@ybotok/loam 0.1.0-beta.3 → 0.2.0-alpha.13

package/dist/core/gate/partners.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"partners.js","sourceRoot":"","sources":["../../../src/core/gate/partners.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,SAAS,EAAuB,MAAM,iBAAiB,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EACL,WAAW,EACX,YAAY,EACZ,WAAW,EACX,iBAAiB,EACjB,YAAY,EACZ,eAAe,EACf,eAAe,GAEhB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,UAAU,EAAqB,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAE/D,OAAO,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAC;AAyD7D,0FAA0F;AAC1F,MAAM,UAAU,iBAAiB,CAAC,CAAW;IAC3C,OAAO,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;AAC7E,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,SAAS,QAAQ,CACf,IAAuB,EACvB,KAA0B,EAC1B,EAAU;IAEV,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,6EAA6E;IAC7E,yDAAyD;IACzD,wCAAwC;IACxC,KAAK,MAAM,SAAS,IAAI,WAAW,CAAC,EAAE,CAAC,EAAE,CAAC;QACxC,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC9B,IAAI,CAAC,KAAK,SAAS;YAAE,SAAS;QAC9B,MAAM,SAAS,GAAG,CAAC,CAAC,OAAO,KAAK,SAAS,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAChE,IAAI,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YAAE,KAAK,GAAG,IAAI,CAAC;QACxD,IAAI,CAAC,SAAS,IAAI,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YAAE,KAAK,GAAG,IAAI,CAAC;QACtE,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;YAAE,QAAQ,GAAG,IAAI,CAAC;QACnD,IAAI,SAAS,EAAE,CAAC;YACd,wEAAwE;YACxE,sEAAsE;YACtE,wEAAwE;YACxE,wEAAwE;YACxE,0EAA0E;YAC1E,sEAAsE;YACtE,8BAA8B;YAC9B,KAAK,GAAG,KAAK,CAAC;YACd,MAAM;QACR,CAAC;IACH,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;AACpC,CAAC;AAED,0FAA0F;AAC1F,SAAS,KAAK,CAAC,CAAM;IACnB,MAAM,KAAK,GAAG;QACZ,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACpD,GAAG,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;QAChE,GAAG,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;KAC/D,CAAC;IACF,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,OAAO,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC;AACxE,CAAC;AASD,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAuB;IACvD,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC;IACxC,2EAA2E;IAC3E,oEAAoE;IACpE,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACzD,uEAAuE;IACvE,uEAAuE;IACvE,2DAA2D;IAC3D,MAAM,SAAS,GAAG,IAAI,GAAG,CAAuB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/E,MAAM,KAAK,GAAwB,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAErE,MAAM,EAAE,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,SAAS,GAAkB,QAAQ,CAAC;IACxC,IAAI,gBAAgB,GAAkB,IAAI,CAAC;IAC3C,IAAI,QAAQ,GAAW,EAAE,CAAC;IAC1B,IAAI,aAAa,GAAU,EAAE,CAAC;IAC9B,IAAI,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YACvC,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC1B,SAAS,GAAG,SAAS,CAAC;gBACtB,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBAC5B,mEAAmE;gBACnE,wDAAwD;gBACxD,gBAAgB;oBACd,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,iBAAiB;wBACrC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACjE,CAAC;iBAAM,CAAC;gBACN,SAAS,GAAG,MAAM,CAAC;gBACnB,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;gBACxB,aAAa,GAAG,GAAG,CAAC,aAAa,CAAC;YACpC,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,yEAAyE;YACzE,uEAAuE;YACvE,yEAAyE;YACzE,uEAAuE;YACvE,6DAA6D;YAC7D,uEAAuE;YACvE,yCAAyC;YACzC,SAAS,GAAG,SAAS,CAAC;YACtB,gBAAgB,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAG,SAAS,KAAK,MAAM,CAAC;IACpC,MAAM,KAAK,GAA2B,MAAM;QAC1C,CAAC,CAAC,eAAe,CAAC,QAAQ,EAAE,KAAK,CAAC;QAClC,CAAC,CAAC,CAAC,EAAU,EAAE,EAAE,CAAC,EAAE,CAAC;IACvB,MAAM,UAAU,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAE7C,4EAA4E;IAC5E,2EAA2E;IAC3E,6EAA6E;IAC7E,2EAA2E;IAC3E,8CAA8C;IAC9C,MAAM,SAAS,GAAG,CAAC,KAAmB,EAAE,WAAoB,EAAiB,EAAE;QAC7E,MAAM,KAAK,GAAG;YACZ,KAAK;YACL,QAAQ,EAAE,UAAU,CAAC,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;YACxD,WAAW;SACZ,CAAC;QACF,OAAO,EAAE,QAAQ,EAAE,eAAe,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;IACzE,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,CAAC,KAAmB,EAAiB,EAAE,CACnD,SAAS,CACP,KAAK,EACL,iBAAiB,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC,WAAW,CAC1F,CAAC;IAEJ,4EAA4E;IAC5E,iEAAiE;IACjE,0EAA0E;IAC1E,qEAAqE;IACrE,MAAM,WAAW,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC3C,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,UAAU,OAAO,0DAA0D,CAAC,CAAC;IAC/F,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACrD,MAAM,GAAG,GAAG,IAAI,GAAG,EAA8B,CAAC;IAClD,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,IAAiB,EAAE,CAAM,EAAE,QAAiB,EAAQ,EAAE;QAChF,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,GAAG,EAAU,EAAE,CAAC;QAC5G,IAAI,IAAI,KAAK,UAAU;YAAE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;;YACzC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QAC1B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC;QAC1C,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC;YAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC1C,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACtB,CAAC,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,aAAa,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC/B,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC/B,2EAA2E;QAC3E,2CAA2C;QAC3C,IAAI,MAAM,KAAK,MAAM;YAAE,SAAS;QAChC,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;YACvB,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;YAC9C,yEAAyE;YACzE,yEAAyE;YACzE,0EAA0E;YAC1E,0EAA0E;YAC1E,cAAc;YACd,EAAE;YACF,iEAAiE;YACjE,0EAA0E;YAC1E,2DAA2D;YAC3D,yEAAyE;YACzE,uEAAuE;YACvE,kEAAkE;YAClE,uEAAuE;YACvE,wEAAwE;YACxE,yEAAyE;YACzE,iBAAiB;YACjB,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,KAAK;gBAAE,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QAChF,CAAC;aAAM,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;YAC9B,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;YAC9C,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,KAAK;gBAAE,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,qEAAqE;IACrE,MAAM,MAAM,GAAG,CAAC,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzE,MAAM,QAAQ,GAAkB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE;QAC1D,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClC,OAAO;YACL,OAAO,EAAE,IAAI;YACb,QAAQ,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,QAAQ;YAC5D,IAAI,EAAE,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU;YACvF,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE;YACzB,wEAAwE;YACxE,oEAAoE;YACpE,uEAAuE;YACvE,QAAQ,EAAE,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ;SAC/C,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,SAAS;QACT,gBAAgB;QAChB,WAAW;QACX,MAAM,EAAE,KAAK,CAAC,WAAW,CAAC;QAC1B,gBAAgB,EAAE,SAAS,CAAC,WAAW,EAAE,KAAK,CAAC;QAC/C,QAAQ;QACR,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE;YACxC,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAClC,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC5C,CAAC,CAAC;KACH,CAAC;AACJ,CAAC","sourcesContent":["/**\n * The direct join partners of one service, derived from the LIVING landscape,\n * and the maturity grading of everything on either end of a join.\n *\n * The landscape is the only place the fleet's joins are drawn, so the partner\n * set is exactly the edges whose resolved source or target is the gated\n * service — resolved through `serviceResolver` with the ENUMERATED fleet\n * riding in, the same ride that keeps container-modelling landscapes attached\n * everywhere else (an edge into `paymentService.api` is an edge into the\n * service that owns it). A landscape that is absent or does not parse yields\n * NO partner set, never an empty one: `landscape` says which, and the check\n * layer turns \"could not look\" into `gate.partners-unknown` rather than\n * letting it read as \"no partners\".\n */\nimport { existsSync } from \"node:fs\";\nimport { errorText, type Elem, type Rel } from \"../c4/likec4.js\";\nimport { serviceResolver } from \"../c4/resolve/service.js\";\nimport {\n  ACTOR_KINDS,\n  EXTERNAL_TAG,\n  INFRA_KINDS,\n  landscapeEvidence,\n  maturityGaps,\n  serviceMaturity,\n  MATURITY_LADDER,\n  type Maturity,\n} from \"../vocabulary/maturity.js\";\nimport { compareIds, type ServiceEntry } from \"../repo/entries.js\";\nimport { landscapePath, servicePathsAt } from \"../repo/paths.js\";\nimport { enumeratedServices } from \"../repo/service-target.js\";\nimport type { FleetContext } from \"../fleet-context.js\";\nimport { ancestorIds } from \"../kernel/ids/fqn/ancestors.js\";\nimport type { DocsDir } from \"../kernel/ids/dirs.js\";\nimport type { RawServiceId } from \"../kernel/ids/service.js\";\nimport type { GatePartner, LandscapeRead, PartnerRole } from \"./report.js\";\n\nexport interface PartnerScanRequest {\n  docsDir: DocsDir;\n  /** The gated service — a name the enumeration approved (`resolveServiceTarget`). */\n  service: RawServiceId;\n  fleet: FleetContext;\n}\n\n/** One service graded on the adoption ladder, with what the next rung wants. */\nexport interface GradedService {\n  maturity: Maturity;\n  gaps: string[];\n}\n\nexport interface PartnerScan {\n  landscape: LandscapeRead;\n  /**\n   * Why the landscape graded `invalid` — the parse-error tally or the read\n   * failure's own words. Null on `read` and `absent`; the finding that fails\n   * the gate must say what broke, not merely that something did.\n   */\n  landscapeProblem: string | null;\n  /**\n   * The gated service's own rung, graded under the landscape's evidence —\n   * `gate.service-undocumented`'s subject. Fail-closed on the api question:\n   * with no readable map, `landscapeEvidence` assumes an API is expected.\n   */\n  target: GradedService;\n  /**\n   * The same service graded with NO api expected of it — the reading that\n   * does not depend on the landscape at all. The check layer answers from\n   * THIS one when the map is absent or broken: the api question is then\n   * unanswerable, and one unanswerable fact must not convict twice (the\n   * landscape already carries its own finding).\n   */\n  targetWithoutApi: GradedService;\n  /**\n   * The gated service's own enumerated entry — carried so a finding can name\n   * the directory it actually occupies. `services/<id>/` is right only for an\n   * unfiled fleet, and a check that sends a reader to a directory they cannot\n   * open has answered worse than not at all.\n   */\n  targetEntry: ServiceEntry;\n  partners: GatePartner[];\n  /**\n   * The enumerated entries behind the partners that HAVE a `services/`\n   * directory, in `partners` order — what the freshness check walks. Kept as\n   * entries rather than names so the ids that travel on carry the\n   * enumeration's provenance (`RawServiceId`), never a document's.\n   */\n  partnerEntries: ServiceEntry[];\n}\n\n/** Is this rung at or above `documented` — the fixed threshold check 1 grades against? */\nexport function atLeastDocumented(m: Maturity): boolean {\n  return MATURITY_LADDER.indexOf(m) >= MATURITY_LADDER.indexOf(\"documented\");\n}\n\n/**\n * What the map says about one edge END: does it stand for a person, is it\n * INFRASTRUCTURE, and is it tagged `#external`? Walked up the ancestor chain\n * because all three facts are usually written on the containing system while\n * the edge is drawn from a nested element — but the walk STOPS at the first\n * element that stands for a service (an explicit binding or a title naming a\n * real directory, `serviceResolver`'s own first two rungs, checked after that\n * element's own facts are read). What sits above the service boundary is a\n * grouping, and a grouping's `#external` is the grouping's claim, not the\n * service's: without the stop, an adopted service drawn inside an `#external`\n * zone was exempted from `gate.partner-undocumented` and its real rung hidden.\n *\n * `infra` is read only off an element that stands for NO service AND sits\n * inside none, which is the asymmetry the `standsFor` local exists for. That is\n * `commands/validate/fleet/census.ts` in two steps and in its order:\n * `serviceLevelElements` drops everything drawn inside a service BEFORE\n * `drawnSystems` ever applies the kind test, so a service's own interior never\n * reaches it. Both halves are load-bearing. A `database` bound with\n * `metadata { service '<id>' }` is an adopted service that happens to be drawn\n * as a store — its side of the join IS recorded, and dropping it would hide a\n * real partner's rung. And a store drawn INSIDE its owner — `orderService.db`,\n * the ordinary way a team draws a private datastore — is that service's\n * interior: reading the kind off it convicted the WHOLE endpoint as\n * infrastructure, and `partnerScan` then dropped order-service from the partner\n * set, so a service this gate exists to grade vanished because of how somebody\n * drew its storage. The kind is the fallback for an element nothing else\n * answers for, never the override.\n */\nfunction endFacts(\n  byId: Map<string, Elem>,\n  known: ReadonlySet<string>,\n  id: string,\n): { actor: boolean; infra: boolean; external: boolean } {\n  let actor = false;\n  let infra = false;\n  let external = false;\n  // The id itself, then each dotted ancestor — the same walk `serviceResolver`\n  // resolves through, out of the one module that spells it\n  // (`core/kernel/ids/fqn/ancestors.ts`).\n  for (const candidate of ancestorIds(id)) {\n    const e = byId.get(candidate);\n    if (e === undefined) continue;\n    const standsFor = e.service !== undefined || known.has(e.title);\n    if (ACTOR_KINDS.has(e.kind.toLowerCase())) actor = true;\n    if (!standsFor && INFRA_KINDS.has(e.kind.toLowerCase())) infra = true;\n    if (e.tags.includes(EXTERNAL_TAG)) external = true;\n    if (standsFor) {\n      // Everything the walk has visited so far was drawn INSIDE this service,\n      // so nothing visited so far was service-LEVEL and no kind read off it\n      // answers for a service — `serviceLevelElements` filtering ahead of the\n      // kind test, spelled as a walk. `actor` and `external` are deliberately\n      // left standing: a person or an `#external` tag written on a container is\n      // still a claim about this endpoint, while the store shape is a claim\n      // about the owner's interior.\n      infra = false;\n      break;\n    }\n  }\n  return { actor, infra, external };\n}\n\n/** How one edge joins the two ends, in the words the finding and the payload both use. */\nfunction viaOf(r: Rel): string[] {\n  const typed = [\n    ...(r.op === undefined ? [] : [`operation ${r.op}`]),\n    ...(r.publishes === undefined ? [] : [`message ${r.publishes}`]),\n    ...(r.consumes === undefined ? [] : [`message ${r.consumes}`]),\n  ];\n  if (typed.length > 0) return typed;\n  return [r.title === undefined ? \"untyped edge\" : `edge '${r.title}'`];\n}\n\ninterface PartnerAccumulator {\n  consumer: boolean;\n  provider: boolean;\n  external: boolean;\n  via: Set<string>;\n}\n\nexport async function partnerScan(req: PartnerScanRequest): Promise<PartnerScan> {\n  const { docsDir, service, fleet } = req;\n  // The same memoized enumeration the command's resolveServiceTarget already\n  // performed on this FleetContext — one walk answers both questions.\n  const entries = await enumeratedServices(docsDir, fleet);\n  // Keyed as plain strings on purpose: the lookups below arrive from the\n  // resolver, whose names are document-asserted, and only a hit proves a\n  // directory. The VALUES keep the enumeration's provenance.\n  const entryById = new Map<string, ServiceEntry>(entries.map((e) => [e.id, e]));\n  const known: ReadonlySet<string> = new Set(entries.map((e) => e.id));\n\n  const lp = landscapePath(docsDir);\n  let landscape: LandscapeRead = \"absent\";\n  let landscapeProblem: string | null = null;\n  let elements: Elem[] = [];\n  let relationships: Rel[] = [];\n  if (existsSync(lp)) {\n    try {\n      const doc = await fleet.loadLikeC4(lp);\n      if (doc.errors.length > 0) {\n        landscape = \"invalid\";\n        const first = doc.errors[0];\n        // Through `errorText` — the raw message had no line, and a dropped\n        // quote's is a parser token list of thousands of lines.\n        landscapeProblem =\n          `${doc.errors.length} parse error(s)` +\n          (first === undefined ? \"\" : ` — first: ${errorText(first)}`);\n      } else {\n        landscape = \"read\";\n        elements = doc.elements;\n        relationships = doc.relationships;\n      }\n    } catch (err) {\n      // A landscape that could not be READ, graded as one that did not PARSE —\n      // commands/validate/fleet/load.ts's containment doctrine, spelled here\n      // because core cannot import it: \"could not be read\" and \"did not parse\"\n      // have the same consequence (nothing may be concluded from this file).\n      // The reason travels into the finding, message-preserving as\n      // `unreadableLandscape` is; the read error must not kill the run — the\n      // other three checks still have answers.\n      landscape = \"invalid\";\n      landscapeProblem = err instanceof Error ? err.message : String(err);\n    }\n  }\n  const parses = landscape === \"read\";\n  const svcOf: (id: string) => string = parses\n    ? serviceResolver(elements, known)\n    : (id: string) => id;\n  const elementIds = elements.map((e) => e.id);\n\n  // One service's ladder rung. `landscapeEvidence` is the ONE shared spelling\n  // of the positive-evidence apiExpected rule (core/vocabulary/maturity.ts);\n  // its own docblock warns against calling it per service inside a FLEET loop,\n  // and this loop is not one — it runs over the gated service and its direct\n  // partners, a handful, never the enumeration.\n  const gradeWith = (entry: ServiceEntry, apiExpected: boolean): GradedService => {\n    const input = {\n      entry,\n      archSpec: existsSync(servicePathsAt(entry.dir).archSpec),\n      apiExpected,\n    };\n    return { maturity: serviceMaturity(input), gaps: maturityGaps(input) };\n  };\n  const grade = (entry: ServiceEntry): GradedService =>\n    gradeWith(\n      entry,\n      landscapeEvidence({ id: entry.id, parses, relationships, elementIds, svcOf }).apiExpected,\n    );\n\n  // Unreachable by construction: the command layer resolved `service` against\n  // the same memoized enumeration this scan just read, and refused\n  // `unknown-service` when no directory answered. Failing closed here beats\n  // grading a service nobody enumerated as if its absence were a rung.\n  const targetEntry = entryById.get(service);\n  if (targetEntry === undefined) {\n    throw new Error(`gate: '${service}' vanished from the enumeration between resolve and scan`);\n  }\n\n  const byId = new Map(elements.map((e) => [e.id, e]));\n  const acc = new Map<string, PartnerAccumulator>();\n  const join = (name: string, role: PartnerRole, r: Rel, external: boolean): void => {\n    const slot = acc.get(name) ?? { consumer: false, provider: false, external: false, via: new Set<string>() };\n    if (role === \"consumer\") slot.consumer = true;\n    else slot.provider = true;\n    slot.external = slot.external || external;\n    for (const v of viaOf(r)) slot.via.add(v);\n    acc.set(name, slot);\n  };\n  for (const r of relationships) {\n    const source = svcOf(r.source);\n    const target = svcOf(r.target);\n    // A self-edge (both ends resolve to the gated service — its own containers\n    // talking to each other) names no partner.\n    if (source === target) continue;\n    if (target === service) {\n      const facts = endFacts(byId, known, r.source);\n      // A person is never a deploy participant, and neither is the fleet's own\n      // infrastructure: the two kind exemptions every landscape census applies\n      // (drawnSystems, commands/validate/fleet/census.ts), spelled here off the\n      // same two sets so a gate and a validate run cannot disagree about what a\n      // partner IS.\n      //\n      // The infra half is the newer one, and it had a measured cost. A\n      // `database` the fleet owns and draws at fleet level joined every service\n      // that reads it, with `maturity: null` because there is no\n      // `services/<title>/` — so `gate.partner-undocumented` told the deployer\n      // to \"adopt it, bind it … or tag it #external\", three remedies none of\n      // which is true of a Postgres (measured on a one-service fixture,\n      // 2026-09-07). It is dropped from the partner SET rather than exempted\n      // from the finding, which is the actor precedent exactly: `partners` is\n      // the list of counterparties whose DOCS the gate grades, and a store has\n      // none to grade.\n      if (!facts.actor && !facts.infra) join(source, \"consumer\", r, facts.external);\n    } else if (source === service) {\n      const facts = endFacts(byId, known, r.target);\n      if (!facts.actor && !facts.infra) join(target, \"provider\", r, facts.external);\n    }\n  }\n\n  // Sorted by id so identical state yields identical bytes — the accumulator's\n  // order is the landscape's edge order, which a reformat may shuffle.\n  const joined = [...acc.entries()].sort((a, b) => compareIds(a[0], b[0]));\n  const partners: GatePartner[] = joined.map(([name, slot]) => {\n    const entry = entryById.get(name);\n    return {\n      service: name,\n      maturity: entry === undefined ? null : grade(entry).maturity,\n      role: slot.consumer && slot.provider ? \"both\" : slot.consumer ? \"consumer\" : \"provider\",\n      via: [...slot.via].sort(),\n      // An adopted service is OURS whatever a zone's tag says: `external` and\n      // a maturity rung together must be unrepresentable, or the rung the\n      // payload carries is one the exemption hides and the human view drops.\n      external: entry === undefined && slot.external,\n    };\n  });\n\n  return {\n    landscape,\n    landscapeProblem,\n    targetEntry,\n    target: grade(targetEntry),\n    targetWithoutApi: gradeWith(targetEntry, false),\n    partners,\n    partnerEntries: joined.flatMap(([name]) => {\n      const entry = entryById.get(name);\n      return entry === undefined ? [] : [entry];\n    }),\n  };\n}\n"]}

package/dist/core/gate/report.js

@@ -0,0 +1,47 @@
+/** The four checks, in report order. A closed set — the payload's `checks[].check` values. */
+export const GATE_CHECKS = ["partners", "freshness", "verification", "interrupted"];
+/**
+ * Fail iff any check carries an error-severity finding. `--strict` never moves
+ * this — like validate's `valid`, the verdict means the same thing in text and
+ * JSON whatever the exit code does, so two pipelines reading one repo can
+ * grade the same report differently and both be telling the truth
+ * (commands/validate/validate.ts documents the stance; gate copies it).
+ */
+export function gateVerdict(checks) {
+    return checks.some((c) => c.findings.some((f) => f.severity === "error")) ? "fail" : "pass";
+}
+export function gateSummary(checks) {
+    const of = (severity) => checks.reduce((n, c) => n + c.findings.filter((f) => f.severity === severity).length, 0);
+    return { errors: of("error"), warnings: of("warn") };
+}
+/**
+ * Per-subject containment: one unreadable sibling degrades ONE subject's
+ * answer, with its path recorded, instead of killing the report the other
+ * subjects still have. The code is validate's own containment code
+ * (`guarded`, commands/validate/report.ts), reused so one breach is spelled
+ * one way — and it is an ERROR: an unanswerable check fails closed, because
+ * "nobody could look" must be distinguishable from "nothing is wrong" in the
+ * exit code as well as the payload. Anything carrying no errno and no path is
+ * a real bug, and still escapes untouched (reportRepositoryUnavailable's
+ * recognizer).
+ */
+export function unreadableSubject(kind, id, err) {
+    const e = err;
+    if (e.path === undefined && typeof e.errno !== "number")
+        throw err;
+    const reason = err instanceof Error ? err.message : String(err);
+    const consequence = kind === "service" ? "its freshness is unknown" : "its verification state is unknown";
+    return {
+        severity: "error",
+        code: kind === "service" ? "service.unreadable" : "feature.unreadable",
+        subject: id,
+        message: `${id}: ${e.path ?? "one of its documents"} could not be read, so ${consequence} — nobody could look, which is not the same as nothing being wrong. ${reason}` +
+            // The same sentence reportRepositoryUnavailable carries, for the same
+            // reason: Node reports EISDIR from read() with no path at all, so the
+            // commonest malformed-docs shape arrives here nameless.
+            (e.path === undefined
+                ? " The failure named no path — that is how Node reports a directory sitting where a file belongs."
+                : ""),
+    };
+}
+//# sourceMappingURL=report.js.map

package/dist/core/gate/report.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"report.js","sourceRoot":"","sources":["../../../src/core/gate/report.ts"],"names":[],"mappings":"AAeA,8FAA8F;AAC9F,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,UAAU,EAAE,WAAW,EAAE,cAAc,EAAE,aAAa,CAAU,CAAC;AAoG7F;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,MAA4B;IACtD,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;AAC9F,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,MAA4B;IACtD,MAAM,EAAE,GAAG,CAAC,QAA0B,EAAU,EAAE,CAChD,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC3F,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;AACvD,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAA2B,EAAE,EAAU,EAAE,GAAY;IACrF,MAAM,CAAC,GAAG,GAA4B,CAAC;IACvC,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ;QAAE,MAAM,GAAG,CAAC;IACnE,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAChE,MAAM,WAAW,GACf,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,mCAAmC,CAAC;IACxF,OAAO;QACL,QAAQ,EAAE,OAAO;QACjB,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,oBAAoB;QACtE,OAAO,EAAE,EAAE;QACX,OAAO,EACL,GAAG,EAAE,KAAK,CAAC,CAAC,IAAI,IAAI,sBAAsB,0BAA0B,WAAW,uEAAuE,MAAM,EAAE;YAC9J,sEAAsE;YACtE,sEAAsE;YACtE,wDAAwD;YACxD,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS;gBACnB,CAAC,CAAC,iGAAiG;gBACnG,CAAC,CAAC,EAAE,CAAC;KACV,CAAC;AACJ,CAAC","sourcesContent":["/**\n * The gate report — what `loam gate` computes before anything is printed.\n *\n * Shapes, verdict arithmetic and the per-subject containment classifier: no\n * filesystem, no process access, no printing. The four checks build findings\n * (`./checks.ts`, `./verification.ts`), the command layer renders them, and\n * this module is what the two agree through — the same split\n * `core/vocabulary/report.ts` gives `loam validate`, whose `Finding` shape\n * the checks reuse so one breach arrives in one shape whichever command\n * reports it.\n */\nimport type { Finding } from \"../vocabulary/report.js\";\nimport type { Maturity } from \"../vocabulary/maturity.js\";\nimport type { VerificationState } from \"../status/report.js\";\n\n/** The four checks, in report order. A closed set — the payload's `checks[].check` values. */\nexport const GATE_CHECKS = [\"partners\", \"freshness\", \"verification\", \"interrupted\"] as const;\nexport type GateCheckName = (typeof GATE_CHECKS)[number];\n\nexport interface GateCheck {\n  check: GateCheckName;\n  findings: Finding[];\n}\n\n/**\n * How the landscape read came out. `absent` and `invalid` are kept apart from\n * `read` because the partner set derived under either is NOT \"no partners\" —\n * it is \"could not look\", and `gate.partners-unknown` exists to keep a\n * pipeline from reading the empty list as a clean one.\n */\nexport type LandscapeRead = \"read\" | \"absent\" | \"invalid\";\n\n/**\n * What the partner is to the gated service: a `consumer` calls into it, a\n * `provider` is called by it, `both` when the landscape draws edges in both\n * directions.\n */\nexport type PartnerRole = \"consumer\" | \"provider\" | \"both\";\n\nexport interface GatePartner {\n  /** The partner's resolved service name — a directory id when one exists, the drawn name otherwise. */\n  service: string;\n  /**\n   * The partner's rung on the adoption ladder, or null when no `services/`\n   * directory answers to the name at all — the state `gate.partner-undocumented`\n   * names. Null is deliberately not a fifth rung: `empty` means \"exists,\n   * nothing in it\", and a partner nobody adopted is a different fact.\n   */\n  maturity: Maturity | null;\n  role: PartnerRole;\n  /** The joins, sorted: `operation <op>`, `message <name>`, or the untyped edge's title. */\n  via: string[];\n  /** The element is tagged `#external` — somebody else's system, undocumented on purpose. */\n  external: boolean;\n}\n\n/**\n * One feature touching the gated service — every active one, plus, under\n * `--since`, every one archived after the ref — with the verification\n * record's own projection beside it. Every field but `id` and `archived` is\n * `verificationState`'s (`core/status/verification.ts`) — never a second\n * derivation of \"verified\".\n */\nexport interface GateFeature extends VerificationState {\n  id: string;\n  /**\n   * Present, and true, only on a row `--since` added: the feature shipped\n   * after the ref, so its record is frozen history. Absent rather than\n   * `false` on the in-flight rows, so a payload without `--since` is byte for\n   * byte the one it was before the flag existed.\n   */\n  archived?: true;\n  /**\n   * Present only beside `archived`: the checklist digest `loam archive`\n   * captured as the feature merged — what its frozen record was graded\n   * against, so a record that had stopped answering the feature before it\n   * shipped reads `stale` — or null when that archive captured none (a loam\n   * that predates the capture, or a feature that had no record then). Under\n   * null a record is read as frozen history, exactly as before the capture\n   * existed, and the row says so rather than letting that reading pass for a\n   * checked one.\n   */\n  checklistAtArchive?: string | null;\n}\n\n/**\n * `--since <ref>`, resolved: the docs-repo commit a deploy pipeline last\n * shipped from, and the `features/archive/` directory names that already\n * existed there AND still hold what they held then. Without it the\n * verification check reads in-flight features only, and a feature drops out of\n * the gate the moment it is archived — which under `--strict` made archiving\n * the cheapest way past an unverified-feature warning. With it, every feature\n * archived AFTER the ref is graded too: its directory absent there, or changed\n * since — a feature unarchived, edited and archived again ships again, at the\n * same path. Nothing is stored: the pipeline already knows its last deployed\n * docs commit, and git already knows what was archived at it.\n */\nexport interface GateSince {\n  ref: string;\n  commit: string;\n  /** Archive directory names an earlier deploy already shipped exactly as they stand — the ones this gate leaves out. */\n  shippedAtRef: ReadonlySet<string>;\n}\n\nexport interface GateReport {\n  service: string;\n  /** The `--since` bound the report was computed under, or null for in-flight features only. */\n  since: { ref: string; commit: string } | null;\n  landscape: LandscapeRead;\n  partners: GatePartner[];\n  features: GateFeature[];\n  checks: GateCheck[];\n}\n\nexport type GateVerdict = \"pass\" | \"fail\";\n\n/**\n * Fail iff any check carries an error-severity finding. `--strict` never moves\n * this — like validate's `valid`, the verdict means the same thing in text and\n * JSON whatever the exit code does, so two pipelines reading one repo can\n * grade the same report differently and both be telling the truth\n * (commands/validate/validate.ts documents the stance; gate copies it).\n */\nexport function gateVerdict(checks: readonly GateCheck[]): GateVerdict {\n  return checks.some((c) => c.findings.some((f) => f.severity === \"error\")) ? \"fail\" : \"pass\";\n}\n\nexport function gateSummary(checks: readonly GateCheck[]): { errors: number; warnings: number } {\n  const of = (severity: \"error\" | \"warn\"): number =>\n    checks.reduce((n, c) => n + c.findings.filter((f) => f.severity === severity).length, 0);\n  return { errors: of(\"error\"), warnings: of(\"warn\") };\n}\n\n/**\n * Per-subject containment: one unreadable sibling degrades ONE subject's\n * answer, with its path recorded, instead of killing the report the other\n * subjects still have. The code is validate's own containment code\n * (`guarded`, commands/validate/report.ts), reused so one breach is spelled\n * one way — and it is an ERROR: an unanswerable check fails closed, because\n * \"nobody could look\" must be distinguishable from \"nothing is wrong\" in the\n * exit code as well as the payload. Anything carrying no errno and no path is\n * a real bug, and still escapes untouched (reportRepositoryUnavailable's\n * recognizer).\n */\nexport function unreadableSubject(kind: \"service\" | \"feature\", id: string, err: unknown): Finding {\n  const e = err as NodeJS.ErrnoException;\n  if (e.path === undefined && typeof e.errno !== \"number\") throw err;\n  const reason = err instanceof Error ? err.message : String(err);\n  const consequence =\n    kind === \"service\" ? \"its freshness is unknown\" : \"its verification state is unknown\";\n  return {\n    severity: \"error\",\n    code: kind === \"service\" ? \"service.unreadable\" : \"feature.unreadable\",\n    subject: id,\n    message:\n      `${id}: ${e.path ?? \"one of its documents\"} could not be read, so ${consequence} — nobody could look, which is not the same as nothing being wrong. ${reason}` +\n      // The same sentence reportRepositoryUnavailable carries, for the same\n      // reason: Node reports EISDIR from read() with no path at all, so the\n      // commonest malformed-docs shape arrives here nameless.\n      (e.path === undefined\n        ? \" The failure named no path — that is how Node reports a directory sitting where a file belongs.\"\n        : \"\"),\n  };\n}\n"]}

package/dist/core/gate/verification.js

@@ -0,0 +1,176 @@
+/**
+ * Check 3 of `loam gate`: the verification records of every active feature
+ * touching the gated service, read through `verificationState`'s own graded
+ * verdicts — never a re-derivation of "verified" (that module's header is the
+ * contract). Split from `./checks.ts` when the four checks outgrew the line
+ * limit; this is the one check with a per-feature phase of its own, so it is
+ * the seam.
+ *
+ * Without `--since` it reads IN-FLIGHT features only, so a feature leaves the
+ * check the moment it is archived — and archive reads no verification record,
+ * deliberately (verify never gates the merge). Under `--strict` that made
+ * archiving the cheapest way past this check's warning, on a draft service
+ * and on a vouched one alike when the feature changed only a contract
+ * (`content_digest` covers the spec bodies, not openapi.yaml/asyncapi.yaml, so
+ * freshness cannot catch it either). `--since <ref>` closes it without any
+ * deployment state: every feature archived after the docs commit the pipeline last
+ * deployed from is graded too, by the same `verificationState`, under the
+ * same code, its row marked `archived: true` — "archived after" meaning its
+ * archive directory was absent at the ref OR differs from what it held there,
+ * since a feature unarchived, edited and archived again ships again from the
+ * same path. Its record is frozen, but not ungraded: it is held to the
+ * checklist `loam archive` captured as the feature merged
+ * (`readSnapshotChecklist`), so a record that had stopped answering the
+ * feature before it shipped is `stale` — archiving it no longer reads it
+ * `verified` again. An archive that captured none (an older loam) is read as
+ * frozen history, as before, and the row says so.
+ *
+ * Report, never fail: every finding here is a warning, by the item's own
+ * design — a deploy gate that hard-failed on unverified work would teach
+ * everyone that the cheapest way past it is an empty record.
+ */
+import { inOrder } from "../kernel/concurrency.js";
+import { verificationState } from "../status/verification.js";
+import { readSnapshotChecklist } from "../staging/snapshot/manifest.js";
+import { listFeatures } from "../repo/repo.js";
+import { featurePaths } from "../repo/paths.js";
+import { compareIds } from "../repo/entries.js";
+import { unreadableSubject } from "./report.js";
+export async function verificationCheck(req) {
+    const { since } = req;
+    const all = await listFeatures(req.docsDir, { includeArchived: since !== undefined }, req.fleet);
+    // "Touching" = carries a specs/<svc>/ delta — the same definition
+    // `status --service` answers with. A feature whose C4 delta merely draws an
+    // edge into the service is deliberately out: counting it needs a delta parse
+    // per active feature, and it can be added additively if a fleet asks. An
+    // archived feature keeps its specs/ under features/archive/, so the one
+    // definition answers for both sides. "Archived after the ref" is "its
+    // archive directory was not there at the ref, or is not what it was there";
+    // a feature whose directory was there UNCHANGED shipped in an earlier
+    // deploy and is not this one's to answer for (`GateSince`).
+    const touching = all
+        .filter((f) => f.services.includes(req.service))
+        .filter((f) => !f.archived || (since !== undefined && !since.shippedAtRef.has(f.dirName)))
+        .sort((a, b) => compareIds(a.id, b.id) || compareIds(a.dirName, b.dirName));
+    // COST ACCEPTED: each touching feature with a record derives its checklist,
+    // which parses its delta. That is the per-feature cost
+    // core/status/fleet/fleet.ts refuses for the WHOLE fleet; a deploy-time
+    // command scoped to one service pays it for that service's features only —
+    // with the invocation's context threaded through `verificationState` into
+    // the derivation, so its enumerations are memo hits (one fleet walk per
+    // run, not one per feature) and the batch prefetch below genuinely seeds
+    // the delta parses. The prefetch is an accelerator only: a host that cannot
+    // batch degrades to per-feature parses with identical findings.
+    // An archived feature never derives a checklist (its record is frozen, see
+    // `verificationState`, and held to the one its archive captured), so
+    // prefetching its delta would parse for nobody.
+    await req.fleet.prefetchLikeC4(touching.filter((f) => !f.archived && f.has.delta).map((f) => featurePaths(f.dir).delta));
+    // inOrder caps the workspaces in flight and keeps the rows in feature order.
+    const rows = await inOrder(touching, async (f) => {
+        try {
+            if (!f.archived) {
+                const { state, notice } = await verificationState(req.docsDir, f, { fleet: req.fleet });
+                return { kind: "read", feature: f, state, notice };
+            }
+            const shipped = await readSnapshotChecklist(f.dir);
+            const { state, notice } = await verificationState(req.docsDir, f, { fleet: req.fleet, shipped });
+            return { kind: "read", feature: f, state, notice, shipped };
+        }
+        catch (err) {
+            return { kind: "unreadable", finding: unreadableSubject("feature", f.id, err) };
+        }
+    });
+    const features = [];
+    const findings = [];
+    for (const row of rows) {
+        if (row.kind === "unreadable") {
+            findings.push(row.finding);
+            continue;
+        }
+        features.push({
+            id: row.feature.id,
+            ...row.state,
+            ...(row.shipped === undefined ? {} : { archived: true, checklistAtArchive: row.shipped }),
+        });
+        findings.push(...featureFindings(row, req.service, since?.ref));
+    }
+    return { features, findings };
+}
+function featureFindings(row, service, since) {
+    const { feature, state, notice } = row;
+    if (state.verdict === "verified")
+        return [];
+    if (state.verdict === "attested") {
+        // attestedNotice's own words — the one notice verify, list and status all
+        // show, converted to a Finding rather than re-derived. The code string
+        // (`verify.scenario-attested`) is spelled literally at its one emit site,
+        // core/verify/record.ts, where the drift guard collects it.
+        return notice === null
+            ? []
+            : [
+                {
+                    severity: notice.severity,
+                    code: notice.code,
+                    subject: feature.id,
+                    message: notice.message,
+                    ...(notice.claims === undefined ? {} : { details: notice.claims }),
+                },
+            ];
+    }
+    const verify = `\`loam verify ${feature.id} --json\``;
+    const open = state.unconfirmed + state.unanswered;
+    const claimsOpen = `${open} of ${state.claims} claim(s) on ${feature.id} are open (${state.unconfirmed} unconfirmed, ${state.unanswered} unanswered)`;
+    const message = () => {
+        // A row `--since` added. Its record is frozen history: `loam verify` reads
+        // it back and refuses to re-record it (commands/verify/verify.ts), so the
+        // in-flight remedies below — derive, answer, re-derive — would send a
+        // deploy pipeline to a command that cannot run. What it CAN be told is
+        // that this deploy carries the feature unchecked, and the one way to
+        // reopen it. An archived record is `stale` only against the checklist its
+        // archive captured — the feature had moved under it before it shipped.
+        if (feature.archived) {
+            const shipped = `${feature.id} touches '${service}' and was archived after ${since ?? "the --since ref"}`;
+            const reopen = `Its record is frozen history: ${verify} reads it back, and \`loam unarchive ${feature.id}\` re-opens the feature if its claims must be answered before this deploy.`;
+            if (state.state === "absent")
+                return `${shipped} with no verification record — nothing was checked before it shipped. ${reopen}`;
+            // The file that failed may be one service's `verification/<svc>.yaml`
+            // as well as the one-file record; `loam verify` names which.
+            if (state.state === "unreadable")
+                return `${shipped} with a verification record that does not read as a record — ${verify} names the file that failed. ${reopen}`;
+            if (state.state === "stale") {
+                return `${shipped}, and it had moved after its record was written — the record answers a checklist that was no longer the one it asked when it was archived, so what shipped was not what was checked. ${reopen}`;
+            }
+            return state.claims === 0
+                ? `${shipped} with a record that answers no claims at all. ${reopen}`
+                : `${shipped}, and ${claimsOpen}. ${reopen}`;
+        }
+        switch (state.state) {
+            case "absent":
+                return `${feature.id} touches '${service}' and has no verification record — nothing has been checked. Derive the checklist and answer it: ${verify}.`;
+            case "unreadable":
+                return `${feature.id}'s verification record does not read as a record — ${verify} names the file that failed and its safe repair (never delete a file other services' attestations may be in); nothing will overwrite it while it is unreadable.`;
+            case "stale":
+                return `${feature.id} moved after its record was written — the answers answer a checklist that is no longer the one being asked. Re-derive and re-answer: ${verify}.`;
+            case "recorded":
+                return state.claims === 0
+                    ? `${feature.id}'s record answers no claims at all — nothing was asked, so nothing was checked. ${verify} re-derives the checklist.`
+                    : `${claimsOpen} — close them with evidence: ${verify}.`;
+            default: {
+                // A fifth record state must land here as a build failure, not fall
+                // through into some rung nobody decided (verificationStatus holds the
+                // same guard for the same reason).
+                const unreachable = state.state;
+                throw new Error(`gate: no wording for verification state '${String(unreachable)}'`);
+            }
+        }
+    };
+    return [
+        {
+            severity: "warn",
+            code: "gate.feature-unverified",
+            subject: feature.id,
+            message: message(),
+        },
+    ];
+}
+//# sourceMappingURL=verification.js.map

package/dist/core/gate/verification.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verification.js","sourceRoot":"","sources":["../../../src/core/gate/verification.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAqB,MAAM,oBAAoB,CAAC;AAOnE,OAAO,EAAE,iBAAiB,EAAoC,MAAM,aAAa,CAAC;AAuBlF,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAA6B;IAE7B,MAAM,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC;IACtB,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,eAAe,EAAE,KAAK,KAAK,SAAS,EAAE,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;IACjG,kEAAkE;IAClE,4EAA4E;IAC5E,6EAA6E;IAC7E,yEAAyE;IACzE,wEAAwE;IACxE,sEAAsE;IACtE,4EAA4E;IAC5E,sEAAsE;IACtE,4DAA4D;IAC5D,MAAM,QAAQ,GAAG,GAAG;SACjB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;SAC/C,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;SACzF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC9E,4EAA4E;IAC5E,uDAAuD;IACvD,wEAAwE;IACxE,2EAA2E;IAC3E,0EAA0E;IAC1E,wEAAwE;IACxE,yEAAyE;IACzE,4EAA4E;IAC5E,gEAAgE;IAChE,2EAA2E;IAC3E,qEAAqE;IACrE,gDAAgD;IAChD,MAAM,GAAG,CAAC,KAAK,CAAC,cAAc,CAC5B,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CACzF,CAAC;IACF,6EAA6E;IAC7E,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,EAA4B,EAAE;QACzE,IAAI,CAAC;YACH,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;gBAChB,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;gBACxF,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;YACrD,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACnD,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;YACjG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QAC9D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,iBAAiB,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC;QAClF,CAAC;IACH,CAAC,CAAC,CAAC;IACH,MAAM,QAAQ,GAAkB,EAAE,CAAC;IACnC,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YAC9B,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC3B,SAAS;QACX,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE;YAClB,GAAG,GAAG,CAAC,KAAK;YACZ,GAAG,CAAC,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,kBAAkB,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;SAC1F,CAAC,CAAC;QACH,QAAQ,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AAChC,CAAC;AAED,SAAS,eAAe,CACtB,GAAY,EACZ,OAAe,EACf,KAAyB;IAEzB,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC;IACvC,IAAI,KAAK,CAAC,OAAO,KAAK,UAAU;QAAE,OAAO,EAAE,CAAC;IAC5C,IAAI,KAAK,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;QACjC,0EAA0E;QAC1E,uEAAuE;QACvE,0EAA0E;QAC1E,4DAA4D;QAC5D,OAAO,MAAM,KAAK,IAAI;YACpB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE;oBACE,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,OAAO,EAAE,OAAO,CAAC,EAAE;oBACnB,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;iBACnE;aACF,CAAC;IACR,CAAC;IACD,MAAM,MAAM,GAAG,iBAAiB,OAAO,CAAC,EAAE,WAAW,CAAC;IACtD,MAAM,IAAI,GAAG,KAAK,CAAC,WAAW,GAAG,KAAK,CAAC,UAAU,CAAC;IAClD,MAAM,UAAU,GAAG,GAAG,IAAI,OAAO,KAAK,CAAC,MAAM,gBAAgB,OAAO,CAAC,EAAE,cAAc,KAAK,CAAC,WAAW,iBAAiB,KAAK,CAAC,UAAU,cAAc,CAAC;IACtJ,MAAM,OAAO,GAAG,GAAW,EAAE;QAC3B,2EAA2E;QAC3E,0EAA0E;QAC1E,sEAAsE;QACtE,uEAAuE;QACvE,qEAAqE;QACrE,0EAA0E;QAC1E,uEAAuE;QACvE,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACrB,MAAM,OAAO,GAAG,GAAG,OAAO,CAAC,EAAE,aAAa,OAAO,4BAA4B,KAAK,IAAI,iBAAiB,EAAE,CAAC;YAC1G,MAAM,MAAM,GAAG,iCAAiC,MAAM,wCAAwC,OAAO,CAAC,EAAE,4EAA4E,CAAC;YACrL,IAAI,KAAK,CAAC,KAAK,KAAK,QAAQ;gBAAE,OAAO,GAAG,OAAO,yEAAyE,MAAM,EAAE,CAAC;YACjI,sEAAsE;YACtE,6DAA6D;YAC7D,IAAI,KAAK,CAAC,KAAK,KAAK,YAAY;gBAAE,OAAO,GAAG,OAAO,gEAAgE,MAAM,gCAAgC,MAAM,EAAE,CAAC;YAClK,IAAI,KAAK,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;gBAC5B,OAAO,GAAG,OAAO,wLAAwL,MAAM,EAAE,CAAC;YACpN,CAAC;YACD,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;gBACvB,CAAC,CAAC,GAAG,OAAO,iDAAiD,MAAM,EAAE;gBACrE,CAAC,CAAC,GAAG,OAAO,SAAS,UAAU,KAAK,MAAM,EAAE,CAAC;QACjD,CAAC;QACD,QAAQ,KAAK,CAAC,KAAK,EAAE,CAAC;YACpB,KAAK,QAAQ;gBACX,OAAO,GAAG,OAAO,CAAC,EAAE,aAAa,OAAO,oGAAoG,MAAM,GAAG,CAAC;YACxJ,KAAK,YAAY;gBACf,OAAO,GAAG,OAAO,CAAC,EAAE,sDAAsD,MAAM,iKAAiK,CAAC;YACpP,KAAK,OAAO;gBACV,OAAO,GAAG,OAAO,CAAC,EAAE,wIAAwI,MAAM,GAAG,CAAC;YACxK,KAAK,UAAU;gBACb,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;oBACvB,CAAC,CAAC,GAAG,OAAO,CAAC,EAAE,mFAAmF,MAAM,4BAA4B;oBACpI,CAAC,CAAC,GAAG,UAAU,gCAAgC,MAAM,GAAG,CAAC;YAC7D,SAAS,CAAC;gBACR,mEAAmE;gBACnE,sEAAsE;gBACtE,mCAAmC;gBACnC,MAAM,WAAW,GAAU,KAAK,CAAC,KAAK,CAAC;gBACvC,MAAM,IAAI,KAAK,CAAC,4CAA4C,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;YACtF,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IACF,OAAO;QACL;YACE,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EAAE,OAAO,CAAC,EAAE;YACnB,OAAO,EAAE,OAAO,EAAE;SACnB;KACF,CAAC;AACJ,CAAC","sourcesContent":["/**\n * Check 3 of `loam gate`: the verification records of every active feature\n * touching the gated service, read through `verificationState`'s own graded\n * verdicts — never a re-derivation of \"verified\" (that module's header is the\n * contract). Split from `./checks.ts` when the four checks outgrew the line\n * limit; this is the one check with a per-feature phase of its own, so it is\n * the seam.\n *\n * Without `--since` it reads IN-FLIGHT features only, so a feature leaves the\n * check the moment it is archived — and archive reads no verification record,\n * deliberately (verify never gates the merge). Under `--strict` that made\n * archiving the cheapest way past this check's warning, on a draft service\n * and on a vouched one alike when the feature changed only a contract\n * (`content_digest` covers the spec bodies, not openapi.yaml/asyncapi.yaml, so\n * freshness cannot catch it either). `--since <ref>` closes it without any\n * deployment state: every feature archived after the docs commit the pipeline last\n * deployed from is graded too, by the same `verificationState`, under the\n * same code, its row marked `archived: true` — \"archived after\" meaning its\n * archive directory was absent at the ref OR differs from what it held there,\n * since a feature unarchived, edited and archived again ships again from the\n * same path. Its record is frozen, but not ungraded: it is held to the\n * checklist `loam archive` captured as the feature merged\n * (`readSnapshotChecklist`), so a record that had stopped answering the\n * feature before it shipped is `stale` — archiving it no longer reads it\n * `verified` again. An archive that captured none (an older loam) is read as\n * frozen history, as before, and the row says so.\n *\n * Report, never fail: every finding here is a warning, by the item's own\n * design — a deploy gate that hard-failed on unverified work would teach\n * everyone that the cheapest way past it is an empty record.\n */\nimport { inOrder } from \"../kernel/concurrency.js\";\nimport { verificationState } from \"../status/verification.js\";\nimport { readSnapshotChecklist } from \"../staging/snapshot/manifest.js\";\nimport { listFeatures } from \"../repo/repo.js\";\nimport { featurePaths } from \"../repo/paths.js\";\nimport { compareIds, type FeatureEntry } from \"../repo/entries.js\";\nimport type { Finding } from \"../vocabulary/report.js\";\nimport type { VerificationState } from \"../status/report.js\";\nimport type { VerifyNotice } from \"../verify/record.js\";\nimport type { FleetContext } from \"../fleet-context.js\";\nimport type { DocsDir } from \"../kernel/ids/dirs.js\";\nimport type { RawServiceId } from \"../kernel/ids/service.js\";\nimport { unreadableSubject, type GateFeature, type GateSince } from \"./report.js\";\n\n/**\n * One graded feature. `shipped` is set only on an archived row: the checklist\n * digest its archive captured, or null when it captured none.\n */\ninterface ReadRow {\n  kind: \"read\";\n  feature: FeatureEntry;\n  state: VerificationState;\n  notice: VerifyNotice | null;\n  shipped?: string | null;\n}\n\ntype VerificationRow = ReadRow | { kind: \"unreadable\"; finding: Finding };\n\nexport interface VerificationCheckRequest {\n  docsDir: DocsDir;\n  service: RawServiceId;\n  fleet: FleetContext;\n  since?: GateSince;\n}\n\nexport async function verificationCheck(\n  req: VerificationCheckRequest,\n): Promise<{ features: GateFeature[]; findings: Finding[] }> {\n  const { since } = req;\n  const all = await listFeatures(req.docsDir, { includeArchived: since !== undefined }, req.fleet);\n  // \"Touching\" = carries a specs/<svc>/ delta — the same definition\n  // `status --service` answers with. A feature whose C4 delta merely draws an\n  // edge into the service is deliberately out: counting it needs a delta parse\n  // per active feature, and it can be added additively if a fleet asks. An\n  // archived feature keeps its specs/ under features/archive/, so the one\n  // definition answers for both sides. \"Archived after the ref\" is \"its\n  // archive directory was not there at the ref, or is not what it was there\";\n  // a feature whose directory was there UNCHANGED shipped in an earlier\n  // deploy and is not this one's to answer for (`GateSince`).\n  const touching = all\n    .filter((f) => f.services.includes(req.service))\n    .filter((f) => !f.archived || (since !== undefined && !since.shippedAtRef.has(f.dirName)))\n    .sort((a, b) => compareIds(a.id, b.id) || compareIds(a.dirName, b.dirName));\n  // COST ACCEPTED: each touching feature with a record derives its checklist,\n  // which parses its delta. That is the per-feature cost\n  // core/status/fleet/fleet.ts refuses for the WHOLE fleet; a deploy-time\n  // command scoped to one service pays it for that service's features only —\n  // with the invocation's context threaded through `verificationState` into\n  // the derivation, so its enumerations are memo hits (one fleet walk per\n  // run, not one per feature) and the batch prefetch below genuinely seeds\n  // the delta parses. The prefetch is an accelerator only: a host that cannot\n  // batch degrades to per-feature parses with identical findings.\n  // An archived feature never derives a checklist (its record is frozen, see\n  // `verificationState`, and held to the one its archive captured), so\n  // prefetching its delta would parse for nobody.\n  await req.fleet.prefetchLikeC4(\n    touching.filter((f) => !f.archived && f.has.delta).map((f) => featurePaths(f.dir).delta),\n  );\n  // inOrder caps the workspaces in flight and keeps the rows in feature order.\n  const rows = await inOrder(touching, async (f): Promise<VerificationRow> => {\n    try {\n      if (!f.archived) {\n        const { state, notice } = await verificationState(req.docsDir, f, { fleet: req.fleet });\n        return { kind: \"read\", feature: f, state, notice };\n      }\n      const shipped = await readSnapshotChecklist(f.dir);\n      const { state, notice } = await verificationState(req.docsDir, f, { fleet: req.fleet, shipped });\n      return { kind: \"read\", feature: f, state, notice, shipped };\n    } catch (err) {\n      return { kind: \"unreadable\", finding: unreadableSubject(\"feature\", f.id, err) };\n    }\n  });\n  const features: GateFeature[] = [];\n  const findings: Finding[] = [];\n  for (const row of rows) {\n    if (row.kind === \"unreadable\") {\n      findings.push(row.finding);\n      continue;\n    }\n    features.push({\n      id: row.feature.id,\n      ...row.state,\n      ...(row.shipped === undefined ? {} : { archived: true, checklistAtArchive: row.shipped }),\n    });\n    findings.push(...featureFindings(row, req.service, since?.ref));\n  }\n  return { features, findings };\n}\n\nfunction featureFindings(\n  row: ReadRow,\n  service: string,\n  since: string | undefined,\n): Finding[] {\n  const { feature, state, notice } = row;\n  if (state.verdict === \"verified\") return [];\n  if (state.verdict === \"attested\") {\n    // attestedNotice's own words — the one notice verify, list and status all\n    // show, converted to a Finding rather than re-derived. The code string\n    // (`verify.scenario-attested`) is spelled literally at its one emit site,\n    // core/verify/record.ts, where the drift guard collects it.\n    return notice === null\n      ? []\n      : [\n          {\n            severity: notice.severity,\n            code: notice.code,\n            subject: feature.id,\n            message: notice.message,\n            ...(notice.claims === undefined ? {} : { details: notice.claims }),\n          },\n        ];\n  }\n  const verify = `\\`loam verify ${feature.id} --json\\``;\n  const open = state.unconfirmed + state.unanswered;\n  const claimsOpen = `${open} of ${state.claims} claim(s) on ${feature.id} are open (${state.unconfirmed} unconfirmed, ${state.unanswered} unanswered)`;\n  const message = (): string => {\n    // A row `--since` added. Its record is frozen history: `loam verify` reads\n    // it back and refuses to re-record it (commands/verify/verify.ts), so the\n    // in-flight remedies below — derive, answer, re-derive — would send a\n    // deploy pipeline to a command that cannot run. What it CAN be told is\n    // that this deploy carries the feature unchecked, and the one way to\n    // reopen it. An archived record is `stale` only against the checklist its\n    // archive captured — the feature had moved under it before it shipped.\n    if (feature.archived) {\n      const shipped = `${feature.id} touches '${service}' and was archived after ${since ?? \"the --since ref\"}`;\n      const reopen = `Its record is frozen history: ${verify} reads it back, and \\`loam unarchive ${feature.id}\\` re-opens the feature if its claims must be answered before this deploy.`;\n      if (state.state === \"absent\") return `${shipped} with no verification record — nothing was checked before it shipped. ${reopen}`;\n      // The file that failed may be one service's `verification/<svc>.yaml`\n      // as well as the one-file record; `loam verify` names which.\n      if (state.state === \"unreadable\") return `${shipped} with a verification record that does not read as a record — ${verify} names the file that failed. ${reopen}`;\n      if (state.state === \"stale\") {\n        return `${shipped}, and it had moved after its record was written — the record answers a checklist that was no longer the one it asked when it was archived, so what shipped was not what was checked. ${reopen}`;\n      }\n      return state.claims === 0\n        ? `${shipped} with a record that answers no claims at all. ${reopen}`\n        : `${shipped}, and ${claimsOpen}. ${reopen}`;\n    }\n    switch (state.state) {\n      case \"absent\":\n        return `${feature.id} touches '${service}' and has no verification record — nothing has been checked. Derive the checklist and answer it: ${verify}.`;\n      case \"unreadable\":\n        return `${feature.id}'s verification record does not read as a record — ${verify} names the file that failed and its safe repair (never delete a file other services' attestations may be in); nothing will overwrite it while it is unreadable.`;\n      case \"stale\":\n        return `${feature.id} moved after its record was written — the answers answer a checklist that is no longer the one being asked. Re-derive and re-answer: ${verify}.`;\n      case \"recorded\":\n        return state.claims === 0\n          ? `${feature.id}'s record answers no claims at all — nothing was asked, so nothing was checked. ${verify} re-derives the checklist.`\n          : `${claimsOpen} — close them with evidence: ${verify}.`;\n      default: {\n        // A fifth record state must land here as a build failure, not fall\n        // through into some rung nobody decided (verificationStatus holds the\n        // same guard for the same reason).\n        const unreachable: never = state.state;\n        throw new Error(`gate: no wording for verification state '${String(unreachable)}'`);\n      }\n    }\n  };\n  return [\n    {\n      severity: \"warn\",\n      code: \"gate.feature-unverified\",\n      subject: feature.id,\n      message: message(),\n    },\n  ];\n}\n"]}

package/dist/core/gherkin/digest.js

@@ -0,0 +1,60 @@
+/**
+ * The scenario-identity digest — ONE recipe with three consumers, deliberately
+ * in one module: `verify/checklist.ts` folds it into `scenario.tested` claim
+ * ids and claim digests, and `./stamp.ts` stamps the same hex as the
+ * `@loam-digest-…` tag on every generated scenario, which is what a cucumber
+ * report carries and what `verify --results` matches on. A second spelling of
+ * the hash would silently stop every scenario claim from being answerable by a
+ * run — which is why this lives beside the stamper rather than inside either
+ * consumer.
+ */
+import { createHash } from "node:crypto";
+/**
+ * The full sha256 of a scenario's body — its lines joined and edge-trimmed,
+ * exactly as `serializeRequirements` frames them. The BODY, not the title,
+ * because rewriting the Given/When/Then under an unchanged heading is new text
+ * nobody answered for, and the promise — rewording a scenario renames its
+ * claim — has to hold for the words that actually specify the behaviour.
+ *
+ * `scenario.tested` claim ids fold in a prefix of this hex, a claim's `digest`
+ * and the `@loam-digest-<16hex>` tag `loam gherkin` stamps both take another
+ * (`verify/checklist.ts` owns those lengths, `./stamp.ts` its own) — so the
+ * claim, the stamp and the report `--results` reads can never disagree about
+ * what a scenario says.
+ *
+ * The identity is (SERVICE, AXIS, body), and both salts are there for the same
+ * reason: a digest that spans two namespaces lets one green run answer a
+ * question nobody ran a test for.
+ *
+ * - The AXIS salt keeps `spec.md` and `arch.spec.md` apart. Without it a green
+ *   BUSINESS run answered the arch claim too — an integration test nobody wrote
+ *   read as run.
+ * - The SERVICE salt keeps two repositories apart. Different services can word
+ *   "the service returns 404 for an unknown id" identically; unsalted, those
+ *   scenarios share one digest and one repository's green run can appear to
+ *   confirm claims from suites that never ran each other's tests.
+ *
+ * The service salt is what makes that case CORRECT rather than merely refused:
+ * `contestedDigests` could only decline to answer a shared digest, which left a
+ * fleet with ordinary repeated wording holding claims nothing could ever
+ * answer.
+ *
+ * Both salts renamed every claim id and every stamped tag on the day they
+ * landed, and both readings are legible rather than silent: an existing
+ * `verification.yaml` answers a checklist digest that is no longer derived and
+ * reports STALE, and an existing generated `.feature` carries digests the
+ * living spec no longer computes and reports `gherkin.stale` beside the
+ * `gherkin.missing` for the new ones. One `loam gherkin` and one re-record
+ * clear both.
+ */
+export function scenarioBodyHash(service, lines, axis = "business") {
+    // NUL-separated like claimId's tuples (verify/checklist.ts), and for its
+    // reason: no body can spell the salt in front of it, so the namespaces stay
+    // disjoint. Spelled as an escape and never as a raw NUL in the literal — a
+    // raw one makes this file read as `data` to `file(1)` and invisible to
+    // `grep`.
+    const body = lines.join("\n").trim();
+    const onAxis = axis === "arch" ? `arch.spec.md\u0000${body}` : body;
+    return createHash("sha256").update(`${service}\u0000${onAxis}`).digest("hex");
+}
+//# sourceMappingURL=digest.js.map

package/dist/core/gherkin/digest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"digest.js","sourceRoot":"","sources":["../../../src/core/gherkin/digest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAKzC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAAe,EACf,KAAe,EACf,IAAI,GAAiB,UAAU;IAE/B,yEAAyE;IACzE,4EAA4E;IAC5E,2EAA2E;IAC3E,uEAAuE;IACvE,UAAU;IACV,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;IACrC,MAAM,MAAM,GAAG,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,qBAAqB,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACpE,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,OAAO,SAAS,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChF,CAAC","sourcesContent":["/**\n * The scenario-identity digest — ONE recipe with three consumers, deliberately\n * in one module: `verify/checklist.ts` folds it into `scenario.tested` claim\n * ids and claim digests, and `./stamp.ts` stamps the same hex as the\n * `@loam-digest-…` tag on every generated scenario, which is what a cucumber\n * report carries and what `verify --results` matches on. A second spelling of\n * the hash would silently stop every scenario claim from being answerable by a\n * run — which is why this lives beside the stamper rather than inside either\n * consumer.\n */\nimport { createHash } from \"node:crypto\";\n\n/** The axis a scenario's words live on: `spec.md` or `arch.spec.md`. */\nexport type ScenarioAxis = \"business\" | \"arch\";\n\n/**\n * The full sha256 of a scenario's body — its lines joined and edge-trimmed,\n * exactly as `serializeRequirements` frames them. The BODY, not the title,\n * because rewriting the Given/When/Then under an unchanged heading is new text\n * nobody answered for, and the promise — rewording a scenario renames its\n * claim — has to hold for the words that actually specify the behaviour.\n *\n * `scenario.tested` claim ids fold in a prefix of this hex, a claim's `digest`\n * and the `@loam-digest-<16hex>` tag `loam gherkin` stamps both take another\n * (`verify/checklist.ts` owns those lengths, `./stamp.ts` its own) — so the\n * claim, the stamp and the report `--results` reads can never disagree about\n * what a scenario says.\n *\n * The identity is (SERVICE, AXIS, body), and both salts are there for the same\n * reason: a digest that spans two namespaces lets one green run answer a\n * question nobody ran a test for.\n *\n * - The AXIS salt keeps `spec.md` and `arch.spec.md` apart. Without it a green\n *   BUSINESS run answered the arch claim too — an integration test nobody wrote\n *   read as run.\n * - The SERVICE salt keeps two repositories apart. Different services can word\n *   \"the service returns 404 for an unknown id\" identically; unsalted, those\n *   scenarios share one digest and one repository's green run can appear to\n *   confirm claims from suites that never ran each other's tests.\n *\n * The service salt is what makes that case CORRECT rather than merely refused:\n * `contestedDigests` could only decline to answer a shared digest, which left a\n * fleet with ordinary repeated wording holding claims nothing could ever\n * answer.\n *\n * Both salts renamed every claim id and every stamped tag on the day they\n * landed, and both readings are legible rather than silent: an existing\n * `verification.yaml` answers a checklist digest that is no longer derived and\n * reports STALE, and an existing generated `.feature` carries digests the\n * living spec no longer computes and reports `gherkin.stale` beside the\n * `gherkin.missing` for the new ones. One `loam gherkin` and one re-record\n * clear both.\n */\nexport function scenarioBodyHash(\n  service: string,\n  lines: string[],\n  axis: ScenarioAxis = \"business\",\n): string {\n  // NUL-separated like claimId's tuples (verify/checklist.ts), and for its\n  // reason: no body can spell the salt in front of it, so the namespaces stay\n  // disjoint. Spelled as an escape and never as a raw NUL in the literal — a\n  // raw one makes this file read as `data` to `file(1)` and invisible to\n  // `grep`.\n  const body = lines.join(\"\\n\").trim();\n  const onAxis = axis === \"arch\" ? `arch.spec.md\\u0000${body}` : body;\n  return createHash(\"sha256\").update(`${service}\\u0000${onAxis}`).digest(\"hex\");\n}\n"]}

package/dist/core/gherkin/emit.js

@@ -0,0 +1,177 @@
+/**
+ * A requirement set as a `.feature` file: what gets written where, and what the
+ * text says.
+ *
+ * The plan is separate from the render because the two answer to different
+ * owners — where a suite lands is the service repository's layout question
+ * (`./stamp.ts` owns the root), while what a scenario reads like is the
+ * requirement's. Every emitted scenario carries the digest tag the claim
+ * checklist matches on, which is why nothing here may reword a scenario body.
+ */
+import {} from "../document/spec.js";
+import { scenarioGherkin } from "../vocabulary/steps.js";
+import {} from "../repo/paths.js";
+import {} from "./digest.js";
+import { gherkinStampLine, scenarioDigest, scenarioDigestTag } from "./stamp.js";
+/** The axis label the machine contract speaks. */
+export function axisLabel(axis) {
+    return axis.key === "archSpec" ? "arch" : "business";
+}
+/**
+ * A requirement name as a file name: lowercase, every non-letter/digit run one
+ * hyphen, edges trimmed.
+ *
+ * The keep-set is `\p{L}\p{N}`, not `[a-z0-9]`, because an ASCII-only slug is
+ * not a slug of a non-Latin fleet — it is the empty string. Every requirement
+ * written in Chinese, Japanese, Korean, Greek, Cyrillic or Hebrew slugged to
+ * nothing, fell back to `requirement`, and the whole service's suite came out
+ * as `requirement.feature`, `requirement-2.feature`, … : file names that name
+ * nothing, in the one place the mapping is supposed to be legible. So letters
+ * of every script survive as themselves.
+ *
+ * Accents are folded rather than kept, and that is the reason for NFKD first:
+ * decomposing splits `é` into `e` + a combining acute, and dropping the
+ * combining marks (`\p{M}`) leaves `e`. Without the fold `émojis` and `emojis`
+ * would be two files that look identical in a directory listing — and on a
+ * filesystem that normalises names (APFS, and HFS+ before it) they would be one
+ * file, silently, with the second emission overwriting the first.
+ *
+ * A name this still leaves empty (all punctuation or emoji) falls back to
+ * "requirement" and lets the collision counter number it. Runs collapse to a
+ * SINGLE hyphen, which is what keeps the `arch--` prefix an axis marker no
+ * business slug can spell.
+ */
+export function slugOf(name) {
+    const s = name
+        .normalize("NFKD")
+        .replace(/\p{M}+/gu, "")
+        .toLowerCase()
+        .replace(/[^\p{L}\p{N}]+/gu, "-")
+        .replace(/^-+|-+$/g, "");
+    return s.length > 0 ? s : "requirement";
+}
+/**
+ * The emission plan for one scope: one `.feature` per requirement.
+ *
+ * File naming is the mapping's contract, so it is spelled here once:
+ * `<slug>.feature` for the business axis, `arch--<slug>.feature` for the
+ * architecture axis — flat and diffable, and collision-proof across axes
+ * because slugs collapse punctuation runs to a single hyphen, so no business
+ * slug can ever begin `arch--`. Two requirements slugging identically are
+ * disambiguated in document order: the first keeps the bare slug, later ones
+ * take `-2`, `-3`, … (counting up past any name that already owns the suffix).
+ *
+ * Tags ride the `Feature:` line and are inherited by every scenario in the
+ * file: `@<FEAT>` in feature mode (living emissions carry no feature tag),
+ * `@architecture` on the arch axis.
+ *
+ * `opts.service` is the suite's owner and salts every digest stamp — the same
+ * service `loam verify` files the matching claims under. Required, not
+ * defaulted: an emission that guessed it would stamp tags no claim matches.
+ */
+export function planEmission(byAxis, opts) {
+    const used = new Set();
+    const out = [];
+    for (const { axis, reqs } of byAxis) {
+        for (const r of reqs) {
+            const base = (axis.key === "archSpec" ? "arch--" : "") + slugOf(r.name);
+            let fileName = `${base}.feature`;
+            for (let n = 2; used.has(fileName); n += 1)
+                fileName = `${base}-${n}.feature`;
+            used.add(fileName);
+            const tags = [
+                ...(opts.featureTag === undefined ? [] : [`@${opts.featureTag}`]),
+                ...(axis.key === "archSpec" ? ["@architecture"] : []),
+            ];
+            const { content, digests, stepless, malformedExamples, strandedBlocks } = renderFeature(r, { tags, version: opts.version }, opts.service, axisLabel(axis));
+            out.push({ fileName, axis, requirement: r, digests, stepless, malformedExamples, strandedBlocks, content });
+        }
+    }
+    return out;
+}
+export function renderFeature(r, stamp, service, axis = "business") {
+    const { tags, version } = stamp;
+    const lines = [gherkinStampLine(version)];
+    if (tags.length > 0)
+        lines.push(tags.join(" "));
+    lines.push(`Feature: ${r.name}`);
+    const text = r.text.join("\n").trim();
+    if (text.length > 0) {
+        lines.push("");
+        for (const l of text.split("\n"))
+            lines.push(l.length > 0 ? `  ${l}` : "");
+    }
+    const digests = [];
+    const stepless = [];
+    const malformedExamples = [];
+    const strandedBlocks = [];
+    for (const s of r.scenarios) {
+        // The digest hashes the WHOLE body, table rows included, so a changed cell
+        // is a changed scenario: `gherkin.stale` fires on an edited case exactly as
+        // it does on an edited step, and the claim it answers moves with it. It is
+        // also why a change to THIS renderer moves no digest: the hash is over the
+        // markdown source, so a suite generated before a grammar change keeps its
+        // stamps and grades `gherkin.current` until somebody regenerates it.
+        const digest = scenarioDigest(service, s.lines, axis);
+        digests.push(digest);
+        const { description, steps, examples, malformedExamples: broken, strandedBlocks: stranded } = scenarioGherkin(s.lines);
+        if (steps.length === 0)
+            stepless.push(s.name);
+        if (broken)
+            malformedExamples.push(s.name);
+        if (stranded)
+            strandedBlocks.push(s.name);
+        // The keyword is the whole difference between one case and twenty: cucumber
+        // expands an outline into one report element per row, each carrying this
+        // scenario's tag, and `runnerAnswers` confirms the claim only when every
+        // one of them passed.
+        lines.push("", `  ${scenarioDigestTag(digest)}`, `  ${examples === null ? "Scenario" : "Scenario Outline"}: ${s.name}`);
+        for (const d of description)
+            lines.push(`    ${d}`);
+        for (const st of steps) {
+            lines.push(`    ${st.text}`);
+            // Gherkin puts a step's argument UNDER the step, indented past it, and
+            // permits at most one of each kind. Docstring first, so a step carrying
+            // both reads request-then-expectation.
+            if (st.docstring !== undefined) {
+                lines.push(`      """${st.docstring.contentType ?? ""}`);
+                // A payload containing its own `"""` would close the block early and
+                // silently move the rest of the request body into the step list.
+                for (const l of st.docstring.lines)
+                    lines.push(l.length === 0 ? "" : `      ${l.replace(/"""/g, '\\"\\"\\"')}`);
+                lines.push('      """');
+            }
+            if (st.table !== undefined)
+                for (const row of st.table)
+                    lines.push(`      ${tableRow(row, st.table)}`);
+        }
+        if (examples !== null) {
+            lines.push("", "    Examples:");
+            for (const row of [examples.header, ...examples.rows])
+                lines.push(`      ${tableRow(row, [examples.header, ...examples.rows])}`);
+        }
+    }
+    return { content: lines.join("\n") + "\n", digests, stepless, malformedExamples, strandedBlocks };
+}
+/**
+ * One table row — an `Examples` case or a step's data table — with columns
+ * padded to the widest cell in that table.
+ *
+ * Padding is cosmetic to cucumber and deliberate here: these files are read in
+ * review as often as they are run, and an unaligned twenty-row matrix is where
+ * a wrong cell hides. Deterministic to the byte, like everything else the
+ * emitter writes — the widths come from the table alone.
+ *
+ * ESCAPING IS NOT COSMETIC. Gherkin's table grammar ends a cell at `|`, so a
+ * cell containing one silently becomes two cells and every row after it
+ * disagrees with the header; `\` and a literal newline are the same class. The
+ * escapes go on before the padding is measured, because the emitted width is
+ * the escaped width — measuring the raw cell produced columns that drifted by
+ * one character per escape.
+ */
+function tableRow(row, all) {
+    const esc = (c) => c.replace(/\\/g, "\\\\").replace(/\|/g, "\\|").replace(/\n/g, "\\n");
+    const widths = row.map((_, i) => Math.max(...all.map((r) => esc(r[i] ?? "").length)));
+    return `| ${row.map((c, i) => esc(c).padEnd(widths[i])).join(" | ")} |`;
+}
+//# sourceMappingURL=emit.js.map