@ybotok/loam 0.2.0-alpha.1 → 0.2.0-alpha.13

package/dist/core/delta/delta.js.map

@@ -1 +1 @@
-{"version":3,"file":"delta.js","sourceRoot":"","sources":["../../../src/core/delta/delta.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAqB,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAoB,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AACtF,OAAO,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAE3E,OAAO,EAAE,YAAY,EAAqB,MAAM,6BAA6B,CAAC;AAC9E,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACrF,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AACxE,OAAO,EACL,qBAAqB,EACrB,eAAe,GAGhB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAc,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,WAAW,EAAoB,MAAM,aAAa,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAC1E,OAAO,EAAE,WAAW,EAAqC,MAAM,YAAY,CAAC;AAC5E,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAG9C;;;;;;;GAOG;AACH,MAAM,eAAe,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AAiB5C,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAAgB,EAChB,UAAsB,EACtB,SAAiB,EACjB,OAAsB;IAEtB,MAAM,MAAM,GAAY,EAAE,CAAC;IAC3B,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAChE,4EAA4E;IAC5E,mEAAmE;IACnE,MAAM,YAAY,GAChB,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,uBAAuB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,uBAAuB,CAAC,UAAU,CAAC,CAAC;IACxH,yEAAyE;IACzE,2EAA2E;IAC3E,4EAA4E;IAC5E,yEAAyE;IACzE,aAAa;IACb,MAAM,QAAQ,GAAG,UAAU,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC,CAAC;IAC5D,2EAA2E;IAC3E,8EAA8E;IAC9E,6EAA6E;IAC7E,6EAA6E;IAC7E,8EAA8E;IAC9E,kDAAkD;IAClD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ;QAAE,OAAO,MAAM,CAAC;IAExF,yEAAyE;IACzE,qDAAqD;IACrD,MAAM,KAAK,GAAe;QACxB,MAAM,EAAE,WAAW,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC;QAChD,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;KAC9C,CAAC;IAEF,2EAA2E;IAC3E,0EAA0E;IAC1E,2EAA2E;IAC3E,2EAA2E;IAC3E,4EAA4E;IAC5E,mDAAmD;IACnD,MAAM,aAAa,GAAmB,EAAE,CAAC;IACzC,MAAM,gBAAgB,GAAyB,EAAE,CAAC;IAElD,6EAA6E;IAC7E,2EAA2E;IAC3E,yEAAyE;IACzE,mDAAmD;IACnD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC7B,MAAM,QAAQ,GAAG,gBAAgB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACjE,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;gBAAE,SAAS;YACpC,MAAM,KAAK,GAAe;gBACxB,IAAI,EAAE,SAAS;gBACf,OAAO,EAAE,OAAO;gBAChB,IAAI;gBACJ,SAAS;gBACT,OAAO;gBACP,QAAQ;gBACR,KAAK,EAAE,IAAI,CAAC,GAAG,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,iBAAiB;gBAClE,sEAAsE;gBACtE,wEAAwE;gBACxE,SAAS,EAAE,IAAI,CAAC,GAAG,KAAK,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,qBAAqB;aACvE,CAAC;YACF,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC,MAAM,kBAAkB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;YAC/G,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;YAC9B,aAAa,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,YAAY,CAAC,IAAI,EAAE,CAAC;QACpC,MAAM,KAAK,GAAe;YACxB,IAAI,EAAE,YAAY;YAClB,OAAO,EAAE,GAAG,CAAC,EAAE;YACf,IAAI,EAAE,eAAe;YACrB,SAAS;YACT,OAAO;YACP,QAAQ,EAAE,GAAG,CAAC,IAAI;YAClB,uEAAuE;YACvE,yEAAyE;YACzE,yEAAyE;YACzE,0EAA0E;YAC1E,KAAK,EAAE,cAAc,GAAG,CAAC,EAAE,EAAE;YAC7B,SAAS,EAAE,uBAAuB,GAAG,CAAC,EAAE,UAAU;SACnD,CAAC;QACF,0EAA0E;QAC1E,yEAAyE;QACzE,2EAA2E;QAC3E,YAAY;QACZ,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,KAAK,EAAE,qBAAqB,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC3F,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;QAC9B,uEAAuE;QACvE,qEAAqE;QACrE,4EAA4E;QAC5E,2CAA2C;QAC3C,MAAM,CAAC,IAAI,CACT,GAAG,mBAAmB,CAAC,MAAM,CAAC,IAAI,EAAE;YAClC,KAAK,EAAE,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YAC3D,OAAO,EAAE,GAAG,CAAC,EAAE;SAChB,CAAC,CACH,CAAC;QACF,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;IACtF,CAAC;IAED,uEAAuE;IACvE,iFAAiF;IACjF,kEAAkE;IAClE,sCAAsC;IACtC,yEAAyE;IACzE,0EAA0E;IAC1E,sBAAsB;IACtB,MAAM,IAAI,GAAiB,QAAQ;QACjC,CAAC,CAAC,MAAM,YAAY,CAAC;YACjB,OAAO;YACP,UAAU;YACV,SAAS;YACT,YAAY,EAAE,gBAAgB;YAC9B,uEAAuE;YACvE,wEAAwE;YACxE,6DAA6D;YAC7D,yDAAyD;YACzD,UAAU,EAAE,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,wBAAwB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC;YACjH,KAAK,EAAE,IAAI,GAAG,CAAC,MAAM,oBAAoB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC5D,sEAAsE;YACtE,yEAAyE;YACzE,+DAA+D;YAC/D,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;SACvF,CAAC;QACJ,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IAC/B,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QAC/B,0EAA0E;QAC1E,kEAAkE;QAClE,2EAA2E;QAC3E,uEAAuE;QACvE,6EAA6E;QAC7E,eAAe;QACf,MAAM,CAAC,IAAI,CAAC;YACV,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,sBAAsB;YAC5B,OAAO,EAAE,SAAS;YAClB,wEAAwE;YACxE,2EAA2E;YAC3E,yEAAyE;YACzE,2EAA2E;YAC3E,wEAAwE;YACxE,2EAA2E;YAC3E,cAAc;YACd,OAAO,EACL,4GAA4G;gBAC5G,wGAAwG;gBACxG,4GAA4G;gBAC5G,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,gBAAgB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SAChE,CAAC,CAAC;IACL,CAAC;IAED,8EAA8E;IAC9E,yEAAyE;IACzE,6EAA6E;IAC7E,yEAAyE;IACzE,8EAA8E;IAC9E,yBAAyB;IACzB,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,wEAAwE;QACxE,4EAA4E;QAC5E,2EAA2E;QAC3E,0EAA0E;QAC1E,4EAA4E;QAC5E,iCAAiC;QACjC,MAAM,CAAC,IAAI,CACT,GAAG,eAAe,CAChB,gBAAgB,EAChB,aAAa,EACb,IAAI,CAAC,IAAI,KAAK,MAAM;YAClB,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;YACnC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACzF,CACF,CAAC;QACF,MAAM,CAAC,IAAI,CACT,GAAG,CAAC,MAAM,qBAAqB,CAAC;YAC9B,YAAY,EAAE,gBAAgB;YAC9B,MAAM,EAAE,aAAa;YACrB,MAAM,EAAE,GAAG,EAAE,CAAC,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC;SAChD,CAAC,CAAC,CACJ,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,KAAK,UAAU,eAAe,CAAC,OAAgB,EAAE,OAAsB;IACrE,MAAM,GAAG,GAAmB,EAAE,CAAC;IAC/B,KAAK,MAAM,OAAO,IAAI,MAAM,oBAAoB,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC;QACnE,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QAClE,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC7B,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC7B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,SAAS;YAChC,MAAM,IAAI,GACR,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;YACjH,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,KAAK,UAAU,UAAU,CACvB,KAAiB,EACjB,UAAkB,EAClB,KAAiB;IAEjB,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAClC,MAAM,GAAG,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACpH,MAAM,IAAI,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,gBAAgB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC7G,MAAM,MAAM,GAAG,WAAW,CACxB,CAAC,UAAU,CAAC,UAAU,CAAC;QACrB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,OAAO,KAAK,SAAS;YACrB,CAAC,CAAC,iBAAiB,CAAC,MAAM,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YACvD,CAAC,CAAC,MAAM,OAAO,CAAC,gBAAgB,CAAC,UAAU,CAAC,CACjD,CAAC;IACF,OAAO;QACL,IAAI;QACJ,MAAM;QACN,MAAM,EAAE;YACN,GAAG,mBAAmB,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC;YACxC,GAAG,oBAAoB,CAAC,KAAK,EAAE,MAAM,CAAC;YACtC,GAAG,CAAC,MAAM,eAAe,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;SACxD;KACF,CAAC;AACJ,CAAC","sourcesContent":["/**\n * Does the diff apply to the thing it claims to change?\n *\n * A requirement delta is a diff against a living spec, and nothing used to check\n * that it lands. Every failure mode here is silent today: MODIFIED of a\n * requirement that does not exist is merged as a creation, ADDED of one that\n * does exist REPLACES it (scenarios and all) while the author believes they are\n * adding, and a heading that nearly matches the delta grammar parses as plain\n * prose so archive merges nothing at all and says nothing about it.\n *\n * The last of those has a legal-looking cousin: a requirement under an ordinary\n * prose heading (`## Behavior`, `## Error Handling`) is BASE too, and BASE never\n * merges. Upstream OpenSpec deltas are written that way, so the answer is to name\n * what will be lost rather than to start merging prose sections.\n *\n * These run inside the archive gate, because the merge is where the damage lands.\n *\n * TWO CORPORA, ONE ALGEBRA. A feature's delta documents live in two places —\n * `specs/<svc>/{spec,arch.spec}.md` against the service tree, and\n * `capabilities/<id>/spec.md` against the authored business tree — and every\n * grade about a DOCUMENT and its living counterpart applies to both verbatim,\n * with the capability id in `subject` where a service id would be. That is not\n * a coincidence to exploit but the reason the business corpus was given deltas\n * at all: a capability document is a requirements document, so the diff that\n * changes one has exactly the same ways of not landing. A second implementation\n * would be a second set of answers to `delta.added-duplicate`.\n *\n * The exception is the four CROSS-FEATURE warnings — `delta.added-conflict`,\n * `delta.modified-conflict`, `delta.modified-pending`, `delta.removed-pending`\n * — which ask what OTHER features in flight claim. `./claims.ts` indexes the\n * service corpus only and states why; on the business axis those four are\n * silent, which is a missing warning and never a wrong answer.\n *\n * This module is only the walk: which documents get read, in what order, and how\n * each is handed a `DeltaScope`. The checks themselves are in `./document.ts`\n * (a document against itself) and `./select.ts` (the delta against the living\n * text). Their order is load-bearing and stays here, where it can be read in one\n * screen.\n */\nimport { existsSync } from \"node:fs\";\nimport { readFile } from \"node:fs/promises\";\nimport { relative } from \"node:path\";\nimport { type FleetContext } from \"../fleet-context.js\";\nimport { parseRequirements } from \"../document/parse.js\";\nimport { type Requirement } from \"../document/spec.js\";\nimport { featureSpecPaths, SPEC_AXES } from \"../repo/paths.js\";\nimport { featureUseCasesDir, livingCapabilityPaths } from \"../repo/authored/paths.js\";\nimport { readCapabilityVocabulary } from \"../capabilities/capabilities.js\";\n\nimport { flowCoverage, type FlowPromises } from \"../usecases/delta/claims.js\";\nimport { enumeratedServiceIds, locateServicePaths } from \"../repo/service-target.js\";\nimport { featureSpecServices } from \"../repo/repo.js\";\nimport { capabilityDocIssues } from \"../capabilities/delta/doc.js\";\nimport { featureCapabilityDeltas } from \"../capabilities/delta/tree.js\";\nimport {\n  removedRealizedIssues,\n  uncoveredIssues,\n  type CapabilityDeltaDoc,\n  type RealizingDoc,\n} from \"../capabilities/delta/uncovered.js\";\nimport { type Issue } from \"../vocabulary/issue.js\";\nimport { claimLookup, type ClaimLookup } from \"./claims.js\";\nimport { deltaDocumentIssues, livingDocumentIssues } from \"./document.js\";\nimport { indexLiving, type DeltaScope, type LivingIndex } from \"./scope.js\";\nimport { selectionIssues } from \"./select.js\";\nimport type { DocsDir, FeatureDir } from \"../kernel/ids/dirs.js\";\n\n/**\n * The business corpus's ONE axis. A capability document carries the promise and\n * nothing else — there is no `arch.spec.md` beside it, because \"how it is\n * built\" is precisely the altitude a capability requirement may not describe\n * (`capability.requirement-service-scoped` is that rule). It has no `key`\n * because it indexes no `ServicePaths`, which is why `DeltaScope.axis` is the\n * narrower `DeltaAxis` and not `SpecAxis`.\n */\nconst CAPABILITY_AXIS = { file: \"spec.md\" };\n\n/**\n * What every document in one feature's walk shares.\n *\n * A record rather than two more parameters because both values are about the\n * WALK and not about the document being graded — `gradeDelta` would otherwise\n * read as a four-argument function whose last two arguments never vary within\n * a run, which is how the next value gets added as a fifth.\n */\ninterface DeltaReads {\n  /** What OTHER features in flight claim — lazy, so the common case never scans. */\n  claims: ClaimLookup;\n  /** The invocation's read index, when the caller threaded one. */\n  context?: FleetContext;\n}\n\nexport async function deltaShapeIssues(\n  docsDir: DocsDir,\n  featureDir: FeatureDir,\n  featureId: string,\n  context?: FleetContext,\n): Promise<Issue[]> {\n  const issues: Issue[] = [];\n  const services = await featureSpecServices(featureDir, context);\n  // One `existsSync` for a feature that carries no capability delta, which is\n  // every feature in a fleet that has not adopted the business axis.\n  const capabilities =\n    context === undefined ? await featureCapabilityDeltas(featureDir) : await context.featureCapabilityDeltas(featureDir);\n  // The flows this feature brings, and one `existsSync` for a feature that\n  // brings none — which is every feature in a fleet that has not adopted the\n  // axis. The directory, not the documents: what is needed here is whether to\n  // pay for the overlay at all, and the walk that lists them happens once,\n  // inside it.\n  const hasFlows = existsSync(featureUseCasesDir(featureDir));\n  // The early return must ask about EVERY corpus. Asking only about services\n  // meant a capability-only feature — a business change with no service touched\n  // yet, which is exactly what an analyst writes first — was graded by nothing\n  // and archived whatever its delta said; asking only about those two would do\n  // the same to a feature whose whole content is a cross-service flow, which is\n  // the shape an architect answers an analyst with.\n  if (services.length === 0 && capabilities.docs.length === 0 && !hasFlows) return issues;\n\n  // What OTHER features in flight claim. Only built when a claim has to be\n  // checked — the common case never pays for the scan.\n  const reads: DeltaReads = {\n    claims: claimLookup(docsDir, featureId, context),\n    ...(context === undefined ? {} : { context }),\n  };\n\n  // The two corpora's parsed requirements, kept as the walk produces them so\n  // the `Realizes:` join below can be taken without re-reading a byte. That\n  // join is the one question neither corpus can answer alone — which service\n  // requirement keeps which business promise — and this is the only place in\n  // loam where both sides are already open (`capabilities/delta/uncovered.ts`\n  // holds the rules; nothing here decides anything).\n  const serviceDeltas: RealizingDoc[] = [];\n  const capabilityDeltas: CapabilityDeltaDoc[] = [];\n\n  // Both requirement-carrying files per service run the same checks — one code\n  // path parameterized by filename, the merge's own factoring. `where` names\n  // the arch file in messages so a finding cannot be chased into the wrong\n  // document; spec.md keeps its historical spelling.\n  for (const service of services) {\n    for (const axis of SPEC_AXES) {\n      const specPath = featureSpecPaths(featureDir, service)[axis.key];\n      if (!existsSync(specPath)) continue;\n      const scope: DeltaScope = {\n        kind: \"service\",\n        subject: service,\n        axis,\n        featureId,\n        docsDir,\n        specPath,\n        where: axis.key === \"spec\" ? service : `${service} (arch.spec.md)`,\n        // How the axis's living document is named in messages — spec.md keeps\n        // the historical \"living spec\", the arch axis says which file it means.\n        livingDoc: axis.key === \"spec\" ? \"living spec\" : \"living arch.spec.md\",\n      };\n      const graded = await gradeDelta(scope, (await locateServicePaths(docsDir, service, context))[axis.key], reads);\n      issues.push(...graded.issues);\n      serviceDeltas.push({ service, file: axis.file, reqs: graded.reqs });\n    }\n  }\n\n  for (const doc of capabilities.docs) {\n    const scope: DeltaScope = {\n      kind: \"capability\",\n      subject: doc.id,\n      axis: CAPABILITY_AXIS,\n      featureId,\n      docsDir,\n      specPath: doc.spec,\n      // `capability <id>`, not `capabilities/<id>` — the second reads as the\n      // LIVING directory, and every message this labels is about the FEATURE's\n      // delta of it. Sending an author to edit the wrong one of two files with\n      // the same name is the whole reason `where` and `livingDoc` are separate.\n      where: `capability ${doc.id}`,\n      livingDoc: `living capabilities/${doc.id}/spec.md`,\n    };\n    // Absent is a real and ordinary answer on this axis: the first feature to\n    // mention a capability is what creates its living document, so the whole\n    // delta grades against `[]` and every requirement in it is legitimately an\n    // addition.\n    const graded = await gradeDelta(scope, livingCapabilityPaths(docsDir, doc.id).spec, reads);\n    issues.push(...graded.issues);\n    // The document's own three rules, on the requirements this delta would\n    // MERGE — before the merge, where the author can still fix them. See\n    // `capabilities/delta/doc.ts` for why grading only the living copy leaves a\n    // hole straight through the altitude rule.\n    issues.push(\n      ...capabilityDocIssues(graded.reqs, {\n        where: relative(docsDir, doc.spec).split(/[\\\\/]/).join(\"/\"),\n        subject: doc.id,\n      }),\n    );\n    capabilityDeltas.push({ id: doc.id, reqs: graded.reqs, living: graded.living.all });\n  }\n\n  // The other carrier of a promise, read once and only when this feature\n  // actually brings a flow: the `dynamic view`s under `features/<FEAT>/usecases/`,\n  // parsed over the map this feature's own merge would leave behind\n  // (`core/usecases/delta/overlay.ts`).\n  // A feature with no `usecases/` directory is a REAL empty answer, not an\n  // ungraded one: there is no flow, so \"no flow keeps this\" is true and the\n  // message may say it.\n  const kept: FlowPromises = hasFlows\n    ? await flowCoverage({\n        docsDir,\n        featureDir,\n        featureId,\n        capabilities: capabilityDeltas,\n        // Read HERE, through the invocation's index, because this module holds\n        // it and `core/usecases/` does not — every other read in this walk does\n        // the same, and `core/repo/service-target.ts` prices a fleet\n        // enumeration per call at ~13 ms on a 120-service fleet.\n        vocabulary: context === undefined ? await readCapabilityVocabulary(docsDir) : await context.capabilities(docsDir),\n        known: new Set(await enumeratedServiceIds(docsDir, context)),\n        // A function rather than the context itself: one memoised LikeC4 read\n        // does not justify an edge from `core/usecases/` to `fleet-context`, and\n        // the edge would push that package up a DAG level for nothing.\n        ...(context === undefined ? {} : { load: (path: string) => context.loadLikeC4(path) }),\n      })\n    : { kind: \"read\", kept: [] };\n  if (kept.kind === \"unreadable\") {\n    // ERROR, and the archive gate's own `NEVER_OVERRIDABLE` keeps `--approve`\n    // off it. This is the refusal that stops a flow being copied into\n    // `architecture/` and the NEXT reader's `loam validate --all` carrying the\n    // failure — including the case the overlay exists for, a hop naming an\n    // element the merge does not land. Mechanical, so it is not loam's judgement\n    // to override.\n    issues.push({\n      severity: \"error\",\n      code: \"usecase.flow-invalid\",\n      subject: featureId,\n      // The opening sentence does NOT say whose file is at fault, and that is\n      // deliberate: the corpus this reads is the feature's flows PLUS the living\n      // `architecture/` documents they are drawn over, so the failing path can\n      // be a living one — a landscape that no longer parses, a use case somebody\n      // else wrote. Every message carries its own path, so a reader can place\n      // it; an opening line that blamed `usecases/` would send them to the wrong\n      // file first.\n      message:\n        `this feature's flows could not be graded against the map its own merge would leave behind, so the archive ` +\n        `would land an architecture/ nothing has checked. The corpus is the feature's usecases/ AND the living ` +\n        `architecture/ documents they are drawn over, so the fault may be in either — each message names its file. ` +\n        `${kept.errors.length} problem(s): ${kept.errors.join(\"; \")}`,\n    });\n  }\n\n  // The `Realizes:` join, both directions, over documents this walk has already\n  // parsed. Skipped entirely when the feature carries no capability delta,\n  // which is every feature in a fleet that has not adopted the business axis —\n  // and the removal half asks for the living corpus only when something is\n  // actually retired, so even an adopting fleet pays the fleet-wide read on the\n  // features that earn it.\n  if (capabilityDeltas.length > 0) {\n    // The three arms travel as three, and flattening two of them to `[]` is\n    // the one thing this must not do: `capability.uncovered` says in words that\n    // no flow keeps the promise, so handing it an empty list for a corpus loam\n    // could not read or could not resolve makes it assert a negative it never\n    // evaluated — and gate on it. `claims.ts`'s header states the rule; this is\n    // where a caller could break it.\n    issues.push(\n      ...uncoveredIssues(\n        capabilityDeltas,\n        serviceDeltas,\n        kept.kind === \"read\"\n          ? { graded: true, kept: kept.kept }\n          : { graded: false, why: kept.kind === \"ungraded\" ? kept.why : kept.errors.join(\"; \") },\n      ),\n    );\n    issues.push(\n      ...(await removedRealizedIssues({\n        capabilities: capabilityDeltas,\n        deltas: serviceDeltas,\n        living: () => livingRealizers(docsDir, context),\n      })),\n    );\n  }\n\n  return issues;\n}\n\n/**\n * Every LIVING service requirements document in the fleet, for the one question\n * that has to ask about services this feature never mentions: does anything out\n * there still realize a capability requirement this feature retires?\n *\n * The same shape and the same cost `openapi.remove-op-consumed` pays through\n * `coherence/lookups.ts` one axis over, and for the same reason — the merge\n * deletes the promise while the `Realizes:` line stays, so the very next\n * `validate --all` reports a breach on a repository whose author was never in\n * this feature. Called behind a thunk (`removedRealizedIssues` invokes it only\n * when something is retired), so a feature that removes nothing never runs it.\n */\nasync function livingRealizers(docsDir: DocsDir, context?: FleetContext): Promise<RealizingDoc[]> {\n  const out: RealizingDoc[] = [];\n  for (const service of await enumeratedServiceIds(docsDir, context)) {\n    const paths = await locateServicePaths(docsDir, service, context);\n    for (const axis of SPEC_AXES) {\n      const path = paths[axis.key];\n      if (!existsSync(path)) continue;\n      const reqs =\n        context === undefined ? parseRequirements(await readFile(path, \"utf8\")) : await context.readRequirements(path);\n      out.push({ service, file: axis.file, reqs });\n    }\n  }\n  return out;\n}\n\n/**\n * One delta document against one living document: the three passes, in the\n * order that makes their messages readable.\n *\n * The order is load-bearing. `deltaDocumentIssues` settles what the delta says\n * about itself, `livingDocumentIssues` settles whether the living text can be\n * selected in at all, and only then does `selectionIssues` compare them — a pin\n * the document pass already refused must not also be reported stale, which\n * would send its author to `loam rebase` for a problem rebase does not fix.\n *\n * The parsed delta requirements come back with the issues because the capability\n * corpus grades them a second way (`capabilityDocIssues`) and re-reading the\n * file to do it would be a second parse of bytes already in hand — and, without\n * a context, a second chance for the two passes to disagree about the document.\n * The LIVING index rides back for the same reason once more: the removal\n * direction of the `Realizes:` join has to resolve a REMOVED spelled by heading\n * into the id it retires, and that id is a fact about the living document.\n */\nasync function gradeDelta(\n  scope: DeltaScope,\n  livingPath: string,\n  reads: DeltaReads,\n): Promise<{ issues: Issue[]; reqs: Requirement[]; living: LivingIndex }> {\n  const { claims, context } = reads;\n  const raw = context === undefined ? await readFile(scope.specPath, \"utf8\") : await context.readText(scope.specPath);\n  const reqs = context === undefined ? parseRequirements(raw) : await context.readRequirements(scope.specPath);\n  const living = indexLiving(\n    !existsSync(livingPath)\n      ? []\n      : context === undefined\n        ? parseRequirements(await readFile(livingPath, \"utf8\"))\n        : await context.readRequirements(livingPath),\n  );\n  return {\n    reqs,\n    living,\n    issues: [\n      ...deltaDocumentIssues(scope, raw, reqs),\n      ...livingDocumentIssues(scope, living),\n      ...(await selectionIssues(scope, reqs, living, claims)),\n    ],\n  };\n}\n"]}
+{"version":3,"file":"delta.js","sourceRoot":"","sources":["../../../src/core/delta/delta.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AACnF,OAAO,EAAoB,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AACtF,OAAO,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAE,MAAM,wCAAwC,CAAC;AAEzE,OAAO,EAAE,YAAY,EAAqB,MAAM,6BAA6B,CAAC;AAC9E,OAAO,EAAE,wBAAwB,EAAyB,MAAM,+BAA+B,CAAC;AAChG,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACrF,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AACxE,OAAO,EACL,qBAAqB,EACrB,eAAe,GAGhB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAc,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,WAAW,EAAoB,MAAM,aAAa,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAC1E,OAAO,EAAE,WAAW,EAAqC,MAAM,YAAY,CAAC;AAC5E,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAG9C;;;;;;;GAOG;AACH,MAAM,eAAe,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AAiB5C,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAAgB,EAChB,UAAsB,EACtB,SAAiB,EACjB,OAAsB;IAEtB,MAAM,MAAM,GAAY,EAAE,CAAC;IAC3B,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAChE,4EAA4E;IAC5E,mEAAmE;IACnE,MAAM,YAAY,GAChB,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,uBAAuB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,uBAAuB,CAAC,UAAU,CAAC,CAAC;IACxH,yEAAyE;IACzE,2EAA2E;IAC3E,4EAA4E;IAC5E,yEAAyE;IACzE,aAAa;IACb,MAAM,QAAQ,GAAG,UAAU,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC,CAAC;IAC5D,2EAA2E;IAC3E,8EAA8E;IAC9E,6EAA6E;IAC7E,6EAA6E;IAC7E,8EAA8E;IAC9E,kDAAkD;IAClD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ;QAAE,OAAO,MAAM,CAAC;IAExF,yEAAyE;IACzE,qDAAqD;IACrD,MAAM,KAAK,GAAe;QACxB,MAAM,EAAE,WAAW,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC;QAChD,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;KAC9C,CAAC;IAEF,2EAA2E;IAC3E,0EAA0E;IAC1E,2EAA2E;IAC3E,2EAA2E;IAC3E,4EAA4E;IAC5E,mDAAmD;IACnD,MAAM,aAAa,GAAmB,EAAE,CAAC;IACzC,MAAM,gBAAgB,GAAyB,EAAE,CAAC;IAClD,0EAA0E;IAC1E,2EAA2E;IAC3E,MAAM,YAAY,GAAuB,EAAE,CAAC;IAE5C,6EAA6E;IAC7E,2EAA2E;IAC3E,yEAAyE;IACzE,mDAAmD;IACnD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC7B,MAAM,QAAQ,GAAG,gBAAgB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACjE,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;gBAAE,SAAS;YACpC,MAAM,KAAK,GAAe;gBACxB,IAAI,EAAE,SAAS;gBACf,OAAO,EAAE,OAAO;gBAChB,IAAI;gBACJ,SAAS;gBACT,OAAO;gBACP,QAAQ;gBACR,KAAK,EAAE,IAAI,CAAC,GAAG,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,iBAAiB;gBAClE,sEAAsE;gBACtE,wEAAwE;gBACxE,SAAS,EAAE,IAAI,CAAC,GAAG,KAAK,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,qBAAqB;aACvE,CAAC;YACF,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC,MAAM,kBAAkB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;YAC/G,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;YAC9B,aAAa,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;YACpE,MAAM,KAAK,GAAG,GAA0C,EAAE,CAAC,kBAAkB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;YACzG,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1G,CAAC;IACH,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,YAAY,CAAC,IAAI,EAAE,CAAC;QACpC,MAAM,KAAK,GAAe;YACxB,IAAI,EAAE,YAAY;YAClB,OAAO,EAAE,GAAG,CAAC,EAAE;YACf,IAAI,EAAE,eAAe;YACrB,SAAS;YACT,OAAO;YACP,QAAQ,EAAE,GAAG,CAAC,IAAI;YAClB,uEAAuE;YACvE,yEAAyE;YACzE,yEAAyE;YACzE,0EAA0E;YAC1E,KAAK,EAAE,cAAc,GAAG,CAAC,EAAE,EAAE;YAC7B,SAAS,EAAE,uBAAuB,GAAG,CAAC,EAAE,UAAU;SACnD,CAAC;QACF,0EAA0E;QAC1E,yEAAyE;QACzE,2EAA2E;QAC3E,YAAY;QACZ,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,KAAK,EAAE,qBAAqB,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC3F,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;QAC9B,uEAAuE;QACvE,qEAAqE;QACrE,4EAA4E;QAC5E,2CAA2C;QAC3C,MAAM,CAAC,IAAI,CACT,GAAG,mBAAmB,CAAC,MAAM,CAAC,IAAI,EAAE;YAClC,KAAK,EAAE,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YAC3D,OAAO,EAAE,GAAG,CAAC,EAAE;SAChB,CAAC,CACH,CAAC;QACF,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;IACtF,CAAC;IAED,uEAAuE;IACvE,iFAAiF;IACjF,kEAAkE;IAClE,sCAAsC;IACtC,yEAAyE;IACzE,0EAA0E;IAC1E,sBAAsB;IACtB,MAAM,KAAK,GAAgD,QAAQ;QACjE,CAAC,CAAC,MAAM,YAAY,CAAC;YACjB,OAAO;YACP,UAAU;YACV,SAAS;YACT,YAAY,EAAE,gBAAgB;YAC9B,uEAAuE;YACvE,wEAAwE;YACxE,6DAA6D;YAC7D,yDAAyD;YACzD,UAAU,EAAE,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,wBAAwB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC;YACjH,4EAA4E;YAC5E,4EAA4E;YAC5E,oEAAoE;YACpE,KAAK,EAAE,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,oBAAoB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,EAAE,GAAG,QAAQ,CAAC,CAAC;YAChF,8EAA8E;YAC9E,wEAAwE;YACxE,gCAAgC;YAChC,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,MAAM,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;YAC9I,sEAAsE;YACtE,yEAAyE;YACzE,+DAA+D;YAC/D,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACtF,kEAAkE;YAClE,uEAAuE;YACvE,oEAAoE;YACpE,2EAA2E;YAC3E,wDAAwD;YACxD,kEAAkE;YAClE,4DAA4D;YAC5D,MAAM,EAAE,GAAG,EAAE,CAAC,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC;SAChD,CAAC;QACJ,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACzD,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC;IAC5B,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QAC/B,0EAA0E;QAC1E,kEAAkE;QAClE,2EAA2E;QAC3E,uEAAuE;QACvE,6EAA6E;QAC7E,eAAe;QACf,MAAM,CAAC,IAAI,CAAC;YACV,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,sBAAsB;YAC5B,OAAO,EAAE,SAAS;YAClB,wEAAwE;YACxE,2EAA2E;YAC3E,yEAAyE;YACzE,2EAA2E;YAC3E,wEAAwE;YACxE,2EAA2E;YAC3E,cAAc;YACd,OAAO,EACL,4GAA4G;gBAC5G,wGAAwG;gBACxG,4GAA4G;gBAC5G,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,gBAAgB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SAChE,CAAC,CAAC;IACL,CAAC;IACD,2EAA2E;IAC3E,0EAA0E;IAC1E,2DAA2D;IAC3D,6EAA6E;IAC7E,wEAAwE;IACxE,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;IAE7B,8EAA8E;IAC9E,yEAAyE;IACzE,6EAA6E;IAC7E,yEAAyE;IACzE,8EAA8E;IAC9E,yBAAyB;IACzB,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,wEAAwE;QACxE,4EAA4E;QAC5E,2EAA2E;QAC3E,0EAA0E;QAC1E,4EAA4E;QAC5E,iCAAiC;QACjC,MAAM,CAAC,IAAI,CACT,GAAG,eAAe,CAChB,gBAAgB,EAChB,aAAa,EACb,IAAI,CAAC,IAAI,KAAK,MAAM;YAClB,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;YACnC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACzF,CACF,CAAC;QACF,MAAM,CAAC,IAAI,CACT,GAAG,CAAC,MAAM,qBAAqB,CAAC;YAC9B,YAAY,EAAE,gBAAgB;YAC9B,MAAM,EAAE,aAAa;YACrB,MAAM,EAAE,GAAG,EAAE,CAAC,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC;SAChD,CAAC,CAAC,CACJ,CAAC;IACJ,CAAC;IAED,+EAA+E;IAC/E,gFAAgF;IAChF,kFAAkF;IAClF,IAAI,CAAC,GAAG,gBAAgB,EAAE,GAAG,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,EAAE,CAAC;QAC9H,MAAM,GAAG,GAAG,OAAO,IAAI,IAAI,YAAY,EAAE,CAAC;QAC1C,MAAM,CAAC,IAAI,CACT,GAAG,CAAC,MAAM,wBAAwB,CAAC;YACjC,OAAO;YACP,YAAY,EAAE,gBAAgB;YAC9B,QAAQ,EAAE,YAAY;YACtB,UAAU,EAAE,MAAM,GAAG,CAAC,YAAY,CAAC,OAAO,CAAC;YAC3C,KAAK,EAAE,IAAI,GAAG,CAAC,MAAM,oBAAoB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YACxD,YAAY,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC;YACzD,YAAY,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,OAAO,CAAC;YAC7C,gBAAgB,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,CAAC;SACvD,CAAC,CAAC,CACJ,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,KAAK,UAAU,eAAe,CAAC,OAAgB,EAAE,OAAsB;IACrE,MAAM,GAAG,GAAmB,EAAE,CAAC;IAC/B,KAAK,MAAM,OAAO,IAAI,MAAM,oBAAoB,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC;QACnE,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QAClE,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC7B,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC7B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,SAAS;YAChC,MAAM,IAAI,GACR,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;YACjH,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,KAAK,UAAU,UAAU,CACvB,KAAiB,EACjB,UAAkB,EAClB,KAAiB;IAEjB,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAClC,MAAM,GAAG,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACpH,MAAM,IAAI,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,gBAAgB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC7G,MAAM,MAAM,GAAG,WAAW,CACxB,CAAC,UAAU,CAAC,UAAU,CAAC;QACrB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,OAAO,KAAK,SAAS;YACrB,CAAC,CAAC,iBAAiB,CAAC,MAAM,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YACvD,CAAC,CAAC,MAAM,OAAO,CAAC,gBAAgB,CAAC,UAAU,CAAC,CACjD,CAAC;IACF,OAAO;QACL,IAAI;QACJ,MAAM;QACN,MAAM,EAAE;YACN,GAAG,mBAAmB,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC;YACxC,GAAG,oBAAoB,CAAC,KAAK,EAAE,MAAM,CAAC;YACtC,GAAG,CAAC,MAAM,eAAe,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;SACxD;KACF,CAAC;AACJ,CAAC","sourcesContent":["/**\n * Does the diff apply to the thing it claims to change?\n *\n * A requirement delta is a diff against a living spec, and nothing used to check\n * that it lands. Every failure mode here is silent today: MODIFIED of a\n * requirement that does not exist is merged as a creation, ADDED of one that\n * does exist REPLACES it (scenarios and all) while the author believes they are\n * adding, and a heading that nearly matches the delta grammar parses as plain\n * prose so archive merges nothing at all and says nothing about it.\n *\n * The last of those has a legal-looking cousin: a requirement under an ordinary\n * prose heading (`## Behavior`, `## Error Handling`) is BASE too, and BASE never\n * merges. Upstream OpenSpec deltas are written that way, so the answer is to name\n * what will be lost rather than to start merging prose sections.\n *\n * These run inside the archive gate, because the merge is where the damage lands.\n *\n * TWO CORPORA, ONE ALGEBRA. A feature's delta documents live in two places —\n * `specs/<svc>/{spec,arch.spec}.md` against the service tree, and\n * `capabilities/<id>/spec.md` against the authored business tree — and every\n * grade about a DOCUMENT and its living counterpart applies to both verbatim,\n * with the capability id in `subject` where a service id would be. That is not\n * a coincidence to exploit but the reason the business corpus was given deltas\n * at all: a capability document is a requirements document, so the diff that\n * changes one has exactly the same ways of not landing. A second implementation\n * would be a second set of answers to `delta.added-duplicate`.\n *\n * The exception is the four CROSS-FEATURE warnings — `delta.added-conflict`,\n * `delta.modified-conflict`, `delta.modified-pending`, `delta.removed-pending`\n * — which ask what OTHER features in flight claim. `./claims.ts` indexes the\n * service corpus only and states why; on the business axis those four are\n * silent, which is a missing warning and never a wrong answer.\n *\n * This module is only the walk: which documents get read, in what order, and how\n * each is handed a `DeltaScope`. The checks themselves are in `./document.ts`\n * (a document against itself) and `./select.ts` (the delta against the living\n * text). Their order is load-bearing and stays here, where it can be read in one\n * screen.\n */\nimport { existsSync } from \"node:fs\";\nimport { readFile } from \"node:fs/promises\";\nimport { relative } from \"node:path\";\nimport { FleetContext } from \"../fleet-context.js\";\nimport { parseRequirements, readRequirementsDocument } from \"../document/parse.js\";\nimport { type Requirement } from \"../document/spec.js\";\nimport { featureSpecPaths, SPEC_AXES } from \"../repo/paths.js\";\nimport { featureUseCasesDir, livingCapabilityPaths } from \"../repo/authored/paths.js\";\nimport { readCapabilityVocabulary } from \"../capabilities/capabilities.js\";\nimport { extendingModels } from \"../c4/service-model/fleet/extending.js\";\n\nimport { flowCoverage, type FlowPromises } from \"../usecases/delta/claims.js\";\nimport { changedPromiseFlowIssues, type ServiceDeltaPair } from \"../usecases/delta/modified.js\";\nimport { enumeratedServiceIds, locateServicePaths } from \"../repo/service-target.js\";\nimport { featureSpecServices } from \"../repo/repo.js\";\nimport { capabilityDocIssues } from \"../capabilities/delta/doc.js\";\nimport { featureCapabilityDeltas } from \"../capabilities/delta/tree.js\";\nimport {\n  removedRealizedIssues,\n  uncoveredIssues,\n  type CapabilityDeltaDoc,\n  type RealizingDoc,\n} from \"../capabilities/delta/uncovered.js\";\nimport { type Issue } from \"../vocabulary/issue.js\";\nimport { claimLookup, type ClaimLookup } from \"./claims.js\";\nimport { deltaDocumentIssues, livingDocumentIssues } from \"./document.js\";\nimport { indexLiving, type DeltaScope, type LivingIndex } from \"./scope.js\";\nimport { selectionIssues } from \"./select.js\";\nimport type { DocsDir, FeatureDir } from \"../kernel/ids/dirs.js\";\n\n/**\n * The business corpus's ONE axis. A capability document carries the promise and\n * nothing else — there is no `arch.spec.md` beside it, because \"how it is\n * built\" is precisely the altitude a capability requirement may not describe\n * (`capability.requirement-service-scoped` is that rule). It has no `key`\n * because it indexes no `ServicePaths`, which is why `DeltaScope.axis` is the\n * narrower `DeltaAxis` and not `SpecAxis`.\n */\nconst CAPABILITY_AXIS = { file: \"spec.md\" };\n\n/**\n * What every document in one feature's walk shares.\n *\n * A record rather than two more parameters because both values are about the\n * WALK and not about the document being graded — `gradeDelta` would otherwise\n * read as a four-argument function whose last two arguments never vary within\n * a run, which is how the next value gets added as a fifth.\n */\ninterface DeltaReads {\n  /** What OTHER features in flight claim — lazy, so the common case never scans. */\n  claims: ClaimLookup;\n  /** The invocation's read index, when the caller threaded one. */\n  context?: FleetContext;\n}\n\nexport async function deltaShapeIssues(\n  docsDir: DocsDir,\n  featureDir: FeatureDir,\n  featureId: string,\n  context?: FleetContext,\n): Promise<Issue[]> {\n  const issues: Issue[] = [];\n  const services = await featureSpecServices(featureDir, context);\n  // One `existsSync` for a feature that carries no capability delta, which is\n  // every feature in a fleet that has not adopted the business axis.\n  const capabilities =\n    context === undefined ? await featureCapabilityDeltas(featureDir) : await context.featureCapabilityDeltas(featureDir);\n  // The flows this feature brings, and one `existsSync` for a feature that\n  // brings none — which is every feature in a fleet that has not adopted the\n  // axis. The directory, not the documents: what is needed here is whether to\n  // pay for the overlay at all, and the walk that lists them happens once,\n  // inside it.\n  const hasFlows = existsSync(featureUseCasesDir(featureDir));\n  // The early return must ask about EVERY corpus. Asking only about services\n  // meant a capability-only feature — a business change with no service touched\n  // yet, which is exactly what an analyst writes first — was graded by nothing\n  // and archived whatever its delta said; asking only about those two would do\n  // the same to a feature whose whole content is a cross-service flow, which is\n  // the shape an architect answers an analyst with.\n  if (services.length === 0 && capabilities.docs.length === 0 && !hasFlows) return issues;\n\n  // What OTHER features in flight claim. Only built when a claim has to be\n  // checked — the common case never pays for the scan.\n  const reads: DeltaReads = {\n    claims: claimLookup(docsDir, featureId, context),\n    ...(context === undefined ? {} : { context }),\n  };\n\n  // The two corpora's parsed requirements, kept as the walk produces them so\n  // the `Realizes:` join below can be taken without re-reading a byte. That\n  // join is the one question neither corpus can answer alone — which service\n  // requirement keeps which business promise — and this is the only place in\n  // loam where both sides are already open (`capabilities/delta/uncovered.ts`\n  // holds the rules; nothing here decides anything).\n  const serviceDeltas: RealizingDoc[] = [];\n  const capabilityDeltas: CapabilityDeltaDoc[] = [];\n  // Each service axis beside its living document, for the one question that\n  // needs both: which living flow claims a requirement this feature changes.\n  const servicePairs: ServiceDeltaPair[] = [];\n\n  // Both requirement-carrying files per service run the same checks — one code\n  // path parameterized by filename, the merge's own factoring. `where` names\n  // the arch file in messages so a finding cannot be chased into the wrong\n  // document; spec.md keeps its historical spelling.\n  for (const service of services) {\n    for (const axis of SPEC_AXES) {\n      const specPath = featureSpecPaths(featureDir, service)[axis.key];\n      if (!existsSync(specPath)) continue;\n      const scope: DeltaScope = {\n        kind: \"service\",\n        subject: service,\n        axis,\n        featureId,\n        docsDir,\n        specPath,\n        where: axis.key === \"spec\" ? service : `${service} (arch.spec.md)`,\n        // How the axis's living document is named in messages — spec.md keeps\n        // the historical \"living spec\", the arch axis says which file it means.\n        livingDoc: axis.key === \"spec\" ? \"living spec\" : \"living arch.spec.md\",\n      };\n      const graded = await gradeDelta(scope, (await locateServicePaths(docsDir, service, context))[axis.key], reads);\n      issues.push(...graded.issues);\n      serviceDeltas.push({ service, file: axis.file, reqs: graded.reqs });\n      const paths = (): ReturnType<typeof locateServicePaths> => locateServicePaths(docsDir, service, context);\n      servicePairs.push({ id: service, axis: axis.key, reqs: graded.reqs, living: graded.living.all, paths });\n    }\n  }\n\n  for (const doc of capabilities.docs) {\n    const scope: DeltaScope = {\n      kind: \"capability\",\n      subject: doc.id,\n      axis: CAPABILITY_AXIS,\n      featureId,\n      docsDir,\n      specPath: doc.spec,\n      // `capability <id>`, not `capabilities/<id>` — the second reads as the\n      // LIVING directory, and every message this labels is about the FEATURE's\n      // delta of it. Sending an author to edit the wrong one of two files with\n      // the same name is the whole reason `where` and `livingDoc` are separate.\n      where: `capability ${doc.id}`,\n      livingDoc: `living capabilities/${doc.id}/spec.md`,\n    };\n    // Absent is a real and ordinary answer on this axis: the first feature to\n    // mention a capability is what creates its living document, so the whole\n    // delta grades against `[]` and every requirement in it is legitimately an\n    // addition.\n    const graded = await gradeDelta(scope, livingCapabilityPaths(docsDir, doc.id).spec, reads);\n    issues.push(...graded.issues);\n    // The document's own three rules, on the requirements this delta would\n    // MERGE — before the merge, where the author can still fix them. See\n    // `capabilities/delta/doc.ts` for why grading only the living copy leaves a\n    // hole straight through the altitude rule.\n    issues.push(\n      ...capabilityDocIssues(graded.reqs, {\n        where: relative(docsDir, doc.spec).split(/[\\\\/]/).join(\"/\"),\n        subject: doc.id,\n      }),\n    );\n    capabilityDeltas.push({ id: doc.id, reqs: graded.reqs, living: graded.living.all });\n  }\n\n  // The other carrier of a promise, read once and only when this feature\n  // actually brings a flow: the `dynamic view`s under `features/<FEAT>/usecases/`,\n  // parsed over the map this feature's own merge would leave behind\n  // (`core/usecases/delta/overlay.ts`).\n  // A feature with no `usecases/` directory is a REAL empty answer, not an\n  // ungraded one: there is no flow, so \"no flow keeps this\" is true and the\n  // message may say it.\n  const flows: { promises: FlowPromises; issues: Issue[] } = hasFlows\n    ? await flowCoverage({\n        docsDir,\n        featureDir,\n        featureId,\n        capabilities: capabilityDeltas,\n        // Read HERE, through the invocation's index, because this module holds\n        // it and `core/usecases/` does not — every other read in this walk does\n        // the same, and `core/repo/service-target.ts` prices a fleet\n        // enumeration per call at ~13 ms on a 120-service fleet.\n        vocabulary: context === undefined ? await readCapabilityVocabulary(docsDir) : await context.capabilities(docsDir),\n        // The fleet the merge leaves: each `specs/<svc>/` of this feature becomes a\n        // `services/<svc>/`, so a hop into a service it introduces resolves to that\n        // service in the grade, as it will under the next `validate --all`.\n        known: new Set([...(await enumeratedServiceIds(docsDir, context)), ...services]),\n        // Decoded or refused by name (`readRequirementsDocument`), never `readFile`'s\n        // utf8 — a UTF-16 capability document would read as no requirements and\n        // convict every flow naming it.\n        read: async (path) => (context === undefined ? parseRequirements(await readRequirementsDocument(path)) : await context.readRequirements(path)),\n        // A function rather than the context itself: one memoised LikeC4 read\n        // does not justify an edge from `core/usecases/` to `fleet-context`, and\n        // the edge would push that package up a DAG level for nothing.\n        ...(context === undefined ? {} : { load: (path: string) => context.loadLikeC4(path) }),\n        // The fleet's extending models, for the merge preview the overlay\n        // grades against — read HERE for `vocabulary`'s reason exactly, and as\n        // a thunk so the walk pays for it only when a flow is really there.\n        // Without it the preview is the pre-routing map and `usecase.flow-invalid`\n        // fails open on the one shape it exists for: a hop into\n        // `<service-fqn>.<container>`, which the archive routes into that\n        // service's own model (verification 2026-09-04, review F8).\n        models: () => extendingModels(docsDir, context),\n      })\n    : { promises: { kind: \"read\", kept: [] }, issues: [] };\n  const kept = flows.promises;\n  if (kept.kind === \"unreadable\") {\n    // ERROR, and the archive gate's own `NEVER_OVERRIDABLE` keeps `--approve`\n    // off it. This is the refusal that stops a flow being copied into\n    // `architecture/` and the NEXT reader's `loam validate --all` carrying the\n    // failure — including the case the overlay exists for, a hop naming an\n    // element the merge does not land. Mechanical, so it is not loam's judgement\n    // to override.\n    issues.push({\n      severity: \"error\",\n      code: \"usecase.flow-invalid\",\n      subject: featureId,\n      // The opening sentence does NOT say whose file is at fault, and that is\n      // deliberate: the corpus this reads is the feature's flows PLUS the living\n      // `architecture/` documents they are drawn over, so the failing path can\n      // be a living one — a landscape that no longer parses, a use case somebody\n      // else wrote. Every message carries its own path, so a reader can place\n      // it; an opening line that blamed `usecases/` would send them to the wrong\n      // file first.\n      message:\n        `this feature's flows could not be graded against the map its own merge would leave behind, so the archive ` +\n        `would land an architecture/ nothing has checked. The corpus is the feature's usecases/ AND the living ` +\n        `architecture/ documents they are drawn over, so the fault may be in either — each message names its file. ` +\n        `${kept.errors.length} problem(s): ${kept.errors.join(\"; \")}`,\n    });\n  }\n  // And the flows that DID read, graded as `validate --all` grades them once\n  // living: every hop against the post-merge map, every `#cap-`/`#req-` tag\n  // against the vocabulary and requirements the merge leaves\n  // (`core/usecases/grade/feature.ts`). Before this, a hop nothing backs and a\n  // `#req-` tag nothing resolves archived clean and turned the fleet red.\n  issues.push(...flows.issues);\n\n  // The `Realizes:` join, both directions, over documents this walk has already\n  // parsed. Skipped entirely when the feature carries no capability delta,\n  // which is every feature in a fleet that has not adopted the business axis —\n  // and the removal half asks for the living corpus only when something is\n  // actually retired, so even an adopting fleet pays the fleet-wide read on the\n  // features that earn it.\n  if (capabilityDeltas.length > 0) {\n    // The three arms travel as three, and flattening two of them to `[]` is\n    // the one thing this must not do: `capability.uncovered` says in words that\n    // no flow keeps the promise, so handing it an empty list for a corpus loam\n    // could not read or could not resolve makes it assert a negative it never\n    // evaluated — and gate on it. `claims.ts`'s header states the rule; this is\n    // where a caller could break it.\n    issues.push(\n      ...uncoveredIssues(\n        capabilityDeltas,\n        serviceDeltas,\n        kept.kind === \"read\"\n          ? { graded: true, kept: kept.kept }\n          : { graded: false, why: kept.kind === \"ungraded\" ? kept.why : kept.errors.join(\"; \") },\n      ),\n    );\n    issues.push(\n      ...(await removedRealizedIssues({\n        capabilities: capabilityDeltas,\n        deltas: serviceDeltas,\n        living: () => livingRealizers(docsDir, context),\n      })),\n    );\n  }\n\n  // The living flows whose `#req-` tag claims a promise this feature rewrites or\n  // retires (`core/usecases/delta/modified.ts`). Asked only when a requirement is\n  // MODIFIED or REMOVED, on either corpus, so no other feature reads a flow for it.\n  if ([...capabilityDeltas, ...servicePairs].some((doc) => doc.reqs.some((r) => r.kind === \"MODIFIED\" || r.kind === \"REMOVED\"))) {\n    const ctx = context ?? new FleetContext();\n    issues.push(\n      ...(await changedPromiseFlowIssues({\n        docsDir,\n        capabilities: capabilityDeltas,\n        services: servicePairs,\n        vocabulary: await ctx.capabilities(docsDir),\n        known: new Set(await enumeratedServiceIds(docsDir, ctx)),\n        serviceModel: (paths) => ctx.serviceModel(docsDir, paths),\n        architecture: () => ctx.architecture(docsDir),\n        readRequirements: (path) => ctx.readRequirements(path),\n      })),\n    );\n  }\n\n  return issues;\n}\n\n/**\n * Every LIVING service requirements document in the fleet, for the one question\n * that has to ask about services this feature never mentions: does anything out\n * there still realize a capability requirement this feature retires?\n *\n * The same shape and the same cost `openapi.remove-op-consumed` pays through\n * the consumer index (`core/consumers/`) one axis over, and for the same reason — the merge\n * deletes the promise while the `Realizes:` line stays, so the very next\n * `validate --all` reports a breach on a repository whose author was never in\n * this feature. Called behind a thunk (`removedRealizedIssues` invokes it only\n * when something is retired), so a feature that removes nothing never runs it.\n */\nasync function livingRealizers(docsDir: DocsDir, context?: FleetContext): Promise<RealizingDoc[]> {\n  const out: RealizingDoc[] = [];\n  for (const service of await enumeratedServiceIds(docsDir, context)) {\n    const paths = await locateServicePaths(docsDir, service, context);\n    for (const axis of SPEC_AXES) {\n      const path = paths[axis.key];\n      if (!existsSync(path)) continue;\n      const reqs =\n        context === undefined ? parseRequirements(await readFile(path, \"utf8\")) : await context.readRequirements(path);\n      out.push({ service, file: axis.file, reqs });\n    }\n  }\n  return out;\n}\n\n/**\n * One delta document against one living document: the three passes, in the\n * order that makes their messages readable.\n *\n * The order is load-bearing. `deltaDocumentIssues` settles what the delta says\n * about itself, `livingDocumentIssues` settles whether the living text can be\n * selected in at all, and only then does `selectionIssues` compare them — a pin\n * the document pass already refused must not also be reported stale, which\n * would send its author to `loam rebase` for a problem rebase does not fix.\n *\n * The parsed delta requirements come back with the issues because the capability\n * corpus grades them a second way (`capabilityDocIssues`) and re-reading the\n * file to do it would be a second parse of bytes already in hand — and, without\n * a context, a second chance for the two passes to disagree about the document.\n * The LIVING index rides back for the same reason once more: the removal\n * direction of the `Realizes:` join has to resolve a REMOVED spelled by heading\n * into the id it retires, and that id is a fact about the living document.\n */\nasync function gradeDelta(\n  scope: DeltaScope,\n  livingPath: string,\n  reads: DeltaReads,\n): Promise<{ issues: Issue[]; reqs: Requirement[]; living: LivingIndex }> {\n  const { claims, context } = reads;\n  const raw = context === undefined ? await readFile(scope.specPath, \"utf8\") : await context.readText(scope.specPath);\n  const reqs = context === undefined ? parseRequirements(raw) : await context.readRequirements(scope.specPath);\n  const living = indexLiving(\n    !existsSync(livingPath)\n      ? []\n      : context === undefined\n        ? parseRequirements(await readFile(livingPath, \"utf8\"))\n        : await context.readRequirements(livingPath),\n  );\n  return {\n    reqs,\n    living,\n    issues: [\n      ...deltaDocumentIssues(scope, raw, reqs),\n      ...livingDocumentIssues(scope, living),\n      ...(await selectionIssues(scope, reqs, living, claims)),\n    ],\n  };\n}\n"]}

package/dist/core/dependencies/fanin.js

@@ -25,8 +25,8 @@
  *     caller, whether or not the edge carries an `op` (an op edge and a plain
  *     edge are one claim of dependence each);
  *  2. a drawn edge carrying `consumes` — the rule of
- *     commands/validate/service/events/events.ts: `consumes` binds the edge's
- *     TARGET as the consumer and its SOURCE as the producer, so an edge drawn
+ *     core/c4/direction/direction.ts: `consumes` binds the edge's TARGET as
+ *     the consumer, so the source is what it consumes from, and an edge drawn
  *     producer→consumer is fan-in on the SOURCE. Such an edge contributes
  *     join 2 ONLY: on the event spine THE ARROW FOLLOWS THE MESSAGE (the
  *     scaffolded landscape's own doctrine, examples/docs' landscape spells

package/dist/core/dependencies/fanin.js.map

@@ -1 +1 @@
-{"version":3,"file":"fanin.js","sourceRoot":"","sources":["../../../src/core/dependencies/fanin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AA2CH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,UAAU,CAAC,GAAiB;IAC1C,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACpC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAuB,CAAC;IACjD,MAAM,MAAM,GAAG,CAAC,QAAgB,EAAE,QAAgB,EAAQ,EAAE;QAC1D,IAAI,QAAQ,KAAK,QAAQ;YAAE,OAAO;QAClC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO;QACzD,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,GAAG,EAAU,CAAC;QACzD,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAClB,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC/B,CAAC,CAAC;IAEF,IAAI,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;QACzB,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC,SAAS,CAAC;QAC/C,KAAK,MAAM,CAAC,IAAI,aAAa,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YAC/B,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YAC/B,qEAAqE;YACrE,0DAA0D;YAC1D,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS;gBAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;;gBAChD,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,0EAA0E;IAC1E,wEAAwE;IACxE,MAAM,SAAS,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC9C,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;QACxC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,SAAS;QAC7B,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;YACjC,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;QACxC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,SAAS;QAC7B,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YACrC,KAAK,MAAM,QAAQ,IAAI,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE;gBAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;IAED,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/E,CAAC","sourcesContent":["/**\n * Fleet fan-in: for each service, how many DISTINCT other known services\n * depend on it — the blast radius behind `loam list --needs-work\n * --review-order`. Reviewing the most-depended-on service first is the one\n * ordering a campaign lead cannot derive by eye from the worklist.\n *\n * Pure derivation, derived-never-stored, in the package that already owns\n * who-depends-on-whom: `core/dependencies/` derives the feature ordering from\n * artifact identities, and this module derives the service-level analog. The\n * command layer (commands/list/review.ts) gathers the inputs from reads the\n * repository already pays for and hands them in as data, so the module itself\n * imports nothing — no IO, no parser import, never prints. The edge slice is\n * structural for the same reason `core/vocabulary/maturity.ts`'s EdgeSource\n * is: `core/c4/likec4.ts`'s `Rel` satisfies it without an import edge into\n * the parser.\n */\n\n/** The slice of a drawn relationship the joins read. */\nexport interface FanInEdge {\n  source: string;\n  target: string;\n  /** AsyncAPI message this edge CONSUMES — binds the TARGET as the consumer. */\n  consumes?: string;\n}\n\n/** One service's contract slice: what it declares it sends, and what its living requirements consume. */\nexport interface FanInContracts {\n  /** Message names this service's asyncapi.yaml reaches from an `action: send` operation. */\n  sent: readonly string[];\n  /** Message names the service's living (non-REMOVED) spec/arch requirements carry on `Consumes:` lines. */\n  consumed: readonly string[];\n}\n\n/**\n * The fleet map's contribution, as a variant rather than optional fields: a\n * landscape either parses — and then it has relationships and a resolver — or\n * it proves nothing, and there is no half-state in which `parses: false`\n * arrives carrying edges anyway. Positive evidence only, the rule\n * `landscapeEvidence` (core/vocabulary/maturity.ts) spells for the same map:\n * an absent or unparseable landscape contributes NOTHING to the edge joins,\n * while the requirement join below still counts.\n */\nexport type FanInLandscape =\n  | {\n      parses: true;\n      relationships: readonly FanInEdge[];\n      /** The shared container-aware resolver (`core/c4/resolve/service.ts` serviceResolver), widened to plain strings. */\n      svcOf: (id: string) => string;\n    }\n  | { parses: false };\n\nexport interface FanInRequest {\n  /** Every known service id — the universe both ends of every join are filtered to. */\n  services: readonly string[];\n  landscape: FanInLandscape;\n  contracts: ReadonlyMap<string, FanInContracts>;\n}\n\n/**\n * Distinct known consumers per service, as a count for every id in\n * `req.services` (0 when nothing depends on it — a proven zero, since only\n * positive evidence ever increments it).\n *\n * Three joins, unioned by DISTINCT consumer so overlapping evidence for one\n * caller counts once:\n *  1. a drawn edge WITHOUT `consumes` into a service — its source is a\n *     caller, whether or not the edge carries an `op` (an op edge and a plain\n *     edge are one claim of dependence each);\n *  2. a drawn edge carrying `consumes` — the rule of\n *     commands/validate/service/events/events.ts: `consumes` binds the edge's\n *     TARGET as the consumer and its SOURCE as the producer, so an edge drawn\n *     producer→consumer is fan-in on the SOURCE. Such an edge contributes\n *     join 2 ONLY: on the event spine THE ARROW FOLLOWS THE MESSAGE (the\n *     scaffolded landscape's own doctrine, examples/docs' landscape spells\n *     it), so the arrow of a delivery edge is not a call into its target —\n *     reading it as one would rank a pure event sink above a real dependency\n *     and hand a bound broker service one phantom dependant per consumer;\n *  3. the landscape-independent requirement join — a service consumes a\n *     message some other service declares `action: send` for.\n * Self-dependence proves nothing, and an endpoint outside the known-service\n * set (an actor, an `#external` system, an unresolved id) is not a fleet\n * caller — review order ranks work the FLEET depends on.\n */\nexport function fleetFanIn(req: FanInRequest): Map<string, number> {\n  const known = new Set(req.services);\n  const consumers = new Map<string, Set<string>>();\n  const depend = (producer: string, consumer: string): void => {\n    if (producer === consumer) return;\n    if (!known.has(producer) || !known.has(consumer)) return;\n    const set = consumers.get(producer) ?? new Set<string>();\n    set.add(consumer);\n    consumers.set(producer, set);\n  };\n\n  if (req.landscape.parses) {\n    const { relationships, svcOf } = req.landscape;\n    for (const r of relationships) {\n      const source = svcOf(r.source);\n      const target = svcOf(r.target);\n      // The variants of the join comment above: a delivery edge (consumes)\n      // claims producer→consumer, never a call into its target.\n      if (r.consumes === undefined) depend(target, source);\n      else depend(source, target);\n    }\n  }\n\n  // Join 3. Producer index first: message name → every service declaring it\n  // sent. A message more than one service declares lands its subscribers on\n  // every declarer — the derivation never guesses which declaration wins.\n  const producers = new Map<string, string[]>();\n  for (const [id, slice] of req.contracts) {\n    if (!known.has(id)) continue;\n    for (const message of slice.sent) {\n      producers.set(message, [...(producers.get(message) ?? []), id]);\n    }\n  }\n  for (const [id, slice] of req.contracts) {\n    if (!known.has(id)) continue;\n    for (const message of slice.consumed) {\n      for (const producer of producers.get(message) ?? []) depend(producer, id);\n    }\n  }\n\n  return new Map(req.services.map((id) => [id, consumers.get(id)?.size ?? 0]));\n}\n"]}
+{"version":3,"file":"fanin.js","sourceRoot":"","sources":["../../../src/core/dependencies/fanin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AA2CH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,UAAU,CAAC,GAAiB;IAC1C,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACpC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAuB,CAAC;IACjD,MAAM,MAAM,GAAG,CAAC,QAAgB,EAAE,QAAgB,EAAQ,EAAE;QAC1D,IAAI,QAAQ,KAAK,QAAQ;YAAE,OAAO;QAClC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO;QACzD,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,GAAG,EAAU,CAAC;QACzD,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAClB,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC/B,CAAC,CAAC;IAEF,IAAI,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;QACzB,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC,SAAS,CAAC;QAC/C,KAAK,MAAM,CAAC,IAAI,aAAa,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YAC/B,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YAC/B,qEAAqE;YACrE,0DAA0D;YAC1D,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS;gBAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;;gBAChD,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,0EAA0E;IAC1E,wEAAwE;IACxE,MAAM,SAAS,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC9C,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;QACxC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,SAAS;QAC7B,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;YACjC,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;QACxC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,SAAS;QAC7B,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YACrC,KAAK,MAAM,QAAQ,IAAI,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE;gBAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;IAED,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/E,CAAC","sourcesContent":["/**\n * Fleet fan-in: for each service, how many DISTINCT other known services\n * depend on it — the blast radius behind `loam list --needs-work\n * --review-order`. Reviewing the most-depended-on service first is the one\n * ordering a campaign lead cannot derive by eye from the worklist.\n *\n * Pure derivation, derived-never-stored, in the package that already owns\n * who-depends-on-whom: `core/dependencies/` derives the feature ordering from\n * artifact identities, and this module derives the service-level analog. The\n * command layer (commands/list/review.ts) gathers the inputs from reads the\n * repository already pays for and hands them in as data, so the module itself\n * imports nothing — no IO, no parser import, never prints. The edge slice is\n * structural for the same reason `core/vocabulary/maturity.ts`'s EdgeSource\n * is: `core/c4/likec4.ts`'s `Rel` satisfies it without an import edge into\n * the parser.\n */\n\n/** The slice of a drawn relationship the joins read. */\nexport interface FanInEdge {\n  source: string;\n  target: string;\n  /** AsyncAPI message this edge CONSUMES — binds the TARGET as the consumer. */\n  consumes?: string;\n}\n\n/** One service's contract slice: what it declares it sends, and what its living requirements consume. */\nexport interface FanInContracts {\n  /** Message names this service's asyncapi.yaml reaches from an `action: send` operation. */\n  sent: readonly string[];\n  /** Message names the service's living (non-REMOVED) spec/arch requirements carry on `Consumes:` lines. */\n  consumed: readonly string[];\n}\n\n/**\n * The fleet map's contribution, as a variant rather than optional fields: a\n * landscape either parses — and then it has relationships and a resolver — or\n * it proves nothing, and there is no half-state in which `parses: false`\n * arrives carrying edges anyway. Positive evidence only, the rule\n * `landscapeEvidence` (core/vocabulary/maturity.ts) spells for the same map:\n * an absent or unparseable landscape contributes NOTHING to the edge joins,\n * while the requirement join below still counts.\n */\nexport type FanInLandscape =\n  | {\n      parses: true;\n      relationships: readonly FanInEdge[];\n      /** The shared container-aware resolver (`core/c4/resolve/service.ts` serviceResolver), widened to plain strings. */\n      svcOf: (id: string) => string;\n    }\n  | { parses: false };\n\nexport interface FanInRequest {\n  /** Every known service id — the universe both ends of every join are filtered to. */\n  services: readonly string[];\n  landscape: FanInLandscape;\n  contracts: ReadonlyMap<string, FanInContracts>;\n}\n\n/**\n * Distinct known consumers per service, as a count for every id in\n * `req.services` (0 when nothing depends on it — a proven zero, since only\n * positive evidence ever increments it).\n *\n * Three joins, unioned by DISTINCT consumer so overlapping evidence for one\n * caller counts once:\n *  1. a drawn edge WITHOUT `consumes` into a service — its source is a\n *     caller, whether or not the edge carries an `op` (an op edge and a plain\n *     edge are one claim of dependence each);\n *  2. a drawn edge carrying `consumes` — the rule of\n *     core/c4/direction/direction.ts: `consumes` binds the edge's TARGET as\n *     the consumer, so the source is what it consumes from, and an edge drawn\n *     producer→consumer is fan-in on the SOURCE. Such an edge contributes\n *     join 2 ONLY: on the event spine THE ARROW FOLLOWS THE MESSAGE (the\n *     scaffolded landscape's own doctrine, examples/docs' landscape spells\n *     it), so the arrow of a delivery edge is not a call into its target —\n *     reading it as one would rank a pure event sink above a real dependency\n *     and hand a bound broker service one phantom dependant per consumer;\n *  3. the landscape-independent requirement join — a service consumes a\n *     message some other service declares `action: send` for.\n * Self-dependence proves nothing, and an endpoint outside the known-service\n * set (an actor, an `#external` system, an unresolved id) is not a fleet\n * caller — review order ranks work the FLEET depends on.\n */\nexport function fleetFanIn(req: FanInRequest): Map<string, number> {\n  const known = new Set(req.services);\n  const consumers = new Map<string, Set<string>>();\n  const depend = (producer: string, consumer: string): void => {\n    if (producer === consumer) return;\n    if (!known.has(producer) || !known.has(consumer)) return;\n    const set = consumers.get(producer) ?? new Set<string>();\n    set.add(consumer);\n    consumers.set(producer, set);\n  };\n\n  if (req.landscape.parses) {\n    const { relationships, svcOf } = req.landscape;\n    for (const r of relationships) {\n      const source = svcOf(r.source);\n      const target = svcOf(r.target);\n      // The variants of the join comment above: a delivery edge (consumes)\n      // claims producer→consumer, never a call into its target.\n      if (r.consumes === undefined) depend(target, source);\n      else depend(source, target);\n    }\n  }\n\n  // Join 3. Producer index first: message name → every service declaring it\n  // sent. A message more than one service declares lands its subscribers on\n  // every declarer — the derivation never guesses which declaration wins.\n  const producers = new Map<string, string[]>();\n  for (const [id, slice] of req.contracts) {\n    if (!known.has(id)) continue;\n    for (const message of slice.sent) {\n      producers.set(message, [...(producers.get(message) ?? []), id]);\n    }\n  }\n  for (const [id, slice] of req.contracts) {\n    if (!known.has(id)) continue;\n    for (const message of slice.consumed) {\n      for (const producer of producers.get(message) ?? []) depend(producer, id);\n    }\n  }\n\n  return new Map(req.services.map((id) => [id, consumers.get(id)?.size ?? 0]));\n}\n"]}

package/dist/core/deployment/delta.js

@@ -0,0 +1,191 @@
+/**
+ * A feature's own topology: `features/<FEAT>/deployment/<name>.likec4`.
+ *
+ * Until this slot existed a change that stood up a standby cluster had to be
+ * written in two places at once — the requirement in the feature, the topology
+ * edited straight into `architecture/` — because `delta.likec4` refuses a
+ * `deployment { }` block and always will: that document re-declares the
+ * landscape's own identifiers and carries its own `specification`, so it cannot
+ * be staged beside the map in one LikeC4 project. A document that declares
+ * NEITHER can, which is exactly why the use-case axis put its flows in files of
+ * their own, and why this mirrors it rather than inventing a shape.
+ *
+ * WHAT MAKES IT WORK, and it was measured before the axis was written: LikeC4
+ * `extend` resolves across documents of one project. A feature writes
+ *
+ *     deployment {
+ *       extend eu {
+ *         dcC = datacenter 'DC-C' { k8sC = cluster 'cluster-c' { … } }
+ *       }
+ *       eu.dcA.k8sA -> eu.dcC.k8sC 'async replication'
+ *     }
+ *
+ * and the living region gains a datacenter with the living file untouched. So
+ * the merge is a copy, not a splice, and `unarchive` needs nothing new — a
+ * create is undone by deleting, which the snapshot manifest already records for
+ * every write in the plan.
+ *
+ * CREATE-ONLY, for `core/usecases/delta/flows.ts`'s reasons rather than a
+ * weaker version of them. A requirement delta merges INTO a living document and
+ * two features editing one requirement would overwrite each other silently; a
+ * topology document has no such algebra — the file is one block, the merge is a
+ * whole-file copy, and there is nothing to merge partially. Rewriting a living
+ * one through a feature would be a silent whole-file replacement with no pin to
+ * collide on, where editing `architecture/<name>.likec4` directly in the same
+ * pull request produces an ordinary git conflict a human resolves.
+ *
+ * ## Graded against the map its own merge would leave behind
+ *
+ * `ARCH-LOAM-FEATURE-CORPUS`, and this axis needs it more literally than the
+ * use-case one does: a feature that stands a service up in a new cluster
+ * declares that service in its `delta.likec4` and instances it here, so the
+ * element the topology names exists ONLY post-merge. Read against the living
+ * landscape it is unresolved, LikeC4 refuses the whole project, and loam would
+ * report a hole against a file whose only fault is arriving with the change
+ * that makes it true.
+ *
+ * The staging is `core/c4/project/staged.ts`, shared with the use-case slot
+ * rather than copied — the two would have disagreed first about the merge
+ * preview, which is the one thing both refusals rest on.
+ */
+import { existsSync } from "node:fs";
+import { basename, join } from "node:path";
+import { architectureDir } from "../c4/project/architecture.js";
+import { stageMergedProject } from "../c4/project/staged.js";
+import {} from "../c4/likec4.js";
+import { relativeDocuments } from "../c4/project/documents.js";
+import { featureDeploymentDir } from "../repo/authored/paths.js";
+import { reservedArchitectureName } from "../repo/paths.js";
+import {} from "../vocabulary/issue.js";
+/**
+ * The topology documents one feature carries, ordered by path.
+ *
+ * Zero readdirs when the feature has no `deployment/` directory, which is every
+ * feature in a fleet that has not adopted the axis: `architectureDocuments`
+ * answers an absent directory with an empty list rather than a throw. That
+ * directory's existence is the whole per-feature opt-in.
+ */
+export async function featureDeployments(featureDir) {
+    return relativeDocuments(featureDeploymentDir(featureDir));
+}
+/**
+ * The LIVING path a feature-local topology document addresses.
+ *
+ * Straight into `architecture/`, with no subdirectory of its own — unlike
+ * `architecture/usecases/`, and the difference is the model rather than taste.
+ * A `deployment { }` block is part of the fleet's ONE architecture project and
+ * is read as such by every loader; filing it under a subdirectory would suggest
+ * a second project, which is exactly the reading `subsystems.likec4` and
+ * `landscape.likec4` already refuse by sitting at the top level together.
+ *
+ * `rel` is joined un-split, which `node:path` normalizes. What holds the join is
+ * PROVENANCE: every `rel` here came out of an `architectureDocuments` walk, so
+ * each component is a directory entry that exists. No caller takes one from argv.
+ */
+export function livingDeploymentPath(docsDir, rel) {
+    return join(architectureDir(docsDir), rel);
+}
+/**
+ * The two things that can go wrong about a topology document's NAME, before
+ * anything about its contents is asked.
+ *
+ * `deployment.doc-reserved` — the name is one loam owns inside `architecture/`.
+ * The merge writes straight into that directory, unlike a flow, which lands
+ * under `usecases/`, so `<name>` is free to collide with the living map, either
+ * of the two GENERATED views files (`subsystems.likec4` and `services.likec4`),
+ * or the flow tree. `reservedArchitectureName` carries which and why. It is
+ * asked FIRST and WITHOUT an existence test, because three of the four fail
+ * silently when the target does not exist yet.
+ *
+ * `deployment.doc-exists` — a topology document this feature introduces that
+ * the living `architecture/` already holds.
+ *
+ * An ERROR and never a warning-that-gates, for `usecase.flow-exists`'s reason:
+ * there is no legal reading of it. The merge would replace an authored topology
+ * wholesale, and no `--approve` makes that a different act than it is. Two
+ * features introducing the same file is the case that makes it load-bearing
+ * rather than pedantic — whichever archives first creates the living document,
+ * and the second is told before it merges that its own file is the one to
+ * delete.
+ *
+ * The collision is on the FILE, not on what is inside it. Two features may both
+ * extend the same living region from two documents of their own and both
+ * archive; that is the shape `extend` exists for, and refusing it would make the
+ * slot useless for the fleet-wide change it was built for.
+ */
+export async function deploymentDeltaIssues(docsDir, featureDir) {
+    const docs = await featureDeployments(featureDir);
+    const issues = [];
+    // The reservation runs FIRST and independently of existence, because three of
+    // the four names it refuses need not exist for the merge to be wrong. A
+    // topology copied over either GENERATED file — `subsystems.likec4` or
+    // `services.likec4` — is destroyed by the next `loam subsystem sync` and is
+    // invisible to every project load until then: the merge would report
+    // `created architecture/subsystems.likec4` and nothing downstream would ever
+    // say another word about it.
+    for (const doc of docs) {
+        const reason = reservedArchitectureName(doc.rel);
+        if (reason === null)
+            continue;
+        issues.push({
+            severity: "error",
+            code: "deployment.doc-reserved",
+            subject: doc.rel,
+            message: `features/<FEAT>/deployment/${doc.rel} would merge to architecture/${doc.rel}, and that name is loam's: ` +
+                `${reason}. Rename the feature's document — its name is yours to choose, and \`extend\` is how it adds to ` +
+                "what a living document already declares.",
+        });
+    }
+    return issues.concat(docs
+        .filter((doc) => reservedArchitectureName(doc.rel) === null)
+        .filter((doc) => existsSync(livingDeploymentPath(docsDir, doc.rel)))
+        .map((doc) => ({
+        severity: "error",
+        code: "deployment.doc-exists",
+        subject: doc.rel,
+        message: `architecture/${doc.rel} already exists, so this feature's topology would replace an authored one wholesale — ` +
+            "a feature-local deployment document INTRODUCES topology, it does not rewrite it. " +
+            `Delete features/<FEAT>/deployment/${doc.rel} and edit architecture/${doc.rel} directly in this same change, ` +
+            "where git produces an ordinary conflict if somebody else is editing it too. " +
+            `To ADD to what that file declares, write a document of another name that says \`extend\` — ` +
+            `\`${suggest(doc.rel)}\` — which is what lets two features grow one region without touching each other.`,
+    })));
+}
+/**
+ * Parse this feature's topology documents over the post-merge map.
+ *
+ * A feature with no `deployment/` directory is `read` at the cost of one walk
+ * over a directory that is not there — the axis's per-feature opt-in, and the
+ * whole price a fleet that has not adopted it pays. Nothing is staged, nothing
+ * is parsed, and no temp tree is made.
+ *
+ * The verdict is deliberately BINARY. The use-case overlay hands its caller the
+ * views it read because the axis has questions about their content; this one
+ * has none — a topology document is checked by being parseable against the map
+ * the merge will write, and everything else about it is graded by
+ * `loam validate --all` once it is living, exactly as the landscape is.
+ */
+export async function readFeatureDeployments(req) {
+    const docs = await featureDeployments(req.featureDir);
+    if (docs.length === 0)
+        return { kind: "read" };
+    // AFTER the early return: the fleet read is paid only by a feature that
+    // actually brings a topology document.
+    const models = req.models === undefined ? undefined : await req.models();
+    const staged = await stageMergedProject({
+        docsDir: req.docsDir,
+        featureDir: req.featureDir,
+        featureId: req.featureId,
+        documents: docs.map((doc) => ({ rel: doc.rel, path: doc.path })),
+        ...(req.load === undefined ? {} : { load: req.load }),
+        ...(models === undefined ? {} : { models }),
+    });
+    return staged.kind === "unreadable" ? { kind: "unreadable", errors: staged.errors } : { kind: "read" };
+}
+/** A free name near the colliding one, so the fix is a rename the author can copy. */
+function suggest(rel) {
+    const name = basename(rel).replace(/\.likec4$/, "");
+    const dir = rel.slice(0, rel.length - basename(rel).length);
+    return `${dir}${name}-extend.likec4`;
+}
+//# sourceMappingURL=delta.js.map

package/dist/core/deployment/delta.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delta.js","sourceRoot":"","sources":["../../../src/core/deployment/delta.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAkB,MAAM,iBAAiB,CAAC;AAEjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AAE5D,OAAO,EAAc,MAAM,wBAAwB,CAAC;AAcpD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,UAAsB;IAC7D,OAAO,iBAAiB,CAAC,oBAAoB,CAAC,UAAU,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAgB,EAAE,GAAW;IAChE,OAAO,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,OAAgB,EAAE,UAAsB;IAClF,MAAM,IAAI,GAAG,MAAM,kBAAkB,CAAC,UAAU,CAAC,CAAC;IAClD,MAAM,MAAM,GAAY,EAAE,CAAC;IAC3B,8EAA8E;IAC9E,wEAAwE;IACxE,sEAAsE;IACtE,4EAA4E;IAC5E,qEAAqE;IACrE,6EAA6E;IAC7E,6BAA6B;IAC7B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,wBAAwB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACjD,IAAI,MAAM,KAAK,IAAI;YAAE,SAAS;QAC9B,MAAM,CAAC,IAAI,CAAC;YACV,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EAAE,GAAG,CAAC,GAAG;YAChB,OAAO,EACL,8BAA8B,GAAG,CAAC,GAAG,gCAAgC,GAAG,CAAC,GAAG,6BAA6B;gBACzG,GAAG,MAAM,kGAAkG;gBAC3G,0CAA0C;SAC7C,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAClB,IAAI;SACD,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,wBAAwB,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC;SAC3D,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,oBAAoB,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;SACnE,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACb,QAAQ,EAAE,OAAgB;QAC1B,IAAI,EAAE,uBAAgC;QACtC,OAAO,EAAE,GAAG,CAAC,GAAG;QAChB,OAAO,EACL,gBAAgB,GAAG,CAAC,GAAG,wFAAwF;YAC/G,mFAAmF;YACnF,qCAAqC,GAAG,CAAC,GAAG,0BAA0B,GAAG,CAAC,GAAG,iCAAiC;YAC9G,8EAA8E;YAC9E,6FAA6F;YAC7F,KAAK,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,mFAAmF;KAC3G,CAAC,CAAC,CACN,CAAC;AACJ,CAAC;AAkCD;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,GAA6B;IACxE,MAAM,IAAI,GAAG,MAAM,kBAAkB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACtD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC/C,wEAAwE;IACxE,uCAAuC;IACvC,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC;IACzE,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC;QACtC,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAChE,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;QACrD,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;KAC5C,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AACzG,CAAC;AAED,sFAAsF;AACtF,SAAS,OAAO,CAAC,GAAW;IAC1B,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IACpD,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IAC5D,OAAO,GAAG,GAAG,GAAG,IAAI,gBAAgB,CAAC;AACvC,CAAC","sourcesContent":["/**\n * A feature's own topology: `features/<FEAT>/deployment/<name>.likec4`.\n *\n * Until this slot existed a change that stood up a standby cluster had to be\n * written in two places at once — the requirement in the feature, the topology\n * edited straight into `architecture/` — because `delta.likec4` refuses a\n * `deployment { }` block and always will: that document re-declares the\n * landscape's own identifiers and carries its own `specification`, so it cannot\n * be staged beside the map in one LikeC4 project. A document that declares\n * NEITHER can, which is exactly why the use-case axis put its flows in files of\n * their own, and why this mirrors it rather than inventing a shape.\n *\n * WHAT MAKES IT WORK, and it was measured before the axis was written: LikeC4\n * `extend` resolves across documents of one project. A feature writes\n *\n *     deployment {\n *       extend eu {\n *         dcC = datacenter 'DC-C' { k8sC = cluster 'cluster-c' { … } }\n *       }\n *       eu.dcA.k8sA -> eu.dcC.k8sC 'async replication'\n *     }\n *\n * and the living region gains a datacenter with the living file untouched. So\n * the merge is a copy, not a splice, and `unarchive` needs nothing new — a\n * create is undone by deleting, which the snapshot manifest already records for\n * every write in the plan.\n *\n * CREATE-ONLY, for `core/usecases/delta/flows.ts`'s reasons rather than a\n * weaker version of them. A requirement delta merges INTO a living document and\n * two features editing one requirement would overwrite each other silently; a\n * topology document has no such algebra — the file is one block, the merge is a\n * whole-file copy, and there is nothing to merge partially. Rewriting a living\n * one through a feature would be a silent whole-file replacement with no pin to\n * collide on, where editing `architecture/<name>.likec4` directly in the same\n * pull request produces an ordinary git conflict a human resolves.\n *\n * ## Graded against the map its own merge would leave behind\n *\n * `ARCH-LOAM-FEATURE-CORPUS`, and this axis needs it more literally than the\n * use-case one does: a feature that stands a service up in a new cluster\n * declares that service in its `delta.likec4` and instances it here, so the\n * element the topology names exists ONLY post-merge. Read against the living\n * landscape it is unresolved, LikeC4 refuses the whole project, and loam would\n * report a hole against a file whose only fault is arriving with the change\n * that makes it true.\n *\n * The staging is `core/c4/project/staged.ts`, shared with the use-case slot\n * rather than copied — the two would have disagreed first about the merge\n * preview, which is the one thing both refusals rest on.\n */\nimport { existsSync } from \"node:fs\";\nimport { basename, join } from \"node:path\";\nimport { architectureDir } from \"../c4/project/architecture.js\";\nimport { stageMergedProject } from \"../c4/project/staged.js\";\nimport { type LoadedDoc } from \"../c4/likec4.js\";\nimport type { ExtendingModel } from \"../c4/splice/contract.js\";\nimport { relativeDocuments } from \"../c4/project/documents.js\";\nimport { featureDeploymentDir } from \"../repo/authored/paths.js\";\nimport { reservedArchitectureName } from \"../repo/paths.js\";\nimport type { DocsDir, FeatureDir } from \"../kernel/ids/dirs.js\";\nimport { type Issue } from \"../vocabulary/issue.js\";\n\n/** One topology document a feature carries. */\nexport interface FeatureDeployment {\n  /**\n   * The path INSIDE the feature's `deployment/` directory, `/`-separated — the\n   * id this axis has. Nesting is spelled by the tree, as it is for every other\n   * authored tree in the repo.\n   */\n  rel: string;\n  /** The absolute path of the authored file. */\n  path: string;\n}\n\n/**\n * The topology documents one feature carries, ordered by path.\n *\n * Zero readdirs when the feature has no `deployment/` directory, which is every\n * feature in a fleet that has not adopted the axis: `architectureDocuments`\n * answers an absent directory with an empty list rather than a throw. That\n * directory's existence is the whole per-feature opt-in.\n */\nexport async function featureDeployments(featureDir: FeatureDir): Promise<FeatureDeployment[]> {\n  return relativeDocuments(featureDeploymentDir(featureDir));\n}\n\n/**\n * The LIVING path a feature-local topology document addresses.\n *\n * Straight into `architecture/`, with no subdirectory of its own — unlike\n * `architecture/usecases/`, and the difference is the model rather than taste.\n * A `deployment { }` block is part of the fleet's ONE architecture project and\n * is read as such by every loader; filing it under a subdirectory would suggest\n * a second project, which is exactly the reading `subsystems.likec4` and\n * `landscape.likec4` already refuse by sitting at the top level together.\n *\n * `rel` is joined un-split, which `node:path` normalizes. What holds the join is\n * PROVENANCE: every `rel` here came out of an `architectureDocuments` walk, so\n * each component is a directory entry that exists. No caller takes one from argv.\n */\nexport function livingDeploymentPath(docsDir: DocsDir, rel: string): string {\n  return join(architectureDir(docsDir), rel);\n}\n\n/**\n * The two things that can go wrong about a topology document's NAME, before\n * anything about its contents is asked.\n *\n * `deployment.doc-reserved` — the name is one loam owns inside `architecture/`.\n * The merge writes straight into that directory, unlike a flow, which lands\n * under `usecases/`, so `<name>` is free to collide with the living map, either\n * of the two GENERATED views files (`subsystems.likec4` and `services.likec4`),\n * or the flow tree. `reservedArchitectureName` carries which and why. It is\n * asked FIRST and WITHOUT an existence test, because three of the four fail\n * silently when the target does not exist yet.\n *\n * `deployment.doc-exists` — a topology document this feature introduces that\n * the living `architecture/` already holds.\n *\n * An ERROR and never a warning-that-gates, for `usecase.flow-exists`'s reason:\n * there is no legal reading of it. The merge would replace an authored topology\n * wholesale, and no `--approve` makes that a different act than it is. Two\n * features introducing the same file is the case that makes it load-bearing\n * rather than pedantic — whichever archives first creates the living document,\n * and the second is told before it merges that its own file is the one to\n * delete.\n *\n * The collision is on the FILE, not on what is inside it. Two features may both\n * extend the same living region from two documents of their own and both\n * archive; that is the shape `extend` exists for, and refusing it would make the\n * slot useless for the fleet-wide change it was built for.\n */\nexport async function deploymentDeltaIssues(docsDir: DocsDir, featureDir: FeatureDir): Promise<Issue[]> {\n  const docs = await featureDeployments(featureDir);\n  const issues: Issue[] = [];\n  // The reservation runs FIRST and independently of existence, because three of\n  // the four names it refuses need not exist for the merge to be wrong. A\n  // topology copied over either GENERATED file — `subsystems.likec4` or\n  // `services.likec4` — is destroyed by the next `loam subsystem sync` and is\n  // invisible to every project load until then: the merge would report\n  // `created architecture/subsystems.likec4` and nothing downstream would ever\n  // say another word about it.\n  for (const doc of docs) {\n    const reason = reservedArchitectureName(doc.rel);\n    if (reason === null) continue;\n    issues.push({\n      severity: \"error\",\n      code: \"deployment.doc-reserved\",\n      subject: doc.rel,\n      message:\n        `features/<FEAT>/deployment/${doc.rel} would merge to architecture/${doc.rel}, and that name is loam's: ` +\n        `${reason}. Rename the feature's document — its name is yours to choose, and \\`extend\\` is how it adds to ` +\n        \"what a living document already declares.\",\n    });\n  }\n  return issues.concat(\n    docs\n      .filter((doc) => reservedArchitectureName(doc.rel) === null)\n      .filter((doc) => existsSync(livingDeploymentPath(docsDir, doc.rel)))\n      .map((doc) => ({\n        severity: \"error\" as const,\n        code: \"deployment.doc-exists\" as const,\n        subject: doc.rel,\n        message:\n          `architecture/${doc.rel} already exists, so this feature's topology would replace an authored one wholesale — ` +\n          \"a feature-local deployment document INTRODUCES topology, it does not rewrite it. \" +\n          `Delete features/<FEAT>/deployment/${doc.rel} and edit architecture/${doc.rel} directly in this same change, ` +\n          \"where git produces an ordinary conflict if somebody else is editing it too. \" +\n          `To ADD to what that file declares, write a document of another name that says \\`extend\\` — ` +\n          `\\`${suggest(doc.rel)}\\` — which is what lets two features grow one region without touching each other.`,\n      })),\n  );\n}\n\n/** What the caller needs to grade this feature's topology against the merge preview. */\nexport interface DeploymentOverlayRequest {\n  docsDir: DocsDir;\n  featureDir: FeatureDir;\n  /** The feature's id — the tag that selects the delta's own additions. */\n  featureId: string;\n  /**\n   * The caller's memoised LikeC4 read, when it has one. A FUNCTION rather than\n   * the `FleetContext` itself, for the reason the use-case overlay states: one\n   * memoised read does not justify an edge from this package to\n   * `core/fleet-context.ts`, and the edge would push it up a DAG level for\n   * nothing.\n   */\n  load?: (path: string) => Promise<LoadedDoc>;\n  /**\n   * The fleet's extending models, for the merge preview — the SAME list\n   * `loam archive` routes with. A preview computed without them holds interior\n   * the archive puts in `services/<…>/model.likec4`, so a topology document\n   * naming `<service-fqn>.<container>` reads clean here and against nothing\n   * once it is living; `deployment.doc-invalid` is the gate that then fails\n   * open (verification 2026-09-04, review F8).\n   *\n   * A THUNK for `load`'s reason and one more: the early return below is the\n   * axis's per-feature opt-in, and a feature with no `deployment/` directory\n   * must not pay a fleet enumeration to be told so.\n   */\n  models?: () => Promise<readonly ExtendingModel[]>;\n}\n\n/** Whether this feature's topology could be read at all, against the map its merge would leave. */\nexport type DeploymentOverlay = { kind: \"read\" } | { kind: \"unreadable\"; errors: string[] };\n\n/**\n * Parse this feature's topology documents over the post-merge map.\n *\n * A feature with no `deployment/` directory is `read` at the cost of one walk\n * over a directory that is not there — the axis's per-feature opt-in, and the\n * whole price a fleet that has not adopted it pays. Nothing is staged, nothing\n * is parsed, and no temp tree is made.\n *\n * The verdict is deliberately BINARY. The use-case overlay hands its caller the\n * views it read because the axis has questions about their content; this one\n * has none — a topology document is checked by being parseable against the map\n * the merge will write, and everything else about it is graded by\n * `loam validate --all` once it is living, exactly as the landscape is.\n */\nexport async function readFeatureDeployments(req: DeploymentOverlayRequest): Promise<DeploymentOverlay> {\n  const docs = await featureDeployments(req.featureDir);\n  if (docs.length === 0) return { kind: \"read\" };\n  // AFTER the early return: the fleet read is paid only by a feature that\n  // actually brings a topology document.\n  const models = req.models === undefined ? undefined : await req.models();\n  const staged = await stageMergedProject({\n    docsDir: req.docsDir,\n    featureDir: req.featureDir,\n    featureId: req.featureId,\n    documents: docs.map((doc) => ({ rel: doc.rel, path: doc.path })),\n    ...(req.load === undefined ? {} : { load: req.load }),\n    ...(models === undefined ? {} : { models }),\n  });\n  return staged.kind === \"unreadable\" ? { kind: \"unreadable\", errors: staged.errors } : { kind: \"read\" };\n}\n\n/** A free name near the colliding one, so the fix is a rename the author can copy. */\nfunction suggest(rel: string): string {\n  const name = basename(rel).replace(/\\.likec4$/, \"\");\n  const dir = rel.slice(0, rel.length - basename(rel).length);\n  return `${dir}${name}-extend.likec4`;\n}\n"]}

package/dist/core/deployment/objects.js

@@ -0,0 +1,145 @@
+/**
+ * The deployment axis: which objects on the fleet's TOPOLOGY carry a rule, and
+ * who owns each of them.
+ *
+ * A `#obl-` tag is a claim about the object it sits on, and the object's model
+ * is not a property any reader can see. Before this module the same undeclared
+ * tag was `obligation.unknown` on a container and SILENCE on a datacenter,
+ * because `validate/fleet/obligations.ts` walked the logical model only — the
+ * fail-open case where a rule an architect placed does not exist for any check,
+ * and a reviewer has no way to tell that from a rule that passed. This is the
+ * derivation that closes it (FEAT-1's ARCH-LOAM-DEPLOY-TAGGED).
+ *
+ * ## The `where` string is the `Covers:` line
+ *
+ * Every finding about a tagged object tells its reader to write
+ * `Covers: <where>`, so `where` is spelled as the grammar reads it —
+ * `node:eu.dcA`, `node:a.db -> node:b.db` — and never as a bare id. A message
+ * that names an object one way and asks for a line spelled another way sends
+ * the reader round the loop twice.
+ *
+ * ## Who owns a datacenter
+ *
+ * Nobody, and the answer is `undefined` rather than a guess. An INSTANCE is
+ * owned by the service its logical element belongs to, which is a real join
+ * through the landscape's own binding; an edge between two instances of one
+ * service is owned by that service; a region, a datacenter or a cluster is
+ * owned by whoever runs the platform, and loam has no such concept. The finding
+ * changes its sentence rather than naming a service that did not ask for the
+ * work — "write it in payment-service's arch.spec.md" is actionable, and
+ * "write it in <the wrong team>'s" is worse than no attribution at all.
+ *
+ * This package is one module today and gains its second with the feature-local
+ * `features/<FEAT>/deployment/` slot, which is the step of the axis that needs
+ * `repo` and `kernel`. Nothing here reads a path.
+ */
+import {} from "../c4/likec4.js";
+import {} from "../c4/parsed/deployment.js";
+import { serviceResolver } from "../c4/resolve/service.js";
+/**
+ * Every `#obl-` tag on the deployment model, one entry per (obligation, object)
+ * pair — the same shape, and the same bare-prefix tolerance, the logical walk
+ * has: a bare `#obl-` slugs to the empty string and is KEPT, because the prefix
+ * is the author's opt-in however little follows it, and dropping it would leave
+ * an object that asked to be graded silently ungraded.
+ */
+export function taggedDeployment(deployment, elements, known, prefix) {
+    const owner = instanceOwners(deployment, elements, known);
+    const out = [];
+    const push = (tags, rest) => {
+        for (const tag of tags.filter((t) => t.startsWith(prefix))) {
+            out.push({ obligation: tag.slice(prefix.length), ...rest });
+        }
+    };
+    // Nodes first, then instances, then edges — the order the model declares them
+    // in, so a fleet report reads top-down the way the document does.
+    for (const node of deployment.nodes)
+        push(node.tags, { where: `node:${node.id}`, id: node.id });
+    for (const instance of deployment.instances) {
+        const service = owner.get(instance.id);
+        push(instance.tags, {
+            where: `node:${instance.id}`,
+            id: instance.id,
+            ...(service === undefined ? {} : { service }),
+        });
+    }
+    for (const edge of deployment.relationships) {
+        // An edge is owned only when BOTH ends agree. A replication edge between
+        // two instances of one service belongs to that service; one crossing
+        // services belongs to neither, and picking the target — the rule the
+        // logical walk uses, where the arrow means "calls" — says nothing here,
+        // because a deployment edge is as often symmetric as directed.
+        const from = owner.get(edge.source);
+        const to = owner.get(edge.target);
+        const service = from !== undefined && from === to ? from : undefined;
+        push(edge.tags, {
+            where: `node:${edge.source} -> node:${edge.target}`,
+            edge,
+            ...(service === undefined ? {} : { service }),
+        });
+    }
+    return out;
+}
+/**
+ * The topology one service is part of.
+ *
+ * Built for the CONTEXT PACK, which is the surface whose reader is an agent
+ * about to write the implementation. Before this, that pack described a
+ * service's calls and contracts and said nothing whatever about where it runs —
+ * so a failover was implemented against a map nobody had read, which is the
+ * gap FEAT-1's ARCH-LOAM-DEPLOY-UNCHECKED names alongside the sentence about
+ * what a green axis does not mean.
+ *
+ * BOTH ENDS, not only the outbound one. A replication edge is as often read
+ * from the standby's side as from the primary's, and a pack that showed only
+ * what this service points at would hide the stream it receives.
+ */
+export function serviceTopology(deployment, elements, known, service) {
+    const owner = instanceOwners(deployment, elements, known);
+    const mine = deployment.instances.filter((i) => owner.get(i.id) === service);
+    const ids = new Set(mine.map((i) => i.id));
+    return {
+        instances: mine.map((i) => ({ id: i.id, element: i.element })),
+        edges: deployment.relationships
+            .filter((r) => ids.has(r.source) || ids.has(r.target))
+            .map((r) => ({ source: r.source, target: r.target, ...(r.title === undefined ? {} : { title: r.title }) })),
+    };
+}
+/**
+ * instance id → the service its logical element belongs to.
+ *
+ * Through `serviceResolver` and NOT `elementService`, and the difference is a
+ * defect this axis shipped once. A deployment instances a CONTAINER far more
+ * often than a whole system — `instanceOf orders.cache` is the ordinary way to
+ * say where the Redis a service owns actually runs — and `elementService` reads
+ * the binding or the TITLE of the element handed to it. A nested container
+ * carries no `metadata { service }` of its own, so that read answered "order
+ * cache", and `obligation.uncovered` told an author to write the requirement in
+ * "order cache's arch.spec.md" — a service that has never existed. The
+ * resolver's whole job is the ancestor walk that finds the bound system above
+ * it, which is the same join every other check makes about a container.
+ *
+ * `known` rides in for the reason `coversEdge` takes it: without the enumerated
+ * fleet the resolver's second tier — the nearest ancestor whose title names a
+ * real `services/<id>/` — cannot run, and a fleet that binds by title rather
+ * than by `metadata { service }` resolves to the title alone. It must be the
+ * SAME set the caller's own findings resolve with, or the message names one
+ * service and the check counts another.
+ *
+ * An instance of an element the landscape does not declare is left UNOWNED
+ * rather than filed under a fabricated name. LikeC4 refuses an unresolved
+ * `instanceOf` outright, so that state is reachable only when the caller hands
+ * in elements from a narrower document than the one the topology was parsed
+ * with.
+ */
+function instanceOwners(deployment, elements, known) {
+    const ids = new Set(elements.map((e) => e.id));
+    const resolve = serviceResolver([...elements], known);
+    const out = new Map();
+    for (const instance of deployment.instances) {
+        if (ids.has(instance.element))
+            out.set(instance.id, resolve(instance.element));
+    }
+    return out;
+}
+//# sourceMappingURL=objects.js.map

package/dist/core/deployment/objects.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"objects.js","sourceRoot":"","sources":["../../../src/core/deployment/objects.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,OAAO,EAAa,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAwC,MAAM,4BAA4B,CAAC;AAClF,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAmB3D;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAC9B,UAA2B,EAC3B,QAAyB,EACzB,KAA0B,EAC1B,MAAc;IAEd,MAAM,KAAK,GAAG,cAAc,CAAC,UAAU,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAuB,EAAE,CAAC;IACnC,MAAM,IAAI,GAAG,CAAC,IAAuB,EAAE,IAA0C,EAAQ,EAAE;QACzF,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YAC3D,GAAG,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC,CAAC;IAEF,8EAA8E;IAC9E,kEAAkE;IAClE,KAAK,MAAM,IAAI,IAAI,UAAU,CAAC,KAAK;QAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;IAChG,KAAK,MAAM,QAAQ,IAAI,UAAU,CAAC,SAAS,EAAE,CAAC;QAC5C,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACvC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE;YAClB,KAAK,EAAE,QAAQ,QAAQ,CAAC,EAAE,EAAE;YAC5B,EAAE,EAAE,QAAQ,CAAC,EAAE;YACf,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;SAC9C,CAAC,CAAC;IACL,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,UAAU,CAAC,aAAa,EAAE,CAAC;QAC5C,yEAAyE;QACzE,qEAAqE;QACrE,qEAAqE;QACrE,wEAAwE;QACxE,+DAA+D;QAC/D,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpC,MAAM,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAClC,MAAM,OAAO,GAAG,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QACrE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;YACd,KAAK,EAAE,QAAQ,IAAI,CAAC,MAAM,YAAY,IAAI,CAAC,MAAM,EAAE;YACnD,IAAI;YACJ,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;SAC9C,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAUD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,eAAe,CAC7B,UAA2B,EAC3B,QAAyB,EACzB,KAA0B,EAC1B,OAAe;IAEf,MAAM,KAAK,GAAG,cAAc,CAAC,UAAU,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC1D,MAAM,IAAI,GAAG,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,OAAO,CAAC,CAAC;IAC7E,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3C,OAAO;QACL,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QAC9D,KAAK,EAAE,UAAU,CAAC,aAAa;aAC5B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;aACrD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;KAC9G,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,SAAS,cAAc,CACrB,UAA2B,EAC3B,QAAyB,EACzB,KAA0B;IAE1B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/C,MAAM,OAAO,GAAG,eAAe,CAAC,CAAC,GAAG,QAAQ,CAAC,EAAE,KAAK,CAAC,CAAC;IACtD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC;IACtC,KAAK,MAAM,QAAQ,IAAI,UAAU,CAAC,SAAS,EAAE,CAAC;QAC5C,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC","sourcesContent":["/**\n * The deployment axis: which objects on the fleet's TOPOLOGY carry a rule, and\n * who owns each of them.\n *\n * A `#obl-` tag is a claim about the object it sits on, and the object's model\n * is not a property any reader can see. Before this module the same undeclared\n * tag was `obligation.unknown` on a container and SILENCE on a datacenter,\n * because `validate/fleet/obligations.ts` walked the logical model only — the\n * fail-open case where a rule an architect placed does not exist for any check,\n * and a reviewer has no way to tell that from a rule that passed. This is the\n * derivation that closes it (FEAT-1's ARCH-LOAM-DEPLOY-TAGGED).\n *\n * ## The `where` string is the `Covers:` line\n *\n * Every finding about a tagged object tells its reader to write\n * `Covers: <where>`, so `where` is spelled as the grammar reads it —\n * `node:eu.dcA`, `node:a.db -> node:b.db` — and never as a bare id. A message\n * that names an object one way and asks for a line spelled another way sends\n * the reader round the loop twice.\n *\n * ## Who owns a datacenter\n *\n * Nobody, and the answer is `undefined` rather than a guess. An INSTANCE is\n * owned by the service its logical element belongs to, which is a real join\n * through the landscape's own binding; an edge between two instances of one\n * service is owned by that service; a region, a datacenter or a cluster is\n * owned by whoever runs the platform, and loam has no such concept. The finding\n * changes its sentence rather than naming a service that did not ask for the\n * work — \"write it in payment-service's arch.spec.md\" is actionable, and\n * \"write it in <the wrong team>'s\" is worse than no attribution at all.\n *\n * This package is one module today and gains its second with the feature-local\n * `features/<FEAT>/deployment/` slot, which is the step of the axis that needs\n * `repo` and `kernel`. Nothing here reads a path.\n */\nimport { type Elem } from \"../c4/likec4.js\";\nimport { type DeploymentModel, type DeployRel } from \"../c4/parsed/deployment.js\";\nimport { serviceResolver } from \"../c4/resolve/service.js\";\n\n/** One deployment object carrying one obligation tag. */\nexport interface TaggedDeployment {\n  /** The obligation id — the tag suffix, exactly as the logical walk reads it. */\n  obligation: string;\n  /**\n   * How a `Covers:` line names this object, and how every message spells it:\n   * `node:<id>` for a node or an instance, `node:<a> -> node:<b>` for an edge.\n   */\n  where: string;\n  /** The service that owns it, where the topology says. Absent for a node nobody's service runs. */\n  service?: string;\n  /** The edge, when this object is one — the caller matches `Covers:` against it. */\n  edge?: DeployRel;\n  /** The node or instance id, when this object is one. */\n  id?: string;\n}\n\n/**\n * Every `#obl-` tag on the deployment model, one entry per (obligation, object)\n * pair — the same shape, and the same bare-prefix tolerance, the logical walk\n * has: a bare `#obl-` slugs to the empty string and is KEPT, because the prefix\n * is the author's opt-in however little follows it, and dropping it would leave\n * an object that asked to be graded silently ungraded.\n */\nexport function taggedDeployment(\n  deployment: DeploymentModel,\n  elements: readonly Elem[],\n  known: ReadonlySet<string>,\n  prefix: string,\n): TaggedDeployment[] {\n  const owner = instanceOwners(deployment, elements, known);\n  const out: TaggedDeployment[] = [];\n  const push = (tags: readonly string[], rest: Omit<TaggedDeployment, \"obligation\">): void => {\n    for (const tag of tags.filter((t) => t.startsWith(prefix))) {\n      out.push({ obligation: tag.slice(prefix.length), ...rest });\n    }\n  };\n\n  // Nodes first, then instances, then edges — the order the model declares them\n  // in, so a fleet report reads top-down the way the document does.\n  for (const node of deployment.nodes) push(node.tags, { where: `node:${node.id}`, id: node.id });\n  for (const instance of deployment.instances) {\n    const service = owner.get(instance.id);\n    push(instance.tags, {\n      where: `node:${instance.id}`,\n      id: instance.id,\n      ...(service === undefined ? {} : { service }),\n    });\n  }\n  for (const edge of deployment.relationships) {\n    // An edge is owned only when BOTH ends agree. A replication edge between\n    // two instances of one service belongs to that service; one crossing\n    // services belongs to neither, and picking the target — the rule the\n    // logical walk uses, where the arrow means \"calls\" — says nothing here,\n    // because a deployment edge is as often symmetric as directed.\n    const from = owner.get(edge.source);\n    const to = owner.get(edge.target);\n    const service = from !== undefined && from === to ? from : undefined;\n    push(edge.tags, {\n      where: `node:${edge.source} -> node:${edge.target}`,\n      edge,\n      ...(service === undefined ? {} : { service }),\n    });\n  }\n  return out;\n}\n\n/** Where one service runs, and what its instances talk to across the topology. */\nexport interface ServiceTopology {\n  /** This service's instances: the deployment id, and the element each one deploys. */\n  instances: Array<{ id: string; element: string }>;\n  /** Deployment edges with at least one end among them — replication, failover, a network hop. */\n  edges: Array<{ source: string; target: string; title?: string }>;\n}\n\n/**\n * The topology one service is part of.\n *\n * Built for the CONTEXT PACK, which is the surface whose reader is an agent\n * about to write the implementation. Before this, that pack described a\n * service's calls and contracts and said nothing whatever about where it runs —\n * so a failover was implemented against a map nobody had read, which is the\n * gap FEAT-1's ARCH-LOAM-DEPLOY-UNCHECKED names alongside the sentence about\n * what a green axis does not mean.\n *\n * BOTH ENDS, not only the outbound one. A replication edge is as often read\n * from the standby's side as from the primary's, and a pack that showed only\n * what this service points at would hide the stream it receives.\n */\nexport function serviceTopology(\n  deployment: DeploymentModel,\n  elements: readonly Elem[],\n  known: ReadonlySet<string>,\n  service: string,\n): ServiceTopology {\n  const owner = instanceOwners(deployment, elements, known);\n  const mine = deployment.instances.filter((i) => owner.get(i.id) === service);\n  const ids = new Set(mine.map((i) => i.id));\n  return {\n    instances: mine.map((i) => ({ id: i.id, element: i.element })),\n    edges: deployment.relationships\n      .filter((r) => ids.has(r.source) || ids.has(r.target))\n      .map((r) => ({ source: r.source, target: r.target, ...(r.title === undefined ? {} : { title: r.title }) })),\n  };\n}\n\n/**\n * instance id → the service its logical element belongs to.\n *\n * Through `serviceResolver` and NOT `elementService`, and the difference is a\n * defect this axis shipped once. A deployment instances a CONTAINER far more\n * often than a whole system — `instanceOf orders.cache` is the ordinary way to\n * say where the Redis a service owns actually runs — and `elementService` reads\n * the binding or the TITLE of the element handed to it. A nested container\n * carries no `metadata { service }` of its own, so that read answered \"order\n * cache\", and `obligation.uncovered` told an author to write the requirement in\n * \"order cache's arch.spec.md\" — a service that has never existed. The\n * resolver's whole job is the ancestor walk that finds the bound system above\n * it, which is the same join every other check makes about a container.\n *\n * `known` rides in for the reason `coversEdge` takes it: without the enumerated\n * fleet the resolver's second tier — the nearest ancestor whose title names a\n * real `services/<id>/` — cannot run, and a fleet that binds by title rather\n * than by `metadata { service }` resolves to the title alone. It must be the\n * SAME set the caller's own findings resolve with, or the message names one\n * service and the check counts another.\n *\n * An instance of an element the landscape does not declare is left UNOWNED\n * rather than filed under a fabricated name. LikeC4 refuses an unresolved\n * `instanceOf` outright, so that state is reachable only when the caller hands\n * in elements from a narrower document than the one the topology was parsed\n * with.\n */\nfunction instanceOwners(\n  deployment: DeploymentModel,\n  elements: readonly Elem[],\n  known: ReadonlySet<string>,\n): Map<string, string> {\n  const ids = new Set(elements.map((e) => e.id));\n  const resolve = serviceResolver([...elements], known);\n  const out = new Map<string, string>();\n  for (const instance of deployment.instances) {\n    if (ids.has(instance.element)) out.set(instance.id, resolve(instance.element));\n  }\n  return out;\n}\n"]}