@ybotok/loam 0.1.0-beta.3 → 0.2.0-alpha.13

package/dist/commands/validate/coverage/covers-after.js

@@ -0,0 +1,105 @@
+import { entryResolves, parseCoversEntry } from "../../../core/c4/arch.js";
+import { stageMergedProject } from "../../../core/c4/project/staged.js";
+import { elementService, serviceResolver } from "../../../core/c4/resolve/service.js";
+/**
+ * The post-merge map, computed at most once and only when asked — `null` when
+ * it cannot be had. Pre-routing on purpose (no extending models passed): an
+ * addition the archive routes into a service's model keeps the fqn it has on
+ * the map, and living scope reads model and map as one corpus, so the
+ * pre-routing preview holds every id a `Covers:` line can name after archive.
+ */
+export function mergedMapOf(source) {
+    let merged;
+    return () => (merged ??= (async () => {
+        const staged = await stageMergedProject({
+            docsDir: source.docsDir,
+            featureDir: source.featureDir,
+            featureId: source.featureId,
+            documents: [],
+            load: (path) => source.fleet.loadLikeC4(path),
+        });
+        return staged.kind === "read" ? { doc: staged.doc, svcOf: serviceResolver(staged.doc.elements, source.known) } : null;
+    })());
+}
+/**
+ * The `Covers:` spelling for a new element that still resolves once it is
+ * living: the service it stands for, else the id the merge gives it — matched in
+ * the preview by kind, title and owning service, and offered only when exactly
+ * one element answers. The delta's own id is the fallback, never a guess.
+ */
+export async function survivingElementCover(e, delta, merged) {
+    // An explicit binding is spliced verbatim, and living scope matches an
+    // element entry by it (`namesElement`), so it survives whether or not the
+    // service has a directory yet; a title only where it names a known service.
+    const service = elementService(e);
+    if (e.service !== undefined || delta.known.has(service))
+        return service;
+    const map = await merged();
+    if (map === null)
+        return e.id;
+    const owner = delta.svcOf(e.id);
+    const [landed, ...others] = map.doc.elements.filter((m) => m.kind === e.kind && m.title === e.title && map.svcOf(m.id) === owner);
+    return landed !== undefined && others.length === 0 ? landed.id : e.id;
+}
+/** The `Covers:` spelling for a new edge — its endpoints' service names, which both scopes resolve alike. */
+export function survivingEdgeCover(r, svcOf) {
+    return `${svcOf(r.source)} -> ${svcOf(r.target)}`;
+}
+/** Does every element name this entry spells belong to a service? Then it is settled — names survive the merge. */
+function namesServicesOnly(entry, known) {
+    if (entry.form === "element")
+        return known.has(entry.id);
+    if (entry.form === "edge")
+        return known.has(entry.source) && known.has(entry.target);
+    return true;
+}
+/**
+ * `covers.unknown` for the entries feature scope resolves only through the
+ * delta's own ids, which the map the merge leaves does not declare. Entries
+ * that resolve nowhere are `coversUnknownFindings`' to report, so they are
+ * skipped here: one breach, one finding.
+ */
+export async function deltaSpelledCovers(input) {
+    const { service, featureScope } = input;
+    const known = featureScope.known ?? new Set();
+    const out = [];
+    for (const r of input.reqs) {
+        if (r.kind === "REMOVED")
+            continue;
+        for (const raw of r.covers) {
+            const entry = parseCoversEntry(raw);
+            if (entry.form !== "element" && entry.form !== "edge")
+                continue;
+            if (!entryResolves(entry, featureScope) || namesServicesOnly(entry, known))
+                continue;
+            const model = await input.model();
+            const after = (elements, relationships) => ({
+                ...featureScope,
+                elements: [...elements, ...model.elements],
+                relationships: [...relationships, ...model.relationships],
+            });
+            if (entryResolves(entry, after(input.living.elements, input.living.relationships)))
+                continue;
+            const map = await input.merged();
+            if (map === null || entryResolves(entry, after(map.doc.elements, map.doc.relationships)))
+                continue;
+            const declared = entry.form === "element" ? input.elements.find((e) => e.id === entry.id) : undefined;
+            const named = entry.form === "edge"
+                ? `${input.svcOf(entry.source)} -> ${input.svcOf(entry.target)}`
+                : declared === undefined
+                    ? entry.id
+                    : await survivingElementCover(declared, { svcOf: input.svcOf, known }, input.merged);
+            out.push({
+                severity: "warn",
+                code: "covers.unknown",
+                subject: service,
+                message: `${service}: arch.spec.md: requirement '${r.name}' — Covers: '${raw}' resolves only through this ` +
+                    `feature's delta.likec4, whose ids are its own spelling: the map this merge leaves declares no such ` +
+                    `${entry.form === "edge" ? "edge" : "element"}, so the next \`loam validate --all\` reports covers.unknown ` +
+                    `on it. Name it the way the living map does — '${named}' resolves in both`,
+            });
+        }
+    }
+    return out;
+}
+//# sourceMappingURL=covers-after.js.map

package/dist/commands/validate/coverage/covers-after.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"covers-after.js","sourceRoot":"","sources":["../../../../src/commands/validate/coverage/covers-after.ts"],"names":[],"mappings":"AAkCA,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAwC,MAAM,0BAA0B,CAAC;AACjH,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AACxE,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAC;AAsBtF;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,MAAmB;IAC7C,IAAI,MAA6C,CAAC;IAClD,OAAO,GAAG,EAAE,CACV,CAAC,MAAM,KAAK,CAAC,KAAK,IAAI,EAAE;QACtB,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC;YACtC,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,SAAS,EAAE,EAAE;YACb,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;SAC9C,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,KAAK,EAAE,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACxH,CAAC,CAAC,EAAE,CAAC,CAAC;AACV,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,CAAO,EACP,KAAoE,EACpE,MAAuC;IAEvC,uEAAuE;IACvE,0EAA0E;IAC1E,4EAA4E;IAC5E,MAAM,OAAO,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;IAClC,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IACxE,MAAM,GAAG,GAAG,MAAM,MAAM,EAAE,CAAC;IAC3B,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,CAAC,CAAC,EAAE,CAAC;IAC9B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAChC,MAAM,CAAC,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,KAAK,CAAC,CAAC;IAClI,OAAO,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACxE,CAAC;AAED,6GAA6G;AAC7G,MAAM,UAAU,kBAAkB,CAAC,CAAM,EAAE,KAA6B;IACtE,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;AACpD,CAAC;AAkBD,mHAAmH;AACnH,SAAS,iBAAiB,CAAC,KAAkB,EAAE,KAA0B;IACvE,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACzD,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACrF,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KAAwB;IAC/D,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,KAAK,CAAC;IACxC,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,IAAI,IAAI,GAAG,EAAU,CAAC;IACtD,MAAM,GAAG,GAAc,EAAE,CAAC;IAC1B,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;QAC3B,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS;YAAE,SAAS;QACnC,KAAK,MAAM,GAAG,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;YAC3B,MAAM,KAAK,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;YACpC,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM;gBAAE,SAAS;YAChE,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,YAAY,CAAC,IAAI,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC;gBAAE,SAAS;YACrF,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,CAAC,QAAgB,EAAE,aAAoB,EAAiB,EAAE,CAAC,CAAC;gBACxE,GAAG,YAAY;gBACf,QAAQ,EAAE,CAAC,GAAG,QAAQ,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC;gBAC1C,aAAa,EAAE,CAAC,GAAG,aAAa,EAAE,GAAG,KAAK,CAAC,aAAa,CAAC;aAC1D,CAAC,CAAC;YACH,IAAI,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;gBAAE,SAAS;YAC7F,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,MAAM,EAAE,CAAC;YACjC,IAAI,GAAG,KAAK,IAAI,IAAI,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;gBAAE,SAAS;YACnG,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACtG,MAAM,KAAK,GACT,KAAK,CAAC,IAAI,KAAK,MAAM;gBACnB,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE;gBAChE,CAAC,CAAC,QAAQ,KAAK,SAAS;oBACtB,CAAC,CAAC,KAAK,CAAC,EAAE;oBACV,CAAC,CAAC,MAAM,qBAAqB,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YAC3F,GAAG,CAAC,IAAI,CAAC;gBACP,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EAAE,OAAO;gBAChB,OAAO,EACL,GAAG,OAAO,gCAAgC,CAAC,CAAC,IAAI,gBAAgB,GAAG,+BAA+B;oBAClG,qGAAqG;oBACrG,GAAG,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,+DAA+D;oBAC5G,iDAAiD,KAAK,oBAAoB;aAC7E,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC","sourcesContent":["/**\n * A feature's `Covers:` lines, read in the id space they will LIVE in.\n *\n * Feature scope used to resolve an arch delta's `Covers:` entries against the\n * delta's own elements plus the living landscape (`../arch-coverage.ts`), and\n * living scope resolves them against the service's model plus the map\n * (`../service/specs.ts`). The two spaces are not the same. A delta re-declares\n * the elements its edges attach to wherever its author writes them, so a stub\n * `orderService` the living map nests as `marketplace.orderService` gave the\n * line `Covers: orderService -> notificationService` a match at feature scope\n * and `covers.unknown` the moment the archive landed it — and the\n * `c4.uncovered` hint had recommended exactly that delta id (the real-fleet\n * review, 2026-10-21). The landscape merge splices a stub's NEW children under\n * the living element it binds to, so a child's id changes with its parent's.\n *\n * WHAT SURVIVES, cheapest proof first. A service name survives both scopes —\n * the binding is spliced verbatim — so an entry naming services only is\n * settled without reading anything. So is one the living map and the service's\n * own model already answer. Only an entry that resolved through the delta's own\n * ids is then asked of the map the merge would leave, staged with the\n * archive's own function (`core/c4/project/staged.ts`) and parsed once per\n * feature, lazily: that is a LikeC4 workspace spin, and the clean path never\n * pays it. Where the preview cannot be had — no landscape, a merge the archive\n * refuses, a living document that does not parse — the entry is let stand:\n * those are other findings' to report, and grading a line against a map\n * nobody could read is the cascade `covers.unknown` already refuses\n * (`../service/specs.ts`).\n *\n * The same preview names the post-merge id of a NEW element that stands for\n * no service, which is what a `c4.uncovered` hint must offer for it: an element\n * that IS a service is offered by name, and an edge always by its endpoints'\n * service names, the one spelling that resolves in both scopes.\n */\nimport type { Elem, LoadedDoc, Rel } from \"../../../core/c4/likec4.js\";\nimport { entryResolves, parseCoversEntry, type CoverageScope, type CoversEntry } from \"../../../core/c4/arch.js\";\nimport { stageMergedProject } from \"../../../core/c4/project/staged.js\";\nimport { elementService, serviceResolver } from \"../../../core/c4/resolve/service.js\";\nimport type { Requirement } from \"../../../core/document/spec.js\";\nimport type { FleetContext } from \"../../../core/fleet-context.js\";\nimport type { DocsDir, FeatureDir } from \"../../../core/kernel/ids/dirs.js\";\nimport type { Finding } from \"../../../core/vocabulary/report.js\";\n\n/** The map the merge would leave, parsed, with its own element→service resolver. */\nexport interface MergedMap {\n  doc: LoadedDoc;\n  svcOf: (id: string) => string;\n}\n\n/** What the preview is computed from. */\nexport interface MergeSource {\n  docsDir: DocsDir;\n  featureDir: FeatureDir;\n  featureId: string;\n  fleet: FleetContext;\n  /** The enumerated fleet plus the feature's own services — the resolver's set. */\n  known: ReadonlySet<string>;\n}\n\n/**\n * The post-merge map, computed at most once and only when asked — `null` when\n * it cannot be had. Pre-routing on purpose (no extending models passed): an\n * addition the archive routes into a service's model keeps the fqn it has on\n * the map, and living scope reads model and map as one corpus, so the\n * pre-routing preview holds every id a `Covers:` line can name after archive.\n */\nexport function mergedMapOf(source: MergeSource): () => Promise<MergedMap | null> {\n  let merged: Promise<MergedMap | null> | undefined;\n  return () =>\n    (merged ??= (async () => {\n      const staged = await stageMergedProject({\n        docsDir: source.docsDir,\n        featureDir: source.featureDir,\n        featureId: source.featureId,\n        documents: [],\n        load: (path) => source.fleet.loadLikeC4(path),\n      });\n      return staged.kind === \"read\" ? { doc: staged.doc, svcOf: serviceResolver(staged.doc.elements, source.known) } : null;\n    })());\n}\n\n/**\n * The `Covers:` spelling for a new element that still resolves once it is\n * living: the service it stands for, else the id the merge gives it — matched in\n * the preview by kind, title and owning service, and offered only when exactly\n * one element answers. The delta's own id is the fallback, never a guess.\n */\nexport async function survivingElementCover(\n  e: Elem,\n  delta: { svcOf: (id: string) => string; known: ReadonlySet<string> },\n  merged: () => Promise<MergedMap | null>,\n): Promise<string> {\n  // An explicit binding is spliced verbatim, and living scope matches an\n  // element entry by it (`namesElement`), so it survives whether or not the\n  // service has a directory yet; a title only where it names a known service.\n  const service = elementService(e);\n  if (e.service !== undefined || delta.known.has(service)) return service;\n  const map = await merged();\n  if (map === null) return e.id;\n  const owner = delta.svcOf(e.id);\n  const [landed, ...others] = map.doc.elements.filter((m) => m.kind === e.kind && m.title === e.title && map.svcOf(m.id) === owner);\n  return landed !== undefined && others.length === 0 ? landed.id : e.id;\n}\n\n/** The `Covers:` spelling for a new edge — its endpoints' service names, which both scopes resolve alike. */\nexport function survivingEdgeCover(r: Rel, svcOf: (id: string) => string): string {\n  return `${svcOf(r.source)} -> ${svcOf(r.target)}`;\n}\n\n/** One arch delta's lines, and the scopes they are read in. */\nexport interface DeltaSpelledInput {\n  service: string;\n  reqs: Requirement[];\n  /** The scope feature validation has always used — delta, living map, model where widened, health. */\n  featureScope: CoverageScope;\n  /** The living map's elements and edges — what the merge keeps whatever it adds. */\n  living: { elements: Elem[]; relationships: Rel[] };\n  /** The service's own model, read lazily; empty when there is none or it does not read. */\n  model: () => Promise<{ elements: Elem[]; relationships: Rel[] }>;\n  /** The delta's elements and resolver, for the spelling a finding offers instead. */\n  elements: Elem[];\n  svcOf: (id: string) => string;\n  merged: () => Promise<MergedMap | null>;\n}\n\n/** Does every element name this entry spells belong to a service? Then it is settled — names survive the merge. */\nfunction namesServicesOnly(entry: CoversEntry, known: ReadonlySet<string>): boolean {\n  if (entry.form === \"element\") return known.has(entry.id);\n  if (entry.form === \"edge\") return known.has(entry.source) && known.has(entry.target);\n  return true;\n}\n\n/**\n * `covers.unknown` for the entries feature scope resolves only through the\n * delta's own ids, which the map the merge leaves does not declare. Entries\n * that resolve nowhere are `coversUnknownFindings`' to report, so they are\n * skipped here: one breach, one finding.\n */\nexport async function deltaSpelledCovers(input: DeltaSpelledInput): Promise<Finding[]> {\n  const { service, featureScope } = input;\n  const known = featureScope.known ?? new Set<string>();\n  const out: Finding[] = [];\n  for (const r of input.reqs) {\n    if (r.kind === \"REMOVED\") continue;\n    for (const raw of r.covers) {\n      const entry = parseCoversEntry(raw);\n      if (entry.form !== \"element\" && entry.form !== \"edge\") continue;\n      if (!entryResolves(entry, featureScope) || namesServicesOnly(entry, known)) continue;\n      const model = await input.model();\n      const after = (elements: Elem[], relationships: Rel[]): CoverageScope => ({\n        ...featureScope,\n        elements: [...elements, ...model.elements],\n        relationships: [...relationships, ...model.relationships],\n      });\n      if (entryResolves(entry, after(input.living.elements, input.living.relationships))) continue;\n      const map = await input.merged();\n      if (map === null || entryResolves(entry, after(map.doc.elements, map.doc.relationships))) continue;\n      const declared = entry.form === \"element\" ? input.elements.find((e) => e.id === entry.id) : undefined;\n      const named =\n        entry.form === \"edge\"\n          ? `${input.svcOf(entry.source)} -> ${input.svcOf(entry.target)}`\n          : declared === undefined\n            ? entry.id\n            : await survivingElementCover(declared, { svcOf: input.svcOf, known }, input.merged);\n      out.push({\n        severity: \"warn\",\n        code: \"covers.unknown\",\n        subject: service,\n        message:\n          `${service}: arch.spec.md: requirement '${r.name}' — Covers: '${raw}' resolves only through this ` +\n          `feature's delta.likec4, whose ids are its own spelling: the map this merge leaves declares no such ` +\n          `${entry.form === \"edge\" ? \"edge\" : \"element\"}, so the next \\`loam validate --all\\` reports covers.unknown ` +\n          `on it. Name it the way the living map does — '${named}' resolves in both`,\n      });\n    }\n  }\n  return out;\n}\n"]}

package/dist/commands/validate/feature.js

@@ -0,0 +1,222 @@
+/**
+ * The feature target: a delta graded on its own, before anything merges.
+ *
+ * Everything here reads the feature directory — delta.likec4, the per-service
+ * spec.md/arch.spec.md deltas, the provenance stamp — and grades the documents
+ * a merge is about to fold into living ones. A delta is held to the same
+ * document rules as the file it becomes (`./checks/requirements.js`), because
+ * grading it more leniently is how a defect acquires a signature saying it was
+ * reviewed.
+ *
+ * The one question that needs the LIVING fleet — what in this delta is actually
+ * new architecture — is `./arch-coverage.js`.
+ */
+import { existsSync } from "node:fs";
+import {} from "../../core/c4/likec4.js";
+import { elementService } from "../../core/c4/resolve/service.js";
+import {} from "../../core/kernel/ids/service.js";
+import {} from "../../core/repo/entries.js";
+import { featurePaths, featureSpecPaths } from "../../core/repo/paths.js";
+import { enumeratedServiceIds } from "../../core/repo/service-target.js";
+import { docsRepoState } from "../../core/repo/state.js";
+import { featureSpecServices, listServices } from "../../core/repo/repo.js";
+import {} from "../../core/vocabulary/report.js";
+import {} from "../../core/document/spec.js";
+import { featureCoherence } from "../../core/coherence/coherence.js";
+import { deltaServiceUnknownFinding, invalidSpecServiceFindings, } from "../../core/coherence/living.js";
+import { issueFinding } from "../../core/vocabulary/issue.js";
+import { featureProvenance } from "../../core/provenance/findings.js";
+import { documentConflictFinding } from "../../core/conflict-markers.js";
+import { docMissingFindings } from "../../core/capabilities/findings.js";
+import { FleetContext } from "../../core/fleet-context.js";
+import { errorText } from "../../core/c4/likec4.js";
+import { coverageFinding, repeatedListLineFindings, scenarioShapeFindings } from "./checks/requirements.js";
+import { deltaArchCoverage } from "./arch-coverage.js";
+import { featureLinkFindings } from "./links/corpus.js";
+import { featureRecordFindings } from "./service/evidence-pins.js";
+export async function validateFeature(docsDir, feature, preloadedLand, fleet) {
+    const findings = [];
+    const featureDir = feature.dir;
+    const featureId = feature.id;
+    // delta.likec4 parse + collect tagged edges. The loaded doc is kept and
+    // handed to featureCoherence below — loading it is a Langium workspace spin,
+    // and paying it twice per feature was the dominant cost of `validate --all`.
+    let taggedEls = [];
+    let taggedRels = [];
+    let elements = [];
+    let deltaRels = [];
+    let deltaDoc;
+    const deltaPath = featurePaths(featureDir).delta;
+    if (existsSync(deltaPath)) {
+        const res = await fleet.loadLikeC4(deltaPath);
+        deltaDoc = res;
+        if (res.errors.length > 0) {
+            findings.push({
+                severity: "error",
+                code: "delta.invalid",
+                message: `delta.likec4 has ${res.errors.length} error(s)`,
+                details: res.errors.map(errorText),
+            });
+        }
+        else {
+            elements = res.elements;
+            deltaRels = res.relationships;
+            taggedEls = res.elements.filter((e) => e.tags.includes(featureId));
+            taggedRels = res.relationships.filter((r) => r.tags.includes(featureId));
+            findings.push({
+                severity: "ok",
+                code: "delta.valid",
+                message: `delta.likec4 valid (${res.elements.length} elements · ${res.relationships.length} relationships)`,
+            });
+        }
+    }
+    findings.push(...(await featureProvenance(featureDir, featureId)));
+    // The verification record, graded for READABILITY only — never for what it
+    // concludes. A conflict-marked or hand-broken `verification.yaml` /
+    // `verification/<svc>.yaml` was refused by `verify`, reported by `status`,
+    // `gate` and `tasks`, and invisible here: `validate --all` from the docs repo
+    // (and so the PR gate) stayed green over a record nobody can read, because
+    // the only target raising this code was the service one, which runs from a
+    // service repo. Same code and severity as that target
+    // (`./service/evidence-pins.ts`) — a warn, so `valid` and `loam archive` are
+    // untouched (verify never gates archive) and `--strict` is the lever. The
+    // verdict itself stays `verify`'s and `status`'s to state.
+    findings.push(...(await featureRecordFindings(docsDir, feature)));
+    // Who this feature is allowed to address. `specs/<svc>/` is what the archive
+    // materialises `services/<svc>/` from, and nothing used to ask whether that
+    // name means anything: one wrong character in `--touches` passed
+    // `validate --all` with zero errors, and archive then created the phantom
+    // directory. A delta may legitimately name a service that does not exist yet
+    // — but only one it INTRODUCES itself, in its own tagged C4. A delta that did
+    // not parse proves neither (`delta.invalid` is that finding), so the question
+    // is suspended there rather than answered by guessing.
+    //
+    // Existence is enumeration MEMBERSHIP through the no-services-tolerant
+    // spelling, never `existsSync(services/<svc>/)` at the root: a service filed
+    // into a subsystem exists wherever the tree walk found it, and the root
+    // probe graded every filed service `delta.service-unknown`. The tolerance
+    // carries the old carve-out forward — `validate --feature` is allowed to run
+    // in a docs repo with no services/ at all, where enumerating is a refusal;
+    // `enumeratedServiceIds` swallows exactly that refusal to an empty list, in
+    // which every service is honestly absent.
+    const featureServices = await featureSpecServices(featureDir, fleet);
+    const introduces = new Set(taggedEls.map(elementService));
+    const deltaReadable = deltaDoc === undefined || deltaDoc.errors.length === 0;
+    const enumerated = new Set(await enumeratedServiceIds(docsDir, fleet));
+    const unknownServices = deltaReadable
+        ? featureServices.filter((svc) => !enumerated.has(svc) && !introduces.has(svc))
+        : [];
+    // The near-miss hint, on the same rule `service.unknown` uses — a typo is
+    // only diagnosable against the ids that DO exist.
+    const closeTo = unknownServices.length > 0 && docsRepoState(docsDir).kind === "ok"
+        ? (await listServices(docsDir, fleet)).map((s) => s.id)
+        : [];
+    // The finding is coherence/living.ts's — the same words archive refuses with,
+    // because it is the same conclusion about the same directory.
+    for (const svc of unknownServices)
+        findings.push(deltaServiceUnknownFinding(svc, closeTo));
+    // The grammar half of the same guarantee. `delta.service-unknown` asks whether
+    // the directory names a service anyone knows; this asks whether the NAME could
+    // ever be one. The two are independent on purpose: a tagged element whose
+    // title matches the directory answers the first question, which is exactly how
+    // `specs/Payment Service/` used to validate green and archive into a directory
+    // no loam command can address. Not suspended on an unreadable delta either —
+    // no reading of the architecture axis can make the name legal.
+    findings.push(...(await invalidSpecServiceFindings(featureDir, fleet)));
+    // Requirement coverage across every per-service delta — the business spec and
+    // the arch spec through the same check — and collect scenario text.
+    let scenarioText = "";
+    const archDeltas = [];
+    for (const svc of featureServices) {
+        const p = featureSpecPaths(featureDir, svc);
+        if (existsSync(p.spec)) {
+            const raw = await fleet.readText(p.spec);
+            scenarioText += "\n" + raw.toLowerCase();
+            const reqs = await fleet.readRequirements(p.spec);
+            // Both document-level breaches carry into the living spec through the
+            // merge, so a delta is graded for them exactly as a living document is:
+            // conflict markers merge as prose under someone's requirement, and a
+            // stepless scenario merges as a requirement the coverage rule calls
+            // covered forever after.
+            const conflict = documentConflictFinding(`${svc}: spec.md`, svc, raw);
+            if (conflict !== null)
+                findings.push(conflict);
+            findings.push({ ...coverageFinding(`${svc}: requirements`, reqs), subject: svc });
+            findings.push(...scenarioShapeFindings(`${svc}: requirements`, svc, reqs));
+            // The keep-last quirk loses lines in a delta exactly as in a living spec
+            // — and a delta's lost Operations: line then merges into the living one.
+            findings.push(...repeatedListLineFindings(reqs, `${svc}: spec.md`, svc));
+        }
+        if (existsSync(p.archSpec)) {
+            const raw = await fleet.readText(p.archSpec);
+            scenarioText += "\n" + raw.toLowerCase();
+            const reqs = await fleet.readRequirements(p.archSpec);
+            archDeltas.push({ service: svc, reqs });
+            const conflict = documentConflictFinding(`${svc}: arch.spec.md`, svc, raw);
+            if (conflict !== null)
+                findings.push(conflict);
+            findings.push({ ...coverageFinding(`${svc}: arch requirements`, reqs), subject: svc });
+            findings.push(...scenarioShapeFindings(`${svc}: arch requirements`, svc, reqs));
+            findings.push(...repeatedListLineFindings(reqs, `${svc}: arch.spec.md`, svc));
+        }
+    }
+    // The BUSINESS corpus's delta documents, graded for the same document-level
+    // breach as the service ones and for the same reason: a conflicted delta
+    // parses as prose, so every other check reads it as a valid document, and
+    // `loam archive` then re-serializes both sides of somebody's merge into the
+    // LIVING capability document. It is worse there than one tree over — once the
+    // feature is archived, nothing walks the delta again, and the living
+    // capability documents are only conflict-scanned while some feature still
+    // carries a delta for them.
+    const capabilityDeltas = await fleet.featureCapabilityDeltas(featureDir);
+    // The half-created directory, on the FEATURE side. The living tree has warned
+    // about `capabilities/<id>/` with no document since the axis landed; the same
+    // `mkdir` inside `features/<FEAT>/capabilities/` earned nothing, and it is the
+    // quieter of the two — an empty directory is not a delta, so the walk finds
+    // no document, the merge carries nothing, and the business change ships as
+    // zero at exit 0. Same code, feature-scoped message (`../../core/capabilities/findings.ts`).
+    // `dirName`, not the id: the directory is `features/FEAT-1-split/`, and a
+    // message spelling `features/FEAT-1/` names a path nobody can open.
+    findings.push(...docMissingFindings(capabilityDeltas, feature.dirName));
+    for (const doc of capabilityDeltas.docs) {
+        const raw = await fleet.readText(doc.spec);
+        const conflict = documentConflictFinding(`capability ${doc.id}: spec.md`, doc.id, raw);
+        if (conflict !== null)
+            findings.push(conflict);
+    }
+    // The links this feature's own documents write — the intent, each service's
+    // two spec deltas, its ADRs and its capability deltas. Same place in the
+    // order as the service target's: after every join loam defined a line for.
+    findings.push(...(await featureLinkFindings({ docsDir, subject: featureId, fleet }, featureDir)));
+    findings.push(...(await deltaArchCoverage({
+        docsDir,
+        featureDir,
+        featureId,
+        elements,
+        relationships: deltaRels,
+        taggedEls,
+        taggedRels,
+        archDeltas,
+        featureServices,
+        scenarioText,
+        preloadedLand,
+        fleet,
+    })));
+    // Coherence — cross-axis consistency (C4 ↔ requirements ↔ OpenAPI).
+    const issues = await featureCoherence({ docsDir, featureDir, featureId, preloadedDelta: deltaDoc, context: fleet });
+    if (issues.length === 0) {
+        findings.push({
+            severity: "ok",
+            code: "coherence.ok",
+            message: "coherence: ✓ C4 · requirements · OpenAPI agree",
+            text: { indent: 2, marker: false },
+        });
+    }
+    else {
+        for (const i of issues) {
+            findings.push({ ...issueFinding(i), text: { indent: 4, header: "coherence:" } });
+        }
+    }
+    return { kind: "feature", id: featureId, path: `features/${feature.dirName}`, findings };
+}
+//# sourceMappingURL=feature.js.map

package/dist/commands/validate/feature.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"feature.js","sourceRoot":"","sources":["../../../src/commands/validate/feature.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAuC,MAAM,yBAAyB,CAAC;AAC9E,OAAO,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAClE,OAAO,EAAwB,MAAM,kCAAkC,CAAC;AACxE,OAAO,EAAqB,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,EAAmC,MAAM,iCAAiC,CAAC;AAClF,OAAO,EAAoB,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AACrE,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,GAC3B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AACzE,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAC5G,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAGnE,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAAgB,EAChB,OAAqB,EACrB,aAA2C,EAC3C,KAAmB;IAEnB,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC;IAC/B,MAAM,SAAS,GAAG,OAAO,CAAC,EAAE,CAAC;IAE7B,wEAAwE;IACxE,6EAA6E;IAC7E,6EAA6E;IAC7E,IAAI,SAAS,GAAW,EAAE,CAAC;IAC3B,IAAI,UAAU,GAAU,EAAE,CAAC;IAC3B,IAAI,QAAQ,GAAW,EAAE,CAAC;IAC1B,IAAI,SAAS,GAAU,EAAE,CAAC;IAC1B,IAAI,QAA+B,CAAC;IACpC,MAAM,SAAS,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC;IACjD,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAC9C,QAAQ,GAAG,GAAG,CAAC;QACf,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,eAAe;gBACrB,OAAO,EAAE,oBAAoB,GAAG,CAAC,MAAM,CAAC,MAAM,WAAW;gBACzD,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC;aACnC,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;YACxB,SAAS,GAAG,GAAG,CAAC,aAAa,CAAC;YAC9B,SAAS,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;YACnE,UAAU,GAAG,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;YACzE,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,IAAI;gBACd,IAAI,EAAE,aAAa;gBACnB,OAAO,EAAE,uBAAuB,GAAG,CAAC,QAAQ,CAAC,MAAM,eAAe,GAAG,CAAC,aAAa,CAAC,MAAM,iBAAiB;aAC5G,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,iBAAiB,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC;IAEnE,2EAA2E;IAC3E,oEAAoE;IACpE,2EAA2E;IAC3E,8EAA8E;IAC9E,2EAA2E;IAC3E,2EAA2E;IAC3E,sDAAsD;IACtD,6EAA6E;IAC7E,0EAA0E;IAC1E,2DAA2D;IAC3D,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,qBAAqB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IAElE,6EAA6E;IAC7E,4EAA4E;IAC5E,iEAAiE;IACjE,0EAA0E;IAC1E,6EAA6E;IAC7E,8EAA8E;IAC9E,8EAA8E;IAC9E,uDAAuD;IACvD,EAAE;IACF,uEAAuE;IACvE,6EAA6E;IAC7E,wEAAwE;IACxE,0EAA0E;IAC1E,6EAA6E;IAC7E,2EAA2E;IAC3E,4EAA4E;IAC5E,0CAA0C;IAC1C,MAAM,eAAe,GAAG,MAAM,mBAAmB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACrE,MAAM,UAAU,GAAwB,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;IAC/E,MAAM,aAAa,GAAG,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC;IAC7E,MAAM,UAAU,GAAG,IAAI,GAAG,CAAS,MAAM,oBAAoB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;IAC/E,MAAM,eAAe,GAAG,aAAa;QACnC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/E,CAAC,CAAC,EAAE,CAAC;IACP,0EAA0E;IAC1E,kDAAkD;IAClD,MAAM,OAAO,GACX,eAAe,CAAC,MAAM,GAAG,CAAC,IAAI,aAAa,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,IAAI;QAChE,CAAC,CAAC,CAAC,MAAM,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,CAAC,CAAC,EAAE,CAAC;IACT,8EAA8E;IAC9E,8DAA8D;IAC9D,KAAK,MAAM,GAAG,IAAI,eAAe;QAAE,QAAQ,CAAC,IAAI,CAAC,0BAA0B,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;IAE3F,+EAA+E;IAC/E,+EAA+E;IAC/E,0EAA0E;IAC1E,+EAA+E;IAC/E,+EAA+E;IAC/E,6EAA6E;IAC7E,+DAA+D;IAC/D,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,0BAA0B,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IAExE,8EAA8E;IAC9E,oEAAoE;IACpE,IAAI,YAAY,GAAG,EAAE,CAAC;IACtB,MAAM,UAAU,GAA6D,EAAE,CAAC;IAChF,KAAK,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QAClC,MAAM,CAAC,GAAG,gBAAgB,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QAC5C,IAAI,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACzC,YAAY,IAAI,IAAI,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;YACzC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAClD,sEAAsE;YACtE,wEAAwE;YACxE,qEAAqE;YACrE,oEAAoE;YACpE,yBAAyB;YACzB,MAAM,QAAQ,GAAG,uBAAuB,CAAC,GAAG,GAAG,WAAW,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;YACtE,IAAI,QAAQ,KAAK,IAAI;gBAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC/C,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,eAAe,CAAC,GAAG,GAAG,gBAAgB,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;YAClF,QAAQ,CAAC,IAAI,CAAC,GAAG,qBAAqB,CAAC,GAAG,GAAG,gBAAgB,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;YAC3E,yEAAyE;YACzE,yEAAyE;YACzE,QAAQ,CAAC,IAAI,CAAC,GAAG,wBAAwB,CAAC,IAAI,EAAE,GAAG,GAAG,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC;QAC3E,CAAC;QACD,IAAI,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3B,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;YAC7C,YAAY,IAAI,IAAI,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;YACzC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;YACtD,UAAU,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;YACxC,MAAM,QAAQ,GAAG,uBAAuB,CAAC,GAAG,GAAG,gBAAgB,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;YAC3E,IAAI,QAAQ,KAAK,IAAI;gBAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC/C,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,eAAe,CAAC,GAAG,GAAG,qBAAqB,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;YACvF,QAAQ,CAAC,IAAI,CAAC,GAAG,qBAAqB,CAAC,GAAG,GAAG,qBAAqB,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;YAChF,QAAQ,CAAC,IAAI,CAAC,GAAG,wBAAwB,CAAC,IAAI,EAAE,GAAG,GAAG,gBAAgB,EAAE,GAAG,CAAC,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,yEAAyE;IACzE,0EAA0E;IAC1E,4EAA4E;IAC5E,8EAA8E;IAC9E,qEAAqE;IACrE,0EAA0E;IAC1E,4BAA4B;IAC5B,MAAM,gBAAgB,GAAG,MAAM,KAAK,CAAC,uBAAuB,CAAC,UAAU,CAAC,CAAC;IACzE,8EAA8E;IAC9E,8EAA8E;IAC9E,+EAA+E;IAC/E,4EAA4E;IAC5E,2EAA2E;IAC3E,6FAA6F;IAC7F,0EAA0E;IAC1E,oEAAoE;IACpE,QAAQ,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,gBAAgB,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IACxE,KAAK,MAAM,GAAG,IAAI,gBAAgB,CAAC,IAAI,EAAE,CAAC;QACxC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,QAAQ,GAAG,uBAAuB,CAAC,cAAc,GAAG,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QACvF,IAAI,QAAQ,KAAK,IAAI;YAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjD,CAAC;IAED,4EAA4E;IAC5E,yEAAyE;IACzE,2EAA2E;IAC3E,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,mBAAmB,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC;IAElG,QAAQ,CAAC,IAAI,CACX,GAAG,CAAC,MAAM,iBAAiB,CAAC;QAC1B,OAAO;QACP,UAAU;QACV,SAAS;QACT,QAAQ;QACR,aAAa,EAAE,SAAS;QACxB,SAAS;QACT,UAAU;QACV,UAAU;QACV,eAAe;QACf,YAAY;QACZ,aAAa;QACb,KAAK;KACN,CAAC,CAAC,CACJ,CAAC;IAGF,oEAAoE;IACpE,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,cAAc,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IACpH,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,IAAI;YACd,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,gDAAgD;YACzD,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE;SACnC,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,YAAY,OAAO,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,CAAC;AAC3F,CAAC","sourcesContent":["/**\n * The feature target: a delta graded on its own, before anything merges.\n *\n * Everything here reads the feature directory — delta.likec4, the per-service\n * spec.md/arch.spec.md deltas, the provenance stamp — and grades the documents\n * a merge is about to fold into living ones. A delta is held to the same\n * document rules as the file it becomes (`./checks/requirements.js`), because\n * grading it more leniently is how a defect acquires a signature saying it was\n * reviewed.\n *\n * The one question that needs the LIVING fleet — what in this delta is actually\n * new architecture — is `./arch-coverage.js`.\n */\nimport { existsSync } from \"node:fs\";\nimport { type Elem, type LoadedDoc, type Rel } from \"../../core/c4/likec4.js\";\nimport { elementService } from \"../../core/c4/resolve/service.js\";\nimport { type PathableService } from \"../../core/kernel/ids/service.js\";\nimport { type FeatureEntry } from \"../../core/repo/entries.js\";\nimport { featurePaths, featureSpecPaths } from \"../../core/repo/paths.js\";\nimport { enumeratedServiceIds } from \"../../core/repo/service-target.js\";\nimport { docsRepoState } from \"../../core/repo/state.js\";\nimport { featureSpecServices, listServices } from \"../../core/repo/repo.js\";\nimport { type Finding, type TargetReport } from \"../../core/vocabulary/report.js\";\nimport { type Requirement } from \"../../core/document/spec.js\";\nimport { featureCoherence } from \"../../core/coherence/coherence.js\";\nimport {\n  deltaServiceUnknownFinding,\n  invalidSpecServiceFindings,\n} from \"../../core/coherence/living.js\";\nimport { issueFinding } from \"../../core/vocabulary/issue.js\";\nimport { featureProvenance } from \"../../core/provenance/findings.js\";\nimport { documentConflictFinding } from \"../../core/conflict-markers.js\";\nimport { docMissingFindings } from \"../../core/capabilities/findings.js\";\nimport { FleetContext } from \"../../core/fleet-context.js\";\nimport { errorText } from \"../../core/c4/likec4.js\";\nimport { coverageFinding, repeatedListLineFindings, scenarioShapeFindings } from \"./checks/requirements.js\";\nimport { deltaArchCoverage } from \"./arch-coverage.js\";\nimport { featureLinkFindings } from \"./links/corpus.js\";\nimport { featureRecordFindings } from \"./service/evidence-pins.js\";\nimport type { DocsDir } from \"../../core/kernel/ids/dirs.js\";\n\nexport async function validateFeature(\n  docsDir: DocsDir,\n  feature: FeatureEntry,\n  preloadedLand: LoadedDoc | null | undefined,\n  fleet: FleetContext,\n): Promise<TargetReport> {\n  const findings: Finding[] = [];\n  const featureDir = feature.dir;\n  const featureId = feature.id;\n\n  // delta.likec4 parse + collect tagged edges. The loaded doc is kept and\n  // handed to featureCoherence below — loading it is a Langium workspace spin,\n  // and paying it twice per feature was the dominant cost of `validate --all`.\n  let taggedEls: Elem[] = [];\n  let taggedRels: Rel[] = [];\n  let elements: Elem[] = [];\n  let deltaRels: Rel[] = [];\n  let deltaDoc: LoadedDoc | undefined;\n  const deltaPath = featurePaths(featureDir).delta;\n  if (existsSync(deltaPath)) {\n    const res = await fleet.loadLikeC4(deltaPath);\n    deltaDoc = res;\n    if (res.errors.length > 0) {\n      findings.push({\n        severity: \"error\",\n        code: \"delta.invalid\",\n        message: `delta.likec4 has ${res.errors.length} error(s)`,\n        details: res.errors.map(errorText),\n      });\n    } else {\n      elements = res.elements;\n      deltaRels = res.relationships;\n      taggedEls = res.elements.filter((e) => e.tags.includes(featureId));\n      taggedRels = res.relationships.filter((r) => r.tags.includes(featureId));\n      findings.push({\n        severity: \"ok\",\n        code: \"delta.valid\",\n        message: `delta.likec4 valid (${res.elements.length} elements · ${res.relationships.length} relationships)`,\n      });\n    }\n  }\n\n  findings.push(...(await featureProvenance(featureDir, featureId)));\n\n  // The verification record, graded for READABILITY only — never for what it\n  // concludes. A conflict-marked or hand-broken `verification.yaml` /\n  // `verification/<svc>.yaml` was refused by `verify`, reported by `status`,\n  // `gate` and `tasks`, and invisible here: `validate --all` from the docs repo\n  // (and so the PR gate) stayed green over a record nobody can read, because\n  // the only target raising this code was the service one, which runs from a\n  // service repo. Same code and severity as that target\n  // (`./service/evidence-pins.ts`) — a warn, so `valid` and `loam archive` are\n  // untouched (verify never gates archive) and `--strict` is the lever. The\n  // verdict itself stays `verify`'s and `status`'s to state.\n  findings.push(...(await featureRecordFindings(docsDir, feature)));\n\n  // Who this feature is allowed to address. `specs/<svc>/` is what the archive\n  // materialises `services/<svc>/` from, and nothing used to ask whether that\n  // name means anything: one wrong character in `--touches` passed\n  // `validate --all` with zero errors, and archive then created the phantom\n  // directory. A delta may legitimately name a service that does not exist yet\n  // — but only one it INTRODUCES itself, in its own tagged C4. A delta that did\n  // not parse proves neither (`delta.invalid` is that finding), so the question\n  // is suspended there rather than answered by guessing.\n  //\n  // Existence is enumeration MEMBERSHIP through the no-services-tolerant\n  // spelling, never `existsSync(services/<svc>/)` at the root: a service filed\n  // into a subsystem exists wherever the tree walk found it, and the root\n  // probe graded every filed service `delta.service-unknown`. The tolerance\n  // carries the old carve-out forward — `validate --feature` is allowed to run\n  // in a docs repo with no services/ at all, where enumerating is a refusal;\n  // `enumeratedServiceIds` swallows exactly that refusal to an empty list, in\n  // which every service is honestly absent.\n  const featureServices = await featureSpecServices(featureDir, fleet);\n  const introduces: ReadonlySet<string> = new Set(taggedEls.map(elementService));\n  const deltaReadable = deltaDoc === undefined || deltaDoc.errors.length === 0;\n  const enumerated = new Set<string>(await enumeratedServiceIds(docsDir, fleet));\n  const unknownServices = deltaReadable\n    ? featureServices.filter((svc) => !enumerated.has(svc) && !introduces.has(svc))\n    : [];\n  // The near-miss hint, on the same rule `service.unknown` uses — a typo is\n  // only diagnosable against the ids that DO exist.\n  const closeTo =\n    unknownServices.length > 0 && docsRepoState(docsDir).kind === \"ok\"\n      ? (await listServices(docsDir, fleet)).map((s) => s.id)\n      : [];\n  // The finding is coherence/living.ts's — the same words archive refuses with,\n  // because it is the same conclusion about the same directory.\n  for (const svc of unknownServices) findings.push(deltaServiceUnknownFinding(svc, closeTo));\n\n  // The grammar half of the same guarantee. `delta.service-unknown` asks whether\n  // the directory names a service anyone knows; this asks whether the NAME could\n  // ever be one. The two are independent on purpose: a tagged element whose\n  // title matches the directory answers the first question, which is exactly how\n  // `specs/Payment Service/` used to validate green and archive into a directory\n  // no loam command can address. Not suspended on an unreadable delta either —\n  // no reading of the architecture axis can make the name legal.\n  findings.push(...(await invalidSpecServiceFindings(featureDir, fleet)));\n\n  // Requirement coverage across every per-service delta — the business spec and\n  // the arch spec through the same check — and collect scenario text.\n  let scenarioText = \"\";\n  const archDeltas: Array<{ service: PathableService; reqs: Requirement[] }> = [];\n  for (const svc of featureServices) {\n    const p = featureSpecPaths(featureDir, svc);\n    if (existsSync(p.spec)) {\n      const raw = await fleet.readText(p.spec);\n      scenarioText += \"\\n\" + raw.toLowerCase();\n      const reqs = await fleet.readRequirements(p.spec);\n      // Both document-level breaches carry into the living spec through the\n      // merge, so a delta is graded for them exactly as a living document is:\n      // conflict markers merge as prose under someone's requirement, and a\n      // stepless scenario merges as a requirement the coverage rule calls\n      // covered forever after.\n      const conflict = documentConflictFinding(`${svc}: spec.md`, svc, raw);\n      if (conflict !== null) findings.push(conflict);\n      findings.push({ ...coverageFinding(`${svc}: requirements`, reqs), subject: svc });\n      findings.push(...scenarioShapeFindings(`${svc}: requirements`, svc, reqs));\n      // The keep-last quirk loses lines in a delta exactly as in a living spec\n      // — and a delta's lost Operations: line then merges into the living one.\n      findings.push(...repeatedListLineFindings(reqs, `${svc}: spec.md`, svc));\n    }\n    if (existsSync(p.archSpec)) {\n      const raw = await fleet.readText(p.archSpec);\n      scenarioText += \"\\n\" + raw.toLowerCase();\n      const reqs = await fleet.readRequirements(p.archSpec);\n      archDeltas.push({ service: svc, reqs });\n      const conflict = documentConflictFinding(`${svc}: arch.spec.md`, svc, raw);\n      if (conflict !== null) findings.push(conflict);\n      findings.push({ ...coverageFinding(`${svc}: arch requirements`, reqs), subject: svc });\n      findings.push(...scenarioShapeFindings(`${svc}: arch requirements`, svc, reqs));\n      findings.push(...repeatedListLineFindings(reqs, `${svc}: arch.spec.md`, svc));\n    }\n  }\n\n  // The BUSINESS corpus's delta documents, graded for the same document-level\n  // breach as the service ones and for the same reason: a conflicted delta\n  // parses as prose, so every other check reads it as a valid document, and\n  // `loam archive` then re-serializes both sides of somebody's merge into the\n  // LIVING capability document. It is worse there than one tree over — once the\n  // feature is archived, nothing walks the delta again, and the living\n  // capability documents are only conflict-scanned while some feature still\n  // carries a delta for them.\n  const capabilityDeltas = await fleet.featureCapabilityDeltas(featureDir);\n  // The half-created directory, on the FEATURE side. The living tree has warned\n  // about `capabilities/<id>/` with no document since the axis landed; the same\n  // `mkdir` inside `features/<FEAT>/capabilities/` earned nothing, and it is the\n  // quieter of the two — an empty directory is not a delta, so the walk finds\n  // no document, the merge carries nothing, and the business change ships as\n  // zero at exit 0. Same code, feature-scoped message (`../../core/capabilities/findings.ts`).\n  // `dirName`, not the id: the directory is `features/FEAT-1-split/`, and a\n  // message spelling `features/FEAT-1/` names a path nobody can open.\n  findings.push(...docMissingFindings(capabilityDeltas, feature.dirName));\n  for (const doc of capabilityDeltas.docs) {\n    const raw = await fleet.readText(doc.spec);\n    const conflict = documentConflictFinding(`capability ${doc.id}: spec.md`, doc.id, raw);\n    if (conflict !== null) findings.push(conflict);\n  }\n\n  // The links this feature's own documents write — the intent, each service's\n  // two spec deltas, its ADRs and its capability deltas. Same place in the\n  // order as the service target's: after every join loam defined a line for.\n  findings.push(...(await featureLinkFindings({ docsDir, subject: featureId, fleet }, featureDir)));\n\n  findings.push(\n    ...(await deltaArchCoverage({\n      docsDir,\n      featureDir,\n      featureId,\n      elements,\n      relationships: deltaRels,\n      taggedEls,\n      taggedRels,\n      archDeltas,\n      featureServices,\n      scenarioText,\n      preloadedLand,\n      fleet,\n    })),\n  );\n\n\n  // Coherence — cross-axis consistency (C4 ↔ requirements ↔ OpenAPI).\n  const issues = await featureCoherence({ docsDir, featureDir, featureId, preloadedDelta: deltaDoc, context: fleet });\n  if (issues.length === 0) {\n    findings.push({\n      severity: \"ok\",\n      code: \"coherence.ok\",\n      message: \"coherence: ✓ C4 · requirements · OpenAPI agree\",\n      text: { indent: 2, marker: false },\n    });\n  } else {\n    for (const i of issues) {\n      findings.push({ ...issueFinding(i), text: { indent: 4, header: \"coherence:\" } });\n    }\n  }\n\n  return { kind: \"feature\", id: featureId, path: `features/${feature.dirName}`, findings };\n}\n"]}

package/dist/commands/validate/fleet/census.js

@@ -0,0 +1,93 @@
+/**
+ * The fleet map's census: which drawn elements answer for a `services/<id>/`.
+ *
+ * Three predicates, in one place because every exemption in the fleet target,
+ * the scorecard's `c4.elements` count and the kind-tag check all have to answer
+ * the same question the same way — a second spelling of "is this element a
+ * service" is how a map and a rollup start disagreeing about the same fleet.
+ * They lived in `./landscape.ts` beside their first reader until that file hit
+ * its line limit; the seam was already there, since nothing here reads a file,
+ * emits a finding, or knows what a target is.
+ */
+import {} from "../../../core/c4/likec4.js";
+import { properAncestorIds } from "../../../core/kernel/ids/fqn/ancestors.js";
+import { ACTOR_KINDS, EXTERNAL_TAG, INFRA_KINDS } from "../../../core/vocabulary/maturity.js";
+/**
+ * Does this element stand for a `services/<id>/` directory — an explicit
+ * `metadata { service }` binding, or a title naming a real one? The question
+ * every exemption in `./landscape.ts`, the scorecard's census and
+ * `./kind-tags.ts` all ask, exported so they cannot answer it differently.
+ */
+export function standsForService(e, services) {
+    return e.service !== undefined || services.has(e.title);
+}
+/**
+ * Service-LEVEL elements: everything not drawn inside something that is
+ * already a service.
+ *
+ * Depth is not a fact about a service. This used to keep only top-level
+ * elements (`!e.id.includes(".")`), which ordinary C4 breaks the moment it
+ * groups services under a parent: every nested element was thrown away, so a
+ * bound service read as unmodelled — an ERROR, on every service in the fleet
+ * — and a binding written one level down was never checked at all. The tree
+ * is walked instead, the way `serviceResolver` walks it for edges: a binding
+ * wins at any depth, then a title naming a real services/<id>/, and what sits
+ * INSIDE one of those is that service's container, not a service of its own.
+ */
+export function serviceLevelElements(elements, services) {
+    const byId = new Map(elements.map((e) => [e.id, e]));
+    /**
+     * The ancestors this document actually DECLARES, nearest first. The chain
+     * itself is `core/kernel/ids/fqn/ancestors.ts`'s — the one spelling of it —
+     * and the filter is this function's own: an id may name a level nothing
+     * declares, and an undeclared level answers for no service.
+     */
+    const ancestorsOf = (e) => properAncestorIds(e.id).flatMap((id) => {
+        const parent = byId.get(id);
+        return parent === undefined ? [] : [parent];
+    });
+    return elements.filter((e) => !ancestorsOf(e).some((p) => standsForService(p, services)));
+}
+/**
+ * The drawn SYSTEMS: service-level elements minus everything the map itself
+ * says is not a service. Actor kinds model people; INFRA kinds model the
+ * datastores, queues and buckets the fleet RUNS; `#external` is somebody
+ * else's system; and an element that CONTAINS a service is a grouping — a
+ * domain, a boundary, an enterprise — not a service nobody adopted. There is
+ * nothing to bind on a grouping and nothing to tag #external, so asking for
+ * either would be a warning with no correct fix; the services under it answer
+ * for themselves. `validateLandscape`'s undocumented pass walks this set, and
+ * the scorecard's `c4.elements` census counts it — one predicate, two readers,
+ * zero drift.
+ *
+ * The INFRA skip is the newest and the one with a measured cost behind it. A
+ * `database` the fleet OWNS and draws at fleet level is neither a person nor
+ * somebody else's system, so it used to earn `landscape.service-undocumented`
+ * — "bind it with `metadata { service '<id>' }`, or tag it `#external`" —
+ * whose two remedies are both FALSE of it: there is no directory to bind, and
+ * it is ours. Measured on a one-service fixture drawing an owned `database` at
+ * fleet level (2026-09-07): that warning plus `landscape.datastore-private`
+ * plus `gate.partner-undocumented` on its one consumer, three findings and no
+ * correct fix, which is why both `examples/docs` and this repo's own suite
+ * tagged an owned Redis `#external` to buy silence.
+ *
+ * `standsForService` wins over the kind, and that guard is load-bearing rather
+ * than defensive: a `database` bound with `metadata { service '<id>' }`, or one
+ * whose title names a real `services/<id>/`, IS an adopted service — dropping
+ * it here would take it out of the scorecard's `c4.elements` denominator and
+ * out of the binding passes at once. The kind is the fallback for an element
+ * nothing else answers for, never an override.
+ *
+ * The `#external` skip here is exactly what `./kind-tags.ts` guards: read off a
+ * tag a KIND declared, it can empty this census for a whole fleet at once. The
+ * INFRA skip is NOT guarded there and does not need to be — a kind is what an
+ * element already is, not a claim declared over the fleet, and `#infrastructure`
+ * is deliberately not a tag loam grades on (`GRADED_TAGS`).
+ */
+export function drawnSystems(elements, services) {
+    return serviceLevelElements(elements, services).filter((e) => !e.tags.includes(EXTERNAL_TAG) &&
+        !ACTOR_KINDS.has(e.kind.toLowerCase()) &&
+        !(INFRA_KINDS.has(e.kind.toLowerCase()) && !standsForService(e, services)) &&
+        !elements.some((c) => c.id.startsWith(`${e.id}.`) && standsForService(c, services)));
+}
+//# sourceMappingURL=census.js.map

package/dist/commands/validate/fleet/census.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"census.js","sourceRoot":"","sources":["../../../../src/commands/validate/fleet/census.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAa,MAAM,4BAA4B,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,2CAA2C,CAAC;AAC9E,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,sCAAsC,CAAC;AAE9F;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,CAAO,EAAE,QAA6B;IACrE,OAAO,CAAC,CAAC,OAAO,KAAK,SAAS,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAgB,EAAE,QAA6B;IAClF,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACrD;;;;;OAKG;IACH,MAAM,WAAW,GAAG,CAAC,CAAO,EAAU,EAAE,CACtC,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE;QACrC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5B,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IACL,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;AAC5F,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,MAAM,UAAU,YAAY,CAAC,QAAgB,EAAE,QAA6B;IAC1E,OAAO,oBAAoB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,MAAM,CACpD,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;QAC9B,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QACtC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;QAC1E,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,gBAAgB,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CACtF,CAAC;AACJ,CAAC","sourcesContent":["/**\n * The fleet map's census: which drawn elements answer for a `services/<id>/`.\n *\n * Three predicates, in one place because every exemption in the fleet target,\n * the scorecard's `c4.elements` count and the kind-tag check all have to answer\n * the same question the same way — a second spelling of \"is this element a\n * service\" is how a map and a rollup start disagreeing about the same fleet.\n * They lived in `./landscape.ts` beside their first reader until that file hit\n * its line limit; the seam was already there, since nothing here reads a file,\n * emits a finding, or knows what a target is.\n */\nimport { type Elem } from \"../../../core/c4/likec4.js\";\nimport { properAncestorIds } from \"../../../core/kernel/ids/fqn/ancestors.js\";\nimport { ACTOR_KINDS, EXTERNAL_TAG, INFRA_KINDS } from \"../../../core/vocabulary/maturity.js\";\n\n/**\n * Does this element stand for a `services/<id>/` directory — an explicit\n * `metadata { service }` binding, or a title naming a real one? The question\n * every exemption in `./landscape.ts`, the scorecard's census and\n * `./kind-tags.ts` all ask, exported so they cannot answer it differently.\n */\nexport function standsForService(e: Elem, services: ReadonlySet<string>): boolean {\n  return e.service !== undefined || services.has(e.title);\n}\n\n/**\n * Service-LEVEL elements: everything not drawn inside something that is\n * already a service.\n *\n * Depth is not a fact about a service. This used to keep only top-level\n * elements (`!e.id.includes(\".\")`), which ordinary C4 breaks the moment it\n * groups services under a parent: every nested element was thrown away, so a\n * bound service read as unmodelled — an ERROR, on every service in the fleet\n * — and a binding written one level down was never checked at all. The tree\n * is walked instead, the way `serviceResolver` walks it for edges: a binding\n * wins at any depth, then a title naming a real services/<id>/, and what sits\n * INSIDE one of those is that service's container, not a service of its own.\n */\nexport function serviceLevelElements(elements: Elem[], services: ReadonlySet<string>): Elem[] {\n  const byId = new Map(elements.map((e) => [e.id, e]));\n  /**\n   * The ancestors this document actually DECLARES, nearest first. The chain\n   * itself is `core/kernel/ids/fqn/ancestors.ts`'s — the one spelling of it —\n   * and the filter is this function's own: an id may name a level nothing\n   * declares, and an undeclared level answers for no service.\n   */\n  const ancestorsOf = (e: Elem): Elem[] =>\n    properAncestorIds(e.id).flatMap((id) => {\n      const parent = byId.get(id);\n      return parent === undefined ? [] : [parent];\n    });\n  return elements.filter((e) => !ancestorsOf(e).some((p) => standsForService(p, services)));\n}\n\n/**\n * The drawn SYSTEMS: service-level elements minus everything the map itself\n * says is not a service. Actor kinds model people; INFRA kinds model the\n * datastores, queues and buckets the fleet RUNS; `#external` is somebody\n * else's system; and an element that CONTAINS a service is a grouping — a\n * domain, a boundary, an enterprise — not a service nobody adopted. There is\n * nothing to bind on a grouping and nothing to tag #external, so asking for\n * either would be a warning with no correct fix; the services under it answer\n * for themselves. `validateLandscape`'s undocumented pass walks this set, and\n * the scorecard's `c4.elements` census counts it — one predicate, two readers,\n * zero drift.\n *\n * The INFRA skip is the newest and the one with a measured cost behind it. A\n * `database` the fleet OWNS and draws at fleet level is neither a person nor\n * somebody else's system, so it used to earn `landscape.service-undocumented`\n * — \"bind it with `metadata { service '<id>' }`, or tag it `#external`\" —\n * whose two remedies are both FALSE of it: there is no directory to bind, and\n * it is ours. Measured on a one-service fixture drawing an owned `database` at\n * fleet level (2026-09-07): that warning plus `landscape.datastore-private`\n * plus `gate.partner-undocumented` on its one consumer, three findings and no\n * correct fix, which is why both `examples/docs` and this repo's own suite\n * tagged an owned Redis `#external` to buy silence.\n *\n * `standsForService` wins over the kind, and that guard is load-bearing rather\n * than defensive: a `database` bound with `metadata { service '<id>' }`, or one\n * whose title names a real `services/<id>/`, IS an adopted service — dropping\n * it here would take it out of the scorecard's `c4.elements` denominator and\n * out of the binding passes at once. The kind is the fallback for an element\n * nothing else answers for, never an override.\n *\n * The `#external` skip here is exactly what `./kind-tags.ts` guards: read off a\n * tag a KIND declared, it can empty this census for a whole fleet at once. The\n * INFRA skip is NOT guarded there and does not need to be — a kind is what an\n * element already is, not a claim declared over the fleet, and `#infrastructure`\n * is deliberately not a tag loam grades on (`GRADED_TAGS`).\n */\nexport function drawnSystems(elements: Elem[], services: ReadonlySet<string>): Elem[] {\n  return serviceLevelElements(elements, services).filter(\n    (e) =>\n      !e.tags.includes(EXTERNAL_TAG) &&\n      !ACTOR_KINDS.has(e.kind.toLowerCase()) &&\n      !(INFRA_KINDS.has(e.kind.toLowerCase()) && !standsForService(e, services)) &&\n      !elements.some((c) => c.id.startsWith(`${e.id}.`) && standsForService(c, services)),\n  );\n}\n"]}

package/dist/commands/validate/fleet/kind-tags.js

@@ -0,0 +1,39 @@
+import { GRADED_TAGS } from "../../../core/vocabulary/maturity.js";
+import {} from "../../../core/vocabulary/report.js";
+import { standsForService } from "./census.js";
+/**
+ * One finding per (kind, graded tag) whose elements include something that
+ * stands for a real service directory. An ERROR, not a warning: the whole point
+ * is that the run must not be able to end green, and a warning leaves exit code
+ * 0 for every caller not passing `--strict`.
+ */
+export function kindTagFindings(input) {
+    const { specification, elements, services } = input;
+    if (specification === undefined)
+        return [];
+    const findings = [];
+    for (const [kind, tags] of Object.entries(specification.elementKindTags)) {
+        const graded = tags.filter((t) => GRADED_TAGS.includes(t));
+        if (graded.length === 0)
+            continue;
+        const ours = elements.filter((e) => e.kind === kind && standsForService(e, services));
+        if (ours.length === 0)
+            continue;
+        const named = ours.slice(0, 3).map((e) => `'${e.title}'`).join(", ");
+        for (const tag of graded) {
+            findings.push({
+                severity: "error",
+                code: "landscape.kind-tag-graded",
+                subject: kind,
+                message: `landscape: the specification declares '#${tag}' on element kind '${kind}', so every '${kind}' ` +
+                    `inherits it — including ${ours.length} that stand(s) for a services/ directory of ours ` +
+                    `(${named}${ours.length > 3 ? ", …" : ""}). loam reads '#${tag}' as "not ours, stop grading", so the ` +
+                    `landscape↔services checks are silenced for exactly the elements they exist for. Remove '#${tag}' from ` +
+                    `the kind and write it on the individual elements that really are foreign — or, if every '${kind}' is ` +
+                    `foreign, stop drawing our services as one.`,
+            });
+        }
+    }
+    return findings;
+}
+//# sourceMappingURL=kind-tags.js.map

package/dist/commands/validate/fleet/kind-tags.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"kind-tags.js","sourceRoot":"","sources":["../../../../src/commands/validate/fleet/kind-tags.ts"],"names":[],"mappings":"AA8DA,OAAO,EAAE,WAAW,EAAE,MAAM,sCAAsC,CAAC;AACnE,OAAO,EAAgB,MAAM,oCAAoC,CAAC;AAClE,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAW/C;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,KAAmB;IACjD,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IACpD,IAAI,aAAa,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAC3C,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,eAAe,CAAC,EAAE,CAAC;QACzE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3D,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAClC,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,gBAAgB,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;QACtF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAChC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrE,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;YACzB,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,2BAA2B;gBACjC,OAAO,EAAE,IAAI;gBACb,OAAO,EACL,2CAA2C,GAAG,sBAAsB,IAAI,gBAAgB,IAAI,IAAI;oBAChG,2BAA2B,IAAI,CAAC,MAAM,mDAAmD;oBACzF,IAAI,KAAK,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,mBAAmB,GAAG,wCAAwC;oBACtG,4FAA4F,GAAG,SAAS;oBACxG,4FAA4F,IAAI,OAAO;oBACvG,4CAA4C;aAC/C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC","sourcesContent":["/**\n * The fleet gate's guard against a tag loam grades on exempting a service.\n *\n * LikeC4 1.59.0 added tags in the specification block, and 1.59.2 applies them\n * before loam sees anything: `specification { element softwareSystem {\n * #external } }` makes EVERY softwareSystem in the document carry `#external`,\n * on `Elem.tags`, indistinguishable from a tag somebody wrote on the element.\n *\n * loam reads `#external` as \"deliberately not ours — stop grading it\". So those\n * six words switched the landscape↔services reconciliation off for the whole\n * fleet, and the gate then printed `landscape.matched` — \"N service(s) modelled\n * … and services/ agree\" — over a map it had stopped checking. That is the worst\n * failure this product has: not a wrong answer, but a green one.\n *\n * ## Why this is not simply \"refuse a graded tag on a kind\"\n *\n * Because a graded tag on a kind is a pattern loam DOCUMENTS and the shipped\n * example depends on. `examples/docs/architecture/landscape.likec4` declares\n *\n *     element topic { #external #platform style { shape queue } }\n *\n * so that the Kafka topics nested inside an external broker do not each demand a\n * `services/payment.events/` nobody owes. Every `topic` is foreign by\n * construction; saying so once on the kind is the spelling that scales, and\n * test/landscape.test.ts has pinned it since long before kind tags existed.\n * Refusing that would be loam breaking its own published fleet map.\n *\n * The line is therefore not WHERE the tag is written but WHAT it exempts:\n *\n *  - a kind whose elements stand for nothing in `services/` — `topic`,\n *    `externalSystem`, `saasVendor` — is the legitimate idiom, and silent here;\n *  - a kind whose elements stand for a REAL `services/<id>/` directory, by an\n *    explicit `metadata { service }` binding or by a title naming one, is the\n *    fail-open. That element is provably ours and provably exempted, and loam\n *    has just been told to stop grading the thing it exists to grade.\n *\n * The second case is also exactly where the suppression reaches ERROR severity:\n * `landscape.binding-unknown` — a binding naming a directory that does not exist\n * — is skipped for `#external` elements, and only a bound element can raise it.\n *\n * Two further limits, both deliberate:\n *\n *  - Only the tags in `GRADED_TAGS`. A kind declaring `#tier1` or `#legacy` is\n *    ordinary LikeC4 that loam does not read, and refusing it would be loam\n *    inventing a rule about somebody else's vocabulary.\n *  - Relationship kinds are not graded. loam reads no relationship tag on the\n *    landscape — `#external` and `#platform` are asked of elements only — so a\n *    relationship kind declaring one changes no conclusion. The relationship\n *    half of the same defect bites on the FEATURE tag at archive time, and is\n *    refused there (`commands/archive/plan/landscape.ts`), where it costs\n *    something.\n *\n * A residual is accepted knowingly: a kind-wide graded tag over elements that\n * stand for no directory still silences `landscape.service-undocumented` for\n * them. That is the `topic` idiom's whole purpose, and it cannot be told from\n * abuse without loam guessing which foreign systems somebody meant to adopt.\n * `landscape.service-unmodelled` — the ERROR that a `services/<id>/` is undrawn\n * — reads no tags at all, so the fleet's own directories are never exempted by\n * any of this.\n */\nimport type { Elem } from \"../../../core/c4/likec4.js\";\nimport type { DocSpecification } from \"../../../core/c4/parsed/specification.js\";\nimport { GRADED_TAGS } from \"../../../core/vocabulary/maturity.js\";\nimport { type Finding } from \"../../../core/vocabulary/report.js\";\nimport { standsForService } from \"./census.js\";\n\nexport interface KindTagInput {\n  /** The landscape's own specification block; absent for a document that did not parse. */\n  specification: DocSpecification | undefined;\n  /** Every element the landscape declares, at any depth. */\n  elements: Elem[];\n  /** The `services/<id>/` directories that exist — what \"ours\" is measured against. */\n  services: ReadonlySet<string>;\n}\n\n/**\n * One finding per (kind, graded tag) whose elements include something that\n * stands for a real service directory. An ERROR, not a warning: the whole point\n * is that the run must not be able to end green, and a warning leaves exit code\n * 0 for every caller not passing `--strict`.\n */\nexport function kindTagFindings(input: KindTagInput): Finding[] {\n  const { specification, elements, services } = input;\n  if (specification === undefined) return [];\n  const findings: Finding[] = [];\n  for (const [kind, tags] of Object.entries(specification.elementKindTags)) {\n    const graded = tags.filter((t) => GRADED_TAGS.includes(t));\n    if (graded.length === 0) continue;\n    const ours = elements.filter((e) => e.kind === kind && standsForService(e, services));\n    if (ours.length === 0) continue;\n    const named = ours.slice(0, 3).map((e) => `'${e.title}'`).join(\", \");\n    for (const tag of graded) {\n      findings.push({\n        severity: \"error\",\n        code: \"landscape.kind-tag-graded\",\n        subject: kind,\n        message:\n          `landscape: the specification declares '#${tag}' on element kind '${kind}', so every '${kind}' ` +\n          `inherits it — including ${ours.length} that stand(s) for a services/ directory of ours ` +\n          `(${named}${ours.length > 3 ? \", …\" : \"\"}). loam reads '#${tag}' as \"not ours, stop grading\", so the ` +\n          `landscape↔services checks are silenced for exactly the elements they exist for. Remove '#${tag}' from ` +\n          `the kind and write it on the individual elements that really are foreign — or, if every '${kind}' is ` +\n          `foreign, stop drawing our services as one.`,\n      });\n    }\n  }\n  return findings;\n}\n"]}