@ybotok/loam 0.1.0-beta.3 → 0.2.0-alpha.13

package/dist/core/consumers/after.js

@@ -0,0 +1,113 @@
+/**
+ * The consumer index read AFTER one feature — the documents as that feature's
+ * merge would leave them, so a consumer the same feature removes or rewrites
+ * stops counting.
+ *
+ * WHY THE GATE NEEDS IT. The archive gate's question is not "who names this
+ * operation today" but "who will still name it once this archive lands", and
+ * the two differ by exactly what the feature itself writes. A rename has to
+ * restate the requirement that governs the old operation, and a removal whose
+ * feature also REMOVES another service's requirement naming it has already
+ * retired that consumer — the remedy the refusal itself gives ("retire the
+ * requirement that names it"). Read off the living files alone, both were
+ * refused for a consumer the same archive deletes: the requirement scan read
+ * living spec.md only, so following the remedy inside the feature did not clear
+ * the finding (the capability axis's `capability.remove-requirement-realized`
+ * has always graded its own join after the merge; this is the contract axes
+ * catching up).
+ *
+ * WHAT A FEATURE CAN EXPRESS, AND WHAT IT CANNOT. Requirements, yes: a spec
+ * delta MODIFIES or REMOVES a requirement of any service it carries
+ * `specs/<svc>/` for, and the merge is `applyRequirementDelta` — the archive's
+ * own function, so the view cannot disagree with what the archive writes. A
+ * contract, yes: the ownership check below asks the contract the merge would
+ * write. EDGES AND USE-CASE HOPS, NO: the landscape merge only ADDS edges and a
+ * feature's flows are create-only, so no `delta.likec4` and no `usecases/`
+ * document can take a living edge or hop away. Those are read as they stand —
+ * the one way to drop or redraw a living edge is to edit the living map in the
+ * same change, and that edit is then simply what the index reads. What the
+ * merge CAN change about a living edge is the directory its source resolves
+ * to: every `specs/<svc>/` becomes a `services/<svc>/`, and an #external
+ * element resolving to one stops producing (`services` below).
+ */
+import { existsSync } from "node:fs";
+import { applyRequirementDelta } from "../document/apply.js";
+import { featureSpecPaths } from "../repo/paths.js";
+import { serviceOperationIds } from "../openapi/doc.js";
+export function featureView(scope) {
+    const { docsDir, featureDir, context } = scope;
+    const deltas = new Map();
+    const contracts = new Map();
+    return {
+        delta: (service, axis) => {
+            const key = `${service}\0${axis}`;
+            let pending = deltas.get(key);
+            if (pending === undefined) {
+                const path = featureSpecPaths(featureDir, service)[axis];
+                // A delta that does not read is the delta checks' finding to make
+                // (`delta.*`); here it credits nothing, which can only keep a consumer
+                // counted — the closed direction.
+                pending = existsSync(path) ? context.readRequirements(path).catch(() => undefined) : Promise.resolve(undefined);
+                deltas.set(key, pending);
+            }
+            return pending;
+        },
+        defines: async (service, op) => {
+            let pending = contracts.get(service);
+            if (pending === undefined) {
+                // `serviceOperationIds` is the rule every same-feature contract check
+                // reads — living upserts minus removals, removals first — so the
+                // ownership question cannot disagree with E1 about what the merge
+                // leaves defined.
+                pending = existsSync(featureSpecPaths(featureDir, service).openapi)
+                    ? serviceOperationIds(docsDir, service, featureDir, context).then((ids) => new Set(ids))
+                    : Promise.resolve(undefined);
+                contracts.set(service, pending);
+            }
+            const ids = await pending;
+            return ids === undefined ? undefined : ids.has(op);
+        },
+        services: () => context.featureSpecServices(featureDir),
+    };
+}
+/**
+ * One spec file's requirements as the merge would leave them — and FAILING
+ * CLOSED when the merge would refuse.
+ *
+ * No delta (or one holding only quoted, BASE requirements) is the living file
+ * itself, read directly. That is not an optimisation: `applyRequirementDelta`
+ * grades the LIVING file's `Requirement-ID` declarations too, so asking it to
+ * apply an empty delta over a living spec with one malformed id threw, and the
+ * catch that used to follow answered "no consumers" — a removal of an
+ * operation that spec still governed then passed the gate at exit 0, and the
+ * next `validate --all` reported `spec-api.op-undefined` (review 2026-10-12,
+ * finding 5).
+ *
+ * A delta the merge refuses is the living file PLUS every requirement the delta
+ * ADDS or MODIFIES. Its identity errors already gate (`delta.*`), and nothing it
+ * says can land until they are fixed — but "nothing can land" was never a
+ * reason to answer "nobody consumes it": the fix that lands next is one of the
+ * readings this union covers, so a consumer in any of them still counts. A
+ * REMOVED requirement credits nothing on this path, because whether it would
+ * select the living one is exactly what the merge could not decide.
+ *
+ * Untouched requirements come back from the merge as the very objects that went
+ * in (`apply.ts` states the identity is load-bearing), which is what tells a
+ * living consumer from one this feature wrote.
+ */
+export function afterMerge(living, delta) {
+    const asLiving = (requirement) => ({ requirement, written: false });
+    if (delta === undefined || delta.every((d) => d.kind === "BASE"))
+        return living.map(asLiving);
+    try {
+        const untouched = new Set(living);
+        return applyRequirementDelta(living, delta).map((requirement) => ({ requirement, written: !untouched.has(requirement) }));
+    }
+    catch {
+        return [
+            ...living.map(asLiving),
+            ...delta.filter((d) => d.kind === "ADDED" || d.kind === "MODIFIED").map((requirement) => ({ requirement, written: true })),
+        ];
+    }
+}
+//# sourceMappingURL=after.js.map

package/dist/core/consumers/after.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"after.js","sourceRoot":"","sources":["../../../src/core/consumers/after.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAE7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAuCxD,MAAM,UAAU,WAAW,CAAC,KAAmB;IAC7C,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAC/C,MAAM,MAAM,GAAG,IAAI,GAAG,EAA8C,CAAC;IACrE,MAAM,SAAS,GAAG,IAAI,GAAG,EAAoD,CAAC;IAC9E,OAAO;QACL,KAAK,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE;YACvB,MAAM,GAAG,GAAG,GAAG,OAAO,KAAK,IAAI,EAAE,CAAC;YAClC,IAAI,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC9B,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,MAAM,IAAI,GAAG,gBAAgB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC;gBACzD,kEAAkE;gBAClE,uEAAuE;gBACvE,kCAAkC;gBAClC,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;gBAChH,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAC3B,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE;YAC7B,IAAI,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACrC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,sEAAsE;gBACtE,iEAAiE;gBACjE,kEAAkE;gBAClE,kBAAkB;gBAClB,OAAO,GAAG,UAAU,CAAC,gBAAgB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC;oBACjE,CAAC,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;oBACxF,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;gBAC/B,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAClC,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC;YAC1B,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACrD,CAAC;QACD,QAAQ,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,mBAAmB,CAAC,UAAU,CAAC;KACxD,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,UAAU,CAAC,MAAqB,EAAE,KAAgC;IAChF,MAAM,QAAQ,GAAG,CAAC,WAAwB,EAAqB,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IACpG,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC9F,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAClC,OAAO,qBAAqB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5H,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YACvB,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;SAC3H,CAAC;IACJ,CAAC;AACH,CAAC","sourcesContent":["/**\n * The consumer index read AFTER one feature — the documents as that feature's\n * merge would leave them, so a consumer the same feature removes or rewrites\n * stops counting.\n *\n * WHY THE GATE NEEDS IT. The archive gate's question is not \"who names this\n * operation today\" but \"who will still name it once this archive lands\", and\n * the two differ by exactly what the feature itself writes. A rename has to\n * restate the requirement that governs the old operation, and a removal whose\n * feature also REMOVES another service's requirement naming it has already\n * retired that consumer — the remedy the refusal itself gives (\"retire the\n * requirement that names it\"). Read off the living files alone, both were\n * refused for a consumer the same archive deletes: the requirement scan read\n * living spec.md only, so following the remedy inside the feature did not clear\n * the finding (the capability axis's `capability.remove-requirement-realized`\n * has always graded its own join after the merge; this is the contract axes\n * catching up).\n *\n * WHAT A FEATURE CAN EXPRESS, AND WHAT IT CANNOT. Requirements, yes: a spec\n * delta MODIFIES or REMOVES a requirement of any service it carries\n * `specs/<svc>/` for, and the merge is `applyRequirementDelta` — the archive's\n * own function, so the view cannot disagree with what the archive writes. A\n * contract, yes: the ownership check below asks the contract the merge would\n * write. EDGES AND USE-CASE HOPS, NO: the landscape merge only ADDS edges and a\n * feature's flows are create-only, so no `delta.likec4` and no `usecases/`\n * document can take a living edge or hop away. Those are read as they stand —\n * the one way to drop or redraw a living edge is to edit the living map in the\n * same change, and that edit is then simply what the index reads. What the\n * merge CAN change about a living edge is the directory its source resolves\n * to: every `specs/<svc>/` becomes a `services/<svc>/`, and an #external\n * element resolving to one stops producing (`services` below).\n */\nimport { existsSync } from \"node:fs\";\nimport { applyRequirementDelta } from \"../document/apply.js\";\nimport type { Requirement } from \"../document/spec.js\";\nimport { featureSpecPaths } from \"../repo/paths.js\";\nimport { serviceOperationIds } from \"../openapi/doc.js\";\nimport type { FleetContext } from \"../fleet-context.js\";\nimport type { DocsDir, FeatureDir } from \"../kernel/ids/dirs.js\";\nimport type { RawServiceId } from \"../kernel/ids/service.js\";\n\n/** The two requirement files a service carries — every consumer scan reads both. */\nexport type SpecAxis = \"spec\" | \"archSpec\";\n\n/** One requirement as the merge would leave it, and whether THIS feature wrote it there. */\nexport interface MergedRequirement {\n  requirement: Requirement;\n  /** True for a requirement the feature's delta added or rewrote — what lets a finding say whose line it is. */\n  written: boolean;\n}\n\n/** What the index asks of the feature it reads after. */\nexport interface FeatureView {\n  /** The feature's own requirement delta for one service's spec file, or `undefined` when it carries none (or none that reads). */\n  delta(service: RawServiceId, axis: SpecAxis): Promise<Requirement[] | undefined>;\n  /** Does `service`'s contract, as this merge leaves it, define `op`? `undefined` when the feature carries no contract delta for it — the living contract answers. */\n  defines(service: RawServiceId, op: string): Promise<boolean | undefined>;\n  /**\n   * The service ids this merge leaves a `services/<id>/` directory for: every\n   * `specs/<id>/` the feature carries, which the archive materialises one from\n   * (the reason `unknownDeltaServices`, `core/coherence/living.ts`, refuses a\n   * stray one). All of them, the ones the gate refuses as unknown or ill-named\n   * included: a directory too many can only take an outside producer away,\n   * the closed direction, and such a feature does not archive anyway.\n   */\n  services(): Promise<readonly RawServiceId[]>;\n}\n\n/** The feature whose merge a view reads after. */\nexport interface FeatureScope {\n  docsDir: DocsDir;\n  featureDir: FeatureDir;\n  context: FleetContext;\n}\n\nexport function featureView(scope: FeatureScope): FeatureView {\n  const { docsDir, featureDir, context } = scope;\n  const deltas = new Map<string, Promise<Requirement[] | undefined>>();\n  const contracts = new Map<string, Promise<ReadonlySet<string> | undefined>>();\n  return {\n    delta: (service, axis) => {\n      const key = `${service}\\0${axis}`;\n      let pending = deltas.get(key);\n      if (pending === undefined) {\n        const path = featureSpecPaths(featureDir, service)[axis];\n        // A delta that does not read is the delta checks' finding to make\n        // (`delta.*`); here it credits nothing, which can only keep a consumer\n        // counted — the closed direction.\n        pending = existsSync(path) ? context.readRequirements(path).catch(() => undefined) : Promise.resolve(undefined);\n        deltas.set(key, pending);\n      }\n      return pending;\n    },\n    defines: async (service, op) => {\n      let pending = contracts.get(service);\n      if (pending === undefined) {\n        // `serviceOperationIds` is the rule every same-feature contract check\n        // reads — living upserts minus removals, removals first — so the\n        // ownership question cannot disagree with E1 about what the merge\n        // leaves defined.\n        pending = existsSync(featureSpecPaths(featureDir, service).openapi)\n          ? serviceOperationIds(docsDir, service, featureDir, context).then((ids) => new Set(ids))\n          : Promise.resolve(undefined);\n        contracts.set(service, pending);\n      }\n      const ids = await pending;\n      return ids === undefined ? undefined : ids.has(op);\n    },\n    services: () => context.featureSpecServices(featureDir),\n  };\n}\n\n/**\n * One spec file's requirements as the merge would leave them — and FAILING\n * CLOSED when the merge would refuse.\n *\n * No delta (or one holding only quoted, BASE requirements) is the living file\n * itself, read directly. That is not an optimisation: `applyRequirementDelta`\n * grades the LIVING file's `Requirement-ID` declarations too, so asking it to\n * apply an empty delta over a living spec with one malformed id threw, and the\n * catch that used to follow answered \"no consumers\" — a removal of an\n * operation that spec still governed then passed the gate at exit 0, and the\n * next `validate --all` reported `spec-api.op-undefined` (review 2026-10-12,\n * finding 5).\n *\n * A delta the merge refuses is the living file PLUS every requirement the delta\n * ADDS or MODIFIES. Its identity errors already gate (`delta.*`), and nothing it\n * says can land until they are fixed — but \"nothing can land\" was never a\n * reason to answer \"nobody consumes it\": the fix that lands next is one of the\n * readings this union covers, so a consumer in any of them still counts. A\n * REMOVED requirement credits nothing on this path, because whether it would\n * select the living one is exactly what the merge could not decide.\n *\n * Untouched requirements come back from the merge as the very objects that went\n * in (`apply.ts` states the identity is load-bearing), which is what tells a\n * living consumer from one this feature wrote.\n */\nexport function afterMerge(living: Requirement[], delta: Requirement[] | undefined): MergedRequirement[] {\n  const asLiving = (requirement: Requirement): MergedRequirement => ({ requirement, written: false });\n  if (delta === undefined || delta.every((d) => d.kind === \"BASE\")) return living.map(asLiving);\n  try {\n    const untouched = new Set(living);\n    return applyRequirementDelta(living, delta).map((requirement) => ({ requirement, written: !untouched.has(requirement) }));\n  } catch {\n    return [\n      ...living.map(asLiving),\n      ...delta.filter((d) => d.kind === \"ADDED\" || d.kind === \"MODIFIED\").map((requirement) => ({ requirement, written: true })),\n    ];\n  }\n}\n"]}

package/dist/core/consumers/consumers.js

@@ -0,0 +1,296 @@
+/**
+ * THE consumer index: who in the fleet still depends on an operation or a
+ * message — the join that turns "an operation left the contract" into "and
+ * these named consumers break", and "an operation's shape moved" into "and these
+ * are the consumers to check it against".
+ *
+ * ONE INDEX, FOUR READERS. `loam diff` names the victims of every removal,
+ * deprecation and modification since a base ref (`core/diff/semantic.ts`); the
+ * coherence gate refuses a feature that takes a consumed operation or message
+ * out of the contract (`openapi.remove-op-consumed`, `asyncapi.remove-message-
+ * consumed` — `core/coherence/consumed/operations.ts`, `core/coherence/events/events.ts`);
+ * and `loam archive` names who an overwrite lands on
+ * (`commands/archive/plan/contracts/consumers.ts`). They used to be THREE
+ * copies — this module as `core/diff/victims.ts`, `edgeConsumers` /
+ * `requirementConsumers` / `governorsAfterMerge` in `core/coherence/lookups.ts`,
+ * `messageConsumers` in `core/coherence/events/lookups.ts` — kept "in step by
+ * hand", and they were not: the gate read `architecture/landscape.likec4` alone
+ * while the diff and the spine read the project, the gate never asked a use
+ * case, and the diff excluded an internal edge the gate counted. Rule 13
+ * (docs/DESIGN.md) fired at the third copy; this is the extraction it forces.
+ *
+ * THE SOURCES, per question:
+ *
+ *  - an operation `op` of `provider`: (1) every edge of the `architecture/`
+ *    PROJECT with `metadata { op }` into the provider (`./current.ts` says why
+ *    the project and never the one file); (2) other services' requirements —
+ *    spec.md AND arch.spec.md — whose `Operations:` line names it, unless that
+ *    service's own contract defines the same id (`ownsOperation` says why);
+ *    (3) the use-case hops the model attributes to it
+ *    (`core/usecases/operations.ts`); (4) the provider's OWN spec.md
+ *    requirements — the file `validate` grades its `Operations:` lines in —
+ *    and its own internal edges still naming it, filed apart as `own`.
+ *  - a message `name` of `provider`: `consumes` edges, other services'
+ *    `Consumes:` lines over both spec files, the use-case hops backed by such an
+ *    edge, and — as `own` — the provider's own `publishes` edges and
+ *    `Publishes:` lines over both spec files, which `validate` grades alike.
+ *
+ * WHY `own` IS ITS OWN LIST. The gate's question is what the merge would leave
+ * broken, and the provider's own documents break too: an overwrite carries no
+ * removal marker, so nothing made the author restate the provider's requirement
+ * still naming the old id, and the next `validate` reported
+ * `spec-api.op-undefined` against the provider itself; a message re-keyed or no
+ * longer sent left the provider's own `Publishes:` line behind for
+ * `spec-event.message-undefined`. So the gate counts `own`. `loam diff` and the
+ * archive's overwrite warnings answer a different question — who ELSE breaks —
+ * and do not: the rule `usecase.step-unlinked` states, that a service owes no
+ * operationId to itself, is why an internal edge stopped keeping every removal
+ * `diff.op-removed-consumed` (verification 2026-09-04, R3), and why a hop whose
+ * two ends are the provider is never a victim.
+ *
+ * WHAT A DOUBT IS WORTH. A consumer the index could not check is a typed
+ * suspension (`./scan.ts`), never a silent nothing, and the readers weigh the
+ * kinds differently: `loam diff` and the overwrite warnings list every one; the
+ * gate refuses on a document nobody could read or place — a consumer's, in
+ * `suspended`, or the provider's own, in `ownSuspended` — and never on a caller
+ * drawn with no op or a contested hop (`documentDoubt` says why).
+ *
+ * READ AFTER A FEATURE, OR AS IT STANDS. With `afterFeature`, every requirement is read
+ * as that feature's merge would leave it (`./after.ts` — a consumer the same
+ * feature MODIFIES or REMOVES stops counting, and an unappliable delta fails
+ * closed); without it, the living fleet as it stands, which is what the diff and
+ * the overwrite warnings ask. Edges and hops read the same either way: no
+ * feature can take a living one away — though it can create the directory an
+ * #external producer resolves to (`externalProducer` says what that changes).
+ *
+ * LAZY, AND PAID ONCE PER INVOCATION. The fleet's four documents per service and
+ * the project load are behind the first question that needs them, and memoised
+ * per FleetContext (`./current.ts`), so a removal-free feature pays for neither
+ * and `validate --all` pays once for every feature it grades. Without a
+ * context (the archive gate's coherence call) the index reads through one of its
+ * own, for its own lifetime.
+ */
+import {} from "../c4/likec4.js";
+import { hopsConsuming, hopsExercising } from "../usecases/operations.js";
+import { FleetContext } from "../fleet-context.js";
+import { livingFleet, livingMap } from "./current.js";
+import { afterMerge, featureView } from "./after.js";
+/**
+ * Both spec files, for every question about another service — the provider's
+ * own lines are read where `validate` grades them (`RequirementRule.ownAxes`).
+ * The message half always read both — an
+ * outbox requirement in arch.spec.md is the canonical home of a `Publishes:`
+ * line, and a scan of spec.md alone answered "nobody consumes it" over the file
+ * most authors use. The operation half read spec.md only, because that is
+ * where `validate` grades an `Operations:` line; but an arch.spec.md line
+ * naming another service's operation is exactly the cross-service dependency
+ * `loam dependencies` already reads off both files, and a removal must not
+ * read the same line as a dependency there and as nothing here.
+ */
+export const REQUIREMENT_AXES = ["spec", "archSpec"];
+/**
+ * Does this service's own living contract define `op`? Then an `Operations:`
+ * line of its own names ITS operation, not another service's.
+ *
+ * Two rules say so, one per spec file. In spec.md it is the rule `validate`
+ * grades an `Operations:` line by: it resolves against the requirement's own
+ * service's contract (`spec-api.op-undefined`, `commands/validate/service/
+ * api.ts`), so in a green fleet another service naming the same id there is
+ * naming its own. `validate` never grades an arch.spec.md line against a
+ * contract; there it is `loam dependencies`' rule — a requirement naming an
+ * operation its own service already provides is "not a dependency on
+ * anybody" (`core/dependencies/facts.ts`), read off both files. Matching the bare
+ * id fleet-wide refused a rename on payment-service because checkout-web's own
+ * `capturePayment` requirement shared the name (review 2026-10-12, finding 1) —
+ * and shared ids like `healthCheck` or `getStatus` are common across a fleet.
+ *
+ * A contract that is unreadable or absent proves no ownership, so the line stays
+ * a consumer: the closed direction, and the reading every scan here gave before
+ * ownership was asked at all.
+ */
+export function ownsOperation(state, op) {
+    return state.openapi.kind === "read" && state.openapi.value.some((o) => o.id === op);
+}
+const EDGE = (resolve, r) => `edge ${resolve(r.source)} → ${resolve(r.target)}${r.title === undefined ? "" : ` ("${r.title}")`}`;
+/** Entry comparator by map key — deterministic suspension order. */
+const byFirst = (a, b) => (a[0] < b[0] ? -1 : 1);
+export function consumerIndex(request) {
+    const { docsDir } = request;
+    const context = request.context ?? new FleetContext();
+    const after = request.afterFeature === undefined ? undefined : featureView({ docsDir, featureDir: request.afterFeature, context });
+    /** One service's requirements on one axis as `after`'s merge would leave them, read once per index. */
+    const merged = new Map();
+    const requirementsOf = (state, axis) => {
+        const key = `${state.id}\0${axis}`;
+        let pending = merged.get(key);
+        if (pending === undefined) {
+            const a = state[axis];
+            pending =
+                a.kind === "unreadable"
+                    ? Promise.resolve({ unreadable: a.path })
+                    : (async () => afterMerge(a.kind === "read" ? a.value : [], await after?.delta(state.id, axis)))();
+            merged.set(key, pending);
+        }
+        return pending;
+    };
+    const label = (service, m) => m.written
+        ? `this feature's ${service} delta requirement '${m.requirement.name}'`
+        : `${service}'s living requirement '${m.requirement.name}'`;
+    /**
+     * The requirement half of one scan, `tupleVisible`'s own discipline applied
+     * to victims: an unreadable consumer axis contributes a SUSPENSION, never a
+     * silent nothing — "consuming nothing" and "loam refused to read the file"
+     * are opposite facts, and collapsing them is how a breaking removal used to
+     * grade down to a confident warning. Sorted, so victim order never depends on
+     * the enumeration's walk order. A REMOVED requirement governs nothing: the
+     * rule `validate` reads living requirements by.
+     *
+     * The provider's own unreadable axis is NOT a suspension: it is not a
+     * consumer anybody else must be warned about, and that file is the provider's
+     * own finding (`validate`, and the delta checks when the feature restates it).
+     * It is filed as `ownSuspended`, which only the gate reads.
+     */
+    const scanRequirements = async (rule) => {
+        const { services, ambiguous } = await livingFleet(docsDir, context);
+        const out = { victims: [], suspended: [], own: [], ownSuspended: [] };
+        for (const id of [...services.keys()].sort()) {
+            const state = services.get(id);
+            const mine = id === rule.provider;
+            for (const axis of REQUIREMENT_AXES) {
+                if (mine && !rule.ownAxes.includes(axis))
+                    continue;
+                const reqs = await requirementsOf(state, axis);
+                if (!Array.isArray(reqs)) {
+                    if (mine)
+                        out.ownSuspended.push({ kind: "unreadable", text: `${id} — ${reqs.unreadable} could not be read, so its own requirements could not be scanned` });
+                    else
+                        out.suspended.push({ kind: "unreadable", text: `${id} — ${reqs.unreadable} could not be read, so its requirements could not be scanned` });
+                    continue;
+                }
+                for (const m of reqs) {
+                    if (m.requirement.kind === "REMOVED")
+                        continue;
+                    if (mine ? rule.own(m.requirement) : await rule.foreign(state, m.requirement)) {
+                        (mine ? out.own : out.victims).push(label(id, m));
+                    }
+                }
+            }
+        }
+        for (const [id, dirs] of [...ambiguous].sort(byFirst)) {
+            const text = `${id} — claimed by ${dirs.join(" and ")}, so its ${id === rule.provider ? "own " : ""}documents could not be scanned`;
+            (id === rule.provider ? out.ownSuspended : out.suspended).push({ kind: "ambiguous", text });
+        }
+        return out;
+    };
+    /** Ownership as the merge leaves it: the feature's contract for a service it carries one for, the living one otherwise. */
+    const owns = async (state, op) => (await after?.defines(state.id, op)) ?? ownsOperation(state, op);
+    const opConsumers = async (provider, op) => {
+        const map = await livingMap(docsDir, context);
+        const edges = [];
+        const internal = [];
+        const unlinked = [];
+        for (const r of map.relationships ?? []) {
+            if (map.resolve(r.target) !== provider)
+                continue;
+            // An edge whose SOURCE resolves to the provider as well is the provider's
+            // own internal call — `own`, never a victim (the header says why). The
+            // spine still grades it against the contract, so the gate counts it.
+            const self = map.resolve(r.source) === provider;
+            if (r.op === op) {
+                (self ? internal : edges).push(EDGE(map.resolve, r));
+            }
+            else if (!self && r.op === undefined && r.publishes === undefined && r.consumes === undefined) {
+                // A caller drawn with NO op is neither a victim nor proof of absence:
+                // it calls the provider, and nobody wrote down which operation.
+                // Dropping it silently made every removal on a seeded fleet (`loam
+                // seed` draws every edge without an op) read "no current landscape
+                // edge names it" while validate warned `spine.op-link-missing` on the
+                // very edge. It rides as a suspension — a warning's worth of doubt,
+                // never an error, so an op-less map does not turn every removal red:
+                // its kind is `unlinked`, which the removal gate does not refuse on
+                // (`documentDoubt` in ./scan.ts says which kinds it does, and why).
+                // An edge naming a message instead (`publishes`/`consumes`) said what
+                // it carries and is the message half's to grade.
+                unlinked.push({ kind: "unlinked", text: `${EDGE(map.resolve, r)} has no \`metadata { op }\`, so whether it calls '${op}' is unknown` });
+            }
+        }
+        const reqs = await scanRequirements({
+            provider,
+            foreign: async (state, r) => r.operations.includes(op) && !(await owns(state, op)),
+            own: (r) => r.operations.includes(op),
+            // spec.md only: `validate` resolves an `Operations:` line against its
+            // own service's contract there (`spec-api.op-undefined`) and never in
+            // arch.spec.md, so the provider's arch.spec.md line naming the operation
+            // strands nothing — refusing for it turned a removal that archived
+            // before the one index into an exit 1 (the contract review, finding 2).
+            // Another service's arch.spec.md line still counts: there it is a
+            // dependency on this contract, as `loam dependencies` reads it.
+            ownAxes: ["spec"],
+        });
+        // Flows last in each list, deliberately: the edge and the requirement say
+        // WHICH document to open, and the flow says what the reader is about to
+        // break — so a `details[]` scanned top-down ends on the consequence.
+        const hops = hopsExercising(map.useCases, { provider, op });
+        return {
+            victims: [...edges, ...reqs.victims, ...hops.breaks],
+            suspended: [...unlinked, ...reqs.suspended, ...hops.unsure.map((text) => ({ kind: "contested", text }))],
+            own: [...internal, ...reqs.own],
+            ownSuspended: reqs.ownSuspended,
+        };
+    };
+    const messageConsumers = async (provider, name) => {
+        const map = await livingMap(docsDir, context);
+        const edges = [];
+        const outbound = [];
+        for (const r of map.relationships ?? []) {
+            // The message join is fleet-global (names are not service-scoped), so
+            // every edge naming it counts, whoever its producer is — except one INTO
+            // the provider itself: its own consumption leaves in the same change, and
+            // counting it would gate every self-consuming producer on its own
+            // retirement.
+            if (r.consumes === name && map.resolve(r.target) !== provider)
+                edges.push(EDGE(map.resolve, r));
+            // The provider's OWN `publishes` edge is the op half's internal edge on
+            // this axis: the spine grades a publishes edge on its SOURCE
+            // (`spine.message-undefined` when the source's contract sends no such
+            // message), so once the provider stops sending it the edge strands the
+            // provider itself — `own`, which only the gate counts. Collecting the
+            // `Publishes:` lines alone let a full retirement archive at exit 0 over
+            // a living publishes edge (the one-index review, finding 3). Another
+            // service's publishes edge is that service's claim, untouched by this one.
+            if (r.publishes === name && map.resolve(r.source) === provider)
+                outbound.push(EDGE(map.resolve, r));
+        }
+        // No ownership rule here, and the asymmetry is the contract's: a consumer
+        // declares the message in its OWN contract with `action: receive` — validate
+        // requires it to — so its own contract naming the message proves nothing
+        // about who sends it. The provider's own `Consumes:` line stays out for the
+        // edge's reason above; its own `Publishes:` line is what `own` is for,
+        // beside its publishes edges.
+        const reqs = await scanRequirements({
+            provider,
+            foreign: async (_state, r) => r.consumes.includes(name),
+            own: (r) => r.publishes.includes(name),
+            // Both: `validate` grades a `Publishes:` line in either file
+            // (`spec-event.message-undefined`), the outbox requirement in
+            // arch.spec.md being its canonical home.
+            ownAxes: REQUIREMENT_AXES,
+        });
+        const hops = hopsConsuming(map.useCases, { provider, name });
+        return { victims: [...edges, ...reqs.victims, ...hops], suspended: reqs.suspended, own: [...outbound, ...reqs.own], ownSuspended: reqs.ownSuspended };
+    };
+    const producers = async (name) => {
+        const { services } = await livingFleet(docsDir, context);
+        return [...services.keys()].sort().filter((id) => services.get(id).sent.includes(name));
+    };
+    // One rule per index, built at its first question: over the directories
+    // `after`'s merge leaves, or the living ones — never on the shared map memo,
+    // which every feature `validate --all` grades reads through one context.
+    let outside;
+    const externalProducer = async (name) => {
+        outside ??= (async () => (await livingMap(docsDir, context)).externalProducerRule((await after?.services()) ?? []))();
+        return (await outside)(name);
+    };
+    return { opConsumers, messageConsumers, producers, externalProducer };
+}
+//# sourceMappingURL=consumers.js.map

package/dist/core/consumers/consumers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consumers.js","sourceRoot":"","sources":["../../../src/core/consumers/consumers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuEG;AACH,OAAO,EAAY,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC1E,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAKnD,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,WAAW,EAAyC,MAAM,YAAY,CAAC;AA4E5F;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAwB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;AAE1E;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,aAAa,CAAC,KAAmB,EAAE,EAAU;IAC3D,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;AACvF,CAAC;AAED,MAAM,IAAI,GAAG,CAAC,OAA+B,EAAE,CAAM,EAAU,EAAE,CAC/D,QAAQ,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;AAEtG,oEAAoE;AACpE,MAAM,OAAO,GAAG,CAAI,CAAc,EAAE,CAAc,EAAU,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAetF,MAAM,UAAU,aAAa,CAAC,OAAwB;IACpD,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAC5B,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,IAAI,YAAY,EAAE,CAAC;IACtD,MAAM,KAAK,GAAG,OAAO,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC;IAEnI,uGAAuG;IACvG,MAAM,MAAM,GAAG,IAAI,GAAG,EAAiE,CAAC;IACxF,MAAM,cAAc,GAAG,CAAC,KAAmB,EAAE,IAAc,EAAyD,EAAE;QACpH,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;QACnC,IAAI,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;YACtB,OAAO;gBACL,CAAC,CAAC,IAAI,KAAK,YAAY;oBACrB,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;oBACzC,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,MAAM,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACvG,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC3B,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,CAAC,OAAe,EAAE,CAAoB,EAAU,EAAE,CAC9D,CAAC,CAAC,OAAO;QACP,CAAC,CAAC,kBAAkB,OAAO,uBAAuB,CAAC,CAAC,WAAW,CAAC,IAAI,GAAG;QACvE,CAAC,CAAC,GAAG,OAAO,0BAA0B,CAAC,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC;IAEhE;;;;;;;;;;;;;OAaG;IACH,MAAM,gBAAgB,GAAG,KAAK,EAAE,IAAqB,EAAsB,EAAE;QAC3E,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACpE,MAAM,GAAG,GAAc,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;QACjF,KAAK,MAAM,EAAE,IAAI,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YAC7C,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAE,CAAC;YAChC,MAAM,IAAI,GAAG,EAAE,KAAK,IAAI,CAAC,QAAQ,CAAC;YAClC,KAAK,MAAM,IAAI,IAAI,gBAAgB,EAAE,CAAC;gBACpC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;oBAAE,SAAS;gBACnD,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;gBAC/C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;oBACzB,IAAI,IAAI;wBAAE,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,IAAI,CAAC,UAAU,kEAAkE,EAAE,CAAC,CAAC;;wBACvJ,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,IAAI,CAAC,UAAU,8DAA8D,EAAE,CAAC,CAAC;oBAChJ,SAAS;gBACX,CAAC;gBACD,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;oBACrB,IAAI,CAAC,CAAC,WAAW,CAAC,IAAI,KAAK,SAAS;wBAAE,SAAS;oBAC/C,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC;wBAC9E,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;oBACpD,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QACD,KAAK,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACtD,MAAM,IAAI,GAAG,GAAG,EAAE,iBAAiB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,KAAK,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,gCAAgC,CAAC;YACpI,CAAC,EAAE,KAAK,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9F,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IAEF,2HAA2H;IAC3H,MAAM,IAAI,GAAG,KAAK,EAAE,KAAmB,EAAE,EAAU,EAAoB,EAAE,CACvE,CAAC,MAAM,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,IAAI,aAAa,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAEnE,MAAM,WAAW,GAAG,KAAK,EAAE,QAAgB,EAAE,EAAU,EAAsB,EAAE;QAC7E,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC9C,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAiB,EAAE,CAAC;QAClC,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,aAAa,IAAI,EAAE,EAAE,CAAC;YACxC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ;gBAAE,SAAS;YACjD,0EAA0E;YAC1E,uEAAuE;YACvE,qEAAqE;YACrE,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC;YAChD,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;gBAChB,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;YACvD,CAAC;iBAAM,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,EAAE,KAAK,SAAS,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAChG,sEAAsE;gBACtE,gEAAgE;gBAChE,mEAAmE;gBACnE,mEAAmE;gBACnE,sEAAsE;gBACtE,oEAAoE;gBACpE,qEAAqE;gBACrE,oEAAoE;gBACpE,oEAAoE;gBACpE,sEAAsE;gBACtE,iDAAiD;gBACjD,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,qDAAqD,EAAE,cAAc,EAAE,CAAC,CAAC;YAC1I,CAAC;QACH,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC;YAClC,QAAQ;YACR,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAClF,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrC,sEAAsE;YACtE,sEAAsE;YACtE,yEAAyE;YACzE,mEAAmE;YACnE,wEAAwE;YACxE,kEAAkE;YAClE,gEAAgE;YAChE,OAAO,EAAE,CAAC,MAAM,CAAC;SAClB,CAAC,CAAC;QACH,0EAA0E;QAC1E,wEAAwE;QACxE,qEAAqE;QACrE,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;QAC5D,OAAO;YACL,OAAO,EAAE,CAAC,GAAG,KAAK,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC;YACpD,SAAS,EAAE,CAAC,GAAG,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAc,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;YACpH,GAAG,EAAE,CAAC,GAAG,QAAQ,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC;YAC/B,YAAY,EAAE,IAAI,CAAC,YAAY;SAChC,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,gBAAgB,GAAG,KAAK,EAAE,QAAgB,EAAE,IAAY,EAAsB,EAAE;QACpF,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC9C,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,aAAa,IAAI,EAAE,EAAE,CAAC;YACxC,sEAAsE;YACtE,yEAAyE;YACzE,0EAA0E;YAC1E,kEAAkE;YAClE,cAAc;YACd,IAAI,CAAC,CAAC,QAAQ,KAAK,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ;gBAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;YAChG,wEAAwE;YACxE,6DAA6D;YAC7D,sEAAsE;YACtE,uEAAuE;YACvE,sEAAsE;YACtE,wEAAwE;YACxE,qEAAqE;YACrE,2EAA2E;YAC3E,IAAI,CAAC,CAAC,SAAS,KAAK,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ;gBAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;QACtG,CAAC;QACD,0EAA0E;QAC1E,6EAA6E;QAC7E,yEAAyE;QACzE,4EAA4E;QAC5E,uEAAuE;QACvE,8BAA8B;QAC9B,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC;YAClC,QAAQ;YACR,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC;YACvD,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC;YACtC,6DAA6D;YAC7D,8DAA8D;YAC9D,yCAAyC;YACzC,OAAO,EAAE,gBAAgB;SAC1B,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7D,OAAO,EAAE,OAAO,EAAE,CAAC,GAAG,KAAK,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,GAAG,QAAQ,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC;IACxJ,CAAC,CAAC;IAEF,MAAM,SAAS,GAAG,KAAK,EAAE,IAAY,EAAqB,EAAE;QAC1D,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACzD,OAAO,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3F,CAAC,CAAC;IAEF,wEAAwE;IACxE,6EAA6E;IAC7E,yEAAyE;IACzE,IAAI,OAA6D,CAAC;IAClE,MAAM,gBAAgB,GAAG,KAAK,EAAE,IAAY,EAA0B,EAAE;QACtE,OAAO,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,MAAM,KAAK,EAAE,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QACtH,OAAO,CAAC,MAAM,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC,CAAC;IAEF,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAAC;AACxE,CAAC","sourcesContent":["/**\n * THE consumer index: who in the fleet still depends on an operation or a\n * message — the join that turns \"an operation left the contract\" into \"and\n * these named consumers break\", and \"an operation's shape moved\" into \"and these\n * are the consumers to check it against\".\n *\n * ONE INDEX, FOUR READERS. `loam diff` names the victims of every removal,\n * deprecation and modification since a base ref (`core/diff/semantic.ts`); the\n * coherence gate refuses a feature that takes a consumed operation or message\n * out of the contract (`openapi.remove-op-consumed`, `asyncapi.remove-message-\n * consumed` — `core/coherence/consumed/operations.ts`, `core/coherence/events/events.ts`);\n * and `loam archive` names who an overwrite lands on\n * (`commands/archive/plan/contracts/consumers.ts`). They used to be THREE\n * copies — this module as `core/diff/victims.ts`, `edgeConsumers` /\n * `requirementConsumers` / `governorsAfterMerge` in `core/coherence/lookups.ts`,\n * `messageConsumers` in `core/coherence/events/lookups.ts` — kept \"in step by\n * hand\", and they were not: the gate read `architecture/landscape.likec4` alone\n * while the diff and the spine read the project, the gate never asked a use\n * case, and the diff excluded an internal edge the gate counted. Rule 13\n * (docs/DESIGN.md) fired at the third copy; this is the extraction it forces.\n *\n * THE SOURCES, per question:\n *\n *  - an operation `op` of `provider`: (1) every edge of the `architecture/`\n *    PROJECT with `metadata { op }` into the provider (`./current.ts` says why\n *    the project and never the one file); (2) other services' requirements —\n *    spec.md AND arch.spec.md — whose `Operations:` line names it, unless that\n *    service's own contract defines the same id (`ownsOperation` says why);\n *    (3) the use-case hops the model attributes to it\n *    (`core/usecases/operations.ts`); (4) the provider's OWN spec.md\n *    requirements — the file `validate` grades its `Operations:` lines in —\n *    and its own internal edges still naming it, filed apart as `own`.\n *  - a message `name` of `provider`: `consumes` edges, other services'\n *    `Consumes:` lines over both spec files, the use-case hops backed by such an\n *    edge, and — as `own` — the provider's own `publishes` edges and\n *    `Publishes:` lines over both spec files, which `validate` grades alike.\n *\n * WHY `own` IS ITS OWN LIST. The gate's question is what the merge would leave\n * broken, and the provider's own documents break too: an overwrite carries no\n * removal marker, so nothing made the author restate the provider's requirement\n * still naming the old id, and the next `validate` reported\n * `spec-api.op-undefined` against the provider itself; a message re-keyed or no\n * longer sent left the provider's own `Publishes:` line behind for\n * `spec-event.message-undefined`. So the gate counts `own`. `loam diff` and the\n * archive's overwrite warnings answer a different question — who ELSE breaks —\n * and do not: the rule `usecase.step-unlinked` states, that a service owes no\n * operationId to itself, is why an internal edge stopped keeping every removal\n * `diff.op-removed-consumed` (verification 2026-09-04, R3), and why a hop whose\n * two ends are the provider is never a victim.\n *\n * WHAT A DOUBT IS WORTH. A consumer the index could not check is a typed\n * suspension (`./scan.ts`), never a silent nothing, and the readers weigh the\n * kinds differently: `loam diff` and the overwrite warnings list every one; the\n * gate refuses on a document nobody could read or place — a consumer's, in\n * `suspended`, or the provider's own, in `ownSuspended` — and never on a caller\n * drawn with no op or a contested hop (`documentDoubt` says why).\n *\n * READ AFTER A FEATURE, OR AS IT STANDS. With `afterFeature`, every requirement is read\n * as that feature's merge would leave it (`./after.ts` — a consumer the same\n * feature MODIFIES or REMOVES stops counting, and an unappliable delta fails\n * closed); without it, the living fleet as it stands, which is what the diff and\n * the overwrite warnings ask. Edges and hops read the same either way: no\n * feature can take a living one away — though it can create the directory an\n * #external producer resolves to (`externalProducer` says what that changes).\n *\n * LAZY, AND PAID ONCE PER INVOCATION. The fleet's four documents per service and\n * the project load are behind the first question that needs them, and memoised\n * per FleetContext (`./current.ts`), so a removal-free feature pays for neither\n * and `validate --all` pays once for every feature it grades. Without a\n * context (the archive gate's coherence call) the index reads through one of its\n * own, for its own lifetime.\n */\nimport { type Rel } from \"../c4/likec4.js\";\nimport { hopsConsuming, hopsExercising } from \"../usecases/operations.js\";\nimport { FleetContext } from \"../fleet-context.js\";\nimport type { DocsDir, FeatureDir } from \"../kernel/ids/dirs.js\";\nimport type { Requirement } from \"../document/spec.js\";\nimport type { ServiceState } from \"./state.js\";\nimport type { ConsumerScan, Suspension } from \"./scan.js\";\nimport { livingFleet, livingMap } from \"./current.js\";\nimport { afterMerge, featureView, type MergedRequirement, type SpecAxis } from \"./after.js\";\n\n/** One consumer question's answer: the scan, plus what of the provider's own still names it. */\nexport interface Consumers extends ConsumerScan {\n  /**\n   * The provider's own documents that still name what it is losing — an edge\n   * it draws to itself, a requirement of its own. Positive evidence, like\n   * `victims`, filed apart because only the gate counts it (the header says why).\n   */\n  own: string[];\n  /**\n   * The provider's own documents the scan could not read or place, on the axes\n   * `own` reads — the gate's doubt about `own`, as `suspended` is every reader's\n   * doubt about `victims`. Filed apart for `own`'s reason: the diff and the\n   * overwrite warnings name who ELSE is affected, and the provider's broken file\n   * is its own `validate` finding there. The gate refuses on it, because an\n   * overwrite carries no REMOVED requirement and that file is where the old id\n   * may still be governed.\n   */\n  ownSuspended: Suspension[];\n}\n\n/** The consumer questions every reader asks. */\nexport interface ConsumerIndex {\n  /** Consumers of `provider`'s operation `op`: edges, other services' requirements, use-case hops; inbound op-less edges and contested hops ride as suspensions. */\n  opConsumers(provider: string, op: string): Promise<Consumers>;\n  /** Consumers of message `name` a `provider` is dropping or changing: consumes-edges (not into the provider), other services' `Consumes:` lines, the hops backed by such an edge; the provider's own publishes edges and `Publishes:` lines ride as `own`. */\n  messageConsumers(provider: string, name: string): Promise<Consumers>;\n  /**\n   * Living services whose asyncapi SENDS `name` — positive evidence only; a\n   * message another service still sends is not orphaned by one producer\n   * dropping it. Senders, never declarers: a consumer declares the message in\n   * its own contract with `action: receive` (validate requires it to), so\n   * counting declarations named the consumer as the message's producer —\n   * `loam diff` said \"still declared by\" the very service the removal orphaned,\n   * while the gate refused for it and the next `validate --all` reported\n   * `spine.message-unproduced` there. The rule that check grades by\n   * (`commands/validate/service/events/message-producers.ts`).\n   *\n   * Always the fleet as it stands, even with `afterFeature`: no requirement\n   * merge decides who sends, and the contract merge that does is the coherence\n   * gate's to simulate. The message gate reads this as the living half of its\n   * after-the-merge senders and replaces every service its feature carries an\n   * event delta for (`core/coherence/events/events.ts`) — read alone, it would\n   * pass a feature retiring a message from both of its senders, each one on the\n   * other's living contract.\n   */\n  producers(name: string): Promise<string[]>;\n  /**\n   * The #external element whose living `publishes` edge sends `name`, or null —\n   * a producer OUTSIDE the fleet, which `producers` never names because no\n   * contract of its own exists. Validate counts it (`spine.message-unproduced`\n   * stays quiet over it), so the gate and `loam diff` must too: counting fleet\n   * senders alone refused a retirement from a message's only fleet sender\n   * while an #external element still published it, and `loam diff` called the\n   * archived removal `diff.message-removed-consumed`, though the next\n   * `validate --all` was clean (the verification of N1–N3, D1). The living\n   * map's edge and tag, after a feature as without one: the landscape merge\n   * only adds to the map. But NOT the living directories after a feature: its\n   * merge creates `services/<id>/` from each `specs/<id>/`, and a directory\n   * the element resolves to outranks the tag, so a feature onboarding the\n   * outside system as a service takes its producer away\n   * (`LivingMap.externalProducerRule` in `./current.ts` says what that cost).\n   */\n  externalProducer(name: string): Promise<string | null>;\n}\n\n/** Where the index reads, and after what. */\nexport interface ConsumerRequest {\n  docsDir: DocsDir;\n  /** The invocation's read index. Absent, the index reads through one of its own. */\n  context?: FleetContext;\n  /** The feature whose merge every requirement is read after (`./after.ts`). Absent: the living fleet as it stands. */\n  afterFeature?: FeatureDir;\n}\n\n/**\n * Both spec files, for every question about another service — the provider's\n * own lines are read where `validate` grades them (`RequirementRule.ownAxes`).\n * The message half always read both — an\n * outbox requirement in arch.spec.md is the canonical home of a `Publishes:`\n * line, and a scan of spec.md alone answered \"nobody consumes it\" over the file\n * most authors use. The operation half read spec.md only, because that is\n * where `validate` grades an `Operations:` line; but an arch.spec.md line\n * naming another service's operation is exactly the cross-service dependency\n * `loam dependencies` already reads off both files, and a removal must not\n * read the same line as a dependency there and as nothing here.\n */\nexport const REQUIREMENT_AXES: readonly SpecAxis[] = [\"spec\", \"archSpec\"];\n\n/**\n * Does this service's own living contract define `op`? Then an `Operations:`\n * line of its own names ITS operation, not another service's.\n *\n * Two rules say so, one per spec file. In spec.md it is the rule `validate`\n * grades an `Operations:` line by: it resolves against the requirement's own\n * service's contract (`spec-api.op-undefined`, `commands/validate/service/\n * api.ts`), so in a green fleet another service naming the same id there is\n * naming its own. `validate` never grades an arch.spec.md line against a\n * contract; there it is `loam dependencies`' rule — a requirement naming an\n * operation its own service already provides is \"not a dependency on\n * anybody\" (`core/dependencies/facts.ts`), read off both files. Matching the bare\n * id fleet-wide refused a rename on payment-service because checkout-web's own\n * `capturePayment` requirement shared the name (review 2026-10-12, finding 1) —\n * and shared ids like `healthCheck` or `getStatus` are common across a fleet.\n *\n * A contract that is unreadable or absent proves no ownership, so the line stays\n * a consumer: the closed direction, and the reading every scan here gave before\n * ownership was asked at all.\n */\nexport function ownsOperation(state: ServiceState, op: string): boolean {\n  return state.openapi.kind === \"read\" && state.openapi.value.some((o) => o.id === op);\n}\n\nconst EDGE = (resolve: (id: string) => string, r: Rel): string =>\n  `edge ${resolve(r.source)} → ${resolve(r.target)}${r.title === undefined ? \"\" : ` (\"${r.title}\")`}`;\n\n/** Entry comparator by map key — deterministic suspension order. */\nconst byFirst = <T>(a: [string, T], b: [string, T]): number => (a[0] < b[0] ? -1 : 1);\n\n/** How one requirement scan decides a hit — for another service, and for the provider itself. */\ninterface RequirementRule {\n  provider: string;\n  foreign: (state: ServiceState, r: Requirement) => Promise<boolean>;\n  own: (r: Requirement) => boolean;\n  /**\n   * The provider's spec files `own` reads: the ones `validate` grades the line\n   * in, since a line it never grades can never be left broken. Other services\n   * are read over `REQUIREMENT_AXES` whatever this says.\n   */\n  ownAxes: readonly SpecAxis[];\n}\n\nexport function consumerIndex(request: ConsumerRequest): ConsumerIndex {\n  const { docsDir } = request;\n  const context = request.context ?? new FleetContext();\n  const after = request.afterFeature === undefined ? undefined : featureView({ docsDir, featureDir: request.afterFeature, context });\n\n  /** One service's requirements on one axis as `after`'s merge would leave them, read once per index. */\n  const merged = new Map<string, Promise<MergedRequirement[] | { unreadable: string }>>();\n  const requirementsOf = (state: ServiceState, axis: SpecAxis): Promise<MergedRequirement[] | { unreadable: string }> => {\n    const key = `${state.id}\\0${axis}`;\n    let pending = merged.get(key);\n    if (pending === undefined) {\n      const a = state[axis];\n      pending =\n        a.kind === \"unreadable\"\n          ? Promise.resolve({ unreadable: a.path })\n          : (async () => afterMerge(a.kind === \"read\" ? a.value : [], await after?.delta(state.id, axis)))();\n      merged.set(key, pending);\n    }\n    return pending;\n  };\n\n  const label = (service: string, m: MergedRequirement): string =>\n    m.written\n      ? `this feature's ${service} delta requirement '${m.requirement.name}'`\n      : `${service}'s living requirement '${m.requirement.name}'`;\n\n  /**\n   * The requirement half of one scan, `tupleVisible`'s own discipline applied\n   * to victims: an unreadable consumer axis contributes a SUSPENSION, never a\n   * silent nothing — \"consuming nothing\" and \"loam refused to read the file\"\n   * are opposite facts, and collapsing them is how a breaking removal used to\n   * grade down to a confident warning. Sorted, so victim order never depends on\n   * the enumeration's walk order. A REMOVED requirement governs nothing: the\n   * rule `validate` reads living requirements by.\n   *\n   * The provider's own unreadable axis is NOT a suspension: it is not a\n   * consumer anybody else must be warned about, and that file is the provider's\n   * own finding (`validate`, and the delta checks when the feature restates it).\n   * It is filed as `ownSuspended`, which only the gate reads.\n   */\n  const scanRequirements = async (rule: RequirementRule): Promise<Consumers> => {\n    const { services, ambiguous } = await livingFleet(docsDir, context);\n    const out: Consumers = { victims: [], suspended: [], own: [], ownSuspended: [] };\n    for (const id of [...services.keys()].sort()) {\n      const state = services.get(id)!;\n      const mine = id === rule.provider;\n      for (const axis of REQUIREMENT_AXES) {\n        if (mine && !rule.ownAxes.includes(axis)) continue;\n        const reqs = await requirementsOf(state, axis);\n        if (!Array.isArray(reqs)) {\n          if (mine) out.ownSuspended.push({ kind: \"unreadable\", text: `${id} — ${reqs.unreadable} could not be read, so its own requirements could not be scanned` });\n          else out.suspended.push({ kind: \"unreadable\", text: `${id} — ${reqs.unreadable} could not be read, so its requirements could not be scanned` });\n          continue;\n        }\n        for (const m of reqs) {\n          if (m.requirement.kind === \"REMOVED\") continue;\n          if (mine ? rule.own(m.requirement) : await rule.foreign(state, m.requirement)) {\n            (mine ? out.own : out.victims).push(label(id, m));\n          }\n        }\n      }\n    }\n    for (const [id, dirs] of [...ambiguous].sort(byFirst)) {\n      const text = `${id} — claimed by ${dirs.join(\" and \")}, so its ${id === rule.provider ? \"own \" : \"\"}documents could not be scanned`;\n      (id === rule.provider ? out.ownSuspended : out.suspended).push({ kind: \"ambiguous\", text });\n    }\n    return out;\n  };\n\n  /** Ownership as the merge leaves it: the feature's contract for a service it carries one for, the living one otherwise. */\n  const owns = async (state: ServiceState, op: string): Promise<boolean> =>\n    (await after?.defines(state.id, op)) ?? ownsOperation(state, op);\n\n  const opConsumers = async (provider: string, op: string): Promise<Consumers> => {\n    const map = await livingMap(docsDir, context);\n    const edges: string[] = [];\n    const internal: string[] = [];\n    const unlinked: Suspension[] = [];\n    for (const r of map.relationships ?? []) {\n      if (map.resolve(r.target) !== provider) continue;\n      // An edge whose SOURCE resolves to the provider as well is the provider's\n      // own internal call — `own`, never a victim (the header says why). The\n      // spine still grades it against the contract, so the gate counts it.\n      const self = map.resolve(r.source) === provider;\n      if (r.op === op) {\n        (self ? internal : edges).push(EDGE(map.resolve, r));\n      } else if (!self && r.op === undefined && r.publishes === undefined && r.consumes === undefined) {\n        // A caller drawn with NO op is neither a victim nor proof of absence:\n        // it calls the provider, and nobody wrote down which operation.\n        // Dropping it silently made every removal on a seeded fleet (`loam\n        // seed` draws every edge without an op) read \"no current landscape\n        // edge names it\" while validate warned `spine.op-link-missing` on the\n        // very edge. It rides as a suspension — a warning's worth of doubt,\n        // never an error, so an op-less map does not turn every removal red:\n        // its kind is `unlinked`, which the removal gate does not refuse on\n        // (`documentDoubt` in ./scan.ts says which kinds it does, and why).\n        // An edge naming a message instead (`publishes`/`consumes`) said what\n        // it carries and is the message half's to grade.\n        unlinked.push({ kind: \"unlinked\", text: `${EDGE(map.resolve, r)} has no \\`metadata { op }\\`, so whether it calls '${op}' is unknown` });\n      }\n    }\n    const reqs = await scanRequirements({\n      provider,\n      foreign: async (state, r) => r.operations.includes(op) && !(await owns(state, op)),\n      own: (r) => r.operations.includes(op),\n      // spec.md only: `validate` resolves an `Operations:` line against its\n      // own service's contract there (`spec-api.op-undefined`) and never in\n      // arch.spec.md, so the provider's arch.spec.md line naming the operation\n      // strands nothing — refusing for it turned a removal that archived\n      // before the one index into an exit 1 (the contract review, finding 2).\n      // Another service's arch.spec.md line still counts: there it is a\n      // dependency on this contract, as `loam dependencies` reads it.\n      ownAxes: [\"spec\"],\n    });\n    // Flows last in each list, deliberately: the edge and the requirement say\n    // WHICH document to open, and the flow says what the reader is about to\n    // break — so a `details[]` scanned top-down ends on the consequence.\n    const hops = hopsExercising(map.useCases, { provider, op });\n    return {\n      victims: [...edges, ...reqs.victims, ...hops.breaks],\n      suspended: [...unlinked, ...reqs.suspended, ...hops.unsure.map((text): Suspension => ({ kind: \"contested\", text }))],\n      own: [...internal, ...reqs.own],\n      ownSuspended: reqs.ownSuspended,\n    };\n  };\n\n  const messageConsumers = async (provider: string, name: string): Promise<Consumers> => {\n    const map = await livingMap(docsDir, context);\n    const edges: string[] = [];\n    const outbound: string[] = [];\n    for (const r of map.relationships ?? []) {\n      // The message join is fleet-global (names are not service-scoped), so\n      // every edge naming it counts, whoever its producer is — except one INTO\n      // the provider itself: its own consumption leaves in the same change, and\n      // counting it would gate every self-consuming producer on its own\n      // retirement.\n      if (r.consumes === name && map.resolve(r.target) !== provider) edges.push(EDGE(map.resolve, r));\n      // The provider's OWN `publishes` edge is the op half's internal edge on\n      // this axis: the spine grades a publishes edge on its SOURCE\n      // (`spine.message-undefined` when the source's contract sends no such\n      // message), so once the provider stops sending it the edge strands the\n      // provider itself — `own`, which only the gate counts. Collecting the\n      // `Publishes:` lines alone let a full retirement archive at exit 0 over\n      // a living publishes edge (the one-index review, finding 3). Another\n      // service's publishes edge is that service's claim, untouched by this one.\n      if (r.publishes === name && map.resolve(r.source) === provider) outbound.push(EDGE(map.resolve, r));\n    }\n    // No ownership rule here, and the asymmetry is the contract's: a consumer\n    // declares the message in its OWN contract with `action: receive` — validate\n    // requires it to — so its own contract naming the message proves nothing\n    // about who sends it. The provider's own `Consumes:` line stays out for the\n    // edge's reason above; its own `Publishes:` line is what `own` is for,\n    // beside its publishes edges.\n    const reqs = await scanRequirements({\n      provider,\n      foreign: async (_state, r) => r.consumes.includes(name),\n      own: (r) => r.publishes.includes(name),\n      // Both: `validate` grades a `Publishes:` line in either file\n      // (`spec-event.message-undefined`), the outbox requirement in\n      // arch.spec.md being its canonical home.\n      ownAxes: REQUIREMENT_AXES,\n    });\n    const hops = hopsConsuming(map.useCases, { provider, name });\n    return { victims: [...edges, ...reqs.victims, ...hops], suspended: reqs.suspended, own: [...outbound, ...reqs.own], ownSuspended: reqs.ownSuspended };\n  };\n\n  const producers = async (name: string): Promise<string[]> => {\n    const { services } = await livingFleet(docsDir, context);\n    return [...services.keys()].sort().filter((id) => services.get(id)!.sent.includes(name));\n  };\n\n  // One rule per index, built at its first question: over the directories\n  // `after`'s merge leaves, or the living ones — never on the shared map memo,\n  // which every feature `validate --all` grades reads through one context.\n  let outside: Promise<(name: string) => string | null> | undefined;\n  const externalProducer = async (name: string): Promise<string | null> => {\n    outside ??= (async () => (await livingMap(docsDir, context)).externalProducerRule((await after?.services()) ?? []))();\n    return (await outside)(name);\n  };\n\n  return { opConsumers, messageConsumers, producers, externalProducer };\n}\n"]}