@ybotok/loam 0.1.0-beta.3 → 0.2.0-alpha.2

package/dist/core/repo/tree/views.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"views.js","sourceRoot":"","sources":["../../../../src/core/repo/tree/views.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,OAAO,EAAa,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAG1C;;;;GAIG;AACH,MAAM,MAAM,GACV,sFAAsF;IACtF,qFAAqF;IACrF,gFAAgF,CAAC;AAEnF;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAe,EAAE,QAAgB;IACpE,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACnD,MAAM,KAAK,GAAa,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC5C,MAAM,UAAU,GAAG,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3F,KAAK,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC;QAC5C,IAAI,CAAC,GAAG,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC1B,KAAK,CAAC,IAAI,CAAC,iBAAiB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5C,KAAK,CAAC,IAAI,CAAC,UAAU,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC/C,KAAK,MAAM,MAAM,IAAI,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;YAC1C,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACzC,IAAI,OAAO,KAAK,SAAS;gBAAE,KAAK,CAAC,IAAI,CAAC,eAAe,OAAO,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpB,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChB,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AACjC,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,gBAAgB,CAAC,IAAe,EAAE,QAAgB;IACzD,MAAM,KAAK,GAAwB,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3E,MAAM,OAAO,GAAG,eAAe,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACjD,MAAM,KAAK,GAAG,CAAC,EAAU,EAAU,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3D,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC;IACtC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC9B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,SAAS;QAClC,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC9B,IAAI,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,+FAA+F;AAC/F,SAAS,SAAS,CAAC,IAAe,EAAE,GAAmB;IACrD,OAAO,CAAC,GAAG,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,0FAA0F;AAC1F,SAAS,OAAO,CAAC,GAAmB;IAClC,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC5B,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,YAAY,CAAC;AAElD,MAAM,UAAU,eAAe,CAAC,GAAmB;IACjD,MAAM,OAAO,GAAG,CAAC,IAAY,EAAU,EAAE,CACvC,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,CAAC,CAAC,CAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACzH,OAAO,aAAa,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AACzD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,UAAU,UAAU,CAAC,MAAqB,EAAE,QAAuB;IACvE,MAAM,EAAE,GAAG,CAAC,IAAmB,EAAiB,EAAE,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC;IAC3G,OAAO,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,QAAQ,CAAC,CAAC;AACrC,CAAC","sourcesContent":["/**\n * The generated views file: `architecture/subsystems.likec4`, one LikeC4 view\n * per subsystem enumerating the services beneath it. GENERATED, never\n * authored — authored bytes stay authored (archive's verbatim-splice promise),\n * so the tree is mirrored into a file of its own that `loam subsystem sync`\n * owns outright, and staleness against the tree is a byte compare\n * (`subsystem.views-stale` in `validate --all`), never a parse: a spike\n * confirmed a views-only document does NOT parse standalone (its `include`\n * lines reference elements the landscape defines), so nothing in loam ever\n * loads this file (and rule 26 does not change that: this file is GENERATED and\n * holds STATIC views, whose contents loam may not read in any document) — only\n * the LikeC4 renderer, which merges the whole `architecture/` project per\n * likec4.config.json, resolves it.\n *\n * The output is deterministic and line-oriented, and both halves are the\n * contract: subsystems sorted by path, members sorted by id, ONE `include`\n * per line — so two concurrent moves into different groups touch different\n * lines and git merges the file without intervention, exactly as the\n * service-grouped landscape splice already achieves. Byte-reproducible on any\n * machine: no timestamps, no absolute paths, no readdir-order dependence (the\n * walk sorts, and every list is re-sorted here). Plain lexicographic sorts on\n * purpose — the ids' own grammar is ASCII, an INVALID name is still ordered\n * deterministically, and `compareIds`' numeric tokenizing lives in `repo/`,\n * which this package must not import (`walk.ts` says why the edge only points\n * the other way).\n *\n * Membership is TRANSITIVE: a subsystem's view includes every service beneath\n * it at any depth, so a parent's view is the whole group's map rather than an\n * empty frame around its children. An empty view body is legal LikeC4 (same\n * spike), so an empty subsystem renders as one — `subsystem new` must be\n * usable before anything moves in.\n *\n * Include lines name the landscape ELEMENT id, resolved through the same\n * element→service join `validate` uses (`serviceResolver`: explicit\n * `metadata { service }` binding first, then a title naming a real service) —\n * because element ids in real landscapes are not service ids, and a view of\n * raw service ids would silently render empty for every such fleet. A member\n * with no landscape element is omitted from the includes: the omission is\n * already an error (`landscape.service-unmodelled`), and rendering only what\n * the committed landscape resolves keeps the output a function of committed\n * bytes alone.\n */\nimport { type Elem } from \"../../c4/likec4.js\";\nimport { serviceResolver } from \"../../c4/resolve/service.js\";\nimport { servicesUnder } from \"./find.js\";\nimport type { FleetTree, SubsystemEntry, WalkedService } from \"./walk.js\";\n\n/**\n * The header every generated file opens with — stable bytes, part of the\n * byte-compare contract, naming the regenerator so a reader who found the\n * file first knows what owns it.\n */\nconst HEADER =\n  \"// generated by loam — the subsystem tree under services/, one view per subsystem.\\n\" +\n  \"// Do not edit: `loam subsystem sync` regenerates this file from the directories,\\n\" +\n  \"// and `loam validate --all` reports `subsystem.views-stale` when it drifts.\\n\";\n\n/**\n * Render the views file for a walked tree, or null when the tree has no\n * subsystems — the file must then be ABSENT, so a flat fleet never carries a\n * generated artifact that says nothing.\n */\nexport function renderSubsystemViews(tree: FleetTree, elements: Elem[]): string | null {\n  if (tree.subsystems.length === 0) return null;\n  const elementOf = elementByService(tree, elements);\n  const lines: string[] = [HEADER, \"views {\"];\n  const subsystems = [...tree.subsystems].sort((a, b) => (pathKey(a) < pathKey(b) ? -1 : 1));\n  for (const [i, sub] of subsystems.entries()) {\n    if (i > 0) lines.push(\"\");\n    lines.push(`  // services/${pathKey(sub)}`);\n    lines.push(`  view ${subsystemViewId(sub)} {`);\n    for (const member of membersOf(tree, sub)) {\n      const element = elementOf.get(member.id);\n      if (element !== undefined) lines.push(`    include ${element}`);\n    }\n    lines.push(\"  }\");\n  }\n  lines.push(\"}\");\n  return lines.join(\"\\n\") + \"\\n\";\n}\n\n/**\n * The landscape element standing for each service id: for every element,\n * resolve it through the shared join, and let the SHALLOWEST element win\n * (document order breaking ties). Shallowest, because `serviceResolver`\n * resolves a service's own containers to the service too, and a view should\n * include the service-level box, not whichever nested container happened to\n * be declared first.\n */\nfunction elementByService(tree: FleetTree, elements: Elem[]): Map<string, string> {\n  const known: ReadonlySet<string> = new Set(tree.services.map((s) => s.id));\n  const resolve = serviceResolver(elements, known);\n  const depth = (id: string): number => id.split(\".\").length;\n  const out = new Map<string, string>();\n  for (const e of elements) {\n    const service = resolve(e.id);\n    if (!known.has(service)) continue;\n    const held = out.get(service);\n    if (held === undefined || depth(e.id) < depth(held)) out.set(service, e.id);\n  }\n  return out;\n}\n\n/** Services beneath this subsystem at any depth, ordered by id — the transitive membership. */\nfunction membersOf(tree: FleetTree, sub: SubsystemEntry): WalkedService[] {\n  return [...servicesUnder(tree, sub)].sort((a, b) => (a.id < b.id ? -1 : 1));\n}\n\n/** The sort key and the comment spelling: the subsystem's path from services/, joined. */\nfunction pathKey(sub: SubsystemEntry): string {\n  return sub.path.join(\"/\");\n}\n\n/**\n * A LikeC4 identifier for the view, derived from the subsystem's path so\n * nesting reads in the name — and INJECTIVE over every path the name grammar\n * admits, because the renderer refuses the whole `architecture/` project over\n * a duplicate view id. The naive folding (every non-identifier byte and the\n * join separator alike becoming `_`) collided three DISTINCT healthy names\n * onto one identifier — `a_b`, and `b` under `a`, both rendered\n * `subsystem_a_b` — so `validate --all` was green while the renderer refused\n * the fleet map; `subsystem.name-collision` never fires because the flat\n * namespace really is intact. Hence the encoding: an identifier byte\n * (`[A-Za-z0-9]`) passes through, any other byte becomes `_` + two lowercase\n * hex digits (`.` → `_2e`, `-` → `_2d`, `_` itself → `_5f` — the underscore\n * must be escaped precisely because it is BOTH legal in a name and the\n * separator), and segments join on `__`. Underscore runs then decode\n * uniquely — one is an escape, two a separator, three a separator followed\n * by an escape — so no two distinct legal paths share an identifier. A name\n * `subsystem.name-invalid` already flagged may hold a code point above 0xff\n * whose longer hex could in principle re-collide; it is deterministic still,\n * and that directory is already an error finding by name.\n *\n * EXPORTED, with its prefix, because `subsystem.view-id-collision` has to ask\n * the generator what it mints rather than re-deriving it. A check carrying its\n * own copy of the escaping above would go quiet the day the encoding changed,\n * and going quiet is the failure this whole family exists to prevent.\n */\nexport const SUBSYSTEM_VIEW_PREFIX = \"subsystem_\";\n\nexport function subsystemViewId(sub: SubsystemEntry): string {\n  const segment = (name: string): string =>\n    [...name].map((ch) => (/[A-Za-z0-9]/.test(ch) ? ch : `_${ch.codePointAt(0)!.toString(16).padStart(2, \"0\")}`)).join(\"\");\n  return `subsystem_${sub.path.map(segment).join(\"__\")}`;\n}\n\n/**\n * Does the file on disk already SAY what `renderSubsystemViews` renders?\n *\n * The generator above only ever emits LF. `core.autocrlf=true` is Git for\n * Windows' installer default and a docs repo ships no `.gitattributes`, so an\n * ordinary Windows clone hands the file back with CRLF and not one fact\n * changed. Four call sites asked this question with a byte equality and all\n * four answered \"stale\" on such a clone: `loam validate` reported an error,\n * `loam subsystem sync` reported `updated` and rewrote with LF, git then showed\n * the file permanently modified, and the next checkout restored the CRLF. That\n * is a loop rather than a diagnosis, which is why the comparison lives here\n * now — the module that mints the bytes is the one that owes an answer about\n * them, and three near-copies of this rule would go stale one at a time.\n *\n * Still never a parse: a views-only document does not parse standalone, and no\n * check anywhere reads this file's content. The narrowing is from BYTES to\n * CONTENT, which is what `subsystem.views-stale`'s own message (\"does not match\n * the tree\") already claims. The symmetric cost is accepted and is the one\n * `core/verify/pins/pin.ts` documents for `pinnedDigest`: a pure line-ending\n * change is invisible, correctly, because it is not a change to what the file\n * says.\n *\n * `null` is carried through as itself rather than collapsing into `\"\"`: absent,\n * must-be-absent and present-but-different are three distinct states with three\n * distinct messages, and a fleet whose views file does not exist is not a fleet\n * whose views file is blank.\n */\nexport function viewsAgree(actual: string | null, expected: string | null): boolean {\n  const lf = (text: string | null): string | null => (text === null ? null : text.replace(/\\r\\n|\\r/g, \"\\n\"));\n  return lf(actual) === lf(expected);\n}\n"]}

package/dist/core/repo/tree/walk.js

@@ -0,0 +1,234 @@
+/**
+ * The tree read model: three-way classification of everything under
+ * `services/`, in one walk.
+ *
+ * A directory holding `subsystem.yaml` is a SUBSYSTEM and is walked; one
+ * holding any service artifact is a SERVICE and is not walked deeper — unless
+ * a marker sits BESIDE the artifacts, where the walk descends anyway (the
+ * marker says a group was here, and its members must not vanish); one holding
+ * neither while containing subdirectories is an ERROR that still names every
+ * service found beneath it. The third branch is the whole point:
+ * two-way classification loses a service silently on an ordinary clean merge —
+ * one branch deletes an emptied subsystem's marker while another moves a
+ * service into it, and the group directory is then read as a service whose
+ * real services vanish from the fleet with no finding. No directory under
+ * `services/` may ever be reinterpreted as a different kind without saying so,
+ * and the fleet is never reported smaller: the walk descends into the broken
+ * group precisely so the stranded services stay enumerated and named.
+ *
+ * The package direction is `repo → repo/tree`, never back. That is why the
+ * artifact-name question arrives INJECTED (`TreeWalkRequest.isServiceArtifact`
+ * — `repo/paths.ts` owns the spellings and `repo/repo.ts` builds the request):
+ * importing `paths.ts` from here while `repo.ts` delegates its enumeration to
+ * this walk would close the exact package cycle `scripts/package-graph.mjs`
+ * exists to refuse.
+ *
+ * Cost: exactly one readdir per directory walked, service directories included
+ * (their own listing is what classifies them), plus one realpath per directory
+ * for the symlink-cycle guard — `entryIs` follows symlinks on purpose, and a
+ * followed cycle without the visited-set is an unbounded recursion.
+ */
+import { realpathSync } from "node:fs";
+import { readdir } from "node:fs/promises";
+import { join } from "node:path";
+import { serviceDirOf, serviceTreePath } from "../../kernel/ids/dirs.js";
+import { rawServiceId } from "../../kernel/ids/service.js";
+import { subsystemNameProblem } from "../../kernel/ids/subsystem.js";
+import { entryIs } from "./fs.js";
+import { readSubsystemMarker, SUBSYSTEM_MARKER } from "./marker.js";
+export async function walkServicesTree(request) {
+    const ctx = {
+        request,
+        tree: { services: [], subsystems: [], findings: [] },
+        visited: new Set(),
+        names: new Map(),
+    };
+    const root = join(request.docsDir, "services");
+    guardDescent(root, ctx);
+    for (const name of await subdirNames(root)) {
+        await visitDir({ dir: join(root, name), name, chain: [] }, ctx);
+    }
+    namespaceFindings(ctx);
+    return ctx.tree;
+}
+/**
+ * Mark a directory as descended-into; false when it (or another name for it)
+ * already was. Guards SUBTREES, not entries: a directory reachable under two
+ * names is classified twice — both names exist and hiding the second would be
+ * the silent shrink this module refuses — but its children are enumerated
+ * once, so a symlink cycle terminates instead of recursing forever. A path
+ * realpath cannot resolve is one whose children cannot be read either.
+ */
+function guardDescent(dir, ctx) {
+    let real;
+    try {
+        real = realpathSync(dir);
+    }
+    catch {
+        return false;
+    }
+    if (ctx.visited.has(real))
+        return false;
+    ctx.visited.add(real);
+    return true;
+}
+/** Sorted non-dot subdirectory names — the walk's deterministic child order. */
+async function subdirNames(dir) {
+    const entries = await readdir(dir, { withFileTypes: true });
+    return entries.filter((e) => !e.name.startsWith(".") && entryIs(dir, e, "dir")).map((e) => e.name).sort();
+}
+/** Classify one directory and, for the group kinds, walk what is inside it. */
+async function visitDir(spot, ctx) {
+    const rel = ["services", ...spot.chain, spot.name].join("/");
+    const entries = (await readdir(spot.dir, { withFileTypes: true })).filter((e) => !e.name.startsWith("."));
+    const files = entries.filter((e) => entryIs(spot.dir, e, "file")).map((e) => e.name);
+    const dirs = entries.filter((e) => entryIs(spot.dir, e, "dir")).map((e) => e.name).sort();
+    const marker = files.includes(SUBSYSTEM_MARKER);
+    const artifact = files.some((f) => ctx.request.isServiceArtifact(f, "file")) ||
+        dirs.some((d) => ctx.request.isServiceArtifact(d, "dir"));
+    if (marker && artifact) {
+        // Artifacts win the classification: the documents are somebody's work and
+        // the marker is one stray file, so the directory stays an addressable
+        // service and the finding names the contradiction instead of the walk
+        // quietly picking a reading. But the walk STILL descends (the module
+        // invariant: no reinterpretation may shrink the fleet) — the marker says
+        // a GROUP was here, and returning without walking made every service
+        // beneath it vanish with only this finding to hint why. Child directories
+        // that are themselves artifacts (`adrs/`) are service interior, not walked.
+        recordService(spot, ctx);
+        const stranded = await descendInto(spot, dirs.filter((d) => !ctx.request.isServiceArtifact(d, "dir")), ctx);
+        ctx.tree.findings.push({
+            severity: "error",
+            code: "subsystem.marker-misplaced",
+            subject: spot.name,
+            message: `${rel}/ holds ${SUBSYSTEM_MARKER} BESIDE service artifacts — a directory is a subsystem or a service, never both. ` +
+                `It stays classified as a service; delete ${rel}/${SUBSYSTEM_MARKER}, ` +
+                `or move the artifacts into a service directory of their own inside the group.` +
+                (stranded.length > 0 ? ` ${stranded.length} service(s) beneath it stay enumerated meanwhile: ${stranded.map((s) => s.id).join(", ")}.` : ""),
+            ...(stranded.length > 0 ? { details: stranded.map(serviceTreePath) } : {}),
+        });
+        return;
+    }
+    if (marker) {
+        await visitSubsystem(spot, { rel, dirs }, ctx);
+        return;
+    }
+    if (artifact) {
+        recordService(spot, ctx);
+        return;
+    }
+    if (dirs.length > 0) {
+        await visitUnmarked(spot, { rel, dirs }, ctx);
+        return;
+    }
+    // Neither marker nor artifact, and nothing beneath: today's flat behaviour —
+    // an empty (or not-yet-adopted) directory under services/ is a service.
+    recordService(spot, ctx);
+}
+function recordService(spot, ctx) {
+    ctx.tree.services.push({
+        id: rawServiceId(spot.name),
+        dir: serviceDirOf(spot.dir),
+        subsystem: spot.chain,
+    });
+    claimName(spot, ctx);
+}
+/** A subsystem: record it, report a broken marker or an illegal name, walk in. */
+async function visitSubsystem(spot, at, ctx) {
+    const meta = await readSubsystemMarker(join(spot.dir, SUBSYSTEM_MARKER));
+    if (meta.invalid !== undefined) {
+        // Exactly one finding per marker file: presence already classified the
+        // directory, so the content failure is metadata, not identity.
+        ctx.tree.findings.push({
+            severity: "error",
+            code: "subsystem.invalid",
+            subject: at.rel,
+            message: `${at.rel}/${SUBSYSTEM_MARKER} cannot be read as subsystem metadata — ${meta.invalid}. ` +
+                `The directory still counts as a subsystem (presence classifies; content is metadata). ` +
+                `Fix the file: a YAML mapping with optional title, description and owner — an empty file is also a valid marker.`,
+        });
+    }
+    const problem = subsystemNameProblem(spot.name, "subsystem directory name");
+    if (problem !== null) {
+        // Walked anyway, mirroring how an illegal service id stays enumerated
+        // (`idProblem`): the directory exists and hiding its subtree would shrink
+        // the fleet over a naming mistake.
+        ctx.tree.findings.push({
+            severity: "error",
+            code: "subsystem.name-invalid",
+            subject: spot.name,
+            message: `${at.rel}/ — ${problem} Rename the directory; its services stay enumerated meanwhile.`,
+        });
+    }
+    ctx.tree.subsystems.push({
+        name: spot.name,
+        path: [...spot.chain, spot.name],
+        dir: spot.dir,
+        meta,
+    });
+    claimName(spot, ctx);
+    await descendInto(spot, at.dirs, ctx);
+}
+/**
+ * Walk the children of a group directory (symlink-cycle guarded), returning
+ * the services newly recorded beneath it — the ONE spelling of descent, so
+ * the three descending branches agree about the guard and the chain.
+ */
+async function descendInto(spot, dirs, ctx) {
+    const before = ctx.tree.services.length;
+    if (guardDescent(spot.dir, ctx)) {
+        for (const child of dirs) {
+            await visitDir({ dir: join(spot.dir, child), name: child, chain: [...spot.chain, spot.name] }, ctx);
+        }
+    }
+    return ctx.tree.services.slice(before);
+}
+/**
+ * The refusal branch — a group directory nothing marks. The walk STILL
+ * descends, so the services beneath stay in the enumeration and the finding
+ * can name them: the fleet must never be reported smaller than it is.
+ */
+async function visitUnmarked(spot, at, ctx) {
+    const stranded = await descendInto(spot, at.dirs, ctx);
+    ctx.tree.findings.push({
+        severity: "error",
+        code: "subsystem.unmarked",
+        subject: at.rel,
+        message: `${at.rel}/ is neither a subsystem (no ${SUBSYSTEM_MARKER}) nor a service (no service artifact), ` +
+            `but ${stranded.length} service(s) sit beneath it` +
+            (stranded.length > 0 ? `: ${stranded.map((s) => s.id).join(", ")}. ` : `. `) +
+            `Without the marker this directory would be read as a service and everything under it would vanish from the fleet — ` +
+            `the shape an ordinary merge produces when one branch deletes an emptied subsystem's marker while another moves a service in. ` +
+            `Restore ${at.rel}/${SUBSYSTEM_MARKER} (an empty file is a valid marker), or move the directories out.`,
+        ...(stranded.length > 0 ? { details: stranded.map(serviceTreePath) } : {}),
+    });
+}
+function claimName(spot, ctx) {
+    const rel = ["services", ...spot.chain, spot.name].join("/");
+    ctx.names.set(spot.name, [...(ctx.names.get(spot.name) ?? []), rel]);
+}
+/**
+ * One flat namespace: every subsystem name and service id, unique across the
+ * whole tree at any depth, never colliding with each other. The identity
+ * decision demands it — a service id is its leaf directory name ALONE, so two
+ * leaves spelling one name are one identity claimed twice, wherever they sit.
+ * One finding per name, naming every claimant, so the fix is a choice rather
+ * than a scavenger hunt.
+ */
+function namespaceFindings(ctx) {
+    for (const [name, dirs] of [...ctx.names].sort(([a], [b]) => (a < b ? -1 : 1))) {
+        if (dirs.length < 2)
+            continue;
+        ctx.tree.findings.push({
+            severity: "error",
+            code: "subsystem.name-collision",
+            subject: name,
+            message: `'${name}' is claimed by ${dirs.length} directories in the services/ tree: ${dirs.join(", ")} — ` +
+                `service ids and subsystem names share one flat namespace, unique at any depth, ` +
+                `because a service's identity is its leaf directory name alone and placement never disambiguates it. ` +
+                `Rename all but one.`,
+            details: dirs,
+        });
+    }
+}
+//# sourceMappingURL=walk.js.map

package/dist/core/repo/tree/walk.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"walk.js","sourceRoot":"","sources":["../../../../src/core/repo/tree/walk.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC3C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,eAAe,EAAiC,MAAM,0BAA0B,CAAC;AACxG,OAAO,EAAE,YAAY,EAAqB,MAAM,6BAA6B,CAAC;AAC9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAErE,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAsB,MAAM,aAAa,CAAC;AAsDxF,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAAwB;IAC7D,MAAM,GAAG,GAAgB;QACvB,OAAO;QACP,IAAI,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE;QACpD,OAAO,EAAE,IAAI,GAAG,EAAE;QAClB,KAAK,EAAE,IAAI,GAAG,EAAE;KACjB,CAAC;IACF,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAC/C,YAAY,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACxB,KAAK,MAAM,IAAI,IAAI,MAAM,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3C,MAAM,QAAQ,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;IAClE,CAAC;IACD,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACvB,OAAO,GAAG,CAAC,IAAI,CAAC;AAClB,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,YAAY,CAAC,GAAW,EAAE,GAAgB;IACjD,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACtB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,gFAAgF;AAChF,KAAK,UAAU,WAAW,CAAC,GAAW;IACpC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;AAC5G,CAAC;AAED,+EAA+E;AAC/E,KAAK,UAAU,QAAQ,CAAC,IAAU,EAAE,GAAgB;IAClD,MAAM,GAAG,GAAG,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1G,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACrF,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1F,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;IAChD,MAAM,QAAQ,GACZ,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QAC3D,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;IAE5D,IAAI,MAAM,IAAI,QAAQ,EAAE,CAAC;QACvB,0EAA0E;QAC1E,sEAAsE;QACtE,sEAAsE;QACtE,qEAAqE;QACrE,yEAAyE;QACzE,qEAAqE;QACrE,0EAA0E;QAC1E,4EAA4E;QAC5E,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACzB,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAC5G,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;YACrB,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,4BAA4B;YAClC,OAAO,EAAE,IAAI,CAAC,IAAI;YAClB,OAAO,EACL,GAAG,GAAG,WAAW,gBAAgB,mFAAmF;gBACpH,4CAA4C,GAAG,IAAI,gBAAgB,IAAI;gBACvE,+EAA+E;gBAC/E,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,MAAM,qDAAqD,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9I,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3E,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,cAAc,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;QAC/C,OAAO;IACT,CAAC;IACD,IAAI,QAAQ,EAAE,CAAC;QACb,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACzB,OAAO;IACT,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpB,MAAM,aAAa,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;QAC9C,OAAO;IACT,CAAC;IACD,6EAA6E;IAC7E,wEAAwE;IACxE,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,aAAa,CAAC,IAAU,EAAE,GAAgB;IACjD,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QACrB,EAAE,EAAE,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;QAC3B,GAAG,EAAE,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC;QAC3B,SAAS,EAAE,IAAI,CAAC,KAAK;KACtB,CAAC,CAAC;IACH,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AACvB,CAAC;AAED,kFAAkF;AAClF,KAAK,UAAU,cAAc,CAAC,IAAU,EAAE,EAAmC,EAAE,GAAgB;IAC7F,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC,CAAC;IACzE,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC/B,uEAAuE;QACvE,+DAA+D;QAC/D,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;YACrB,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,mBAAmB;YACzB,OAAO,EAAE,EAAE,CAAC,GAAG;YACf,OAAO,EACL,GAAG,EAAE,CAAC,GAAG,IAAI,gBAAgB,2CAA2C,IAAI,CAAC,OAAO,IAAI;gBACxF,wFAAwF;gBACxF,iHAAiH;SACpH,CAAC,CAAC;IACL,CAAC;IACD,MAAM,OAAO,GAAG,oBAAoB,CAAC,IAAI,CAAC,IAAI,EAAE,0BAA0B,CAAC,CAAC;IAC5E,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,sEAAsE;QACtE,0EAA0E;QAC1E,mCAAmC;QACnC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;YACrB,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,wBAAwB;YAC9B,OAAO,EAAE,IAAI,CAAC,IAAI;YAClB,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,OAAO,OAAO,gEAAgE;SACjG,CAAC,CAAC;IACL,CAAC;IACD,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QACvB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC;QAChC,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,IAAI;KACL,CAAC,CAAC;IACH,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACrB,MAAM,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AACxC,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,WAAW,CAAC,IAAU,EAAE,IAAc,EAAE,GAAgB;IACrE,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;IACxC,IAAI,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;QAChC,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;YACzB,MAAM,QAAQ,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QACtG,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AACzC,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,aAAa,CAAC,IAAU,EAAE,EAAmC,EAAE,GAAgB;IAC5F,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACvD,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QACrB,QAAQ,EAAE,OAAO;QACjB,IAAI,EAAE,oBAAoB;QAC1B,OAAO,EAAE,EAAE,CAAC,GAAG;QACf,OAAO,EACL,GAAG,EAAE,CAAC,GAAG,gCAAgC,gBAAgB,yCAAyC;YAClG,OAAO,QAAQ,CAAC,MAAM,4BAA4B;YAClD,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;YAC5E,qHAAqH;YACrH,+HAA+H;YAC/H,WAAW,EAAE,CAAC,GAAG,IAAI,gBAAgB,kEAAkE;QACzG,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3E,CAAC,CAAC;AACL,CAAC;AAED,SAAS,SAAS,CAAC,IAAU,EAAE,GAAgB;IAC7C,MAAM,GAAG,GAAG,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7D,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;AACvE,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,iBAAiB,CAAC,GAAgB;IACzC,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,SAAS;QAC9B,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;YACrB,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,0BAA0B;YAChC,OAAO,EAAE,IAAI;YACb,OAAO,EACL,IAAI,IAAI,mBAAmB,IAAI,CAAC,MAAM,uCAAuC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;gBACjG,iFAAiF;gBACjF,sGAAsG;gBACtG,qBAAqB;YACvB,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;IACL,CAAC;AACH,CAAC","sourcesContent":["/**\n * The tree read model: three-way classification of everything under\n * `services/`, in one walk.\n *\n * A directory holding `subsystem.yaml` is a SUBSYSTEM and is walked; one\n * holding any service artifact is a SERVICE and is not walked deeper — unless\n * a marker sits BESIDE the artifacts, where the walk descends anyway (the\n * marker says a group was here, and its members must not vanish); one holding\n * neither while containing subdirectories is an ERROR that still names every\n * service found beneath it. The third branch is the whole point:\n * two-way classification loses a service silently on an ordinary clean merge —\n * one branch deletes an emptied subsystem's marker while another moves a\n * service into it, and the group directory is then read as a service whose\n * real services vanish from the fleet with no finding. No directory under\n * `services/` may ever be reinterpreted as a different kind without saying so,\n * and the fleet is never reported smaller: the walk descends into the broken\n * group precisely so the stranded services stay enumerated and named.\n *\n * The package direction is `repo → repo/tree`, never back. That is why the\n * artifact-name question arrives INJECTED (`TreeWalkRequest.isServiceArtifact`\n * — `repo/paths.ts` owns the spellings and `repo/repo.ts` builds the request):\n * importing `paths.ts` from here while `repo.ts` delegates its enumeration to\n * this walk would close the exact package cycle `scripts/package-graph.mjs`\n * exists to refuse.\n *\n * Cost: exactly one readdir per directory walked, service directories included\n * (their own listing is what classifies them), plus one realpath per directory\n * for the symlink-cycle guard — `entryIs` follows symlinks on purpose, and a\n * followed cycle without the visited-set is an unbounded recursion.\n */\nimport { realpathSync } from \"node:fs\";\nimport { readdir } from \"node:fs/promises\";\nimport { join } from \"node:path\";\nimport { serviceDirOf, serviceTreePath, type DocsDir, type ServiceDir } from \"../../kernel/ids/dirs.js\";\nimport { rawServiceId, type RawServiceId } from \"../../kernel/ids/service.js\";\nimport { subsystemNameProblem } from \"../../kernel/ids/subsystem.js\";\nimport type { Finding } from \"../../vocabulary/report.js\";\nimport { entryIs } from \"./fs.js\";\nimport { readSubsystemMarker, SUBSYSTEM_MARKER, type SubsystemMeta } from \"./marker.js\";\n\nexport interface WalkedService {\n  id: RawServiceId;\n  dir: ServiceDir;\n  /**\n   * Names of the directories between `services/` and the service, outermost\n   * first. Empty = unfiled — directly under `services/`, which is permanent,\n   * normal and SILENT. For a service stranded under an unmarked group the\n   * chain still records the physical placement: the path is a fact even while\n   * `subsystem.unmarked` says the grouping is broken.\n   */\n  subsystem: string[];\n}\n\nexport interface SubsystemEntry {\n  /** The directory name — the subsystem's name in the flat namespace. */\n  name: string;\n  /** Names from `services/` down to and including this one. */\n  path: string[];\n  /** Absolute path of the subsystem directory. */\n  dir: string;\n  meta: SubsystemMeta;\n}\n\nexport interface FleetTree {\n  services: WalkedService[];\n  subsystems: SubsystemEntry[];\n  findings: Finding[];\n}\n\nexport interface TreeWalkRequest {\n  docsDir: DocsDir;\n  /** Does this entry name a service artifact? `repo/paths.ts`'s table, injected — the module doc says why. */\n  isServiceArtifact: (name: string, kind: \"file\" | \"dir\") => boolean;\n}\n\ninterface WalkContext {\n  request: TreeWalkRequest;\n  tree: FleetTree;\n  /** Realpaths already DESCENDED into — the symlink-cycle guard. */\n  visited: Set<string>;\n  /** Every name in the flat namespace → the directories that claim it. */\n  names: Map<string, string[]>;\n}\n\n/** One directory the walk is looking at: where it is, and how it is reached. */\ninterface Spot {\n  dir: string;\n  name: string;\n  /** Directory names between `services/` and this one, outermost first. */\n  chain: string[];\n}\n\nexport async function walkServicesTree(request: TreeWalkRequest): Promise<FleetTree> {\n  const ctx: WalkContext = {\n    request,\n    tree: { services: [], subsystems: [], findings: [] },\n    visited: new Set(),\n    names: new Map(),\n  };\n  const root = join(request.docsDir, \"services\");\n  guardDescent(root, ctx);\n  for (const name of await subdirNames(root)) {\n    await visitDir({ dir: join(root, name), name, chain: [] }, ctx);\n  }\n  namespaceFindings(ctx);\n  return ctx.tree;\n}\n\n/**\n * Mark a directory as descended-into; false when it (or another name for it)\n * already was. Guards SUBTREES, not entries: a directory reachable under two\n * names is classified twice — both names exist and hiding the second would be\n * the silent shrink this module refuses — but its children are enumerated\n * once, so a symlink cycle terminates instead of recursing forever. A path\n * realpath cannot resolve is one whose children cannot be read either.\n */\nfunction guardDescent(dir: string, ctx: WalkContext): boolean {\n  let real: string;\n  try {\n    real = realpathSync(dir);\n  } catch {\n    return false;\n  }\n  if (ctx.visited.has(real)) return false;\n  ctx.visited.add(real);\n  return true;\n}\n\n/** Sorted non-dot subdirectory names — the walk's deterministic child order. */\nasync function subdirNames(dir: string): Promise<string[]> {\n  const entries = await readdir(dir, { withFileTypes: true });\n  return entries.filter((e) => !e.name.startsWith(\".\") && entryIs(dir, e, \"dir\")).map((e) => e.name).sort();\n}\n\n/** Classify one directory and, for the group kinds, walk what is inside it. */\nasync function visitDir(spot: Spot, ctx: WalkContext): Promise<void> {\n  const rel = [\"services\", ...spot.chain, spot.name].join(\"/\");\n  const entries = (await readdir(spot.dir, { withFileTypes: true })).filter((e) => !e.name.startsWith(\".\"));\n  const files = entries.filter((e) => entryIs(spot.dir, e, \"file\")).map((e) => e.name);\n  const dirs = entries.filter((e) => entryIs(spot.dir, e, \"dir\")).map((e) => e.name).sort();\n  const marker = files.includes(SUBSYSTEM_MARKER);\n  const artifact =\n    files.some((f) => ctx.request.isServiceArtifact(f, \"file\")) ||\n    dirs.some((d) => ctx.request.isServiceArtifact(d, \"dir\"));\n\n  if (marker && artifact) {\n    // Artifacts win the classification: the documents are somebody's work and\n    // the marker is one stray file, so the directory stays an addressable\n    // service and the finding names the contradiction instead of the walk\n    // quietly picking a reading. But the walk STILL descends (the module\n    // invariant: no reinterpretation may shrink the fleet) — the marker says\n    // a GROUP was here, and returning without walking made every service\n    // beneath it vanish with only this finding to hint why. Child directories\n    // that are themselves artifacts (`adrs/`) are service interior, not walked.\n    recordService(spot, ctx);\n    const stranded = await descendInto(spot, dirs.filter((d) => !ctx.request.isServiceArtifact(d, \"dir\")), ctx);\n    ctx.tree.findings.push({\n      severity: \"error\",\n      code: \"subsystem.marker-misplaced\",\n      subject: spot.name,\n      message:\n        `${rel}/ holds ${SUBSYSTEM_MARKER} BESIDE service artifacts — a directory is a subsystem or a service, never both. ` +\n        `It stays classified as a service; delete ${rel}/${SUBSYSTEM_MARKER}, ` +\n        `or move the artifacts into a service directory of their own inside the group.` +\n        (stranded.length > 0 ? ` ${stranded.length} service(s) beneath it stay enumerated meanwhile: ${stranded.map((s) => s.id).join(\", \")}.` : \"\"),\n      ...(stranded.length > 0 ? { details: stranded.map(serviceTreePath) } : {}),\n    });\n    return;\n  }\n  if (marker) {\n    await visitSubsystem(spot, { rel, dirs }, ctx);\n    return;\n  }\n  if (artifact) {\n    recordService(spot, ctx);\n    return;\n  }\n  if (dirs.length > 0) {\n    await visitUnmarked(spot, { rel, dirs }, ctx);\n    return;\n  }\n  // Neither marker nor artifact, and nothing beneath: today's flat behaviour —\n  // an empty (or not-yet-adopted) directory under services/ is a service.\n  recordService(spot, ctx);\n}\n\nfunction recordService(spot: Spot, ctx: WalkContext): void {\n  ctx.tree.services.push({\n    id: rawServiceId(spot.name),\n    dir: serviceDirOf(spot.dir),\n    subsystem: spot.chain,\n  });\n  claimName(spot, ctx);\n}\n\n/** A subsystem: record it, report a broken marker or an illegal name, walk in. */\nasync function visitSubsystem(spot: Spot, at: { rel: string; dirs: string[] }, ctx: WalkContext): Promise<void> {\n  const meta = await readSubsystemMarker(join(spot.dir, SUBSYSTEM_MARKER));\n  if (meta.invalid !== undefined) {\n    // Exactly one finding per marker file: presence already classified the\n    // directory, so the content failure is metadata, not identity.\n    ctx.tree.findings.push({\n      severity: \"error\",\n      code: \"subsystem.invalid\",\n      subject: at.rel,\n      message:\n        `${at.rel}/${SUBSYSTEM_MARKER} cannot be read as subsystem metadata — ${meta.invalid}. ` +\n        `The directory still counts as a subsystem (presence classifies; content is metadata). ` +\n        `Fix the file: a YAML mapping with optional title, description and owner — an empty file is also a valid marker.`,\n    });\n  }\n  const problem = subsystemNameProblem(spot.name, \"subsystem directory name\");\n  if (problem !== null) {\n    // Walked anyway, mirroring how an illegal service id stays enumerated\n    // (`idProblem`): the directory exists and hiding its subtree would shrink\n    // the fleet over a naming mistake.\n    ctx.tree.findings.push({\n      severity: \"error\",\n      code: \"subsystem.name-invalid\",\n      subject: spot.name,\n      message: `${at.rel}/ — ${problem} Rename the directory; its services stay enumerated meanwhile.`,\n    });\n  }\n  ctx.tree.subsystems.push({\n    name: spot.name,\n    path: [...spot.chain, spot.name],\n    dir: spot.dir,\n    meta,\n  });\n  claimName(spot, ctx);\n  await descendInto(spot, at.dirs, ctx);\n}\n\n/**\n * Walk the children of a group directory (symlink-cycle guarded), returning\n * the services newly recorded beneath it — the ONE spelling of descent, so\n * the three descending branches agree about the guard and the chain.\n */\nasync function descendInto(spot: Spot, dirs: string[], ctx: WalkContext): Promise<WalkedService[]> {\n  const before = ctx.tree.services.length;\n  if (guardDescent(spot.dir, ctx)) {\n    for (const child of dirs) {\n      await visitDir({ dir: join(spot.dir, child), name: child, chain: [...spot.chain, spot.name] }, ctx);\n    }\n  }\n  return ctx.tree.services.slice(before);\n}\n\n/**\n * The refusal branch — a group directory nothing marks. The walk STILL\n * descends, so the services beneath stay in the enumeration and the finding\n * can name them: the fleet must never be reported smaller than it is.\n */\nasync function visitUnmarked(spot: Spot, at: { rel: string; dirs: string[] }, ctx: WalkContext): Promise<void> {\n  const stranded = await descendInto(spot, at.dirs, ctx);\n  ctx.tree.findings.push({\n    severity: \"error\",\n    code: \"subsystem.unmarked\",\n    subject: at.rel,\n    message:\n      `${at.rel}/ is neither a subsystem (no ${SUBSYSTEM_MARKER}) nor a service (no service artifact), ` +\n      `but ${stranded.length} service(s) sit beneath it` +\n      (stranded.length > 0 ? `: ${stranded.map((s) => s.id).join(\", \")}. ` : `. `) +\n      `Without the marker this directory would be read as a service and everything under it would vanish from the fleet — ` +\n      `the shape an ordinary merge produces when one branch deletes an emptied subsystem's marker while another moves a service in. ` +\n      `Restore ${at.rel}/${SUBSYSTEM_MARKER} (an empty file is a valid marker), or move the directories out.`,\n    ...(stranded.length > 0 ? { details: stranded.map(serviceTreePath) } : {}),\n  });\n}\n\nfunction claimName(spot: Spot, ctx: WalkContext): void {\n  const rel = [\"services\", ...spot.chain, spot.name].join(\"/\");\n  ctx.names.set(spot.name, [...(ctx.names.get(spot.name) ?? []), rel]);\n}\n\n/**\n * One flat namespace: every subsystem name and service id, unique across the\n * whole tree at any depth, never colliding with each other. The identity\n * decision demands it — a service id is its leaf directory name ALONE, so two\n * leaves spelling one name are one identity claimed twice, wherever they sit.\n * One finding per name, naming every claimant, so the fix is a choice rather\n * than a scavenger hunt.\n */\nfunction namespaceFindings(ctx: WalkContext): void {\n  for (const [name, dirs] of [...ctx.names].sort(([a], [b]) => (a < b ? -1 : 1))) {\n    if (dirs.length < 2) continue;\n    ctx.tree.findings.push({\n      severity: \"error\",\n      code: \"subsystem.name-collision\",\n      subject: name,\n      message:\n        `'${name}' is claimed by ${dirs.length} directories in the services/ tree: ${dirs.join(\", \")} — ` +\n        `service ids and subsystem names share one flat namespace, unique at any depth, ` +\n        `because a service's identity is its leaf directory name alone and placement never disambiguates it. ` +\n        `Rename all but one.`,\n      details: dirs,\n    });\n  }\n}\n"]}

package/dist/core/results.js

@@ -29,12 +29,109 @@
  * report loam cannot recognize must refuse rather than quietly answer every
  * claim "not found".
  */
-import { DIGEST_TAG_RE, scenarioDigestTag } from "./gherkin.js";
-import { isRecord } from "./records.js";
+import { DIGEST_TAG_RE, scenarioDigestTag } from "./gherkin/stamp.js";
+import { isRecord } from "./kernel/records.js";
 /**
  * Read a parsed cucumber JSON document down to its digest-tagged scenarios.
  * `reportName` is how the caller spelled the file, for the refusal message.
  */
+/** The marker key that makes a JSON document loam's own scenario shape, and the version this loam reads. */
+export const SCENARIO_REPORT_MARKER = "loamScenarioReport";
+export const SCENARIO_REPORT_VERSION = 1;
+/**
+ * Is this document loam's own scenario-report shape rather than a cucumber one?
+ *
+ * Marker-only, deliberately: the caller must be able to choose a READER before
+ * either has validated anything, so that a malformed `loamScenarioReport` file
+ * refuses as a malformed report of ITS kind rather than as "not a cucumber
+ * array". A file that claims the shape and then fails it must never fall
+ * through to the other parser and be told it is the wrong sort of document.
+ */
+export function isScenarioReport(doc) {
+    return isRecord(doc) && doc[SCENARIO_REPORT_MARKER] !== undefined;
+}
+/**
+ * `{"loamScenarioReport": 1, "results": [{"digest": "…", "status": "passed"}]}`
+ * — the runner-neutral answer sheet for `scenario.tested` claims.
+ *
+ * WHY THIS EXISTS. `loam gherkin` stamps every generated scenario
+ * `@loam-digest-<16hex>`, and until now only cucumber's JSON carried that tag
+ * back. A fleet on JUnit, pytest, Playwright, Vitest or a house runner could
+ * therefore never reach `verified` — not because its evidence was weaker, but
+ * because of a file format. The example fleet's own shipped record is the proof
+ * of the cost: every claim in it is `answered_by: agent`, so the product's
+ * showcase demonstrates only the lesser verdict.
+ *
+ * THE STANDARD OF PROOF IS UNCHANGED, and that is the whole argument. The
+ * contract was never the JSON dialect: it is the digest — content-derived, so
+ * rewording a `Given` breaks the match — plus a status that says a real run
+ * reported it green. Both halves are here. An answer from this file is
+ * `answered_by: runner` exactly as a cucumber one is, because it is the same
+ * claim answered to the same standard by the same identity.
+ *
+ * It also adds no forgeability. loam cannot prove any JSON came from executing
+ * a commit — SCHEMA says so, and the record stores the file's sha256 and mtime
+ * precisely because that is all it can honestly claim. A hand-written cucumber
+ * array was always exactly as easy to write as this is.
+ *
+ * The strict/tolerant split mirrors `verify/evidence/contract.ts` for its
+ * reason: a cucumber report is another tool's file full of entries loam has no
+ * business judging, while this shape exists for one purpose, so a malformed
+ * entry is a malformed report rather than scenery to skip. `status` must be
+ * exactly `passed` or `failed`; `skipped`, `pending` and vendor spellings are
+ * refused rather than guessed at, because guessing is how a not-run scenario
+ * becomes a confirmation.
+ */
+export function readScenarioReport(doc, reportName) {
+    if (!isRecord(doc)) {
+        return { ok: false, message: `${reportName} is not a JSON object.` };
+    }
+    const version = doc[SCENARIO_REPORT_MARKER];
+    if (version !== SCENARIO_REPORT_VERSION) {
+        return {
+            ok: false,
+            message: `${reportName} declares \`${SCENARIO_REPORT_MARKER}: ${JSON.stringify(version)}\`, and this loam reads ` +
+                `version ${SCENARIO_REPORT_VERSION}. A report loam cannot read is refused rather than answered in part.`,
+        };
+    }
+    const results = doc["results"];
+    if (!Array.isArray(results)) {
+        return {
+            ok: false,
+            message: `${reportName} has no \`results\` array — the shape is {"${SCENARIO_REPORT_MARKER}": 1, "results": [{"digest": "…", "status": "passed"}]}.`,
+        };
+    }
+    const scenarios = [];
+    for (const [i, entry] of results.entries()) {
+        const at = `${reportName} results[${i}]`;
+        if (!isRecord(entry))
+            return { ok: false, message: `${at} is not an object.` };
+        const digest = str(entry["digest"]);
+        if (digest === undefined || !/^[0-9a-f]{16}$/.test(digest)) {
+            return {
+                ok: false,
+                message: `${at} has no \`digest\` of 16 lowercase hex characters — that is the \`@loam-digest-…\` tag \`loam gherkin\` stamped on the scenario.`,
+            };
+        }
+        const status = str(entry["status"]);
+        if (status !== "passed" && status !== "failed") {
+            return {
+                ok: false,
+                message: `${at} has \`status: ${JSON.stringify(entry["status"])}\`; this shape accepts only "passed" or "failed". ` +
+                    "A scenario that did not run has no place in an answer sheet — omit it, and its claim stays unanswered rather than becoming a confirmation.",
+            };
+        }
+        scenarios.push({
+            // The runner's own name for the test, when it gave one — this is where a
+            // reader goes to see the run, and it is the only free text here.
+            where: str(entry["test"]) ?? `(${SCENARIO_REPORT_MARKER} entry ${i})`,
+            digests: [digest],
+            steps: [status],
+            hooks: [],
+        });
+    }
+    return { ok: true, scenarios };
+}
 export function readCucumberReport(doc, reportName) {
     if (!Array.isArray(doc)) {
         return {

package/dist/core/results.js.map

@@ -1 +1 @@
-{"version":3,"file":"results.js","sourceRoot":"","sources":["../../src/core/results.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAChE,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAqBxC;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAY,EAAE,UAAkB;IACjE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EACL,GAAG,UAAU,4EAA4E;gBACzF,6EAA6E;SAChF,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAqB,EAAE,CAAC;IACvC,KAAK,MAAM,OAAO,IAAI,GAAG,EAAE,CAAC;QAC1B,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,SAAS;QACjC,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,mBAAmB,CAAC;QACvF,MAAM,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;QACrC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;YAAE,SAAS;QACvC,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;YAC1B,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAAE,SAAS;YAC5B,MAAM,OAAO,GAAa,EAAE,CAAC;YAC7B,MAAM,IAAI,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC;YACxB,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxB,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;oBACrB,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;oBAClF,MAAM,CAAC,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBAC/D,IAAI,CAAC;wBAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC;gBAC7B,CAAC;YACH,CAAC;YACD,gEAAgE;YAChE,iEAAiE;YACjE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YACnC,MAAM,cAAc,GAAG,CAAC,GAAY,EAAY,EAAE;gBAChD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;oBAAE,OAAO,EAAE,CAAC;gBACnC,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;oBACnB,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;oBAC7F,OAAO,CAAC,MAAM,IAAI,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;gBAC7C,CAAC,CAAC,CAAC;YACL,CAAC,CAAC;YACF,MAAM,KAAK,GAAG,cAAc,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;YAC1C,2EAA2E;YAC3E,MAAM,KAAK,GAAG,CAAC,GAAG,cAAc,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,cAAc,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAChF,oEAAoE;YACpE,wCAAwC;YACxC,MAAM,MAAM,GAAG,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;YAChD,SAAS,CAAC,IAAI,CAAC;gBACb,KAAK,EAAE,GAAG,WAAW,MAAM,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,IAAI,oBAAoB,EAAE;gBACpE,OAAO;gBACP,KAAK;gBACL,KAAK;gBACL,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;aAC5C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AACjC,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAwB;IACvD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC9C,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS;YAAE,SAAS;QACrC,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,IAAI,GAAG,EAAU,CAAC;QACvD,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QACpB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC7B,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC9C,KAAK,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,MAAM,EAAE,CAAC;QACxC,IAAI,QAAQ,CAAC,IAAI,GAAG,CAAC;YAAE,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,aAAa,CAC3B,MAAe,EACf,SAA2B,EAC3B,UAAkB;IAElB,MAAM,SAAS,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAC3C,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACtB,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC5E,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,MAAM,CACX,CAAC,CAAC,EAAE,EACJ,aAAa,EACb,EAAE,EACF,GAAG,iBAAiB,CAAC,CAAC,CAAC,MAAO,CAAC,6BAA6B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,UAAU,kCAAkC;gBAC/H,gEAAgE,CACnE,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAO,CAAC,CAAC,CAAC;QAClG,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YAClF,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,wCAAwC,UAAU,YAAY,GAAG,EAAE,CAAC,CAAC;QAC9G,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,UAAU,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,MAAM,OAAO,IAAI,CAAC,MAAM,uBAAuB,CAAC,CAAC,CAAC,EAAE,CAAC;QACnG,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,UAAU,KAAK,KAAK,CAAC,KAAK,IAAI,KAAK,EAAE,CAAC,CAAC;IACrG,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,MAAM,CAAC,EAAU,EAAE,OAA0B,EAAE,QAAkB,EAAE,IAAa;IACvF,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC;AACnG,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,MAAM,CAAC,CAAiB;IAC/B,OAAO,CACL,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;QAClB,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,QAAQ,CAAC;QACpC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,QAAQ,CAAC;QACpC,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAClD,CAAC;AACJ,CAAC;AAED,oFAAoF;AACpF,SAAS,MAAM,CAAC,CAAiB;IAC/B,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,cAAc,CAAC;IAChD,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,SAAS,CAAC,CAAC;IACtE,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;IACpD,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3D,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC;IACnD,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,yBAAyB,CAAC;IAC1D,OAAO,oBAAoB,CAAC,CAAC,MAAM,IAAI,SAAS,GAAG,CAAC;AACtD,CAAC;AAED,SAAS,GAAG,CAAC,CAAU;IACrB,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACtE,CAAC","sourcesContent":["/**\n * `loam verify --results` — the cucumber report as an answer sheet.\n *\n * `loam gherkin` tags every generated scenario `@loam-digest-<16hex>`, and\n * cucumber's JSON format carries tags per scenario — so a test report says,\n * mechanically, which spec scenarios ran green. This module reads that report\n * and answers `scenario.tested` claims from it. The digest is the ONLY\n * identity: a claim's `digest` and the tag are the same 16 hex of the same\n * body hash, and names match nothing — rewording a scenario breaks the match,\n * which is the point, because an agent must not be able to SAY a scenario is\n * tested; only a green run may.\n *\n * That identity is CONTENT, and content stops one step short of a fleet: two\n * services whose specs word a scenario identically share a digest, so one\n * repository's report matches the other repository's claim. Those claims are\n * refused rather than answered — see {@link contestedDigests}.\n *\n * Parsing is deliberately tolerant of everything except the shape it matches\n * on. The format is what cucumber-js `--format json`, cucumber-jvm, behave and\n * SpecFlow emit — an array of features, each `elements[]` (scenarios) with\n * `name`, `tags[] {name}` and `steps[] {result {status}}`, plus the two\n * places those dialects put a failure the steps never see: cucumber-jvm\n * reports @Before/@After hook results in per-element `before[]`/`after[]`\n * arrays (a teardown assertion fails there while every step stays `passed`),\n * and behave carries an element-level `status` that a hook failure flips.\n * Only those fields are contract: unknown fields, tagless elements\n * (backgrounds, hand-written scenarios) and stray entries are skipped without\n * comment. What is NOT tolerated is a file that is not that array at all: a\n * report loam cannot recognize must refuse rather than quietly answer every\n * claim \"not found\".\n */\nimport { DIGEST_TAG_RE, scenarioDigestTag } from \"./gherkin.js\";\nimport { isRecord } from \"./records.js\";\nimport type { Answer, Claim } from \"./verify.js\";\n\n/** One report scenario, reduced to what matching needs. */\nexport interface ReportScenario {\n  /** `<feature uri or name> › <scenario name>` — where the run can be seen. */\n  where: string;\n  /** Digests carried as `@loam-digest-…` tags. Usually one; hand-tagging can add more. */\n  digests: string[];\n  /** Step statuses, lowercased, in order. */\n  steps: string[];\n  /** Hook statuses from cucumber-jvm's `before[]`/`after[]`, lowercased, in order. */\n  hooks: string[];\n  /** behave's element-level status, lowercased — absent in the other dialects. */\n  status?: string;\n}\n\nexport type ReportRead =\n  | { ok: true; scenarios: ReportScenario[] }\n  | { ok: false; message: string };\n\n/**\n * Read a parsed cucumber JSON document down to its digest-tagged scenarios.\n * `reportName` is how the caller spelled the file, for the refusal message.\n */\nexport function readCucumberReport(doc: unknown, reportName: string): ReportRead {\n  if (!Array.isArray(doc)) {\n    return {\n      ok: false,\n      message:\n        `${reportName} is not a cucumber JSON report — expected the top-level array of features ` +\n        \"that `cucumber-js --format json` (or cucumber-jvm, behave, SpecFlow) emits.\",\n    };\n  }\n  const scenarios: ReportScenario[] = [];\n  for (const feature of doc) {\n    if (!isRecord(feature)) continue;\n    const featureName = str(feature[\"uri\"]) ?? str(feature[\"name\"]) ?? \"(unnamed feature)\";\n    const elements = feature[\"elements\"];\n    if (!Array.isArray(elements)) continue;\n    for (const el of elements) {\n      if (!isRecord(el)) continue;\n      const digests: string[] = [];\n      const tags = el[\"tags\"];\n      if (Array.isArray(tags)) {\n        for (const t of tags) {\n          const name = typeof t === \"string\" ? t : isRecord(t) ? str(t[\"name\"]) : undefined;\n          const m = name === undefined ? null : DIGEST_TAG_RE.exec(name);\n          if (m) digests.push(m[1]!);\n        }\n      }\n      // No digest tag, nothing to match: a background, a hand-written\n      // scenario, another tool's output. Invisible here, deliberately.\n      if (digests.length === 0) continue;\n      const resultStatuses = (raw: unknown): string[] => {\n        if (!Array.isArray(raw)) return [];\n        return raw.map((s) => {\n          const status = isRecord(s) && isRecord(s[\"result\"]) ? str(s[\"result\"][\"status\"]) : undefined;\n          return (status ?? \"unknown\").toLowerCase();\n        });\n      };\n      const steps = resultStatuses(el[\"steps\"]);\n      // cucumber-jvm's @Before/@After hooks: separate arrays, same result shape.\n      const hooks = [...resultStatuses(el[\"before\"]), ...resultStatuses(el[\"after\"])];\n      // behave's element-level status — a hook failure flips it while the\n      // steps that already ran keep \"passed\".\n      const status = str(el[\"status\"])?.toLowerCase();\n      scenarios.push({\n        where: `${featureName} › ${str(el[\"name\"]) ?? \"(unnamed scenario)\"}`,\n        digests,\n        steps,\n        hooks,\n        ...(status === undefined ? {} : { status }),\n      });\n    }\n  }\n  return { ok: true, scenarios };\n}\n\n/**\n * The digests that more than one service claims, with the services that claim\n * them — a scenario worded identically in two services' specs.\n *\n * The digest is a hash of the scenario body and of nothing else, so `loam\n * gherkin` stamps the same tag into both repositories and a report from either\n * one matches both claims. A report says which scenario ran; it never says\n * whose suite ran it, and the two repositories never ran each other's tests.\n * loam has no way to tell them apart, so it does not choose: the answer is\n * refused, with the services named, and `--service` is the way to give a report\n * an owner (it narrows the checklist to one repository's claims before the\n * matching starts, so nothing here is contested).\n *\n * Only the SERVICE boundary counts. One service's spec repeating a scenario\n * word for word is genuinely one test — that is the documented meaning of the\n * stamp — and both claims may be answered by the one run.\n */\nexport function contestedDigests(claims: readonly Claim[]): Map<string, string[]> {\n  const owners = new Map<string, Set<string>>();\n  for (const c of claims) {\n    if (c.digest === undefined) continue;\n    const seen = owners.get(c.digest) ?? new Set<string>();\n    seen.add(c.subject);\n    owners.set(c.digest, seen);\n  }\n  const contested = new Map<string, string[]>();\n  for (const [digest, services] of owners) {\n    if (services.size > 1) contested.set(digest, [...services].sort());\n  }\n  return contested;\n}\n\n/**\n * Answer every claim from the report — the runner's half of the record. Meant\n * for `scenario.tested` claims (the only kind carrying a digest); a claim\n * without one is answered `unconfirmed` rather than skipped, because silence\n * must never read as checked.\n *\n * Confirmation is strict on purpose: every matching occurrence — a digest the\n * report holds twice is a re-run, and all of them count — ran at least one\n * step, every step `passed`, every before/after hook `passed`, and the\n * element-level status (when the dialect reports one) is `passed`. One failed\n * occurrence wins as failure, a skipped-only run is \"skipped\" not green, and\n * no match at all is \"not found in report\". A digest two services share is\n * refused before any of that: see {@link contestedDigests}.\n */\nexport function runnerAnswers(\n  claims: Claim[],\n  scenarios: ReportScenario[],\n  reportName: string,\n): Answer[] {\n  const contested = contestedDigests(claims);\n  return claims.map((c) => {\n    const rivals = c.digest === undefined ? undefined : contested.get(c.digest);\n    if (rivals !== undefined) {\n      return answer(\n        c.id,\n        \"unconfirmed\",\n        [],\n        `${scenarioDigestTag(c.digest!)} is worded identically in ${rivals.join(\", \")}, so ${reportName} cannot say whose suite ran it. ` +\n          \"Record each service's claims from its own repo with --service.\",\n      );\n    }\n    const runs = c.digest === undefined ? [] : scenarios.filter((s) => s.digests.includes(c.digest!));\n    if (runs.length === 0) {\n      const tag = c.digest === undefined ? \"a digest tag\" : scenarioDigestTag(c.digest);\n      return answer(c.id, \"unconfirmed\", [], `not found in report — no scenario in ${reportName} carries ${tag}`);\n    }\n    const failing = runs.filter((r) => !passed(r));\n    if (failing.length === 0) {\n      return answer(c.id, \"confirmed\", runs.map((r) => `${reportName}: ${r.where}`));\n    }\n    const first = failing[0]!;\n    const rerun = runs.length > 1 ? ` — ${failing.length} of ${runs.length} matching runs failed` : \"\";\n    return answer(c.id, \"unconfirmed\", [], `${reason(first)} (${reportName}: ${first.where})${rerun}`);\n  });\n}\n\nfunction answer(id: string, verdict: Answer[\"verdict\"], evidence: string[], note?: string): Answer {\n  return { id, verdict, evidence, ...(note === undefined ? {} : { note }), answered_by: \"runner\" };\n}\n\n/**\n * Green means green: at least one step, every step `passed`, every before/\n * after hook `passed`, and the element-level status (when the dialect carries\n * one) `passed` too. The last two exist because a run the runner itself\n * reports as FAILED — a teardown assertion in an @After hook, exactly the\n * shape the arch axis's outbox checks take — used to read as confirmed here:\n * the steps all passed, and the hook failure lived in fields nobody read.\n */\nfunction passed(r: ReportScenario): boolean {\n  return (\n    r.steps.length > 0 &&\n    r.steps.every((s) => s === \"passed\") &&\n    r.hooks.every((h) => h === \"passed\") &&\n    (r.status === undefined || r.status === \"passed\")\n  );\n}\n\n/** Why a run did not pass, naming the step, hook or element status that says so. */\nfunction reason(r: ReportScenario): string {\n  if (r.steps.length === 0) return \"no steps ran\";\n  const i = r.steps.findIndex((s) => s !== \"passed\" && s !== \"skipped\");\n  if (i >= 0) return `${r.steps[i]} at step ${i + 1}`;\n  if (r.steps.some((s) => s === \"skipped\")) return \"skipped\";\n  const h = r.hooks.findIndex((s) => s !== \"passed\");\n  if (h >= 0) return `${r.hooks[h]} in a before/after hook`;\n  return `scenario status '${r.status ?? \"unknown\"}'`;\n}\n\nfunction str(v: unknown): string | undefined {\n  return typeof v === \"string\" && v.trim().length > 0 ? v : undefined;\n}\n"]}
+{"version":3,"file":"results.js","sourceRoot":"","sources":["../../src/core/results.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAsB/C;;;GAGG;AACH,4GAA4G;AAC5G,MAAM,CAAC,MAAM,sBAAsB,GAAG,oBAAoB,CAAC;AAC3D,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC;AAEzC;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAY;IAC3C,OAAO,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,sBAAsB,CAAC,KAAK,SAAS,CAAC;AACpE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAY,EAAE,UAAkB;IACjE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACnB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,UAAU,wBAAwB,EAAE,CAAC;IACvE,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,sBAAsB,CAAC,CAAC;IAC5C,IAAI,OAAO,KAAK,uBAAuB,EAAE,CAAC;QACxC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EACL,GAAG,UAAU,eAAe,sBAAsB,KAAK,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,0BAA0B;gBACxG,WAAW,uBAAuB,sEAAsE;SAC3G,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC;IAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,GAAG,UAAU,8CAA8C,sBAAsB,0DAA0D;SACrJ,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAqB,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QAC3C,MAAM,EAAE,GAAG,GAAG,UAAU,YAAY,CAAC,GAAG,CAAC;QACzC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,oBAAoB,EAAE,CAAC;QAC/E,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;QACpC,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3D,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE,GAAG,EAAE,kIAAkI;aACjJ,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;QACpC,IAAI,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC/C,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EACL,GAAG,EAAE,kBAAkB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,oDAAoD;oBAC1G,4IAA4I;aAC/I,CAAC;QACJ,CAAC;QACD,SAAS,CAAC,IAAI,CAAC;YACb,yEAAyE;YACzE,iEAAiE;YACjE,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,IAAI,sBAAsB,UAAU,CAAC,GAAG;YACrE,OAAO,EAAE,CAAC,MAAM,CAAC;YACjB,KAAK,EAAE,CAAC,MAAM,CAAC;YACf,KAAK,EAAE,EAAE;SACV,CAAC,CAAC;IACL,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,GAAY,EAAE,UAAkB;IACjE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EACL,GAAG,UAAU,4EAA4E;gBACzF,6EAA6E;SAChF,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAqB,EAAE,CAAC;IACvC,KAAK,MAAM,OAAO,IAAI,GAAG,EAAE,CAAC;QAC1B,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,SAAS;QACjC,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,mBAAmB,CAAC;QACvF,MAAM,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;QACrC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;YAAE,SAAS;QACvC,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;YAC1B,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAAE,SAAS;YAC5B,MAAM,OAAO,GAAa,EAAE,CAAC;YAC7B,MAAM,IAAI,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC;YACxB,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxB,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;oBACrB,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;oBAClF,MAAM,CAAC,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBAC/D,IAAI,CAAC;wBAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC;gBAC7B,CAAC;YACH,CAAC;YACD,gEAAgE;YAChE,iEAAiE;YACjE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YACnC,MAAM,cAAc,GAAG,CAAC,GAAY,EAAY,EAAE;gBAChD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;oBAAE,OAAO,EAAE,CAAC;gBACnC,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;oBACnB,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;oBAC7F,OAAO,CAAC,MAAM,IAAI,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;gBAC7C,CAAC,CAAC,CAAC;YACL,CAAC,CAAC;YACF,MAAM,KAAK,GAAG,cAAc,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;YAC1C,2EAA2E;YAC3E,MAAM,KAAK,GAAG,CAAC,GAAG,cAAc,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,cAAc,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAChF,oEAAoE;YACpE,wCAAwC;YACxC,MAAM,MAAM,GAAG,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;YAChD,SAAS,CAAC,IAAI,CAAC;gBACb,KAAK,EAAE,GAAG,WAAW,MAAM,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,IAAI,oBAAoB,EAAE;gBACpE,OAAO;gBACP,KAAK;gBACL,KAAK;gBACL,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;aAC5C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AACjC,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAwB;IACvD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC9C,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS;YAAE,SAAS;QACrC,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,IAAI,GAAG,EAAU,CAAC;QACvD,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QACpB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC7B,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC9C,KAAK,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,MAAM,EAAE,CAAC;QACxC,IAAI,QAAQ,CAAC,IAAI,GAAG,CAAC;YAAE,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,aAAa,CAC3B,MAAe,EACf,SAA2B,EAC3B,UAAkB;IAElB,MAAM,SAAS,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAC3C,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACtB,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC5E,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,MAAM,CACX,CAAC,CAAC,EAAE,EACJ,aAAa,EACb,EAAE,EACF,GAAG,iBAAiB,CAAC,CAAC,CAAC,MAAO,CAAC,6BAA6B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,UAAU,kCAAkC;gBAC/H,gEAAgE,CACnE,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAO,CAAC,CAAC,CAAC;QAClG,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YAClF,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,wCAAwC,UAAU,YAAY,GAAG,EAAE,CAAC,CAAC;QAC9G,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,UAAU,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,MAAM,OAAO,IAAI,CAAC,MAAM,uBAAuB,CAAC,CAAC,CAAC,EAAE,CAAC;QACnG,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,UAAU,KAAK,KAAK,CAAC,KAAK,IAAI,KAAK,EAAE,CAAC,CAAC;IACrG,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,MAAM,CAAC,EAAU,EAAE,OAA0B,EAAE,QAAkB,EAAE,IAAa;IACvF,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC;AACnG,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,MAAM,CAAC,CAAiB;IAC/B,OAAO,CACL,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;QAClB,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,QAAQ,CAAC;QACpC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,QAAQ,CAAC;QACpC,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAClD,CAAC;AACJ,CAAC;AAED,oFAAoF;AACpF,SAAS,MAAM,CAAC,CAAiB;IAC/B,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,cAAc,CAAC;IAChD,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,SAAS,CAAC,CAAC;IACtE,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;IACpD,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3D,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC;IACnD,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,yBAAyB,CAAC;IAC1D,OAAO,oBAAoB,CAAC,CAAC,MAAM,IAAI,SAAS,GAAG,CAAC;AACtD,CAAC;AAED,SAAS,GAAG,CAAC,CAAU;IACrB,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACtE,CAAC","sourcesContent":["/**\n * `loam verify --results` — the cucumber report as an answer sheet.\n *\n * `loam gherkin` tags every generated scenario `@loam-digest-<16hex>`, and\n * cucumber's JSON format carries tags per scenario — so a test report says,\n * mechanically, which spec scenarios ran green. This module reads that report\n * and answers `scenario.tested` claims from it. The digest is the ONLY\n * identity: a claim's `digest` and the tag are the same 16 hex of the same\n * body hash, and names match nothing — rewording a scenario breaks the match,\n * which is the point, because an agent must not be able to SAY a scenario is\n * tested; only a green run may.\n *\n * That identity is CONTENT, and content stops one step short of a fleet: two\n * services whose specs word a scenario identically share a digest, so one\n * repository's report matches the other repository's claim. Those claims are\n * refused rather than answered — see {@link contestedDigests}.\n *\n * Parsing is deliberately tolerant of everything except the shape it matches\n * on. The format is what cucumber-js `--format json`, cucumber-jvm, behave and\n * SpecFlow emit — an array of features, each `elements[]` (scenarios) with\n * `name`, `tags[] {name}` and `steps[] {result {status}}`, plus the two\n * places those dialects put a failure the steps never see: cucumber-jvm\n * reports @Before/@After hook results in per-element `before[]`/`after[]`\n * arrays (a teardown assertion fails there while every step stays `passed`),\n * and behave carries an element-level `status` that a hook failure flips.\n * Only those fields are contract: unknown fields, tagless elements\n * (backgrounds, hand-written scenarios) and stray entries are skipped without\n * comment. What is NOT tolerated is a file that is not that array at all: a\n * report loam cannot recognize must refuse rather than quietly answer every\n * claim \"not found\".\n */\nimport { DIGEST_TAG_RE, scenarioDigestTag } from \"./gherkin/stamp.js\";\nimport { isRecord } from \"./kernel/records.js\";\nimport type { Answer } from \"./verify/answers.js\";\nimport type { Claim } from \"./verify/checklist.js\";\n\n/** One report scenario, reduced to what matching needs. */\nexport interface ReportScenario {\n  /** `<feature uri or name> › <scenario name>` — where the run can be seen. */\n  where: string;\n  /** Digests carried as `@loam-digest-…` tags. Usually one; hand-tagging can add more. */\n  digests: string[];\n  /** Step statuses, lowercased, in order. */\n  steps: string[];\n  /** Hook statuses from cucumber-jvm's `before[]`/`after[]`, lowercased, in order. */\n  hooks: string[];\n  /** behave's element-level status, lowercased — absent in the other dialects. */\n  status?: string;\n}\n\nexport type ReportRead =\n  | { ok: true; scenarios: ReportScenario[] }\n  | { ok: false; message: string };\n\n/**\n * Read a parsed cucumber JSON document down to its digest-tagged scenarios.\n * `reportName` is how the caller spelled the file, for the refusal message.\n */\n/** The marker key that makes a JSON document loam's own scenario shape, and the version this loam reads. */\nexport const SCENARIO_REPORT_MARKER = \"loamScenarioReport\";\nexport const SCENARIO_REPORT_VERSION = 1;\n\n/**\n * Is this document loam's own scenario-report shape rather than a cucumber one?\n *\n * Marker-only, deliberately: the caller must be able to choose a READER before\n * either has validated anything, so that a malformed `loamScenarioReport` file\n * refuses as a malformed report of ITS kind rather than as \"not a cucumber\n * array\". A file that claims the shape and then fails it must never fall\n * through to the other parser and be told it is the wrong sort of document.\n */\nexport function isScenarioReport(doc: unknown): boolean {\n  return isRecord(doc) && doc[SCENARIO_REPORT_MARKER] !== undefined;\n}\n\n/**\n * `{\"loamScenarioReport\": 1, \"results\": [{\"digest\": \"…\", \"status\": \"passed\"}]}`\n * — the runner-neutral answer sheet for `scenario.tested` claims.\n *\n * WHY THIS EXISTS. `loam gherkin` stamps every generated scenario\n * `@loam-digest-<16hex>`, and until now only cucumber's JSON carried that tag\n * back. A fleet on JUnit, pytest, Playwright, Vitest or a house runner could\n * therefore never reach `verified` — not because its evidence was weaker, but\n * because of a file format. The example fleet's own shipped record is the proof\n * of the cost: every claim in it is `answered_by: agent`, so the product's\n * showcase demonstrates only the lesser verdict.\n *\n * THE STANDARD OF PROOF IS UNCHANGED, and that is the whole argument. The\n * contract was never the JSON dialect: it is the digest — content-derived, so\n * rewording a `Given` breaks the match — plus a status that says a real run\n * reported it green. Both halves are here. An answer from this file is\n * `answered_by: runner` exactly as a cucumber one is, because it is the same\n * claim answered to the same standard by the same identity.\n *\n * It also adds no forgeability. loam cannot prove any JSON came from executing\n * a commit — SCHEMA says so, and the record stores the file's sha256 and mtime\n * precisely because that is all it can honestly claim. A hand-written cucumber\n * array was always exactly as easy to write as this is.\n *\n * The strict/tolerant split mirrors `verify/evidence/contract.ts` for its\n * reason: a cucumber report is another tool's file full of entries loam has no\n * business judging, while this shape exists for one purpose, so a malformed\n * entry is a malformed report rather than scenery to skip. `status` must be\n * exactly `passed` or `failed`; `skipped`, `pending` and vendor spellings are\n * refused rather than guessed at, because guessing is how a not-run scenario\n * becomes a confirmation.\n */\nexport function readScenarioReport(doc: unknown, reportName: string): ReportRead {\n  if (!isRecord(doc)) {\n    return { ok: false, message: `${reportName} is not a JSON object.` };\n  }\n  const version = doc[SCENARIO_REPORT_MARKER];\n  if (version !== SCENARIO_REPORT_VERSION) {\n    return {\n      ok: false,\n      message:\n        `${reportName} declares \\`${SCENARIO_REPORT_MARKER}: ${JSON.stringify(version)}\\`, and this loam reads ` +\n        `version ${SCENARIO_REPORT_VERSION}. A report loam cannot read is refused rather than answered in part.`,\n    };\n  }\n  const results = doc[\"results\"];\n  if (!Array.isArray(results)) {\n    return {\n      ok: false,\n      message: `${reportName} has no \\`results\\` array — the shape is {\"${SCENARIO_REPORT_MARKER}\": 1, \"results\": [{\"digest\": \"…\", \"status\": \"passed\"}]}.`,\n    };\n  }\n  const scenarios: ReportScenario[] = [];\n  for (const [i, entry] of results.entries()) {\n    const at = `${reportName} results[${i}]`;\n    if (!isRecord(entry)) return { ok: false, message: `${at} is not an object.` };\n    const digest = str(entry[\"digest\"]);\n    if (digest === undefined || !/^[0-9a-f]{16}$/.test(digest)) {\n      return {\n        ok: false,\n        message: `${at} has no \\`digest\\` of 16 lowercase hex characters — that is the \\`@loam-digest-…\\` tag \\`loam gherkin\\` stamped on the scenario.`,\n      };\n    }\n    const status = str(entry[\"status\"]);\n    if (status !== \"passed\" && status !== \"failed\") {\n      return {\n        ok: false,\n        message:\n          `${at} has \\`status: ${JSON.stringify(entry[\"status\"])}\\`; this shape accepts only \"passed\" or \"failed\". ` +\n          \"A scenario that did not run has no place in an answer sheet — omit it, and its claim stays unanswered rather than becoming a confirmation.\",\n      };\n    }\n    scenarios.push({\n      // The runner's own name for the test, when it gave one — this is where a\n      // reader goes to see the run, and it is the only free text here.\n      where: str(entry[\"test\"]) ?? `(${SCENARIO_REPORT_MARKER} entry ${i})`,\n      digests: [digest],\n      steps: [status],\n      hooks: [],\n    });\n  }\n  return { ok: true, scenarios };\n}\n\nexport function readCucumberReport(doc: unknown, reportName: string): ReportRead {\n  if (!Array.isArray(doc)) {\n    return {\n      ok: false,\n      message:\n        `${reportName} is not a cucumber JSON report — expected the top-level array of features ` +\n        \"that `cucumber-js --format json` (or cucumber-jvm, behave, SpecFlow) emits.\",\n    };\n  }\n  const scenarios: ReportScenario[] = [];\n  for (const feature of doc) {\n    if (!isRecord(feature)) continue;\n    const featureName = str(feature[\"uri\"]) ?? str(feature[\"name\"]) ?? \"(unnamed feature)\";\n    const elements = feature[\"elements\"];\n    if (!Array.isArray(elements)) continue;\n    for (const el of elements) {\n      if (!isRecord(el)) continue;\n      const digests: string[] = [];\n      const tags = el[\"tags\"];\n      if (Array.isArray(tags)) {\n        for (const t of tags) {\n          const name = typeof t === \"string\" ? t : isRecord(t) ? str(t[\"name\"]) : undefined;\n          const m = name === undefined ? null : DIGEST_TAG_RE.exec(name);\n          if (m) digests.push(m[1]!);\n        }\n      }\n      // No digest tag, nothing to match: a background, a hand-written\n      // scenario, another tool's output. Invisible here, deliberately.\n      if (digests.length === 0) continue;\n      const resultStatuses = (raw: unknown): string[] => {\n        if (!Array.isArray(raw)) return [];\n        return raw.map((s) => {\n          const status = isRecord(s) && isRecord(s[\"result\"]) ? str(s[\"result\"][\"status\"]) : undefined;\n          return (status ?? \"unknown\").toLowerCase();\n        });\n      };\n      const steps = resultStatuses(el[\"steps\"]);\n      // cucumber-jvm's @Before/@After hooks: separate arrays, same result shape.\n      const hooks = [...resultStatuses(el[\"before\"]), ...resultStatuses(el[\"after\"])];\n      // behave's element-level status — a hook failure flips it while the\n      // steps that already ran keep \"passed\".\n      const status = str(el[\"status\"])?.toLowerCase();\n      scenarios.push({\n        where: `${featureName} › ${str(el[\"name\"]) ?? \"(unnamed scenario)\"}`,\n        digests,\n        steps,\n        hooks,\n        ...(status === undefined ? {} : { status }),\n      });\n    }\n  }\n  return { ok: true, scenarios };\n}\n\n/**\n * The digests that more than one service claims, with the services that claim\n * them — a scenario worded identically in two services' specs.\n *\n * The digest is a hash of the scenario body and of nothing else, so `loam\n * gherkin` stamps the same tag into both repositories and a report from either\n * one matches both claims. A report says which scenario ran; it never says\n * whose suite ran it, and the two repositories never ran each other's tests.\n * loam has no way to tell them apart, so it does not choose: the answer is\n * refused, with the services named, and `--service` is the way to give a report\n * an owner (it narrows the checklist to one repository's claims before the\n * matching starts, so nothing here is contested).\n *\n * Only the SERVICE boundary counts. One service's spec repeating a scenario\n * word for word is genuinely one test — that is the documented meaning of the\n * stamp — and both claims may be answered by the one run.\n */\nexport function contestedDigests(claims: readonly Claim[]): Map<string, string[]> {\n  const owners = new Map<string, Set<string>>();\n  for (const c of claims) {\n    if (c.digest === undefined) continue;\n    const seen = owners.get(c.digest) ?? new Set<string>();\n    seen.add(c.subject);\n    owners.set(c.digest, seen);\n  }\n  const contested = new Map<string, string[]>();\n  for (const [digest, services] of owners) {\n    if (services.size > 1) contested.set(digest, [...services].sort());\n  }\n  return contested;\n}\n\n/**\n * Answer every claim from the report — the runner's half of the record. Meant\n * for `scenario.tested` claims (the only kind carrying a digest); a claim\n * without one is answered `unconfirmed` rather than skipped, because silence\n * must never read as checked.\n *\n * Confirmation is strict on purpose: every matching occurrence — a digest the\n * report holds twice is a re-run, and all of them count — ran at least one\n * step, every step `passed`, every before/after hook `passed`, and the\n * element-level status (when the dialect reports one) is `passed`. One failed\n * occurrence wins as failure, a skipped-only run is \"skipped\" not green, and\n * no match at all is \"not found in report\". A digest two services share is\n * refused before any of that: see {@link contestedDigests}.\n */\nexport function runnerAnswers(\n  claims: Claim[],\n  scenarios: ReportScenario[],\n  reportName: string,\n): Answer[] {\n  const contested = contestedDigests(claims);\n  return claims.map((c) => {\n    const rivals = c.digest === undefined ? undefined : contested.get(c.digest);\n    if (rivals !== undefined) {\n      return answer(\n        c.id,\n        \"unconfirmed\",\n        [],\n        `${scenarioDigestTag(c.digest!)} is worded identically in ${rivals.join(\", \")}, so ${reportName} cannot say whose suite ran it. ` +\n          \"Record each service's claims from its own repo with --service.\",\n      );\n    }\n    const runs = c.digest === undefined ? [] : scenarios.filter((s) => s.digests.includes(c.digest!));\n    if (runs.length === 0) {\n      const tag = c.digest === undefined ? \"a digest tag\" : scenarioDigestTag(c.digest);\n      return answer(c.id, \"unconfirmed\", [], `not found in report — no scenario in ${reportName} carries ${tag}`);\n    }\n    const failing = runs.filter((r) => !passed(r));\n    if (failing.length === 0) {\n      return answer(c.id, \"confirmed\", runs.map((r) => `${reportName}: ${r.where}`));\n    }\n    const first = failing[0]!;\n    const rerun = runs.length > 1 ? ` — ${failing.length} of ${runs.length} matching runs failed` : \"\";\n    return answer(c.id, \"unconfirmed\", [], `${reason(first)} (${reportName}: ${first.where})${rerun}`);\n  });\n}\n\nfunction answer(id: string, verdict: Answer[\"verdict\"], evidence: string[], note?: string): Answer {\n  return { id, verdict, evidence, ...(note === undefined ? {} : { note }), answered_by: \"runner\" };\n}\n\n/**\n * Green means green: at least one step, every step `passed`, every before/\n * after hook `passed`, and the element-level status (when the dialect carries\n * one) `passed` too. The last two exist because a run the runner itself\n * reports as FAILED — a teardown assertion in an @After hook, exactly the\n * shape the arch axis's outbox checks take — used to read as confirmed here:\n * the steps all passed, and the hook failure lived in fields nobody read.\n */\nfunction passed(r: ReportScenario): boolean {\n  return (\n    r.steps.length > 0 &&\n    r.steps.every((s) => s === \"passed\") &&\n    r.hooks.every((h) => h === \"passed\") &&\n    (r.status === undefined || r.status === \"passed\")\n  );\n}\n\n/** Why a run did not pass, naming the step, hook or element status that says so. */\nfunction reason(r: ReportScenario): string {\n  if (r.steps.length === 0) return \"no steps ran\";\n  const i = r.steps.findIndex((s) => s !== \"passed\" && s !== \"skipped\");\n  if (i >= 0) return `${r.steps[i]} at step ${i + 1}`;\n  if (r.steps.some((s) => s === \"skipped\")) return \"skipped\";\n  const h = r.hooks.findIndex((s) => s !== \"passed\");\n  if (h >= 0) return `${r.hooks[h]} in a before/after hook`;\n  return `scenario status '${r.status ?? \"unknown\"}'`;\n}\n\nfunction str(v: unknown): string | undefined {\n  return typeof v === \"string\" && v.trim().length > 0 ? v : undefined;\n}\n"]}