle `import/no-cycle` cannot see. The memo lives on the class and\n * calls this; callers holding a context use `context.featureCapabilityDeltas`.\n */\nimport { readCapabilityTree, type CapabilityTree } from \"../tree.js\";\nimport { featureCapabilityDeltasDir } from \"../../repo/authored/paths.js\";\nimport type { FeatureDir } from \"../../kernel/ids/dirs.js\";\n\n/**\n * The capability documents one feature's delta carries, ordered by id.\n *\n * `present: false` — and zero readdirs — when the feature has no\n * `capabilities/` directory, which is every feature in a fleet that has not\n * adopted the axis. That short-circuit is `readCapabilityTree`'s own\n * `existsSync` and it is the whole cost such a fleet pays.\n */\nexport function featureCapabilityDeltas(featureDir: FeatureDir): Promise<CapabilityTree> {\n  return readCapabilityTree(featureCapabilityDeltasDir(featureDir));\n}\n"]}

package/dist/core/capabilities/delta/uncovered.js

@@ -0,0 +1,222 @@
+import { splitRealizesEntry } from "../realizes/join.js";
+import { tagSlug } from "../usecase-join.js";
+/**
+ * The `(capability, requirement)` pair, keyed for a Set.
+ *
+ * NUL — the separator `core/delta/scope.ts`'s claim key already uses — rather
+ * than `#`, because a key's separator must be one its halves cannot contain and
+ * a capability id is a YAML key and a directory name, constrained nowhere.
+ * Re-joining with `#` would make `a#b` + `C` and `a` + `b#C` one key, and the
+ * second is unreachable only because the requirement grammar happens to exclude
+ * `#` today.
+ */
+function pairKey(capability, requirement) {
+    return `${capability}\0${requirement}`;
+}
+/**
+ * The pairs one requirement's `Realizes:` lines name.
+ *
+ * Through `splitRealizesEntry`, never a local split, and the LAST `#` is what
+ * makes it right: the requirement half has a grammar that excludes `#` and the
+ * capability half has none, so a first-`#` split mis-parses every id containing
+ * one — silently, which is the failure this axis exists to refuse.
+ */
+function realizedPairs(r) {
+    return r.realizes.flatMap((entry) => {
+        const target = splitRealizesEntry(entry);
+        return target === null ? [] : [pairKey(target.capability, target.requirement)];
+    });
+}
+/** How a service document is named in a message — the axis only where it is not the default one. */
+function docLabel(doc) {
+    return doc.file === "spec.md" ? doc.service : `${doc.service} (${doc.file})`;
+}
+/**
+ * `capability.uncovered` — a capability requirement this feature ADDS that no
+ * `Realizes:` line in the same feature's service deltas names.
+ *
+ * ADDED ONLY. A MODIFIED changes a promise the living fleet may already
+ * realize, so demanding a re-declaration would force an edit with nothing to
+ * change — the same exemption `c4.uncovered` takes one axis over. A requirement
+ * with no `Requirement-ID:` is SKIPPED rather than reported: it is already
+ * `capability.requirement-unidentified`, and there is nothing for a `Realizes:`
+ * line to address, so two findings for one mistake is the failure to avoid.
+ *
+ * The covering side is ADDED or MODIFIED, never BASE and never REMOVED. A BASE
+ * requirement in a delta quotes living context and the merge never writes it,
+ * so a `Realizes:` line there lands nowhere; a REMOVED one is on its way out and
+ * cannot keep a promise after it is gone.
+ *
+ * Feature scope, deliberately. The fleet-scope version already ships as
+ * `capability.requirement-unrealized`, and grading a feature-ADDED requirement
+ * against the LIVING fleet is vacuous — no living `Realizes:` can name it
+ * without being `capability.realizes-unknown` today.
+ */
+export function uncoveredIssues(capabilities, services, 
+// REQUIRED, with no default. A default would have to be one of the two arms,
+// and either choice is wrong for a caller that forgot: `graded: true` with an
+// empty list makes the message assert a negative, and `graded: false` makes it
+// quietly stop checking a corpus the caller does have. The compiler asking is
+// cheaper than either.
+flows) {
+    if (capabilities.length === 0)
+        return [];
+    const kept = new Set();
+    for (const doc of services) {
+        for (const r of doc.reqs) {
+            if (r.kind !== "ADDED" && r.kind !== "MODIFIED")
+                continue;
+            for (const pair of realizedPairs(r))
+                kept.add(pair);
+        }
+    }
+    // The other carrier, through the SAME `pairKey` as the `Realizes:` side: two
+    // corpora answering one question must not be able to disagree about which
+    // promise a claim addresses. The caller resolved these; a claim whose tags did
+    // not both resolve never reaches here, which is what stops a typo from
+    // silencing the gate.
+    if (flows.graded)
+        for (const flow of flows.kept)
+            kept.add(pairKey(flow.capability, flow.requirement));
+    // What the message may CLAIM about the flow half. Ungraded, it claims nothing
+    // and says so — the `Realizes:` half was still checked and is still worth
+    // gating on, so the finding stands; what must not stand is a sentence
+    // convicting a flow nobody resolved.
+    const flowClause = flows.graded
+        ? "and no `dynamic view` under this feature's usecases/ resolves a `#req-` tag to it. "
+        : `and the flow half of the join was NOT checked — ${flows.why}, so a \`#req-\` claim could not be resolved either way. `;
+    const issues = [];
+    for (const doc of capabilities) {
+        for (const r of doc.reqs) {
+            if (r.kind !== "ADDED" || r.id === undefined)
+                continue;
+            if (kept.has(pairKey(doc.id, r.id)))
+                continue;
+            const entry = `${doc.id}#${r.id}`;
+            issues.push({
+                severity: "warn",
+                gates: true,
+                code: "capability.uncovered",
+                subject: doc.id,
+                message: `capability ${doc.id}: ADDED requirement '${r.name}' (${r.id}) is realized by nothing this feature changes — ` +
+                    `no ADDED or MODIFIED requirement in its specs/ deltas carries \`Realizes: ${entry}\`, ` +
+                    flowClause +
+                    "The document is legal; the MERGE is what is unsafe: once it lands, the only thing that will ever mention " +
+                    "this promise again is a fleet-scope warning (capability.requirement-unrealized) nobody reads. " +
+                    `Three ways on: add \`Realizes: ${entry}\` to the service requirement that carries part of it; ` +
+                    `if the promise CROSSES services, write the flow that keeps it as features/<FEAT>/usecases/<name>.likec4 and ` +
+                    `tag its \`dynamic view\` \`#cap-${tagSlug(doc.id)}\` and \`#req-${tagSlug(r.id)}\` — the archive merges it into ` +
+                    "architecture/usecases/ with everything else this feature lands; or archive with --approve to land the promise " +
+                    "ahead of the fleet and let capability.requirement-unrealized carry it.",
+            });
+        }
+    }
+    return issues;
+}
+/** The living requirements a delta document supersedes — MODIFIED and REMOVED both restate or delete. */
+function supersedes(delta, living) {
+    if (delta === undefined)
+        return false;
+    return delta.reqs.some((r) => {
+        if (r.kind !== "MODIFIED" && r.kind !== "REMOVED")
+            return false;
+        return r.id === undefined ? r.name === living.name : r.id === living.id;
+    });
+}
+/**
+ * `capability.remove-requirement-realized` — this feature retires a capability
+ * requirement that something the merge LEAVES BEHIND still realizes.
+ *
+ * The hole the forward direction does not close, and the one this whole module
+ * exists to make impossible: a feature that REMOVES a capability requirement a
+ * living service requirement realizes used to archive at exit 0, and the next
+ * `loam validate --all` then failed with `capability.realizes-unknown` against a
+ * service document nobody had touched. An archive that leaves the fleet red
+ * against an untouched document is the exact class of silent damage the product
+ * exists to refuse.
+ *
+ * GRADED AGAINST THE POST-MERGE FLEET, which is the only reading under which
+ * the two escape hatches fall out instead of being special-cased. A living
+ * requirement that this feature's own delta MODIFIES or REMOVES is gone as
+ * written — a MODIFIED carries its FULL new text, so restating the requirement
+ * without its `Realizes:` line IS how an author drops the join — and the delta's
+ * own ADDED/MODIFIED requirements are what stands in its place. So: retire the
+ * realizer in the same change and there is no breach; keep the line and there
+ * is.
+ *
+ * A `#req-` tagged flow realizing the promise is NOT consulted, and that is the
+ * other subject rather than a gap: the tag names the requirement directly, so a
+ * removal turns it into `usecase.requirement-unresolved` on the living view —
+ * an error the delta walk raises before the archive, naming that view
+ * (`core/usecases/delta/modified.ts`), and nothing here would make it louder.
+ *
+ * A REMOVED spelled by heading resolves through the living document, so it
+ * grades exactly what the merge would delete. One that selects nothing is
+ * already `delta.removed-unknown` and retires nothing, so it is skipped here —
+ * two findings for one mistake, again.
+ */
+export async function removedRealizedIssues(join) {
+    const retired = new Map();
+    for (const doc of join.capabilities) {
+        for (const r of doc.reqs) {
+            if (r.kind !== "REMOVED")
+                continue;
+            const selected = doc.living.filter((l) => (r.id === undefined ? l.name === r.name : l.id === r.id));
+            for (const l of selected) {
+                if (l.id === undefined)
+                    continue;
+                retired.set(pairKey(doc.id, l.id), { capability: doc.id, id: l.id, name: l.name });
+            }
+        }
+    }
+    if (retired.size === 0)
+        return [];
+    // Who still realizes each retired pair after the merge: the living
+    // requirements this feature does not supersede, plus the requirements its own
+    // deltas add or restate.
+    const realizers = new Map();
+    const record = (pair, who) => {
+        if (!retired.has(pair))
+            return;
+        const found = realizers.get(pair) ?? [];
+        found.push(who);
+        realizers.set(pair, found);
+    };
+    for (const doc of await join.living()) {
+        const delta = join.deltas.find((d) => d.service === doc.service && d.file === doc.file);
+        for (const r of doc.reqs) {
+            if (supersedes(delta, r))
+                continue;
+            for (const pair of realizedPairs(r))
+                record(pair, `${docLabel(doc)}'s living requirement '${r.name}'`);
+        }
+    }
+    for (const doc of join.deltas) {
+        for (const r of doc.reqs) {
+            if (r.kind !== "ADDED" && r.kind !== "MODIFIED")
+                continue;
+            for (const pair of realizedPairs(r))
+                record(pair, `this feature's ${docLabel(doc)} delta requirement '${r.name}'`);
+        }
+    }
+    const issues = [];
+    for (const [pair, promise] of retired) {
+        const who = realizers.get(pair);
+        if (who === undefined)
+            continue;
+        const entry = `${promise.capability}#${promise.id}`;
+        issues.push({
+            severity: "error",
+            code: "capability.remove-requirement-realized",
+            subject: promise.capability,
+            message: `capability ${promise.capability}: this feature REMOVES '${promise.name}' (${promise.id}), but ${who.join("; ")} ` +
+                `still carries \`Realizes: ${entry}\`. After the merge that line points at a promise no document declares, and ` +
+                "the very next `loam validate --all` reports capability.realizes-unknown against whatever carries it — for a " +
+                "LIVING realizer, a service document this feature never touched. Retire the realizing requirement in the same " +
+                "feature, or drop its `Realizes:` line (a MODIFIED does that by restating the requirement without it), or " +
+                "archive with --approve to break the join deliberately.",
+        });
+    }
+    return issues;
+}
+//# sourceMappingURL=uncovered.js.map

package/dist/core/capabilities/delta/uncovered.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"uncovered.js","sourceRoot":"","sources":["../../../../src/core/capabilities/delta/uncovered.ts"],"names":[],"mappings":"AAmEA,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAqC7C;;;;;;;;;GASG;AACH,SAAS,OAAO,CAAC,UAAkB,EAAE,WAAmB;IACtD,OAAO,GAAG,UAAU,KAAK,WAAW,EAAE,CAAC;AACzC,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,aAAa,CAAC,CAAc;IACnC,OAAO,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;QAClC,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;QACzC,OAAO,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;IACjF,CAAC,CAAC,CAAC;AACL,CAAC;AAED,oGAAoG;AACpG,SAAS,QAAQ,CAAC,GAAiB;IACjC,OAAO,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,OAAO,KAAK,GAAG,CAAC,IAAI,GAAG,CAAC;AAC/E,CAAC;AAwCD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,eAAe,CAC7B,YAA2C,EAC3C,QAAiC;AACjC,6EAA6E;AAC7E,8EAA8E;AAC9E,+EAA+E;AAC/E,8EAA8E;AAC9E,uBAAuB;AACvB,KAAiB;IAEjB,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACzC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YACzB,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU;gBAAE,SAAS;YAC1D,KAAK,MAAM,IAAI,IAAI,aAAa,CAAC,CAAC,CAAC;gBAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IACD,6EAA6E;IAC7E,0EAA0E;IAC1E,+EAA+E;IAC/E,uEAAuE;IACvE,sBAAsB;IACtB,IAAI,KAAK,CAAC,MAAM;QAAE,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,IAAI;YAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;IACtG,8EAA8E;IAC9E,0EAA0E;IAC1E,sEAAsE;IACtE,qCAAqC;IACrC,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM;QAC7B,CAAC,CAAC,qFAAqF;QACvF,CAAC,CAAC,mDAAmD,KAAK,CAAC,GAAG,2DAA2D,CAAC;IAC5H,MAAM,MAAM,GAAY,EAAE,CAAC;IAC3B,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;QAC/B,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YACzB,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,EAAE,KAAK,SAAS;gBAAE,SAAS;YACvD,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;gBAAE,SAAS;YAC9C,MAAM,KAAK,GAAG,GAAG,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC;YAClC,MAAM,CAAC,IAAI,CAAC;gBACV,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,IAAI;gBACX,IAAI,EAAE,sBAAsB;gBAC5B,OAAO,EAAE,GAAG,CAAC,EAAE;gBACf,OAAO,EACL,cAAc,GAAG,CAAC,EAAE,wBAAwB,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE,kDAAkD;oBAC9G,6EAA6E,KAAK,MAAM;oBACxF,UAAU;oBACV,2GAA2G;oBAC3G,gGAAgG;oBAChG,kCAAkC,KAAK,yDAAyD;oBAChG,8GAA8G;oBAC9G,mCAAmC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,iBAAiB,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,kCAAkC;oBAClH,gHAAgH;oBAChH,wEAAwE;aAC3E,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAiBD,yGAAyG;AACzG,SAAS,UAAU,CAAC,KAA+B,EAAE,MAAmB;IACtE,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACtC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;QAC3B,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QAChE,OAAO,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC;IAC1E,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,IAAiB;IAC3D,MAAM,OAAO,GAAG,IAAI,GAAG,EAA4D,CAAC;IACpF,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;QACpC,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YACzB,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS;gBAAE,SAAS;YACnC,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACpG,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;gBACzB,IAAI,CAAC,CAAC,EAAE,KAAK,SAAS;oBAAE,SAAS;gBACjC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YACrF,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAElC,mEAAmE;IACnE,8EAA8E;IAC9E,yBAAyB;IACzB,MAAM,SAAS,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC9C,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,GAAW,EAAQ,EAAE;QACjD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO;QAC/B,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACxC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChB,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC7B,CAAC,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,MAAM,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC;QACxF,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YACzB,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC;gBAAE,SAAS;YACnC,KAAK,MAAM,IAAI,IAAI,aAAa,CAAC,CAAC,CAAC;gBAAE,MAAM,CAAC,IAAI,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;QACzG,CAAC;IACH,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAC9B,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YACzB,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU;gBAAE,SAAS;YAC1D,KAAK,MAAM,IAAI,IAAI,aAAa,CAAC,CAAC,CAAC;gBAAE,MAAM,CAAC,IAAI,EAAE,kBAAkB,QAAQ,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;QACrH,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAY,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,OAAO,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,GAAG,KAAK,SAAS;YAAE,SAAS;QAChC,MAAM,KAAK,GAAG,GAAG,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;QACpD,MAAM,CAAC,IAAI,CAAC;YACV,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,wCAAwC;YAC9C,OAAO,EAAE,OAAO,CAAC,UAAU;YAC3B,OAAO,EACL,cAAc,OAAO,CAAC,UAAU,2BAA2B,OAAO,CAAC,IAAI,MAAM,OAAO,CAAC,EAAE,UAAU,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;gBAClH,6BAA6B,KAAK,8EAA8E;gBAChH,8GAA8G;gBAC9G,+GAA+G;gBAC/G,2GAA2G;gBAC3G,wDAAwD;SAC3D,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["/**\n * The `Realizes:` join taken INSIDE ONE FEATURE, in both directions: a promise\n * this feature makes that nothing in it keeps, and a promise it retires that\n * something outside it still keeps.\n *\n * `../realizes/findings.ts` grades the same join at the two places it can be\n * WRONG — an entry that resolves to nothing, a living requirement nothing\n * realizes. This module grades it at the one place it can silently COME APART:\n * the merge. Both directions are about a change, both are answered from\n * documents the archive gate already has parsed, and neither has any meaning\n * outside a feature — which is why they live together here and not beside their\n * fleet-scope siblings.\n *\n * TWO CODES, NOT ONE, and the decision is worth the paragraph because the shape\n * invites the opposite:\n *\n *   - The FIXES are different. `capability.uncovered` is fixed by writing the\n *     `Realizes:` line the promise is missing; `capability.remove-requirement-realized`\n *     is fixed by retiring the requirement that carries the line, or by dropping\n *     the line from it. A code is what a machine branches on and the branch is\n *     the fix, so a single code covering both would be a code neither caller can\n *     act on.\n *   - The SEVERITIES are different, and they are different for the reason\n *     `../../vocabulary/issue.ts` draws the distinction at all. `capability.uncovered`\n *     is a warning that GATES: the document is legal — writing a business promise\n *     ahead of the fleet is the recorded intended use, which is exactly why\n *     `capability.requirement-unrealized` warns and never gates — while the MERGE\n *     is what is unsafe, because once it lands the only thing that will ever\n *     mention the promise again is a fleet-scope warning nobody reads. The\n *     removal direction has no such legal reading: after that merge a LIVING\n *     service document nobody in the feature touched carries a pointer at\n *     nothing, and `capability.realizes-unknown` is already an ERROR there. So it\n *     is an error here, exactly as `openapi.remove-op-consumed` is one axis over\n *     for the identical shape — this feature retires a thing the living fleet\n *     still uses. One code carrying two severities is a code that says nothing.\n *   - The family already spells every direction of every join as its own code:\n *     `capability.unknown` / `capability.realizes-unknown` name the entry that\n *     resolves to nothing, `capability.unrealized` /\n *     `capability.requirement-unrealized` name the promise nobody keeps. A pair\n *     here is the shape a reader of that list already expects.\n *\n * A `#req-` TAGGED FLOW COUNTS AS COVER, and the reason it did not is worth\n * recording because it was a consequence rather than a policy. A `dynamic view`\n * used to be a fleet document with no feature-delta path, so a `#req-` tag\n * naming a capability requirement that was not living yet was ALREADY\n * `usecase.requirement-unresolved` — an error on `validate --all` — for the\n * whole window before the archive. At the moment this ran, a legal flow claim on\n * a newly-ADDED requirement could not exist, and the message said so: archive\n * with `--approve` first, tag the flow afterwards. That advice lands a promise\n * kept by nothing and relies on somebody coming back.\n *\n * `features/<FEAT>/usecases/` closed that (`core/usecases/delta/flows.ts`), so\n * the claim can now be legal at the moment it is graded, and the third arm of\n * `flows` below is it. What has NOT changed is which claims count: both tags\n * must resolve, against the vocabulary and requirement index this feature's own\n * merge would leave behind. A broken tag of either kind is an error in its own\n * right and must never also mark a promise kept — a typo that silenced this gate\n * would turn a mistake into a green archive.\n *\n * NO FILESYSTEM, deliberately, exactly as `../realizes/join.ts` has none — and\n * that is why the flows arrive as resolved pairs rather than as a docsDir. The\n * living side of the removal direction arrives as a thunk the caller supplies,\n * so the fleet-wide read happens only when this feature retires something, and\n * this module stays testable without a tree.\n */\nimport type { Requirement } from \"../../document/spec.js\";\nimport type { Issue } from \"../../vocabulary/issue.js\";\nimport { splitRealizesEntry } from \"../realizes/join.js\";\nimport { tagSlug } from \"../usecase-join.js\";\n\n/**\n * One requirements document on the SERVICE side of the join, and the two facts\n * that address it: whose it is, and which axis. Both halves of the key are\n * needed because a feature's delta of `payment-service`'s `arch.spec.md`\n * supersedes the living `arch.spec.md` and says nothing at all about the living\n * `spec.md` beside it.\n */\nexport interface RealizingDoc {\n  /** The service id. */\n  service: string;\n  /** The axis's filename — `spec.md` or `arch.spec.md`, as `SPEC_AXES` spells it. */\n  file: string;\n  reqs: readonly Requirement[];\n}\n\n/**\n * One capability document a feature's delta changes, with the living text that\n * delta applies to.\n *\n * `living` is here rather than derived because a REMOVED requirement is exempt\n * from `capability.requirement-unidentified` and so may be spelled by heading\n * alone — the id it retires is then a fact about the LIVING document, and\n * without it the removal direction would silently grade nothing for the\n * commonest way a removal is written. Requirements rather than the delta\n * package's `LivingIndex`: `core/delta` imports this package, so importing it\n * back would be a package cycle the file-level cycle check cannot see.\n */\nexport interface CapabilityDeltaDoc {\n  /** The capability id — the directory chain under `features/<FEAT>/capabilities/`. */\n  id: string;\n  reqs: readonly Requirement[];\n  /** The LIVING `capabilities/<id>/spec.md` requirements, or `[]` when this feature creates it. */\n  living: readonly Requirement[];\n}\n\n/**\n * The `(capability, requirement)` pair, keyed for a Set.\n *\n * NUL — the separator `core/delta/scope.ts`'s claim key already uses — rather\n * than `#`, because a key's separator must be one its halves cannot contain and\n * a capability id is a YAML key and a directory name, constrained nowhere.\n * Re-joining with `#` would make `a#b` + `C` and `a` + `b#C` one key, and the\n * second is unreachable only because the requirement grammar happens to exclude\n * `#` today.\n */\nfunction pairKey(capability: string, requirement: string): string {\n  return `${capability}\\0${requirement}`;\n}\n\n/**\n * The pairs one requirement's `Realizes:` lines name.\n *\n * Through `splitRealizesEntry`, never a local split, and the LAST `#` is what\n * makes it right: the requirement half has a grammar that excludes `#` and the\n * capability half has none, so a first-`#` split mis-parses every id containing\n * one — silently, which is the failure this axis exists to refuse.\n */\nfunction realizedPairs(r: Requirement): string[] {\n  return r.realizes.flatMap((entry) => {\n    const target = splitRealizesEntry(entry);\n    return target === null ? [] : [pairKey(target.capability, target.requirement)];\n  });\n}\n\n/** How a service document is named in a message — the axis only where it is not the default one. */\nfunction docLabel(doc: RealizingDoc): string {\n  return doc.file === \"spec.md\" ? doc.service : `${doc.service} (${doc.file})`;\n}\n\n/**\n * One promise a `#req-` tagged flow in the SAME feature keeps.\n *\n * Structurally typed rather than imported from `core/usecases/delta/claims.ts`,\n * where the caller builds it, and the reason is the package graph rather than\n * taste: `core/usecases/` already imports this package, so importing it back\n * would be a cycle that `import/no-cycle` cannot see — the acyclicity obligation\n * `scripts/package-graph.mjs` exists to hold. The shape is three fields; the\n * RULE that produced them (both tags resolved, or the claim does not count) is\n * that module's, and this one grades what it is handed.\n */\nexport interface KeptByFlow {\n  capability: string;\n  requirement: string;\n  /** The view ids keeping it. Carried for a caller's report; nothing here reads it. */\n  flows: readonly string[];\n}\n\n/**\n * The flow corpus, or the honest statement that there was not one to read.\n *\n * A TRI-STATE and not a possibly-empty list, because the message says what was\n * checked and an empty list would make it say something loam never looked at.\n * \"No flow keeps this\" and \"the flows were not graded\" are different sentences\n * and only one of them is an accusation — the standing rule this axis states\n * everywhere else, applied to the message rather than to a severity.\n *\n * `why` is printed, so it names the cause an author can act on: an\n * `architecture/` that did not parse is one thing, a `capabilities.yaml` that\n * does not read as a vocabulary is another, and inside a feature gate NOTHING\n * ELSE reports the second — `core/coherence/declared.ts` keeps\n * `capability.invalid` for `validate --all`. Without the sentence the run\n * refuses, names the wrong cause, and points at nothing.\n */\nexport type FlowCorpus =\n  | { graded: true; kept: readonly KeptByFlow[] }\n  | { graded: false; why: string };\n\n/**\n * `capability.uncovered` — a capability requirement this feature ADDS that no\n * `Realizes:` line in the same feature's service deltas names.\n *\n * ADDED ONLY. A MODIFIED changes a promise the living fleet may already\n * realize, so demanding a re-declaration would force an edit with nothing to\n * change — the same exemption `c4.uncovered` takes one axis over. A requirement\n * with no `Requirement-ID:` is SKIPPED rather than reported: it is already\n * `capability.requirement-unidentified`, and there is nothing for a `Realizes:`\n * line to address, so two findings for one mistake is the failure to avoid.\n *\n * The covering side is ADDED or MODIFIED, never BASE and never REMOVED. A BASE\n * requirement in a delta quotes living context and the merge never writes it,\n * so a `Realizes:` line there lands nowhere; a REMOVED one is on its way out and\n * cannot keep a promise after it is gone.\n *\n * Feature scope, deliberately. The fleet-scope version already ships as\n * `capability.requirement-unrealized`, and grading a feature-ADDED requirement\n * against the LIVING fleet is vacuous — no living `Realizes:` can name it\n * without being `capability.realizes-unknown` today.\n */\nexport function uncoveredIssues(\n  capabilities: readonly CapabilityDeltaDoc[],\n  services: readonly RealizingDoc[],\n  // REQUIRED, with no default. A default would have to be one of the two arms,\n  // and either choice is wrong for a caller that forgot: `graded: true` with an\n  // empty list makes the message assert a negative, and `graded: false` makes it\n  // quietly stop checking a corpus the caller does have. The compiler asking is\n  // cheaper than either.\n  flows: FlowCorpus,\n): Issue[] {\n  if (capabilities.length === 0) return [];\n  const kept = new Set<string>();\n  for (const doc of services) {\n    for (const r of doc.reqs) {\n      if (r.kind !== \"ADDED\" && r.kind !== \"MODIFIED\") continue;\n      for (const pair of realizedPairs(r)) kept.add(pair);\n    }\n  }\n  // The other carrier, through the SAME `pairKey` as the `Realizes:` side: two\n  // corpora answering one question must not be able to disagree about which\n  // promise a claim addresses. The caller resolved these; a claim whose tags did\n  // not both resolve never reaches here, which is what stops a typo from\n  // silencing the gate.\n  if (flows.graded) for (const flow of flows.kept) kept.add(pairKey(flow.capability, flow.requirement));\n  // What the message may CLAIM about the flow half. Ungraded, it claims nothing\n  // and says so — the `Realizes:` half was still checked and is still worth\n  // gating on, so the finding stands; what must not stand is a sentence\n  // convicting a flow nobody resolved.\n  const flowClause = flows.graded\n    ? \"and no `dynamic view` under this feature's usecases/ resolves a `#req-` tag to it. \"\n    : `and the flow half of the join was NOT checked — ${flows.why}, so a \\`#req-\\` claim could not be resolved either way. `;\n  const issues: Issue[] = [];\n  for (const doc of capabilities) {\n    for (const r of doc.reqs) {\n      if (r.kind !== \"ADDED\" || r.id === undefined) continue;\n      if (kept.has(pairKey(doc.id, r.id))) continue;\n      const entry = `${doc.id}#${r.id}`;\n      issues.push({\n        severity: \"warn\",\n        gates: true,\n        code: \"capability.uncovered\",\n        subject: doc.id,\n        message:\n          `capability ${doc.id}: ADDED requirement '${r.name}' (${r.id}) is realized by nothing this feature changes — ` +\n          `no ADDED or MODIFIED requirement in its specs/ deltas carries \\`Realizes: ${entry}\\`, ` +\n          flowClause +\n          \"The document is legal; the MERGE is what is unsafe: once it lands, the only thing that will ever mention \" +\n          \"this promise again is a fleet-scope warning (capability.requirement-unrealized) nobody reads. \" +\n          `Three ways on: add \\`Realizes: ${entry}\\` to the service requirement that carries part of it; ` +\n          `if the promise CROSSES services, write the flow that keeps it as features/<FEAT>/usecases/<name>.likec4 and ` +\n          `tag its \\`dynamic view\\` \\`#cap-${tagSlug(doc.id)}\\` and \\`#req-${tagSlug(r.id)}\\` — the archive merges it into ` +\n          \"architecture/usecases/ with everything else this feature lands; or archive with --approve to land the promise \" +\n          \"ahead of the fleet and let capability.requirement-unrealized carry it.\",\n      });\n    }\n  }\n  return issues;\n}\n\n/** Everything the removal direction needs, and nothing it would have to read twice. */\nexport interface RemovalJoin {\n  /** This feature's capability deltas, each with the living document it applies to. */\n  capabilities: readonly CapabilityDeltaDoc[];\n  /** This feature's own service delta documents, already parsed by the same walk. */\n  deltas: readonly RealizingDoc[];\n  /**\n   * Every LIVING service requirements document in the fleet. A thunk, called at\n   * most once and only when this feature actually retires a capability\n   * requirement — the overwhelming majority of features retire none, and this\n   * read is the whole fleet's `spec.md` and `arch.spec.md`.\n   */\n  living: () => Promise<readonly RealizingDoc[]>;\n}\n\n/** The living requirements a delta document supersedes — MODIFIED and REMOVED both restate or delete. */\nfunction supersedes(delta: RealizingDoc | undefined, living: Requirement): boolean {\n  if (delta === undefined) return false;\n  return delta.reqs.some((r) => {\n    if (r.kind !== \"MODIFIED\" && r.kind !== \"REMOVED\") return false;\n    return r.id === undefined ? r.name === living.name : r.id === living.id;\n  });\n}\n\n/**\n * `capability.remove-requirement-realized` — this feature retires a capability\n * requirement that something the merge LEAVES BEHIND still realizes.\n *\n * The hole the forward direction does not close, and the one this whole module\n * exists to make impossible: a feature that REMOVES a capability requirement a\n * living service requirement realizes used to archive at exit 0, and the next\n * `loam validate --all` then failed with `capability.realizes-unknown` against a\n * service document nobody had touched. An archive that leaves the fleet red\n * against an untouched document is the exact class of silent damage the product\n * exists to refuse.\n *\n * GRADED AGAINST THE POST-MERGE FLEET, which is the only reading under which\n * the two escape hatches fall out instead of being special-cased. A living\n * requirement that this feature's own delta MODIFIES or REMOVES is gone as\n * written — a MODIFIED carries its FULL new text, so restating the requirement\n * without its `Realizes:` line IS how an author drops the join — and the delta's\n * own ADDED/MODIFIED requirements are what stands in its place. So: retire the\n * realizer in the same change and there is no breach; keep the line and there\n * is.\n *\n * A `#req-` tagged flow realizing the promise is NOT consulted, and that is the\n * other subject rather than a gap: the tag names the requirement directly, so a\n * removal turns it into `usecase.requirement-unresolved` on the living view —\n * an error the delta walk raises before the archive, naming that view\n * (`core/usecases/delta/modified.ts`), and nothing here would make it louder.\n *\n * A REMOVED spelled by heading resolves through the living document, so it\n * grades exactly what the merge would delete. One that selects nothing is\n * already `delta.removed-unknown` and retires nothing, so it is skipped here —\n * two findings for one mistake, again.\n */\nexport async function removedRealizedIssues(join: RemovalJoin): Promise<Issue[]> {\n  const retired = new Map<string, { capability: string; id: string; name: string }>();\n  for (const doc of join.capabilities) {\n    for (const r of doc.reqs) {\n      if (r.kind !== \"REMOVED\") continue;\n      const selected = doc.living.filter((l) => (r.id === undefined ? l.name === r.name : l.id === r.id));\n      for (const l of selected) {\n        if (l.id === undefined) continue;\n        retired.set(pairKey(doc.id, l.id), { capability: doc.id, id: l.id, name: l.name });\n      }\n    }\n  }\n  if (retired.size === 0) return [];\n\n  // Who still realizes each retired pair after the merge: the living\n  // requirements this feature does not supersede, plus the requirements its own\n  // deltas add or restate.\n  const realizers = new Map<string, string[]>();\n  const record = (pair: string, who: string): void => {\n    if (!retired.has(pair)) return;\n    const found = realizers.get(pair) ?? [];\n    found.push(who);\n    realizers.set(pair, found);\n  };\n  for (const doc of await join.living()) {\n    const delta = join.deltas.find((d) => d.service === doc.service && d.file === doc.file);\n    for (const r of doc.reqs) {\n      if (supersedes(delta, r)) continue;\n      for (const pair of realizedPairs(r)) record(pair, `${docLabel(doc)}'s living requirement '${r.name}'`);\n    }\n  }\n  for (const doc of join.deltas) {\n    for (const r of doc.reqs) {\n      if (r.kind !== \"ADDED\" && r.kind !== \"MODIFIED\") continue;\n      for (const pair of realizedPairs(r)) record(pair, `this feature's ${docLabel(doc)} delta requirement '${r.name}'`);\n    }\n  }\n\n  const issues: Issue[] = [];\n  for (const [pair, promise] of retired) {\n    const who = realizers.get(pair);\n    if (who === undefined) continue;\n    const entry = `${promise.capability}#${promise.id}`;\n    issues.push({\n      severity: \"error\",\n      code: \"capability.remove-requirement-realized\",\n      subject: promise.capability,\n      message:\n        `capability ${promise.capability}: this feature REMOVES '${promise.name}' (${promise.id}), but ${who.join(\"; \")} ` +\n        `still carries \\`Realizes: ${entry}\\`. After the merge that line points at a promise no document declares, and ` +\n        \"the very next `loam validate --all` reports capability.realizes-unknown against whatever carries it — for a \" +\n        \"LIVING realizer, a service document this feature never touched. Retire the realizing requirement in the same \" +\n        \"feature, or drop its `Realizes:` line (a MODIFIED does that by restating the requirement without it), or \" +\n        \"archive with --approve to break the join deliberately.\",\n    });\n  }\n  return issues;\n}\n"]}