@ybotok/loam 0.2.0-alpha.1 → 0.2.0-alpha.13

package/dist/commands/validate/arch-coverage.js

@@ -15,8 +15,9 @@
  * one module is what stops "new" being decided differently in three places.
  */
 import { existsSync } from "node:fs";
-import { loadFile } from "../../core/c4/likec4.js";
+import {} from "../../core/c4/likec4.js";
 import { elementService, serviceResolver } from "../../core/c4/resolve/service.js";
+import { groupsServices } from "../../core/c4/resolve/systems.js";
 import {} from "../../core/kernel/ids/service.js";
 import { landscapePath as landscapeFile } from "../../core/repo/paths.js";
 import { locateServicePaths } from "../../core/repo/service-target.js";
@@ -28,8 +29,9 @@ import { readHealth } from "../../core/vocabulary/health.js";
 import { FleetContext } from "../../core/fleet-context.js";
 import { ACTOR_KINDS, EXTERNAL_TAG } from "../../core/vocabulary/maturity.js";
 import { coversEntries, coversUnknownFindings } from "./checks/requirements.js";
+import { deltaSpelledCovers, mergedMapOf, survivingEdgeCover, survivingElementCover } from "./coverage/covers-after.js";
 export async function deltaArchCoverage(delta) {
-    const { docsDir, elements, relationships, taggedEls, taggedRels, archDeltas, featureServices, scenarioText, preloadedLand, fleet, } = delta;
+    const { docsDir, featureDir, featureId, elements, relationships, taggedEls, taggedRels, archDeltas, featureServices, scenarioText, preloadedLand, fleet, } = delta;
     const findings = [];
     // The delta's own element→service resolver, built once for the whole feature.
     // `serviceOf` is a one-shot wrapper that rebuilds its index on every call, and
@@ -48,6 +50,9 @@ export async function deltaArchCoverage(delta) {
         ...featureServices,
     ]);
     const svcOf = serviceResolver(elements, known);
+    // The map this feature's merge would leave, parsed at most once and only when
+    // a hint or a `Covers:` line needs it (./coverage/covers-after.ts says when).
+    const merged = mergedMapOf({ docsDir, featureDir, featureId, fleet, known });
     // Arch-edge coverage (heuristic, warn-only): each new tagged edge should be named by a scenario.
     for (const r of taggedRels) {
         const target = svcOf(r.target);
@@ -66,8 +71,12 @@ export async function deltaArchCoverage(delta) {
     // this is where agent-built code cuts its corners — the outbox, the retries,
     // the alerts — because no business scenario was ever going to mention them.
     // Grouping-only elements take the same exemptions the fleet map applies
-    // (person kinds, #external) — one set, in checks/vocabulary.ts, so "not a
-    // service" cannot mean two things. Warnings, never archive gates; `--strict`
+    // (person kinds, #external) — one set, in core/vocabulary/maturity.ts, so
+    // "not a service" cannot mean two things — and so does a GROUPING, an element
+    // that stands for no service and contains one (core/c4/resolve/systems.ts).
+    // A new domain drawn around a new service was asked for a `Covers:` line of
+    // its own: there is no obligation a group can carry, and the service inside
+    // it is graded on its own. Warnings, never archive gates; `--strict`
     // escalates.
     //
     // Only requirements the archive will MERGE grant coverage here. In a delta,
@@ -88,11 +97,7 @@ export async function deltaArchCoverage(delta) {
     const livingLandscape = async () => {
         if (living === undefined) {
             const lp = landscapeFile(docsDir);
-            living = existsSync(lp)
-                ? fleet === undefined
-                    ? await loadFile(lp)
-                    : await fleet.loadLikeC4(lp)
-                : null;
+            living = existsSync(lp) ? await fleet.loadLikeC4(lp) : null;
         }
         return living;
     };
@@ -117,17 +122,22 @@ export async function deltaArchCoverage(delta) {
     const edgeKey = (source, target) => JSON.stringify([source, target]);
     const baseEdges = new Set((base?.relationships ?? []).map((r) => edgeKey(baseSvcOf(r.source), baseSvcOf(r.target))));
     for (const e of taggedEls) {
-        if (ACTOR_KINDS.has(e.kind.toLowerCase()) || e.tags.includes(EXTERNAL_TAG))
+        if (ACTOR_KINDS.has(e.kind.toLowerCase()) || e.tags.includes(EXTERNAL_TAG) || groupsServices(e, elements, known))
             continue;
         if (baseIds.has(e.id) || baseServices.has(elementService(e)))
             continue;
         if (activeCovers.some((c) => coversElement(c, e)))
             continue;
+        // Spelled in the space it will live in, the line covers it too: the id the
+        // merge gives an element is the one the hint below recommends.
+        const cover = await survivingElementCover(e, { svcOf, known }, merged);
+        if (activeCovers.some((c) => c.form === "element" && c.id === cover))
+            continue;
         findings.push({
             severity: "warn",
             code: "c4.uncovered",
             subject: elementService(e),
-            message: `delta adds '${e.title}' (${e.id}) but no arch requirement covers it — add 'Covers: ${e.id}' to a specs/<svc>/arch.spec.md delta, or its architectural obligations ship unchecked`,
+            message: `delta adds '${e.title}' (${e.id}) but no arch requirement covers it — add 'Covers: ${cover}' to a specs/<svc>/arch.spec.md delta, or its architectural obligations ship unchecked`,
         });
     }
     for (const r of taggedRels) {
@@ -139,7 +149,7 @@ export async function deltaArchCoverage(delta) {
             severity: "warn",
             code: "c4.uncovered",
             subject: svcOf(r.target),
-            message: `delta adds edge ${svcOf(r.source)} → ${svcOf(r.target)} ("${r.title ?? ""}") but no arch requirement covers it — add 'Covers: ${r.source} -> ${r.target}' to a specs/<svc>/arch.spec.md delta`,
+            message: `delta adds edge ${svcOf(r.source)} → ${svcOf(r.target)} ("${r.title ?? ""}") but no arch requirement covers it — add 'Covers: ${survivingEdgeCover(r, svcOf)}' to a specs/<svc>/arch.spec.md delta`,
         });
     }
     // covers.unknown, feature scope. Resolution looks at the delta itself, the
@@ -153,30 +163,71 @@ export async function deltaArchCoverage(delta) {
         const landParses = land !== null && land.errors.length === 0 ? land : null;
         const baseElements = [...elements, ...(landParses?.elements ?? [])];
         const baseRels = [...relationships, ...(landParses?.relationships ?? [])];
+        // A feature never brings topology through `delta.likec4` — a `deployment { }`
+        // block in one is refused by the merge — so the living map is the whole
+        // scope for a `node:` entry in a delta, exactly as it is in service scope.
+        const baseDeployment = landParses?.deployment;
         for (const { service: svc, reqs } of archDeltas) {
             // An unreadable living health.yaml mutes the alert:/sli: entries here
             // exactly as in service scope — the health.invalid finding itself
             // belongs to the service target, which owns the file's diagnosis.
-            const health = await readHealth((await locateServicePaths(docsDir, svc, fleet)).health);
-            let scope = { elements: baseElements, relationships: baseRels, health: health.ids, known };
+            const svcPaths = await locateServicePaths(docsDir, svc, fleet);
+            const health = await readHealth(svcPaths.health);
+            // Through the ONE reader of `model.likec4`: a model that EXTENDS the map
+            // is not a file this could open, and reading it as one would answer with
+            // a pile of parse errors — which this arm reads as "no widening", so
+            // every `Covers:` line naming a container of a migrated service would be
+            // convicted as a typo. `mapUnreadable` is the same silence for the same
+            // reason: nothing may widen a scope out of a document nobody could read.
+            // Read at most once, and only when a line needs it.
+            let modelRead;
+            const model = () => (modelRead ??= (async () => {
+                const m = existsSync(svcPaths.model) ? await fleet.serviceModel(docsDir, svcPaths) : null;
+                return m !== null && !m.mapUnreadable && m.doc.errors.length === 0
+                    ? { elements: m.doc.elements, relationships: m.doc.relationships }
+                    : { elements: [], relationships: [] };
+            })());
+            let scope = {
+                elements: baseElements,
+                relationships: baseRels,
+                ...(baseDeployment === undefined ? {} : { deployment: baseDeployment }),
+                health: health.ids,
+                known,
+            };
             const unresolved = coversUnknownFindings(reqs, { where: `${svc}: arch.spec.md`, subject: svc }, scope, health.unreadable);
             if (unresolved.length > 0) {
-                const modelPath = (await locateServicePaths(docsDir, svc, fleet)).model;
-                const model = existsSync(modelPath)
-                    ? fleet === undefined
-                        ? await loadFile(modelPath)
-                        : await fleet.loadLikeC4(modelPath)
-                    : null;
-                if (model !== null && model.errors.length === 0) {
-                    scope = {
-                        elements: [...baseElements, ...model.elements],
-                        relationships: [...baseRels, ...model.relationships],
-                        health: health.ids,
-                        known,
-                    };
+                const m = await model();
+                // Widened, never narrowed: the topology rides along. Rebuilding the
+                // record without it convicted every `node:` entry as a typo the moment
+                // another entry beside it sent the scope here.
+                scope = {
+                    ...scope,
+                    elements: [...baseElements, ...m.elements],
+                    relationships: [...baseRels, ...m.relationships],
+                };
+                // The map the merge would leave widens it last, and only for a line still
+                // unresolved: one spelled the way the living map will spell an element
+                // this feature adds resolves there and nowhere else yet — and it is the
+                // spelling the hints recommend.
+                const after = coversUnknownFindings(reqs, { where: svc, subject: svc }, scope, health.unreadable).length > 0 ? (await merged())?.doc : undefined;
+                if (after !== undefined) {
+                    scope = { ...scope, elements: [...scope.elements, ...after.elements], relationships: [...scope.relationships, ...after.relationships] };
                 }
                 findings.push(...coversUnknownFindings(reqs, { where: `${svc}: arch.spec.md`, subject: svc }, scope, health.unreadable));
             }
+            // And the lines that DID resolve, read in the space they will live in:
+            // one that answered only through the delta's own ids is `covers.unknown`
+            // the moment the archive lands it (./coverage/covers-after.ts).
+            findings.push(...(await deltaSpelledCovers({
+                service: svc,
+                reqs,
+                featureScope: scope,
+                living: { elements: landParses?.elements ?? [], relationships: landParses?.relationships ?? [] },
+                model,
+                elements,
+                svcOf,
+                merged,
+            })));
         }
     }
     return findings;

package/dist/commands/validate/arch-coverage.js.map

@@ -1 +1 @@
-{"version":3,"file":"arch-coverage.js","sourceRoot":"","sources":["../../../src/commands/validate/arch-coverage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAuC,MAAM,yBAAyB,CAAC;AACxF,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACnF,OAAO,EAAwB,MAAM,kCAAkC,CAAC;AACxE,OAAO,EAAE,aAAa,IAAI,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EAAgB,MAAM,iCAAiC,CAAC;AAC/D,OAAO,EAAoB,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,aAAa,EAAsB,MAAM,uBAAuB,CAAC;AACtF,OAAO,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AA8BhF,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAAgB;IACtD,MAAM,EACJ,OAAO,EACP,QAAQ,EACR,aAAa,EACb,SAAS,EACT,UAAU,EACV,UAAU,EACV,eAAe,EACf,YAAY,EACZ,aAAa,EACb,KAAK,GACN,GAAG,KAAK,CAAC;IACV,MAAM,QAAQ,GAAc,EAAE,CAAC;IAE/B,8EAA8E;IAC9E,+EAA+E;IAC/E,2EAA2E;IAC3E,2EAA2E;IAC3E,4EAA4E;IAC5E,4EAA4E;IAC5E,yEAAyE;IACzE,+DAA+D;IAC/D,uEAAuE;IACvE,yEAAyE;IACzE,4EAA4E;IAC5E,mBAAmB;IACnB,MAAM,KAAK,GAAwB,IAAI,GAAG,CAAS;QACjD,GAAG,CAAC,MAAM,oBAAoB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC/C,GAAG,eAAe;KACnB,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,eAAe,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAE/C,iGAAiG;IACjG,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC/B,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;QAC3D,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM;YACjC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,oBAAoB;YACzD,OAAO,EAAE,MAAM;YACf,OAAO,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,MAAM,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,0BAA0B,EAAE;YACzG,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,iCAAiC,EAAE;SAC/D,CAAC,CAAC;IACL,CAAC;IAED,4EAA4E;IAC5E,8EAA8E;IAC9E,6EAA6E;IAC7E,6EAA6E;IAC7E,4EAA4E;IAC5E,wEAAwE;IACxE,0EAA0E;IAC1E,6EAA6E;IAC7E,aAAa;IACb,EAAE;IACF,4EAA4E;IAC5E,qEAAqE;IACrE,4EAA4E;IAC5E,yEAAyE;IACzE,4EAA4E;IAC5E,gEAAgE;IAChE,MAAM,YAAY,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CACnD,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAC/E,CAAC;IAEF,yEAAyE;IACzE,0EAA0E;IAC1E,8EAA8E;IAC9E,4EAA4E;IAC5E,4EAA4E;IAC5E,2EAA2E;IAC3E,uEAAuE;IACvE,IAAI,MAAM,GAAiC,aAAa,CAAC;IACzD,MAAM,eAAe,GAAG,KAAK,IAA+B,EAAE;QAC5D,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,EAAE,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;YAClC,MAAM,GAAG,UAAU,CAAC,EAAE,CAAC;gBACrB,CAAC,CAAC,KAAK,KAAK,SAAS;oBACnB,CAAC,CAAC,MAAM,QAAQ,CAAC,EAAE,CAAC;oBACpB,CAAC,CAAC,MAAM,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC9B,CAAC,CAAC,IAAI,CAAC;QACX,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IACF,MAAM,aAAa,GAAG,KAAK,IAA+B,EAAE;QAC1D,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACnE,MAAM,GAAG,GAAG,MAAM,eAAe,EAAE,CAAC;QACpC,OAAO,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,aAAa,EAAE,CAAC;IACnC,MAAM,SAAS,GAAG,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC/E,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/D,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;IACzE,2EAA2E;IAC3E,0EAA0E;IAC1E,4EAA4E;IAC5E,0EAA0E;IAC1E,6EAA6E;IAC7E,8EAA8E;IAC9E,6EAA6E;IAC7E,qEAAqE;IACrE,MAAM,OAAO,GAAG,CAAC,MAAc,EAAE,MAAc,EAAU,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC7F,MAAM,SAAS,GAAG,IAAI,GAAG,CACvB,CAAC,IAAI,EAAE,aAAa,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,SAAU,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,SAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAC5F,CAAC;IAEF,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;QAC1B,IAAI,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;YAAE,SAAS;QACrF,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;YAAE,SAAS;QACvE,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAAE,SAAS;QAC5D,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC;YAC1B,OAAO,EAAE,eAAe,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,EAAE,sDAAsD,CAAC,CAAC,EAAE,wFAAwF;SAC5L,CAAC,CAAC;IACL,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;YAAE,SAAS;QACvE,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;YAAE,SAAS;QAC1E,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;YACxB,OAAO,EAAE,mBAAmB,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,uDAAuD,CAAC,CAAC,MAAM,OAAO,CAAC,CAAC,MAAM,uCAAuC;SACzM,CAAC,CAAC;IACL,CAAC;IAED,2EAA2E;IAC3E,4EAA4E;IAC5E,6EAA6E;IAC7E,yEAAyE;IACzE,4EAA4E;IAC5E,8CAA8C;IAC9C,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,GAAG,MAAM,eAAe,EAAE,CAAC;QACrC,MAAM,UAAU,GAAG,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;QAC3E,MAAM,YAAY,GAAG,CAAC,GAAG,QAAQ,EAAE,GAAG,CAAC,UAAU,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC;QACpE,MAAM,QAAQ,GAAG,CAAC,GAAG,aAAa,EAAE,GAAG,CAAC,UAAU,EAAE,aAAa,IAAI,EAAE,CAAC,CAAC,CAAC;QAC1E,KAAK,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,UAAU,EAAE,CAAC;YAChD,sEAAsE;YACtE,kEAAkE;YAClE,kEAAkE;YAClE,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,CAAC,MAAM,kBAAkB,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YACxF,IAAI,KAAK,GAAkB,EAAE,QAAQ,EAAE,YAAY,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC;YAC1G,MAAM,UAAU,GAAG,qBAAqB,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,GAAG,gBAAgB,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;YAC1H,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC1B,MAAM,SAAS,GAAG,CAAC,MAAM,kBAAkB,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;gBACxE,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,CAAC;oBACjC,CAAC,CAAC,KAAK,KAAK,SAAS;wBACnB,CAAC,CAAC,MAAM,QAAQ,CAAC,SAAS,CAAC;wBAC3B,CAAC,CAAC,MAAM,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC;oBACrC,CAAC,CAAC,IAAI,CAAC;gBACT,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAChD,KAAK,GAAG;wBACN,QAAQ,EAAE,CAAC,GAAG,YAAY,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC;wBAC9C,aAAa,EAAE,CAAC,GAAG,QAAQ,EAAE,GAAG,KAAK,CAAC,aAAa,CAAC;wBACpD,MAAM,EAAE,MAAM,CAAC,GAAG;wBAClB,KAAK;qBACN,CAAC;gBACJ,CAAC;gBACD,QAAQ,CAAC,IAAI,CAAC,GAAG,qBAAqB,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,GAAG,gBAAgB,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;YAC3H,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,uGAAuG;AACvG,SAAS,WAAW,CAAC,MAAc,EAAE,KAAyB,EAAE,YAAoB;IAClF,IAAI,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,KAAK,MAAM,KAAK,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,CAAC;QACzD,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC;IACnF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC","sourcesContent":["/**\n * Whether the architecture a delta INTRODUCES is covered by a requirement that\n * will actually merge.\n *\n * Three findings, one question asked three ways: `archedge.uncovered` (a\n * scenario names the new edge — heuristic, warn-only), `c4.uncovered` (an\n * arch.spec.md requirement covers the new element or edge — mechanical), and\n * `covers.unknown` (the `Covers:` line resolves to something real). This is\n * where agent-built code cuts its corners — the outbox, the retries, the alerts\n * — because no business scenario was ever going to mention them.\n *\n * Split out of `validateFeature` because it is the only part of the feature\n * target that needs the LIVING landscape: everything else there reads the\n * feature directory alone. Keeping the lazy load and its two exemption sets in\n * one module is what stops \"new\" being decided differently in three places.\n */\nimport { existsSync } from \"node:fs\";\nimport { loadFile, type Elem, type LoadedDoc, type Rel } from \"../../core/c4/likec4.js\";\nimport { elementService, serviceResolver } from \"../../core/c4/resolve/service.js\";\nimport { type PathableService } from \"../../core/kernel/ids/service.js\";\nimport { landscapePath as landscapeFile } from \"../../core/repo/paths.js\";\nimport { locateServicePaths } from \"../../core/repo/service-target.js\";\nimport { enumeratedServiceIds } from \"../../core/repo/service-target.js\";\nimport { type Finding } from \"../../core/vocabulary/report.js\";\nimport { type Requirement } from \"../../core/document/spec.js\";\nimport { coversEdge, coversElement, type CoverageScope } from \"../../core/c4/arch.js\";\nimport { readHealth } from \"../../core/vocabulary/health.js\";\nimport { FleetContext } from \"../../core/fleet-context.js\";\nimport { ACTOR_KINDS, EXTERNAL_TAG } from \"../../core/vocabulary/maturity.js\";\nimport { coversEntries, coversUnknownFindings } from \"./checks/requirements.js\";\nimport type { DocsDir } from \"../../core/kernel/ids/dirs.js\";\n\n/** One feature delta's architecture, and everything needed to decide what in it is new. */\nexport interface DeltaArch {\n  docsDir: DocsDir;\n  /** Every element the delta declares — the resolver's index, and `coversEdge`'s scope. */\n  elements: Elem[];\n  /** Every relationship the delta declares. */\n  relationships: Rel[];\n  /** The delta's own additions: elements and edges carrying the feature id as a tag. */\n  taggedEls: Elem[];\n  taggedRels: Rel[];\n  /** Each addressed service's arch.spec.md delta, in enumeration order. */\n  archDeltas: Array<{ service: PathableService; reqs: Requirement[] }>;\n  /**\n   * Every service the feature's `specs/` addresses — not just the ones with an\n   * arch delta. The resolver's fleet set unions these in because a service the\n   * feature INTRODUCES has no `services/` directory yet, and without its name\n   * an edge into that service's own modelled container resolved to the\n   * container's title — a phantom the fleet half alone cannot rule out.\n   */\n  featureServices: PathableService[];\n  /** Every scenario the feature's deltas carry, lowercased — the heuristic's haystack. */\n  scenarioText: string;\n  /** The living landscape under --all; undefined means \"load it if you need it\", null \"there is none\". */\n  preloadedLand?: LoadedDoc | null;\n  fleet?: FleetContext;\n}\n\nexport async function deltaArchCoverage(delta: DeltaArch): Promise<Finding[]> {\n  const {\n    docsDir,\n    elements,\n    relationships,\n    taggedEls,\n    taggedRels,\n    archDeltas,\n    featureServices,\n    scenarioText,\n    preloadedLand,\n    fleet,\n  } = delta;\n  const findings: Finding[] = [];\n\n  // The delta's own element→service resolver, built once for the whole feature.\n  // `serviceOf` is a one-shot wrapper that rebuilds its index on every call, and\n  // the two loops below ask it up to five times per tagged edge — so a delta\n  // over a large model paid for one Map of every element per question asked.\n  // The enumerated fleet — `services/` plus the feature's own `specs/` names,\n  // where a service it introduces lives — rides into it, and into `baseSvcOf`\n  // below, which MUST resolve the same way or the already-living exemption\n  // keys never match: so an edge drawn into a modelled container\n  // (`payment.api`) grades against the service that owns it instead of a\n  // service called \"api\" that has never existed. An unenumerable services/\n  // degrades to the feature's own names, exactly what every caller got before\n  // the set existed.\n  const known: ReadonlySet<string> = new Set<string>([\n    ...(await enumeratedServiceIds(docsDir, fleet)),\n    ...featureServices,\n  ]);\n  const svcOf = serviceResolver(elements, known);\n\n  // Arch-edge coverage (heuristic, warn-only): each new tagged edge should be named by a scenario.\n  for (const r of taggedRels) {\n    const target = svcOf(r.target);\n    const covered = edgeCovered(target, r.title, scenarioText);\n    findings.push({\n      severity: covered ? \"ok\" : \"warn\",\n      code: covered ? \"archedge.covered\" : \"archedge.uncovered\",\n      subject: target,\n      message: `${svcOf(r.source)} → ${target}  \"${r.title ?? \"\"}\"${covered ? \"\" : \"  — no scenario names it\"}`,\n      text: { indent: 4, header: \"arch-edge coverage (heuristic):\" },\n    });\n  }\n\n  // The architecture spec axis, feature scope — the mechanical counterpart of\n  // the heuristic above. Every NEW tagged element and edge in the delta wants a\n  // `Covers:` line in one of the feature's arch.spec.md deltas (c4.uncovered):\n  // this is where agent-built code cuts its corners — the outbox, the retries,\n  // the alerts — because no business scenario was ever going to mention them.\n  // Grouping-only elements take the same exemptions the fleet map applies\n  // (person kinds, #external) — one set, in checks/vocabulary.ts, so \"not a\n  // service\" cannot mean two things. Warnings, never archive gates; `--strict`\n  // escalates.\n  //\n  // Only requirements the archive will MERGE grant coverage here. In a delta,\n  // BASE means \"the living state, quoted\": it merges nothing, emits no\n  // .feature, and yields no scenario.tested claim — so a Covers: line under a\n  // plain `## Requirements` quote is an obligation that ships nowhere, and\n  // counting it silenced c4.uncovered for free. (The service-scope pass keeps\n  // the unfiltered call: a LIVING spec is legitimately all BASE.)\n  const activeCovers = archDeltas.flatMap(({ reqs }) =>\n    coversEntries(reqs.filter((r) => r.kind === \"ADDED\" || r.kind === \"MODIFIED\")),\n  );\n\n  // What the living landscape ALREADY holds. A delta has to re-declare the\n  // elements its new edges attach to, and authors tag those re-declarations\n  // along with everything else — so a requirements-only feature that touches an\n  // existing service was told to write `Covers:` lines for architecture it is\n  // not adding. c4.uncovered is an obligation on NEW architecture; an element\n  // the living landscape already resolves is not new, whatever the tag says.\n  // Loaded lazily: a delta with nothing tagged never pays for the parse.\n  let living: LoadedDoc | null | undefined = preloadedLand;\n  const livingLandscape = async (): Promise<LoadedDoc | null> => {\n    if (living === undefined) {\n      const lp = landscapeFile(docsDir);\n      living = existsSync(lp)\n        ? fleet === undefined\n          ? await loadFile(lp)\n          : await fleet.loadLikeC4(lp)\n        : null;\n    }\n    return living;\n  };\n  const alreadyLiving = async (): Promise<LoadedDoc | null> => {\n    if (taggedEls.length === 0 && taggedRels.length === 0) return null;\n    const doc = await livingLandscape();\n    return doc !== null && doc.errors.length === 0 ? doc : null;\n  };\n  const base = await alreadyLiving();\n  const baseSvcOf = base === null ? null : serviceResolver(base.elements, known);\n  const baseIds = new Set(base?.elements.map((e) => e.id) ?? []);\n  const baseServices = new Set((base?.elements ?? []).map(elementService));\n  // How a service→service pair is keyed, spelled ONCE. The two sides used to\n  // join with different separators — a NUL where the set was built, a space\n  // where it was queried — so the exemption never matched anything, and every\n  // edge a delta re-declares verbatim (which it must, to attach anything to\n  // it) was reported as new architecture nobody covers. The join is structural\n  // rather than a separator character: the last one was a NUL, and a raw NUL in\n  // a template literal makes the source read as binary to `file` and invisible\n  // to `grep` — which is how a one-character mismatch survived review.\n  const edgeKey = (source: string, target: string): string => JSON.stringify([source, target]);\n  const baseEdges = new Set(\n    (base?.relationships ?? []).map((r) => edgeKey(baseSvcOf!(r.source), baseSvcOf!(r.target))),\n  );\n\n  for (const e of taggedEls) {\n    if (ACTOR_KINDS.has(e.kind.toLowerCase()) || e.tags.includes(EXTERNAL_TAG)) continue;\n    if (baseIds.has(e.id) || baseServices.has(elementService(e))) continue;\n    if (activeCovers.some((c) => coversElement(c, e))) continue;\n    findings.push({\n      severity: \"warn\",\n      code: \"c4.uncovered\",\n      subject: elementService(e),\n      message: `delta adds '${e.title}' (${e.id}) but no arch requirement covers it — add 'Covers: ${e.id}' to a specs/<svc>/arch.spec.md delta, or its architectural obligations ship unchecked`,\n    });\n  }\n  for (const r of taggedRels) {\n    if (baseEdges.has(edgeKey(svcOf(r.source), svcOf(r.target)))) continue;\n    if (activeCovers.some((c) => coversEdge(c, r, elements, known))) continue;\n    findings.push({\n      severity: \"warn\",\n      code: \"c4.uncovered\",\n      subject: svcOf(r.target),\n      message: `delta adds edge ${svcOf(r.source)} → ${svcOf(r.target)} (\"${r.title ?? \"\"}\") but no arch requirement covers it — add 'Covers: ${r.source} -> ${r.target}' to a specs/<svc>/arch.spec.md delta`,\n    });\n  }\n\n  // covers.unknown, feature scope. Resolution looks at the delta itself, the\n  // living landscape, the service's own model and its health.yaml — a delta's\n  // arch requirement may cover an element it adds, one that already exists, or\n  // an alert the service declares. The landscape and each model are loaded\n  // lazily, and only when an entry fails against what is already in hand: the\n  // clean path never pays for a workspace spin.\n  if (archDeltas.some(({ reqs }) => coversEntries(reqs).length > 0)) {\n    const land = await livingLandscape();\n    const landParses = land !== null && land.errors.length === 0 ? land : null;\n    const baseElements = [...elements, ...(landParses?.elements ?? [])];\n    const baseRels = [...relationships, ...(landParses?.relationships ?? [])];\n    for (const { service: svc, reqs } of archDeltas) {\n      // An unreadable living health.yaml mutes the alert:/sli: entries here\n      // exactly as in service scope — the health.invalid finding itself\n      // belongs to the service target, which owns the file's diagnosis.\n      const health = await readHealth((await locateServicePaths(docsDir, svc, fleet)).health);\n      let scope: CoverageScope = { elements: baseElements, relationships: baseRels, health: health.ids, known };\n      const unresolved = coversUnknownFindings(reqs, { where: `${svc}: arch.spec.md`, subject: svc }, scope, health.unreadable);\n      if (unresolved.length > 0) {\n        const modelPath = (await locateServicePaths(docsDir, svc, fleet)).model;\n        const model = existsSync(modelPath)\n          ? fleet === undefined\n            ? await loadFile(modelPath)\n            : await fleet.loadLikeC4(modelPath)\n          : null;\n        if (model !== null && model.errors.length === 0) {\n          scope = {\n            elements: [...baseElements, ...model.elements],\n            relationships: [...baseRels, ...model.relationships],\n            health: health.ids,\n            known,\n          };\n        }\n        findings.push(...coversUnknownFindings(reqs, { where: `${svc}: arch.spec.md`, subject: svc }, scope, health.unreadable));\n      }\n    }\n  }\n\n  return findings;\n}\n\n/** Heuristic: an edge is \"covered\" if a scenario names the target or a keyword from the edge title. */\nfunction edgeCovered(target: string, title: string | undefined, scenarioText: string): boolean {\n  if (scenarioText.includes(target.toLowerCase())) return true;\n  for (const token of (title ?? \"\").split(/[^A-Za-z0-9]+/)) {\n    if (token.length >= 5 && scenarioText.includes(token.toLowerCase())) return true;\n  }\n  return false;\n}\n"]}
+{"version":3,"file":"arch-coverage.js","sourceRoot":"","sources":["../../../src/commands/validate/arch-coverage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAuC,MAAM,yBAAyB,CAAC;AAC9E,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACnF,OAAO,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAClE,OAAO,EAAwB,MAAM,kCAAkC,CAAC;AACxE,OAAO,EAAE,aAAa,IAAI,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EAAgB,MAAM,iCAAiC,CAAC;AAC/D,OAAO,EAAoB,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,aAAa,EAAsB,MAAM,uBAAuB,CAAC;AACtF,OAAO,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAChF,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAwCxH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAAgB;IACtD,MAAM,EACJ,OAAO,EACP,UAAU,EACV,SAAS,EACT,QAAQ,EACR,aAAa,EACb,SAAS,EACT,UAAU,EACV,UAAU,EACV,eAAe,EACf,YAAY,EACZ,aAAa,EACb,KAAK,GACN,GAAG,KAAK,CAAC;IACV,MAAM,QAAQ,GAAc,EAAE,CAAC;IAE/B,8EAA8E;IAC9E,+EAA+E;IAC/E,2EAA2E;IAC3E,2EAA2E;IAC3E,4EAA4E;IAC5E,4EAA4E;IAC5E,yEAAyE;IACzE,+DAA+D;IAC/D,uEAAuE;IACvE,yEAAyE;IACzE,4EAA4E;IAC5E,mBAAmB;IACnB,MAAM,KAAK,GAAwB,IAAI,GAAG,CAAS;QACjD,GAAG,CAAC,MAAM,oBAAoB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC/C,GAAG,eAAe;KACnB,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,eAAe,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC/C,8EAA8E;IAC9E,8EAA8E;IAC9E,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAE7E,iGAAiG;IACjG,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC/B,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;QAC3D,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM;YACjC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,oBAAoB;YACzD,OAAO,EAAE,MAAM;YACf,OAAO,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,MAAM,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,0BAA0B,EAAE;YACzG,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,iCAAiC,EAAE;SAC/D,CAAC,CAAC;IACL,CAAC;IAED,4EAA4E;IAC5E,8EAA8E;IAC9E,6EAA6E;IAC7E,6EAA6E;IAC7E,4EAA4E;IAC5E,wEAAwE;IACxE,0EAA0E;IAC1E,8EAA8E;IAC9E,4EAA4E;IAC5E,4EAA4E;IAC5E,4EAA4E;IAC5E,qEAAqE;IACrE,aAAa;IACb,EAAE;IACF,4EAA4E;IAC5E,qEAAqE;IACrE,4EAA4E;IAC5E,yEAAyE;IACzE,4EAA4E;IAC5E,gEAAgE;IAChE,MAAM,YAAY,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CACnD,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAC/E,CAAC;IAEF,yEAAyE;IACzE,0EAA0E;IAC1E,8EAA8E;IAC9E,4EAA4E;IAC5E,4EAA4E;IAC5E,2EAA2E;IAC3E,uEAAuE;IACvE,IAAI,MAAM,GAAiC,aAAa,CAAC;IACzD,MAAM,eAAe,GAAG,KAAK,IAA+B,EAAE;QAC5D,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,EAAE,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;YAClC,MAAM,GAAG,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9D,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IACF,MAAM,aAAa,GAAG,KAAK,IAA+B,EAAE;QAC1D,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACnE,MAAM,GAAG,GAAG,MAAM,eAAe,EAAE,CAAC;QACpC,OAAO,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,aAAa,EAAE,CAAC;IACnC,MAAM,SAAS,GAAG,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC/E,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/D,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;IACzE,2EAA2E;IAC3E,0EAA0E;IAC1E,4EAA4E;IAC5E,0EAA0E;IAC1E,6EAA6E;IAC7E,8EAA8E;IAC9E,6EAA6E;IAC7E,qEAAqE;IACrE,MAAM,OAAO,GAAG,CAAC,MAAc,EAAE,MAAc,EAAU,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC7F,MAAM,SAAS,GAAG,IAAI,GAAG,CACvB,CAAC,IAAI,EAAE,aAAa,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,SAAU,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,SAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAC5F,CAAC;IAEF,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;QAC1B,IAAI,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,cAAc,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC;YAAE,SAAS;QAC3H,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;YAAE,SAAS;QACvE,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAAE,SAAS;QAC5D,2EAA2E;QAC3E,+DAA+D;QAC/D,MAAM,KAAK,GAAG,MAAM,qBAAqB,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,MAAM,CAAC,CAAC;QACvE,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC;YAAE,SAAS;QAC/E,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC;YAC1B,OAAO,EAAE,eAAe,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,EAAE,sDAAsD,KAAK,wFAAwF;SAC7L,CAAC,CAAC;IACL,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;YAAE,SAAS;QACvE,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;YAAE,SAAS;QAC1E,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;YACxB,OAAO,EAAE,mBAAmB,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,uDAAuD,kBAAkB,CAAC,CAAC,EAAE,KAAK,CAAC,uCAAuC;SAC9M,CAAC,CAAC;IACL,CAAC;IAED,2EAA2E;IAC3E,4EAA4E;IAC5E,6EAA6E;IAC7E,yEAAyE;IACzE,4EAA4E;IAC5E,8CAA8C;IAC9C,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,GAAG,MAAM,eAAe,EAAE,CAAC;QACrC,MAAM,UAAU,GAAG,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;QAC3E,MAAM,YAAY,GAAG,CAAC,GAAG,QAAQ,EAAE,GAAG,CAAC,UAAU,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC;QACpE,MAAM,QAAQ,GAAG,CAAC,GAAG,aAAa,EAAE,GAAG,CAAC,UAAU,EAAE,aAAa,IAAI,EAAE,CAAC,CAAC,CAAC;QAC1E,8EAA8E;QAC9E,wEAAwE;QACxE,2EAA2E;QAC3E,MAAM,cAAc,GAAG,UAAU,EAAE,UAAU,CAAC;QAC9C,KAAK,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,UAAU,EAAE,CAAC;YAChD,sEAAsE;YACtE,kEAAkE;YAClE,kEAAkE;YAClE,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;YAC/D,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACjD,yEAAyE;YACzE,yEAAyE;YACzE,qEAAqE;YACrE,yEAAyE;YACzE,wEAAwE;YACxE,yEAAyE;YACzE,oDAAoD;YACpD,IAAI,SAA0E,CAAC;YAC/E,MAAM,KAAK,GAAG,GAAwD,EAAE,CACtE,CAAC,SAAS,KAAK,CAAC,KAAK,IAAI,EAAE;gBACzB,MAAM,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;gBAC1F,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,aAAa,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;oBAChE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,aAAa,EAAE,CAAC,CAAC,GAAG,CAAC,aAAa,EAAE;oBAClE,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC;YAC1C,CAAC,CAAC,EAAE,CAAC,CAAC;YACR,IAAI,KAAK,GAAkB;gBACzB,QAAQ,EAAE,YAAY;gBACtB,aAAa,EAAE,QAAQ;gBACvB,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,cAAc,EAAE,CAAC;gBACvE,MAAM,EAAE,MAAM,CAAC,GAAG;gBAClB,KAAK;aACN,CAAC;YACF,MAAM,UAAU,GAAG,qBAAqB,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,GAAG,gBAAgB,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;YAC1H,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC1B,MAAM,CAAC,GAAG,MAAM,KAAK,EAAE,CAAC;gBACxB,oEAAoE;gBACpE,uEAAuE;gBACvE,+CAA+C;gBAC/C,KAAK,GAAG;oBACN,GAAG,KAAK;oBACR,QAAQ,EAAE,CAAC,GAAG,YAAY,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC;oBAC1C,aAAa,EAAE,CAAC,GAAG,QAAQ,EAAE,GAAG,CAAC,CAAC,aAAa,CAAC;iBACjD,CAAC;gBACF,0EAA0E;gBAC1E,uEAAuE;gBACvE,wEAAwE;gBACxE,gCAAgC;gBAChC,MAAM,KAAK,GAAG,qBAAqB,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,MAAM,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;gBACjJ,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;oBACxB,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,CAAC,GAAG,KAAK,CAAC,QAAQ,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC,EAAE,aAAa,EAAE,CAAC,GAAG,KAAK,CAAC,aAAa,EAAE,GAAG,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC;gBAC1I,CAAC;gBACD,QAAQ,CAAC,IAAI,CAAC,GAAG,qBAAqB,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,GAAG,gBAAgB,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;YAC3H,CAAC;YACD,uEAAuE;YACvE,yEAAyE;YACzE,gEAAgE;YAChE,QAAQ,CAAC,IAAI,CACX,GAAG,CAAC,MAAM,kBAAkB,CAAC;gBAC3B,OAAO,EAAE,GAAG;gBACZ,IAAI;gBACJ,YAAY,EAAE,KAAK;gBACnB,MAAM,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,IAAI,EAAE,EAAE,aAAa,EAAE,UAAU,EAAE,aAAa,IAAI,EAAE,EAAE;gBAChG,KAAK;gBACL,QAAQ;gBACR,KAAK;gBACL,MAAM;aACP,CAAC,CAAC,CACJ,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,uGAAuG;AACvG,SAAS,WAAW,CAAC,MAAc,EAAE,KAAyB,EAAE,YAAoB;IAClF,IAAI,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,KAAK,MAAM,KAAK,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,CAAC;QACzD,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC;IACnF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC","sourcesContent":["/**\n * Whether the architecture a delta INTRODUCES is covered by a requirement that\n * will actually merge.\n *\n * Three findings, one question asked three ways: `archedge.uncovered` (a\n * scenario names the new edge — heuristic, warn-only), `c4.uncovered` (an\n * arch.spec.md requirement covers the new element or edge — mechanical), and\n * `covers.unknown` (the `Covers:` line resolves to something real). This is\n * where agent-built code cuts its corners — the outbox, the retries, the alerts\n * — because no business scenario was ever going to mention them.\n *\n * Split out of `validateFeature` because it is the only part of the feature\n * target that needs the LIVING landscape: everything else there reads the\n * feature directory alone. Keeping the lazy load and its two exemption sets in\n * one module is what stops \"new\" being decided differently in three places.\n */\nimport { existsSync } from \"node:fs\";\nimport { type Elem, type LoadedDoc, type Rel } from \"../../core/c4/likec4.js\";\nimport { elementService, serviceResolver } from \"../../core/c4/resolve/service.js\";\nimport { groupsServices } from \"../../core/c4/resolve/systems.js\";\nimport { type PathableService } from \"../../core/kernel/ids/service.js\";\nimport { landscapePath as landscapeFile } from \"../../core/repo/paths.js\";\nimport { locateServicePaths } from \"../../core/repo/service-target.js\";\nimport { enumeratedServiceIds } from \"../../core/repo/service-target.js\";\nimport { type Finding } from \"../../core/vocabulary/report.js\";\nimport { type Requirement } from \"../../core/document/spec.js\";\nimport { coversEdge, coversElement, type CoverageScope } from \"../../core/c4/arch.js\";\nimport { readHealth } from \"../../core/vocabulary/health.js\";\nimport { FleetContext } from \"../../core/fleet-context.js\";\nimport { ACTOR_KINDS, EXTERNAL_TAG } from \"../../core/vocabulary/maturity.js\";\nimport { coversEntries, coversUnknownFindings } from \"./checks/requirements.js\";\nimport { deltaSpelledCovers, mergedMapOf, survivingEdgeCover, survivingElementCover } from \"./coverage/covers-after.js\";\nimport type { DocsDir, FeatureDir } from \"../../core/kernel/ids/dirs.js\";\n\n/** One feature delta's architecture, and everything needed to decide what in it is new. */\nexport interface DeltaArch {\n  docsDir: DocsDir;\n  /** The feature itself — what the merge preview a `Covers:` line is checked against is computed from. */\n  featureDir: FeatureDir;\n  featureId: string;\n  /** Every element the delta declares — the resolver's index, and `coversEdge`'s scope. */\n  elements: Elem[];\n  /** Every relationship the delta declares. */\n  relationships: Rel[];\n  /** The delta's own additions: elements and edges carrying the feature id as a tag. */\n  taggedEls: Elem[];\n  taggedRels: Rel[];\n  /** Each addressed service's arch.spec.md delta, in enumeration order. */\n  archDeltas: Array<{ service: PathableService; reqs: Requirement[] }>;\n  /**\n   * Every service the feature's `specs/` addresses — not just the ones with an\n   * arch delta. The resolver's fleet set unions these in because a service the\n   * feature INTRODUCES has no `services/` directory yet, and without its name\n   * an edge into that service's own modelled container resolved to the\n   * container's title — a phantom the fleet half alone cannot rule out.\n   */\n  featureServices: PathableService[];\n  /** Every scenario the feature's deltas carry, lowercased — the heuristic's haystack. */\n  scenarioText: string;\n  /** The living landscape under --all; undefined means \"load it if you need it\", null \"there is none\". */\n  preloadedLand?: LoadedDoc | null;\n  /**\n   * The read index the service models below are read through. Required, for\n   * `validateService`'s reason: `serviceModel` needs the enumeration and a\n   * document memo to answer at all. Every validate mode builds one before it\n   * grades anything — `--feature` included (`validate.ts`) — so there is no\n   * second, unmemoised reading rule here for a run that arrived without one.\n   */\n  fleet: FleetContext;\n}\n\nexport async function deltaArchCoverage(delta: DeltaArch): Promise<Finding[]> {\n  const {\n    docsDir,\n    featureDir,\n    featureId,\n    elements,\n    relationships,\n    taggedEls,\n    taggedRels,\n    archDeltas,\n    featureServices,\n    scenarioText,\n    preloadedLand,\n    fleet,\n  } = delta;\n  const findings: Finding[] = [];\n\n  // The delta's own element→service resolver, built once for the whole feature.\n  // `serviceOf` is a one-shot wrapper that rebuilds its index on every call, and\n  // the two loops below ask it up to five times per tagged edge — so a delta\n  // over a large model paid for one Map of every element per question asked.\n  // The enumerated fleet — `services/` plus the feature's own `specs/` names,\n  // where a service it introduces lives — rides into it, and into `baseSvcOf`\n  // below, which MUST resolve the same way or the already-living exemption\n  // keys never match: so an edge drawn into a modelled container\n  // (`payment.api`) grades against the service that owns it instead of a\n  // service called \"api\" that has never existed. An unenumerable services/\n  // degrades to the feature's own names, exactly what every caller got before\n  // the set existed.\n  const known: ReadonlySet<string> = new Set<string>([\n    ...(await enumeratedServiceIds(docsDir, fleet)),\n    ...featureServices,\n  ]);\n  const svcOf = serviceResolver(elements, known);\n  // The map this feature's merge would leave, parsed at most once and only when\n  // a hint or a `Covers:` line needs it (./coverage/covers-after.ts says when).\n  const merged = mergedMapOf({ docsDir, featureDir, featureId, fleet, known });\n\n  // Arch-edge coverage (heuristic, warn-only): each new tagged edge should be named by a scenario.\n  for (const r of taggedRels) {\n    const target = svcOf(r.target);\n    const covered = edgeCovered(target, r.title, scenarioText);\n    findings.push({\n      severity: covered ? \"ok\" : \"warn\",\n      code: covered ? \"archedge.covered\" : \"archedge.uncovered\",\n      subject: target,\n      message: `${svcOf(r.source)} → ${target}  \"${r.title ?? \"\"}\"${covered ? \"\" : \"  — no scenario names it\"}`,\n      text: { indent: 4, header: \"arch-edge coverage (heuristic):\" },\n    });\n  }\n\n  // The architecture spec axis, feature scope — the mechanical counterpart of\n  // the heuristic above. Every NEW tagged element and edge in the delta wants a\n  // `Covers:` line in one of the feature's arch.spec.md deltas (c4.uncovered):\n  // this is where agent-built code cuts its corners — the outbox, the retries,\n  // the alerts — because no business scenario was ever going to mention them.\n  // Grouping-only elements take the same exemptions the fleet map applies\n  // (person kinds, #external) — one set, in core/vocabulary/maturity.ts, so\n  // \"not a service\" cannot mean two things — and so does a GROUPING, an element\n  // that stands for no service and contains one (core/c4/resolve/systems.ts).\n  // A new domain drawn around a new service was asked for a `Covers:` line of\n  // its own: there is no obligation a group can carry, and the service inside\n  // it is graded on its own. Warnings, never archive gates; `--strict`\n  // escalates.\n  //\n  // Only requirements the archive will MERGE grant coverage here. In a delta,\n  // BASE means \"the living state, quoted\": it merges nothing, emits no\n  // .feature, and yields no scenario.tested claim — so a Covers: line under a\n  // plain `## Requirements` quote is an obligation that ships nowhere, and\n  // counting it silenced c4.uncovered for free. (The service-scope pass keeps\n  // the unfiltered call: a LIVING spec is legitimately all BASE.)\n  const activeCovers = archDeltas.flatMap(({ reqs }) =>\n    coversEntries(reqs.filter((r) => r.kind === \"ADDED\" || r.kind === \"MODIFIED\")),\n  );\n\n  // What the living landscape ALREADY holds. A delta has to re-declare the\n  // elements its new edges attach to, and authors tag those re-declarations\n  // along with everything else — so a requirements-only feature that touches an\n  // existing service was told to write `Covers:` lines for architecture it is\n  // not adding. c4.uncovered is an obligation on NEW architecture; an element\n  // the living landscape already resolves is not new, whatever the tag says.\n  // Loaded lazily: a delta with nothing tagged never pays for the parse.\n  let living: LoadedDoc | null | undefined = preloadedLand;\n  const livingLandscape = async (): Promise<LoadedDoc | null> => {\n    if (living === undefined) {\n      const lp = landscapeFile(docsDir);\n      living = existsSync(lp) ? await fleet.loadLikeC4(lp) : null;\n    }\n    return living;\n  };\n  const alreadyLiving = async (): Promise<LoadedDoc | null> => {\n    if (taggedEls.length === 0 && taggedRels.length === 0) return null;\n    const doc = await livingLandscape();\n    return doc !== null && doc.errors.length === 0 ? doc : null;\n  };\n  const base = await alreadyLiving();\n  const baseSvcOf = base === null ? null : serviceResolver(base.elements, known);\n  const baseIds = new Set(base?.elements.map((e) => e.id) ?? []);\n  const baseServices = new Set((base?.elements ?? []).map(elementService));\n  // How a service→service pair is keyed, spelled ONCE. The two sides used to\n  // join with different separators — a NUL where the set was built, a space\n  // where it was queried — so the exemption never matched anything, and every\n  // edge a delta re-declares verbatim (which it must, to attach anything to\n  // it) was reported as new architecture nobody covers. The join is structural\n  // rather than a separator character: the last one was a NUL, and a raw NUL in\n  // a template literal makes the source read as binary to `file` and invisible\n  // to `grep` — which is how a one-character mismatch survived review.\n  const edgeKey = (source: string, target: string): string => JSON.stringify([source, target]);\n  const baseEdges = new Set(\n    (base?.relationships ?? []).map((r) => edgeKey(baseSvcOf!(r.source), baseSvcOf!(r.target))),\n  );\n\n  for (const e of taggedEls) {\n    if (ACTOR_KINDS.has(e.kind.toLowerCase()) || e.tags.includes(EXTERNAL_TAG) || groupsServices(e, elements, known)) continue;\n    if (baseIds.has(e.id) || baseServices.has(elementService(e))) continue;\n    if (activeCovers.some((c) => coversElement(c, e))) continue;\n    // Spelled in the space it will live in, the line covers it too: the id the\n    // merge gives an element is the one the hint below recommends.\n    const cover = await survivingElementCover(e, { svcOf, known }, merged);\n    if (activeCovers.some((c) => c.form === \"element\" && c.id === cover)) continue;\n    findings.push({\n      severity: \"warn\",\n      code: \"c4.uncovered\",\n      subject: elementService(e),\n      message: `delta adds '${e.title}' (${e.id}) but no arch requirement covers it — add 'Covers: ${cover}' to a specs/<svc>/arch.spec.md delta, or its architectural obligations ship unchecked`,\n    });\n  }\n  for (const r of taggedRels) {\n    if (baseEdges.has(edgeKey(svcOf(r.source), svcOf(r.target)))) continue;\n    if (activeCovers.some((c) => coversEdge(c, r, elements, known))) continue;\n    findings.push({\n      severity: \"warn\",\n      code: \"c4.uncovered\",\n      subject: svcOf(r.target),\n      message: `delta adds edge ${svcOf(r.source)} → ${svcOf(r.target)} (\"${r.title ?? \"\"}\") but no arch requirement covers it — add 'Covers: ${survivingEdgeCover(r, svcOf)}' to a specs/<svc>/arch.spec.md delta`,\n    });\n  }\n\n  // covers.unknown, feature scope. Resolution looks at the delta itself, the\n  // living landscape, the service's own model and its health.yaml — a delta's\n  // arch requirement may cover an element it adds, one that already exists, or\n  // an alert the service declares. The landscape and each model are loaded\n  // lazily, and only when an entry fails against what is already in hand: the\n  // clean path never pays for a workspace spin.\n  if (archDeltas.some(({ reqs }) => coversEntries(reqs).length > 0)) {\n    const land = await livingLandscape();\n    const landParses = land !== null && land.errors.length === 0 ? land : null;\n    const baseElements = [...elements, ...(landParses?.elements ?? [])];\n    const baseRels = [...relationships, ...(landParses?.relationships ?? [])];\n    // A feature never brings topology through `delta.likec4` — a `deployment { }`\n    // block in one is refused by the merge — so the living map is the whole\n    // scope for a `node:` entry in a delta, exactly as it is in service scope.\n    const baseDeployment = landParses?.deployment;\n    for (const { service: svc, reqs } of archDeltas) {\n      // An unreadable living health.yaml mutes the alert:/sli: entries here\n      // exactly as in service scope — the health.invalid finding itself\n      // belongs to the service target, which owns the file's diagnosis.\n      const svcPaths = await locateServicePaths(docsDir, svc, fleet);\n      const health = await readHealth(svcPaths.health);\n      // Through the ONE reader of `model.likec4`: a model that EXTENDS the map\n      // is not a file this could open, and reading it as one would answer with\n      // a pile of parse errors — which this arm reads as \"no widening\", so\n      // every `Covers:` line naming a container of a migrated service would be\n      // convicted as a typo. `mapUnreadable` is the same silence for the same\n      // reason: nothing may widen a scope out of a document nobody could read.\n      // Read at most once, and only when a line needs it.\n      let modelRead: Promise<{ elements: Elem[]; relationships: Rel[] }> | undefined;\n      const model = (): Promise<{ elements: Elem[]; relationships: Rel[] }> =>\n        (modelRead ??= (async () => {\n          const m = existsSync(svcPaths.model) ? await fleet.serviceModel(docsDir, svcPaths) : null;\n          return m !== null && !m.mapUnreadable && m.doc.errors.length === 0\n            ? { elements: m.doc.elements, relationships: m.doc.relationships }\n            : { elements: [], relationships: [] };\n        })());\n      let scope: CoverageScope = {\n        elements: baseElements,\n        relationships: baseRels,\n        ...(baseDeployment === undefined ? {} : { deployment: baseDeployment }),\n        health: health.ids,\n        known,\n      };\n      const unresolved = coversUnknownFindings(reqs, { where: `${svc}: arch.spec.md`, subject: svc }, scope, health.unreadable);\n      if (unresolved.length > 0) {\n        const m = await model();\n        // Widened, never narrowed: the topology rides along. Rebuilding the\n        // record without it convicted every `node:` entry as a typo the moment\n        // another entry beside it sent the scope here.\n        scope = {\n          ...scope,\n          elements: [...baseElements, ...m.elements],\n          relationships: [...baseRels, ...m.relationships],\n        };\n        // The map the merge would leave widens it last, and only for a line still\n        // unresolved: one spelled the way the living map will spell an element\n        // this feature adds resolves there and nowhere else yet — and it is the\n        // spelling the hints recommend.\n        const after = coversUnknownFindings(reqs, { where: svc, subject: svc }, scope, health.unreadable).length > 0 ? (await merged())?.doc : undefined;\n        if (after !== undefined) {\n          scope = { ...scope, elements: [...scope.elements, ...after.elements], relationships: [...scope.relationships, ...after.relationships] };\n        }\n        findings.push(...coversUnknownFindings(reqs, { where: `${svc}: arch.spec.md`, subject: svc }, scope, health.unreadable));\n      }\n      // And the lines that DID resolve, read in the space they will live in:\n      // one that answered only through the delta's own ids is `covers.unknown`\n      // the moment the archive lands it (./coverage/covers-after.ts).\n      findings.push(\n        ...(await deltaSpelledCovers({\n          service: svc,\n          reqs,\n          featureScope: scope,\n          living: { elements: landParses?.elements ?? [], relationships: landParses?.relationships ?? [] },\n          model,\n          elements,\n          svcOf,\n          merged,\n        })),\n      );\n    }\n  }\n\n  return findings;\n}\n\n/** Heuristic: an edge is \"covered\" if a scenario names the target or a keyword from the edge title. */\nfunction edgeCovered(target: string, title: string | undefined, scenarioText: string): boolean {\n  if (scenarioText.includes(target.toLowerCase())) return true;\n  for (const token of (title ?? \"\").split(/[^A-Za-z0-9]+/)) {\n    if (token.length >= 5 && scenarioText.includes(token.toLowerCase())) return true;\n  }\n  return false;\n}\n"]}

package/dist/commands/validate/checks/fleet-shape.js

@@ -1,41 +1,35 @@
 /**
- * Fleet-shape advisories over the parsed landscape: the two ways a fleet map
- * stops answering questions as it grows, caught while the map is already in
- * memory.
+ * Fleet-shape advisories over the parsed landscape: the way a fleet map stops
+ * answering questions as it grows, caught while the map is already in memory.
  *
- * Both shapes become visible at service three rather than service two.
+ * The shape becomes visible at service three rather than service two.
  * Ubiquitous infrastructure — logging Kafka, an identity provider, service
  * discovery — takes one inbound edge per modelled service until the map is a
  * hairball around it; deleting the element fixes the picture and loses "who
  * depends on the Identity Provider", which is the question the map exists to
  * answer during an incident. Tagging keeps both: the fleet view excludes
- * `#platform`, and a platform view keeps the dependents. And a datastore drawn as a fleet-level
- * peer makes a claim its consumer count either supports or refutes: one
- * consumer means the drawing is false — the store is that service's
- * internals, not a system in its own right — while two or more mean the
- * strongest coupling two services can have, which deserves to be stated
- * rather than inferred.
+ * `#platform`, and a platform view keeps the dependents.
  *
- * Everything here is O(relationships) over data the fleet target already
- * holds. loam still reads no code and decides no policy: the team chooses
- * what counts as platform and which data is truly shared — these warnings
- * only name the shapes that are usually wrong.
+ * The DATASTORE half of this pair moved to `../fleet/map/consumers.ts` when its
+ * consumer count stopped being a fact about the map alone: a private store now
+ * lives nested inside its owner's element, and the services reaching it are
+ * attested in their own models (E3/R1). The census both checks read is built
+ * there and handed in here as `consumers`, so a hub and a store can never
+ * disagree about who consumes what.
+ *
+ * loam still reads no code and decides no policy: the team chooses what counts
+ * as platform — this warning only names a shape that is usually wrong.
  */
 import { existsSync } from "node:fs";
-import { readFile } from "node:fs/promises";
 import {} from "../../../core/c4/likec4.js";
-import {} from "../../../core/kernel/ids/service.js";
 import {} from "../../../core/vocabulary/report.js";
 import {} from "../../../core/repo/entries.js";
 import { permissionsPath, servicePathsAt } from "../../../core/repo/paths.js";
 import { readVocabulary } from "../../../core/permissions/permissions.js";
-import { readCapabilityVocabulary } from "../../../core/capabilities/capabilities.js";
 import { capabilityDocFindings, capabilityRequirementIndex, docMissingFindings, gradableCapabilityIds, invalidVocabularyFinding, unrealizedFindings, } from "../../../core/capabilities/findings.js";
 import { useCaseRequirementClaims } from "../../../core/usecases/capability.js";
 import { capabilityRollup, usedCapabilities } from "../../../core/capabilities/rollup.js";
 import { requirementUnrealizedFindings } from "../../../core/capabilities/realizes/findings.js";
-import { parseRequirements } from "../../../core/document/parse.js";
-import {} from "../../../core/document/spec.js";
 import { FleetContext } from "../../../core/fleet-context.js";
 import { EXTERNAL_TAG, PLATFORM_TAG } from "../../../core/vocabulary/maturity.js";
 /**
@@ -45,91 +39,33 @@ import { EXTERNAL_TAG, PLATFORM_TAG } from "../../../core/vocabulary/maturity.js
  * the shared hub starts making the map unreadable.
  */
 export const PLATFORM_CANDIDATE_MIN_CONSUMERS = 3;
-/** The element kind read as a datastore, compared case-insensitively. */
-const DATASTORE_KIND = "database";
 export function fleetShapeFindings(shape) {
-    const { drawn, relationships, services, resolve } = shape;
+    const { drawn, services } = shape;
     const findings = [];
-    // Distinct consumer SERVICES of an element, its nested children included: an
-    // edge into `kafka.paymentEvents` is consumption of `kafka`. Persons, other
-    // external systems and unresolved sources never count — a consumer is a
-    // source the shared resolver files under a real services/<id>/, so two edges
-    // from one service are one consumer.
-    const consumersOf = (e) => {
-        const out = new Set();
-        for (const r of relationships) {
-            if (r.target !== e.id && !r.target.startsWith(`${e.id}.`))
-                continue;
-            const svc = resolve(r.source);
-            if (services.has(svc))
-                out.add(svc);
-        }
-        return [...out].sort();
-    };
     for (const e of drawn) {
         // An element that stands for a real service is the fleet itself, not its
-        // shape: many consumers is what a well-used service looks like, and a
-        // datastore bound to a directory is graded by the binding checks instead.
+        // shape: many consumers is what a well-used service looks like.
         if (e.service !== undefined || services.has(e.title))
             continue;
-        const consumers = consumersOf(e);
-        if (e.tags.includes(EXTERNAL_TAG) &&
-            !e.tags.includes(PLATFORM_TAG) &&
-            consumers.length >= PLATFORM_CANDIDATE_MIN_CONSUMERS) {
-            findings.push({
-                severity: "warn",
-                code: "landscape.platform-candidate",
-                subject: e.title,
-                message: `landscape: '${e.title}' is consumed by ${consumers.length} services (${consumers.join(", ")}) ` +
-                    `and is not tagged #platform — a hub like this takes one more edge per modelled service until ` +
-                    `the fleet view is unreadable. Declare \`tag platform\` in the specification block and tag the ` +
-                    `element (LikeC4 refuses an undeclared tag, so both steps are needed): the fleet view then ` +
-                    `excludes it, and a platform view over \`include * -> element.tag = #platform\` keeps ` +
-                    `"who depends on it" answerable`,
-            });
-        }
-        if (e.kind.toLowerCase() !== DATASTORE_KIND || consumers.length === 0)
+        if (!e.tags.includes(EXTERNAL_TAG) || e.tags.includes(PLATFORM_TAG))
             continue;
-        if (consumers.length === 1) {
-            findings.push({
-                severity: "warn",
-                code: "landscape.datastore-private",
-                subject: e.title,
-                message: `landscape: '${e.title}' is a datastore with a single consumer at fleet level ` +
-                    `('${consumers[0]}') — drawn as a peer it reads as a system in its own right, available to ` +
-                    `be depended on. Move it into ${shape.pathOf(consumers[0])}/model.likec4 as a nested container ` +
-                    `and delete it here, or add the second consumer's edge if another service really reaches ` +
-                    `the same data`,
-            });
-        }
-        else {
-            findings.push({
-                severity: "warn",
-                code: "landscape.datastore-shared",
-                subject: e.title,
-                message: `landscape: '${e.title}' is a datastore shared by ${consumers.length} services ` +
-                    `(${consumers.join(", ")}) — the strongest coupling two services can have, and the hardest ` +
-                    `to undo. Shared means the same DATA: if they read the same tables or keys, keep it drawn ` +
-                    `and let this warning state the coupling; if they only share a host or cluster (two schemas, ` +
-                    `two lock paths), that is operational blast radius — a runbook fact — and the honest model ` +
-                    `is one private store per service`,
-            });
-        }
+        const consumers = shape.consumers(e.id);
+        if (consumers.length < PLATFORM_CANDIDATE_MIN_CONSUMERS)
+            continue;
+        findings.push({
+            severity: "warn",
+            code: "landscape.platform-candidate",
+            subject: e.title,
+            message: `landscape: '${e.title}' is consumed by ${consumers.length} services (${consumers.join(", ")}) ` +
+                `and is not tagged #platform — a hub like this takes one more edge per modelled service until ` +
+                `the fleet view is unreadable. Declare \`tag platform\` in the specification block and tag the ` +
+                `element (LikeC4 refuses an undeclared tag, so both steps are needed): the fleet view then ` +
+                `excludes it, and a platform view over \`include * -> element.tag = #platform\` keeps ` +
+                `"who depends on it" answerable`,
+        });
     }
     return findings;
 }
-/**
- * The #external element that declares it PUBLISHES this message, or null —
- * the landscape-side half of the event spine's fleet question, beside the
- * other checks that read tags off the drawn map.
- *
- * Positive evidence only: an edge carrying `metadata { publishes '<msg>' }`
- * whose source element — itself or a declared ancestor, since the edge may
- * point out of a topic nested inside the broker — is tagged #external and
- * resolves to no known service directory. The resolution guard is what keeps
- * a mis-tagged internal service reading as unproduced: a tag is cheap to
- * write, and a services/<id>/ directory outranks it.
- */
 /**
  * The authorization vocabulary graded against the fleet that uses it — the half
  * of the axis no single service can answer.
@@ -165,14 +101,14 @@ export async function permissionFindings(docsDir, services, fleet) {
     for (const entry of services) {
         const paths = servicePathsAt(entry.dir);
         for (const path of [paths.spec, paths.archSpec]) {
-            // Existence first, and for BOTH readers: arch.spec.md is optional (most
+            // Existence first, and for BOTH documents: arch.spec.md is optional (most
             // of a legacy fleet has none) and spec.md is missing on a half-adopted
             // service. `FleetContext.readRequirements` throws ENOENT, which surfaces
             // as `repository-unavailable` and takes the whole `--all` run down — an
             // absent optional artifact must never be able to do that.
             if (!existsSync(path))
                 continue;
-            const reqs = fleet === undefined ? await readRequirementsAt(path) : await fleet.readRequirements(path);
+            const reqs = await fleet.readRequirements(path);
             for (const r of reqs) {
                 if (r.kind !== "REMOVED")
                     for (const p of r.requires)
@@ -192,12 +128,6 @@ export async function permissionFindings(docsDir, services, fleet) {
         },
     ];
 }
-/** The uncached read, for the `--service` path where no fleet context exists. */
-async function readRequirementsAt(path) {
-    if (!existsSync(path))
-        return [];
-    return parseRequirements(await readFile(path, "utf8"));
-}
 /**
  * The capability vocabulary graded against the fleet that realizes it — the
  * axis's fleet half, beside permissionFindings and shaped by the same two
@@ -227,10 +157,10 @@ async function readRequirementsAt(path) {
  * nobody read.
  */
 export async function capabilityFleetFindings(docsDir, services, fleet, flows) {
-    const vocab = fleet === undefined ? await readCapabilityVocabulary(docsDir) : await fleet.capabilities(docsDir);
+    const vocab = await fleet.capabilities(docsDir);
     if (!vocab.present)
         return [];
-    const read = fleet === undefined ? readRequirementsAt : (p) => fleet.readRequirements(p);
+    const read = (p) => fleet.readRequirements(p);
     const authored = docMissingFindings(vocab.tree);
     for (const doc of vocab.tree.docs)
         authored.push(...capabilityDocFindings(await read(doc.spec), doc.id));
@@ -271,26 +201,4 @@ export async function capabilityFleetFindings(docsDir, services, fleet, flows) {
         ...requirementUnrealizedFindings(unrealizedRequirements),
     ];
 }
-export function externalProducerOf(message, land, landSvcOf, known) {
-    if (land === null || land.errors.length > 0 || landSvcOf === null)
-        return null;
-    const knownIds = known;
-    const byId = new Map(land.elements.map((e) => [e.id, e]));
-    for (const r of land.relationships) {
-        if (r.publishes !== message)
-            continue;
-        if (knownIds.has(landSvcOf(r.source)))
-            continue;
-        for (let id = r.source;;) {
-            const e = byId.get(id);
-            if (e !== undefined && e.tags.includes(EXTERNAL_TAG))
-                return e.title;
-            const dot = id.lastIndexOf(".");
-            if (dot === -1)
-                break;
-            id = id.slice(0, dot);
-        }
-    }
-    return null;
-}
 //# sourceMappingURL=fleet-shape.js.map