@ybotok/loam 0.2.0-alpha.1 → 0.2.0-alpha.13

package/dist/commands/validate/fleet/load.js.map

@@ -1 +1 @@
-{"version":3,"file":"load.js","sourceRoot":"","sources":["../../../../src/commands/validate/fleet/load.ts"],"names":[],"mappings":"AAcA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAY;IAC9C,OAAO;QACL,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QACvE,QAAQ,EAAE,EAAE;QACZ,aAAa,EAAE,EAAE;KAClB,CAAC;AACJ,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAA8B;IAChE,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,EAAE,CAAC;IACtB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,mBAAmB,CAAC,GAAG,CAAC,CAAC;IAClC,CAAC;AACH,CAAC","sourcesContent":["/**\n * The landscape's contained load path — the one phase of the fleet target that\n * touches the filesystem before anything can be graded. Split from\n * `./landscape.ts` when the fleet target grew past the line limit; the\n * containment DOCTRINE below travelled with the functions it explains.\n *\n * The load ITSELF is no longer here. `loadArchitecture` moved to\n * `core/c4/project/architecture.ts` when the use-case axis grew a second reader\n * of it, and that module's banner records why; what stayed is the containment,\n * which is command-layer business because it is about which validate TARGET a\n * failed read is filed against.\n */\nimport type { LoadedDoc } from \"../../../core/c4/likec4.js\";\n\n/**\n * A landscape that could not be READ, shaped as one that did not PARSE.\n *\n * The landscape is the one artifact no target owns: it is read once for the\n * whole run and it is graded on a target of its own, which runs OUTSIDE\n * `guarded`. So a landscape.likec4 that is a directory, or that carries a\n * permission bit this process cannot open, escaped every per-target catch and\n * became the whole run's `repository-unavailable` — one file, and a fleet gate\n * that said nothing about the ninety-nine services that are fine. A DANGLING\n * symlink is not one of those shapes and never was: every read of the file is\n * gated on an `existsSync` that follows the link, so a broken one resolves as\n * `landscape.missing` long before anything opens it.\n *\n * What this contains is the FLEET-level reads, and only those: the `--all`\n * preload, and both reads inside `validateLandscape` — the conflict-marker\n * `readFile` and the parse. `loam validate --service <id>` and\n * `loam validate --feature <id>` hand in no preloaded doc, so `validateService`\n * and `validateFeature` open the same file again on demand, unwrapped and\n * INSIDE `guarded`: an EISDIR there is still reported as `service.unreadable`\n * or `feature.unreadable`, which files the fleet map's failure against the one\n * target the caller happened to name. That is the wrong subject on a finding\n * that does at least carry the offending path, and it costs those runs nothing\n * further — they grade a single target either way, so there is no report left\n * unwritten — which is why the remainder was left for the change that gives the\n * landscape one load path instead of three.\n *\n * `guarded` is deliberately NOT widened to cover the landscape target instead.\n * Its code ternary knows only services and features, so it would file the fleet\n * map's failure as `feature.unreadable`; and a guarded failure yields no\n * document, so all N services would go on to re-open the same broken file\n * inside their own guards and emit N copies of it. Containing the IO here needs\n * no new code and no new sentence: \"could not be read\" and \"did not parse\" have\n * the same consequence — nothing may be concluded from this file — and\n * `landscape.invalid` is already how that is said.\n */\nexport function unreadableLandscape(err: unknown): LoadedDoc {\n  return {\n    errors: [{ message: err instanceof Error ? err.message : String(err) }],\n    elements: [],\n    relationships: [],\n  };\n}\n\n/** One landscape load, answering with `unreadableLandscape` rather than throwing. */\nexport async function readLandscape(load: () => Promise<LoadedDoc>): Promise<LoadedDoc> {\n  try {\n    return await load();\n  } catch (err) {\n    return unreadableLandscape(err);\n  }\n}\n"]}
+{"version":3,"file":"load.js","sourceRoot":"","sources":["../../../../src/commands/validate/fleet/load.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAG9D,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAE1F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAY;IAC9C,OAAO;QACL,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QACvE,QAAQ,EAAE,EAAE;QACZ,aAAa,EAAE,EAAE;KAClB,CAAC;AACJ,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAA8B;IAChE,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,EAAE,CAAC;IACtB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,mBAAmB,CAAC,GAAG,CAAC,CAAC;IAClC,CAAC;AACH,CAAC;AAYD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,KAAoB;IAC/D,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IACjC,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAClG,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IAClE,MAAM,SAAS,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,KAAK,CAAC,cAAc,CAAC;QACzB,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC;QAC9F,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;KACzF,CAAC,CAAC;IACH,MAAM,KAAK,CAAC,qBAAqB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;AACpD,CAAC","sourcesContent":["/**\n * The landscape's contained load path — the one phase of the fleet target that\n * touches the filesystem before anything can be graded. Split from\n * `./landscape.ts` when the fleet target grew past the line limit; the\n * containment DOCTRINE below travelled with the functions it explains.\n *\n * The load ITSELF is no longer here. `loadArchitecture` moved to\n * `core/c4/project/architecture.ts` when the use-case axis grew a second reader\n * of it, and that module's banner records why; what stayed is the containment,\n * which is command-layer business because it is about which validate TARGET a\n * failed read is filed against.\n */\nimport { existsSync } from \"node:fs\";\nimport { resolve } from \"node:path\";\nimport type { LoadedDoc } from \"../../../core/c4/likec4.js\";\nimport { FleetContext } from \"../../../core/fleet-context.js\";\nimport type { DocsDir } from \"../../../core/kernel/ids/dirs.js\";\nimport type { FeatureEntry, ServiceEntry } from \"../../../core/repo/entries.js\";\nimport { featurePaths, landscapePath, servicePathsAt } from \"../../../core/repo/paths.js\";\n\n/**\n * A landscape that could not be READ, shaped as one that did not PARSE.\n *\n * The landscape is the one artifact no target owns: it is read once for the\n * whole run and it is graded on a target of its own, which runs OUTSIDE\n * `guarded`. So a landscape.likec4 that is a directory, or that carries a\n * permission bit this process cannot open, escaped every per-target catch and\n * became the whole run's `repository-unavailable` — one file, and a fleet gate\n * that said nothing about the ninety-nine services that are fine. A DANGLING\n * symlink is not one of those shapes and never was: every read of the file is\n * gated on an `existsSync` that follows the link, so a broken one resolves as\n * `landscape.missing` long before anything opens it.\n *\n * What this contains is the FLEET-level reads, and only those: the `--all`\n * preload, and both reads inside `validateLandscape` — the conflict-marker\n * `readFile` and the parse. `loam validate --service <id>` and\n * `loam validate --feature <id>` hand in no preloaded doc, so `validateService`\n * and `validateFeature` open the same file again on demand, unwrapped and\n * INSIDE `guarded`: an EISDIR there is still reported as `service.unreadable`\n * or `feature.unreadable`, which files the fleet map's failure against the one\n * target the caller happened to name. That is the wrong subject on a finding\n * that does at least carry the offending path, and it costs those runs nothing\n * further — they grade a single target either way, so there is no report left\n * unwritten — which is why the remainder was left for the change that gives the\n * landscape one load path instead of three.\n *\n * `guarded` is deliberately NOT widened to cover the landscape target instead.\n * Its code ternary knows only services and features, so it would file the fleet\n * map's failure as `feature.unreadable`; and a guarded failure yields no\n * document, so all N services would go on to re-open the same broken file\n * inside their own guards and emit N copies of it. Containing the IO here needs\n * no new code and no new sentence: \"could not be read\" and \"did not parse\" have\n * the same consequence — nothing may be concluded from this file — and\n * `landscape.invalid` is already how that is said.\n */\nexport function unreadableLandscape(err: unknown): LoadedDoc {\n  return {\n    errors: [{ message: err instanceof Error ? err.message : String(err) }],\n    elements: [],\n    relationships: [],\n  };\n}\n\n/** One landscape load, answering with `unreadableLandscape` rather than throwing. */\nexport async function readLandscape(load: () => Promise<LoadedDoc>): Promise<LoadedDoc> {\n  try {\n    return await load();\n  } catch (err) {\n    return unreadableLandscape(err);\n  }\n}\n\n/** Everything a `--all` run parses up front, and the enumerations it was narrowed to. */\nexport interface FleetPrefetch {\n  docsDir: DocsDir;\n  fleet: FleetContext;\n  /** The services this run grades — the `--base` narrowing when there is one. */\n  services: readonly ServiceEntry[];\n  /** The active features this run grades, likewise. */\n  features: readonly FeatureEntry[];\n}\n\n/**\n * ONE workspace per document KIND for the whole `--all` run.\n *\n * The per-path load pays a fresh Langium workspace per document (~100 ms each\n * even warm), which made the fleet's main CI command O(documents) workspace\n * spins — 13.7 s median over the 120-service benchmark (docs/BENCHMARKS.md). So\n * `--all` enumerates its documents up front and batch-parses them into the\n * fleet context's memo; every load below, the landscape read included, is then a\n * seeded hit. The enumerations are the same memoised promises the target loops\n * reuse.\n *\n * TWO WORKSPACES, because the fleet's models no longer parse the same way as\n * each other: a model that EXTENDS the map is a PROJECT (the map plus that\n * file) and a model that stands alone is a document. So the shapes are read\n * first, the DOCUMENT batch is asked for everything that is one — the landscape,\n * every feature delta, every standalone model — and `prefetchServiceModels`\n * then batches the extending half as projects, finding its own standalone list\n * already memoised and asking for nothing.\n *\n * The order is load-bearing rather than tidy. `prefetchLikeC4` returns without a\n * workspace when fewer than two documents are missing (one document gains\n * nothing from batch isolation it already has), so splitting the documents\n * across two calls is how a fleet of one service and one feature ends up\n * batching the feature and parsing the model in a workspace of its own — the\n * exact per-document spin this function exists to remove, and what\n * `test/validate-batch-fallback.test.ts` counts.\n *\n * If a batch CANNOT run — a sandbox denying tmpdir writes — the prefetch seeds\n * nothing and every load falls back to today's per-path parse: identical\n * findings, the old speed. Single-service `validate` and `list` keep their\n * untouched code paths on purpose, so the ≤10% regression bound in\n * docs/BENCHMARKS.md holds by construction.\n *\n * It lives HERE rather than in `../validate.ts` because it is fleet-loading\n * business and that module is the argument grammar and the target dispatch; the\n * block also took that file to its line limit, which is the ceiling asking the\n * question it exists to ask.\n */\nexport async function prefetchFleetDocuments(input: FleetPrefetch): Promise<void> {\n  const { docsDir, fleet } = input;\n  const paths = input.services.filter((svc) => svc.has.model).map((svc) => servicePathsAt(svc.dir));\n  const shapes = await fleet.modelShapes(paths.map((p) => p.model));\n  const landscape = landscapePath(docsDir);\n  await fleet.prefetchLikeC4([\n    ...(existsSync(landscape) ? [landscape] : []),\n    ...input.features.filter((feat) => feat.has.delta).map((feat) => featurePaths(feat.dir).delta),\n    ...paths.filter((p) => shapes.get(resolve(p.model)) !== \"extending\").map((p) => p.model),\n  ]);\n  await fleet.prefetchServiceModels(docsDir, paths);\n}\n"]}

package/dist/commands/validate/fleet/map/attest.js

@@ -0,0 +1,98 @@
+/**
+ * What the fleet's own `model.likec4` files say, read ONCE for the two map
+ * checks that need it: the calls each model attests across its boundary
+ * (`./isolation.ts`), and the datastores that live nested inside a service's own
+ * element (`../../checks/fleet-shape.ts`).
+ *
+ * One reader rather than two, because the two checks were answering the same
+ * question from different evidence and disagreeing about the fleet — the
+ * map-only consumer census `./consumers.ts` tells the story of (R1). A model is
+ * evidence about the fleet exactly as the map is, so it is read here and handed
+ * to both.
+ *
+ * EXTENDING MODELS ONLY, for the consumer join. An extending model's ids ARE the
+ * map's fully-qualified ids — one project, one id space — so `counterpartId`
+ * joins to a drawn element exactly. A standalone model's ids are its own file's,
+ * and `../../../../core/c4/resolve/attested.ts` says outright that a counterpart
+ * is never matched to a landscape element: joining one would file a coincidence
+ * of spelling as a coupling. Standalone models still contribute their attested
+ * CALLS, because `landscape.service-isolated` asks only whether the model
+ * declares any, which is shape-independent.
+ *
+ * A model that does not parse contributes nothing — neither calls nor stores.
+ * `c4.invalid` is that file's finding, and a fleet-shape advisory computed from
+ * a document nobody could read would be an inference about bytes.
+ *
+ * A sub-package of `fleet/` for `./isolation.ts`'s reason and with its rule: it
+ * imports NOTHING from `fleet/`, so the map facts it needs (the resolver, the
+ * ids the map draws at fleet level) arrive on the input record.
+ */
+import { existsSync } from "node:fs";
+import {} from "../../../../core/c4/likec4.js";
+import { attestedCalls } from "../../../../core/c4/resolve/attested.js";
+import { FleetContext } from "../../../../core/fleet-context.js";
+import { inOrder } from "../../../../core/kernel/concurrency.js";
+import {} from "../../../../core/repo/entries.js";
+import { servicePathsAt } from "../../../../core/repo/paths.js";
+import { DATASTORE_KIND } from "../../../../core/vocabulary/maturity.js";
+export async function mapAttestation(input) {
+    // Through the ONE reader of `model.likec4` (`core/c4/service-model/load.ts`),
+    // so a model that EXTENDS the map attests the calls it draws inside the
+    // element the map binds — read as a slice of the per-service project — exactly
+    // as a standalone one attests the calls it draws in its own file. Memoised in
+    // the index, so under `--all` these are hits. Pooled and joined on the entry,
+    // never by index.
+    const present = input.entries.filter((entry) => existsSync(servicePathsAt(entry.dir).model));
+    // ONE workspace for the fleet's models rather than one per service. Both
+    // answers below are about the WHOLE fleet — who else reaches this store is not
+    // a question a narrowed run may answer differently — while `--base` prefetches
+    // only the scope it grades, so without this a scoped run would spin a LikeC4
+    // workspace per un-narrowed service. An accelerator with `prefetchLikeC4`'s
+    // failure story exactly: a batch that cannot run seeds nothing, and every read
+    // below falls back to its own load.
+    await input.fleet.prefetchServiceModels(input.docsDir, present.map((entry) => servicePathsAt(entry.dir)));
+    const loaded = await inOrder(present, async (entry) => ({
+        entry,
+        // CONTAINED, for `fleet/load.ts unreadableLandscape`'s reason: this runs on
+        // the landscape target, which sits outside the dispatcher's `guarded`, so a
+        // `model.likec4` that is a directory or carries a permission bit would
+        // otherwise become the whole run's `repository-unavailable` — one file, and
+        // no report at all for the ninety-nine services that are fine. A model that
+        // could not be READ contributes nothing here, exactly as one that did not
+        // parse does; `service.unreadable` is its own target's finding.
+        model: await input.fleet.serviceModel(input.docsDir, servicePathsAt(entry.dir)).catch(() => null),
+    }));
+    const models = [];
+    const nestedStores = [];
+    for (const { entry, model } of loaded) {
+        // A model that does not parse attests nothing: `c4.invalid` is its finding.
+        // An extending model whose MAP does not parse could not be read at all, and
+        // neither reader runs in that state anyway — the fleet target returns on
+        // `landscape.invalid` long before here.
+        if (model === null || model.mapUnreadable || model.doc.errors.length > 0)
+            continue;
+        models.push({
+            service: entry.id,
+            extending: model.shape === "extending",
+            calls: attestedCalls(model.doc, entry.id, input.services),
+        });
+        if (model.shape !== "extending")
+            continue;
+        for (const element of model.doc.elements) {
+            if (element.kind.toLowerCase() !== DATASTORE_KIND)
+                continue;
+            // The slice carries the partners this model's own edges point at, and a
+            // partner may be another service's store — so the store is kept only when
+            // the MAP's resolver files it under this service, and only when the map
+            // does not draw it as a peer of the services (which is the fleet-level
+            // census's subject, and a different grade).
+            if (input.standsForService(element))
+                continue;
+            if (input.drawnIds.has(element.id) || input.resolve(element.id) !== entry.id)
+                continue;
+            nestedStores.push({ owner: entry.id, fqn: element.id, title: element.title });
+        }
+    }
+    return { models, nestedStores };
+}
+//# sourceMappingURL=attest.js.map

package/dist/commands/validate/fleet/map/attest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attest.js","sourceRoot":"","sources":["../../../../../src/commands/validate/fleet/map/attest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAa,MAAM,+BAA+B,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAqB,MAAM,yCAAyC,CAAC;AAC3F,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AACjE,OAAO,EAAE,OAAO,EAAE,MAAM,wCAAwC,CAAC;AAEjE,OAAO,EAAqB,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,MAAM,yCAAyC,CAAC;AA8CzE,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAAkB;IACrD,8EAA8E;IAC9E,wEAAwE;IACxE,+EAA+E;IAC/E,8EAA8E;IAC9E,8EAA8E;IAC9E,kBAAkB;IAClB,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IAC7F,yEAAyE;IACzE,+EAA+E;IAC/E,+EAA+E;IAC/E,6EAA6E;IAC7E,4EAA4E;IAC5E,+EAA+E;IAC/E,oCAAoC;IACpC,MAAM,KAAK,CAAC,KAAK,CAAC,qBAAqB,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC1G,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QACtD,KAAK;QACL,4EAA4E;QAC5E,4EAA4E;QAC5E,uEAAuE;QACvE,4EAA4E;QAC5E,4EAA4E;QAC5E,0EAA0E;QAC1E,gEAAgE;QAChE,KAAK,EAAE,MAAM,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;KAClG,CAAC,CAAC,CAAC;IAEJ,MAAM,MAAM,GAAoB,EAAE,CAAC;IACnC,MAAM,YAAY,GAAkB,EAAE,CAAC;IACvC,KAAK,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,MAAM,EAAE,CAAC;QACtC,4EAA4E;QAC5E,4EAA4E;QAC5E,yEAAyE;QACzE,wCAAwC;QACxC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,SAAS;QACnF,MAAM,CAAC,IAAI,CAAC;YACV,OAAO,EAAE,KAAK,CAAC,EAAE;YACjB,SAAS,EAAE,KAAK,CAAC,KAAK,KAAK,WAAW;YACtC,KAAK,EAAE,aAAa,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,QAAQ,CAAC;SAC1D,CAAC,CAAC;QACH,IAAI,KAAK,CAAC,KAAK,KAAK,WAAW;YAAE,SAAS;QAC1C,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;YACzC,IAAI,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,cAAc;gBAAE,SAAS;YAC5D,wEAAwE;YACxE,0EAA0E;YAC1E,wEAAwE;YACxE,uEAAuE;YACvE,4CAA4C;YAC5C,IAAI,KAAK,CAAC,gBAAgB,CAAC,OAAO,CAAC;gBAAE,SAAS;YAC9C,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,KAAM,KAAK,CAAC,EAAa;gBAAE,SAAS;YACnG,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;AAClC,CAAC","sourcesContent":["/**\n * What the fleet's own `model.likec4` files say, read ONCE for the two map\n * checks that need it: the calls each model attests across its boundary\n * (`./isolation.ts`), and the datastores that live nested inside a service's own\n * element (`../../checks/fleet-shape.ts`).\n *\n * One reader rather than two, because the two checks were answering the same\n * question from different evidence and disagreeing about the fleet — the\n * map-only consumer census `./consumers.ts` tells the story of (R1). A model is\n * evidence about the fleet exactly as the map is, so it is read here and handed\n * to both.\n *\n * EXTENDING MODELS ONLY, for the consumer join. An extending model's ids ARE the\n * map's fully-qualified ids — one project, one id space — so `counterpartId`\n * joins to a drawn element exactly. A standalone model's ids are its own file's,\n * and `../../../../core/c4/resolve/attested.ts` says outright that a counterpart\n * is never matched to a landscape element: joining one would file a coincidence\n * of spelling as a coupling. Standalone models still contribute their attested\n * CALLS, because `landscape.service-isolated` asks only whether the model\n * declares any, which is shape-independent.\n *\n * A model that does not parse contributes nothing — neither calls nor stores.\n * `c4.invalid` is that file's finding, and a fleet-shape advisory computed from\n * a document nobody could read would be an inference about bytes.\n *\n * A sub-package of `fleet/` for `./isolation.ts`'s reason and with its rule: it\n * imports NOTHING from `fleet/`, so the map facts it needs (the resolver, the\n * ids the map draws at fleet level) arrive on the input record.\n */\nimport { existsSync } from \"node:fs\";\nimport { type Elem } from \"../../../../core/c4/likec4.js\";\nimport { attestedCalls, type AttestedCall } from \"../../../../core/c4/resolve/attested.js\";\nimport { FleetContext } from \"../../../../core/fleet-context.js\";\nimport { inOrder } from \"../../../../core/kernel/concurrency.js\";\nimport type { DocsDir } from \"../../../../core/kernel/ids/dirs.js\";\nimport { type ServiceEntry } from \"../../../../core/repo/entries.js\";\nimport { servicePathsAt } from \"../../../../core/repo/paths.js\";\nimport { DATASTORE_KIND } from \"../../../../core/vocabulary/maturity.js\";\n\n/** One service's model, as the map checks read it. */\nexport interface AttestedModel {\n  /** The service directory this model belongs to. */\n  service: string;\n  /** EXTENDING — and therefore whether `counterpartId` is a map id at all. */\n  extending: boolean;\n  calls: readonly AttestedCall[];\n}\n\n/** A datastore drawn INSIDE the element that resolves to its owner, rather than beside it. */\nexport interface NestedStore {\n  /** The service whose element holds it. */\n  owner: string;\n  /** The store's id as the one project spells it — `marketplace.orderService.db`. */\n  fqn: string;\n  title: string;\n}\n\nexport interface MapAttestation {\n  models: readonly AttestedModel[];\n  nestedStores: readonly NestedStore[];\n}\n\nexport interface AttestInput {\n  docsDir: DocsDir;\n  /** The enumerated services — every one of them, not a candidate subset: both readers ask about the whole fleet. */\n  entries: readonly ServiceEntry[];\n  /** The services/<id>/ directories that exist, as the resolver's `known`. */\n  services: ReadonlySet<string>;\n  /** The MAP's element→service resolver — what decides whose element a nested id sits under. */\n  resolve: (id: string) => string;\n  /**\n   * `census.ts`'s one predicate for \"this element stands for a `services/<id>/`\",\n   * injected because a `fleet/map/` module may not import `fleet/`. A `database`\n   * that IS a service directory is the fleet itself, not a store: the binding\n   * checks grade it, exactly as they do in `./consumers.ts`'s two halves.\n   */\n  standsForService: (e: Elem) => boolean;\n  /** The ids the map draws at FLEET level: a datastore among them is a peer, and the peer census owns it. */\n  drawnIds: ReadonlySet<string>;\n  /** Under `--all` every model.likec4 is already in this memo, so the reads below are hits. */\n  fleet: FleetContext;\n}\n\nexport async function mapAttestation(input: AttestInput): Promise<MapAttestation> {\n  // Through the ONE reader of `model.likec4` (`core/c4/service-model/load.ts`),\n  // so a model that EXTENDS the map attests the calls it draws inside the\n  // element the map binds — read as a slice of the per-service project — exactly\n  // as a standalone one attests the calls it draws in its own file. Memoised in\n  // the index, so under `--all` these are hits. Pooled and joined on the entry,\n  // never by index.\n  const present = input.entries.filter((entry) => existsSync(servicePathsAt(entry.dir).model));\n  // ONE workspace for the fleet's models rather than one per service. Both\n  // answers below are about the WHOLE fleet — who else reaches this store is not\n  // a question a narrowed run may answer differently — while `--base` prefetches\n  // only the scope it grades, so without this a scoped run would spin a LikeC4\n  // workspace per un-narrowed service. An accelerator with `prefetchLikeC4`'s\n  // failure story exactly: a batch that cannot run seeds nothing, and every read\n  // below falls back to its own load.\n  await input.fleet.prefetchServiceModels(input.docsDir, present.map((entry) => servicePathsAt(entry.dir)));\n  const loaded = await inOrder(present, async (entry) => ({\n    entry,\n    // CONTAINED, for `fleet/load.ts unreadableLandscape`'s reason: this runs on\n    // the landscape target, which sits outside the dispatcher's `guarded`, so a\n    // `model.likec4` that is a directory or carries a permission bit would\n    // otherwise become the whole run's `repository-unavailable` — one file, and\n    // no report at all for the ninety-nine services that are fine. A model that\n    // could not be READ contributes nothing here, exactly as one that did not\n    // parse does; `service.unreadable` is its own target's finding.\n    model: await input.fleet.serviceModel(input.docsDir, servicePathsAt(entry.dir)).catch(() => null),\n  }));\n\n  const models: AttestedModel[] = [];\n  const nestedStores: NestedStore[] = [];\n  for (const { entry, model } of loaded) {\n    // A model that does not parse attests nothing: `c4.invalid` is its finding.\n    // An extending model whose MAP does not parse could not be read at all, and\n    // neither reader runs in that state anyway — the fleet target returns on\n    // `landscape.invalid` long before here.\n    if (model === null || model.mapUnreadable || model.doc.errors.length > 0) continue;\n    models.push({\n      service: entry.id,\n      extending: model.shape === \"extending\",\n      calls: attestedCalls(model.doc, entry.id, input.services),\n    });\n    if (model.shape !== \"extending\") continue;\n    for (const element of model.doc.elements) {\n      if (element.kind.toLowerCase() !== DATASTORE_KIND) continue;\n      // The slice carries the partners this model's own edges point at, and a\n      // partner may be another service's store — so the store is kept only when\n      // the MAP's resolver files it under this service, and only when the map\n      // does not draw it as a peer of the services (which is the fleet-level\n      // census's subject, and a different grade).\n      if (input.standsForService(element)) continue;\n      if (input.drawnIds.has(element.id) || input.resolve(element.id) !== (entry.id as string)) continue;\n      nestedStores.push({ owner: entry.id, fqn: element.id, title: element.title });\n    }\n  }\n  return { models, nestedStores };\n}\n"]}

package/dist/commands/validate/fleet/map/bindings.js

@@ -0,0 +1,107 @@
+/**
+ * The element↔directory passes of the fleet cross-check: which drawn box
+ * answers for which `services/<id>/`, and what it means when the answer is
+ * none, two, or one nobody owns.
+ *
+ * Lifted out of `../landscape.ts` when that module reached its line limit, and
+ * the seam is a phase rather than a subject: everything here runs after the map
+ * has parsed, reads nothing from disk, and grades exactly one join — the census
+ * `../census.ts` derives against the enumeration `../landscape.ts` performed.
+ * The four grades are ordered as the report reads them, and the ORDER is the
+ * caller's business, which is why this is one function rather than four.
+ *
+ * A sub-package of `fleet/` for `./isolation.ts`'s reason, and with its rule: it
+ * imports NOTHING from `fleet/` itself, so the two census derivations arrive as
+ * data on the input record rather than as an import of `../census.js`.
+ */
+import {} from "../../../../core/c4/likec4.js";
+import { elementService } from "../../../../core/c4/resolve/service.js";
+import { EXTERNAL_TAG, INFRA_KINDS } from "../../../../core/vocabulary/maturity.js";
+import {} from "../../../../core/vocabulary/report.js";
+export function bindingFindings(input) {
+    const { elements, drawn, services, pathOf } = input;
+    const findings = [];
+    // Two boxes standing for one service directory. Every join in loam is
+    // `element -> service`, computed by picking the FIRST element that resolves —
+    // so with two of them, which one wins is readdir order, and the edges of the
+    // loser are attributed to a service they do not belong to. Silent until now,
+    // and unfixable by staring at either element on its own.
+    const perService = new Map();
+    for (const e of drawn) {
+        if (e.tags.includes(EXTERNAL_TAG))
+            continue;
+        const id = elementService(e);
+        perService.set(id, [...(perService.get(id) ?? []), e]);
+    }
+    for (const [id, elems] of perService) {
+        if (elems.length < 2)
+            continue;
+        // A collision only matters where it decides something: a real directory to
+        // attribute to, or a binding somebody wrote down on purpose.
+        if (!services.has(id) && !elems.some((e) => e.service !== undefined))
+            continue;
+        findings.push({
+            severity: "warn",
+            code: "landscape.binding-duplicate",
+            subject: id,
+            message: `landscape: ${elems.length} elements resolve to service '${id}' (${elems.map((e) => e.id).join(", ")}) — every element→service join picks one of them arbitrarily, so the others' edges are filed under a service that does not own them; keep one element per services/<id>/`,
+        });
+    }
+    for (const id of services) {
+        if (input.modelled.has(id))
+            continue;
+        findings.push({
+            severity: "error",
+            code: "landscape.service-unmodelled",
+            subject: id,
+            message: `landscape: ${pathOf(id)}/ exists but nothing in architecture/landscape.likec4 models it — add an element, or bind one with metadata { service '${id}' }`,
+        });
+    }
+    // A binding is a claim about this repo wherever it is written — including
+    // inside another element, which the old top-level filter never looked at, so
+    // a typo one level down bound an edge to a service that does not exist and
+    // nothing said so. Every element with a binding answers for it, at any depth.
+    for (const e of elements) {
+        if (e.tags.includes(EXTERNAL_TAG) || e.service === undefined)
+            continue;
+        if (services.has(e.service))
+            continue;
+        findings.push({
+            severity: "error",
+            code: "landscape.binding-unknown",
+            subject: e.service,
+            message: `landscape: '${e.title}' binds to service '${e.service}', but services/${e.service}/ does not exist`,
+        });
+    }
+    // Walked over the SYSTEM census — the same derivation the scorecard counts,
+    // so the map's exemptions and the fleet rollup cannot drift — with the two
+    // residual skips that are not exemptions: a bound element is the binding
+    // pass's subject above, and a title naming a real directory is documented.
+    //
+    // Infrastructure the fleet OWNS is out of `systems` upstream, in
+    // `../census.ts drawnSystems` (INFRA_KINDS), and it had to be: this message
+    // offers exactly two remedies and BOTH are false of an owned datastore — there
+    // is no `services/<id>/` to bind, and `#external` would claim somebody else
+    // runs it. Measured on a one-service fixture drawing an owned `database` at
+    // fleet level (2026-09-07), it fired here and had no correct fix.
+    for (const e of input.systems) {
+        if (e.service !== undefined)
+            continue; // graded by the binding pass above
+        if (services.has(e.title))
+            continue;
+        findings.push({
+            severity: "warn",
+            code: "landscape.service-undocumented",
+            subject: e.title,
+            // The third remedy is spelled from `INFRA_KINDS` rather than typed out,
+            // for the reason the set exists at all: the hook is a kind NAME, so a
+            // fleet whose specification spells its store `postgres` still lands here,
+            // and this sentence is the only place that tells its author which
+            // spellings loam reads. A prose copy would be a second list free to drift
+            // from the one the census walks.
+            message: `landscape: '${e.title}' has no services/${e.title}/ — bind it with metadata { service '<id>' }, tag it #${EXTERNAL_TAG} if it is not ours, or give it one of the kinds loam reads as infrastructure (${[...INFRA_KINDS].join(", ")}) if it is a store, queue or bucket the fleet runs rather than a system somebody adopts`,
+        });
+    }
+    return findings;
+}
+//# sourceMappingURL=bindings.js.map

package/dist/commands/validate/fleet/map/bindings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bindings.js","sourceRoot":"","sources":["../../../../../src/commands/validate/fleet/map/bindings.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAa,MAAM,+BAA+B,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AACxE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,yCAAyC,CAAC;AACpF,OAAO,EAAgB,MAAM,uCAAuC,CAAC;AAiBrE,MAAM,UAAU,eAAe,CAAC,KAAmB;IACjD,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IACpD,MAAM,QAAQ,GAAc,EAAE,CAAC;IAE/B,sEAAsE;IACtE,8EAA8E;IAC9E,6EAA6E;IAC7E,6EAA6E;IAC7E,yDAAyD;IACzD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC7C,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;YAAE,SAAS;QAC5C,MAAM,EAAE,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;QAC7B,UAAU,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACzD,CAAC;IACD,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,UAAU,EAAE,CAAC;QACrC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,SAAS;QAC/B,2EAA2E;QAC3E,6DAA6D;QAC7D,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC;YAAE,SAAS;QAC/E,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,6BAA6B;YACnC,OAAO,EAAE,EAAE;YACX,OAAO,EAAE,cAAc,KAAK,CAAC,MAAM,iCAAiC,EAAE,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,0KAA0K;SACxR,CAAC,CAAC;IACL,CAAC;IAED,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;QAC1B,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,SAAS;QACrC,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,8BAA8B;YACpC,OAAO,EAAE,EAAE;YACX,OAAO,EAAE,cAAc,MAAM,CAAC,EAAE,CAAC,0HAA0H,EAAE,KAAK;SACnK,CAAC,CAAC;IACL,CAAC;IAED,0EAA0E;IAC1E,6EAA6E;IAC7E,2EAA2E;IAC3E,8EAA8E;IAC9E,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS;YAAE,SAAS;QACvE,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;YAAE,SAAS;QACtC,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,2BAA2B;YACjC,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,OAAO,EAAE,eAAe,CAAC,CAAC,KAAK,uBAAuB,CAAC,CAAC,OAAO,mBAAmB,CAAC,CAAC,OAAO,kBAAkB;SAC9G,CAAC,CAAC;IACL,CAAC;IAED,4EAA4E;IAC5E,2EAA2E;IAC3E,yEAAyE;IACzE,2EAA2E;IAC3E,EAAE;IACF,iEAAiE;IACjE,4EAA4E;IAC5E,+EAA+E;IAC/E,4EAA4E;IAC5E,4EAA4E;IAC5E,kEAAkE;IAClE,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAC9B,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS;YAAE,SAAS,CAAC,mCAAmC;QAC1E,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;YAAE,SAAS;QACpC,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,gCAAgC;YACtC,OAAO,EAAE,CAAC,CAAC,KAAK;YAChB,wEAAwE;YACxE,sEAAsE;YACtE,0EAA0E;YAC1E,kEAAkE;YAClE,0EAA0E;YAC1E,iCAAiC;YACjC,OAAO,EAAE,eAAe,CAAC,CAAC,KAAK,qBAAqB,CAAC,CAAC,KAAK,yDAAyD,YAAY,iFAAiF,CAAC,GAAG,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,yFAAyF;SACtU,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC","sourcesContent":["/**\n * The element↔directory passes of the fleet cross-check: which drawn box\n * answers for which `services/<id>/`, and what it means when the answer is\n * none, two, or one nobody owns.\n *\n * Lifted out of `../landscape.ts` when that module reached its line limit, and\n * the seam is a phase rather than a subject: everything here runs after the map\n * has parsed, reads nothing from disk, and grades exactly one join — the census\n * `../census.ts` derives against the enumeration `../landscape.ts` performed.\n * The four grades are ordered as the report reads them, and the ORDER is the\n * caller's business, which is why this is one function rather than four.\n *\n * A sub-package of `fleet/` for `./isolation.ts`'s reason, and with its rule: it\n * imports NOTHING from `fleet/` itself, so the two census derivations arrive as\n * data on the input record rather than as an import of `../census.js`.\n */\nimport { type Elem } from \"../../../../core/c4/likec4.js\";\nimport { elementService } from \"../../../../core/c4/resolve/service.js\";\nimport { EXTERNAL_TAG, INFRA_KINDS } from \"../../../../core/vocabulary/maturity.js\";\nimport { type Finding } from \"../../../../core/vocabulary/report.js\";\n\nexport interface BindingInput {\n  /** Every element the map declares, at any depth — a binding answers for itself wherever it is written. */\n  elements: Elem[];\n  /** Service-LEVEL elements (`census.ts serviceLevelElements`) — the fleet map's own boxes. */\n  drawn: Elem[];\n  /** The drawn SYSTEMS (`census.ts drawnSystems`) — `drawn` minus what the map itself says is no service. */\n  systems: Elem[];\n  /** The services/<id>/ directories that exist. */\n  services: ReadonlySet<string>;\n  /** The services some element resolves to — the set `landscape.service-unmodelled` reads. */\n  modelled: ReadonlySet<string>;\n  /** Where a service's directory sits, repo-relative — the enumeration's answer, never `services/<id>`. */\n  pathOf: (id: string) => string;\n}\n\nexport function bindingFindings(input: BindingInput): Finding[] {\n  const { elements, drawn, services, pathOf } = input;\n  const findings: Finding[] = [];\n\n  // Two boxes standing for one service directory. Every join in loam is\n  // `element -> service`, computed by picking the FIRST element that resolves —\n  // so with two of them, which one wins is readdir order, and the edges of the\n  // loser are attributed to a service they do not belong to. Silent until now,\n  // and unfixable by staring at either element on its own.\n  const perService = new Map<string, Elem[]>();\n  for (const e of drawn) {\n    if (e.tags.includes(EXTERNAL_TAG)) continue;\n    const id = elementService(e);\n    perService.set(id, [...(perService.get(id) ?? []), e]);\n  }\n  for (const [id, elems] of perService) {\n    if (elems.length < 2) continue;\n    // A collision only matters where it decides something: a real directory to\n    // attribute to, or a binding somebody wrote down on purpose.\n    if (!services.has(id) && !elems.some((e) => e.service !== undefined)) continue;\n    findings.push({\n      severity: \"warn\",\n      code: \"landscape.binding-duplicate\",\n      subject: id,\n      message: `landscape: ${elems.length} elements resolve to service '${id}' (${elems.map((e) => e.id).join(\", \")}) — every element→service join picks one of them arbitrarily, so the others' edges are filed under a service that does not own them; keep one element per services/<id>/`,\n    });\n  }\n\n  for (const id of services) {\n    if (input.modelled.has(id)) continue;\n    findings.push({\n      severity: \"error\",\n      code: \"landscape.service-unmodelled\",\n      subject: id,\n      message: `landscape: ${pathOf(id)}/ exists but nothing in architecture/landscape.likec4 models it — add an element, or bind one with metadata { service '${id}' }`,\n    });\n  }\n\n  // A binding is a claim about this repo wherever it is written — including\n  // inside another element, which the old top-level filter never looked at, so\n  // a typo one level down bound an edge to a service that does not exist and\n  // nothing said so. Every element with a binding answers for it, at any depth.\n  for (const e of elements) {\n    if (e.tags.includes(EXTERNAL_TAG) || e.service === undefined) continue;\n    if (services.has(e.service)) continue;\n    findings.push({\n      severity: \"error\",\n      code: \"landscape.binding-unknown\",\n      subject: e.service,\n      message: `landscape: '${e.title}' binds to service '${e.service}', but services/${e.service}/ does not exist`,\n    });\n  }\n\n  // Walked over the SYSTEM census — the same derivation the scorecard counts,\n  // so the map's exemptions and the fleet rollup cannot drift — with the two\n  // residual skips that are not exemptions: a bound element is the binding\n  // pass's subject above, and a title naming a real directory is documented.\n  //\n  // Infrastructure the fleet OWNS is out of `systems` upstream, in\n  // `../census.ts drawnSystems` (INFRA_KINDS), and it had to be: this message\n  // offers exactly two remedies and BOTH are false of an owned datastore — there\n  // is no `services/<id>/` to bind, and `#external` would claim somebody else\n  // runs it. Measured on a one-service fixture drawing an owned `database` at\n  // fleet level (2026-09-07), it fired here and had no correct fix.\n  for (const e of input.systems) {\n    if (e.service !== undefined) continue; // graded by the binding pass above\n    if (services.has(e.title)) continue;\n    findings.push({\n      severity: \"warn\",\n      code: \"landscape.service-undocumented\",\n      subject: e.title,\n      // The third remedy is spelled from `INFRA_KINDS` rather than typed out,\n      // for the reason the set exists at all: the hook is a kind NAME, so a\n      // fleet whose specification spells its store `postgres` still lands here,\n      // and this sentence is the only place that tells its author which\n      // spellings loam reads. A prose copy would be a second list free to drift\n      // from the one the census walks.\n      message: `landscape: '${e.title}' has no services/${e.title}/ — bind it with metadata { service '<id>' }, tag it #${EXTERNAL_TAG} if it is not ours, or give it one of the kinds loam reads as infrastructure (${[...INFRA_KINDS].join(\", \")}) if it is a store, queue or bucket the fleet runs rather than a system somebody adopts`,\n    });\n  }\n\n  return findings;\n}\n"]}

package/dist/commands/validate/fleet/map/consumers.js

@@ -0,0 +1,244 @@
+/**
+ * Who consumes a drawn element — and the datastore grade that reads the answer.
+ *
+ * The census used to walk the MAP's relationships alone, and under the extending
+ * shape that is a partial view of the fleet: a service draws the container-level
+ * call in its own `model.likec4` and the map carries the service-level twin, so a
+ * store whose consuming edges were all drawn in models had ZERO consumers and
+ * was graded on the one service the map happened to draw (R1). A model is
+ * evidence about the fleet exactly as the map is, so both are counted here,
+ * once, by one derivation two checks share.
+ *
+ * WHERE A STORE LIVES IS THE TEAM'S CHOICE, and this module used to say the
+ * opposite at length. Nested under the element that resolves to its owner — in
+ * that service's `extend <fqn> { store = database … }` block, or inside its
+ * element on the map — and drawn as a fleet-level PEER are both first-class
+ * placements, and loam grades neither as wrong. `landscape.datastore-private`
+ * existed to push every one-consumer store into the first, its whole message a
+ * prescription to delete the peer; it is retired (2026-09-07), the arm below is
+ * gone, and no message here prescribes a move.
+ *
+ * What survives the retirement is the one CONSEQUENCE, which is a fact about
+ * LikeC4 rather than a preference: a per-service project is `architecture/` plus
+ * that ONE model, so an edge naming `<owner-fqn>.<store>` resolves for a SECOND
+ * service only when the MAP declares the store. Written in the owner's `extend`
+ * block instead, the same edge is two errors on the consumer's own model
+ * ("Could not resolve reference to Referenceable named 'store'"). That is the
+ * load-bearing half, it is stated by `reversibility` below where it actually
+ * bites, and SCHEMA carries the same sentence.
+ *
+ * The choice is cheap, and the surviving message says exactly HOW cheap, because
+ * "reversible" was false in the one state that used to assert it. The two
+ * placements do give the store the same id, `<owner-fqn>.<store>` — but the
+ * move is only free in ONE direction once a second service names it. Measured
+ * on `examples/docs`: moving `db` out of order-service's `extend` block into
+ * `orderService` on the map left the model at 12 elements · 8 relationships,
+ * left `Covers: marketplace.orderService.db` in its arch.spec.md resolving, and
+ * left checkout-web's container-level edge to it resolving too. Moving it BACK
+ * with that second edge drawn is two errors on checkout-web's own model
+ * ("Could not resolve reference to Referenceable named 'db'"), or
+ * `landscape.invalid` plus one `spine.landscape-invalid` per service when the
+ * second edge is drawn on the map — because an `extend` block is visible to its
+ * own service's project alone. `datastore-shared` printed the unconditional
+ * clause in 100% of the states it fires in, every one of which already has the
+ * second consumer that makes map→extend break (verification 2026-09-04). So the
+ * rule the message states is directional: extend→map is always safe; map→extend
+ * only while no other service's model or map edge names the store.
+ *
+ * A sub-package of `fleet/` for `./isolation.ts`'s reason and with its rule: it
+ * imports NOTHING from `fleet/`, so the map facts it reads arrive on the input
+ * records the caller fills.
+ */
+import {} from "../../../../core/c4/likec4.js";
+import { infrastructureKind } from "../../../../core/c4/direction/direction.js";
+import { DATASTORE_KIND } from "../../../../core/vocabulary/maturity.js";
+import {} from "../../../../core/vocabulary/report.js";
+import {} from "./attest.js";
+/**
+ * Distinct consumer SERVICES of an element, its nested children included: an
+ * edge into `kafka.paymentEvents` is consumption of `kafka`.
+ *
+ * Two kinds of evidence, unioned. From the MAP: a relationship whose target is
+ * the element or a descendant and whose source the shared resolver files under a
+ * real `services/<id>/` — persons, other external systems and unresolved sources
+ * never count, and two edges from one service are one consumer. From the
+ * MODELS: a service whose own model attests an OUTBOUND call at the element or a
+ * descendant.
+ *
+ * EITHER DIRECTION, where the element's end of the edge is infrastructure
+ * (`infrastructureKind` in core/c4/direction/direction.ts, among the elements
+ * that stand for no service). A
+ * database, a topic or a bucket never initiates anything, so an edge between it
+ * and a service says that the service uses it, whichever way the arrow points.
+ * Fleets draw a read both ways, as a call (`service -> store`) or as the data's
+ * flow (`store -> service`), and loam's own event doctrine draws every consumer
+ * as `topic -> service`. The census used to read only the edges INTO the
+ * element, so a reader drawn as data flow stopped counting: the second
+ * consumer of a shared store vanished and `landscape.datastore-shared` with
+ * it, and a broker's consumers were never counted toward
+ * `landscape.platform-candidate` at all, which made the "three of our services
+ * reach it" in `examples/docs` false.
+ * Elsewhere the direction still means something (an external system calling
+ * INTO the fleet is not one the callee consumes), so it is still read there.
+ * The model half follows the same rule: an INBOUND attested call counts when
+ * its counterpart is infrastructure.
+ *
+ * The model half reads EXTENDING models only, and the reason is the id space. An
+ * extending model's ids are the map's fully-qualified ids — one project — so the
+ * join is exact. A standalone model's ids are its own file's, and
+ * `core/c4/resolve/attested.ts` says outright that a counterpart is never
+ * matched to a landscape element: joining one would file a coincidence of
+ * spelling as a coupling between two services.
+ */
+export function consumerCensus(input) {
+    const reaches = (elementId, id) => id === elementId || id.startsWith(`${elementId}.`);
+    const infraKindOf = infrastructureKind(input.elements.filter((e) => !input.standsForService(e)));
+    const isInfra = (id) => infraKindOf(id) !== undefined;
+    return (elementId) => {
+        const out = new Set();
+        const count = (id) => {
+            const svc = input.resolve(id);
+            if (input.services.has(svc))
+                out.add(svc);
+        };
+        for (const r of input.relationships) {
+            if (reaches(elementId, r.target))
+                count(r.source);
+            else if (reaches(elementId, r.source) && isInfra(r.source))
+                count(r.target);
+        }
+        for (const model of input.attested) {
+            if (!model.extending)
+                continue;
+            const uses = model.calls.some((c) => reaches(elementId, c.counterpartId) && (c.direction === "out" || isInfra(c.counterpartId)));
+            if (uses)
+                out.add(model.service);
+        }
+        return [...out].sort();
+    };
+}
+/**
+ * A datastore two or more services reach is the strongest coupling two services
+ * can have and the hardest to undo, which deserves to be STATED rather than
+ * inferred. That is the whole of this grade now, and it applies to both
+ * placements alike: a fleet-level peer and a store nested under its owner earn
+ * the same `landscape.datastore-shared` at two consumers, and neither is graded
+ * at one.
+ *
+ * The one-consumer arm is gone (2026-09-07). A fleet-level peer with a single
+ * consumer used to be `landscape.datastore-private` — "drawn as a peer it reads
+ * as a system in its own right … delete this peer" — which made WHERE a store is
+ * drawn a restriction rather than the team's choice. It was never a fact about
+ * the fleet: the same store, nested, was silent, so the finding graded the
+ * drawing and not the architecture. The nested half was ALREADY silent at one
+ * consumer, and it is that half's rule that now holds for both.
+ */
+export function datastoreFindings(input) {
+    const findings = [];
+    for (const e of input.drawn) {
+        // An element that stands for a real service is the fleet itself, not its
+        // shape; a datastore bound to a directory is graded by the binding checks.
+        if (input.standsForService(e))
+            continue;
+        if (e.kind.toLowerCase() !== DATASTORE_KIND)
+            continue;
+        const consumers = input.consumers(e.id);
+        // One consumer is a store that service owns, drawn where the team chose to
+        // draw it — a fact about the map's layout, not about the fleet. Zero is a
+        // store nothing reaches, which was never graded here either.
+        if (consumers.length < 2)
+            continue;
+        findings.push(sharedFinding(e.title, consumers, "", ""));
+    }
+    for (const store of nestedStoresOf(input)) {
+        // The owner is a consumer by construction — the store sits inside the element
+        // that resolves to it — so silence at one consumer IS the fixed state, and
+        // the only question left is whether a second service reaches the same data.
+        const consumers = [...new Set([store.owner, ...input.consumers(store.fqn)])].sort();
+        if (consumers.length < 2)
+            continue;
+        findings.push(sharedFinding(store.title, consumers, 
+        // The store's own id, and said as such. The clause read "nested under
+        // '<fqn>'", which sends a reader looking for an element that HOLDS the
+        // store — when that id IS the store, and its container is its prefix.
+        ` — ${store.owner}'s own store, written as '${store.fqn}'`, reversibility(store, consumers.filter((c) => c !== store.owner))));
+    }
+    return findings;
+}
+/**
+ * Every store nested under the element that resolves to its owner, from both
+ * places the stance allows one to be written: inside the service's element ON
+ * THE MAP, and in the service's own extending model. Keyed by fqn, so a
+ * map-declared store — which the owner's model slice carries too, since a slice
+ * is everything resolving to the service — is one store and not two.
+ *
+ * Both sources are needed and neither is redundant. The map's covers a service
+ * whose model is standalone or absent (no slice to read); the model's covers a
+ * store the map never draws, which is the placement the adopt brief prescribes.
+ */
+function nestedStoresOf(input) {
+    const drawnIds = new Set(input.drawn.map((e) => e.id));
+    const byFqn = new Map();
+    for (const e of input.elements) {
+        if (e.kind.toLowerCase() !== DATASTORE_KIND || drawnIds.has(e.id))
+            continue;
+        // The peer branch's guard, which this half was missing: a `database` bound
+        // with `metadata { service '<id>' }` and drawn one level down became a store
+        // "owned" by its own binding, so a second reader made it a shared datastore
+        // and the fix offered was to give each service its own copy of a service.
+        if (input.standsForService(e))
+            continue;
+        const owner = input.resolve(e.id);
+        if (!input.services.has(owner))
+            continue;
+        byFqn.set(e.id, { owner, fqn: e.id, title: e.title });
+    }
+    for (const store of input.nestedStores)
+        if (!byFqn.has(store.fqn))
+            byFqn.set(store.fqn, store);
+    return [...byFqn.values()];
+}
+/**
+ * Which way the store may still be moved, now that a second service reaches it.
+ *
+ * The clause this replaces said the two placements were interchangeable — "the
+ * two placements give it the same id … so moving the declaration between them
+ * rewrites no edge" — and that is false in every state `datastore-shared` fires
+ * in, because the finding needs a second consumer and a second consumer's edge
+ * resolves only against a store the MAP declares (a per-service project is
+ * `architecture/` plus one model). Measured: performing the move the sentence
+ * called free turned a clean `examples/docs` into `c4.invalid` on the consumer's
+ * model, or into `landscape.invalid` + one `spine.landscape-invalid` per service
+ * when the second edge is on the map (verification 2026-09-04).
+ *
+ * The direction is stated rather than the current placement, and it holds
+ * either way round: out of the owner's `extend` block onto the map is always
+ * safe, back in is not while another service names the store. (In practice a
+ * store this finding reaches is one the MAP declares — a second consumer's edge
+ * cannot resolve against an `extend` block, so it could never have been drawn
+ * — which is the same fact said from the other side.)
+ */
+function reversibility(store, others) {
+    const named = others.length === 1 ? `${others[0]}'s edge` : `${others.join(", ")}'s edges`;
+    return (`. Both placements give it the same id, ${store.fqn}, but with a second consumer the move is ONE-WAY: ` +
+        `${named} resolves only against a declaration the MAP holds — a per-service project is \`architecture/\` ` +
+        `plus one model, so an \`extend\` block is visible to its own service's project alone. Out of ` +
+        `${store.owner}'s \`extend\` block onto ${store.owner}'s element on the map is always safe; moving it ` +
+        `back INTO the \`extend\` block breaks that edge — \`c4.invalid\` on the other service's model, or ` +
+        `\`landscape.invalid\` when the edge is drawn on the map`);
+}
+/** The two-or-more message, shared by the peer and the nested store — one word about coupling, once. */
+function sharedFinding(title, consumers, where, tail) {
+    return {
+        severity: "warn",
+        code: "landscape.datastore-shared",
+        subject: title,
+        message: `landscape: '${title}' is a datastore shared by ${consumers.length} services ` +
+            `(${consumers.join(", ")})${where} — the strongest coupling two services can have, and the ` +
+            `hardest to undo. Shared means the same DATA: if they read the same tables or keys, keep it ` +
+            `where it is and let this warning state the coupling; if they only share a host or cluster ` +
+            `(two schemas, two lock paths), that is operational blast radius — a runbook fact — and the ` +
+            `honest model is one private store per service${tail}`,
+    };
+}
+//# sourceMappingURL=consumers.js.map

package/dist/commands/validate/fleet/map/consumers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consumers.js","sourceRoot":"","sources":["../../../../../src/commands/validate/fleet/map/consumers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AACH,OAAO,EAAuB,MAAM,+BAA+B,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AAChF,OAAO,EAAE,cAAc,EAAE,MAAM,yCAAyC,CAAC;AACzE,OAAO,EAAgB,MAAM,uCAAuC,CAAC;AACrE,OAAO,EAAwC,MAAM,aAAa,CAAC;AAiBnE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,MAAM,UAAU,cAAc,CAAC,KAAkB;IAC/C,MAAM,OAAO,GAAG,CAAC,SAAiB,EAAE,EAAU,EAAW,EAAE,CAAC,EAAE,KAAK,SAAS,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,SAAS,GAAG,CAAC,CAAC;IAC/G,MAAM,WAAW,GAAG,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACjG,MAAM,OAAO,GAAG,CAAC,EAAU,EAAW,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,KAAK,SAAS,CAAC;IACvE,OAAO,CAAC,SAAiB,EAAY,EAAE;QACrC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;QAC9B,MAAM,KAAK,GAAG,CAAC,EAAU,EAAQ,EAAE;YACjC,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAC9B,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5C,CAAC,CAAC;QACF,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;YACpC,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC;gBAAE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;iBAC7C,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;gBAAE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC9E,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YACnC,IAAI,CAAC,KAAK,CAAC,SAAS;gBAAE,SAAS;YAC/B,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAC3B,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,KAAK,KAAK,IAAI,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAClG,CAAC;YACF,IAAI,IAAI;gBAAE,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACzB,CAAC,CAAC;AACJ,CAAC;AA0BD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAqB;IACrD,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAC5B,yEAAyE;QACzE,2EAA2E;QAC3E,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC;YAAE,SAAS;QACxC,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,cAAc;YAAE,SAAS;QACtD,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACxC,2EAA2E;QAC3E,0EAA0E;QAC1E,6DAA6D;QAC7D,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;YAAE,SAAS;QACnC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IAC3D,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1C,8EAA8E;QAC9E,2EAA2E;QAC3E,4EAA4E;QAC5E,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACpF,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;YAAE,SAAS;QACnC,QAAQ,CAAC,IAAI,CACX,aAAa,CACX,KAAK,CAAC,KAAK,EACX,SAAS;QACT,sEAAsE;QACtE,uEAAuE;QACvE,sEAAsE;QACtE,MAAM,KAAK,CAAC,KAAK,6BAA6B,KAAK,CAAC,GAAG,GAAG,EAC1D,aAAa,CAAC,KAAK,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC,CACjE,CACF,CAAC;IACJ,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,cAAc,CAAC,KAAqB;IAC3C,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACvD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC7C,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,cAAc,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAAE,SAAS;QAC5E,2EAA2E;QAC3E,6EAA6E;QAC7E,4EAA4E;QAC5E,0EAA0E;QAC1E,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC;YAAE,SAAS;QACxC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,SAAS;QACzC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IACxD,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,YAAY;QAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC/F,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;AAC7B,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,SAAS,aAAa,CAAC,KAAkB,EAAE,MAAgB;IACzD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAE,SAAS,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC;IAC5F,OAAO,CACL,0CAA0C,KAAK,CAAC,GAAG,oDAAoD;QACvG,GAAG,KAAK,kGAAkG;QAC1G,+FAA+F;QAC/F,GAAG,KAAK,CAAC,KAAK,4BAA4B,KAAK,CAAC,KAAK,kDAAkD;QACvG,oGAAoG;QACpG,yDAAyD,CAC1D,CAAC;AACJ,CAAC;AAED,wGAAwG;AACxG,SAAS,aAAa,CAAC,KAAa,EAAE,SAAmB,EAAE,KAAa,EAAE,IAAY;IACpF,OAAO;QACL,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,4BAA4B;QAClC,OAAO,EAAE,KAAK;QACd,OAAO,EACL,eAAe,KAAK,8BAA8B,SAAS,CAAC,MAAM,YAAY;YAC9E,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,2DAA2D;YAC5F,6FAA6F;YAC7F,4FAA4F;YAC5F,6FAA6F;YAC7F,gDAAgD,IAAI,EAAE;KACzD,CAAC;AACJ,CAAC","sourcesContent":["/**\n * Who consumes a drawn element — and the datastore grade that reads the answer.\n *\n * The census used to walk the MAP's relationships alone, and under the extending\n * shape that is a partial view of the fleet: a service draws the container-level\n * call in its own `model.likec4` and the map carries the service-level twin, so a\n * store whose consuming edges were all drawn in models had ZERO consumers and\n * was graded on the one service the map happened to draw (R1). A model is\n * evidence about the fleet exactly as the map is, so both are counted here,\n * once, by one derivation two checks share.\n *\n * WHERE A STORE LIVES IS THE TEAM'S CHOICE, and this module used to say the\n * opposite at length. Nested under the element that resolves to its owner — in\n * that service's `extend <fqn> { store = database … }` block, or inside its\n * element on the map — and drawn as a fleet-level PEER are both first-class\n * placements, and loam grades neither as wrong. `landscape.datastore-private`\n * existed to push every one-consumer store into the first, its whole message a\n * prescription to delete the peer; it is retired (2026-09-07), the arm below is\n * gone, and no message here prescribes a move.\n *\n * What survives the retirement is the one CONSEQUENCE, which is a fact about\n * LikeC4 rather than a preference: a per-service project is `architecture/` plus\n * that ONE model, so an edge naming `<owner-fqn>.<store>` resolves for a SECOND\n * service only when the MAP declares the store. Written in the owner's `extend`\n * block instead, the same edge is two errors on the consumer's own model\n * (\"Could not resolve reference to Referenceable named 'store'\"). That is the\n * load-bearing half, it is stated by `reversibility` below where it actually\n * bites, and SCHEMA carries the same sentence.\n *\n * The choice is cheap, and the surviving message says exactly HOW cheap, because\n * \"reversible\" was false in the one state that used to assert it. The two\n * placements do give the store the same id, `<owner-fqn>.<store>` — but the\n * move is only free in ONE direction once a second service names it. Measured\n * on `examples/docs`: moving `db` out of order-service's `extend` block into\n * `orderService` on the map left the model at 12 elements · 8 relationships,\n * left `Covers: marketplace.orderService.db` in its arch.spec.md resolving, and\n * left checkout-web's container-level edge to it resolving too. Moving it BACK\n * with that second edge drawn is two errors on checkout-web's own model\n * (\"Could not resolve reference to Referenceable named 'db'\"), or\n * `landscape.invalid` plus one `spine.landscape-invalid` per service when the\n * second edge is drawn on the map — because an `extend` block is visible to its\n * own service's project alone. `datastore-shared` printed the unconditional\n * clause in 100% of the states it fires in, every one of which already has the\n * second consumer that makes map→extend break (verification 2026-09-04). So the\n * rule the message states is directional: extend→map is always safe; map→extend\n * only while no other service's model or map edge names the store.\n *\n * A sub-package of `fleet/` for `./isolation.ts`'s reason and with its rule: it\n * imports NOTHING from `fleet/`, so the map facts it reads arrive on the input\n * records the caller fills.\n */\nimport { type Elem, type Rel } from \"../../../../core/c4/likec4.js\";\nimport { infrastructureKind } from \"../../../../core/c4/direction/direction.js\";\nimport { DATASTORE_KIND } from \"../../../../core/vocabulary/maturity.js\";\nimport { type Finding } from \"../../../../core/vocabulary/report.js\";\nimport { type AttestedModel, type NestedStore } from \"./attest.js\";\n\nexport interface CensusInput {\n  /** The map's own edges — a service-level twin is what the map carries of a container-level call. */\n  relationships: Rel[];\n  /** Every element the map declares, at any depth: what says an endpoint is infrastructure. */\n  elements: Elem[];\n  /** The services/<id>/ directories that exist: a consumer is an edge's other end filed under a real one. */\n  services: ReadonlySet<string>;\n  /** The shared element→service resolver every edge join uses. */\n  resolve: (id: string) => string;\n  /** `census.ts`'s predicate, for `DatastoreInput.standsForService`'s reason: a bound `database` is a service, not infrastructure. */\n  standsForService: (e: Elem) => boolean;\n  /** What each service's own model attests (`./attest.ts`). */\n  attested: readonly AttestedModel[];\n}\n\n/**\n * Distinct consumer SERVICES of an element, its nested children included: an\n * edge into `kafka.paymentEvents` is consumption of `kafka`.\n *\n * Two kinds of evidence, unioned. From the MAP: a relationship whose target is\n * the element or a descendant and whose source the shared resolver files under a\n * real `services/<id>/` — persons, other external systems and unresolved sources\n * never count, and two edges from one service are one consumer. From the\n * MODELS: a service whose own model attests an OUTBOUND call at the element or a\n * descendant.\n *\n * EITHER DIRECTION, where the element's end of the edge is infrastructure\n * (`infrastructureKind` in core/c4/direction/direction.ts, among the elements\n * that stand for no service). A\n * database, a topic or a bucket never initiates anything, so an edge between it\n * and a service says that the service uses it, whichever way the arrow points.\n * Fleets draw a read both ways, as a call (`service -> store`) or as the data's\n * flow (`store -> service`), and loam's own event doctrine draws every consumer\n * as `topic -> service`. The census used to read only the edges INTO the\n * element, so a reader drawn as data flow stopped counting: the second\n * consumer of a shared store vanished and `landscape.datastore-shared` with\n * it, and a broker's consumers were never counted toward\n * `landscape.platform-candidate` at all, which made the \"three of our services\n * reach it\" in `examples/docs` false.\n * Elsewhere the direction still means something (an external system calling\n * INTO the fleet is not one the callee consumes), so it is still read there.\n * The model half follows the same rule: an INBOUND attested call counts when\n * its counterpart is infrastructure.\n *\n * The model half reads EXTENDING models only, and the reason is the id space. An\n * extending model's ids are the map's fully-qualified ids — one project — so the\n * join is exact. A standalone model's ids are its own file's, and\n * `core/c4/resolve/attested.ts` says outright that a counterpart is never\n * matched to a landscape element: joining one would file a coincidence of\n * spelling as a coupling between two services.\n */\nexport function consumerCensus(input: CensusInput): (elementId: string) => string[] {\n  const reaches = (elementId: string, id: string): boolean => id === elementId || id.startsWith(`${elementId}.`);\n  const infraKindOf = infrastructureKind(input.elements.filter((e) => !input.standsForService(e)));\n  const isInfra = (id: string): boolean => infraKindOf(id) !== undefined;\n  return (elementId: string): string[] => {\n    const out = new Set<string>();\n    const count = (id: string): void => {\n      const svc = input.resolve(id);\n      if (input.services.has(svc)) out.add(svc);\n    };\n    for (const r of input.relationships) {\n      if (reaches(elementId, r.target)) count(r.source);\n      else if (reaches(elementId, r.source) && isInfra(r.source)) count(r.target);\n    }\n    for (const model of input.attested) {\n      if (!model.extending) continue;\n      const uses = model.calls.some(\n        (c) => reaches(elementId, c.counterpartId) && (c.direction === \"out\" || isInfra(c.counterpartId)),\n      );\n      if (uses) out.add(model.service);\n    }\n    return [...out].sort();\n  };\n}\n\nexport interface DatastoreInput {\n  /** Service-LEVEL elements — the fleet map's own boxes, where a store drawn as a peer is found. */\n  drawn: Elem[];\n  /** Every element the MAP declares, at any depth — the other place a nested store is written. */\n  elements: Elem[];\n  /** Stores an extending model declares inside its own element (`./attest.ts`). */\n  nestedStores: readonly NestedStore[];\n  /** The services/<id>/ directories that exist. */\n  services: ReadonlySet<string>;\n  /** The shared element→service resolver, for naming the consumer's own element on the map. */\n  resolve: (id: string) => string;\n  /**\n   * `census.ts`'s one predicate for \"this element stands for a `services/<id>/`\",\n   * injected because a `fleet/map/` module may not import `fleet/`. Both halves\n   * of the grade below skip such an element: it is the fleet itself, not its\n   * shape, and a store bound to a directory is the binding checks' subject.\n   * `./attest.ts` applies the same predicate to the stores a MODEL declares, so\n   * all three places answer it once.\n   */\n  standsForService: (e: Elem) => boolean;\n  /** The census above, built once and shared with the platform-candidate advisory. */\n  consumers: (elementId: string) => string[];\n}\n\n/**\n * A datastore two or more services reach is the strongest coupling two services\n * can have and the hardest to undo, which deserves to be STATED rather than\n * inferred. That is the whole of this grade now, and it applies to both\n * placements alike: a fleet-level peer and a store nested under its owner earn\n * the same `landscape.datastore-shared` at two consumers, and neither is graded\n * at one.\n *\n * The one-consumer arm is gone (2026-09-07). A fleet-level peer with a single\n * consumer used to be `landscape.datastore-private` — \"drawn as a peer it reads\n * as a system in its own right … delete this peer\" — which made WHERE a store is\n * drawn a restriction rather than the team's choice. It was never a fact about\n * the fleet: the same store, nested, was silent, so the finding graded the\n * drawing and not the architecture. The nested half was ALREADY silent at one\n * consumer, and it is that half's rule that now holds for both.\n */\nexport function datastoreFindings(input: DatastoreInput): Finding[] {\n  const findings: Finding[] = [];\n  for (const e of input.drawn) {\n    // An element that stands for a real service is the fleet itself, not its\n    // shape; a datastore bound to a directory is graded by the binding checks.\n    if (input.standsForService(e)) continue;\n    if (e.kind.toLowerCase() !== DATASTORE_KIND) continue;\n    const consumers = input.consumers(e.id);\n    // One consumer is a store that service owns, drawn where the team chose to\n    // draw it — a fact about the map's layout, not about the fleet. Zero is a\n    // store nothing reaches, which was never graded here either.\n    if (consumers.length < 2) continue;\n    findings.push(sharedFinding(e.title, consumers, \"\", \"\"));\n  }\n  for (const store of nestedStoresOf(input)) {\n    // The owner is a consumer by construction — the store sits inside the element\n    // that resolves to it — so silence at one consumer IS the fixed state, and\n    // the only question left is whether a second service reaches the same data.\n    const consumers = [...new Set([store.owner, ...input.consumers(store.fqn)])].sort();\n    if (consumers.length < 2) continue;\n    findings.push(\n      sharedFinding(\n        store.title,\n        consumers,\n        // The store's own id, and said as such. The clause read \"nested under\n        // '<fqn>'\", which sends a reader looking for an element that HOLDS the\n        // store — when that id IS the store, and its container is its prefix.\n        ` — ${store.owner}'s own store, written as '${store.fqn}'`,\n        reversibility(store, consumers.filter((c) => c !== store.owner)),\n      ),\n    );\n  }\n\n  return findings;\n}\n\n/**\n * Every store nested under the element that resolves to its owner, from both\n * places the stance allows one to be written: inside the service's element ON\n * THE MAP, and in the service's own extending model. Keyed by fqn, so a\n * map-declared store — which the owner's model slice carries too, since a slice\n * is everything resolving to the service — is one store and not two.\n *\n * Both sources are needed and neither is redundant. The map's covers a service\n * whose model is standalone or absent (no slice to read); the model's covers a\n * store the map never draws, which is the placement the adopt brief prescribes.\n */\nfunction nestedStoresOf(input: DatastoreInput): NestedStore[] {\n  const drawnIds = new Set(input.drawn.map((e) => e.id));\n  const byFqn = new Map<string, NestedStore>();\n  for (const e of input.elements) {\n    if (e.kind.toLowerCase() !== DATASTORE_KIND || drawnIds.has(e.id)) continue;\n    // The peer branch's guard, which this half was missing: a `database` bound\n    // with `metadata { service '<id>' }` and drawn one level down became a store\n    // \"owned\" by its own binding, so a second reader made it a shared datastore\n    // and the fix offered was to give each service its own copy of a service.\n    if (input.standsForService(e)) continue;\n    const owner = input.resolve(e.id);\n    if (!input.services.has(owner)) continue;\n    byFqn.set(e.id, { owner, fqn: e.id, title: e.title });\n  }\n  for (const store of input.nestedStores) if (!byFqn.has(store.fqn)) byFqn.set(store.fqn, store);\n  return [...byFqn.values()];\n}\n\n/**\n * Which way the store may still be moved, now that a second service reaches it.\n *\n * The clause this replaces said the two placements were interchangeable — \"the\n * two placements give it the same id … so moving the declaration between them\n * rewrites no edge\" — and that is false in every state `datastore-shared` fires\n * in, because the finding needs a second consumer and a second consumer's edge\n * resolves only against a store the MAP declares (a per-service project is\n * `architecture/` plus one model). Measured: performing the move the sentence\n * called free turned a clean `examples/docs` into `c4.invalid` on the consumer's\n * model, or into `landscape.invalid` + one `spine.landscape-invalid` per service\n * when the second edge is on the map (verification 2026-09-04).\n *\n * The direction is stated rather than the current placement, and it holds\n * either way round: out of the owner's `extend` block onto the map is always\n * safe, back in is not while another service names the store. (In practice a\n * store this finding reaches is one the MAP declares — a second consumer's edge\n * cannot resolve against an `extend` block, so it could never have been drawn\n * — which is the same fact said from the other side.)\n */\nfunction reversibility(store: NestedStore, others: string[]): string {\n  const named = others.length === 1 ? `${others[0]!}'s edge` : `${others.join(\", \")}'s edges`;\n  return (\n    `. Both placements give it the same id, ${store.fqn}, but with a second consumer the move is ONE-WAY: ` +\n    `${named} resolves only against a declaration the MAP holds — a per-service project is \\`architecture/\\` ` +\n    `plus one model, so an \\`extend\\` block is visible to its own service's project alone. Out of ` +\n    `${store.owner}'s \\`extend\\` block onto ${store.owner}'s element on the map is always safe; moving it ` +\n    `back INTO the \\`extend\\` block breaks that edge — \\`c4.invalid\\` on the other service's model, or ` +\n    `\\`landscape.invalid\\` when the edge is drawn on the map`\n  );\n}\n\n/** The two-or-more message, shared by the peer and the nested store — one word about coupling, once. */\nfunction sharedFinding(title: string, consumers: string[], where: string, tail: string): Finding {\n  return {\n    severity: \"warn\",\n    code: \"landscape.datastore-shared\",\n    subject: title,\n    message:\n      `landscape: '${title}' is a datastore shared by ${consumers.length} services ` +\n      `(${consumers.join(\", \")})${where} — the strongest coupling two services can have, and the ` +\n      `hardest to undo. Shared means the same DATA: if they read the same tables or keys, keep it ` +\n      `where it is and let this warning state the coupling; if they only share a host or cluster ` +\n      `(two schemas, two lock paths), that is operational blast radius — a runbook fact — and the ` +\n      `honest model is one private store per service${tail}`,\n  };\n}\n"]}