@ybotok/loam 0.2.0-alpha.1 → 0.2.0-alpha.13

package/dist/commands/archive/run.js

@@ -9,23 +9,29 @@
  * and swapped. `--dry-run` returns between the second and the third.
  */
 import { existsSync } from "node:fs";
-import { mkdir, rename } from "node:fs/promises";
-import { emitJson, repoPath, sayExplain } from "../../core/envelope/json.js";
-import { message, quietPruneEmptyParents, quietRm, rollbackError, rollbackStaged, stageWrites, swapStaged, } from "../../core/staging/commit.js";
+import { rename } from "node:fs/promises";
+import { CodedFailure, emitJson, repoPath, sayExplain } from "../../core/envelope/json.js";
+import { message, mkdirReportingCreated, quietPruneEmptyParents, quietRm, rollbackError, rollbackStaged, stageWrites, swapStaged, } from "../../core/staging/commit.js";
 import { clearCommitIntent, writeCommitIntent } from "../../core/staging/recovery/intent.js";
-import { SNAPSHOT_DIR, SnapshotClobberError, snapshotDir, writeSnapshot, } from "../../core/staging/snapshot.js";
+import { SNAPSHOT_DIR, snapshotDir } from "../../core/staging/snapshot/manifest.js";
+import { SnapshotClobberError, writeSnapshot } from "../../core/staging/snapshot/snapshot.js";
 import { enumeratedServices } from "../../core/repo/service-target.js";
+import { listFleetTree } from "../../core/repo/repo.js";
+import { serviceViewsPath, subsystemViewsPath } from "../../core/repo/paths.js";
+import { serviceViewsState, viewsState } from "../../core/repo/tree/render/stale.js";
+import { loadArchitecture } from "../../core/c4/project/architecture.js";
 import { FleetContext } from "../../core/fleet-context.js";
 import { gate } from "./plan/gate.js";
-import {} from "./plan/refusal.js";
+import { issueJson, printPlan, refuseJson } from "./plan/refusal.js";
 import { planCapabilities, planGlossary, planSpecs } from "./plan/specs.js";
 import { planOpenapiContracts } from "./plan/contracts/openapi.js";
 import { planAsyncapiContracts } from "./plan/contracts/asyncapi.js";
-import { planFlows, planLandscape } from "./plan/landscape.js";
+import { contractConsumers } from "./plan/contracts/consumers.js";
+import { planDeployments, planFlows, planLandscape } from "./plan/landscape.js";
+import { planFeatureLinks, planInboundLinks } from "./plan/document/links.js";
 import { emptyPlan } from "./plan/state.js";
-import { issueJson, refuseJson } from "./plan/refusal.js";
-import { ArchiveFailure } from "./plan/refusal.js";
-import { printPlan } from "./plan/refusal.js";
+import { checklistAtArchive } from "./shipped.js";
+import { outstandingLines } from "./closing.js";
 export async function archiveLocked(config, featureId, opts) {
     const dryRun = opts.dryRun === true;
     const json = opts.json === true;
@@ -59,16 +65,34 @@ export async function archiveLocked(config, featureId, opts) {
     // a create-only whole-file copy, refused at the gate if the word already
     // lives (`core/glossary/delta.ts`).
     await planGlossary(read, gated, planned, say);
-    await planOpenapiContracts(read, gated, planned, say);
-    await planAsyncapiContracts(read, gated, planned, say);
-    await planLandscape(config, gated, planned, say);
+    // One consumer index for both contract planners, built only if one of them
+    // overwrites an operation or a message (./plan/contracts/consumers.ts) —
+    // and then over the living fleet as it stands before this merge.
+    const contracts = { ...read, consumers: contractConsumers(read) };
+    await planOpenapiContracts(contracts, gated, planned, say);
+    await planAsyncapiContracts(contracts, gated, planned, say);
+    // `read`, not `config`: the C4 merge now asks which services own their own
+    // interior, and that answer comes from the fleet enumeration this run has
+    // already paid for.
+    await planLandscape(read, gated, planned, say);
     // The flows this feature brings, after the elements they draw hops over: the
     // copy is create-only and refused at the gate if the living tree already holds
     // one (`core/usecases/delta/flows.ts`), and it is ordered after the landscape
     // merge so a reader of the plan sees the map change before the sequence drawn
     // on it.
     await planFlows(config, gated, planned, say);
+    await planDeployments(config, gated, planned, say);
+    // After the merges, because it is the move rather than a merge: the feature's own
+    // documents ride the rename into features/archive/, and their links out of
+    // the feature are re-expressed for it in this same commit
+    // (./plan/document/links.ts) — planned at their current paths, swapped before
+    // the rename carries them, and parked in the snapshot like every other write.
+    await planFeatureLinks(config, gated, planned, say);
+    // And the links the rest of the corpus holds INTO the feature, after every
+    // merge so a document the merge rewrites is relinked from its merged text.
+    await planInboundLinks(read, gated, planned, say);
     const { writes, planWarns, planGates, openapiRemovals, asyncapiRemovals } = planned;
+    const revouchOwed = planned.revouchOwed.map((r) => ({ ...r, path: repoPath(config.docsDir, r.path) }));
     // Gate on what only the plan could see: a merged operation pointing at a
     // component that exists nowhere, a removal marker addressing no operation.
     // Same doctrine as the coherence gate — a judgment call --approve overrides
@@ -94,6 +118,17 @@ export async function archiveLocked(config, featureId, opts) {
         for (const i of planGates)
             say(`      ✗ ${i.message}`);
     }
+    // Printed by the dry run and the real merge alike, before either commits to
+    // anything: the merge is what moves these documents, and the merge's PR is
+    // the place their re-vouches belong. Not a finding and not a refusal — the
+    // staleness that follows is honest, and `content.stale` is what grades it.
+    if (revouchOwed.length > 0) {
+        say(`\n  re-vouch owed — this merge moves ${revouchOwed.length} vouched spec(s) under the vouch stamp, so content.stale follows on each until its owner re-vouches:`);
+        for (const r of revouchOwed) {
+            say(`    ${r.path}  (owner: ${r.owner ?? "none recorded"}) — \`loam vouch --service ${r.service}\`, run in that service's repo`);
+        }
+        say(`    land the re-vouches in this PR: \`loam validate --all --base <ref> --strict\` stays red on it until they do.`);
+    }
     // The plan as data, verb decided now — after the commit everything would read
     // as an update. The `--json` payload is identical for a dry run and the real
     // thing except for `archived`; what WOULD happen is what DOES happen.
@@ -114,6 +149,9 @@ export async function archiveLocked(config, featureId, opts) {
         overridden: overridden.map((issue) => issueJson(issue, repoPath(config.docsDir, archiveDest))),
         openapiRemovals,
         asyncapiRemovals,
+        revouchOwed,
+        // What the requirement merge takes away (./plan/specs.ts). Additive.
+        dropped: planned.dropped.map((row) => ({ ...row, path: repoPath(config.docsDir, row.path) })),
         // Present only when this run found an interrupted commit and dealt with it:
         // an agent that sees the docs change under it deserves to be told why, and
         // the absent field is the ordinary case.
@@ -122,10 +160,16 @@ export async function archiveLocked(config, featureId, opts) {
     if (dryRun) {
         if (json)
             emitJson(payload(false));
+        // What the real run would print in place of its closing line, said BEFORE
+        // anything is written — the one moment a reader can still act on it.
         else
-            printPlan(config.docsDir, writes, dirName);
+            printPlan(config.docsDir, writes, dirName, outstandingLines({ advisory, planWarns, overridden, staleViews: [], dryRun: true }));
         return;
     }
+    // The question the feature asks as it ships, captured before anything below
+    // moves the living docs it is derived from — see ./shipped.ts. It rides in
+    // the snapshot manifest; a dry run writes no snapshot, so it pays nothing.
+    const checklist = await checklistAtArchive(read, gated);
     // COMMIT — the whole plan computed cleanly. Stage every new version beside its
     // target, snapshot what is about to be overwritten, then swap them into place.
     // Staging touches the filesystem — a read-only `architecture/`, a full disk,
@@ -137,10 +181,10 @@ export async function archiveLocked(config, featureId, opts) {
         staged = await stageWrites(writes);
     }
     catch (err) {
-        throw new ArchiveFailure("merge-failed", `${message(err)} — nothing was written`);
+        throw new CodedFailure("merge-failed", `${message(err)} — nothing was written`);
     }
     let snapshot = false;
-    let createdArchiveDir;
+    let createdArchiveDir = null;
     try {
         // The snapshot's resolver pair: how a docs-relative path decomposes into a
         // service identity, and where that identity lives NOW. Built here — the
@@ -168,11 +212,13 @@ export async function archiveLocked(config, featureId, opts) {
         const serviceDirOf = (service) => dirOf.get(service) ?? null;
         await writeSnapshot({
             featureDir,
+            movesTo: archiveDest,
             docsDir: config.docsDir,
             feature: { featureId: id, dirName },
             staged,
             serviceKeyOf,
             serviceDirOf,
+            ...(checklist === undefined ? {} : { checklist }),
         });
         snapshot = true;
         // The journal, fsynced, BEFORE the first rename: swapStaged is N renames and
@@ -182,7 +228,7 @@ export async function archiveLocked(config, featureId, opts) {
         // it records the same digests the swaps are about to produce.
         await writeCommitIntent(config.docsDir, { command: "archive", restore: "before", feature: id, moveFrom: featureDir, moveTo: archiveDest }, staged);
         await swapStaged(staged);
-        createdArchiveDir = await mkdir(archiveDir, { recursive: true });
+        createdArchiveDir = await mkdirReportingCreated(archiveDir);
         await rename(featureDir, archiveDest);
         // Last: while it exists, the commit is in flight.
         await clearCommitIntent(config.docsDir);
@@ -194,11 +240,11 @@ export async function archiveLocked(config, featureId, opts) {
             // the answer is not "re-run": a previous archive of this feature is still
             // sitting in the living docs.
             await rollbackStaged(staged);
-            throw new ArchiveFailure("commit-interrupted", err.message);
+            throw new CodedFailure("commit-interrupted", err.message);
         }
         // Everything this run made, unmade: the swapped files, the snapshot inside the
         // feature that is staying put, and features/archive/ if we are the ones who
-        // created it (mkdir reports nothing when it was already there).
+        // created it (mkdirReportingCreated reports null when it was already there).
         const failures = await rollbackStaged(staged);
         // The rollback decided the outcome, so the journal has nothing left to
         // describe — including on rollback-incomplete, where the files it names are
@@ -216,7 +262,7 @@ export async function archiveLocked(config, featureId, opts) {
         // and a recursive remove of "the directory we created" took that feature —
         // snapshot and all — with it, on OUR failure path, in silence. Empty
         // directories only, stopping at the first that is not.
-        if (createdArchiveDir !== undefined)
+        if (createdArchiveDir !== null)
             await quietPruneEmptyParents(archiveDir, createdArchiveDir);
         // The code is a caller's answer to "can I trust the repo?": merge-failed
         // means yes (rolled back), rollback-incomplete means look at it by hand.
@@ -224,28 +270,86 @@ export async function archiveLocked(config, featureId, opts) {
         const kept = snapshot && failures.length > 0
             ? ` Pre-images of the overwritten files are kept in features/${dirName}/${SNAPSHOT_DIR}/files/.`
             : "";
-        throw new ArchiveFailure(failures.length > 0 ? "rollback-incomplete" : "merge-failed", wrapped.message + kept);
+        throw new CodedFailure(failures.length > 0 ? "rollback-incomplete" : "merge-failed", wrapped.message + kept);
     }
+    // This merge just changed the map, and both generated views files are a
+    // function of the tree AND the map: a delta whose element lands inside a
+    // group that exactly covered a subsystem takes that subsystem's boundary
+    // line away, a delta binding an element to a filed service adds an include,
+    // and one new edge changes exactly one service's overview. Archive does not
+    // rewrite either file — `loam subsystem sync` owns them outright, and folding
+    // a second generated artifact into this transaction would mean archive
+    // computing the post-merge tree AND the post-merge map, which is how the two
+    // writers disagree — but it must not report a repo as current when the next
+    // `validate --all` will call it stale. Graded through validate's own
+    // functions, so the two cannot answer differently.
+    const staleViews = await staleGeneratedViews(config.docsDir);
     if (json) {
-        emitJson(payload(true));
+        emitJson({
+            ...payload(true),
+            // The original boolean keeps its exact meaning — `architecture/subsystems.likec4`
+            // and nothing else — because a payload key's meaning is frozen; the list
+            // beside it is the additive answer that can name the second file. Both are
+            // omitted when nothing is stale, exactly as the boolean always was.
+            ...(staleViews.length === 0 ? {} : { staleViews }),
+            ...(staleViews.includes("architecture/subsystems.likec4") ? { subsystemViewsStale: true } : {}),
+        });
         return;
     }
     console.log(`\n  archived: features/${dirName} → features/archive/${dirName}`);
     console.log(`  snapshot: features/archive/${dirName}/${SNAPSHOT_DIR}/ — \`loam unarchive ${id}\` puts it back`);
     // The closing line is a claim about the whole docs repo, and it is the line a
     // reader stops at. It may be printed only when this archive left nothing the
-    // next `validate --all` will fail on — a service with no model, or a gate the
-    // caller told it to merge past. Printing it over either is how a red fleet
-    // gets reported as a finished one.
-    const incomplete = planWarns.filter((w) => w.code === "service.no-model");
-    if (incomplete.length === 0 && overridden.length === 0) {
+    // next `validate --all` will fail on; ./closing.ts lists every reason it
+    // cannot be, and those lines are printed instead. Printing it over any of
+    // them is how a red fleet gets reported as a finished one.
+    const owed = outstandingLines({ advisory, planWarns, overridden, staleViews, dryRun: false });
+    if (owed.length === 0) {
         console.log("  living spec + landscape are now complete + current.");
         return;
     }
-    for (const w of incomplete)
-        console.log(`  ⚠ ${w.message}`);
-    if (overridden.length > 0) {
-        console.log(`  ⚠ merged past ${overridden.length} gating issue(s) with --approve — the living docs carry them now; \`loam validate --all\` says what they cost.`);
+    for (const line of owed)
+        console.log(line);
+}
+/**
+ * Which generated files would the next `validate --all` report
+ * `subsystem.views-stale` on? Docs-relative paths, sorted, empty for none.
+ *
+ * Asked through validate's OWN functions rather than a second compare, so the
+ * warning archive prints and the error validate raises can never disagree —
+ * including about the gate validate holds: a map that does not parse is
+ * `landscape.invalid`'s business, and grading a generated file against a map
+ * nobody can read would cascade a second complaint behind the first. An
+ * unreadable map therefore answers "no claim", exactly as validate does.
+ *
+ * BOTH generated files, because this merge just changed the map and the
+ * per-service overviews are a function of it in a way the subsystem views are
+ * not: a delta adding one edge changes exactly one service's peer set, and a
+ * delta binding a new element adds a whole view. Naming only the file loam
+ * happened to check first would let a repo be reported current while the very
+ * next `validate --all` calls it stale — the one thing this advisory exists to
+ * prevent.
+ */
+async function staleGeneratedViews(docsDir) {
+    try {
+        const doc = await loadArchitecture(docsDir);
+        if (doc.errors.length > 0)
+            return [];
+        const tree = await listFleetTree(docsDir);
+        const stale = [];
+        if (!(await viewsState(subsystemViewsPath(docsDir), tree, doc)).agrees)
+            stale.push("architecture/subsystems.likec4");
+        if (!(await serviceViewsState(serviceViewsPath(docsDir), tree, doc)).agrees) {
+            stale.push("architecture/services.likec4");
+        }
+        return stale.sort();
+    }
+    catch {
+        // Tolerant for the reason the snapshot resolver above is: a docs repo with
+        // no `services/` at all still archives a landscape-only feature, and this
+        // question is an ADVISORY printed after a commit that already succeeded.
+        // Nothing here may turn a landed archive into a non-zero exit.
+        return [];
     }
 }
 //# sourceMappingURL=run.js.map

package/dist/commands/archive/run.js.map

@@ -1 +1 @@
-{"version":3,"file":"run.js","sourceRoot":"","sources":["../../../src/commands/archive/run.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAC7E,OAAO,EACL,OAAO,EACP,sBAAsB,EACtB,OAAO,EACP,aAAa,EACb,cAAc,EACd,WAAW,EACX,UAAU,GACX,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAC7F,OAAO,EACL,YAAY,EACZ,oBAAoB,EACpB,WAAW,EACX,aAAa,GAEd,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AACtC,OAAO,EAAuB,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5E,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAG9C,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAA4B,EAC5B,SAAiB,EACjB,IAAoB;IAEpB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC;IACpC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC;IAChC,+EAA+E;IAC/E,MAAM,GAAG,GAAG,CAAC,IAAI,GAAG,EAAE,EAAQ,EAAE;QAC9B,IAAI,CAAC,IAAI;YAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC,CAAC;IAEF,qEAAqE;IACrE,yEAAyE;IACzE,2EAA2E;IAC3E,yEAAyE;IACzE,yEAAyE;IACzE,yEAAyE;IACzE,4BAA4B;IAC5B,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,YAAY,EAAE,EAAE,CAAC;IACpE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IACrD,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO;IAC3B,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IAExG,GAAG,CAAC,WAAW,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IAErD,gFAAgF;IAChF,uEAAuE;IACvE,MAAM,OAAO,GAAG,SAAS,EAAE,CAAC;IAC5B,MAAM,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAC3C,6EAA6E;IAC7E,wEAAwE;IACxE,yEAAyE;IACzE,MAAM,gBAAgB,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAClD,0EAA0E;IAC1E,yEAAyE;IACzE,oCAAoC;IACpC,MAAM,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAC9C,MAAM,oBAAoB,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IACtD,MAAM,qBAAqB,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IACvD,MAAM,aAAa,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IACjD,6EAA6E;IAC7E,+EAA+E;IAC/E,8EAA8E;IAC9E,8EAA8E;IAC9E,SAAS;IACT,MAAM,SAAS,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAC7C,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,eAAe,EAAE,gBAAgB,EAAE,GAAG,OAAO,CAAC;IAEpF,yEAAyE;IACzE,2EAA2E;IAC3E,4EAA4E;IAC5E,6EAA6E;IAC7E,0EAA0E;IAC1E,2BAA2B;IAC3B,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAC1C,MAAM,GAAG,GAAG,WAAW,EAAE,eAAe,SAAS,CAAC,MAAM,iCAAiC,CAAC;QAC1F,IAAI,IAAI,EAAE,CAAC;YACT,UAAU,CACR,cAAc,EACd,GAAG,EACH,CAAC,GAAG,MAAM,EAAE,GAAG,SAAS,EAAE,GAAG,SAAS,CAAC,EACvC,YAAY,OAAO,EAAE,CACtB,CAAC;YACF,OAAO;QACT,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC;QACzB,KAAK,MAAM,CAAC,IAAI,SAAS;YAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7D,OAAO,CAAC,KAAK,CAAC,sGAAsG,CAAC,CAAC;QACtH,UAAU,CAAC,cAAc,CAAC,CAAC;QAC3B,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,GAAG,CAAC,2BAA2B,SAAS,CAAC,MAAM,uCAAuC,CAAC,CAAC;QACxF,KAAK,MAAM,CAAC,IAAI,SAAS;YAAE,GAAG,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IACzD,CAAC;IAED,8EAA8E;IAC9E,6EAA6E;IAC7E,sEAAsE;IACtE,MAAM,QAAQ,GAAG,CAAC,GAAG,QAAQ,EAAE,GAAG,SAAS,CAAC,CAAC;IAC7C,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1E,MAAM,IAAI,GAAmC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC9D,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC;QACtC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;KACjD,CAAC,CAAC,CAAC;IACJ,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,oBAAoB,OAAO,EAAE,EAAE,CAAC,CAAC;IAC9F,MAAM,OAAO,GAAG,CAAC,QAAiB,EAA2B,EAAE,CAAC,CAAC;QAC/D,OAAO,EAAE,SAAS;QAClB,OAAO,EAAE,EAAE;QACX,QAAQ;QACR,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC;QAC3C,IAAI;QACJ,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;QAC1F,UAAU,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;QAC9F,eAAe;QACf,gBAAgB;QAChB,4EAA4E;QAC5E,2EAA2E;QAC3E,yCAAyC;QACzC,GAAG,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;KAC7C,CAAC,CAAC;IAEH,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,IAAI;YAAE,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;;YAC9B,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QAChD,OAAO;IACT,CAAC;IAED,+EAA+E;IAC/E,+EAA+E;IAC/E,6EAA6E;IAC7E,8EAA8E;IAC9E,wEAAwE;IACxE,6EAA6E;IAC7E,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,cAAc,CAAC,cAAc,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,iBAAqC,CAAC;IAC1C,IAAI,CAAC;QACH,2EAA2E;QAC3E,wEAAwE;QACxE,0EAA0E;QAC1E,mEAAmE;QACnE,uEAAuE;QACvE,uEAAuE;QACvE,uEAAuE;QACvE,uEAAuE;QACvE,0EAA0E;QAC1E,uDAAuD;QACvD,mEAAmE;QACnE,wEAAwE;QACxE,iEAAiE;QACjE,sEAAsE;QACtE,MAAM,KAAK,GAAG,IAAI,GAAG,CACnB,CAAC,MAAM,kBAAkB,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CACrH,CAAC;QACF,MAAM,YAAY,GAAG,CAAC,GAAW,EAAqB,EAAE;YACtD,KAAK,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,KAAK,EAAE,CAAC;gBACnC,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,GAAG,GAAG,CAAC;oBAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;YACzF,CAAC;YACD,MAAM,CAAC,GAAG,2BAA2B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAChD,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACxD,CAAC,CAAC;QACF,MAAM,YAAY,GAAG,CAAC,OAAe,EAAiB,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC;QACpF,MAAM,aAAa,CAAC;YAClB,UAAU;YACV,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,OAAO,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE;YACnC,MAAM;YACN,YAAY;YACZ,YAAY;SACb,CAAC,CAAC;QACH,QAAQ,GAAG,IAAI,CAAC;QAChB,6EAA6E;QAC7E,yEAAyE;QACzE,6EAA6E;QAC7E,2EAA2E;QAC3E,8DAA8D;QAC9D,MAAM,iBAAiB,CACrB,MAAM,CAAC,OAAO,EACd,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,EACjG,MAAM,CACP,CAAC;QACF,MAAM,UAAU,CAAC,MAAM,CAAC,CAAC;QACzB,iBAAiB,GAAG,MAAM,KAAK,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACjE,MAAM,MAAM,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;QACtC,kDAAkD;QAClD,MAAM,iBAAiB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,oBAAoB,EAAE,CAAC;YACxC,mEAAmE;YACnE,0EAA0E;YAC1E,0EAA0E;YAC1E,8BAA8B;YAC9B,MAAM,cAAc,CAAC,MAAM,CAAC,CAAC;YAC7B,MAAM,IAAI,cAAc,CAAC,oBAAoB,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QAC9D,CAAC;QACD,+EAA+E;QAC/E,4EAA4E;QAC5E,gEAAgE;QAChE,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,CAAC;QAC9C,uEAAuE;QACvE,4EAA4E;QAC5E,iDAAiD;QACjD,MAAM,iBAAiB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACxC,2EAA2E;QAC3E,4EAA4E;QAC5E,4EAA4E;QAC5E,6EAA6E;QAC7E,4EAA4E;QAC5E,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC;QAC9E,0EAA0E;QAC1E,0EAA0E;QAC1E,2EAA2E;QAC3E,qEAAqE;QACrE,uDAAuD;QACvD,IAAI,iBAAiB,KAAK,SAAS;YAAE,MAAM,sBAAsB,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC;QACjG,yEAAyE;QACzE,yEAAyE;QACzE,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC7C,MAAM,IAAI,GACR,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;YAC7B,CAAC,CAAC,6DAA6D,OAAO,IAAI,YAAY,UAAU;YAChG,CAAC,CAAC,EAAE,CAAC;QACT,MAAM,IAAI,cAAc,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,cAAc,EAAE,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IACjH,CAAC;IAED,IAAI,IAAI,EAAE,CAAC;QACT,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACxB,OAAO;IACT,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,0BAA0B,OAAO,uBAAuB,OAAO,EAAE,CAAC,CAAC;IAC/E,OAAO,CAAC,GAAG,CAAC,gCAAgC,OAAO,IAAI,YAAY,wBAAwB,EAAE,iBAAiB,CAAC,CAAC;IAChH,8EAA8E;IAC9E,6EAA6E;IAC7E,8EAA8E;IAC9E,2EAA2E;IAC3E,mCAAmC;IACnC,MAAM,UAAU,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,kBAAkB,CAAC,CAAC;IAC1E,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvD,OAAO,CAAC,GAAG,CAAC,uDAAuD,CAAC,CAAC;QACrE,OAAO;IACT,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,UAAU;QAAE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5D,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,GAAG,CACT,mBAAmB,UAAU,CAAC,MAAM,gHAAgH,CACrJ,CAAC;IACJ,CAAC;AACH,CAAC","sourcesContent":["/**\n * The archive itself, under the docs lock: gate, plan, commit.\n *\n * The order is the command's whole safety property. Every refusal happens before\n * a byte is planned (`./plan/gate.ts`), the plan is computed entirely in memory\n * so a failure on any axis leaves the living docs untouched (`./plan/specs.ts`,\n * `./plan/contracts/`, `./plan/landscape.ts`), and only a plan that succeeded\n * on every axis is staged\n * and swapped. `--dry-run` returns between the second and the third.\n */\nimport { existsSync } from \"node:fs\";\nimport { mkdir, rename } from \"node:fs/promises\";\nimport { emitJson, repoPath, sayExplain } from \"../../core/envelope/json.js\";\nimport {\n  message,\n  quietPruneEmptyParents,\n  quietRm,\n  rollbackError,\n  rollbackStaged,\n  stageWrites,\n  swapStaged,\n} from \"../../core/staging/commit.js\";\nimport { clearCommitIntent, writeCommitIntent } from \"../../core/staging/recovery/intent.js\";\nimport {\n  SNAPSHOT_DIR,\n  SnapshotClobberError,\n  snapshotDir,\n  writeSnapshot,\n  type ServiceKey,\n} from \"../../core/staging/snapshot.js\";\nimport { enumeratedServices } from \"../../core/repo/service-target.js\";\nimport { FleetContext } from \"../../core/fleet-context.js\";\nimport { gate } from \"./plan/gate.js\";\nimport { type ArchiveOptions } from \"./plan/refusal.js\";\nimport { planCapabilities, planGlossary, planSpecs } from \"./plan/specs.js\";\nimport { planOpenapiContracts } from \"./plan/contracts/openapi.js\";\nimport { planAsyncapiContracts } from \"./plan/contracts/asyncapi.js\";\nimport { planFlows, planLandscape } from \"./plan/landscape.js\";\nimport { emptyPlan } from \"./plan/state.js\";\nimport { issueJson, refuseJson } from \"./plan/refusal.js\";\nimport { ArchiveFailure } from \"./plan/refusal.js\";\nimport { printPlan } from \"./plan/refusal.js\";\nimport type { DocsDir } from \"../../core/kernel/ids/dirs.js\";\n\nexport async function archiveLocked(\n  config: { docsDir: DocsDir },\n  featureId: string,\n  opts: ArchiveOptions,\n): Promise<void> {\n  const dryRun = opts.dryRun === true;\n  const json = opts.json === true;\n  // All prose goes through here so `--json` keeps stdout a single JSON document.\n  const say = (line = \"\"): void => {\n    if (!json) console.log(line);\n  };\n\n  // One read index for the whole run, threaded through every planner's\n  // config record: gate, the spec merge and both contract merges each hold\n  // per-service loops that resolve living paths through the enumeration, and\n  // without a shared context every one of those calls re-walks the fleet —\n  // O(services²) work under a lock that guarantees the tree is not moving.\n  // The snapshot resolver below reads through the same context, so it pays\n  // for that enumeration too.\n  const read = { docsDir: config.docsDir, fleet: new FleetContext() };\n  const gated = await gate(read, featureId, opts, say);\n  if (gated === null) return;\n  const { id, dirName, featureDir, gating, advisory, archiveDir, archiveDest, recovered, issues } = gated;\n\n  say(`archive ${id}${dryRun ? \"  (dry run)\" : \"\"}\\n`);\n\n  // PLAN — compute every merge in memory. Nothing is written until the whole plan\n  // succeeds, so a failure on any axis leaves the living docs untouched.\n  const planned = emptyPlan();\n  await planSpecs(read, gated, planned, say);\n  // The business corpus, beside the service one and before the contracts: both\n  // are requirement merges, and reading them together is how a plan stays\n  // legible as \"what this feature promises\" followed by \"how it is built\".\n  await planCapabilities(read, gated, planned, say);\n  // The vocabulary the change brings with it, beside the promises it makes:\n  // a create-only whole-file copy, refused at the gate if the word already\n  // lives (`core/glossary/delta.ts`).\n  await planGlossary(read, gated, planned, say);\n  await planOpenapiContracts(read, gated, planned, say);\n  await planAsyncapiContracts(read, gated, planned, say);\n  await planLandscape(config, gated, planned, say);\n  // The flows this feature brings, after the elements they draw hops over: the\n  // copy is create-only and refused at the gate if the living tree already holds\n  // one (`core/usecases/delta/flows.ts`), and it is ordered after the landscape\n  // merge so a reader of the plan sees the map change before the sequence drawn\n  // on it.\n  await planFlows(config, gated, planned, say);\n  const { writes, planWarns, planGates, openapiRemovals, asyncapiRemovals } = planned;\n\n  // Gate on what only the plan could see: a merged operation pointing at a\n  // component that exists nowhere, a removal marker addressing no operation.\n  // Same doctrine as the coherence gate — a judgment call --approve overrides\n  // (unlike the mechanical merge-failed refusals), and a dry run is gated too.\n  // Checked after the whole plan so the refusal costs nothing: no write has\n  // happened yet either way.\n  if (planGates.length > 0 && !opts.approve) {\n    const msg = `archive ${id} — BLOCKED: ${planGates.length} issue(s) in the contract merge`;\n    if (json) {\n      refuseJson(\n        \"not-coherent\",\n        msg,\n        [...issues, ...planWarns, ...planGates],\n        `features/${dirName}`,\n      );\n      return;\n    }\n    console.error(`${msg}:`);\n    for (const i of planGates) console.error(`  ✗ ${i.message}`);\n    console.error(`\\nFix them in the feature's openapi.yaml / asyncapi.yaml — or re-run with --approve to merge anyway.`);\n    sayExplain(\"not-coherent\");\n    process.exitCode = 1;\n    return;\n  }\n  if (planGates.length > 0) {\n    say(`\\n  ⚠ archiving despite ${planGates.length} contract merge issue(s) (--approve):`);\n    for (const i of planGates) say(`      ✗ ${i.message}`);\n  }\n\n  // The plan as data, verb decided now — after the commit everything would read\n  // as an update. The `--json` payload is identical for a dry run and the real\n  // thing except for `archived`; what WOULD happen is what DOES happen.\n  const warnings = [...advisory, ...planWarns];\n  const overridden = opts.approve === true ? [...gating, ...planGates] : [];\n  const plan: Array<Record<string, unknown>> = writes.map((w) => ({\n    path: repoPath(config.docsDir, w.path),\n    action: existsSync(w.path) ? \"update\" : \"create\",\n  }));\n  plan.push({ path: `features/${dirName}`, action: \"move\", to: `features/archive/${dirName}` });\n  const payload = (archived: boolean): Record<string, unknown> => ({\n    command: \"archive\",\n    feature: id,\n    archived,\n    path: repoPath(config.docsDir, archiveDest),\n    plan,\n    warnings: warnings.map((issue) => issueJson(issue, repoPath(config.docsDir, archiveDest))),\n    overridden: overridden.map((issue) => issueJson(issue, repoPath(config.docsDir, archiveDest))),\n    openapiRemovals,\n    asyncapiRemovals,\n    // Present only when this run found an interrupted commit and dealt with it:\n    // an agent that sees the docs change under it deserves to be told why, and\n    // the absent field is the ordinary case.\n    ...(recovered === null ? {} : { recovered }),\n  });\n\n  if (dryRun) {\n    if (json) emitJson(payload(false));\n    else printPlan(config.docsDir, writes, dirName);\n    return;\n  }\n\n  // COMMIT — the whole plan computed cleanly. Stage every new version beside its\n  // target, snapshot what is about to be overwritten, then swap them into place.\n  // Staging touches the filesystem — a read-only `architecture/`, a full disk,\n  // a target whose pre-image cannot be read. None of that is a bug in loam, and\n  // reporting `internal` sends the reader looking for one; it is the same\n  // answer as any other merge that could not be computed: nothing was written.\n  let staged;\n  try {\n    staged = await stageWrites(writes);\n  } catch (err) {\n    throw new ArchiveFailure(\"merge-failed\", `${message(err)} — nothing was written`);\n  }\n  let snapshot = false;\n  let createdArchiveDir: string | undefined;\n  try {\n    // The snapshot's resolver pair: how a docs-relative path decomposes into a\n    // service identity, and where that identity lives NOW. Built here — the\n    // command layer's view of the tree — and injected, so the snapshot module\n    // never learns the repo layout. The seam the flat wave left is now\n    // threaded: both answers come from the enumeration, so a service filed\n    // into a subsystem keys its snapshot rows by the directory it actually\n    // lives in, and the clobber guard grades a leftover claim at that same\n    // address. The root-level parse stays as the fallback for the one path\n    // shape the enumeration cannot know yet — a service this archive CREATES,\n    // which always materialises unfiled at services/<id>/.\n    // Tolerant on purpose: a docs repo whose services/ is absent still\n    // archives a landscape-only feature exactly as before — the enumeration\n    // is empty, every row keys by the flat fallback, and the missing\n    // directory stays doctor's diagnosis rather than a merge-failed here.\n    const dirOf = new Map(\n      (await enumeratedServices(config.docsDir, read.fleet)).map((s) => [s.id as string, repoPath(config.docsDir, s.dir)]),\n    );\n    const serviceKeyOf = (rel: string): ServiceKey | null => {\n      for (const [service, dir] of dirOf) {\n        if (rel.startsWith(`${dir}/`)) return { service, artifact: rel.slice(dir.length + 1) };\n      }\n      const m = /^services\\/([^/]+)\\/(.+)$/.exec(rel);\n      return m ? { service: m[1]!, artifact: m[2]! } : null;\n    };\n    const serviceDirOf = (service: string): string | null => dirOf.get(service) ?? null;\n    await writeSnapshot({\n      featureDir,\n      docsDir: config.docsDir,\n      feature: { featureId: id, dirName },\n      staged,\n      serviceKeyOf,\n      serviceDirOf,\n    });\n    snapshot = true;\n    // The journal, fsynced, BEFORE the first rename: swapStaged is N renames and\n    // only each one of them is atomic, so a kill between two used to leave a\n    // half-merged repo that nothing could name — `doctor` and `status` called it\n    // healthy and `validate --all` blamed the delta. Written from `staged`, so\n    // it records the same digests the swaps are about to produce.\n    await writeCommitIntent(\n      config.docsDir,\n      { command: \"archive\", restore: \"before\", feature: id, moveFrom: featureDir, moveTo: archiveDest },\n      staged,\n    );\n    await swapStaged(staged);\n    createdArchiveDir = await mkdir(archiveDir, { recursive: true });\n    await rename(featureDir, archiveDest);\n    // Last: while it exists, the commit is in flight.\n    await clearCommitIntent(config.docsDir);\n  } catch (err) {\n    if (err instanceof SnapshotClobberError) {\n      // Nothing swapped — the refusal happens before the journal is even\n      // written — so this only takes the temp files away. Its own code, because\n      // the answer is not \"re-run\": a previous archive of this feature is still\n      // sitting in the living docs.\n      await rollbackStaged(staged);\n      throw new ArchiveFailure(\"commit-interrupted\", err.message);\n    }\n    // Everything this run made, unmade: the swapped files, the snapshot inside the\n    // feature that is staying put, and features/archive/ if we are the ones who\n    // created it (mkdir reports nothing when it was already there).\n    const failures = await rollbackStaged(staged);\n    // The rollback decided the outcome, so the journal has nothing left to\n    // describe — including on rollback-incomplete, where the files it names are\n    // the ones the message tells a human to look at.\n    await clearCommitIntent(config.docsDir);\n    // The snapshot goes only when the rollback HELD. On rollback-incomplete it\n    // holds the only on-disk pre-images of the very files the message tells the\n    // reader to repair by hand — a MODIFIED requirement's previous text appears\n    // nowhere else. Retaining it is safe: the next archive of this feature reads\n    // it before it would replace it, and refuses if the living docs have moved.\n    if (snapshot && failures.length === 0) await quietRm(snapshotDir(featureDir));\n    // `features/archive/` is shared the moment it exists: another archive can\n    // have moved a whole feature into it between our mkdir and this rollback,\n    // and a recursive remove of \"the directory we created\" took that feature —\n    // snapshot and all — with it, on OUR failure path, in silence. Empty\n    // directories only, stopping at the first that is not.\n    if (createdArchiveDir !== undefined) await quietPruneEmptyParents(archiveDir, createdArchiveDir);\n    // The code is a caller's answer to \"can I trust the repo?\": merge-failed\n    // means yes (rolled back), rollback-incomplete means look at it by hand.\n    const wrapped = rollbackError(err, failures);\n    const kept =\n      snapshot && failures.length > 0\n        ? ` Pre-images of the overwritten files are kept in features/${dirName}/${SNAPSHOT_DIR}/files/.`\n        : \"\";\n    throw new ArchiveFailure(failures.length > 0 ? \"rollback-incomplete\" : \"merge-failed\", wrapped.message + kept);\n  }\n\n  if (json) {\n    emitJson(payload(true));\n    return;\n  }\n  console.log(`\\n  archived: features/${dirName} → features/archive/${dirName}`);\n  console.log(`  snapshot: features/archive/${dirName}/${SNAPSHOT_DIR}/ — \\`loam unarchive ${id}\\` puts it back`);\n  // The closing line is a claim about the whole docs repo, and it is the line a\n  // reader stops at. It may be printed only when this archive left nothing the\n  // next `validate --all` will fail on — a service with no model, or a gate the\n  // caller told it to merge past. Printing it over either is how a red fleet\n  // gets reported as a finished one.\n  const incomplete = planWarns.filter((w) => w.code === \"service.no-model\");\n  if (incomplete.length === 0 && overridden.length === 0) {\n    console.log(\"  living spec + landscape are now complete + current.\");\n    return;\n  }\n  for (const w of incomplete) console.log(`  ⚠ ${w.message}`);\n  if (overridden.length > 0) {\n    console.log(\n      `  ⚠ merged past ${overridden.length} gating issue(s) with --approve — the living docs carry them now; \\`loam validate --all\\` says what they cost.`,\n    );\n  }\n}\n"]}
+{"version":3,"file":"run.js","sourceRoot":"","sources":["../../../src/commands/archive/run.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAC3F,OAAO,EACL,OAAO,EACP,qBAAqB,EACrB,sBAAsB,EACtB,OAAO,EACP,aAAa,EACb,cAAc,EACd,WAAW,EACX,UAAU,GACX,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAC7F,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,yCAAyC,CAAC;AACpF,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAAmB,MAAM,yCAAyC,CAAC;AAC/G,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAChF,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,sCAAsC,CAAC;AACrF,OAAO,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AACzE,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AACtC,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAuB,MAAM,mBAAmB,CAAC;AAC1F,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5E,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAChF,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC9E,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAGhD,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAA4B,EAC5B,SAAiB,EACjB,IAAoB;IAEpB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC;IACpC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC;IAChC,+EAA+E;IAC/E,MAAM,GAAG,GAAG,CAAC,IAAI,GAAG,EAAE,EAAQ,EAAE;QAC9B,IAAI,CAAC,IAAI;YAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC,CAAC;IAEF,qEAAqE;IACrE,yEAAyE;IACzE,2EAA2E;IAC3E,yEAAyE;IACzE,yEAAyE;IACzE,yEAAyE;IACzE,4BAA4B;IAC5B,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,YAAY,EAAE,EAAE,CAAC;IACpE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IACrD,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO;IAC3B,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IAExG,GAAG,CAAC,WAAW,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IAErD,gFAAgF;IAChF,uEAAuE;IACvE,MAAM,OAAO,GAAG,SAAS,EAAE,CAAC;IAC5B,MAAM,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAC3C,6EAA6E;IAC7E,wEAAwE;IACxE,yEAAyE;IACzE,MAAM,gBAAgB,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAClD,0EAA0E;IAC1E,yEAAyE;IACzE,oCAAoC;IACpC,MAAM,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAC9C,2EAA2E;IAC3E,yEAAyE;IACzE,iEAAiE;IACjE,MAAM,SAAS,GAAG,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;IAClE,MAAM,oBAAoB,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAC3D,MAAM,qBAAqB,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAC5D,2EAA2E;IAC3E,0EAA0E;IAC1E,oBAAoB;IACpB,MAAM,aAAa,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAC/C,6EAA6E;IAC7E,+EAA+E;IAC/E,8EAA8E;IAC9E,8EAA8E;IAC9E,SAAS;IACT,MAAM,SAAS,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAC7C,MAAM,eAAe,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IACnD,kFAAkF;IAClF,2EAA2E;IAC3E,0DAA0D;IAC1D,8EAA8E;IAC9E,8EAA8E;IAC9E,MAAM,gBAAgB,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IACpD,2EAA2E;IAC3E,2EAA2E;IAC3E,MAAM,gBAAgB,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAClD,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,eAAe,EAAE,gBAAgB,EAAE,GAAG,OAAO,CAAC;IACpF,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IAEvG,yEAAyE;IACzE,2EAA2E;IAC3E,4EAA4E;IAC5E,6EAA6E;IAC7E,0EAA0E;IAC1E,2BAA2B;IAC3B,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAC1C,MAAM,GAAG,GAAG,WAAW,EAAE,eAAe,SAAS,CAAC,MAAM,iCAAiC,CAAC;QAC1F,IAAI,IAAI,EAAE,CAAC;YACT,UAAU,CACR,cAAc,EACd,GAAG,EACH,CAAC,GAAG,MAAM,EAAE,GAAG,SAAS,EAAE,GAAG,SAAS,CAAC,EACvC,YAAY,OAAO,EAAE,CACtB,CAAC;YACF,OAAO;QACT,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC;QACzB,KAAK,MAAM,CAAC,IAAI,SAAS;YAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7D,OAAO,CAAC,KAAK,CAAC,sGAAsG,CAAC,CAAC;QACtH,UAAU,CAAC,cAAc,CAAC,CAAC;QAC3B,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,GAAG,CAAC,2BAA2B,SAAS,CAAC,MAAM,uCAAuC,CAAC,CAAC;QACxF,KAAK,MAAM,CAAC,IAAI,SAAS;YAAE,GAAG,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IACzD,CAAC;IACD,4EAA4E;IAC5E,2EAA2E;IAC3E,2EAA2E;IAC3E,2EAA2E;IAC3E,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,GAAG,CAAC,wCAAwC,WAAW,CAAC,MAAM,sGAAsG,CAAC,CAAC;QACtK,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;YAC5B,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,aAAa,CAAC,CAAC,KAAK,IAAI,eAAe,8BAA8B,CAAC,CAAC,OAAO,gCAAgC,CAAC,CAAC;QACnI,CAAC;QACD,GAAG,CAAC,kHAAkH,CAAC,CAAC;IAC1H,CAAC;IAED,8EAA8E;IAC9E,6EAA6E;IAC7E,sEAAsE;IACtE,MAAM,QAAQ,GAAG,CAAC,GAAG,QAAQ,EAAE,GAAG,SAAS,CAAC,CAAC;IAC7C,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1E,MAAM,IAAI,GAAmC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC9D,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC;QACtC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;KACjD,CAAC,CAAC,CAAC;IACJ,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,oBAAoB,OAAO,EAAE,EAAE,CAAC,CAAC;IAC9F,MAAM,OAAO,GAAG,CAAC,QAAiB,EAA2B,EAAE,CAAC,CAAC;QAC/D,OAAO,EAAE,SAAS;QAClB,OAAO,EAAE,EAAE;QACX,QAAQ;QACR,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC;QAC3C,IAAI;QACJ,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;QAC1F,UAAU,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;QAC9F,eAAe;QACf,gBAAgB;QAChB,WAAW;QACX,qEAAqE;QACrE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC7F,4EAA4E;QAC5E,2EAA2E;QAC3E,yCAAyC;QACzC,GAAG,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;KAC7C,CAAC,CAAC;IAEH,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,IAAI;YAAE,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QACnC,0EAA0E;QAC1E,qEAAqE;;YAChE,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACrI,OAAO;IACT,CAAC;IAED,4EAA4E;IAC5E,2EAA2E;IAC3E,2EAA2E;IAC3E,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAExD,+EAA+E;IAC/E,+EAA+E;IAC/E,6EAA6E;IAC7E,8EAA8E;IAC9E,wEAAwE;IACxE,6EAA6E;IAC7E,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,YAAY,CAAC,cAAc,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,iBAAiB,GAAkB,IAAI,CAAC;IAC5C,IAAI,CAAC;QACH,2EAA2E;QAC3E,wEAAwE;QACxE,0EAA0E;QAC1E,mEAAmE;QACnE,uEAAuE;QACvE,uEAAuE;QACvE,uEAAuE;QACvE,uEAAuE;QACvE,0EAA0E;QAC1E,uDAAuD;QACvD,mEAAmE;QACnE,wEAAwE;QACxE,iEAAiE;QACjE,sEAAsE;QACtE,MAAM,KAAK,GAAG,IAAI,GAAG,CACnB,CAAC,MAAM,kBAAkB,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CACrH,CAAC;QACF,MAAM,YAAY,GAAG,CAAC,GAAW,EAAqB,EAAE;YACtD,KAAK,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,KAAK,EAAE,CAAC;gBACnC,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,GAAG,GAAG,CAAC;oBAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;YACzF,CAAC;YACD,MAAM,CAAC,GAAG,2BAA2B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAChD,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACxD,CAAC,CAAC;QACF,MAAM,YAAY,GAAG,CAAC,OAAe,EAAiB,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC;QACpF,MAAM,aAAa,CAAC;YAClB,UAAU;YACV,OAAO,EAAE,WAAW;YACpB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,OAAO,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE;YACnC,MAAM;YACN,YAAY;YACZ,YAAY;YACZ,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;SAClD,CAAC,CAAC;QACH,QAAQ,GAAG,IAAI,CAAC;QAChB,6EAA6E;QAC7E,yEAAyE;QACzE,6EAA6E;QAC7E,2EAA2E;QAC3E,8DAA8D;QAC9D,MAAM,iBAAiB,CACrB,MAAM,CAAC,OAAO,EACd,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,EACjG,MAAM,CACP,CAAC;QACF,MAAM,UAAU,CAAC,MAAM,CAAC,CAAC;QACzB,iBAAiB,GAAG,MAAM,qBAAqB,CAAC,UAAU,CAAC,CAAC;QAC5D,MAAM,MAAM,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;QACtC,kDAAkD;QAClD,MAAM,iBAAiB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,oBAAoB,EAAE,CAAC;YACxC,mEAAmE;YACnE,0EAA0E;YAC1E,0EAA0E;YAC1E,8BAA8B;YAC9B,MAAM,cAAc,CAAC,MAAM,CAAC,CAAC;YAC7B,MAAM,IAAI,YAAY,CAAC,oBAAoB,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5D,CAAC;QACD,+EAA+E;QAC/E,4EAA4E;QAC5E,6EAA6E;QAC7E,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,CAAC;QAC9C,uEAAuE;QACvE,4EAA4E;QAC5E,iDAAiD;QACjD,MAAM,iBAAiB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACxC,2EAA2E;QAC3E,4EAA4E;QAC5E,4EAA4E;QAC5E,6EAA6E;QAC7E,4EAA4E;QAC5E,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC;QAC9E,0EAA0E;QAC1E,0EAA0E;QAC1E,2EAA2E;QAC3E,qEAAqE;QACrE,uDAAuD;QACvD,IAAI,iBAAiB,KAAK,IAAI;YAAE,MAAM,sBAAsB,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC;QAC5F,yEAAyE;QACzE,yEAAyE;QACzE,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC7C,MAAM,IAAI,GACR,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;YAC7B,CAAC,CAAC,6DAA6D,OAAO,IAAI,YAAY,UAAU;YAChG,CAAC,CAAC,EAAE,CAAC;QACT,MAAM,IAAI,YAAY,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,cAAc,EAAE,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IAC/G,CAAC;IAED,wEAAwE;IACxE,yEAAyE;IACzE,yEAAyE;IACzE,4EAA4E;IAC5E,4EAA4E;IAC5E,8EAA8E;IAC9E,uEAAuE;IACvE,6EAA6E;IAC7E,4EAA4E;IAC5E,qEAAqE;IACrE,mDAAmD;IACnD,MAAM,UAAU,GAAG,MAAM,mBAAmB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAE7D,IAAI,IAAI,EAAE,CAAC;QACT,QAAQ,CAAC;YACP,GAAG,OAAO,CAAC,IAAI,CAAC;YAChB,kFAAkF;YAClF,yEAAyE;YACzE,2EAA2E;YAC3E,oEAAoE;YACpE,GAAG,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC;YAClD,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,gCAAgC,CAAC,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChG,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,0BAA0B,OAAO,uBAAuB,OAAO,EAAE,CAAC,CAAC;IAC/E,OAAO,CAAC,GAAG,CAAC,gCAAgC,OAAO,IAAI,YAAY,wBAAwB,EAAE,iBAAiB,CAAC,CAAC;IAChH,8EAA8E;IAC9E,6EAA6E;IAC7E,yEAAyE;IACzE,0EAA0E;IAC1E,2DAA2D;IAC3D,MAAM,IAAI,GAAG,gBAAgB,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9F,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,uDAAuD,CAAC,CAAC;QACrE,OAAO;IACT,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,IAAI;QAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,KAAK,UAAU,mBAAmB,CAAC,OAAgB;IACjD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;QAC1C,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM;YAAE,KAAK,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;QACrH,IAAI,CAAC,CAAC,MAAM,iBAAiB,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;YAC5E,KAAK,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;QAC7C,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,2EAA2E;QAC3E,0EAA0E;QAC1E,yEAAyE;QACzE,+DAA+D;QAC/D,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC","sourcesContent":["/**\n * The archive itself, under the docs lock: gate, plan, commit.\n *\n * The order is the command's whole safety property. Every refusal happens before\n * a byte is planned (`./plan/gate.ts`), the plan is computed entirely in memory\n * so a failure on any axis leaves the living docs untouched (`./plan/specs.ts`,\n * `./plan/contracts/`, `./plan/landscape.ts`), and only a plan that succeeded\n * on every axis is staged\n * and swapped. `--dry-run` returns between the second and the third.\n */\nimport { existsSync } from \"node:fs\";\nimport { rename } from \"node:fs/promises\";\nimport { CodedFailure, emitJson, repoPath, sayExplain } from \"../../core/envelope/json.js\";\nimport {\n  message,\n  mkdirReportingCreated,\n  quietPruneEmptyParents,\n  quietRm,\n  rollbackError,\n  rollbackStaged,\n  stageWrites,\n  swapStaged,\n} from \"../../core/staging/commit.js\";\nimport { clearCommitIntent, writeCommitIntent } from \"../../core/staging/recovery/intent.js\";\nimport { SNAPSHOT_DIR, snapshotDir } from \"../../core/staging/snapshot/manifest.js\";\nimport { SnapshotClobberError, writeSnapshot, type ServiceKey } from \"../../core/staging/snapshot/snapshot.js\";\nimport { enumeratedServices } from \"../../core/repo/service-target.js\";\nimport { listFleetTree } from \"../../core/repo/repo.js\";\nimport { serviceViewsPath, subsystemViewsPath } from \"../../core/repo/paths.js\";\nimport { serviceViewsState, viewsState } from \"../../core/repo/tree/render/stale.js\";\nimport { loadArchitecture } from \"../../core/c4/project/architecture.js\";\nimport { FleetContext } from \"../../core/fleet-context.js\";\nimport { gate } from \"./plan/gate.js\";\nimport { issueJson, printPlan, refuseJson, type ArchiveOptions } from \"./plan/refusal.js\";\nimport { planCapabilities, planGlossary, planSpecs } from \"./plan/specs.js\";\nimport { planOpenapiContracts } from \"./plan/contracts/openapi.js\";\nimport { planAsyncapiContracts } from \"./plan/contracts/asyncapi.js\";\nimport { contractConsumers } from \"./plan/contracts/consumers.js\";\nimport { planDeployments, planFlows, planLandscape } from \"./plan/landscape.js\";\nimport { planFeatureLinks, planInboundLinks } from \"./plan/document/links.js\";\nimport { emptyPlan } from \"./plan/state.js\";\nimport { checklistAtArchive } from \"./shipped.js\";\nimport { outstandingLines } from \"./closing.js\";\nimport type { DocsDir } from \"../../core/kernel/ids/dirs.js\";\n\nexport async function archiveLocked(\n  config: { docsDir: DocsDir },\n  featureId: string,\n  opts: ArchiveOptions,\n): Promise<void> {\n  const dryRun = opts.dryRun === true;\n  const json = opts.json === true;\n  // All prose goes through here so `--json` keeps stdout a single JSON document.\n  const say = (line = \"\"): void => {\n    if (!json) console.log(line);\n  };\n\n  // One read index for the whole run, threaded through every planner's\n  // config record: gate, the spec merge and both contract merges each hold\n  // per-service loops that resolve living paths through the enumeration, and\n  // without a shared context every one of those calls re-walks the fleet —\n  // O(services²) work under a lock that guarantees the tree is not moving.\n  // The snapshot resolver below reads through the same context, so it pays\n  // for that enumeration too.\n  const read = { docsDir: config.docsDir, fleet: new FleetContext() };\n  const gated = await gate(read, featureId, opts, say);\n  if (gated === null) return;\n  const { id, dirName, featureDir, gating, advisory, archiveDir, archiveDest, recovered, issues } = gated;\n\n  say(`archive ${id}${dryRun ? \"  (dry run)\" : \"\"}\\n`);\n\n  // PLAN — compute every merge in memory. Nothing is written until the whole plan\n  // succeeds, so a failure on any axis leaves the living docs untouched.\n  const planned = emptyPlan();\n  await planSpecs(read, gated, planned, say);\n  // The business corpus, beside the service one and before the contracts: both\n  // are requirement merges, and reading them together is how a plan stays\n  // legible as \"what this feature promises\" followed by \"how it is built\".\n  await planCapabilities(read, gated, planned, say);\n  // The vocabulary the change brings with it, beside the promises it makes:\n  // a create-only whole-file copy, refused at the gate if the word already\n  // lives (`core/glossary/delta.ts`).\n  await planGlossary(read, gated, planned, say);\n  // One consumer index for both contract planners, built only if one of them\n  // overwrites an operation or a message (./plan/contracts/consumers.ts) —\n  // and then over the living fleet as it stands before this merge.\n  const contracts = { ...read, consumers: contractConsumers(read) };\n  await planOpenapiContracts(contracts, gated, planned, say);\n  await planAsyncapiContracts(contracts, gated, planned, say);\n  // `read`, not `config`: the C4 merge now asks which services own their own\n  // interior, and that answer comes from the fleet enumeration this run has\n  // already paid for.\n  await planLandscape(read, gated, planned, say);\n  // The flows this feature brings, after the elements they draw hops over: the\n  // copy is create-only and refused at the gate if the living tree already holds\n  // one (`core/usecases/delta/flows.ts`), and it is ordered after the landscape\n  // merge so a reader of the plan sees the map change before the sequence drawn\n  // on it.\n  await planFlows(config, gated, planned, say);\n  await planDeployments(config, gated, planned, say);\n  // After the merges, because it is the move rather than a merge: the feature's own\n  // documents ride the rename into features/archive/, and their links out of\n  // the feature are re-expressed for it in this same commit\n  // (./plan/document/links.ts) — planned at their current paths, swapped before\n  // the rename carries them, and parked in the snapshot like every other write.\n  await planFeatureLinks(config, gated, planned, say);\n  // And the links the rest of the corpus holds INTO the feature, after every\n  // merge so a document the merge rewrites is relinked from its merged text.\n  await planInboundLinks(read, gated, planned, say);\n  const { writes, planWarns, planGates, openapiRemovals, asyncapiRemovals } = planned;\n  const revouchOwed = planned.revouchOwed.map((r) => ({ ...r, path: repoPath(config.docsDir, r.path) }));\n\n  // Gate on what only the plan could see: a merged operation pointing at a\n  // component that exists nowhere, a removal marker addressing no operation.\n  // Same doctrine as the coherence gate — a judgment call --approve overrides\n  // (unlike the mechanical merge-failed refusals), and a dry run is gated too.\n  // Checked after the whole plan so the refusal costs nothing: no write has\n  // happened yet either way.\n  if (planGates.length > 0 && !opts.approve) {\n    const msg = `archive ${id} — BLOCKED: ${planGates.length} issue(s) in the contract merge`;\n    if (json) {\n      refuseJson(\n        \"not-coherent\",\n        msg,\n        [...issues, ...planWarns, ...planGates],\n        `features/${dirName}`,\n      );\n      return;\n    }\n    console.error(`${msg}:`);\n    for (const i of planGates) console.error(`  ✗ ${i.message}`);\n    console.error(`\\nFix them in the feature's openapi.yaml / asyncapi.yaml — or re-run with --approve to merge anyway.`);\n    sayExplain(\"not-coherent\");\n    process.exitCode = 1;\n    return;\n  }\n  if (planGates.length > 0) {\n    say(`\\n  ⚠ archiving despite ${planGates.length} contract merge issue(s) (--approve):`);\n    for (const i of planGates) say(`      ✗ ${i.message}`);\n  }\n  // Printed by the dry run and the real merge alike, before either commits to\n  // anything: the merge is what moves these documents, and the merge's PR is\n  // the place their re-vouches belong. Not a finding and not a refusal — the\n  // staleness that follows is honest, and `content.stale` is what grades it.\n  if (revouchOwed.length > 0) {\n    say(`\\n  re-vouch owed — this merge moves ${revouchOwed.length} vouched spec(s) under the vouch stamp, so content.stale follows on each until its owner re-vouches:`);\n    for (const r of revouchOwed) {\n      say(`    ${r.path}  (owner: ${r.owner ?? \"none recorded\"}) — \\`loam vouch --service ${r.service}\\`, run in that service's repo`);\n    }\n    say(`    land the re-vouches in this PR: \\`loam validate --all --base <ref> --strict\\` stays red on it until they do.`);\n  }\n\n  // The plan as data, verb decided now — after the commit everything would read\n  // as an update. The `--json` payload is identical for a dry run and the real\n  // thing except for `archived`; what WOULD happen is what DOES happen.\n  const warnings = [...advisory, ...planWarns];\n  const overridden = opts.approve === true ? [...gating, ...planGates] : [];\n  const plan: Array<Record<string, unknown>> = writes.map((w) => ({\n    path: repoPath(config.docsDir, w.path),\n    action: existsSync(w.path) ? \"update\" : \"create\",\n  }));\n  plan.push({ path: `features/${dirName}`, action: \"move\", to: `features/archive/${dirName}` });\n  const payload = (archived: boolean): Record<string, unknown> => ({\n    command: \"archive\",\n    feature: id,\n    archived,\n    path: repoPath(config.docsDir, archiveDest),\n    plan,\n    warnings: warnings.map((issue) => issueJson(issue, repoPath(config.docsDir, archiveDest))),\n    overridden: overridden.map((issue) => issueJson(issue, repoPath(config.docsDir, archiveDest))),\n    openapiRemovals,\n    asyncapiRemovals,\n    revouchOwed,\n    // What the requirement merge takes away (./plan/specs.ts). Additive.\n    dropped: planned.dropped.map((row) => ({ ...row, path: repoPath(config.docsDir, row.path) })),\n    // Present only when this run found an interrupted commit and dealt with it:\n    // an agent that sees the docs change under it deserves to be told why, and\n    // the absent field is the ordinary case.\n    ...(recovered === null ? {} : { recovered }),\n  });\n\n  if (dryRun) {\n    if (json) emitJson(payload(false));\n    // What the real run would print in place of its closing line, said BEFORE\n    // anything is written — the one moment a reader can still act on it.\n    else printPlan(config.docsDir, writes, dirName, outstandingLines({ advisory, planWarns, overridden, staleViews: [], dryRun: true }));\n    return;\n  }\n\n  // The question the feature asks as it ships, captured before anything below\n  // moves the living docs it is derived from — see ./shipped.ts. It rides in\n  // the snapshot manifest; a dry run writes no snapshot, so it pays nothing.\n  const checklist = await checklistAtArchive(read, gated);\n\n  // COMMIT — the whole plan computed cleanly. Stage every new version beside its\n  // target, snapshot what is about to be overwritten, then swap them into place.\n  // Staging touches the filesystem — a read-only `architecture/`, a full disk,\n  // a target whose pre-image cannot be read. None of that is a bug in loam, and\n  // reporting `internal` sends the reader looking for one; it is the same\n  // answer as any other merge that could not be computed: nothing was written.\n  let staged;\n  try {\n    staged = await stageWrites(writes);\n  } catch (err) {\n    throw new CodedFailure(\"merge-failed\", `${message(err)} — nothing was written`);\n  }\n  let snapshot = false;\n  let createdArchiveDir: string | null = null;\n  try {\n    // The snapshot's resolver pair: how a docs-relative path decomposes into a\n    // service identity, and where that identity lives NOW. Built here — the\n    // command layer's view of the tree — and injected, so the snapshot module\n    // never learns the repo layout. The seam the flat wave left is now\n    // threaded: both answers come from the enumeration, so a service filed\n    // into a subsystem keys its snapshot rows by the directory it actually\n    // lives in, and the clobber guard grades a leftover claim at that same\n    // address. The root-level parse stays as the fallback for the one path\n    // shape the enumeration cannot know yet — a service this archive CREATES,\n    // which always materialises unfiled at services/<id>/.\n    // Tolerant on purpose: a docs repo whose services/ is absent still\n    // archives a landscape-only feature exactly as before — the enumeration\n    // is empty, every row keys by the flat fallback, and the missing\n    // directory stays doctor's diagnosis rather than a merge-failed here.\n    const dirOf = new Map(\n      (await enumeratedServices(config.docsDir, read.fleet)).map((s) => [s.id as string, repoPath(config.docsDir, s.dir)]),\n    );\n    const serviceKeyOf = (rel: string): ServiceKey | null => {\n      for (const [service, dir] of dirOf) {\n        if (rel.startsWith(`${dir}/`)) return { service, artifact: rel.slice(dir.length + 1) };\n      }\n      const m = /^services\\/([^/]+)\\/(.+)$/.exec(rel);\n      return m ? { service: m[1]!, artifact: m[2]! } : null;\n    };\n    const serviceDirOf = (service: string): string | null => dirOf.get(service) ?? null;\n    await writeSnapshot({\n      featureDir,\n      movesTo: archiveDest,\n      docsDir: config.docsDir,\n      feature: { featureId: id, dirName },\n      staged,\n      serviceKeyOf,\n      serviceDirOf,\n      ...(checklist === undefined ? {} : { checklist }),\n    });\n    snapshot = true;\n    // The journal, fsynced, BEFORE the first rename: swapStaged is N renames and\n    // only each one of them is atomic, so a kill between two used to leave a\n    // half-merged repo that nothing could name — `doctor` and `status` called it\n    // healthy and `validate --all` blamed the delta. Written from `staged`, so\n    // it records the same digests the swaps are about to produce.\n    await writeCommitIntent(\n      config.docsDir,\n      { command: \"archive\", restore: \"before\", feature: id, moveFrom: featureDir, moveTo: archiveDest },\n      staged,\n    );\n    await swapStaged(staged);\n    createdArchiveDir = await mkdirReportingCreated(archiveDir);\n    await rename(featureDir, archiveDest);\n    // Last: while it exists, the commit is in flight.\n    await clearCommitIntent(config.docsDir);\n  } catch (err) {\n    if (err instanceof SnapshotClobberError) {\n      // Nothing swapped — the refusal happens before the journal is even\n      // written — so this only takes the temp files away. Its own code, because\n      // the answer is not \"re-run\": a previous archive of this feature is still\n      // sitting in the living docs.\n      await rollbackStaged(staged);\n      throw new CodedFailure(\"commit-interrupted\", err.message);\n    }\n    // Everything this run made, unmade: the swapped files, the snapshot inside the\n    // feature that is staying put, and features/archive/ if we are the ones who\n    // created it (mkdirReportingCreated reports null when it was already there).\n    const failures = await rollbackStaged(staged);\n    // The rollback decided the outcome, so the journal has nothing left to\n    // describe — including on rollback-incomplete, where the files it names are\n    // the ones the message tells a human to look at.\n    await clearCommitIntent(config.docsDir);\n    // The snapshot goes only when the rollback HELD. On rollback-incomplete it\n    // holds the only on-disk pre-images of the very files the message tells the\n    // reader to repair by hand — a MODIFIED requirement's previous text appears\n    // nowhere else. Retaining it is safe: the next archive of this feature reads\n    // it before it would replace it, and refuses if the living docs have moved.\n    if (snapshot && failures.length === 0) await quietRm(snapshotDir(featureDir));\n    // `features/archive/` is shared the moment it exists: another archive can\n    // have moved a whole feature into it between our mkdir and this rollback,\n    // and a recursive remove of \"the directory we created\" took that feature —\n    // snapshot and all — with it, on OUR failure path, in silence. Empty\n    // directories only, stopping at the first that is not.\n    if (createdArchiveDir !== null) await quietPruneEmptyParents(archiveDir, createdArchiveDir);\n    // The code is a caller's answer to \"can I trust the repo?\": merge-failed\n    // means yes (rolled back), rollback-incomplete means look at it by hand.\n    const wrapped = rollbackError(err, failures);\n    const kept =\n      snapshot && failures.length > 0\n        ? ` Pre-images of the overwritten files are kept in features/${dirName}/${SNAPSHOT_DIR}/files/.`\n        : \"\";\n    throw new CodedFailure(failures.length > 0 ? \"rollback-incomplete\" : \"merge-failed\", wrapped.message + kept);\n  }\n\n  // This merge just changed the map, and both generated views files are a\n  // function of the tree AND the map: a delta whose element lands inside a\n  // group that exactly covered a subsystem takes that subsystem's boundary\n  // line away, a delta binding an element to a filed service adds an include,\n  // and one new edge changes exactly one service's overview. Archive does not\n  // rewrite either file — `loam subsystem sync` owns them outright, and folding\n  // a second generated artifact into this transaction would mean archive\n  // computing the post-merge tree AND the post-merge map, which is how the two\n  // writers disagree — but it must not report a repo as current when the next\n  // `validate --all` will call it stale. Graded through validate's own\n  // functions, so the two cannot answer differently.\n  const staleViews = await staleGeneratedViews(config.docsDir);\n\n  if (json) {\n    emitJson({\n      ...payload(true),\n      // The original boolean keeps its exact meaning — `architecture/subsystems.likec4`\n      // and nothing else — because a payload key's meaning is frozen; the list\n      // beside it is the additive answer that can name the second file. Both are\n      // omitted when nothing is stale, exactly as the boolean always was.\n      ...(staleViews.length === 0 ? {} : { staleViews }),\n      ...(staleViews.includes(\"architecture/subsystems.likec4\") ? { subsystemViewsStale: true } : {}),\n    });\n    return;\n  }\n  console.log(`\\n  archived: features/${dirName} → features/archive/${dirName}`);\n  console.log(`  snapshot: features/archive/${dirName}/${SNAPSHOT_DIR}/ — \\`loam unarchive ${id}\\` puts it back`);\n  // The closing line is a claim about the whole docs repo, and it is the line a\n  // reader stops at. It may be printed only when this archive left nothing the\n  // next `validate --all` will fail on; ./closing.ts lists every reason it\n  // cannot be, and those lines are printed instead. Printing it over any of\n  // them is how a red fleet gets reported as a finished one.\n  const owed = outstandingLines({ advisory, planWarns, overridden, staleViews, dryRun: false });\n  if (owed.length === 0) {\n    console.log(\"  living spec + landscape are now complete + current.\");\n    return;\n  }\n  for (const line of owed) console.log(line);\n}\n\n/**\n * Which generated files would the next `validate --all` report\n * `subsystem.views-stale` on? Docs-relative paths, sorted, empty for none.\n *\n * Asked through validate's OWN functions rather than a second compare, so the\n * warning archive prints and the error validate raises can never disagree —\n * including about the gate validate holds: a map that does not parse is\n * `landscape.invalid`'s business, and grading a generated file against a map\n * nobody can read would cascade a second complaint behind the first. An\n * unreadable map therefore answers \"no claim\", exactly as validate does.\n *\n * BOTH generated files, because this merge just changed the map and the\n * per-service overviews are a function of it in a way the subsystem views are\n * not: a delta adding one edge changes exactly one service's peer set, and a\n * delta binding a new element adds a whole view. Naming only the file loam\n * happened to check first would let a repo be reported current while the very\n * next `validate --all` calls it stale — the one thing this advisory exists to\n * prevent.\n */\nasync function staleGeneratedViews(docsDir: DocsDir): Promise<string[]> {\n  try {\n    const doc = await loadArchitecture(docsDir);\n    if (doc.errors.length > 0) return [];\n    const tree = await listFleetTree(docsDir);\n    const stale: string[] = [];\n    if (!(await viewsState(subsystemViewsPath(docsDir), tree, doc)).agrees) stale.push(\"architecture/subsystems.likec4\");\n    if (!(await serviceViewsState(serviceViewsPath(docsDir), tree, doc)).agrees) {\n      stale.push(\"architecture/services.likec4\");\n    }\n    return stale.sort();\n  } catch {\n    // Tolerant for the reason the snapshot resolver above is: a docs repo with\n    // no `services/` at all still archives a landscape-only feature, and this\n    // question is an ADVISORY printed after a commit that already succeeded.\n    // Nothing here may turn a landed archive into a non-zero exit.\n    return [];\n  }\n}\n"]}

package/dist/commands/archive/shipped.js

@@ -0,0 +1,49 @@
+/**
+ * What `archive` writes down about the verification a feature ships with: the
+ * digest of the checklist it asks at the moment of the merge, captured into
+ * the undo snapshot's manifest (`core/staging/snapshot/manifest.ts`,
+ * `readSnapshotChecklist`).
+ *
+ * Archive reads no verdict — verify never gates the merge, and nothing here
+ * changes that: a record's state decides nothing about whether the archive
+ * runs. But once archived, a record is frozen history, and the checklist it
+ * could be held to is gone — the merge moves the feature's operations into the
+ * living contract, so a derivation after it can only mismatch. That made
+ * archiving the cheapest way past `loam gate --since`: a record gone stale
+ * read `verified` again the moment its feature shipped. With the question as
+ * it stood at the merge written down beside the record, the gate holds the
+ * frozen record to the feature that actually shipped, and `list`, `status` and
+ * `verify` keep reading it as the frozen history they always did.
+ *
+ * A module of its own rather than lines in `./run.ts`, which sequences the
+ * commit and is near the line limit; this is the one place archive asks the
+ * done-check anything.
+ */
+import { featureChecklist } from "../../core/verify/checklist.js";
+import { readVerificationState } from "../../core/verify/read/file.js";
+/**
+ * The digest a fresh `loam verify` would derive for the feature right now —
+ * call it before the first byte of the merge lands — or undefined when there
+ * is nothing worth capturing.
+ *
+ * Only a feature that carries a READABLE record pays for the derivation (it
+ * loads the delta into a LikeC4 workspace): with no record, or one nothing can
+ * read, the gate's answer is "absent" or "unreadable" whatever the checklist
+ * was, so a capture would buy nothing.
+ *
+ * Every failure is "nothing captured", never a refusal — verify does not gate
+ * the archive, and a derivation that could not run must not start to. The
+ * gate reads an absent capture as frozen history and says so.
+ */
+export async function checklistAtArchive(read, feature) {
+    try {
+        const record = await readVerificationState(feature.featureDir);
+        if (record.state !== "ok")
+            return undefined;
+        return (await featureChecklist(read.docsDir, feature.featureDir, feature.id, read.fleet)).digest;
+    }
+    catch {
+        return undefined;
+    }
+}
+//# sourceMappingURL=shipped.js.map

package/dist/commands/archive/shipped.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shipped.js","sourceRoot":"","sources":["../../../src/commands/archive/shipped.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAIvE;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAA+C,EAC/C,OAA+C;IAE/C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC/D,IAAI,MAAM,CAAC,KAAK,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;QAC5C,OAAO,CAAC,MAAM,gBAAgB,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;IACnG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC","sourcesContent":["/**\n * What `archive` writes down about the verification a feature ships with: the\n * digest of the checklist it asks at the moment of the merge, captured into\n * the undo snapshot's manifest (`core/staging/snapshot/manifest.ts`,\n * `readSnapshotChecklist`).\n *\n * Archive reads no verdict — verify never gates the merge, and nothing here\n * changes that: a record's state decides nothing about whether the archive\n * runs. But once archived, a record is frozen history, and the checklist it\n * could be held to is gone — the merge moves the feature's operations into the\n * living contract, so a derivation after it can only mismatch. That made\n * archiving the cheapest way past `loam gate --since`: a record gone stale\n * read `verified` again the moment its feature shipped. With the question as\n * it stood at the merge written down beside the record, the gate holds the\n * frozen record to the feature that actually shipped, and `list`, `status` and\n * `verify` keep reading it as the frozen history they always did.\n *\n * A module of its own rather than lines in `./run.ts`, which sequences the\n * commit and is near the line limit; this is the one place archive asks the\n * done-check anything.\n */\nimport { featureChecklist } from \"../../core/verify/checklist.js\";\nimport { readVerificationState } from \"../../core/verify/read/file.js\";\nimport type { FleetContext } from \"../../core/fleet-context.js\";\nimport type { DocsDir, FeatureDir } from \"../../core/kernel/ids/dirs.js\";\n\n/**\n * The digest a fresh `loam verify` would derive for the feature right now —\n * call it before the first byte of the merge lands — or undefined when there\n * is nothing worth capturing.\n *\n * Only a feature that carries a READABLE record pays for the derivation (it\n * loads the delta into a LikeC4 workspace): with no record, or one nothing can\n * read, the gate's answer is \"absent\" or \"unreadable\" whatever the checklist\n * was, so a capture would buy nothing.\n *\n * Every failure is \"nothing captured\", never a refusal — verify does not gate\n * the archive, and a derivation that could not run must not start to. The\n * gate reads an absent capture as frozen history and says so.\n */\nexport async function checklistAtArchive(\n  read: { docsDir: DocsDir; fleet: FleetContext },\n  feature: { id: string; featureDir: FeatureDir },\n): Promise<string | undefined> {\n  try {\n    const record = await readVerificationState(feature.featureDir);\n    if (record.state !== \"ok\") return undefined;\n    return (await featureChecklist(read.docsDir, feature.featureDir, feature.id, read.fleet)).digest;\n  } catch {\n    return undefined;\n  }\n}\n"]}

package/dist/commands/context/context.js

@@ -1,8 +1,8 @@
-import { loadConfig } from "../../core/envelope/config.js";
-import { emitJson, fail, reportNoConfig } from "../../core/envelope/json.js";
+import { configOrRefuse, emitJson, fail } from "../../core/envelope/json.js";
 import { parseServiceId } from "../../core/kernel/ids/service.js";
 import { FleetContext } from "../../core/fleet-context.js";
-import { assemblePack, packHoles } from "../../core/pack/pack.js";
+import { assembleIntroducedPack, assemblePack, packHoles, } from "../../core/pack/pack.js";
+import { introducingFeatures } from "../../core/projection/introduced.js";
 import { nearestIds } from "../../core/repo/entries.js";
 import { missingFeatureMessage, resolveFeature } from "../../core/repo/repo.js";
 import { DocsRepoUnavailableError } from "../../core/repo/state.js";
@@ -17,12 +17,10 @@ export function registerContext(program) {
         .option("--json", "emit the machine contract instead of the human view")
         .action(async (serviceArg, opts) => {
         const json = opts.json === true;
-        const loaded = await loadConfig();
-        if (loaded.kind !== "loaded") {
-            reportNoConfig(json, loaded);
+        const config = await configOrRefuse(json);
+        if (config === null)
             return;
-        }
-        const { docsDir } = loaded.config;
+        const { docsDir } = config;
         // `services`, not `docs`: the pack is a statement about one service in
         // the fleet, and an empty pack read out of a directory that is not a
         // docs repo would say "nothing is documented here" about a repo nobody
@@ -56,18 +54,14 @@ export function registerContext(program) {
             // pack reads as "nothing to know here".
             const entries = await context.listServices(docsDir);
             const entry = entries.find((e) => e.id === serviceArg);
-            if (entry === undefined) {
-                const parsed = parseServiceId(serviceArg, "service");
-                if (!parsed.ok) {
-                    fail(json, "invalid-option", parsed.problem);
-                    return;
-                }
-                const near = nearestIds(serviceArg, entries.map((e) => e.id));
-                fail(json, "unknown-service", `No service '${serviceArg}' under ${docsDir}/services/.` +
-                    (near.length === 0 ? "" : ` Did you mean ${near.map((n) => `'${n}'`).join(" or ")}?`));
+            const assembled = entry !== undefined
+                ? { ok: true, pack: await assemblePack({ docsDir, entry, feature, context }) }
+                : await notLivingPack({ docsDir, name: serviceArg, feature, context });
+            if (!assembled.ok) {
+                fail(json, assembled.code, assembled.message);
                 return;
             }
-            const pack = await assemblePack({ docsDir, entry, feature, context });
+            const { pack } = assembled;
             // A document behind the pack that exists but does not parse empties
             // its section, and an agent loading the pack as a briefing would read
             // that as "nothing here" — the vacuously-green pattern. The output
@@ -96,4 +90,77 @@ export function registerContext(program) {
         }
     });
 }
+/**
+ * The answer for a name `services/` does not hold: the pack of the service an
+ * active feature INTRODUCES, or the refusal.
+ *
+ * The introducing features are the second enumeration, asked before the
+ * grammar for the first one's reason — the name came off a readdir, of the
+ * feature's own `specs/`. Refusing it as unknown told the implementer of a NEW
+ * service, at step 1 of the implement protocol (`loam context <svc> --feature
+ * <FEAT>`), that the service the feature they were handed creates does not
+ * exist, while `loam tasks` listed their work for it on the same tree.
+ *
+ * The briefing is ONE feature's delta, because a service nobody has merged yet
+ * is whatever its introducing delta says it is. One introducer is used without
+ * a flag; several, with none named, is refused rather than picked — two deltas
+ * each describing the same new service differently is a conflict a person
+ * resolves, and silently briefing from the first would hide the other.
+ */
+async function notLivingPack(req) {
+    const { docsDir, name, feature, context } = req;
+    const introducing = await introducingFeatures(docsDir, name, context);
+    const [first] = introducing;
+    if (first === undefined)
+        return unknownService(req);
+    const ids = introducing.map((f) => f.id).join(", ");
+    if (feature !== null && !introducing.some((f) => f.dir === feature.dir)) {
+        // A feature that does not introduce the service has nothing to say about
+        // it — its projection would be an EMPTY pack, which reads as "nothing to
+        // know here" about a service another feature is busy creating.
+        return {
+            ok: false,
+            code: "unknown-service",
+            message: `No service '${name}' under ${docsDir}/services/, and ${feature.id} does not introduce it — ` +
+                `${ids} ${introducing.length === 1 ? "does" : "do"}. Name ${introducing.length === 1 ? "it" : "one"} with --feature ${first.id}.`,
+        };
+    }
+    if (feature === null && introducing.length > 1) {
+        return {
+            ok: false,
+            code: "invalid-option",
+            message: `'${name}' is not in the living docs yet, and ${ids} each introduce it — ` +
+                `name the delta to brief from with --feature <FEAT>.`,
+        };
+    }
+    const chosen = feature ?? first;
+    // The chosen feature's own readdir spelling of the name: equal as a string,
+    // and the one value here that carries the fact that a directory produced it.
+    const service = chosen.services.find((s) => s === name);
+    if (service === undefined)
+        return unknownService(req);
+    const pack = await assembleIntroducedPack({ docsDir, service, feature: chosen, introducedBy: introducing, context });
+    return { ok: true, pack };
+}
+/**
+ * The refusal for a name nothing holds — the grammar's, then `unknown-service`
+ * with the near misses. The candidates are every service a reader could have
+ * meant: the living ones and the ones a feature in flight introduces, since a
+ * typo of the second is now a name this command would have briefed.
+ */
+async function unknownService(req) {
+    const { docsDir, name, context } = req;
+    const parsed = parseServiceId(name, "service");
+    if (!parsed.ok)
+        return { ok: false, code: "invalid-option", message: parsed.problem };
+    const [living, active] = await Promise.all([context.listServices(docsDir), context.listFeatures(docsDir)]);
+    const known = new Set([...living.map((e) => e.id), ...active.flatMap((f) => f.services)]);
+    const near = nearestIds(name, [...known]);
+    return {
+        ok: false,
+        code: "unknown-service",
+        message: `No service '${name}' under ${docsDir}/services/.` +
+            (near.length === 0 ? "" : ` Did you mean ${near.map((n) => `'${n}'`).join(" or ")}?`),
+    };
+}
 //# sourceMappingURL=context.js.map