@ybotok/loam 0.2.0-alpha.5 → 0.2.0-alpha.6

package/dist/core/brief/checks.js.map

@@ -1 +1 @@
-{"version":3,"file":"checks.js","sourceRoot":"","sources":["../../../src/core/brief/checks.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,wEAAwE;AACxE,yEAAyE;AACzE,wEAAwE;AAExE;;;GAGG;AACH,MAAM,WAAW,GAAG,8BAA8B,CAAC;AACnD,MAAM,CAAC,MAAM,OAAO,GAAG,qBAAqB,CAAC;AAc7C,2GAA2G;AAC3G,MAAM,CAAC,MAAM,eAAe,GAAiB;IAC3C,EAAE,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,yDAAyD,EAAE;IAClI,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,uCAAuC,EAAE;IAC1G;QACE,IAAI,EAAE,gCAAgC;QACtC,QAAQ,EAAE,OAAO;QACjB,GAAG,EAAE,WAAW;QAChB,IAAI,EAAE,kEAAkE;KACzE;IACD;QACE,IAAI,EAAE,4BAA4B;QAClC,QAAQ,EAAE,OAAO;QACjB,GAAG,EAAE,WAAW;QAChB,IAAI,EAAE,wJAAwJ;KAC/J;IACD;QACE,IAAI,EAAE,6BAA6B;QACnC,QAAQ,EAAE,OAAO;QACjB,GAAG,EAAE,WAAW;QAChB,IAAI,EAAE,6HAA6H;KACpI;IACD;QACE,IAAI,EAAE,8BAA8B;QACpC,QAAQ,EAAE,OAAO;QACjB,GAAG,EAAE,WAAW;QAChB,IAAI,EAAE,4FAA4F;KACnG;IACD;QACE,IAAI,EAAE,+BAA+B;QACrC,QAAQ,EAAE,OAAO;QACjB,GAAG,EAAE,WAAW;QAChB,IAAI,EAAE,2FAA2F;KAClG;IACD,qEAAqE;IACrE,wEAAwE;IACxE,4EAA4E;IAC5E,yCAAyC;IACzC;QACE,IAAI,EAAE,0BAA0B;QAChC,QAAQ,EAAE,MAAM;QAChB,GAAG,EAAE,WAAW;QAChB,IAAI,EAAE,+JAA+J;KACtK;IACD;QACE,IAAI,EAAE,sBAAsB;QAC5B,QAAQ,EAAE,MAAM;QAChB,GAAG,EAAE,WAAW;QAChB,IAAI,EAAE,8HAA8H;KACrI;IACD,8EAA8E;IAC9E,wEAAwE;IACxE,uEAAuE;IACvE;QACE,IAAI,EAAE,iBAAiB;QACvB,QAAQ,EAAE,MAAM;QAChB,GAAG,EAAE,WAAW;QAChB,IAAI,EAAE,0HAA0H;KACjI;IACD;QACE,4EAA4E;QAC5E,0EAA0E;QAC1E,2EAA2E;QAC3E,yEAAyE;QACzE,4EAA4E;QAC5E,sCAAsC;QACtC,IAAI,EAAE,oBAAoB;QAC1B,QAAQ,EAAE,MAAM;QAChB,GAAG,EAAE,WAAW;QAChB,IAAI,EAAE,kQAAkQ;KACzQ;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,QAAQ,EAAE,OAAO;QACjB,GAAG,EAAE,WAAW;QAChB,IAAI,EAAE,kKAAkK;KACzK;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,MAAM;QAChB,GAAG,EAAE,WAAW;QAChB,IAAI,EAAE,+EAA+E;KACtF;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,QAAQ,EAAE,MAAM;QAChB,GAAG,EAAE,WAAW;QAChB,IAAI,EAAE,gJAAgJ;KACvJ;IACD,2EAA2E;IAC3E,2EAA2E;IAC3E,uEAAuE;IACvE,sBAAsB;IACtB;QACE,IAAI,EAAE,uBAAuB;QAC7B,QAAQ,EAAE,OAAO;QACjB,GAAG,EAAE,WAAW;QAChB,IAAI,EAAE,mKAAmK;KAC1K;IACD;QACE,IAAI,EAAE,sBAAsB;QAC5B,QAAQ,EAAE,MAAM;QAChB,GAAG,EAAE,WAAW;QAChB,IAAI,EAAE,sIAAsI;KAC7I;IACD,2EAA2E;IAC3E,iEAAiE;IACjE,uEAAuE;IACvE,2EAA2E;IAC3E,sCAAsC;IACtC;QACE,IAAI,EAAE,4BAA4B;QAClC,QAAQ,EAAE,MAAM;QAChB,GAAG,EAAE,WAAW;QAChB,IAAI,EAAE,sJAAsJ;KAC7J;IACD;QACE,IAAI,EAAE,oBAAoB;QAC1B,QAAQ,EAAE,OAAO;QACjB,GAAG,EAAE,WAAW;QAChB,IAAI,EAAE,6HAA6H;KACpI;IACD;QACE,IAAI,EAAE,uBAAuB;QAC7B,QAAQ,EAAE,MAAM;QAChB,GAAG,EAAE,WAAW;QAChB,IAAI,EAAE,sEAAsE;KAC7E;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,QAAQ,EAAE,MAAM;QAChB,GAAG,EAAE,WAAW;QAChB,IAAI,EAAE,uIAAuI;KAC9I;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,MAAM;QAChB,GAAG,EAAE,WAAW;QAChB,IAAI,EAAE,2IAA2I;KAClJ;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,MAAM;QAChB,GAAG,EAAE,WAAW;QAChB,IAAI,EAAE,iMAAiM;KACxM;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,QAAQ,EAAE,MAAM;QAChB,GAAG,EAAE,WAAW;QAChB,IAAI,EAAE,+JAA+J;KACtK;IACD;QACE,IAAI,EAAE,8BAA8B;QACpC,QAAQ,EAAE,MAAM;QAChB,GAAG,EAAE,WAAW;QAChB,IAAI,EAAE,oSAAoS;KAC3S;IACD;QACE,IAAI,EAAE,uBAAuB;QAC7B,QAAQ,EAAE,OAAO;QACjB,GAAG,EAAE,WAAW;QAChB,IAAI,EAAE,uJAAuJ;KAC9J;IACD;QACE,IAAI,EAAE,4BAA4B;QAClC,QAAQ,EAAE,OAAO;QACjB,GAAG,EAAE,WAAW;QAChB,IAAI,EAAE,2EAA2E;KAClF;IACD;QACE,IAAI,EAAE,4BAA4B;QAClC,QAAQ,EAAE,OAAO;QACjB,GAAG,EAAE,WAAW;QAChB,IAAI,EAAE,iFAAiF;KACxF;IACD,EAAE,IAAI,EAAE,2BAA2B,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,mCAAmC,EAAE;IACpH,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,4BAA4B,EAAE;IAClG;QACE,IAAI,EAAE,sBAAsB;QAC5B,QAAQ,EAAE,OAAO;QACjB,GAAG,EAAE,WAAW;QAChB,IAAI,EAAE,+HAA+H;KACtI;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,QAAQ,EAAE,MAAM;QAChB,GAAG,EAAE,WAAW;QAChB,IAAI,EAAE,0HAA0H;KACjI;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,QAAQ,EAAE,MAAM;QAChB,GAAG,EAAE,WAAW;QAChB,IAAI,EAAE,6WAA6W;KACpX;IACD,4EAA4E;IAC5E,8EAA8E;IAC9E,+EAA+E;IAC/E,2EAA2E;IAC3E,uEAAuE;IACvE,kEAAkE;IAClE;QACE,IAAI,EAAE,8BAA8B;QACpC,QAAQ,EAAE,OAAO;QACjB,GAAG,EAAE,OAAO;QACZ,IAAI,EAAE,0LAA0L;KACjM;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,QAAQ,EAAE,OAAO;QACjB,GAAG,EAAE,OAAO;QACZ,IAAI,EAAE,yNAAyN;KAChO;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,QAAQ,EAAE,OAAO;QACjB,GAAG,EAAE,OAAO;QACZ,IAAI,EAAE,kJAAkJ;KACzJ;IACD;QACE,IAAI,EAAE,2BAA2B;QACjC,QAAQ,EAAE,OAAO;QACjB,GAAG,EAAE,OAAO;QACZ,IAAI,EAAE,yIAAyI;KAChJ;IACD;QACE,IAAI,EAAE,6BAA6B;QACnC,QAAQ,EAAE,MAAM;QAChB,GAAG,EAAE,OAAO;QACZ,IAAI,EAAE,6LAA6L;KACpM;IACD,yEAAyE;IACzE,sEAAsE;IACtE,2EAA2E;IAC3E;QACE,IAAI,EAAE,+BAA+B;QACrC,QAAQ,EAAE,MAAM;QAChB,GAAG,EAAE,OAAO;QACZ,IAAI,EAAE,wNAAwN;KAC/N;CACF,CAAC","sourcesContent":["/**\n * The checks half of the adoption brief: every check `loam validate` will run\n * against a baseline, each naming the invocation that surfaces it. Its\n * counterpart — the UNCHECKED list, the checks that do not exist — lives in\n * unchecked.ts: honesty no validator will ever supply, and an agent that does\n * not know where the checking stops will assume it never does.\n */\n\n/* ------------------------------------------------------------------ */\n/* The checks                                                          */\n/* ------------------------------------------------------------------ */\n\n/**\n * The two invocations a baseline meets. `<id>` is a placeholder for the service\n * id — the JSON contract keeps it symbolic, the text renderer substitutes it.\n */\nconst VIA_SERVICE = \"loam validate --service <id>\";\nexport const VIA_ALL = \"loam validate --all\";\n\nexport interface BriefCheck {\n  code: string;\n  severity: \"error\" | \"warn\";\n  /**\n   * The invocation that surfaces this check. Most run under `--service`, but\n   * the fleet cross-check does not — attributing it there taught agents to\n   * expect a finding that run never reports.\n   */\n  via: typeof VIA_SERVICE | typeof VIA_ALL;\n  what: string;\n}\n\n/** What `loam validate` will run against the result — each check names the invocation that surfaces it. */\nexport const VALIDATE_CHECKS: BriefCheck[] = [\n  { code: \"service.no-model\", severity: \"error\", via: VIA_SERVICE, what: \"there is no model.likec4 — every other check stops here\" },\n  { code: \"c4.invalid\", severity: \"error\", via: VIA_SERVICE, what: \"model.likec4 does not parse as LikeC4\" },\n  {\n    code: \"requirements.missing-scenarios\",\n    severity: \"error\",\n    via: VIA_SERVICE,\n    what: \"a requirement in spec.md or arch.spec.md has no `#### Scenario:`\",\n  },\n  {\n    code: \"spec.duplicate-requirement\",\n    severity: \"error\",\n    via: VIA_SERVICE,\n    what: \"one `### Requirement:` name defined twice in one living spec.md or arch.spec.md — a later merge edits only the first, the rest live on as stale copies\",\n  },\n  {\n    code: \"spec.requirement-id-invalid\",\n    severity: \"error\",\n    via: VIA_SERVICE,\n    what: \"an optional `Requirement-ID:` violates `[A-Za-z][A-Za-z0-9._-]{0,127}` — stable identities must be portable and unambiguous\",\n  },\n  {\n    code: \"spec.requirement-id-repeated\",\n    severity: \"error\",\n    via: VIA_SERVICE,\n    what: \"one requirement declares `Requirement-ID:` more than once — keep exactly one identity line\",\n  },\n  {\n    code: \"spec.requirement-id-duplicate\",\n    severity: \"error\",\n    via: VIA_SERVICE,\n    what: \"one stable Requirement-ID identifies multiple requirements in one spec.md or arch.spec.md\",\n  },\n  // The keep-last pair: a second `Operations:` / `Covers:` line in one\n  // requirement body REPLACES the first — assignment, not append — so the\n  // author's two-line list silently loses its first line. The semantics stay;\n  // the loss no longer happens in silence.\n  {\n    code: \"spec.repeated-operations\",\n    severity: \"warn\",\n    via: VIA_SERVICE,\n    what: \"a second `Operations:` line in one requirement body — the last replaces the earlier ones, whose list is silently dropped; merge into one comma-separated line\",\n  },\n  {\n    code: \"spec.repeated-covers\",\n    severity: \"warn\",\n    via: VIA_SERVICE,\n    what: \"a second `Covers:` line in one requirement body — same keep-last rule, same silent loss; merge into one comma-separated line\",\n  },\n  // The graded absences: the brief marks spec.md and openapi.yaml required, and\n  // validate agrees they belong — as warns, because partial adoption is a\n  // supported state and these are its honest progress meter, not a gate.\n  {\n    code: \"service.no-spec\",\n    severity: \"warn\",\n    via: VIA_SERVICE,\n    what: \"spec.md does not exist yet — legal mid-adoption, but requirement coverage and API governance are unchecked until it does\",\n  },\n  {\n    // `warn` is the floor, not the whole story, and the difference matters to a\n    // baseline: the absence is graded an ERROR once something already written\n    // down joins into the file — a living requirement's `Operations:` line, or\n    // an op-linked landscape edge (`landscape.expects`, landscape.ts). For a\n    // service the fleet already calls, `required: true` on this target and this\n    // row are the same fact stated twice.\n    code: \"service.no-openapi\",\n    severity: \"warn\",\n    via: VIA_SERVICE,\n    what: \"openapi.yaml does not exist yet — quiet only when the landscape proves no other service calls an operation on this one, and an ERROR rather than a warning once a living `Operations:` line or a landscape edge already names an operation it would have defined\",\n  },\n  {\n    code: \"openapi.invalid\",\n    severity: \"error\",\n    via: VIA_SERVICE,\n    what: \"openapi.yaml exists but does not parse — an unreadable contract proves nothing, so the `api.*` checks and the spine's op resolution are suspended until it reads\",\n  },\n  {\n    code: \"api.ungoverned\",\n    severity: \"warn\",\n    via: VIA_SERVICE,\n    what: \"an operationId in openapi.yaml that no requirement's `Operations:` line names\",\n  },\n  {\n    code: \"api.ops-unlinked\",\n    severity: \"warn\",\n    via: VIA_SERVICE,\n    what: \"openapi.yaml defines operations and spec.md has requirements, but no `Operations:` line joins them — every cross-axis check is vacuously green\",\n  },\n  // The `Operations:` spine, checked against the LIVING contract. It used to\n  // fire only inside a feature delta, so a baseline could ship a requirement\n  // governing an operation nobody defines and stay green until the first\n  // feature touched it.\n  {\n    code: \"spec-api.op-undefined\",\n    severity: \"error\",\n    via: VIA_SERVICE,\n    what: \"a living requirement's `Operations:` line names an operationId this service's openapi.yaml does not define — the two axes disagree about what the service exposes\",\n  },\n  {\n    code: \"spec.no-requirements\",\n    severity: \"warn\",\n    via: VIA_SERVICE,\n    what: \"spec.md exists but holds no `### Requirement:` block at all — every requirement-driven check below it is vacuous rather than passing\",\n  },\n  // The deprecation pair fires on a fresh baseline too — a legacy service is\n  // exactly where ops marked `deprecated: true` coexist with their\n  // replacements, and documenting that lifecycle honestly is part of the\n  // adoption. Mark the flag where the code retires an op; loam reads it, and\n  // has no removal semantics beyond it.\n  {\n    code: \"api.requirement-deprecated\",\n    severity: \"warn\",\n    via: VIA_SERVICE,\n    what: \"a requirement whose `Operations:` list resolves only to operations openapi.yaml marks `deprecated: true` — the behaviour it governs is being retired\",\n  },\n  {\n    code: \"spine.op-undefined\",\n    severity: \"error\",\n    via: VIA_SERVICE,\n    what: \"a landscape edge into this service calls an operation its openapi.yaml does not define — a broken contract between services\",\n  },\n  {\n    code: \"spine.op-link-missing\",\n    severity: \"warn\",\n    via: VIA_SERVICE,\n    what: 'a landscape \"Calls\" edge into this service with no `metadata { op }`',\n  },\n  {\n    code: \"spine.op-deprecated\",\n    severity: \"warn\",\n    via: VIA_SERVICE,\n    what: \"a landscape edge into this service calls an operation openapi.yaml marks `deprecated: true` — the consumer should be migrating off it\",\n  },\n  {\n    code: \"covers.unknown\",\n    severity: \"warn\",\n    via: VIA_SERVICE,\n    what: \"a `Covers:` entry in arch.spec.md that resolves to no element, edge, alert or SLI — a typo silently costs the coverage it was written for\",\n  },\n  {\n    code: \"health.invalid\",\n    severity: \"warn\",\n    via: VIA_SERVICE,\n    what: \"health.yaml exists but does not parse — its alert/SLI ids are unreadable, so `Covers: alert:/sli:` entries and health coverage go unchecked until it reads (a missing health.yaml stays silent)\",\n  },\n  {\n    code: \"health.uncovered\",\n    severity: \"warn\",\n    via: VIA_SERVICE,\n    what: \"an alert or SLI declared in health.yaml that no arch.spec.md requirement covers — expected until the arch spec is written; each one is a signal nothing tests\",\n  },\n  {\n    code: \"health.dependency-unmodelled\",\n    severity: \"warn\",\n    via: VIA_SERVICE,\n    what: \"a health.yaml `dependencies:` id that nothing in this service's OWN model.likec4 answers to (element id, `metadata { service }` binding, or title) — the model carries everything the service touches, private stores included as nested containers, and the on-call file must name the same world\",\n  },\n  {\n    code: \"frontmatter.malformed\",\n    severity: \"error\",\n    via: VIA_SERVICE,\n    what: \"the frontmatter block does not parse as YAML — owner, status and sources are unreadable, and the field checks are suspended until the header is fixed\",\n  },\n  {\n    code: \"frontmatter.field-mismatch\",\n    severity: \"error\",\n    via: VIA_SERVICE,\n    what: \"spec.md declares a different `service:` than the directory it lives under\",\n  },\n  {\n    code: \"frontmatter.status-unknown\",\n    severity: \"error\",\n    via: VIA_SERVICE,\n    what: \"a status outside `draft` / `verified` — a typo here reads as unverified forever\",\n  },\n  { code: \"frontmatter.field-missing\", severity: \"warn\", via: VIA_SERVICE, what: \"no `owner`, `status` or `service`\" },\n  { code: \"sources.absent\", severity: \"warn\", via: VIA_SERVICE, what: \"spec.md names no `sources`\" },\n  {\n    code: \"sources.path-missing\",\n    severity: \"error\",\n    via: VIA_SERVICE,\n    what: \"a listed source does not exist, or is a glob pattern — no longer supported (checked when loam runs inside the service's repo)\",\n  },\n  {\n    code: \"sources.unvouched\",\n    severity: \"warn\",\n    via: VIA_SERVICE,\n    what: \"`sources` with no digest — nobody has vouched for the document yet. Expected on a fresh baseline; only a human closes it\",\n  },\n  {\n    code: \"sources.unwalked\",\n    severity: \"warn\",\n    via: VIA_SERVICE,\n    what: \"`sources` leaves whole top-level paths of the service repo untouched — the finding names them (checked when loam runs inside the service's repo, against the files git tracks). It grades the WALK, not the writing: the only completeness signal loam can compute, because it is the only one that compares the document against the repository rather than against itself\",\n  },\n  // sources.stale, sources.current and content.stale are deliberately absent:\n  // all three compare against digests `loam vouch` stamps, and a fresh baseline\n  // has no stamp to compare — the table lists what a baseline can actually meet.\n  // The gherkin.* staleness chain is absent the same way: it fires only once\n  // `loam gherkin` has generated a suite under <gherkinDir>/loam/ in the\n  // service's own repo, and a fresh baseline has not generated one.\n  {\n    code: \"landscape.service-unmodelled\",\n    severity: \"error\",\n    via: VIA_ALL,\n    what: \"nothing in architecture/landscape.likec4 resolves to services/<id>/ — the fleet map is incomplete until an element exists or an existing one is bound with `metadata { service '<id>' }`\",\n  },\n  {\n    code: \"landscape.missing\",\n    severity: \"error\",\n    via: VIA_ALL,\n    what: \"architecture/landscape.likec4 does not exist at all — an error as soon as services/ holds one service (a warning only in an empty docs repo): with no fleet map, every cross-service check is blind rather than passing\",\n  },\n  {\n    code: \"landscape.invalid\",\n    severity: \"error\",\n    via: VIA_ALL,\n    what: \"architecture/landscape.likec4 exists but does not parse — fix it before anything else; the whole cross-service layer is unchecked until it reads\",\n  },\n  {\n    code: \"landscape.binding-unknown\",\n    severity: \"error\",\n    via: VIA_ALL,\n    what: \"an element's `metadata { service }` names a directory that does not exist — a binding is a claim about this repo, and this one is false\",\n  },\n  {\n    code: \"landscape.binding-duplicate\",\n    severity: \"warn\",\n    via: VIA_ALL,\n    what: \"two landscape elements resolve to the same services/<id>/ — every element→service join picks one of them arbitrarily, so the other's edges are filed under a service that does not own them\",\n  },\n  // Fires on a fresh baseline by construction: the adopt protocol's step 3\n  // writes the model and `subsystem sync` writes the project file, so a\n  // service is owed the second command from the moment the first file lands.\n  {\n    code: \"service.likec4-config-missing\",\n    severity: \"warn\",\n    via: VIA_ALL,\n    what: \"model.likec4 exists and services/<id>/likec4.config.json does not — the renderer's per-service project file, which `loam subsystem sync` writes; without it the model is a box on the fleet map with nothing inside it\",\n  },\n];\n"]}
+{"version":3,"file":"checks.js","sourceRoot":"","sources":["../../../src/core/brief/checks.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,wEAAwE;AACxE,yEAAyE;AACzE,wEAAwE;AAExE;;;GAGG;AACH,MAAM,WAAW,GAAG,8BAA8B,CAAC;AACnD,MAAM,CAAC,MAAM,OAAO,GAAG,qBAAqB,CAAC;AAc7C,2GAA2G;AAC3G,MAAM,CAAC,MAAM,eAAe,GAAiB;IAC3C,EAAE,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,yDAAyD,EAAE;IAClI;QACE,IAAI,EAAE,YAAY;QAClB,QAAQ,EAAE,OAAO;QACjB,GAAG,EAAE,WAAW;QAChB,IAAI,EAAE,qPAAqP;KAC5P;IACD,+EAA+E;IAC/E,8EAA8E;IAC9E,6EAA6E;IAC7E,6EAA6E;IAC7E,0EAA0E;IAC1E;QACE,IAAI,EAAE,yBAAyB;QAC/B,QAAQ,EAAE,MAAM;QAChB,GAAG,EAAE,WAAW;QAChB,4EAA4E;QAC5E,uEAAuE;QACvE,yEAAyE;QACzE,6EAA6E;QAC7E,0EAA0E;QAC1E,4CAA4C;QAC5C,IAAI,EAAE,0ZAA0Z;KACja;IACD;QACE,IAAI,EAAE,oBAAoB;QAC1B,QAAQ,EAAE,MAAM;QAChB,GAAG,EAAE,WAAW;QAChB,IAAI,EAAE,oQAAoQ;KAC3Q;IACD;QACE,IAAI,EAAE,gCAAgC;QACtC,QAAQ,EAAE,OAAO;QACjB,GAAG,EAAE,WAAW;QAChB,IAAI,EAAE,kEAAkE;KACzE;IACD;QACE,IAAI,EAAE,4BAA4B;QAClC,QAAQ,EAAE,OAAO;QACjB,GAAG,EAAE,WAAW;QAChB,IAAI,EAAE,wJAAwJ;KAC/J;IACD;QACE,IAAI,EAAE,6BAA6B;QACnC,QAAQ,EAAE,OAAO;QACjB,GAAG,EAAE,WAAW;QAChB,IAAI,EAAE,6HAA6H;KACpI;IACD;QACE,IAAI,EAAE,8BAA8B;QACpC,QAAQ,EAAE,OAAO;QACjB,GAAG,EAAE,WAAW;QAChB,IAAI,EAAE,4FAA4F;KACnG;IACD;QACE,IAAI,EAAE,+BAA+B;QACrC,QAAQ,EAAE,OAAO;QACjB,GAAG,EAAE,WAAW;QAChB,IAAI,EAAE,2FAA2F;KAClG;IACD,qEAAqE;IACrE,wEAAwE;IACxE,4EAA4E;IAC5E,yCAAyC;IACzC;QACE,IAAI,EAAE,0BAA0B;QAChC,QAAQ,EAAE,MAAM;QAChB,GAAG,EAAE,WAAW;QAChB,IAAI,EAAE,+JAA+J;KACtK;IACD;QACE,IAAI,EAAE,sBAAsB;QAC5B,QAAQ,EAAE,MAAM;QAChB,GAAG,EAAE,WAAW;QAChB,IAAI,EAAE,8HAA8H;KACrI;IACD,8EAA8E;IAC9E,wEAAwE;IACxE,uEAAuE;IACvE;QACE,IAAI,EAAE,iBAAiB;QACvB,QAAQ,EAAE,MAAM;QAChB,GAAG,EAAE,WAAW;QAChB,IAAI,EAAE,0HAA0H;KACjI;IACD;QACE,4EAA4E;QAC5E,0EAA0E;QAC1E,2EAA2E;QAC3E,yEAAyE;QACzE,4EAA4E;QAC5E,sCAAsC;QACtC,IAAI,EAAE,oBAAoB;QAC1B,QAAQ,EAAE,MAAM;QAChB,GAAG,EAAE,WAAW;QAChB,IAAI,EAAE,kQAAkQ;KACzQ;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,QAAQ,EAAE,OAAO;QACjB,GAAG,EAAE,WAAW;QAChB,IAAI,EAAE,kKAAkK;KACzK;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,MAAM;QAChB,GAAG,EAAE,WAAW;QAChB,IAAI,EAAE,+EAA+E;KACtF;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,QAAQ,EAAE,MAAM;QAChB,GAAG,EAAE,WAAW;QAChB,IAAI,EAAE,gJAAgJ;KACvJ;IACD,2EAA2E;IAC3E,2EAA2E;IAC3E,uEAAuE;IACvE,sBAAsB;IACtB;QACE,IAAI,EAAE,uBAAuB;QAC7B,QAAQ,EAAE,OAAO;QACjB,GAAG,EAAE,WAAW;QAChB,IAAI,EAAE,mKAAmK;KAC1K;IACD;QACE,IAAI,EAAE,sBAAsB;QAC5B,QAAQ,EAAE,MAAM;QAChB,GAAG,EAAE,WAAW;QAChB,IAAI,EAAE,sIAAsI;KAC7I;IACD,2EAA2E;IAC3E,iEAAiE;IACjE,uEAAuE;IACvE,2EAA2E;IAC3E,sCAAsC;IACtC;QACE,IAAI,EAAE,4BAA4B;QAClC,QAAQ,EAAE,MAAM;QAChB,GAAG,EAAE,WAAW;QAChB,IAAI,EAAE,sJAAsJ;KAC7J;IACD;QACE,IAAI,EAAE,oBAAoB;QAC1B,QAAQ,EAAE,OAAO;QACjB,GAAG,EAAE,WAAW;QAChB,IAAI,EAAE,6HAA6H;KACpI;IACD;QACE,IAAI,EAAE,uBAAuB;QAC7B,QAAQ,EAAE,MAAM;QAChB,GAAG,EAAE,WAAW;QAChB,IAAI,EAAE,sEAAsE;KAC7E;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,QAAQ,EAAE,MAAM;QAChB,GAAG,EAAE,WAAW;QAChB,IAAI,EAAE,uIAAuI;KAC9I;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,MAAM;QAChB,GAAG,EAAE,WAAW;QAChB,IAAI,EAAE,2IAA2I;KAClJ;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,MAAM;QAChB,GAAG,EAAE,WAAW;QAChB,IAAI,EAAE,iMAAiM;KACxM;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,QAAQ,EAAE,MAAM;QAChB,GAAG,EAAE,WAAW;QAChB,IAAI,EAAE,+JAA+J;KACtK;IACD;QACE,IAAI,EAAE,8BAA8B;QACpC,QAAQ,EAAE,MAAM;QAChB,GAAG,EAAE,WAAW;QAChB,IAAI,EAAE,oSAAoS;KAC3S;IACD;QACE,IAAI,EAAE,uBAAuB;QAC7B,QAAQ,EAAE,OAAO;QACjB,GAAG,EAAE,WAAW;QAChB,IAAI,EAAE,uJAAuJ;KAC9J;IACD;QACE,IAAI,EAAE,4BAA4B;QAClC,QAAQ,EAAE,OAAO;QACjB,GAAG,EAAE,WAAW;QAChB,IAAI,EAAE,2EAA2E;KAClF;IACD;QACE,IAAI,EAAE,4BAA4B;QAClC,QAAQ,EAAE,OAAO;QACjB,GAAG,EAAE,WAAW;QAChB,IAAI,EAAE,iFAAiF;KACxF;IACD,EAAE,IAAI,EAAE,2BAA2B,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,mCAAmC,EAAE;IACpH,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,4BAA4B,EAAE;IAClG;QACE,IAAI,EAAE,sBAAsB;QAC5B,QAAQ,EAAE,OAAO;QACjB,GAAG,EAAE,WAAW;QAChB,IAAI,EAAE,+HAA+H;KACtI;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,QAAQ,EAAE,MAAM;QAChB,GAAG,EAAE,WAAW;QAChB,IAAI,EAAE,0HAA0H;KACjI;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,QAAQ,EAAE,MAAM;QAChB,GAAG,EAAE,WAAW;QAChB,IAAI,EAAE,6WAA6W;KACpX;IACD,4EAA4E;IAC5E,8EAA8E;IAC9E,+EAA+E;IAC/E,2EAA2E;IAC3E,uEAAuE;IACvE,kEAAkE;IAClE,EAAE;IACF,wEAAwE;IACxE,4EAA4E;IAC5E,yEAAyE;IACzE,4EAA4E;IAC5E,yEAAyE;IACzE,yEAAyE;IACzE,4EAA4E;IAC5E,wEAAwE;IACxE,0EAA0E;IAC1E,yEAAyE;IACzE,sEAAsE;IACtE,4EAA4E;IAC5E;QACE,IAAI,EAAE,uBAAuB;QAC7B,QAAQ,EAAE,OAAO;QACjB,GAAG,EAAE,WAAW;QAChB,IAAI,EAAE,gKAAgK;KACvK;IACD;QACE,IAAI,EAAE,wBAAwB;QAC9B,QAAQ,EAAE,MAAM;QAChB,GAAG,EAAE,WAAW;QAChB,IAAI,EAAE,kJAAkJ;KACzJ;IACD;QACE,IAAI,EAAE,uBAAuB;QAC7B,QAAQ,EAAE,MAAM;QAChB,GAAG,EAAE,WAAW;QAChB,IAAI,EAAE,4VAA4V;KACnW;IACD;QACE,IAAI,EAAE,gCAAgC;QACtC,QAAQ,EAAE,OAAO;QACjB,GAAG,EAAE,WAAW;QAChB,IAAI,EAAE,uKAAuK;KAC9K;IACD;QACE,IAAI,EAAE,+BAA+B;QACrC,QAAQ,EAAE,OAAO;QACjB,GAAG,EAAE,WAAW;QAChB,IAAI,EAAE,uKAAuK;KAC9K;IACD;QACE,IAAI,EAAE,sBAAsB;QAC5B,QAAQ,EAAE,OAAO;QACjB,GAAG,EAAE,WAAW;QAChB,IAAI,EAAE,mKAAmK;KAC1K;IACD;QACE,IAAI,EAAE,8BAA8B;QACpC,QAAQ,EAAE,OAAO;QACjB,GAAG,EAAE,OAAO;QACZ,IAAI,EAAE,kZAAkZ;KACzZ;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,QAAQ,EAAE,OAAO;QACjB,GAAG,EAAE,OAAO;QACZ,IAAI,EAAE,yNAAyN;KAChO;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,QAAQ,EAAE,OAAO;QACjB,GAAG,EAAE,OAAO;QACZ,6EAA6E;QAC7E,0EAA0E;QAC1E,2EAA2E;QAC3E,yEAAyE;QACzE,IAAI,EAAE,gOAAgO;KACvO;IACD;QACE,IAAI,EAAE,2BAA2B;QACjC,QAAQ,EAAE,OAAO;QACjB,GAAG,EAAE,OAAO;QACZ,IAAI,EAAE,yIAAyI;KAChJ;IACD;QACE,IAAI,EAAE,6BAA6B;QACnC,QAAQ,EAAE,MAAM;QAChB,GAAG,EAAE,OAAO;QACZ,IAAI,EAAE,6LAA6L;KACpM;IACD,0EAA0E;IAC1E,4EAA4E;IAC5E,2EAA2E;IAC3E,4EAA4E;IAC5E,8EAA8E;IAC9E,6EAA6E;IAC7E,qEAAqE;IACrE,EAAE,IAAI,EAAE,4BAA4B,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,gXAAgX,EAAE;IAC9b,8EAA8E;IAC9E,8EAA8E;IAC9E,6EAA6E;IAC7E,4EAA4E;IAC5E,kEAAkE;IAClE,6EAA6E;IAC7E,oEAAoE;IACpE;QACE,IAAI,EAAE,+BAA+B;QACrC,QAAQ,EAAE,MAAM;QAChB,GAAG,EAAE,OAAO;QACZ,IAAI,EAAE,yTAAyT;KAChU;IACD;QACE,IAAI,EAAE,6BAA6B;QACnC,QAAQ,EAAE,MAAM;QAChB,GAAG,EAAE,OAAO;QACZ,IAAI,EAAE,mRAAmR;KAC1R;IACD;QACE,IAAI,EAAE,wBAAwB;QAC9B,QAAQ,EAAE,MAAM;QAChB,GAAG,EAAE,OAAO;QACZ,IAAI,EAAE,0bAA0b;KACjc;IACD;QACE,IAAI,EAAE,0BAA0B;QAChC,QAAQ,EAAE,MAAM;QAChB,GAAG,EAAE,OAAO;QACZ,IAAI,EAAE,uRAAuR;KAC9R;IACD,qEAAqE;IACrE,0EAA0E;IAC1E,6EAA6E;IAC7E;QACE,IAAI,EAAE,oBAAoB;QAC1B,QAAQ,EAAE,MAAM;QAChB,GAAG,EAAE,OAAO;QACZ,IAAI,EAAE,kjBAAkjB;KACzjB;IACD;QACE,IAAI,EAAE,0BAA0B;QAChC,QAAQ,EAAE,MAAM;QAChB,GAAG,EAAE,OAAO;QACZ,IAAI,EAAE,6dAA6d;KACpe;CACF,CAAC","sourcesContent":["/**\n * The checks half of the adoption brief: every check `loam validate` will run\n * against a baseline, each naming the invocation that surfaces it. Its\n * counterpart — the UNCHECKED list, the checks that do not exist — lives in\n * unchecked.ts: honesty no validator will ever supply, and an agent that does\n * not know where the checking stops will assume it never does.\n */\n\n/* ------------------------------------------------------------------ */\n/* The checks                                                          */\n/* ------------------------------------------------------------------ */\n\n/**\n * The two invocations a baseline meets. `<id>` is a placeholder for the service\n * id — the JSON contract keeps it symbolic, the text renderer substitutes it.\n */\nconst VIA_SERVICE = \"loam validate --service <id>\";\nexport const VIA_ALL = \"loam validate --all\";\n\nexport interface BriefCheck {\n  code: string;\n  severity: \"error\" | \"warn\";\n  /**\n   * The invocation that surfaces this check. Most run under `--service`, but\n   * the fleet cross-check does not — attributing it there taught agents to\n   * expect a finding that run never reports.\n   */\n  via: typeof VIA_SERVICE | typeof VIA_ALL;\n  what: string;\n}\n\n/** What `loam validate` will run against the result — each check names the invocation that surfaces it. */\nexport const VALIDATE_CHECKS: BriefCheck[] = [\n  { code: \"service.no-model\", severity: \"error\", via: VIA_SERVICE, what: \"there is no model.likec4 — every other check stops here\" },\n  {\n    code: \"c4.invalid\",\n    severity: \"error\",\n    via: VIA_SERVICE,\n    what: \"model.likec4 does not parse as LikeC4 — for a model that extends the fleet map, parsed together with `architecture/landscape.likec4`, and every error is this model's, including one the parser blames on the map (the map parses clean on its own)\",\n  },\n  // The two shapes' own grades. A model that extends the map cannot diverge from\n  // it — there is one declaration — and a model that stands alone cannot own an\n  // element outside itself, because nothing else is in its project. So exactly\n  // one of these two can ever fire for a given model, and which one is decided\n  // by the file's own grammar (SCHEMA.md, \"Two shapes of a service model\").\n  {\n    code: \"c4.declaration-diverged\",\n    severity: \"warn\",\n    via: VIA_SERVICE,\n    // \"the fleet map (architecture/)\", never one file: the map is a project, an\n    // element may be declared in any document of it, and the finding's own\n    // message and `loam explain` both refuse to name a file for that reason.\n    // Naming `architecture/landscape.likec4` here sent a reader of a fleet whose\n    // map is spread over several documents to a file that may not declare the\n    // element at all (verification 2026-09-04).\n    what: \"a model that declares its own `specification` (the standalone shape) declares an element the fleet map (`architecture/`) also declares, and the two copies disagree about `kind`, `title`, the tag SET or the `metadata { service }` binding — two documents are two authorities on one element. `description` is deliberately not compared. Copy the map's declaration verbatim, or migrate the model to extend the map\",\n  },\n  {\n    code: \"c4.element-unowned\",\n    severity: \"warn\",\n    via: VIA_SERVICE,\n    what: \"a model that extends the fleet map declares an element OUTSIDE the element that resolves to this service — a system this service reaches belongs in `architecture/landscape.likec4`, declared once, and another service's internals belong in that service's model\",\n  },\n  {\n    code: \"requirements.missing-scenarios\",\n    severity: \"error\",\n    via: VIA_SERVICE,\n    what: \"a requirement in spec.md or arch.spec.md has no `#### Scenario:`\",\n  },\n  {\n    code: \"spec.duplicate-requirement\",\n    severity: \"error\",\n    via: VIA_SERVICE,\n    what: \"one `### Requirement:` name defined twice in one living spec.md or arch.spec.md — a later merge edits only the first, the rest live on as stale copies\",\n  },\n  {\n    code: \"spec.requirement-id-invalid\",\n    severity: \"error\",\n    via: VIA_SERVICE,\n    what: \"an optional `Requirement-ID:` violates `[A-Za-z][A-Za-z0-9._-]{0,127}` — stable identities must be portable and unambiguous\",\n  },\n  {\n    code: \"spec.requirement-id-repeated\",\n    severity: \"error\",\n    via: VIA_SERVICE,\n    what: \"one requirement declares `Requirement-ID:` more than once — keep exactly one identity line\",\n  },\n  {\n    code: \"spec.requirement-id-duplicate\",\n    severity: \"error\",\n    via: VIA_SERVICE,\n    what: \"one stable Requirement-ID identifies multiple requirements in one spec.md or arch.spec.md\",\n  },\n  // The keep-last pair: a second `Operations:` / `Covers:` line in one\n  // requirement body REPLACES the first — assignment, not append — so the\n  // author's two-line list silently loses its first line. The semantics stay;\n  // the loss no longer happens in silence.\n  {\n    code: \"spec.repeated-operations\",\n    severity: \"warn\",\n    via: VIA_SERVICE,\n    what: \"a second `Operations:` line in one requirement body — the last replaces the earlier ones, whose list is silently dropped; merge into one comma-separated line\",\n  },\n  {\n    code: \"spec.repeated-covers\",\n    severity: \"warn\",\n    via: VIA_SERVICE,\n    what: \"a second `Covers:` line in one requirement body — same keep-last rule, same silent loss; merge into one comma-separated line\",\n  },\n  // The graded absences: the brief marks spec.md and openapi.yaml required, and\n  // validate agrees they belong — as warns, because partial adoption is a\n  // supported state and these are its honest progress meter, not a gate.\n  {\n    code: \"service.no-spec\",\n    severity: \"warn\",\n    via: VIA_SERVICE,\n    what: \"spec.md does not exist yet — legal mid-adoption, but requirement coverage and API governance are unchecked until it does\",\n  },\n  {\n    // `warn` is the floor, not the whole story, and the difference matters to a\n    // baseline: the absence is graded an ERROR once something already written\n    // down joins into the file — a living requirement's `Operations:` line, or\n    // an op-linked landscape edge (`landscape.expects`, landscape.ts). For a\n    // service the fleet already calls, `required: true` on this target and this\n    // row are the same fact stated twice.\n    code: \"service.no-openapi\",\n    severity: \"warn\",\n    via: VIA_SERVICE,\n    what: \"openapi.yaml does not exist yet — quiet only when the landscape proves no other service calls an operation on this one, and an ERROR rather than a warning once a living `Operations:` line or a landscape edge already names an operation it would have defined\",\n  },\n  {\n    code: \"openapi.invalid\",\n    severity: \"error\",\n    via: VIA_SERVICE,\n    what: \"openapi.yaml exists but does not parse — an unreadable contract proves nothing, so the `api.*` checks and the spine's op resolution are suspended until it reads\",\n  },\n  {\n    code: \"api.ungoverned\",\n    severity: \"warn\",\n    via: VIA_SERVICE,\n    what: \"an operationId in openapi.yaml that no requirement's `Operations:` line names\",\n  },\n  {\n    code: \"api.ops-unlinked\",\n    severity: \"warn\",\n    via: VIA_SERVICE,\n    what: \"openapi.yaml defines operations and spec.md has requirements, but no `Operations:` line joins them — every cross-axis check is vacuously green\",\n  },\n  // The `Operations:` spine, checked against the LIVING contract. It used to\n  // fire only inside a feature delta, so a baseline could ship a requirement\n  // governing an operation nobody defines and stay green until the first\n  // feature touched it.\n  {\n    code: \"spec-api.op-undefined\",\n    severity: \"error\",\n    via: VIA_SERVICE,\n    what: \"a living requirement's `Operations:` line names an operationId this service's openapi.yaml does not define — the two axes disagree about what the service exposes\",\n  },\n  {\n    code: \"spec.no-requirements\",\n    severity: \"warn\",\n    via: VIA_SERVICE,\n    what: \"spec.md exists but holds no `### Requirement:` block at all — every requirement-driven check below it is vacuous rather than passing\",\n  },\n  // The deprecation pair fires on a fresh baseline too — a legacy service is\n  // exactly where ops marked `deprecated: true` coexist with their\n  // replacements, and documenting that lifecycle honestly is part of the\n  // adoption. Mark the flag where the code retires an op; loam reads it, and\n  // has no removal semantics beyond it.\n  {\n    code: \"api.requirement-deprecated\",\n    severity: \"warn\",\n    via: VIA_SERVICE,\n    what: \"a requirement whose `Operations:` list resolves only to operations openapi.yaml marks `deprecated: true` — the behaviour it governs is being retired\",\n  },\n  {\n    code: \"spine.op-undefined\",\n    severity: \"error\",\n    via: VIA_SERVICE,\n    what: \"a landscape edge into this service calls an operation its openapi.yaml does not define — a broken contract between services\",\n  },\n  {\n    code: \"spine.op-link-missing\",\n    severity: \"warn\",\n    via: VIA_SERVICE,\n    what: 'a landscape \"Calls\" edge into this service with no `metadata { op }`',\n  },\n  {\n    code: \"spine.op-deprecated\",\n    severity: \"warn\",\n    via: VIA_SERVICE,\n    what: \"a landscape edge into this service calls an operation openapi.yaml marks `deprecated: true` — the consumer should be migrating off it\",\n  },\n  {\n    code: \"covers.unknown\",\n    severity: \"warn\",\n    via: VIA_SERVICE,\n    what: \"a `Covers:` entry in arch.spec.md that resolves to no element, edge, alert or SLI — a typo silently costs the coverage it was written for\",\n  },\n  {\n    code: \"health.invalid\",\n    severity: \"warn\",\n    via: VIA_SERVICE,\n    what: \"health.yaml exists but does not parse — its alert/SLI ids are unreadable, so `Covers: alert:/sli:` entries and health coverage go unchecked until it reads (a missing health.yaml stays silent)\",\n  },\n  {\n    code: \"health.uncovered\",\n    severity: \"warn\",\n    via: VIA_SERVICE,\n    what: \"an alert or SLI declared in health.yaml that no arch.spec.md requirement covers — expected until the arch spec is written; each one is a signal nothing tests\",\n  },\n  {\n    code: \"health.dependency-unmodelled\",\n    severity: \"warn\",\n    via: VIA_SERVICE,\n    what: \"a health.yaml `dependencies:` id that nothing in this service's OWN model.likec4 answers to (element id, `metadata { service }` binding, or title) — the model carries everything the service touches, private stores included as nested containers, and the on-call file must name the same world\",\n  },\n  {\n    code: \"frontmatter.malformed\",\n    severity: \"error\",\n    via: VIA_SERVICE,\n    what: \"the frontmatter block does not parse as YAML — owner, status and sources are unreadable, and the field checks are suspended until the header is fixed\",\n  },\n  {\n    code: \"frontmatter.field-mismatch\",\n    severity: \"error\",\n    via: VIA_SERVICE,\n    what: \"spec.md declares a different `service:` than the directory it lives under\",\n  },\n  {\n    code: \"frontmatter.status-unknown\",\n    severity: \"error\",\n    via: VIA_SERVICE,\n    what: \"a status outside `draft` / `verified` — a typo here reads as unverified forever\",\n  },\n  { code: \"frontmatter.field-missing\", severity: \"warn\", via: VIA_SERVICE, what: \"no `owner`, `status` or `service`\" },\n  { code: \"sources.absent\", severity: \"warn\", via: VIA_SERVICE, what: \"spec.md names no `sources`\" },\n  {\n    code: \"sources.path-missing\",\n    severity: \"error\",\n    via: VIA_SERVICE,\n    what: \"a listed source does not exist, or is a glob pattern — no longer supported (checked when loam runs inside the service's repo)\",\n  },\n  {\n    code: \"sources.unvouched\",\n    severity: \"warn\",\n    via: VIA_SERVICE,\n    what: \"`sources` with no digest — nobody has vouched for the document yet. Expected on a fresh baseline; only a human closes it\",\n  },\n  {\n    code: \"sources.unwalked\",\n    severity: \"warn\",\n    via: VIA_SERVICE,\n    what: \"`sources` leaves whole top-level paths of the service repo untouched — the finding names them (checked when loam runs inside the service's repo, against the files git tracks). It grades the WALK, not the writing: the only completeness signal loam can compute, because it is the only one that compares the document against the repository rather than against itself\",\n  },\n  // sources.stale, sources.current and content.stale are deliberately absent:\n  // all three compare against digests `loam vouch` stamps, and a fresh baseline\n  // has no stamp to compare — the table lists what a baseline can actually meet.\n  // The gherkin.* staleness chain is absent the same way: it fires only once\n  // `loam gherkin` has generated a suite under <gherkinDir>/loam/ in the\n  // service's own repo, and a fresh baseline has not generated one.\n  //\n  // The service's OWN use cases: a `dynamic view` in any `.likec4` beside\n  // model.likec4 (or inside it) that opts in with `#req-`. The same codes the\n  // fleet target grades over architecture/usecases/, reused on the service\n  // target because the flow's hops name this service's containers, which only\n  // its own project can resolve. `usecase.step-unlinked` was at first left\n  // out, on the reasoning that a hop between two containers of one service\n  // owes no operationId — true, and exactly the scope of the guard that keeps\n  // it quiet there (a service owes none to itself); but a service's model\n  // routinely declares a stand-in for a sibling service it calls, and a hop\n  // from a service-local flow into that stand-in with no `metadata { op }`\n  // warns exactly as it does on the fleet map. The row is listed so the\n  // agent's own baseline run never reports a code the brief left unexplained.\n  {\n    code: \"usecase.step-unbacked\",\n    severity: \"error\",\n    via: VIA_SERVICE,\n    what: \"a hop of a `#req-`-tagged dynamic view in this service's project that no relationship in model.likec4 backs — LikeC4 reports nothing for it, so only this does\",\n  },\n  {\n    code: \"usecase.step-contested\",\n    severity: \"warn\",\n    via: VIA_SERVICE,\n    what: \"two or more relationships back one hop of a service-local flow and name different operations — loam names the candidates rather than picking one\",\n  },\n  {\n    code: \"usecase.step-unlinked\",\n    severity: \"warn\",\n    via: VIA_SERVICE,\n    what: \"a hop of a service-local flow into ANOTHER service's element — a stand-in this model.likec4 declares for a sibling, bound or titled as that service — backed by an edge carrying no `metadata { op }` and no `publishes`/`consumes`; never on a hop whose caller and provider resolve to the same service, because a service owes no operationId to itself\",\n  },\n  {\n    code: \"usecase.requirement-unresolved\",\n    severity: \"error\",\n    via: VIA_SERVICE,\n    what: \"a `#req-` tag on a service-local flow naming no `Requirement-ID` of this service's spec.md or arch.spec.md — the id is scoped by the directory, never by a capability\",\n  },\n  {\n    code: \"usecase.capability-unresolved\",\n    severity: \"error\",\n    via: VIA_SERVICE,\n    what: \"a `#cap-` tag on a flow inside this service's own project — a capability is claimed on the fleet map, never inside one service; drop the tag and keep the `#req-` one\",\n  },\n  {\n    code: \"usecase.flow-invalid\",\n    severity: \"error\",\n    via: VIA_SERVICE,\n    what: \"a `.likec4` beside model.likec4 that does not parse as part of the service's LikeC4 project — no flow in it was graded; model.likec4 itself is still graded alone\",\n  },\n  {\n    code: \"landscape.service-unmodelled\",\n    severity: \"error\",\n    via: VIA_ALL,\n    what: \"nothing in architecture/landscape.likec4 resolves to services/<id>/ — the fleet map is incomplete until an element exists or an existing one is bound with `metadata { service '<id>' }`. On the FLEET target for any service; on the SERVICE target too when that service's model.likec4 EXTENDS the map, where an unbound directory leaves the model with nothing to be inside and nothing in it can be graded\",\n  },\n  {\n    code: \"landscape.missing\",\n    severity: \"error\",\n    via: VIA_ALL,\n    what: \"architecture/landscape.likec4 does not exist at all — an error as soon as services/ holds one service (a warning only in an empty docs repo): with no fleet map, every cross-service check is blind rather than passing\",\n  },\n  {\n    code: \"landscape.invalid\",\n    severity: \"error\",\n    via: VIA_ALL,\n    // The fleet map is the whole `architecture/` PROJECT, so this code fires for\n    // a palette or a use case beside the landscape just as readily as for the\n    // landscape itself — and the message names the document that broke. Saying\n    // \"landscape.likec4\" here sent an author to a file with no errors in it.\n    what: \"the `architecture/` project does not parse — the landscape, or any `.likec4` beside it; the message names the document that broke. Fix it before anything else: the whole cross-service layer is unchecked until the map reads\",\n  },\n  {\n    code: \"landscape.binding-unknown\",\n    severity: \"error\",\n    via: VIA_ALL,\n    what: \"an element's `metadata { service }` names a directory that does not exist — a binding is a claim about this repo, and this one is false\",\n  },\n  {\n    code: \"landscape.binding-duplicate\",\n    severity: \"warn\",\n    via: VIA_ALL,\n    what: \"two landscape elements resolve to the same services/<id>/ — every element→service join picks one of them arbitrarily, so the other's edges are filed under a service that does not own them\",\n  },\n  // Evidence-gated: the model's own cross-boundary calls are the proof that\n  // the map owes an edge, so a service whose model declares none stays silent\n  // — that state is the adopt brief's to name (`landscape.touched`), never a\n  // fleet finding that cannot tell a hermit from a batch job. And BINARY: one\n  // edge closes it, because loam cannot tell a call the map forgot from one the\n  // fleet deliberately does not draw at its own altitude, and a set difference\n  // reported as an omission is an invented edge with a code beside it.\n  { code: \"landscape.service-isolated\", severity: \"warn\", via: VIA_ALL, what: \"an element resolves to services/<id>/ and no edge anywhere in architecture/ touches it, while model.likec4 declares a call across its boundary — the service is drawn and invisible to every cross-service check; silent when the model declares no such call, and silent once ONE edge is drawn: the check is touched/untouched, not a set difference over the attested calls\" },\n  // The four renderer-wiring grades, all repaired by one `loam subsystem sync`.\n  // None of them fires on a baseline written from this brief: the model it asks\n  // for extends the map, so it belongs to the root project and is owed no file\n  // and no exclusion. They are listed because an agent adopting into an OLDER\n  // repository — one whose root `likec4.config.json` still excludes\n  // `services/**`, or that carries a hand-written project file — meets them on\n  // the first `--all` run and must not read one as work on the model.\n  {\n    code: \"service.likec4-config-missing\",\n    severity: \"warn\",\n    via: VIA_ALL,\n    what: \"a model that stands alone (declares its own `specification`) renders only as a project of its own, and services/<id>/likec4.config.json is not there — `loam subsystem sync` writes it; without it the model is a box on the fleet map with nothing renderable inside it. Never raised for a model that extends the map\",\n  },\n  {\n    code: \"service.likec4-config-stray\",\n    severity: \"warn\",\n    via: VIA_ALL,\n    what: \"the reverse: model.likec4 extends the fleet map and a likec4.config.json sits beside it — the renderer registers that file as a project of its own, holding nothing, or holding the model alone where it cannot parse. Delete it; loam never writes one beside an extending model\",\n  },\n  {\n    code: \"service.model-excluded\",\n    severity: \"warn\",\n    via: VIA_ALL,\n    what: \"model.likec4 extends the fleet map and the root likec4.config.json's `exclude` hides it, so the renderer never loads it. Two entry shapes reach it: one covering the DIRECTORY, which `loam subsystem sync` rewrites (that command maintains the `services/` entries), and one shaped like a FILE (`services/**/model.likec4`), which sync cannot repair — the message says which one you have, and the file shape has to be removed or narrowed by hand\",\n  },\n  {\n    code: \"service.model-unexcluded\",\n    severity: \"warn\",\n    via: VIA_ALL,\n    what: \"the mirror, and the damaging one: a model that stands alone whose directory the root `exclude` does NOT cover — the renderer merges it into the map, reports every kind and element it declares as a duplicate, and blanks the whole root project, not just this service. Same repair\",\n  },\n  // The same list, one level up: the entry covers the MAP. It is not a\n  // per-service wiring grade and no `sync` repairs it — sync recomputes the\n  // `services/` entries only — so it is listed separately from the four above.\n  {\n    code: \"landscape.excluded\",\n    severity: \"warn\",\n    via: VIA_ALL,\n    what: \"the root likec4.config.json's `exclude` covers architecture/landscape.likec4 itself — the renderer loads no fleet map at all, and every extending model in the root project resolves against nothing, while loam keeps grading the map it reads from disk. `c4.fleet-project-invalid` is not graded while the entry stands, because that check reads the renderer's project and would report this one line once per model. The finding quotes the entry verbatim; remove or narrow it by hand, because `loam subsystem sync` maintains only the `services/` entries in that list\",\n  },\n  {\n    code: \"c4.fleet-project-invalid\",\n    severity: \"warn\",\n    via: VIA_ALL,\n    what: \"every document reads clean where loam grades it, and the ONE project the renderer builds out of them — the map, every extending model, and every `.likec4` beside one — does not parse. A tag or an element declared in two of those documents is declared twice there; declare it once, in the map or in the single service that owns it. Not graded at all while `landscape.excluded` holds: with the map out of that project every `extend` is unresolvable, so the entry is the finding\",\n  },\n];\n"]}

package/dist/core/brief/landscape.js

@@ -1,194 +1,277 @@
 /**
- * The fleet-map half of the adoption brief: what `architecture/landscape.likec4`
+ * The fleet-map half of the adoption brief, READ side: what the fleet map
  * already says about one service — its elements, its inbound and outbound
- * edges, the operations the fleet already calls on it — and the block the
- * service still owes the file when nothing in it resolves to the service yet.
- * Both halves exist to stop an agent inventing a parallel model: the fleet has
- * already drawn some of these boxes and edges, and a baseline has to attach to
- * them.
+ * edges, the operations the fleet already calls on it — and which of the four
+ * states the map is in for it. The write the service still owes the file — the
+ * block, when nothing in it resolves to the service yet, or the EDGES, when an
+ * element does and no edge touches it — is spelled in `./map/owed.ts`
+ * (`landscapeArtifact`, `instructionFor`), which this module hands its findings
+ * to. Both halves exist to stop an agent inventing a parallel model: the fleet
+ * has already drawn some of these boxes and edges, and a baseline has to attach.
+ *
+ * "The fleet map" is the `architecture/` PROJECT — the landscape plus every
+ * other `.likec4` under it, minus the generated views file — and not the
+ * landscape FILE. The two are the same document set `validate --all` grades
+ * `landscape.service-isolated` over, and reading one file here let the two
+ * surfaces disagree about the same tree.
  */
 import { existsSync } from "node:fs";
 import { loadFile } from "../c4/likec4.js";
-import { elementService, serviceResolver } from "../c4/resolve/service.js";
+import { loadArchitecture } from "../c4/project/architecture.js";
+import { attestedCalls } from "../c4/resolve/attested.js";
+import { serviceResolver } from "../c4/resolve/service.js";
+import { ServiceModels } from "../c4/prefetch/fleet.js";
+import { OBLIGATION_TAG_PREFIX } from "../obligations/obligations.js";
 import { landscapePath } from "../repo/paths.js";
 import { enumeratedServiceIds, serviceTreePathOf } from "../repo/service-target.js";
+import { EXTERNAL_TAG, GRADED_TAGS } from "../vocabulary/maturity.js";
+import { brokenDocuments, instructionFor } from "./map/owed.js";
+import { properAncestorIds } from "../kernel/ids/fqn/ancestors.js";
 /**
- * The LikeC4 identifier the fleet map's element for a service conventionally
- * carries: the directory name, camel-cased. It is a suggestion and nothing
- * more — `metadata { service '<id>' }` is what actually joins the element to
- * the directory — but a brief that hands over a concrete block gets followed,
- * and one that describes a block in prose gets improvised on.
+ * The service ids the resolver may fall back on when an element carries no
+ * `metadata { service }` binding — the same positive evidence `validate` and
+ * `list` hand it. A docs repo with no `services/` yet (`adopt` runs there)
+ * leaves the resolver with bindings alone, which is what it had before.
  */
-function elementIdFor(service) {
-    const parts = service.split(/[^A-Za-z0-9]+/).filter((p) => p !== "");
-    if (parts.length === 0)
-        return "service";
-    const head = parts[0].toLowerCase();
-    const tail = parts.slice(1).map((p) => p[0].toUpperCase() + p.slice(1).toLowerCase());
-    const id = head + tail.join("");
-    // LikeC4 identifiers cannot open with a digit; a service id can.
-    return /^[0-9]/.test(id) ? `svc${id[0].toUpperCase()}${id.slice(1)}` : id;
+async function knownServices(docsDir) {
+    return new Set(await enumeratedServiceIds(docsDir));
 }
 /**
- * The block this service still owes `architecture/landscape.likec4`.
- *
- * `expects` is what the fleet ALREADY calls on the service — those edges exist
- * in the map today, so the example draws the outbound side as a comment rather
- * than telling an agent to duplicate an edge that is already there.
+ * The tags loam reads on an ELEMENT. `GRADED_TAGS` is the vocabulary's own
+ * list of the tags that change what loam concludes — spelled once there, so
+ * the day a third tag is graded this set follows and the instruction below
+ * does not tell an agent to clear it as unread. The obligation prefix is the
+ * one tag PREFIX loam reads on an element; `#cap-`/`#req-` are view tags and
+ * never sit on one, so they are not in this list.
  */
-function landscapeBlock(service, expects, present) {
-    const id = elementIdFor(service);
-    const calls = expects.length > 0
-        ? expects.map((op) => `//   <caller> -> ${id} 'Calls ${op}' { metadata { op '${op}' } }`)
-        : [`//   <caller> -> ${id} 'Calls <operationId>' { metadata { op '<operationId>' } }`];
-    const model = [
-        "model {",
-        ...(present ? ["  // ... the fleet's other services stay exactly as they are ...", ""] : []),
-        `  ${id} = softwareSystem '${service}' {`,
-        "    description '<one line: what this service is responsible for>'",
-        `    metadata { service '${service}' }`,
-        "  }",
-        "",
-        "  // every call in or out of it, one edge each:",
-        ...calls.map((line) => `  ${line}`),
-        "}",
-    ];
-    // When the file does not exist the example is the WHOLE file, so it carries
-    // the `specification` block a bare `model` would be rejected without: the
-    // brief must never hand over a document `loam validate` refuses. When the file
-    // does exist the example is a fragment to splice, and repeating a
-    // `specification` block there would invite a second one.
-    return present
-        ? model.join("\n")
-        : ["specification {", "  element softwareSystem", "}", "", ...model].join("\n");
-}
-/** The fleet map's own brief — assembled per service, because the block it owes names the service. */
-export function landscapeArtifact(service, expects, present, servicePath) {
-    return {
-        artifact: "landscape.likec4",
-        required: true,
-        purpose: "the fleet map — until an element here resolves to this directory, the service is documented and invisible to every cross-service check",
-        shape: [
-            "This file is the WHOLE FLEET's, not this service's. Add to it; never rewrite it. Everything already in `model { ... }` belongs to the other services, and replacing the file destroys their map along with their edges.",
-            `Add one top-level element for the service, bound to its directory: \`metadata { service '${service}' }\`. Until an element resolves to \`${servicePath}/\`, \`loam validate --all\` reports \`landscape.service-unmodelled\` (error).`,
-            "Bind rather than rename: a binding whose id names no directory is `landscape.binding-unknown` (error), and two elements binding the SAME directory is `landscape.binding-duplicate` (warn) — every element→service join then picks one of them arbitrarily.",
-            "Draw every cross-service call as an edge carrying the operation it uses: `a -> b 'Calls createSplit' { metadata { op 'createSplit' } }`. The `op` must be an operationId the TARGET's openapi.yaml defines, or `spine.op-undefined` (error) — a broken contract between services.",
-            "If the file does not exist yet, create it with a `specification { ... }` block declaring the kinds you use, then the `model { ... }` block. A landscape that does not parse is `landscape.invalid` (error) and blinds every cross-service check at once.",
-        ],
-        example: landscapeBlock(service, expects, present),
-    };
-}
+const LOAM_TAGS = new Set(GRADED_TAGS);
+const LOAM_TAG_PREFIXES = [OBLIGATION_TAG_PREFIX];
 /**
- * The service ids the resolver may fall back on when an element carries no
- * `metadata { service }` binding — the same positive evidence `validate` and
- * `list` hand it. A docs repo that cannot be enumerated (no `services/` yet:
- * `adopt` runs there) leaves the resolver with bindings alone, which is what it
- * had before.
+ * The element's tags loam does NOT read — named in the instruction and never
+ * interpreted. A placeholder convention ("drawn ahead of adoption") is the
+ * fleet's own, `loam seed` writes none, and a view written `exclude
+ * element.tag = #<that>` keeps an adopted service hidden until it is cleared.
  */
-async function knownServices(docsDir) {
-    return new Set(await enumeratedServiceIds(docsDir));
+function foreignTagsOf(elements) {
+    const unread = (t) => !LOAM_TAGS.has(t) && !LOAM_TAG_PREFIXES.some((p) => t.startsWith(p));
+    return [...new Set(elements.flatMap((e) => e.tags))].filter(unread);
 }
 /**
- * What the living landscape already says about this service.
+ * The attested calls, or nothing off a model that could not be read: `c4.invalid`
+ * is validate's finding, and an edge list read off half a document is invention.
  *
- * This is the half of the brief that stops an agent inventing a parallel model:
- * the fleet has already drawn some of these boxes and edges, and the baseline has
- * to attach to them. A landscape that does not parse yields `modelled: null` —
- * "nothing models it" would be a claim about a document nobody could read.
+ * Through the ONE reader of `model.likec4` (`core/c4/service-model/load.ts`),
+ * because the two shapes are read differently and this brief is handed to an
+ * agent that will act on it: a model that EXTENDS the fleet map, opened as a
+ * lone file, comes back as a pile of parse errors — so the brief would tell
+ * every migrated service that its model attests nothing and quietly drop the
+ * edges the map most likely owes. `mapUnreadable` is the same empty answer for
+ * the same reason: an extending model whose map does not parse was never read.
+ */
+async function attestedFrom(docsDir, paths, service, known) {
+    // The memo directly rather than through `core/fleet-context.ts`, and the
+    // reason is the package graph: this module already depends on `core/c4/`, and
+    // reaching for the read index would add a `brief -> core-root` edge for one
+    // read in a command that grades a single service. The three things the memo
+    // cannot know for itself are supplied here — the enumeration this function
+    // was already handed, the per-file loader, and a counter nobody is keeping.
+    const models = new ServiceModels({
+        onProjectLoad: () => {
+            // `adopt` reports no read counters, so there is nothing to increment. The
+            // hook is the memo's way of letting a caller own its own statistics, and
+            // an empty one is that answer, not a forgotten line.
+        },
+        known: async () => known,
+        standalone: (path) => loadFile(path),
+    });
+    const model = await models.model(docsDir, paths);
+    if (model.mapUnreadable || model.doc.errors.length > 0)
+        return [];
+    return attestedCalls(model.doc, service, known);
+}
+/**
+ * What the living fleet map already says about this service — the half of the
+ * brief that stops an agent inventing a parallel model: the fleet has already
+ * drawn some of these boxes and edges, and the baseline has to attach to them.
+ * An `architecture/` project that does not parse yields `modelled: null` —
+ * "nothing models it" would be a claim about documents nobody could read; the
+ * landscape FILE parsing on its own does not rescue it, because the map the
+ * renderer and `validate --all` see is the whole project. `paths` is the
+ * service's own artifact set, located by the caller through the enumeration
+ * (never joined at `services/<id>/`): the model is opened in exactly one state —
+ * an element with no edge — to name the calls the map most likely owes. The
+ * WHOLE record travels rather than the model path alone, because the model is
+ * now read through its own shape and an extending one is read as a project of
+ * the service's directory plus the map. It is required rather than optional
+ * because the edgeless instruction states what that file attests, and a caller
+ * that omitted it would get a brief asserting a fact about a document loam never
+ * opened.
  */
-export async function landscapeContext(docsDir, service) {
+export async function landscapeContext(docsDir, service, paths) {
     const path = landscapePath(docsDir);
     // The service's own directory, spelled from the enumeration rather than joined
     // at the root: this text is handed to an AGENT that will go and edit files, and
     // a filed service named at `services/<id>/` sends it to create a second
     // directory beside the one that already exists.
     const servicePath = await serviceTreePathOf(docsDir, service);
+    const bare = { service, expects: [], servicePath, attested: [], foreignTags: [] };
     const empty = {
         present: existsSync(path),
         parses: false,
+        callersKnown: false,
         modelled: null,
         elements: [],
         inbound: [],
         outbound: [],
         expects: [],
+        touched: null,
+        attested: [],
         instruction: null,
     };
     if (!empty.present)
-        return { ...empty, modelled: false, instruction: instructionFor(service, "absent", [], servicePath) };
-    const land = await loadFile(path);
-    if (land.errors.length > 0)
-        return { ...empty, instruction: instructionFor(service, "unparseable", [], servicePath) };
-    const mine = (e) => elementService(e) === service;
-    const elements = land.elements.filter(mine).map((e) => ({
+        return { ...empty, modelled: false, instruction: instructionFor({ ...bare, state: "absent" }) };
+    // The `architecture/` PROJECT, through the one loader every other reader
+    // shares — never `loadFile(path)`. A fleet spreads its model over more than
+    // the landscape (a second `model { }` block in a sibling, a use case, a
+    // palette), and `landscape.service-isolated` grades `touched` over exactly
+    // this set: reading the landscape alone made `adopt` report `touched: false`,
+    // the attested calls and an edit target for a service the fleet run on the
+    // same tree called matched, with nothing to tell an agent which was right.
+    const known = await knownServices(docsDir);
+    const land = await loadArchitecture(docsDir);
+    if (land.errors.length > 0) {
+        // Since W4 this arm answers for the whole `architecture/` PROJECT, so the
+        // document that broke is very often a SIBLING beside a landscape that parses
+        // perfectly — and two things followed from not saying so:
+        //   - the instruction told an agent to go and fix parse errors in
+        //     `architecture/landscape.likec4`, which has none, contradicting
+        //     `validate --all` run one second later on the same tree;
+        //   - the API question — who CALLS this service — was answered "unknown"
+        //     off a landscape file loam can read, so a broken palette flipped
+        //     `openapi.yaml` to required for a browser UI the map proves nobody
+        //     calls, while `list` and `context` (which read the FILE, see
+        //     core/pack/living.ts) answered the opposite about the same tree.
+        // Nothing else is rescued: `modelled`, `elements` and `touched` stay
+        // unknown, because those are claims about the project the renderer loads.
+        const expects = await expectsFromFile(path, service, known);
+        return {
+            ...empty,
+            callersKnown: expects !== null,
+            expects: expects ?? [],
+            instruction: instructionFor({
+                ...bare,
+                expects: expects ?? [],
+                state: "unparseable",
+                broken: brokenDocuments(docsDir, land),
+            }),
+        };
+    }
+    // One resolver for the whole scan, built with the real service ids, and
+    // built BEFORE the element filter: "an element resolves to this service" is
+    // the resolver's answer — a nearest-ancestor binding wins over a descendant's
+    // title — and it is the answer `validate --all` grades `service-unmodelled`
+    // on and `loam context` prints `modelled` from. This used to ask each
+    // element for its OWN binding-or-title instead, so a container titled
+    // 'payment-service' inside an element bound to order-service read as
+    // payment-service's box, and the edgeless arm told an agent "do not add a
+    // second element" for a service the fleet run reported unmodelled (error).
+    // The same resolver serves the edges: one drawn into a modelled container
+    // (`paymentService.api`) is an edge into the service, and `expects` — which
+    // decides whether this service owes an OpenAPI contract at all — has to see
+    // it. Building it once also stops the per-edge rebuild the old
+    // `serviceOf(land.elements, id)` call did.
+    const svcOf = serviceResolver(land.elements, known);
+    const mine = (id) => svcOf(id) === service;
+    // The service-LEVEL elements only: one that resolves to the service while
+    // an ancestor does too is a container of it, and listing it would show a
+    // second box the map does not have.
+    const elements = land.elements
+        .filter((e) => mine(e.id) && !properAncestorIds(e.id).some(mine))
+        .map((e) => ({
         id: e.id,
         title: e.title,
         kind: e.kind,
         tags: e.tags,
         bound: e.service !== undefined,
     }));
-    // One resolver for the whole scan, built with the real service ids: an edge
-    // drawn into a modelled container (`paymentService.api`) is an edge into the
-    // service, and `expects` — which now decides whether this service owes an
-    // OpenAPI contract at all — has to see it. Building it once also stops the
-    // per-edge rebuild the old `serviceOf(land.elements, id)` call did.
-    const svcOf = serviceResolver(land.elements, await knownServices(docsDir));
     const inbound = [];
     const outbound = [];
+    // An edge whose BOTH endpoints resolve here is the service's own internal
+    // wiring: filed as inbound it made the service its own caller (verification
+    // 2026-09-04). It still TOUCHES the service, so `touched` below reads the
+    // relationships rather than these lists — the isolation check counts either
+    // endpoint, and the two predicates must not disagree.
+    const self = (r) => mine(r.source) && mine(r.target);
     for (const r of land.relationships) {
+        if (self(r))
+            continue;
         const edge = { op: r.op ?? null, title: r.title ?? null };
-        if (svcOf(r.target) === service)
+        if (mine(r.target))
             inbound.push({ from: svcOf(r.source), ...edge });
-        else if (svcOf(r.source) === service)
+        else if (mine(r.source))
             outbound.push({ to: svcOf(r.target), ...edge });
     }
     const expects = [...new Set(inbound.map((e) => e.op).filter((op) => op !== null))];
+    const modelled = land.elements.some((e) => mine(e.id));
+    const touched = modelled ? land.relationships.some((r) => mine(r.source) || mine(r.target)) : null;
+    const attested = touched === false && existsSync(paths.model) ? await attestedFrom(docsDir, paths, service, known) : [];
+    const req = {
+        service,
+        expects,
+        servicePath,
+        attested,
+        foreignTags: foreignTagsOf(elements),
+        elementId: elements[0]?.id,
+        // The one graded tag that changes what the brief may PROMISE: an `#external`
+        // element is never `landscape.service-isolated`'s subject. Off the same
+        // element `elementId` names, never the union.
+        external: elements[0]?.tags.includes(EXTERNAL_TAG) ?? false,
+    };
+    const instruction = !modelled
+        ? instructionFor({ ...req, state: "unmodelled" })
+        : touched === false
+            ? instructionFor({ ...req, state: "edgeless" })
+            : null;
     return {
         present: true,
         parses: true,
-        modelled: elements.length > 0,
+        callersKnown: true,
+        modelled,
         elements,
         inbound,
         outbound,
         expects,
-        instruction: elements.length > 0 ? null : instructionFor(service, "unmodelled", expects, servicePath),
+        touched,
+        attested,
+        instruction,
     };
 }
 /**
- * The fleet-map instruction, in the three states a landscape can be in.
+ * The operations the fleet already calls on this service, read off the landscape
+ * FILE alone — `null` when that file cannot be read either.
  *
- * It says the file, the block, and the consequence, in that order. The
- * consequence is the part agents acted on: "add an element" reads as tidiness,
- * "until you do, `loam validate --all` fails and no cross-service check can see
- * this service" reads as work.
+ * The fallback for an `architecture/` project that does not parse, and the
+ * narrowest one that can be justified: it answers ONE question, the one `loam
+ * list` and `loam context` answer off the same bytes (`landscapeEvidence`,
+ * core/vocabulary/maturity.ts). "Nothing calls this service" and "loam could not
+ * tell" are different answers, and only the first may switch an API contract
+ * off, which is why the empty list and the unreadable file are told apart here
+ * rather than collapsed to `[]`.
  */
-function instructionFor(service, state, expects, servicePath) {
-    const id = elementIdFor(service);
-    const bind = `an element bound with \`metadata { service '${service}' }\``;
-    const consequence = `Until one resolves, \`loam validate --all\` reports \`landscape.service-unmodelled\` (error) for ` +
-        `${servicePath}/: the service is documented and invisible — no edge into it can be checked ` +
-        `against its openapi.yaml, and no feature can draw a call to it.`;
-    // `expects` is reachable only through elements that already resolve to this
-    // service, so it is empty in every state that produces an instruction. It is
-    // threaded through anyway rather than dropped: the caller computes it once,
-    // and the day an unmodelled service can inherit an edge (a container-level
-    // binding, say) the sentence is already here instead of being noticed missing.
-    const owed = expects.length > 0
-        ? ` The fleet already calls ${expects.map((o) => `'${o}'`).join(", ")} on this service, so those edges exist; your element is what they will resolve to.`
-        : "";
-    if (state === "absent") {
-        return (`architecture/landscape.likec4 does not exist yet. Create it with a \`specification { ... }\` block ` +
-            `declaring the kinds you use and a \`model { ... }\` block containing ${bind} ` +
-            `(conventionally \`${id} = softwareSystem '${service}'\`), plus one edge per cross-service call, each ` +
-            `carrying \`metadata { op '<operationId>' }\`. ${consequence}${owed}`);
+async function expectsFromFile(path, service, known) {
+    try {
+        const doc = await loadFile(path);
+        if (doc.errors.length > 0)
+            return null;
+        const svcOf = serviceResolver(doc.elements, known);
+        const ops = doc.relationships
+            .filter((r) => svcOf(r.target) === service)
+            .map((r) => r.op)
+            .filter((op) => op !== undefined);
+        return [...new Set(ops)];
     }
-    if (state === "unparseable") {
-        return (`architecture/landscape.likec4 exists but does not parse (\`landscape.invalid\`), so nothing can be said ` +
-            `about what it already models. Fix the parse errors first — they blind every cross-service check at once — ` +
-            `then make sure it holds ${bind}. ${consequence}`);
+    catch {
+        return null;
     }
-    return (`Nothing in architecture/landscape.likec4 resolves to ${servicePath}/. ADD to that file — do not rewrite ` +
-        `it, every other service's map is in there — ${bind}, conventionally ` +
-        `\`${id} = softwareSystem '${service}'\`, inside the existing \`model { ... }\` block, and draw each ` +
-        `cross-service call as an edge carrying \`metadata { op '<operationId>' }\`. ${consequence}${owed}`);
 }
 //# sourceMappingURL=landscape.js.map