@ybotok/loam 0.1.0-beta.3 → 0.2.0-alpha.13

package/dist/commands/archive/plan/document/run.js

@@ -0,0 +1,136 @@
+/**
+ * The in-place half of a requirement merge: a living document that already
+ * exists has its requirements RUN rewritten, and nothing else.
+ *
+ * Moved out of `../specs.ts` when that module took on what a CREATED document
+ * says (`./head.ts`) and where a merged link points (`./links.ts`): the three
+ * are the document-level questions a requirement merge answers, and the merge
+ * loop itself is what is left beside the contract and landscape planners.
+ */
+import { parseRequirements, splitRequirementsSection } from "../../../../core/document/parse.js";
+import { serializeRequirements } from "../../../../core/document/spec.js";
+/**
+ * Rewrite ONLY what the delta touched inside a living spec's requirements run.
+ * Byte-for-byte preserved: everything before the first requirement inside
+ * `## Requirements` (the intro, the heading line, prose under the heading) and
+ * everything from the section's end onward (the next `## ` heading to EOF) —
+ * the old cut was a substring `indexOf("\n## Requirements")`, a prefix match
+ * that also hit `## Requirements Extra` and silently destroyed every section
+ * after the requirements. `living` must be every living requirement — the gate's
+ * stray guard refuses any document whose requirements sit outside the section,
+ * using the same heading definition, before this output is ever written.
+ *
+ * Inside the run the unit is one requirement, and an untouched one is written
+ * back as its raw slice (`spliceRun`). The whole run used to be re-serialized,
+ * and `serializeRequirements` writes a blank line under every
+ * `### Requirement:` heading — so a living spec written without one, the shape
+ * the adopt brief's own examples taught, had that line inserted under every
+ * requirement the feature never mentioned. The diff, the vouch pack and the
+ * re-vouch all widened from the delta to the whole section.
+ *
+ * Exported for `../specs.ts`, which calls it for both corpora, and for
+ * test/archive.test.ts: the slice-to-requirement join (`verbatimSlices`) can
+ * only be handed a disagreeing pair directly, because the gate refuses every
+ * document that would produce one through the CLI.
+ */
+export function rewriteRequirementsRun(text, living, merged) {
+    const s = splitRequirementsSection(text);
+    // No `## Requirements` at all: the stray guard has already refused any doc
+    // whose requirements live elsewhere, so this one has none — open the section.
+    if (s === null)
+        return `${text.trimEnd()}\n\n## Requirements\n\n${serializeRequirements(merged)}`;
+    if (s.run !== "")
+        return s.head + spliceRun(s, living, merged) + s.tail;
+    // The section held no requirements yet: head and tail are raw slices, and the
+    // glue supplies the blank lines the author never had reason to write.
+    const headGlue = s.head.endsWith("\n\n") ? "" : s.head.endsWith("\n") ? "\n" : "\n\n";
+    const tailGlue = s.tail === "" ? "" : "\n";
+    return s.head + headGlue + serializeRequirements(merged) + tailGlue + s.tail;
+}
+/** The line breaks (and blank lines) a slice ends with — what separates it from whatever follows. */
+const TRAILING_BREAKS = /(?:\r?\n[ \t]*)*$/;
+/**
+ * The merged run: every living requirement the delta left alone as its raw
+ * slice, every one it added or replaced serialized, in `merged`'s order.
+ *
+ * Keyed on object identity, which `applyRequirementDelta` keeps for exactly the
+ * requirements it did not touch — so there is no second reading here of what
+ * the delta changed, and no way for the splice and the algebra to disagree.
+ * Which slice belongs to which living requirement is `verbatimSlices`' join.
+ *
+ * Prose BETWEEN requirements rides in the slice of the requirement above it,
+ * which is where parseRequirements attributes it too: it survives verbatim
+ * beside an untouched requirement and goes with a replaced one, as it always
+ * did — a MODIFIED carries its full new text.
+ */
+function spliceRun(section, living, merged) {
+    const verbatim = verbatimSlices(section.requirements, living);
+    let out = "";
+    let previousVerbatim = true;
+    for (const requirement of merged) {
+        const raw = verbatim.get(requirement);
+        // Two untouched neighbours keep whatever the author put between them. Next
+        // to a serialized requirement the canonical blank line is ADDED after the
+        // untouched text, never by rewriting it.
+        if (out !== "" && (raw === undefined || !previousVerbatim))
+            out = withBlankLine(out);
+        out += raw ?? serializeRequirements([requirement]);
+        previousVerbatim = raw !== undefined;
+    }
+    if (out === "")
+        return "";
+    // The run ends as it ended: whatever separated the old last requirement from
+    // the next heading (or EOF) now follows the new last one — and at least a
+    // newline when a merged requirement lands where the file used to stop without one.
+    const ending = section.run.slice(section.run.search(TRAILING_BREAKS));
+    const body = out.slice(0, out.search(TRAILING_BREAKS));
+    return body + (ending === "" && merged.at(-1) !== living.at(-1) ? "\n" : ending);
+}
+/** A requirement's identity as the merge selects it: `Requirement-ID:` when authored, the exact heading otherwise. */
+const identity = (r) => (r.id === undefined ? `name:${r.name}` : `id:${r.id}`);
+/**
+ * Each living requirement's raw slice, joined on its IDENTITY — the slice read
+ * back through the same parser that produced `living`, so a slice can only
+ * land in place of the requirement it actually is.
+ *
+ * The join used to be by position, guarded by a count. The two walks agree in
+ * order today (one heading-and-fence definition, core/document/parse.ts, and
+ * the gate's stray guard refusing any requirement outside the section), but
+ * nothing declared that, and equal counts paired differently would have written
+ * one requirement's bytes where another belongs — under its vouch stamp, with
+ * nothing to say so.
+ *
+ * Fails closed to the empty map, which serializes every requirement — the old
+ * whole-run rewrite, still a correct merge and only a wider diff: when the
+ * counts differ, when a slice does not read as exactly one requirement, when
+ * two slices claim one identity, or when a living requirement finds no slice
+ * of its own.
+ */
+function verbatimSlices(slices, living) {
+    const none = new Map();
+    if (slices.length !== living.length)
+        return none;
+    const byIdentity = new Map();
+    for (const slice of slices) {
+        const [only, ...more] = parseRequirements(slice);
+        if (only === undefined || more.length > 0 || byIdentity.has(identity(only)))
+            return none;
+        byIdentity.set(identity(only), slice);
+    }
+    const verbatim = new Map();
+    for (const requirement of living) {
+        const slice = byIdentity.get(identity(requirement));
+        if (slice === undefined)
+            return none;
+        // Taken once: a second living requirement of the same identity finds nothing.
+        byIdentity.delete(identity(requirement));
+        verbatim.set(requirement, slice);
+    }
+    return verbatim;
+}
+/** `text` ending in a blank line: line breaks appended to make one, nothing rewritten. */
+function withBlankLine(text) {
+    const breaks = text.slice(text.search(TRAILING_BREAKS)).split("\n").length - 1;
+    return breaks >= 2 ? text : text + "\n".repeat(2 - breaks);
+}
+//# sourceMappingURL=run.js.map

package/dist/commands/archive/plan/document/run.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run.js","sourceRoot":"","sources":["../../../../../src/commands/archive/plan/document/run.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AACjG,OAAO,EAAE,qBAAqB,EAAoB,MAAM,mCAAmC,CAAC;AAE5F;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAY,EAAE,MAAqB,EAAE,MAAqB;IAC/F,MAAM,CAAC,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;IACzC,2EAA2E;IAC3E,8EAA8E;IAC9E,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,0BAA0B,qBAAqB,CAAC,MAAM,CAAC,EAAE,CAAC;IAClG,IAAI,CAAC,CAAC,GAAG,KAAK,EAAE;QAAE,OAAO,CAAC,CAAC,IAAI,GAAG,SAAS,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;IACxE,8EAA8E;IAC9E,sEAAsE;IACtE,MAAM,QAAQ,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;IACtF,MAAM,QAAQ,GAAG,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3C,OAAO,CAAC,CAAC,IAAI,GAAG,QAAQ,GAAG,qBAAqB,CAAC,MAAM,CAAC,GAAG,QAAQ,GAAG,CAAC,CAAC,IAAI,CAAC;AAC/E,CAAC;AAED,qGAAqG;AACrG,MAAM,eAAe,GAAG,mBAAmB,CAAC;AAE5C;;;;;;;;;;;;;GAaG;AACH,SAAS,SAAS,CAChB,OAAgD,EAChD,MAAqB,EACrB,MAAqB;IAErB,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IAC9D,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,gBAAgB,GAAG,IAAI,CAAC;IAC5B,KAAK,MAAM,WAAW,IAAI,MAAM,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACtC,2EAA2E;QAC3E,0EAA0E;QAC1E,yCAAyC;QACzC,IAAI,GAAG,KAAK,EAAE,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,gBAAgB,CAAC;YAAE,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QACrF,GAAG,IAAI,GAAG,IAAI,qBAAqB,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;QACnD,gBAAgB,GAAG,GAAG,KAAK,SAAS,CAAC;IACvC,CAAC;IACD,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,EAAE,CAAC;IAC1B,6EAA6E;IAC7E,0EAA0E;IAC1E,mFAAmF;IACnF,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC;IACtE,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC;IACvD,OAAO,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,IAAI,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;AACnF,CAAC;AAED,sHAAsH;AACtH,MAAM,QAAQ,GAAG,CAAC,CAAmC,EAAU,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAEzH;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAS,cAAc,CAAC,MAAgB,EAAE,MAAqB;IAC7D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC5C,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACjD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC7C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;QACjD,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACzF,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;IACxC,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAuB,CAAC;IAChD,KAAK,MAAM,WAAW,IAAI,MAAM,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;QACpD,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QACrC,8EAA8E;QAC9E,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;QACzC,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,0FAA0F;AAC1F,SAAS,aAAa,CAAC,IAAY;IACjC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IAC/E,OAAO,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC;AAC7D,CAAC","sourcesContent":["/**\n * The in-place half of a requirement merge: a living document that already\n * exists has its requirements RUN rewritten, and nothing else.\n *\n * Moved out of `../specs.ts` when that module took on what a CREATED document\n * says (`./head.ts`) and where a merged link points (`./links.ts`): the three\n * are the document-level questions a requirement merge answers, and the merge\n * loop itself is what is left beside the contract and landscape planners.\n */\nimport { parseRequirements, splitRequirementsSection } from \"../../../../core/document/parse.js\";\nimport { serializeRequirements, type Requirement } from \"../../../../core/document/spec.js\";\n\n/**\n * Rewrite ONLY what the delta touched inside a living spec's requirements run.\n * Byte-for-byte preserved: everything before the first requirement inside\n * `## Requirements` (the intro, the heading line, prose under the heading) and\n * everything from the section's end onward (the next `## ` heading to EOF) —\n * the old cut was a substring `indexOf(\"\\n## Requirements\")`, a prefix match\n * that also hit `## Requirements Extra` and silently destroyed every section\n * after the requirements. `living` must be every living requirement — the gate's\n * stray guard refuses any document whose requirements sit outside the section,\n * using the same heading definition, before this output is ever written.\n *\n * Inside the run the unit is one requirement, and an untouched one is written\n * back as its raw slice (`spliceRun`). The whole run used to be re-serialized,\n * and `serializeRequirements` writes a blank line under every\n * `### Requirement:` heading — so a living spec written without one, the shape\n * the adopt brief's own examples taught, had that line inserted under every\n * requirement the feature never mentioned. The diff, the vouch pack and the\n * re-vouch all widened from the delta to the whole section.\n *\n * Exported for `../specs.ts`, which calls it for both corpora, and for\n * test/archive.test.ts: the slice-to-requirement join (`verbatimSlices`) can\n * only be handed a disagreeing pair directly, because the gate refuses every\n * document that would produce one through the CLI.\n */\nexport function rewriteRequirementsRun(text: string, living: Requirement[], merged: Requirement[]): string {\n  const s = splitRequirementsSection(text);\n  // No `## Requirements` at all: the stray guard has already refused any doc\n  // whose requirements live elsewhere, so this one has none — open the section.\n  if (s === null) return `${text.trimEnd()}\\n\\n## Requirements\\n\\n${serializeRequirements(merged)}`;\n  if (s.run !== \"\") return s.head + spliceRun(s, living, merged) + s.tail;\n  // The section held no requirements yet: head and tail are raw slices, and the\n  // glue supplies the blank lines the author never had reason to write.\n  const headGlue = s.head.endsWith(\"\\n\\n\") ? \"\" : s.head.endsWith(\"\\n\") ? \"\\n\" : \"\\n\\n\";\n  const tailGlue = s.tail === \"\" ? \"\" : \"\\n\";\n  return s.head + headGlue + serializeRequirements(merged) + tailGlue + s.tail;\n}\n\n/** The line breaks (and blank lines) a slice ends with — what separates it from whatever follows. */\nconst TRAILING_BREAKS = /(?:\\r?\\n[ \\t]*)*$/;\n\n/**\n * The merged run: every living requirement the delta left alone as its raw\n * slice, every one it added or replaced serialized, in `merged`'s order.\n *\n * Keyed on object identity, which `applyRequirementDelta` keeps for exactly the\n * requirements it did not touch — so there is no second reading here of what\n * the delta changed, and no way for the splice and the algebra to disagree.\n * Which slice belongs to which living requirement is `verbatimSlices`' join.\n *\n * Prose BETWEEN requirements rides in the slice of the requirement above it,\n * which is where parseRequirements attributes it too: it survives verbatim\n * beside an untouched requirement and goes with a replaced one, as it always\n * did — a MODIFIED carries its full new text.\n */\nfunction spliceRun(\n  section: { run: string; requirements: string[] },\n  living: Requirement[],\n  merged: Requirement[],\n): string {\n  const verbatim = verbatimSlices(section.requirements, living);\n  let out = \"\";\n  let previousVerbatim = true;\n  for (const requirement of merged) {\n    const raw = verbatim.get(requirement);\n    // Two untouched neighbours keep whatever the author put between them. Next\n    // to a serialized requirement the canonical blank line is ADDED after the\n    // untouched text, never by rewriting it.\n    if (out !== \"\" && (raw === undefined || !previousVerbatim)) out = withBlankLine(out);\n    out += raw ?? serializeRequirements([requirement]);\n    previousVerbatim = raw !== undefined;\n  }\n  if (out === \"\") return \"\";\n  // The run ends as it ended: whatever separated the old last requirement from\n  // the next heading (or EOF) now follows the new last one — and at least a\n  // newline when a merged requirement lands where the file used to stop without one.\n  const ending = section.run.slice(section.run.search(TRAILING_BREAKS));\n  const body = out.slice(0, out.search(TRAILING_BREAKS));\n  return body + (ending === \"\" && merged.at(-1) !== living.at(-1) ? \"\\n\" : ending);\n}\n\n/** A requirement's identity as the merge selects it: `Requirement-ID:` when authored, the exact heading otherwise. */\nconst identity = (r: Pick<Requirement, \"id\" | \"name\">): string => (r.id === undefined ? `name:${r.name}` : `id:${r.id}`);\n\n/**\n * Each living requirement's raw slice, joined on its IDENTITY — the slice read\n * back through the same parser that produced `living`, so a slice can only\n * land in place of the requirement it actually is.\n *\n * The join used to be by position, guarded by a count. The two walks agree in\n * order today (one heading-and-fence definition, core/document/parse.ts, and\n * the gate's stray guard refusing any requirement outside the section), but\n * nothing declared that, and equal counts paired differently would have written\n * one requirement's bytes where another belongs — under its vouch stamp, with\n * nothing to say so.\n *\n * Fails closed to the empty map, which serializes every requirement — the old\n * whole-run rewrite, still a correct merge and only a wider diff: when the\n * counts differ, when a slice does not read as exactly one requirement, when\n * two slices claim one identity, or when a living requirement finds no slice\n * of its own.\n */\nfunction verbatimSlices(slices: string[], living: Requirement[]): Map<Requirement, string> {\n  const none = new Map<Requirement, string>();\n  if (slices.length !== living.length) return none;\n  const byIdentity = new Map<string, string>();\n  for (const slice of slices) {\n    const [only, ...more] = parseRequirements(slice);\n    if (only === undefined || more.length > 0 || byIdentity.has(identity(only))) return none;\n    byIdentity.set(identity(only), slice);\n  }\n  const verbatim = new Map<Requirement, string>();\n  for (const requirement of living) {\n    const slice = byIdentity.get(identity(requirement));\n    if (slice === undefined) return none;\n    // Taken once: a second living requirement of the same identity finds nothing.\n    byIdentity.delete(identity(requirement));\n    verbatim.set(requirement, slice);\n  }\n  return verbatim;\n}\n\n/** `text` ending in a blank line: line breaks appended to make one, nothing rewritten. */\nfunction withBlankLine(text: string): string {\n  const breaks = text.slice(text.search(TRAILING_BREAKS)).split(\"\\n\").length - 1;\n  return breaks >= 2 ? text : text + \"\\n\".repeat(2 - breaks);\n}\n"]}

package/dist/commands/archive/plan/gate.js

@@ -0,0 +1,319 @@
+/**
+ * Every refusal that happens before a byte is planned.
+ *
+ * They are gathered here because they share one doctrine that is easy to lose:
+ * `--approve` overrides judgments about the FEATURE, and nothing else. A service
+ * directory whose name the id grammar refuses, a living document holding git
+ * conflict markers, a requirement outside `## Requirements` — those are
+ * mechanical facts about paths and files, so `--approve` does not reach them,
+ * and the dry run is gated too, since a plan built on one describes a merge loam
+ * must never perform.
+ *
+ * `null` means the refusal has already been printed and the exit code set.
+ */
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+import { fail, repoPath, sayExplain } from "../../../core/envelope/json.js";
+import { approveOverrides, gatesArchive } from "../../../core/vocabulary/issue.js";
+import { recoverInterruptedCommit } from "../../../core/staging/recovery/recover.js";
+import { readUtf8 } from "../../../core/staging/writes.js";
+import { loadFile } from "../../../core/c4/likec4.js";
+import { archiveDir as archiveRoot, featurePaths, featureSpecPaths, SPEC_AXES } from "../../../core/repo/paths.js";
+import { livingCapabilityPaths } from "../../../core/repo/authored/paths.js";
+import { locateServicePaths } from "../../../core/repo/service-target.js";
+import { featureSpecServices, missingFeatureMessage, resolveFeature } from "../../../core/repo/repo.js";
+import { featureCoherence } from "../../../core/coherence/coherence.js";
+import { invalidSpecServiceFindings, livingMergeConflicts, unknownDeltaServices, } from "../../../core/coherence/living.js";
+import { SEVERITY_MARK } from "../../../core/vocabulary/report.js";
+import { isRequirementsHeading, parseRequirements } from "../../../core/document/parse.js";
+import { refuseFindings, refuseJson, sayRecovery } from "./refusal.js";
+import {} from "./state.js";
+export async function gate(config, featureId, opts, say) {
+    const json = opts.json === true;
+    // Before anything is read: a commit that was killed between two renames left
+    // the living docs half-written, and every other command in loam would have
+    // planned against them as if they were the truth. Under the same lock, so the
+    // repair cannot race a writer. It refuses when the half-merged files have been
+    // edited since — that is a human's call, not a merge's.
+    const recovered = await recoverInterruptedCommit(config.docsDir);
+    if (recovered !== null && !json)
+        sayRecovery(recovered);
+    const feature = await resolveFeature(config.docsDir, featureId, "exclude");
+    if (!feature) {
+        fail(json, "unknown-target", await missingFeatureMessage(config.docsDir, featureId));
+        return null;
+    }
+    // The raw argument's last appearance: from here on the feature answers only to
+    // its canonical id — tags, coherence, and the self-exclusion scans all match
+    // on `id`, and `archive FEAT-5-slug` must plan exactly like `archive FEAT-5`.
+    const { id, dirName, dir: featureDir } = feature;
+    // Parse delta.likec4 ONCE for the whole run: the coherence gate and the
+    // architecture merge below read the same file, and loading it spins up a
+    // fresh Langium workspace each time. Nothing writes it in between.
+    const deltaLikec4 = featurePaths(featureDir).delta;
+    const deltaDoc = existsSync(deltaLikec4) ? await loadFile(deltaLikec4) : undefined;
+    const deltaServices = await featureSpecServices(featureDir);
+    // The business corpus's delta tree, walked once HERE and carried on `Gated`:
+    // the conflict-marker scan, the strayed-requirement scan and the merge itself
+    // all ask which capability documents this feature rewrites, and three walks
+    // are three chances to answer differently. `featureCoherence` below walks it
+    // again on its own — it is called without `config.fleet`, the same
+    // no-context path `core/coherence/declared.ts` already documents paying for
+    // the arch delta — so this is not the run's only walk, only the one every
+    // phase downstream of the gate shares.
+    const capabilityDeltas = (await config.fleet.featureCapabilityDeltas(featureDir)).docs;
+    // A `specs/<svc>/` whose NAME is not a legal service id, refused before
+    // anything joins that name into a path: the conflict scan below probes
+    // `services/<svc>/<axis>` with it, and the requirements merge would
+    // materialise `services/<svc>/` from it — a directory `service.id-invalid`
+    // then calls an error on the next `validate --all`, and one no loam command
+    // can address or re-create. The set comes from coherence/living.ts's
+    // `invalidSpecServiceFindings` — the same function validate reads — so the
+    // two gates cannot drift.
+    //
+    // --approve does not apply, exactly as with the conflict-marker refusal
+    // below: --approve overrides judgments about the FEATURE, and a name the id
+    // grammar refuses is a mechanical fact about the path it would become. The
+    // dry run is gated too: a plan built on that name describes a merge loam
+    // must never perform.
+    const illegalServices = await invalidSpecServiceFindings(featureDir);
+    if (illegalServices.length > 0) {
+        const msg = `archive ${id} — BLOCKED: ${illegalServices.length} per-service delta(s) named by an illegal service id; --approve does not override this`;
+        if (json) {
+            refuseFindings("not-coherent", msg, illegalServices, `features/${dirName}`);
+            return null;
+        }
+        console.error(`${msg}:`);
+        for (const f of illegalServices)
+            console.error(`  ✗ ${f.message}`);
+        console.error(`\n--approve does not override this — the directory the merge would create is one loam can never address, mechanically.`);
+        // Every arm in this file refuses by hand — it prints a headline, a list and
+        // a closing sentence rather than the one message `fail()` takes — so the
+        // code and its lookup have to be asked for explicitly. `sayExplain` is
+        // called rather than the format being copied six times, and the code passed
+        // is the SAME one the `--json` branch a few lines up emits: text and
+        // envelope must name one refusal, or a reader who switches modes to find
+        // the code is handed a different answer than the one they saw.
+        sayExplain("not-coherent");
+        process.exitCode = 1;
+        return null;
+    }
+    // Git conflict markers in a LIVING document this merge would rewrite, before
+    // anything else is asked of it. Both sides of somebody's merge are in the
+    // file, so nothing it says is anyone's text — and the requirements rewrite
+    // deletes whichever marker lines fall inside a requirement it replaces, turning a
+    // conflict anyone can see into a file nobody can tell is wrong. Checked ahead
+    // of the coherence gate for `inspectLandscape`'s reason: a conflicted
+    // document parses, so every verdict downstream of it is an opinion about half
+    // of two people's work.
+    //
+    // --approve does not apply, exactly as with the strayed-requirement refusal
+    // below: --approve overrides judgments about the FEATURE, and this is a fact
+    // about the living document.
+    const conflicted = await livingMergeConflicts(config.docsDir, deltaServices, capabilityDeltas.map((d) => d.id));
+    if (conflicted.length > 0) {
+        const msg = `archive ${id} — BLOCKED: ${conflicted.length} living document(s) still hold git conflict markers`;
+        if (json) {
+            refuseFindings("merge-failed", msg, conflicted, `features/${dirName}`);
+            return null;
+        }
+        console.error(`${msg}:`);
+        for (const f of conflicted)
+            console.error(`  ✗ ${f.message}`);
+        console.error(`\n--approve does not override this — the loss is mechanical, not a judgment call.`);
+        sayExplain("merge-failed");
+        process.exitCode = 1;
+        return null;
+    }
+    // Gate: GATING issues block the archive. Severity and gating are two
+    // different questions (issue.ts): errors gate because the merge would write
+    // something wrong, and the rare warning marked `gates` blocks too — the
+    // document is legal but the merge would drop authored content. Advisory
+    // warnings are printed (and carried into --json) but never block, matching
+    // validate's own doctrine (report.ts: "warnings never gate"). --approve
+    // overrides the gating issues ONLY, and must say exactly which ones it is
+    // walking past. A dry run is gated too: a plan for a merge that would be
+    // refused describes nothing that will happen.
+    const issues = await featureCoherence({ docsDir: config.docsDir, featureDir, featureId: id, preloadedDelta: deltaDoc });
+    // The issues --approve cannot move, carved out before the gate below reads
+    // the rest. The register is issue.ts's `approveOverrides` — the same data
+    // the `overridable` key in the envelope is resolved from — never a code
+    // string spelled here, because two spellings of "what the flag moves" would
+    // drift. What the register HOLDS has grown: it began as one code (a
+    // `metadata { service }` binding the id grammar refuses, where the merge
+    // would splice the name into the living map verbatim and probe
+    // `services/<binding>/` with it) and now holds the create-only collisions of
+    // every whole-file axis besides. They share the doctrine and nothing else —
+    // each is a mechanical fact about what the merge would write, never a
+    // judgment about the feature — which is why the message below counts them
+    // and lets each issue say its own sentence.
+    //
+    // IT USED TO NAME BINDINGS, and had been wrong for every other code in the
+    // register since the use-case slot landed: a feature whose flow collided
+    // with a living one was refused with "1 element binding(s) name an illegal
+    // service id", about a feature that binds nothing. A refusal headline that
+    // describes the wrong breach sends its reader to the wrong file first.
+    const nonOverridable = issues.filter((i) => !approveOverrides(i));
+    if (nonOverridable.length > 0) {
+        const msg = `archive ${id} — BLOCKED: ${nonOverridable.length} issue(s) --approve does not override; each names what the merge would write`;
+        if (json) {
+            refuseJson("not-coherent", msg, issues, `features/${dirName}`);
+            return null;
+        }
+        console.error(`${msg}:`);
+        // The whole list, not just the carve-out: the reader is about to fix the
+        // feature, and the issues --approve COULD have moved are work they still
+        // owe — hiding them here made the second refusal a surprise. The closing
+        // line says which of the marks the flag cannot move.
+        for (const i of issues)
+            console.error(`  ${SEVERITY_MARK[i.severity]} ${i.message}`);
+        console.error(`\nOf these, --approve does not override ${nonOverridable.length}: ${[...new Set(nonOverridable.map((i) => i.code))].sort().join(", ")}. ` +
+            "Each is a mechanical fact about what the merge would write — a name loam cannot resolve, or a file it would replace wholesale — not a judgement the flag can move. " +
+            "Fix those; the other issues gate as usual.");
+        sayExplain("not-coherent");
+        process.exitCode = 1;
+        return null;
+    }
+    const gating = issues.filter(gatesArchive);
+    const advisory = issues.filter((i) => !gatesArchive(i));
+    if (gating.length > 0 && !opts.approve) {
+        const msg = `archive ${id} — BLOCKED: not coherent (${gating.length} gating issue(s), ${advisory.length} advisory warning(s))`;
+        if (json) {
+            refuseJson("not-coherent", msg, issues, `features/${dirName}`);
+            return null;
+        }
+        console.error(`${msg}:`);
+        for (const i of issues)
+            console.error(`  ${SEVERITY_MARK[i.severity]} ${i.message}`);
+        console.error(`\nFix the gating issues (advisory warnings never block), or re-run with --approve to override them (may corrupt the living docs).`);
+        sayExplain("not-coherent");
+        process.exitCode = 1;
+        return null;
+    }
+    if (gating.length > 0) {
+        say(`⚠ archiving despite ${gating.length} gating issue(s) (--approve):`);
+        for (const i of gating)
+            say(`  ${SEVERITY_MARK[i.severity]} ${i.message}`);
+        say();
+    }
+    if (advisory.length > 0) {
+        say(`⚠ ${advisory.length} warning(s) (non-blocking):`);
+        for (const i of advisory)
+            say(`  ⚠ ${i.message}`);
+        say();
+    }
+    // A `specs/<svc>/` addressed to a service that exists nowhere. `validate`
+    // graded this and archive did not, which is the half that costs something:
+    // `specs/<svc>/` is what the merge MATERIALISES `services/<svc>/` from, so a
+    // one-character slip in `--touches` archived at exit 0 and left the fleet a
+    // living service nobody meant to adopt. The set comes from coherence/living.ts's
+    // `unknownDeltaServices` — the same function validate reads — so the two
+    // gates cannot drift into disagreeing about which ids are real.
+    //
+    // Gated exactly like a coherence error, --approve included: which service you
+    // meant is a judgment about the FEATURE. A feature that genuinely introduces
+    // one has a better escape hatch than --approve anyway — tag its element in
+    // delta.likec4, which is also what makes the fleet map true afterwards.
+    const unknownServices = await unknownDeltaServices(config.docsDir, featureDir, id, { preloadedDelta: deltaDoc });
+    if (unknownServices.length > 0 && !opts.approve) {
+        const msg = `archive ${id} — BLOCKED: ${unknownServices.length} per-service delta(s) address a service that does not exist`;
+        if (json) {
+            refuseFindings("not-coherent", msg, unknownServices, `features/${dirName}`);
+            return null;
+        }
+        console.error(`${msg}:`);
+        for (const f of unknownServices)
+            console.error(`  ✗ ${f.message}`);
+        console.error(`\nFix the id, or introduce the service in this feature's delta.likec4 — or re-run with --approve to create it anyway.`);
+        sayExplain("not-coherent");
+        process.exitCode = 1;
+        return null;
+    }
+    if (unknownServices.length > 0) {
+        say(`⚠ archiving despite ${unknownServices.length} unknown service(s) (--approve) — this merge creates them:`);
+        for (const f of unknownServices)
+            say(`  ✗ ${f.message}`);
+        say();
+    }
+    // A LIVING requirement outside `## Requirements` is a merge loam cannot do
+    // correctly: the rewrite replaces only the requirements RUN inside that
+    // section (rewriteRequirementsRun) while parseRequirements collects from
+    // every section — so the strayed requirement keeps its authored copy in the
+    // preserved prose AND lands again in the rewritten run, and the next
+    // archive's MODIFIED replaces only one of them. Refused rather than
+    // repaired: excising blocks from prose programmatically would be archive
+    // editing text it does not understand. --approve does not apply — it
+    // overrides judgments about the FEATURE, and this is neither.
+    const strayed = [];
+    const scanStrayed = async (livingPath, subject) => {
+        if (!existsSync(livingPath))
+            return;
+        for (const r of parseRequirements(await readUtf8(livingPath))) {
+            // The ONE definition of the heading (spec.ts): the guard and the rewrite
+            // boundary match the same way, so they cannot disagree about "outside".
+            if (r.section !== undefined && isRequirementsHeading(r.section))
+                continue;
+            const where = r.section === undefined ? "above every heading" : `under '${r.section}'`;
+            strayed.push({
+                severity: "error",
+                code: "living.requirement-outside-requirements",
+                subject,
+                message: `${subject}: living requirement '${r.name}' sits ${where} in ${repoPath(config.docsDir, livingPath)} — the merge rewrites only '## Requirements', so it would land in the file twice. Re-home it under '## Requirements' first, then re-run.`,
+            });
+        }
+    };
+    for (const svc of deltaServices) {
+        for (const axis of SPEC_AXES) {
+            if (!existsSync(featureSpecPaths(featureDir, svc)[axis.key]))
+                continue;
+            // The shared context, because this sits in a deltaServices × SPEC_AXES
+            // loop: without it every iteration re-walks and re-reads the fleet.
+            await scanStrayed((await locateServicePaths(config.docsDir, svc, config.fleet))[axis.key], svc);
+        }
+    }
+    // The business corpus, for the identical mechanical reason: a capability
+    // document is narrative ABOVE `## Requirements`, `rewriteRequirementsRun`
+    // rewrites only the run inside that heading, and a requirement filed under
+    // `## Notes` would keep its authored copy in the preserved prose AND land
+    // again in the rewritten run.
+    for (const doc of capabilityDeltas) {
+        await scanStrayed(livingCapabilityPaths(config.docsDir, doc.id).spec, doc.id);
+    }
+    if (strayed.length > 0) {
+        const msg = `archive ${id} — BLOCKED: ${strayed.length} living requirement(s) outside '## Requirements'`;
+        if (json) {
+            refuseJson("living-outside-requirements", msg, strayed, `features/${dirName}`);
+            return null;
+        }
+        console.error(`${msg}:`);
+        for (const i of strayed)
+            console.error(`  ✗ ${i.message}`);
+        console.error(`\n--approve does not override this — the duplication is mechanical, not a judgment call.`);
+        sayExplain("living-outside-requirements");
+        process.exitCode = 1;
+        return null;
+    }
+    // Pre-flight: the archive destination must be free, or the final move would fail
+    // after the living docs were already rewritten.
+    const archiveDir = archiveRoot(config.docsDir);
+    const archiveDest = join(archiveDir, dirName);
+    if (existsSync(archiveDest)) {
+        fail(json, "archive-exists", `archive ${id} — BLOCKED: features/archive/${dirName} already exists. Remove or rename it, then re-run.`);
+        return null;
+    }
+    return {
+        id,
+        dirName,
+        featureDir,
+        deltaDoc,
+        deltaServices,
+        capabilityDeltas,
+        gating,
+        advisory,
+        archiveDir,
+        archiveDest,
+        recovered,
+        issues,
+    };
+}
+//# sourceMappingURL=gate.js.map

package/dist/commands/archive/plan/gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate.js","sourceRoot":"","sources":["../../../../src/commands/archive/plan/gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAC5E,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAc,MAAM,mCAAmC,CAAC;AAC/F,OAAO,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AACrF,OAAO,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAE,MAAM,4BAA4B,CAAC;AACtD,OAAO,EAAE,UAAU,IAAI,WAAW,EAAE,YAAY,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AACnH,OAAO,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAC7E,OAAO,EAAE,kBAAkB,EAAE,MAAM,sCAAsC,CAAC;AAC1E,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACxG,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AACxE,OAAO,EACL,0BAA0B,EAC1B,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAC;AACnE,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AAC3F,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,WAAW,EAAuB,MAAM,cAAc,CAAC;AAC5F,OAAO,EAAc,MAAM,YAAY,CAAC;AAIxC,MAAM,CAAC,KAAK,UAAU,IAAI,CACxB,MAAiD,EACjD,SAAiB,EACjB,IAAoB,EACpB,GAA4B;IAE5B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC;IAChC,6EAA6E;IAC7E,2EAA2E;IAC3E,8EAA8E;IAC9E,+EAA+E;IAC/E,wDAAwD;IACxD,MAAM,SAAS,GAAG,MAAM,wBAAwB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACjE,IAAI,SAAS,KAAK,IAAI,IAAI,CAAC,IAAI;QAAE,WAAW,CAAC,SAAS,CAAC,CAAC;IAExD,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;IAC3E,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,IAAI,CAAC,IAAI,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;QACrF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,+EAA+E;IAC/E,6EAA6E;IAC7E,8EAA8E;IAC9E,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;IAEjD,wEAAwE;IACxE,yEAAyE;IACzE,mEAAmE;IACnE,MAAM,WAAW,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC;IACnD,MAAM,QAAQ,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAEnF,MAAM,aAAa,GAAG,MAAM,mBAAmB,CAAC,UAAU,CAAC,CAAC;IAC5D,6EAA6E;IAC7E,8EAA8E;IAC9E,4EAA4E;IAC5E,6EAA6E;IAC7E,mEAAmE;IACnE,4EAA4E;IAC5E,0EAA0E;IAC1E,uCAAuC;IACvC,MAAM,gBAAgB,GAAG,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,uBAAuB,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;IAEvF,wEAAwE;IACxE,uEAAuE;IACvE,oEAAoE;IACpE,2EAA2E;IAC3E,4EAA4E;IAC5E,qEAAqE;IACrE,2EAA2E;IAC3E,0BAA0B;IAC1B,EAAE;IACF,wEAAwE;IACxE,4EAA4E;IAC5E,2EAA2E;IAC3E,yEAAyE;IACzE,sBAAsB;IACtB,MAAM,eAAe,GAAG,MAAM,0BAA0B,CAAC,UAAU,CAAC,CAAC;IACrE,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,WAAW,EAAE,eAAe,eAAe,CAAC,MAAM,wFAAwF,CAAC;QACvJ,IAAI,IAAI,EAAE,CAAC;YACT,cAAc,CAAC,cAAc,EAAE,GAAG,EAAE,eAAe,EAAE,YAAY,OAAO,EAAE,CAAC,CAAC;YAC5E,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC;QACzB,KAAK,MAAM,CAAC,IAAI,eAAe;YAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QACnE,OAAO,CAAC,KAAK,CAAC,wHAAwH,CAAC,CAAC;QACxI,4EAA4E;QAC5E,yEAAyE;QACzE,uEAAuE;QACvE,4EAA4E;QAC5E,qEAAqE;QACrE,yEAAyE;QACzE,+DAA+D;QAC/D,UAAU,CAAC,cAAc,CAAC,CAAC;QAC3B,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,6EAA6E;IAC7E,0EAA0E;IAC1E,2EAA2E;IAC3E,kFAAkF;IAClF,8EAA8E;IAC9E,sEAAsE;IACtE,8EAA8E;IAC9E,wBAAwB;IACxB,EAAE;IACF,4EAA4E;IAC5E,6EAA6E;IAC7E,6BAA6B;IAC7B,MAAM,UAAU,GAAG,MAAM,oBAAoB,CAAC,MAAM,CAAC,OAAO,EAAE,aAAa,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAChH,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,WAAW,EAAE,eAAe,UAAU,CAAC,MAAM,qDAAqD,CAAC;QAC/G,IAAI,IAAI,EAAE,CAAC;YACT,cAAc,CAAC,cAAc,EAAE,GAAG,EAAE,UAAU,EAAE,YAAY,OAAO,EAAE,CAAC,CAAC;YACvE,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC;QACzB,KAAK,MAAM,CAAC,IAAI,UAAU;YAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QAC9D,OAAO,CAAC,KAAK,CAAC,mFAAmF,CAAC,CAAC;QACnG,UAAU,CAAC,cAAc,CAAC,CAAC;QAC3B,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,qEAAqE;IACrE,4EAA4E;IAC5E,wEAAwE;IACxE,wEAAwE;IACxE,2EAA2E;IAC3E,wEAAwE;IACxE,0EAA0E;IAC1E,yEAAyE;IACzE,8CAA8C;IAC9C,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC,CAAC;IACxH,2EAA2E;IAC3E,0EAA0E;IAC1E,wEAAwE;IACxE,4EAA4E;IAC5E,oEAAoE;IACpE,yEAAyE;IACzE,+DAA+D;IAC/D,6EAA6E;IAC7E,4EAA4E;IAC5E,sEAAsE;IACtE,0EAA0E;IAC1E,4CAA4C;IAC5C,EAAE;IACF,2EAA2E;IAC3E,yEAAyE;IACzE,2EAA2E;IAC3E,2EAA2E;IAC3E,uEAAuE;IACvE,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC;IAClE,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,WAAW,EAAE,eAAe,cAAc,CAAC,MAAM,8EAA8E,CAAC;QAC5I,IAAI,IAAI,EAAE,CAAC;YACT,UAAU,CAAC,cAAc,EAAE,GAAG,EAAE,MAAM,EAAE,YAAY,OAAO,EAAE,CAAC,CAAC;YAC/D,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC;QACzB,yEAAyE;QACzE,yEAAyE;QACzE,yEAAyE;QACzE,qDAAqD;QACrD,KAAK,MAAM,CAAC,IAAI,MAAM;YAAE,OAAO,CAAC,KAAK,CAAC,KAAK,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QACrF,OAAO,CAAC,KAAK,CACX,2CAA2C,cAAc,CAAC,MAAM,KAAK,CAAC,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YACxI,qKAAqK;YACrK,4CAA4C,CAC/C,CAAC;QACF,UAAU,CAAC,cAAc,CAAC,CAAC;QAC3B,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,WAAW,EAAE,6BAA6B,MAAM,CAAC,MAAM,qBAAqB,QAAQ,CAAC,MAAM,uBAAuB,CAAC;QAC/H,IAAI,IAAI,EAAE,CAAC;YACT,UAAU,CAAC,cAAc,EAAE,GAAG,EAAE,MAAM,EAAE,YAAY,OAAO,EAAE,CAAC,CAAC;YAC/D,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC;QACzB,KAAK,MAAM,CAAC,IAAI,MAAM;YAAE,OAAO,CAAC,KAAK,CAAC,KAAK,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QACrF,OAAO,CAAC,KAAK,CAAC,mIAAmI,CAAC,CAAC;QACnJ,UAAU,CAAC,cAAc,CAAC,CAAC;QAC3B,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,GAAG,CAAC,uBAAuB,MAAM,CAAC,MAAM,+BAA+B,CAAC,CAAC;QACzE,KAAK,MAAM,CAAC,IAAI,MAAM;YAAE,GAAG,CAAC,KAAK,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3E,GAAG,EAAE,CAAC;IACR,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,GAAG,CAAC,KAAK,QAAQ,CAAC,MAAM,6BAA6B,CAAC,CAAC;QACvD,KAAK,MAAM,CAAC,IAAI,QAAQ;YAAE,GAAG,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QAClD,GAAG,EAAE,CAAC;IACR,CAAC;IAED,0EAA0E;IAC1E,2EAA2E;IAC3E,6EAA6E;IAC7E,4EAA4E;IAC5E,iFAAiF;IACjF,yEAAyE;IACzE,gEAAgE;IAChE,EAAE;IACF,8EAA8E;IAC9E,6EAA6E;IAC7E,2EAA2E;IAC3E,wEAAwE;IACxE,MAAM,eAAe,GAAG,MAAM,oBAAoB,CAAC,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC,CAAC;IACjH,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAChD,MAAM,GAAG,GAAG,WAAW,EAAE,eAAe,eAAe,CAAC,MAAM,6DAA6D,CAAC;QAC5H,IAAI,IAAI,EAAE,CAAC;YACT,cAAc,CAAC,cAAc,EAAE,GAAG,EAAE,eAAe,EAAE,YAAY,OAAO,EAAE,CAAC,CAAC;YAC5E,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC;QACzB,KAAK,MAAM,CAAC,IAAI,eAAe;YAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QACnE,OAAO,CAAC,KAAK,CAAC,uHAAuH,CAAC,CAAC;QACvI,UAAU,CAAC,cAAc,CAAC,CAAC;QAC3B,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,GAAG,CAAC,uBAAuB,eAAe,CAAC,MAAM,4DAA4D,CAAC,CAAC;QAC/G,KAAK,MAAM,CAAC,IAAI,eAAe;YAAE,GAAG,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QACzD,GAAG,EAAE,CAAC;IACR,CAAC;IAED,2EAA2E;IAC3E,wEAAwE;IACxE,yEAAyE;IACzE,4EAA4E;IAC5E,qEAAqE;IACrE,oEAAoE;IACpE,yEAAyE;IACzE,qEAAqE;IACrE,8DAA8D;IAC9D,MAAM,OAAO,GAAY,EAAE,CAAC;IAC5B,MAAM,WAAW,GAAG,KAAK,EAAE,UAAkB,EAAE,OAAe,EAAiB,EAAE;QAC/E,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,OAAO;QACpC,KAAK,MAAM,CAAC,IAAI,iBAAiB,CAAC,MAAM,QAAQ,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;YAC9D,yEAAyE;YACzE,wEAAwE;YACxE,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,IAAI,qBAAqB,CAAC,CAAC,CAAC,OAAO,CAAC;gBAAE,SAAS;YAC1E,MAAM,KAAK,GAAG,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,OAAO,GAAG,CAAC;YACvF,OAAO,CAAC,IAAI,CAAC;gBACX,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,yCAAyC;gBAC/C,OAAO;gBACP,OAAO,EAAE,GAAG,OAAO,yBAAyB,CAAC,CAAC,IAAI,UAAU,KAAK,OAAO,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,0IAA0I;aACvP,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;QAChC,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC7B,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAAE,SAAS;YACvE,uEAAuE;YACvE,oEAAoE;YACpE,MAAM,WAAW,CAAC,CAAC,MAAM,kBAAkB,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;QAClG,CAAC;IACH,CAAC;IACD,yEAAyE;IACzE,0EAA0E;IAC1E,2EAA2E;IAC3E,0EAA0E;IAC1E,8BAA8B;IAC9B,KAAK,MAAM,GAAG,IAAI,gBAAgB,EAAE,CAAC;QACnC,MAAM,WAAW,CAAC,qBAAqB,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAChF,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,WAAW,EAAE,eAAe,OAAO,CAAC,MAAM,kDAAkD,CAAC;QACzG,IAAI,IAAI,EAAE,CAAC;YACT,UAAU,CAAC,6BAA6B,EAAE,GAAG,EAAE,OAAO,EAAE,YAAY,OAAO,EAAE,CAAC,CAAC;YAC/E,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC;QACzB,KAAK,MAAM,CAAC,IAAI,OAAO;YAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3D,OAAO,CAAC,KAAK,CAAC,0FAA0F,CAAC,CAAC;QAC1G,UAAU,CAAC,6BAA6B,CAAC,CAAC;QAC1C,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,iFAAiF;IACjF,gDAAgD;IAChD,MAAM,UAAU,GAAG,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC/C,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC9C,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5B,IAAI,CAAC,IAAI,EAAE,gBAAgB,EAAE,WAAW,EAAE,gCAAgC,OAAO,oDAAoD,CAAC,CAAC;QACvI,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,EAAE;QACF,OAAO;QACP,UAAU;QACV,QAAQ;QACR,aAAa;QACb,gBAAgB;QAChB,MAAM;QACN,QAAQ;QACR,UAAU;QACV,WAAW;QACX,SAAS;QACT,MAAM;KACP,CAAC;AACJ,CAAC","sourcesContent":["/**\n * Every refusal that happens before a byte is planned.\n *\n * They are gathered here because they share one doctrine that is easy to lose:\n * `--approve` overrides judgments about the FEATURE, and nothing else. A service\n * directory whose name the id grammar refuses, a living document holding git\n * conflict markers, a requirement outside `## Requirements` — those are\n * mechanical facts about paths and files, so `--approve` does not reach them,\n * and the dry run is gated too, since a plan built on one describes a merge loam\n * must never perform.\n *\n * `null` means the refusal has already been printed and the exit code set.\n */\nimport { existsSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport { fail, repoPath, sayExplain } from \"../../../core/envelope/json.js\";\nimport { approveOverrides, gatesArchive, type Issue } from \"../../../core/vocabulary/issue.js\";\nimport { recoverInterruptedCommit } from \"../../../core/staging/recovery/recover.js\";\nimport { readUtf8 } from \"../../../core/staging/writes.js\";\nimport { loadFile } from \"../../../core/c4/likec4.js\";\nimport { archiveDir as archiveRoot, featurePaths, featureSpecPaths, SPEC_AXES } from \"../../../core/repo/paths.js\";\nimport { livingCapabilityPaths } from \"../../../core/repo/authored/paths.js\";\nimport { locateServicePaths } from \"../../../core/repo/service-target.js\";\nimport { featureSpecServices, missingFeatureMessage, resolveFeature } from \"../../../core/repo/repo.js\";\nimport { featureCoherence } from \"../../../core/coherence/coherence.js\";\nimport {\n  invalidSpecServiceFindings,\n  livingMergeConflicts,\n  unknownDeltaServices,\n} from \"../../../core/coherence/living.js\";\nimport { SEVERITY_MARK } from \"../../../core/vocabulary/report.js\";\nimport { isRequirementsHeading, parseRequirements } from \"../../../core/document/parse.js\";\nimport { refuseFindings, refuseJson, sayRecovery, type ArchiveOptions } from \"./refusal.js\";\nimport { type Gated } from \"./state.js\";\nimport type { DocsDir } from \"../../../core/kernel/ids/dirs.js\";\nimport type { FleetContext } from \"../../../core/fleet-context.js\";\n\nexport async function gate(\n  config: { docsDir: DocsDir; fleet: FleetContext },\n  featureId: string,\n  opts: ArchiveOptions,\n  say: (line?: string) => void,\n): Promise<Gated | null> {\n  const json = opts.json === true;\n  // Before anything is read: a commit that was killed between two renames left\n  // the living docs half-written, and every other command in loam would have\n  // planned against them as if they were the truth. Under the same lock, so the\n  // repair cannot race a writer. It refuses when the half-merged files have been\n  // edited since — that is a human's call, not a merge's.\n  const recovered = await recoverInterruptedCommit(config.docsDir);\n  if (recovered !== null && !json) sayRecovery(recovered);\n\n  const feature = await resolveFeature(config.docsDir, featureId, \"exclude\");\n  if (!feature) {\n    fail(json, \"unknown-target\", await missingFeatureMessage(config.docsDir, featureId));\n    return null;\n  }\n  // The raw argument's last appearance: from here on the feature answers only to\n  // its canonical id — tags, coherence, and the self-exclusion scans all match\n  // on `id`, and `archive FEAT-5-slug` must plan exactly like `archive FEAT-5`.\n  const { id, dirName, dir: featureDir } = feature;\n\n  // Parse delta.likec4 ONCE for the whole run: the coherence gate and the\n  // architecture merge below read the same file, and loading it spins up a\n  // fresh Langium workspace each time. Nothing writes it in between.\n  const deltaLikec4 = featurePaths(featureDir).delta;\n  const deltaDoc = existsSync(deltaLikec4) ? await loadFile(deltaLikec4) : undefined;\n\n  const deltaServices = await featureSpecServices(featureDir);\n  // The business corpus's delta tree, walked once HERE and carried on `Gated`:\n  // the conflict-marker scan, the strayed-requirement scan and the merge itself\n  // all ask which capability documents this feature rewrites, and three walks\n  // are three chances to answer differently. `featureCoherence` below walks it\n  // again on its own — it is called without `config.fleet`, the same\n  // no-context path `core/coherence/declared.ts` already documents paying for\n  // the arch delta — so this is not the run's only walk, only the one every\n  // phase downstream of the gate shares.\n  const capabilityDeltas = (await config.fleet.featureCapabilityDeltas(featureDir)).docs;\n\n  // A `specs/<svc>/` whose NAME is not a legal service id, refused before\n  // anything joins that name into a path: the conflict scan below probes\n  // `services/<svc>/<axis>` with it, and the requirements merge would\n  // materialise `services/<svc>/` from it — a directory `service.id-invalid`\n  // then calls an error on the next `validate --all`, and one no loam command\n  // can address or re-create. The set comes from coherence/living.ts's\n  // `invalidSpecServiceFindings` — the same function validate reads — so the\n  // two gates cannot drift.\n  //\n  // --approve does not apply, exactly as with the conflict-marker refusal\n  // below: --approve overrides judgments about the FEATURE, and a name the id\n  // grammar refuses is a mechanical fact about the path it would become. The\n  // dry run is gated too: a plan built on that name describes a merge loam\n  // must never perform.\n  const illegalServices = await invalidSpecServiceFindings(featureDir);\n  if (illegalServices.length > 0) {\n    const msg = `archive ${id} — BLOCKED: ${illegalServices.length} per-service delta(s) named by an illegal service id; --approve does not override this`;\n    if (json) {\n      refuseFindings(\"not-coherent\", msg, illegalServices, `features/${dirName}`);\n      return null;\n    }\n    console.error(`${msg}:`);\n    for (const f of illegalServices) console.error(`  ✗ ${f.message}`);\n    console.error(`\\n--approve does not override this — the directory the merge would create is one loam can never address, mechanically.`);\n    // Every arm in this file refuses by hand — it prints a headline, a list and\n    // a closing sentence rather than the one message `fail()` takes — so the\n    // code and its lookup have to be asked for explicitly. `sayExplain` is\n    // called rather than the format being copied six times, and the code passed\n    // is the SAME one the `--json` branch a few lines up emits: text and\n    // envelope must name one refusal, or a reader who switches modes to find\n    // the code is handed a different answer than the one they saw.\n    sayExplain(\"not-coherent\");\n    process.exitCode = 1;\n    return null;\n  }\n\n  // Git conflict markers in a LIVING document this merge would rewrite, before\n  // anything else is asked of it. Both sides of somebody's merge are in the\n  // file, so nothing it says is anyone's text — and the requirements rewrite\n  // deletes whichever marker lines fall inside a requirement it replaces, turning a\n  // conflict anyone can see into a file nobody can tell is wrong. Checked ahead\n  // of the coherence gate for `inspectLandscape`'s reason: a conflicted\n  // document parses, so every verdict downstream of it is an opinion about half\n  // of two people's work.\n  //\n  // --approve does not apply, exactly as with the strayed-requirement refusal\n  // below: --approve overrides judgments about the FEATURE, and this is a fact\n  // about the living document.\n  const conflicted = await livingMergeConflicts(config.docsDir, deltaServices, capabilityDeltas.map((d) => d.id));\n  if (conflicted.length > 0) {\n    const msg = `archive ${id} — BLOCKED: ${conflicted.length} living document(s) still hold git conflict markers`;\n    if (json) {\n      refuseFindings(\"merge-failed\", msg, conflicted, `features/${dirName}`);\n      return null;\n    }\n    console.error(`${msg}:`);\n    for (const f of conflicted) console.error(`  ✗ ${f.message}`);\n    console.error(`\\n--approve does not override this — the loss is mechanical, not a judgment call.`);\n    sayExplain(\"merge-failed\");\n    process.exitCode = 1;\n    return null;\n  }\n\n  // Gate: GATING issues block the archive. Severity and gating are two\n  // different questions (issue.ts): errors gate because the merge would write\n  // something wrong, and the rare warning marked `gates` blocks too — the\n  // document is legal but the merge would drop authored content. Advisory\n  // warnings are printed (and carried into --json) but never block, matching\n  // validate's own doctrine (report.ts: \"warnings never gate\"). --approve\n  // overrides the gating issues ONLY, and must say exactly which ones it is\n  // walking past. A dry run is gated too: a plan for a merge that would be\n  // refused describes nothing that will happen.\n  const issues = await featureCoherence({ docsDir: config.docsDir, featureDir, featureId: id, preloadedDelta: deltaDoc });\n  // The issues --approve cannot move, carved out before the gate below reads\n  // the rest. The register is issue.ts's `approveOverrides` — the same data\n  // the `overridable` key in the envelope is resolved from — never a code\n  // string spelled here, because two spellings of \"what the flag moves\" would\n  // drift. What the register HOLDS has grown: it began as one code (a\n  // `metadata { service }` binding the id grammar refuses, where the merge\n  // would splice the name into the living map verbatim and probe\n  // `services/<binding>/` with it) and now holds the create-only collisions of\n  // every whole-file axis besides. They share the doctrine and nothing else —\n  // each is a mechanical fact about what the merge would write, never a\n  // judgment about the feature — which is why the message below counts them\n  // and lets each issue say its own sentence.\n  //\n  // IT USED TO NAME BINDINGS, and had been wrong for every other code in the\n  // register since the use-case slot landed: a feature whose flow collided\n  // with a living one was refused with \"1 element binding(s) name an illegal\n  // service id\", about a feature that binds nothing. A refusal headline that\n  // describes the wrong breach sends its reader to the wrong file first.\n  const nonOverridable = issues.filter((i) => !approveOverrides(i));\n  if (nonOverridable.length > 0) {\n    const msg = `archive ${id} — BLOCKED: ${nonOverridable.length} issue(s) --approve does not override; each names what the merge would write`;\n    if (json) {\n      refuseJson(\"not-coherent\", msg, issues, `features/${dirName}`);\n      return null;\n    }\n    console.error(`${msg}:`);\n    // The whole list, not just the carve-out: the reader is about to fix the\n    // feature, and the issues --approve COULD have moved are work they still\n    // owe — hiding them here made the second refusal a surprise. The closing\n    // line says which of the marks the flag cannot move.\n    for (const i of issues) console.error(`  ${SEVERITY_MARK[i.severity]} ${i.message}`);\n    console.error(\n      `\\nOf these, --approve does not override ${nonOverridable.length}: ${[...new Set(nonOverridable.map((i) => i.code))].sort().join(\", \")}. ` +\n        \"Each is a mechanical fact about what the merge would write — a name loam cannot resolve, or a file it would replace wholesale — not a judgement the flag can move. \" +\n        \"Fix those; the other issues gate as usual.\",\n    );\n    sayExplain(\"not-coherent\");\n    process.exitCode = 1;\n    return null;\n  }\n  const gating = issues.filter(gatesArchive);\n  const advisory = issues.filter((i) => !gatesArchive(i));\n  if (gating.length > 0 && !opts.approve) {\n    const msg = `archive ${id} — BLOCKED: not coherent (${gating.length} gating issue(s), ${advisory.length} advisory warning(s))`;\n    if (json) {\n      refuseJson(\"not-coherent\", msg, issues, `features/${dirName}`);\n      return null;\n    }\n    console.error(`${msg}:`);\n    for (const i of issues) console.error(`  ${SEVERITY_MARK[i.severity]} ${i.message}`);\n    console.error(`\\nFix the gating issues (advisory warnings never block), or re-run with --approve to override them (may corrupt the living docs).`);\n    sayExplain(\"not-coherent\");\n    process.exitCode = 1;\n    return null;\n  }\n  if (gating.length > 0) {\n    say(`⚠ archiving despite ${gating.length} gating issue(s) (--approve):`);\n    for (const i of gating) say(`  ${SEVERITY_MARK[i.severity]} ${i.message}`);\n    say();\n  }\n  if (advisory.length > 0) {\n    say(`⚠ ${advisory.length} warning(s) (non-blocking):`);\n    for (const i of advisory) say(`  ⚠ ${i.message}`);\n    say();\n  }\n\n  // A `specs/<svc>/` addressed to a service that exists nowhere. `validate`\n  // graded this and archive did not, which is the half that costs something:\n  // `specs/<svc>/` is what the merge MATERIALISES `services/<svc>/` from, so a\n  // one-character slip in `--touches` archived at exit 0 and left the fleet a\n  // living service nobody meant to adopt. The set comes from coherence/living.ts's\n  // `unknownDeltaServices` — the same function validate reads — so the two\n  // gates cannot drift into disagreeing about which ids are real.\n  //\n  // Gated exactly like a coherence error, --approve included: which service you\n  // meant is a judgment about the FEATURE. A feature that genuinely introduces\n  // one has a better escape hatch than --approve anyway — tag its element in\n  // delta.likec4, which is also what makes the fleet map true afterwards.\n  const unknownServices = await unknownDeltaServices(config.docsDir, featureDir, id, { preloadedDelta: deltaDoc });\n  if (unknownServices.length > 0 && !opts.approve) {\n    const msg = `archive ${id} — BLOCKED: ${unknownServices.length} per-service delta(s) address a service that does not exist`;\n    if (json) {\n      refuseFindings(\"not-coherent\", msg, unknownServices, `features/${dirName}`);\n      return null;\n    }\n    console.error(`${msg}:`);\n    for (const f of unknownServices) console.error(`  ✗ ${f.message}`);\n    console.error(`\\nFix the id, or introduce the service in this feature's delta.likec4 — or re-run with --approve to create it anyway.`);\n    sayExplain(\"not-coherent\");\n    process.exitCode = 1;\n    return null;\n  }\n  if (unknownServices.length > 0) {\n    say(`⚠ archiving despite ${unknownServices.length} unknown service(s) (--approve) — this merge creates them:`);\n    for (const f of unknownServices) say(`  ✗ ${f.message}`);\n    say();\n  }\n\n  // A LIVING requirement outside `## Requirements` is a merge loam cannot do\n  // correctly: the rewrite replaces only the requirements RUN inside that\n  // section (rewriteRequirementsRun) while parseRequirements collects from\n  // every section — so the strayed requirement keeps its authored copy in the\n  // preserved prose AND lands again in the rewritten run, and the next\n  // archive's MODIFIED replaces only one of them. Refused rather than\n  // repaired: excising blocks from prose programmatically would be archive\n  // editing text it does not understand. --approve does not apply — it\n  // overrides judgments about the FEATURE, and this is neither.\n  const strayed: Issue[] = [];\n  const scanStrayed = async (livingPath: string, subject: string): Promise<void> => {\n    if (!existsSync(livingPath)) return;\n    for (const r of parseRequirements(await readUtf8(livingPath))) {\n      // The ONE definition of the heading (spec.ts): the guard and the rewrite\n      // boundary match the same way, so they cannot disagree about \"outside\".\n      if (r.section !== undefined && isRequirementsHeading(r.section)) continue;\n      const where = r.section === undefined ? \"above every heading\" : `under '${r.section}'`;\n      strayed.push({\n        severity: \"error\",\n        code: \"living.requirement-outside-requirements\",\n        subject,\n        message: `${subject}: living requirement '${r.name}' sits ${where} in ${repoPath(config.docsDir, livingPath)} — the merge rewrites only '## Requirements', so it would land in the file twice. Re-home it under '## Requirements' first, then re-run.`,\n      });\n    }\n  };\n  for (const svc of deltaServices) {\n    for (const axis of SPEC_AXES) {\n      if (!existsSync(featureSpecPaths(featureDir, svc)[axis.key])) continue;\n      // The shared context, because this sits in a deltaServices × SPEC_AXES\n      // loop: without it every iteration re-walks and re-reads the fleet.\n      await scanStrayed((await locateServicePaths(config.docsDir, svc, config.fleet))[axis.key], svc);\n    }\n  }\n  // The business corpus, for the identical mechanical reason: a capability\n  // document is narrative ABOVE `## Requirements`, `rewriteRequirementsRun`\n  // rewrites only the run inside that heading, and a requirement filed under\n  // `## Notes` would keep its authored copy in the preserved prose AND land\n  // again in the rewritten run.\n  for (const doc of capabilityDeltas) {\n    await scanStrayed(livingCapabilityPaths(config.docsDir, doc.id).spec, doc.id);\n  }\n  if (strayed.length > 0) {\n    const msg = `archive ${id} — BLOCKED: ${strayed.length} living requirement(s) outside '## Requirements'`;\n    if (json) {\n      refuseJson(\"living-outside-requirements\", msg, strayed, `features/${dirName}`);\n      return null;\n    }\n    console.error(`${msg}:`);\n    for (const i of strayed) console.error(`  ✗ ${i.message}`);\n    console.error(`\\n--approve does not override this — the duplication is mechanical, not a judgment call.`);\n    sayExplain(\"living-outside-requirements\");\n    process.exitCode = 1;\n    return null;\n  }\n\n  // Pre-flight: the archive destination must be free, or the final move would fail\n  // after the living docs were already rewritten.\n  const archiveDir = archiveRoot(config.docsDir);\n  const archiveDest = join(archiveDir, dirName);\n  if (existsSync(archiveDest)) {\n    fail(json, \"archive-exists\", `archive ${id} — BLOCKED: features/archive/${dirName} already exists. Remove or rename it, then re-run.`);\n    return null;\n  }\n\n  return {\n    id,\n    dirName,\n    featureDir,\n    deltaDoc,\n    deltaServices,\n    capabilityDeltas,\n    gating,\n    advisory,\n    archiveDir,\n    archiveDest,\n    recovered,\n    issues,\n  };\n}\n"]}