@ybotok/loam 0.2.0-alpha.7 → 0.2.0-alpha.9

package/dist/commands/validate/checks/requirements.js.map

@@ -1 +1 @@
-{"version":3,"file":"requirements.js","sourceRoot":"","sources":["../../../../src/commands/validate/checks/requirements.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAgB,MAAM,oCAAoC,CAAC;AAClE,OAAO,EAAE,4BAA4B,EAAE,MAAM,qCAAqC,CAAC;AACnF,OAAO,EAAE,qBAAqB,EAAoB,MAAM,gCAAgC,CAAC;AACzF,OAAO,EACL,QAAQ,EACR,gBAAgB,EAChB,aAAa,EACb,gBAAgB,GAGjB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAmB,MAAM,0CAA0C,CAAC;AAC3E,OAAO,EAAkB,MAAM,8BAA8B,CAAC;AAE9D,8FAA8F;AAC9F,MAAM,UAAU,aAAa,CAAC,IAAmB;IAC/C,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC;AACjG,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,4BAA4B,CAAC,IAAmB,EAAE,KAAa,EAAE,OAAe;IAC9F,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,IAAI;QAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACxE,OAAO,CAAC,GAAG,MAAM,CAAC;SACf,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;SACxB,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACnB,QAAQ,EAAE,OAAgB;QAC1B,IAAI,EAAE,4BAA4B;QAClC,OAAO;QACP,OAAO,EAAE,GAAG,KAAK,kBAAkB,IAAI,gBAAgB,CAAC,0FAA0F;KACnJ,CAAC,CAAC,CAAC;AACR,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,qBAAqB,CAAC,IAAmB,EAAE,KAAa,EAAE,OAAe;IACvF,OAAO,qBAAqB,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;QACjD,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO;gBACL,QAAQ,EAAE,OAAgB;gBAC1B,IAAI,EAAE,6BAA6B;gBACnC,OAAO;gBACP,OAAO,EAAE,GAAG,KAAK,kBAAkB,OAAO,CAAC,WAAW,iCAAiC,OAAO,CAAC,KAAK,2DAA2D;aAChK,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAChC,OAAO;gBACL,QAAQ,EAAE,OAAgB;gBAC1B,IAAI,EAAE,8BAA8B;gBACpC,OAAO;gBACP,OAAO,EAAE,GAAG,KAAK,kBAAkB,OAAO,CAAC,WAAW,6BAA6B,OAAO,CAAC,MAAM,CAAC,MAAM,iDAAiD;aAC1J,CAAC;QACJ,CAAC;QACD,OAAO;YACL,QAAQ,EAAE,OAAgB;YAC1B,IAAI,EAAE,+BAA+B;YACrC,OAAO;YACP,OAAO,EAAE,GAAG,KAAK,qBAAqB,OAAO,CAAC,EAAE,kBAAkB,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,6CAA6C;SAC1K,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,kBAAkB,GAAG,+BAA+B,CAAC;AAC3D,MAAM,cAAc,GAAG,2BAA2B,CAAC;AAEnD;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAAmB,EAAE,KAAa,EAAE,OAAe;IAC1F,MAAM,GAAG,GAAc,EAAE,CAAC;IAC1B,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS;YAAE,SAAS;QACnC,KAAK,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI;YAChC,EAAE,EAAE,EAAE,kBAAkB,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,0BAA0B,EAAE;YAClF,EAAE,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,sBAAsB,EAAE;SACvE,EAAE,CAAC;YACF,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;YACxD,IAAI,CAAC,GAAG,CAAC;gBAAE,SAAS;YACpB,GAAG,CAAC,IAAI,CAAC;gBACP,QAAQ,EAAE,MAAM;gBAChB,IAAI;gBACJ,OAAO;gBACP,OAAO,EAAE,GAAG,KAAK,kBAAkB,CAAC,CAAC,IAAI,SAAS,CAAC,KAAK,KAAK,8IAA8I;aAC5M,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAiBD,MAAM,UAAU,qBAAqB,CACnC,IAAmB,EACnB,MAAsB,EACtB,KAAoB,EACpB,gBAAgB,GAAG,KAAK;IAExB,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC;IAClC,MAAM,GAAG,GAAc,EAAE,CAAC;IAC1B,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS;YAAE,SAAS;QACnC,KAAK,MAAM,GAAG,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;YAC3B,MAAM,KAAK,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;YACpC,IAAI,gBAAgB,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC;gBAAE,SAAS;YACnF,IAAI,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC;gBAAE,SAAS;YAC1C,MAAM,KAAK,GAAG,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YAC7C,GAAG,CAAC,IAAI,CAAC;gBACP,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,gBAAgB;gBACtB,OAAO;gBACP,OAAO,EACL,GAAG,KAAK,kBAAkB,CAAC,CAAC,IAAI,gBAAgB,GAAG,uBAAuB;oBAC1E,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;wBACf,CAAC,CAAC,mBAAmB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;wBACxC,CAAC,CAAC,6CAA6C,CAAC;aACrD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,uBAAuB,CACrC,IAAmB,EACnB,MAAsB,EACtB,UAAsB;IAEtB,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC;IAClC,IAAI,UAAU,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAChD,MAAM,KAAK,GAAG,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAc,EAAE,CAAC;IAC1B,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS;YAAE,SAAS;QACnC,KAAK,MAAM,GAAG,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;YAC7B,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YACvC,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACnC,GAAG,CAAC,IAAI,CAAC;gBACP,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,qBAAqB;gBAC3B,OAAO;gBACP,OAAO,EACL,GAAG,KAAK,kBAAkB,CAAC,CAAC,IAAI,kBAAkB,GAAG,oDAAoD;oBACzG,CAAC,CAAC,UAAU,CAAC,OAAO;wBAClB,CAAC,CAAC,uJAAuJ;wBACzJ,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;4BAChB,CAAC,CAAC,mBAAmB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;4BACxC,CAAC,CAAC,+EAA+E,CAAC;aACzF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,0BAA0B,CACxC,OAAe,EACf,GAAgB,EAChB,UAAyB;IAEzB,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;QACrB,IAAI,EAAE,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAC3C,MAAM,SAAS,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QACjG,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACrC,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtF,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,WAAW,IAAI,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACnG,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACvC,OAAO;QACL;YACE,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EAAE,OAAO;YAChB,OAAO,EAAE,GAAG,OAAO,KAAK,UAAU,CAAC,MAAM,oHAAoH;YAC7J,OAAO,EAAE,UAAU;SACpB;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAa,EAAE,IAAmB;IAChE,MAAM,OAAO,GAAG,4BAA4B,CAAC,IAAI,CAAC,CAAC;IACnD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO;YACL,QAAQ,EAAE,IAAI;YACd,IAAI,EAAE,sBAAsB;YAC5B,OAAO,EAAE,GAAG,KAAK,aAAa,IAAI,CAAC,MAAM,eAAe,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,uBAAuB;SAC5G,CAAC;IACJ,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,OAAO;QACjB,IAAI,EAAE,gCAAgC;QACtC,OAAO,EAAE,GAAG,KAAK,KAAK,OAAO,CAAC,MAAM,oCAAoC;QACxE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACnC,IAAI,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE;KAC7B,CAAC;AACJ,CAAC","sourcesContent":["/**\n * What a requirement document owes, checked the same way wherever it lives.\n *\n * The same `### Requirement:` grammar is authored in four places — a service's\n * spec.md and arch.spec.md, and a feature's per-service deltas of both — and\n * every breach below carries from a delta into the living document through the\n * archive merge. So the checks are one set called from both target kinds\n * (`service/` and `feature/`): grading a delta more leniently than the file it\n * is about to become is how a defect acquires a signature saying it was\n * reviewed.\n *\n * None of these read the filesystem and none of them print — they take parsed\n * requirements and answer in findings.\n */\nimport { type Finding } from \"../../../core/vocabulary/report.js\";\nimport { requirementsMissingScenarios } from \"../../../core/document/scenarios.js\";\nimport { requirementIdProblems, type Requirement } from \"../../../core/document/spec.js\";\nimport {\n  closeIds,\n  coversCandidates,\n  entryResolves,\n  parseCoversEntry,\n  type CoverageScope,\n  type CoversEntry,\n} from \"../../../core/c4/arch.js\";\nimport { type Vocabulary } from \"../../../core/permissions/permissions.js\";\nimport { type Operation } from \"../../../core/openapi/doc.js\";\n\n/** The parsed Covers entries of every requirement that will live (REMOVED covers nothing). */\nexport function coversEntries(reqs: Requirement[]): CoversEntry[] {\n  return reqs.filter((r) => r.kind !== \"REMOVED\").flatMap((r) => r.covers.map(parseCoversEntry));\n}\n\n/**\n * `spec.duplicate-requirement` — two `### Requirement:` blocks with one name in\n * one LIVING document. Nothing else catches it, and the merge algebra\n * (applyRequirementDelta) matches by name and edits only the FIRST match: a\n * later archive rewrites one copy and the other survives as a stale snapshot\n * of whatever the requirement used to say. Per file on purpose — spec.md and\n * arch.spec.md are separate requirement namespaces (their merges never cross\n * files), so one name appearing in both is legal and unflagged.\n */\nexport function duplicateRequirementFindings(reqs: Requirement[], where: string, subject: string): Finding[] {\n  const counts = new Map<string, number>();\n  for (const r of reqs) counts.set(r.name, (counts.get(r.name) ?? 0) + 1);\n  return [...counts]\n    .filter(([, n]) => n > 1)\n    .map(([name, n]) => ({\n      severity: \"error\" as const,\n      code: \"spec.duplicate-requirement\",\n      subject,\n      message: `${where}: requirement '${name}' is defined ${n} times — a merge edits only the first, every other copy lives on stale; keep exactly one`,\n    }));\n}\n\n/** Stable IDs are optional, but once authored they must select exactly one requirement. */\nexport function requirementIdFindings(reqs: Requirement[], where: string, subject: string): Finding[] {\n  return requirementIdProblems(reqs).map((problem) => {\n    if (problem.kind === \"invalid\") {\n      return {\n        severity: \"error\" as const,\n        code: \"spec.requirement-id-invalid\",\n        subject,\n        message: `${where}: requirement '${problem.requirement}' has invalid Requirement-ID '${problem.value}' — use 1-128 characters matching [A-Za-z][A-Za-z0-9._-]*`,\n      };\n    }\n    if (problem.kind === \"repeated\") {\n      return {\n        severity: \"error\" as const,\n        code: \"spec.requirement-id-repeated\",\n        subject,\n        message: `${where}: requirement '${problem.requirement}' declares Requirement-ID ${problem.values.length} times — identity must be declared exactly once`,\n      };\n    }\n    return {\n      severity: \"error\" as const,\n      code: \"spec.requirement-id-duplicate\",\n      subject,\n      message: `${where}: Requirement-ID '${problem.id}' is shared by ${problem.requirements.map((name) => `'${name}'`).join(\", \")} — one ID may identify only one requirement`,\n    };\n  });\n}\n\n/**\n * The two list lines of the requirement grammar, exactly as core/document/spec.ts spells\n * them (mirrored here, not exported from there, because the parser's grammar is\n * its own; a drift shows up as this check counting differently than the parser\n * assigns). A SECOND matching line in one requirement body REPLACES the first —\n * assignment, not append, the documented keep-last quirk — so the author's\n * \"long list in two lines\" pattern silently loses its first line.\n */\nconst OPERATIONS_LINE_RE = /^\\s*Operations?:\\s*(.+?)\\s*$/i;\nconst COVERS_LINE_RE = /^\\s*Covers?:\\s*(.+?)\\s*$/i;\n\n/**\n * `spec.repeated-operations` / `spec.repeated-covers` — warn on the silent\n * loss, keep the keep-last semantics (changing them would re-read every spec\n * in the fleet). Scenario bodies never count: the parser only assigns from the\n * requirement's own body lines, and `Requirement.text` is exactly those.\n * REMOVED requirements are exempt the way coversEntries exempts them — content\n * on its way out obliges nothing.\n */\nexport function repeatedListLineFindings(reqs: Requirement[], where: string, subject: string): Finding[] {\n  const out: Finding[] = [];\n  for (const r of reqs) {\n    if (r.kind === \"REMOVED\") continue;\n    for (const { re, label, code } of [\n      { re: OPERATIONS_LINE_RE, label: \"Operations:\", code: \"spec.repeated-operations\" },\n      { re: COVERS_LINE_RE, label: \"Covers:\", code: \"spec.repeated-covers\" },\n    ]) {\n      const n = r.text.filter((line) => re.test(line)).length;\n      if (n < 2) continue;\n      out.push({\n        severity: \"warn\",\n        code,\n        subject,\n        message: `${where}: requirement '${r.name}' has ${n} '${label}' lines — the last REPLACES the others (assignment, not append), the earlier list is silently lost; merge them into one comma-separated line`,\n      });\n    }\n  }\n  return out;\n}\n\n/**\n * `covers.unknown` — the typo guard on the Covers: line. Warn, not error: the\n * axis is advisory end to end, and a wrong id already costs its author the\n * coverage they wrote the line for. The hint offers only real ids (closeIds's\n * rule), and says where resolution looked when there is nothing close.\n * `healthUnreadable` mutes the alert:/sli: forms only: against a health.yaml\n * nobody could read, \"did you mean\" is a false diagnosis of a typo —\n * health.invalid (emitted by the service target) is the honest one.\n */\n/** Which document is being graded, and under whose name the finding is filed. */\nexport interface CoverageTarget {\n  where: string;\n  subject: string;\n}\n\nexport function coversUnknownFindings(\n  reqs: Requirement[],\n  target: CoverageTarget,\n  scope: CoverageScope,\n  healthUnreadable = false,\n): Finding[] {\n  const { where, subject } = target;\n  const out: Finding[] = [];\n  for (const r of reqs) {\n    if (r.kind === \"REMOVED\") continue;\n    for (const raw of r.covers) {\n      const entry = parseCoversEntry(raw);\n      if (healthUnreadable && (entry.form === \"alert\" || entry.form === \"sli\")) continue;\n      if (entryResolves(entry, scope)) continue;\n      const close = coversCandidates(entry, scope);\n      out.push({\n        severity: \"warn\",\n        code: \"covers.unknown\",\n        subject,\n        message:\n          `${where}: requirement '${r.name}' — Covers: '${raw}' resolves to nothing` +\n          (close.length > 0\n            ? `. Did you mean: ${close.join(\", \")}?`\n            : \" in the model, the landscape or health.yaml\"),\n      });\n    }\n  }\n  return out;\n}\n\n/**\n * `permissions.unknown` — the typo guard on the `Requires:` line, and an ERROR\n * where its `Covers:` sibling is a warning.\n *\n * The two differ because what they promise differs. `Covers:` is advisory end\n * to end: a wrong id costs its author the coverage they wrote the line for and\n * nothing else. `Requires:` names authorization the service actually enforces,\n * and the failure it guards is the one an unaided reader cannot see — an\n * invented permission reads exactly like a real one, in the requirement, in the\n * generated scenario, and in the test somebody then writes against it. Its\n * grade is `Operations:`', not `Covers:`'.\n *\n * Silent on ONE case only: an unreadable vocabulary, where\n * `permissions.invalid` is the honest finding and grading every entry against a\n * file nobody could parse is the false cascade `healthUnreadable` exists to\n * stop one axis over. A MISSING vocabulary is not that case — the `Requires:`\n * line is itself the opt-in, and a line that resolves against nothing while\n * reading like a join is the failure this whole axis exists to prevent.\n */\nexport function requiresUnknownFindings(\n  reqs: Requirement[],\n  target: CoverageTarget,\n  vocabulary: Vocabulary,\n): Finding[] {\n  const { where, subject } = target;\n  if (vocabulary.invalid !== undefined) return [];\n  const known = [...vocabulary.byId.keys()];\n  const out: Finding[] = [];\n  for (const r of reqs) {\n    if (r.kind === \"REMOVED\") continue;\n    for (const raw of r.requires) {\n      if (vocabulary.byId.has(raw)) continue;\n      const close = closeIds(raw, known);\n      out.push({\n        severity: \"error\",\n        code: \"permissions.unknown\",\n        subject,\n        message:\n          `${where}: requirement '${r.name}' — Requires: '${raw}' is not declared in architecture/permissions.yaml` +\n          (!vocabulary.present\n            ? \", which does not exist. The `Requires:` line is the opt-in: create the fleet vocabulary with this permission under its subject kind, or drop the line\"\n            : close.length > 0\n              ? `. Did you mean: ${close.join(\", \")}?`\n              : \". Entries are '<subject>/<permission>'; declare it there, or fix the spelling\"),\n      });\n    }\n  }\n  return out;\n}\n\n/**\n * `api.response-ungoverned` — a declared 4xx/5xx response no scenario reaches.\n *\n * The gap this closes is the one a whole adoption can fall into: `api.ungoverned`\n * grades OPERATIONS against requirements, so an endpoint with one happy-path\n * requirement and twelve declared failure codes is fully governed by every\n * check loam had. The refusals are where a service's decision layer surfaces —\n * a permission denied, a field combination rejected, a state that forbids the\n * transition — and the contract is the only artifact in the corpus that already\n * enumerates them.\n *\n * A scenario \"reaches\" a code when the code appears as a standalone number\n * anywhere in its body, `Examples` rows included — which is why this arrived\n * with outline support and not before: a status column is exactly where a\n * matrix puts its codes, and before it those rows were prose in a description.\n * The match is textual and therefore generous by design. It answers \"did\n * anybody write this case down\", not \"is this scenario correct\", and the\n * failure it is built to catch is the code nobody mentioned at all. Warn, like\n * its sibling: a service may legitimately declare a code its scenarios describe\n * in words, and an error would teach authors to paste numbers into prose.\n *\n * Operations no requirement governs are skipped: `api.ungoverned` already\n * names those, and reporting each of their codes as well is one defect\n * counted twice.\n */\nexport function responseGovernanceFindings(\n  service: string,\n  ops: Operation[],\n  livingReqs: Requirement[],\n): Finding[] {\n  const ungoverned: string[] = [];\n  for (const op of ops) {\n    if (op.failureCodes.length === 0) continue;\n    const governing = livingReqs.filter((r) => r.kind !== \"REMOVED\" && r.operations.includes(op.id));\n    if (governing.length === 0) continue;\n    const body = governing.flatMap((r) => r.scenarios.flatMap((s) => s.lines)).join(\"\\n\");\n    const missing = op.failureCodes.filter((code) => !new RegExp(`(?<!\\\\d)${code}(?!\\\\d)`).test(body));\n    if (missing.length > 0) ungoverned.push(`${op.id}: ${missing.join(\", \")}`);\n  }\n  if (ungoverned.length === 0) return [];\n  return [\n    {\n      severity: \"warn\",\n      code: \"api.response-ungoverned\",\n      subject: service,\n      message: `${service}: ${ungoverned.length} operation(s) declare a failure response no scenario reaches — write the refusal as a scenario, or as a row in one`,\n      details: ungoverned,\n    },\n  ];\n}\n\nexport function coverageFinding(label: string, reqs: Requirement[]): Finding {\n  const missing = requirementsMissingScenarios(reqs);\n  if (missing.length === 0) {\n    return {\n      severity: \"ok\",\n      code: \"requirements.covered\",\n      message: `${label} covered (${reqs.length} requirement${reqs.length === 1 ? \"\" : \"s\"}, all with scenarios)`,\n    };\n  }\n  return {\n    severity: \"error\",\n    code: \"requirements.missing-scenarios\",\n    message: `${label}: ${missing.length} requirement(s) without a scenario`,\n    details: missing.map((r) => r.name),\n    text: { detailPrefix: \"- \" },\n  };\n}\n"]}
+{"version":3,"file":"requirements.js","sourceRoot":"","sources":["../../../../src/commands/validate/checks/requirements.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAgB,MAAM,oCAAoC,CAAC;AAClE,OAAO,EACL,qBAAqB,EACrB,gBAAgB,EAChB,uBAAuB,EACvB,4BAA4B,EAC5B,gBAAgB,GACjB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,qBAAqB,EAAoB,MAAM,gCAAgC,CAAC;AACzF,OAAO,EACL,QAAQ,EACR,gBAAgB,EAChB,aAAa,EACb,gBAAgB,GAGjB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAmB,MAAM,0CAA0C,CAAC;AAC3E,OAAO,EAAkB,MAAM,8BAA8B,CAAC;AAE9D,8FAA8F;AAC9F,MAAM,UAAU,aAAa,CAAC,IAAmB;IAC/C,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC;AACjG,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,4BAA4B,CAAC,IAAmB,EAAE,KAAa,EAAE,OAAe;IAC9F,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,IAAI;QAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACxE,OAAO,CAAC,GAAG,MAAM,CAAC;SACf,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;SACxB,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACnB,QAAQ,EAAE,OAAgB;QAC1B,IAAI,EAAE,4BAA4B;QAClC,OAAO;QACP,OAAO,EAAE,GAAG,KAAK,kBAAkB,IAAI,gBAAgB,CAAC,0FAA0F;KACnJ,CAAC,CAAC,CAAC;AACR,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,qBAAqB,CAAC,IAAmB,EAAE,KAAa,EAAE,OAAe;IACvF,OAAO,qBAAqB,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;QACjD,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO;gBACL,QAAQ,EAAE,OAAgB;gBAC1B,IAAI,EAAE,6BAA6B;gBACnC,OAAO;gBACP,OAAO,EAAE,GAAG,KAAK,kBAAkB,OAAO,CAAC,WAAW,iCAAiC,OAAO,CAAC,KAAK,2DAA2D;aAChK,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAChC,OAAO;gBACL,QAAQ,EAAE,OAAgB;gBAC1B,IAAI,EAAE,8BAA8B;gBACpC,OAAO;gBACP,OAAO,EAAE,GAAG,KAAK,kBAAkB,OAAO,CAAC,WAAW,6BAA6B,OAAO,CAAC,MAAM,CAAC,MAAM,iDAAiD;aAC1J,CAAC;QACJ,CAAC;QACD,OAAO;YACL,QAAQ,EAAE,OAAgB;YAC1B,IAAI,EAAE,+BAA+B;YACrC,OAAO;YACP,OAAO,EAAE,GAAG,KAAK,qBAAqB,OAAO,CAAC,EAAE,kBAAkB,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,6CAA6C;SAC1K,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,kBAAkB,GAAG,+BAA+B,CAAC;AAC3D,MAAM,cAAc,GAAG,2BAA2B,CAAC;AAEnD;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAAmB,EAAE,KAAa,EAAE,OAAe;IAC1F,MAAM,GAAG,GAAc,EAAE,CAAC;IAC1B,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS;YAAE,SAAS;QACnC,KAAK,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI;YAChC,EAAE,EAAE,EAAE,kBAAkB,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,0BAA0B,EAAE;YAClF,EAAE,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,sBAAsB,EAAE;SACvE,EAAE,CAAC;YACF,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;YACxD,IAAI,CAAC,GAAG,CAAC;gBAAE,SAAS;YACpB,GAAG,CAAC,IAAI,CAAC;gBACP,QAAQ,EAAE,MAAM;gBAChB,IAAI;gBACJ,OAAO;gBACP,OAAO,EAAE,GAAG,KAAK,kBAAkB,CAAC,CAAC,IAAI,SAAS,CAAC,KAAK,KAAK,8IAA8I;aAC5M,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAiBD,MAAM,UAAU,qBAAqB,CACnC,IAAmB,EACnB,MAAsB,EACtB,KAAoB,EACpB,gBAAgB,GAAG,KAAK;IAExB,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC;IAClC,MAAM,GAAG,GAAc,EAAE,CAAC;IAC1B,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS;YAAE,SAAS;QACnC,KAAK,MAAM,GAAG,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;YAC3B,MAAM,KAAK,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;YACpC,IAAI,gBAAgB,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC;gBAAE,SAAS;YACnF,IAAI,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC;gBAAE,SAAS;YAC1C,MAAM,KAAK,GAAG,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YAC7C,GAAG,CAAC,IAAI,CAAC;gBACP,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,gBAAgB;gBACtB,OAAO;gBACP,OAAO,EACL,GAAG,KAAK,kBAAkB,CAAC,CAAC,IAAI,gBAAgB,GAAG,uBAAuB;oBAC1E,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;wBACf,CAAC,CAAC,mBAAmB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;wBACxC,CAAC,CAAC,6CAA6C,CAAC;aACrD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,uBAAuB,CACrC,IAAmB,EACnB,MAAsB,EACtB,UAAsB;IAEtB,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC;IAClC,IAAI,UAAU,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAChD,MAAM,KAAK,GAAG,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAc,EAAE,CAAC;IAC1B,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS;YAAE,SAAS;QACnC,KAAK,MAAM,GAAG,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;YAC7B,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YACvC,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACnC,GAAG,CAAC,IAAI,CAAC;gBACP,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,qBAAqB;gBAC3B,OAAO;gBACP,OAAO,EACL,GAAG,KAAK,kBAAkB,CAAC,CAAC,IAAI,kBAAkB,GAAG,oDAAoD;oBACzG,CAAC,CAAC,UAAU,CAAC,OAAO;wBAClB,CAAC,CAAC,uJAAuJ;wBACzJ,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;4BAChB,CAAC,CAAC,mBAAmB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;4BACxC,CAAC,CAAC,+EAA+E,CAAC;aACzF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,0BAA0B,CACxC,OAAe,EACf,GAAgB,EAChB,UAAyB;IAEzB,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;QACrB,IAAI,EAAE,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAC3C,MAAM,SAAS,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QACjG,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACrC,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtF,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,WAAW,IAAI,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACnG,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACvC,OAAO;QACL;YACE,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EAAE,OAAO;YAChB,OAAO,EAAE,GAAG,OAAO,KAAK,UAAU,CAAC,MAAM,oHAAoH;YAC7J,OAAO,EAAE,UAAU;SACpB;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAa,EAAE,IAAmB;IAChE,MAAM,OAAO,GAAG,4BAA4B,CAAC,IAAI,CAAC,CAAC;IACnD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO;YACL,QAAQ,EAAE,IAAI;YACd,IAAI,EAAE,sBAAsB;YAC5B,OAAO,EAAE,GAAG,KAAK,aAAa,IAAI,CAAC,MAAM,eAAe,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,uBAAuB;SAC5G,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,GAAG,uBAAuB,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE,CAAC;AACtF,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAa,EAAE,OAAe,EAAE,IAAmB;IACvF,OAAO;QACL,GAAG,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC;QACzC,GAAG,qBAAqB,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC;QAC9C,GAAG,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC;KAC1C,CAAC;AACJ,CAAC","sourcesContent":["/**\n * What a requirement document owes, checked the same way wherever it lives.\n *\n * The same `### Requirement:` grammar is authored in four places — a service's\n * spec.md and arch.spec.md, and a feature's per-service deltas of both — and\n * every breach below carries from a delta into the living document through the\n * archive merge. So the checks are one set called from both target kinds\n * (`service/` and `feature/`): grading a delta more leniently than the file it\n * is about to become is how a defect acquires a signature saying it was\n * reviewed.\n *\n * None of these read the filesystem and none of them print — they take parsed\n * requirements and answer in findings.\n */\nimport { type Finding } from \"../../../core/vocabulary/report.js\";\nimport {\n  assertionlessFindings,\n  examplesFindings,\n  missingScenariosFinding,\n  requirementsMissingScenarios,\n  steplessFindings,\n} from \"../../../core/document/scenarios.js\";\nimport { requirementIdProblems, type Requirement } from \"../../../core/document/spec.js\";\nimport {\n  closeIds,\n  coversCandidates,\n  entryResolves,\n  parseCoversEntry,\n  type CoverageScope,\n  type CoversEntry,\n} from \"../../../core/c4/arch.js\";\nimport { type Vocabulary } from \"../../../core/permissions/permissions.js\";\nimport { type Operation } from \"../../../core/openapi/doc.js\";\n\n/** The parsed Covers entries of every requirement that will live (REMOVED covers nothing). */\nexport function coversEntries(reqs: Requirement[]): CoversEntry[] {\n  return reqs.filter((r) => r.kind !== \"REMOVED\").flatMap((r) => r.covers.map(parseCoversEntry));\n}\n\n/**\n * `spec.duplicate-requirement` — two `### Requirement:` blocks with one name in\n * one LIVING document. Nothing else catches it, and the merge algebra\n * (applyRequirementDelta) matches by name and edits only the FIRST match: a\n * later archive rewrites one copy and the other survives as a stale snapshot\n * of whatever the requirement used to say. Per file on purpose — spec.md and\n * arch.spec.md are separate requirement namespaces (their merges never cross\n * files), so one name appearing in both is legal and unflagged.\n */\nexport function duplicateRequirementFindings(reqs: Requirement[], where: string, subject: string): Finding[] {\n  const counts = new Map<string, number>();\n  for (const r of reqs) counts.set(r.name, (counts.get(r.name) ?? 0) + 1);\n  return [...counts]\n    .filter(([, n]) => n > 1)\n    .map(([name, n]) => ({\n      severity: \"error\" as const,\n      code: \"spec.duplicate-requirement\",\n      subject,\n      message: `${where}: requirement '${name}' is defined ${n} times — a merge edits only the first, every other copy lives on stale; keep exactly one`,\n    }));\n}\n\n/** Stable IDs are optional, but once authored they must select exactly one requirement. */\nexport function requirementIdFindings(reqs: Requirement[], where: string, subject: string): Finding[] {\n  return requirementIdProblems(reqs).map((problem) => {\n    if (problem.kind === \"invalid\") {\n      return {\n        severity: \"error\" as const,\n        code: \"spec.requirement-id-invalid\",\n        subject,\n        message: `${where}: requirement '${problem.requirement}' has invalid Requirement-ID '${problem.value}' — use 1-128 characters matching [A-Za-z][A-Za-z0-9._-]*`,\n      };\n    }\n    if (problem.kind === \"repeated\") {\n      return {\n        severity: \"error\" as const,\n        code: \"spec.requirement-id-repeated\",\n        subject,\n        message: `${where}: requirement '${problem.requirement}' declares Requirement-ID ${problem.values.length} times — identity must be declared exactly once`,\n      };\n    }\n    return {\n      severity: \"error\" as const,\n      code: \"spec.requirement-id-duplicate\",\n      subject,\n      message: `${where}: Requirement-ID '${problem.id}' is shared by ${problem.requirements.map((name) => `'${name}'`).join(\", \")} — one ID may identify only one requirement`,\n    };\n  });\n}\n\n/**\n * The two list lines of the requirement grammar, exactly as core/document/spec.ts spells\n * them (mirrored here, not exported from there, because the parser's grammar is\n * its own; a drift shows up as this check counting differently than the parser\n * assigns). A SECOND matching line in one requirement body REPLACES the first —\n * assignment, not append, the documented keep-last quirk — so the author's\n * \"long list in two lines\" pattern silently loses its first line.\n */\nconst OPERATIONS_LINE_RE = /^\\s*Operations?:\\s*(.+?)\\s*$/i;\nconst COVERS_LINE_RE = /^\\s*Covers?:\\s*(.+?)\\s*$/i;\n\n/**\n * `spec.repeated-operations` / `spec.repeated-covers` — warn on the silent\n * loss, keep the keep-last semantics (changing them would re-read every spec\n * in the fleet). Scenario bodies never count: the parser only assigns from the\n * requirement's own body lines, and `Requirement.text` is exactly those.\n * REMOVED requirements are exempt the way coversEntries exempts them — content\n * on its way out obliges nothing.\n */\nexport function repeatedListLineFindings(reqs: Requirement[], where: string, subject: string): Finding[] {\n  const out: Finding[] = [];\n  for (const r of reqs) {\n    if (r.kind === \"REMOVED\") continue;\n    for (const { re, label, code } of [\n      { re: OPERATIONS_LINE_RE, label: \"Operations:\", code: \"spec.repeated-operations\" },\n      { re: COVERS_LINE_RE, label: \"Covers:\", code: \"spec.repeated-covers\" },\n    ]) {\n      const n = r.text.filter((line) => re.test(line)).length;\n      if (n < 2) continue;\n      out.push({\n        severity: \"warn\",\n        code,\n        subject,\n        message: `${where}: requirement '${r.name}' has ${n} '${label}' lines — the last REPLACES the others (assignment, not append), the earlier list is silently lost; merge them into one comma-separated line`,\n      });\n    }\n  }\n  return out;\n}\n\n/**\n * `covers.unknown` — the typo guard on the Covers: line. Warn, not error: the\n * axis is advisory end to end, and a wrong id already costs its author the\n * coverage they wrote the line for. The hint offers only real ids (closeIds's\n * rule), and says where resolution looked when there is nothing close.\n * `healthUnreadable` mutes the alert:/sli: forms only: against a health.yaml\n * nobody could read, \"did you mean\" is a false diagnosis of a typo —\n * health.invalid (emitted by the service target) is the honest one.\n */\n/** Which document is being graded, and under whose name the finding is filed. */\nexport interface CoverageTarget {\n  where: string;\n  subject: string;\n}\n\nexport function coversUnknownFindings(\n  reqs: Requirement[],\n  target: CoverageTarget,\n  scope: CoverageScope,\n  healthUnreadable = false,\n): Finding[] {\n  const { where, subject } = target;\n  const out: Finding[] = [];\n  for (const r of reqs) {\n    if (r.kind === \"REMOVED\") continue;\n    for (const raw of r.covers) {\n      const entry = parseCoversEntry(raw);\n      if (healthUnreadable && (entry.form === \"alert\" || entry.form === \"sli\")) continue;\n      if (entryResolves(entry, scope)) continue;\n      const close = coversCandidates(entry, scope);\n      out.push({\n        severity: \"warn\",\n        code: \"covers.unknown\",\n        subject,\n        message:\n          `${where}: requirement '${r.name}' — Covers: '${raw}' resolves to nothing` +\n          (close.length > 0\n            ? `. Did you mean: ${close.join(\", \")}?`\n            : \" in the model, the landscape or health.yaml\"),\n      });\n    }\n  }\n  return out;\n}\n\n/**\n * `permissions.unknown` — the typo guard on the `Requires:` line, and an ERROR\n * where its `Covers:` sibling is a warning.\n *\n * The two differ because what they promise differs. `Covers:` is advisory end\n * to end: a wrong id costs its author the coverage they wrote the line for and\n * nothing else. `Requires:` names authorization the service actually enforces,\n * and the failure it guards is the one an unaided reader cannot see — an\n * invented permission reads exactly like a real one, in the requirement, in the\n * generated scenario, and in the test somebody then writes against it. Its\n * grade is `Operations:`', not `Covers:`'.\n *\n * Silent on ONE case only: an unreadable vocabulary, where\n * `permissions.invalid` is the honest finding and grading every entry against a\n * file nobody could parse is the false cascade `healthUnreadable` exists to\n * stop one axis over. A MISSING vocabulary is not that case — the `Requires:`\n * line is itself the opt-in, and a line that resolves against nothing while\n * reading like a join is the failure this whole axis exists to prevent.\n */\nexport function requiresUnknownFindings(\n  reqs: Requirement[],\n  target: CoverageTarget,\n  vocabulary: Vocabulary,\n): Finding[] {\n  const { where, subject } = target;\n  if (vocabulary.invalid !== undefined) return [];\n  const known = [...vocabulary.byId.keys()];\n  const out: Finding[] = [];\n  for (const r of reqs) {\n    if (r.kind === \"REMOVED\") continue;\n    for (const raw of r.requires) {\n      if (vocabulary.byId.has(raw)) continue;\n      const close = closeIds(raw, known);\n      out.push({\n        severity: \"error\",\n        code: \"permissions.unknown\",\n        subject,\n        message:\n          `${where}: requirement '${r.name}' — Requires: '${raw}' is not declared in architecture/permissions.yaml` +\n          (!vocabulary.present\n            ? \", which does not exist. The `Requires:` line is the opt-in: create the fleet vocabulary with this permission under its subject kind, or drop the line\"\n            : close.length > 0\n              ? `. Did you mean: ${close.join(\", \")}?`\n              : \". Entries are '<subject>/<permission>'; declare it there, or fix the spelling\"),\n      });\n    }\n  }\n  return out;\n}\n\n/**\n * `api.response-ungoverned` — a declared 4xx/5xx response no scenario reaches.\n *\n * The gap this closes is the one a whole adoption can fall into: `api.ungoverned`\n * grades OPERATIONS against requirements, so an endpoint with one happy-path\n * requirement and twelve declared failure codes is fully governed by every\n * check loam had. The refusals are where a service's decision layer surfaces —\n * a permission denied, a field combination rejected, a state that forbids the\n * transition — and the contract is the only artifact in the corpus that already\n * enumerates them.\n *\n * A scenario \"reaches\" a code when the code appears as a standalone number\n * anywhere in its body, `Examples` rows included — which is why this arrived\n * with outline support and not before: a status column is exactly where a\n * matrix puts its codes, and before it those rows were prose in a description.\n * The match is textual and therefore generous by design. It answers \"did\n * anybody write this case down\", not \"is this scenario correct\", and the\n * failure it is built to catch is the code nobody mentioned at all. Warn, like\n * its sibling: a service may legitimately declare a code its scenarios describe\n * in words, and an error would teach authors to paste numbers into prose.\n *\n * Operations no requirement governs are skipped: `api.ungoverned` already\n * names those, and reporting each of their codes as well is one defect\n * counted twice.\n */\nexport function responseGovernanceFindings(\n  service: string,\n  ops: Operation[],\n  livingReqs: Requirement[],\n): Finding[] {\n  const ungoverned: string[] = [];\n  for (const op of ops) {\n    if (op.failureCodes.length === 0) continue;\n    const governing = livingReqs.filter((r) => r.kind !== \"REMOVED\" && r.operations.includes(op.id));\n    if (governing.length === 0) continue;\n    const body = governing.flatMap((r) => r.scenarios.flatMap((s) => s.lines)).join(\"\\n\");\n    const missing = op.failureCodes.filter((code) => !new RegExp(`(?<!\\\\d)${code}(?!\\\\d)`).test(body));\n    if (missing.length > 0) ungoverned.push(`${op.id}: ${missing.join(\", \")}`);\n  }\n  if (ungoverned.length === 0) return [];\n  return [\n    {\n      severity: \"warn\",\n      code: \"api.response-ungoverned\",\n      subject: service,\n      message: `${service}: ${ungoverned.length} operation(s) declare a failure response no scenario reaches — write the refusal as a scenario, or as a row in one`,\n      details: ungoverned,\n    },\n  ];\n}\n\nexport function coverageFinding(label: string, reqs: Requirement[]): Finding {\n  const missing = requirementsMissingScenarios(reqs);\n  if (missing.length === 0) {\n    return {\n      severity: \"ok\",\n      code: \"requirements.covered\",\n      message: `${label} covered (${reqs.length} requirement${reqs.length === 1 ? \"\" : \"s\"}, all with scenarios)`,\n    };\n  }\n  return { ...missingScenariosFinding(label, missing), text: { detailPrefix: \"- \" } };\n}\n\n/**\n * The scenario-shape run of the battery every requirement document gets, in\n * report order — stepless, assertionless, examples — spelled once for the four\n * documents the header names, so they cannot drift apart. What differs between\n * the four stays at each call site: a delta's coverage finding carries its\n * service as `subject`, a living spec.md with no requirements reports\n * `spec.no-requirements` in coverage's place, and duplicate names and\n * requirement ids are graded on LIVING documents (`duplicateRequirementFindings`).\n */\nexport function scenarioShapeFindings(label: string, subject: string, reqs: Requirement[]): Finding[] {\n  return [\n    ...steplessFindings(label, subject, reqs),\n    ...assertionlessFindings(label, subject, reqs),\n    ...examplesFindings(label, subject, reqs),\n  ];\n}\n"]}

package/dist/commands/validate/checks/sources.js

@@ -6,7 +6,6 @@ import { listField, readFrontmatter } from "../../../core/document/frontmatter.j
 import {} from "../../../core/vocabulary/report.js";
 import { missingSources, patternSources, unsafeSources } from "../../../core/provenance/sources.js";
 import { emptySourcesMessage, expandSourceFiles } from "../../../core/provenance/stamp.js";
-import { UNVERIFIABLE } from "./vocabulary.js";
 /**
  * The two things a `sources` list can be that `serviceProvenance` cannot say.
  *
@@ -45,9 +44,14 @@ export async function sourceScopeFindings(docsDir, service, repoDir, fleet) {
         // arch axis. The refusal and the finding must be the same sentence.
         const label = file === "spec.md" ? service : `${service}: ${file}`;
         if (repoDir === undefined) {
+            // A literal, as at the rollup's counting site (../report.ts), and for
+            // the reason given there: the stable-code collector reads only literal
+            // `code:` slots. This used to be a shared constant, which kept the two
+            // spellings equal but hid the emission itself from the collector — the
+            // code was guarded only because the rollup's text marker spelled it.
             out.push({
                 severity: "ok",
-                code: UNVERIFIABLE,
+                code: "sources.unverifiable-from-here",
                 subject: service,
                 message: `${label}: ${sources.length} source(s) declared, but this is not ${service}'s repository — nothing here can resolve them. Run \`loam validate --service ${service}\` from inside it.`,
             });

package/dist/commands/validate/checks/sources.js.map

@@ -1 +1 @@
-{"version":3,"file":"sources.js","sourceRoot":"","sources":["../../../../src/commands/validate/checks/sources.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAwB,MAAM,qCAAqC,CAAC;AAC3E,OAAO,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAExD,OAAO,EAAE,kBAAkB,EAAE,MAAM,sCAAsC,CAAC;AAC1E,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,uCAAuC,CAAC;AACnF,OAAO,EAAgB,MAAM,oCAAoC,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AACpG,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AAC3F,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAG/C;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAAgB,EAChB,OAAwB,EACxB,OAA2B,EAC3B,KAAoB;IAEpB,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IAChE,MAAM,GAAG,GAAc,EAAE,CAAC;IAC1B,+EAA+E;IAC/E,yEAAyE;IACzE,sEAAsE;IACtE,KAAK,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QACnG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,SAAS;QAChC,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,eAAe,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,CAAC;QAClE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACnC,0EAA0E;QAC1E,oEAAoE;QACpE,MAAM,KAAK,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,KAAK,IAAI,EAAE,CAAC;QACnE,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,GAAG,CAAC,IAAI,CAAC;gBACP,QAAQ,EAAE,IAAI;gBACd,IAAI,EAAE,YAAY;gBAClB,OAAO,EAAE,OAAO;gBAChB,OAAO,EAAE,GAAG,KAAK,KAAK,OAAO,CAAC,MAAM,wCAAwC,OAAO,gFAAgF,OAAO,oBAAoB;aAC/L,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,wEAAwE;QACxE,oEAAoE;QACpE,0EAA0E;QAC1E,IACE,cAAc,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC;YAClC,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC;YAC1C,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,EAC3C,CAAC;YACD,SAAS;QACX,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QACnE,IAAI,SAAS,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,SAAS;QACzC,GAAG,CAAC,IAAI,CAAC;YACP,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE,OAAO;YAChB,OAAO,EAAE,SAAS,CAAC,KAAK,IAAI,mBAAmB,CAAC,KAAK,EAAE,OAAO,CAAC;SAChE,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC","sourcesContent":["import { existsSync } from \"node:fs\";\nimport { type PathableService } from \"../../../core/kernel/ids/service.js\";\nimport { SPEC_AXES } from \"../../../core/repo/paths.js\";\nimport type { FleetContext } from \"../../../core/fleet-context.js\";\nimport { locateServicePaths } from \"../../../core/repo/service-target.js\";\nimport { listField, readFrontmatter } from \"../../../core/document/frontmatter.js\";\nimport { type Finding } from \"../../../core/vocabulary/report.js\";\nimport { missingSources, patternSources, unsafeSources } from \"../../../core/provenance/sources.js\";\nimport { emptySourcesMessage, expandSourceFiles } from \"../../../core/provenance/stamp.js\";\nimport { UNVERIFIABLE } from \"./vocabulary.js\";\nimport type { DocsDir } from \"../../../core/kernel/ids/dirs.js\";\n\n/**\n * The two things a `sources` list can be that `serviceProvenance` cannot say.\n *\n * `sources.unverifiable-from-here` — the spec names sources and loam is NOT in\n * that service's repository, so every sources check (existence, digest,\n * staleness) is skipped. serviceProvenance returns an empty list in that case\n * and the silence read as \"checked and fine\". It used to be counted only under\n * `--all` and printed as one rollup line, which meant `validate --service X`\n * run from the docs repo — the single most common way anyone looks at one\n * service — reported nothing at all about its own blind spot. Severity `ok`,\n * deliberately: nothing is WRONG with the docs, the check simply cannot run\n * here, and grading it a warning would make a fully documented fleet\n * permanently yellow and `--strict` permanently red in the docs repo's CI.\n *\n * `sources.empty` — the paths exist, and expand to no files at all: an empty\n * directory, or a tree the repository itself ignores. A digest over nothing\n * never changes, so the stamp would read as current forever. `loam vouch`\n * already refuses to stamp it; until now `validate` said nothing, so an author\n * got a green run followed by a refusal, two commands contradicting each other\n * about one document. The sentence comes from `emptySourcesMessage`, the same\n * definition vouch refuses with, under the label vouch uses.\n */\nexport async function sourceScopeFindings(\n  docsDir: DocsDir,\n  service: PathableService,\n  repoDir: string | undefined,\n  fleet?: FleetContext,\n): Promise<Finding[]> {\n  const paths = await locateServicePaths(docsDir, service, fleet);\n  const out: Finding[] = [];\n  // The axis pair is SPEC_AXES', not this function's: `serviceProvenance` grades\n  // the same two files from the same list, and a scope check that walked a\n  // shorter list than the grading would go quiet on the axis it forgot.\n  for (const { path, file } of SPEC_AXES.map((axis) => ({ path: paths[axis.key], file: axis.file }))) {\n    if (!existsSync(path)) continue;\n    const sources = listField(await readFrontmatter(path), \"sources\");\n    if (sources.length === 0) continue;\n    // vouch's own labelling: a bare service id for spec.md, qualified for the\n    // arch axis. The refusal and the finding must be the same sentence.\n    const label = file === \"spec.md\" ? service : `${service}: ${file}`;\n    if (repoDir === undefined) {\n      out.push({\n        severity: \"ok\",\n        code: UNVERIFIABLE,\n        subject: service,\n        message: `${label}: ${sources.length} source(s) declared, but this is not ${service}'s repository — nothing here can resolve them. Run \\`loam validate --service ${service}\\` from inside it.`,\n      });\n      continue;\n    }\n    // Every other shape of broken list is serviceProvenance's to grade, and\n    // grading them twice would send an author fixing one thing from two\n    // findings. \"Covers no files\" is only meaningful once the paths are real.\n    if (\n      patternSources(sources).length > 0 ||\n      unsafeSources(repoDir, sources).length > 0 ||\n      missingSources(repoDir, sources).length > 0\n    ) {\n      continue;\n    }\n    const expansion = await expandSourceFiles(repoDir, sources, label);\n    if (expansion.files.length > 0) continue;\n    out.push({\n      severity: \"warn\",\n      code: \"sources.empty\",\n      subject: service,\n      message: expansion.empty ?? emptySourcesMessage(label, sources),\n    });\n  }\n  return out;\n}\n"]}
+{"version":3,"file":"sources.js","sourceRoot":"","sources":["../../../../src/commands/validate/checks/sources.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAwB,MAAM,qCAAqC,CAAC;AAC3E,OAAO,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAExD,OAAO,EAAE,kBAAkB,EAAE,MAAM,sCAAsC,CAAC;AAC1E,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,uCAAuC,CAAC;AACnF,OAAO,EAAgB,MAAM,oCAAoC,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AACpG,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AAG3F;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAAgB,EAChB,OAAwB,EACxB,OAA2B,EAC3B,KAAmB;IAEnB,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IAChE,MAAM,GAAG,GAAc,EAAE,CAAC;IAC1B,+EAA+E;IAC/E,yEAAyE;IACzE,sEAAsE;IACtE,KAAK,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QACnG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,SAAS;QAChC,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,eAAe,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,CAAC;QAClE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACnC,0EAA0E;QAC1E,oEAAoE;QACpE,MAAM,KAAK,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,KAAK,IAAI,EAAE,CAAC;QACnE,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,sEAAsE;YACtE,uEAAuE;YACvE,uEAAuE;YACvE,uEAAuE;YACvE,qEAAqE;YACrE,GAAG,CAAC,IAAI,CAAC;gBACP,QAAQ,EAAE,IAAI;gBACd,IAAI,EAAE,gCAAgC;gBACtC,OAAO,EAAE,OAAO;gBAChB,OAAO,EAAE,GAAG,KAAK,KAAK,OAAO,CAAC,MAAM,wCAAwC,OAAO,gFAAgF,OAAO,oBAAoB;aAC/L,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,wEAAwE;QACxE,oEAAoE;QACpE,0EAA0E;QAC1E,IACE,cAAc,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC;YAClC,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC;YAC1C,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,EAC3C,CAAC;YACD,SAAS;QACX,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QACnE,IAAI,SAAS,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,SAAS;QACzC,GAAG,CAAC,IAAI,CAAC;YACP,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE,OAAO;YAChB,OAAO,EAAE,SAAS,CAAC,KAAK,IAAI,mBAAmB,CAAC,KAAK,EAAE,OAAO,CAAC;SAChE,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC","sourcesContent":["import { existsSync } from \"node:fs\";\nimport { type PathableService } from \"../../../core/kernel/ids/service.js\";\nimport { SPEC_AXES } from \"../../../core/repo/paths.js\";\nimport type { FleetContext } from \"../../../core/fleet-context.js\";\nimport { locateServicePaths } from \"../../../core/repo/service-target.js\";\nimport { listField, readFrontmatter } from \"../../../core/document/frontmatter.js\";\nimport { type Finding } from \"../../../core/vocabulary/report.js\";\nimport { missingSources, patternSources, unsafeSources } from \"../../../core/provenance/sources.js\";\nimport { emptySourcesMessage, expandSourceFiles } from \"../../../core/provenance/stamp.js\";\nimport type { DocsDir } from \"../../../core/kernel/ids/dirs.js\";\n\n/**\n * The two things a `sources` list can be that `serviceProvenance` cannot say.\n *\n * `sources.unverifiable-from-here` — the spec names sources and loam is NOT in\n * that service's repository, so every sources check (existence, digest,\n * staleness) is skipped. serviceProvenance returns an empty list in that case\n * and the silence read as \"checked and fine\". It used to be counted only under\n * `--all` and printed as one rollup line, which meant `validate --service X`\n * run from the docs repo — the single most common way anyone looks at one\n * service — reported nothing at all about its own blind spot. Severity `ok`,\n * deliberately: nothing is WRONG with the docs, the check simply cannot run\n * here, and grading it a warning would make a fully documented fleet\n * permanently yellow and `--strict` permanently red in the docs repo's CI.\n *\n * `sources.empty` — the paths exist, and expand to no files at all: an empty\n * directory, or a tree the repository itself ignores. A digest over nothing\n * never changes, so the stamp would read as current forever. `loam vouch`\n * already refuses to stamp it; until now `validate` said nothing, so an author\n * got a green run followed by a refusal, two commands contradicting each other\n * about one document. The sentence comes from `emptySourcesMessage`, the same\n * definition vouch refuses with, under the label vouch uses.\n */\nexport async function sourceScopeFindings(\n  docsDir: DocsDir,\n  service: PathableService,\n  repoDir: string | undefined,\n  fleet: FleetContext,\n): Promise<Finding[]> {\n  const paths = await locateServicePaths(docsDir, service, fleet);\n  const out: Finding[] = [];\n  // The axis pair is SPEC_AXES', not this function's: `serviceProvenance` grades\n  // the same two files from the same list, and a scope check that walked a\n  // shorter list than the grading would go quiet on the axis it forgot.\n  for (const { path, file } of SPEC_AXES.map((axis) => ({ path: paths[axis.key], file: axis.file }))) {\n    if (!existsSync(path)) continue;\n    const sources = listField(await readFrontmatter(path), \"sources\");\n    if (sources.length === 0) continue;\n    // vouch's own labelling: a bare service id for spec.md, qualified for the\n    // arch axis. The refusal and the finding must be the same sentence.\n    const label = file === \"spec.md\" ? service : `${service}: ${file}`;\n    if (repoDir === undefined) {\n      // A literal, as at the rollup's counting site (../report.ts), and for\n      // the reason given there: the stable-code collector reads only literal\n      // `code:` slots. This used to be a shared constant, which kept the two\n      // spellings equal but hid the emission itself from the collector — the\n      // code was guarded only because the rollup's text marker spelled it.\n      out.push({\n        severity: \"ok\",\n        code: \"sources.unverifiable-from-here\",\n        subject: service,\n        message: `${label}: ${sources.length} source(s) declared, but this is not ${service}'s repository — nothing here can resolve them. Run \\`loam validate --service ${service}\\` from inside it.`,\n      });\n      continue;\n    }\n    // Every other shape of broken list is serviceProvenance's to grade, and\n    // grading them twice would send an author fixing one thing from two\n    // findings. \"Covers no files\" is only meaningful once the paths are real.\n    if (\n      patternSources(sources).length > 0 ||\n      unsafeSources(repoDir, sources).length > 0 ||\n      missingSources(repoDir, sources).length > 0\n    ) {\n      continue;\n    }\n    const expansion = await expandSourceFiles(repoDir, sources, label);\n    if (expansion.files.length > 0) continue;\n    out.push({\n      severity: \"warn\",\n      code: \"sources.empty\",\n      subject: service,\n      message: expansion.empty ?? emptySourcesMessage(label, sources),\n    });\n  }\n  return out;\n}\n"]}

package/dist/commands/validate/feature.js

@@ -12,8 +12,7 @@
  * new architecture — is `./arch-coverage.js`.
  */
 import { existsSync } from "node:fs";
-import { readFile } from "node:fs/promises";
-import { loadFile } from "../../core/c4/likec4.js";
+import {} from "../../core/c4/likec4.js";
 import { elementService } from "../../core/c4/resolve/service.js";
 import {} from "../../core/kernel/ids/service.js";
 import {} from "../../core/repo/entries.js";
@@ -22,21 +21,19 @@ import { enumeratedServiceIds } from "../../core/repo/service-target.js";
 import { docsRepoState } from "../../core/repo/state.js";
 import { featureSpecServices, listServices } from "../../core/repo/repo.js";
 import {} from "../../core/vocabulary/report.js";
-import { parseRequirements } from "../../core/document/parse.js";
-import { assertionlessFindings, examplesFindings, steplessFindings, } from "../../core/document/scenarios.js";
 import {} from "../../core/document/spec.js";
 import { featureCoherence } from "../../core/coherence/coherence.js";
 import { deltaServiceUnknownFinding, invalidSpecServiceFindings, } from "../../core/coherence/living.js";
 import { issueFinding } from "../../core/vocabulary/issue.js";
 import { featureProvenance } from "../../core/provenance/findings.js";
 import { documentConflictFinding } from "../../core/conflict-markers.js";
-import { featureCapabilityDeltas } from "../../core/capabilities/delta/tree.js";
 import { docMissingFindings } from "../../core/capabilities/findings.js";
 import { FleetContext } from "../../core/fleet-context.js";
 import { errorText } from "../../core/c4/likec4.js";
-import { coverageFinding, repeatedListLineFindings } from "./checks/requirements.js";
+import { coverageFinding, repeatedListLineFindings, scenarioShapeFindings } from "./checks/requirements.js";
 import { deltaArchCoverage } from "./arch-coverage.js";
 import { featureLinkFindings } from "./links/corpus.js";
+import { featureRecordFindings } from "./service/evidence-pins.js";
 export async function validateFeature(docsDir, feature, preloadedLand, fleet) {
     const findings = [];
     const featureDir = feature.dir;
@@ -51,7 +48,7 @@ export async function validateFeature(docsDir, feature, preloadedLand, fleet) {
     let deltaDoc;
     const deltaPath = featurePaths(featureDir).delta;
     if (existsSync(deltaPath)) {
-        const res = fleet === undefined ? await loadFile(deltaPath) : await fleet.loadLikeC4(deltaPath);
+        const res = await fleet.loadLikeC4(deltaPath);
         deltaDoc = res;
         if (res.errors.length > 0) {
             findings.push({
@@ -74,6 +71,17 @@ export async function validateFeature(docsDir, feature, preloadedLand, fleet) {
         }
     }
     findings.push(...(await featureProvenance(featureDir, featureId)));
+    // The verification record, graded for READABILITY only — never for what it
+    // concludes. A conflict-marked or hand-broken `verification.yaml` /
+    // `verification/<svc>.yaml` was refused by `verify`, reported by `status`,
+    // `gate` and `tasks`, and invisible here: `validate --all` from the docs repo
+    // (and so the PR gate) stayed green over a record nobody can read, because
+    // the only target raising this code was the service one, which runs from a
+    // service repo. Same code and severity as that target
+    // (`./service/evidence-pins.ts`) — a warn, so `valid` and `loam archive` are
+    // untouched (verify never gates archive) and `--strict` is the lever. The
+    // verdict itself stays `verify`'s and `status`'s to state.
+    findings.push(...(await featureRecordFindings(docsDir, feature)));
     // Who this feature is allowed to address. `specs/<svc>/` is what the archive
     // materialises `services/<svc>/` from, and nothing used to ask whether that
     // name means anything: one wrong character in `--touches` passed
@@ -122,9 +130,9 @@ export async function validateFeature(docsDir, feature, preloadedLand, fleet) {
     for (const svc of featureServices) {
         const p = featureSpecPaths(featureDir, svc);
         if (existsSync(p.spec)) {
-            const raw = fleet === undefined ? await readFile(p.spec, "utf8") : await fleet.readText(p.spec);
+            const raw = await fleet.readText(p.spec);
             scenarioText += "\n" + raw.toLowerCase();
-            const reqs = fleet === undefined ? parseRequirements(raw) : await fleet.readRequirements(p.spec);
+            const reqs = await fleet.readRequirements(p.spec);
             // Both document-level breaches carry into the living spec through the
             // merge, so a delta is graded for them exactly as a living document is:
             // conflict markers merge as prose under someone's requirement, and a
@@ -134,25 +142,21 @@ export async function validateFeature(docsDir, feature, preloadedLand, fleet) {
             if (conflict !== null)
                 findings.push(conflict);
             findings.push({ ...coverageFinding(`${svc}: requirements`, reqs), subject: svc });
-            findings.push(...steplessFindings(`${svc}: requirements`, svc, reqs));
-            findings.push(...assertionlessFindings(`${svc}: requirements`, svc, reqs));
-            findings.push(...examplesFindings(`${svc}: requirements`, svc, reqs));
+            findings.push(...scenarioShapeFindings(`${svc}: requirements`, svc, reqs));
             // The keep-last quirk loses lines in a delta exactly as in a living spec
             // — and a delta's lost Operations: line then merges into the living one.
             findings.push(...repeatedListLineFindings(reqs, `${svc}: spec.md`, svc));
         }
         if (existsSync(p.archSpec)) {
-            const raw = fleet === undefined ? await readFile(p.archSpec, "utf8") : await fleet.readText(p.archSpec);
+            const raw = await fleet.readText(p.archSpec);
             scenarioText += "\n" + raw.toLowerCase();
-            const reqs = fleet === undefined ? parseRequirements(raw) : await fleet.readRequirements(p.archSpec);
+            const reqs = await fleet.readRequirements(p.archSpec);
             archDeltas.push({ service: svc, reqs });
             const conflict = documentConflictFinding(`${svc}: arch.spec.md`, svc, raw);
             if (conflict !== null)
                 findings.push(conflict);
             findings.push({ ...coverageFinding(`${svc}: arch requirements`, reqs), subject: svc });
-            findings.push(...steplessFindings(`${svc}: arch requirements`, svc, reqs));
-            findings.push(...assertionlessFindings(`${svc}: arch requirements`, svc, reqs));
-            findings.push(...examplesFindings(`${svc}: arch requirements`, svc, reqs));
+            findings.push(...scenarioShapeFindings(`${svc}: arch requirements`, svc, reqs));
             findings.push(...repeatedListLineFindings(reqs, `${svc}: arch.spec.md`, svc));
         }
     }
@@ -164,7 +168,7 @@ export async function validateFeature(docsDir, feature, preloadedLand, fleet) {
     // feature is archived, nothing walks the delta again, and the living
     // capability documents are only conflict-scanned while some feature still
     // carries a delta for them.
-    const capabilityDeltas = fleet === undefined ? await featureCapabilityDeltas(featureDir) : await fleet.featureCapabilityDeltas(featureDir);
+    const capabilityDeltas = await fleet.featureCapabilityDeltas(featureDir);
     // The half-created directory, on the FEATURE side. The living tree has warned
     // about `capabilities/<id>/` with no document since the axis landed; the same
     // `mkdir` inside `features/<FEAT>/capabilities/` earned nothing, and it is the
@@ -175,7 +179,7 @@ export async function validateFeature(docsDir, feature, preloadedLand, fleet) {
     // message spelling `features/FEAT-1/` names a path nobody can open.
     findings.push(...docMissingFindings(capabilityDeltas, feature.dirName));
     for (const doc of capabilityDeltas.docs) {
-        const raw = fleet === undefined ? await readFile(doc.spec, "utf8") : await fleet.readText(doc.spec);
+        const raw = await fleet.readText(doc.spec);
         const conflict = documentConflictFinding(`capability ${doc.id}: spec.md`, doc.id, raw);
         if (conflict !== null)
             findings.push(conflict);

package/dist/commands/validate/feature.js.map

@@ -1 +1 @@
-{"version":3,"file":"feature.js","sourceRoot":"","sources":["../../../src/commands/validate/feature.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAuC,MAAM,yBAAyB,CAAC;AACxF,OAAO,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAClE,OAAO,EAAwB,MAAM,kCAAkC,CAAC;AACxE,OAAO,EAAqB,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,EAAmC,MAAM,iCAAiC,CAAC;AAClF,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EACL,qBAAqB,EACrB,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAoB,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AACrE,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,GAC3B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAChF,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AACzE,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AACrF,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAGxD,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAAgB,EAChB,OAAqB,EACrB,aAAgC,EAChC,KAAoB;IAEpB,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC;IAC/B,MAAM,SAAS,GAAG,OAAO,CAAC,EAAE,CAAC;IAE7B,wEAAwE;IACxE,6EAA6E;IAC7E,6EAA6E;IAC7E,IAAI,SAAS,GAAW,EAAE,CAAC;IAC3B,IAAI,UAAU,GAAU,EAAE,CAAC;IAC3B,IAAI,QAAQ,GAAW,EAAE,CAAC;IAC1B,IAAI,SAAS,GAAU,EAAE,CAAC;IAC1B,IAAI,QAA+B,CAAC;IACpC,MAAM,SAAS,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC;IACjD,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAChG,QAAQ,GAAG,GAAG,CAAC;QACf,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,eAAe;gBACrB,OAAO,EAAE,oBAAoB,GAAG,CAAC,MAAM,CAAC,MAAM,WAAW;gBACzD,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC;aACnC,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;YACxB,SAAS,GAAG,GAAG,CAAC,aAAa,CAAC;YAC9B,SAAS,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;YACnE,UAAU,GAAG,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;YACzE,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,IAAI;gBACd,IAAI,EAAE,aAAa;gBACnB,OAAO,EAAE,uBAAuB,GAAG,CAAC,QAAQ,CAAC,MAAM,eAAe,GAAG,CAAC,aAAa,CAAC,MAAM,iBAAiB;aAC5G,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,iBAAiB,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC;IAEnE,6EAA6E;IAC7E,4EAA4E;IAC5E,iEAAiE;IACjE,0EAA0E;IAC1E,6EAA6E;IAC7E,8EAA8E;IAC9E,8EAA8E;IAC9E,uDAAuD;IACvD,EAAE;IACF,uEAAuE;IACvE,6EAA6E;IAC7E,wEAAwE;IACxE,0EAA0E;IAC1E,6EAA6E;IAC7E,2EAA2E;IAC3E,4EAA4E;IAC5E,0CAA0C;IAC1C,MAAM,eAAe,GAAG,MAAM,mBAAmB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACrE,MAAM,UAAU,GAAwB,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;IAC/E,MAAM,aAAa,GAAG,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC;IAC7E,MAAM,UAAU,GAAG,IAAI,GAAG,CAAS,MAAM,oBAAoB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;IAC/E,MAAM,eAAe,GAAG,aAAa;QACnC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/E,CAAC,CAAC,EAAE,CAAC;IACP,0EAA0E;IAC1E,kDAAkD;IAClD,MAAM,OAAO,GACX,eAAe,CAAC,MAAM,GAAG,CAAC,IAAI,aAAa,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,IAAI;QAChE,CAAC,CAAC,CAAC,MAAM,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,CAAC,CAAC,EAAE,CAAC;IACT,8EAA8E;IAC9E,8DAA8D;IAC9D,KAAK,MAAM,GAAG,IAAI,eAAe;QAAE,QAAQ,CAAC,IAAI,CAAC,0BAA0B,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;IAE3F,+EAA+E;IAC/E,+EAA+E;IAC/E,0EAA0E;IAC1E,+EAA+E;IAC/E,+EAA+E;IAC/E,6EAA6E;IAC7E,+DAA+D;IAC/D,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,0BAA0B,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IAExE,8EAA8E;IAC9E,oEAAoE;IACpE,IAAI,YAAY,GAAG,EAAE,CAAC;IACtB,MAAM,UAAU,GAA6D,EAAE,CAAC;IAChF,KAAK,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QAClC,MAAM,CAAC,GAAG,gBAAgB,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QAC5C,IAAI,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,MAAM,GAAG,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAChG,YAAY,IAAI,IAAI,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;YACzC,MAAM,IAAI,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACjG,sEAAsE;YACtE,wEAAwE;YACxE,qEAAqE;YACrE,oEAAoE;YACpE,yBAAyB;YACzB,MAAM,QAAQ,GAAG,uBAAuB,CAAC,GAAG,GAAG,WAAW,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;YACtE,IAAI,QAAQ,KAAK,IAAI;gBAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC/C,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,eAAe,CAAC,GAAG,GAAG,gBAAgB,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;YAClF,QAAQ,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,GAAG,GAAG,gBAAgB,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;YACtE,QAAQ,CAAC,IAAI,CAAC,GAAG,qBAAqB,CAAC,GAAG,GAAG,gBAAgB,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;YAC3E,QAAQ,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,GAAG,GAAG,gBAAgB,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;YACtE,yEAAyE;YACzE,yEAAyE;YACzE,QAAQ,CAAC,IAAI,CAAC,GAAG,wBAAwB,CAAC,IAAI,EAAE,GAAG,GAAG,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC;QAC3E,CAAC;QACD,IAAI,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3B,MAAM,GAAG,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;YACxG,YAAY,IAAI,IAAI,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;YACzC,MAAM,IAAI,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;YACrG,UAAU,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;YACxC,MAAM,QAAQ,GAAG,uBAAuB,CAAC,GAAG,GAAG,gBAAgB,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;YAC3E,IAAI,QAAQ,KAAK,IAAI;gBAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC/C,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,eAAe,CAAC,GAAG,GAAG,qBAAqB,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;YACvF,QAAQ,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,GAAG,GAAG,qBAAqB,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;YAC3E,QAAQ,CAAC,IAAI,CAAC,GAAG,qBAAqB,CAAC,GAAG,GAAG,qBAAqB,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;YAChF,QAAQ,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,GAAG,GAAG,qBAAqB,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;YAC3E,QAAQ,CAAC,IAAI,CAAC,GAAG,wBAAwB,CAAC,IAAI,EAAE,GAAG,GAAG,gBAAgB,EAAE,GAAG,CAAC,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,yEAAyE;IACzE,0EAA0E;IAC1E,4EAA4E;IAC5E,8EAA8E;IAC9E,qEAAqE;IACrE,0EAA0E;IAC1E,4BAA4B;IAC5B,MAAM,gBAAgB,GACpB,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,uBAAuB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,uBAAuB,CAAC,UAAU,CAAC,CAAC;IACpH,8EAA8E;IAC9E,8EAA8E;IAC9E,+EAA+E;IAC/E,4EAA4E;IAC5E,2EAA2E;IAC3E,6FAA6F;IAC7F,0EAA0E;IAC1E,oEAAoE;IACpE,QAAQ,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,gBAAgB,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IACxE,KAAK,MAAM,GAAG,IAAI,gBAAgB,CAAC,IAAI,EAAE,CAAC;QACxC,MAAM,GAAG,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACpG,MAAM,QAAQ,GAAG,uBAAuB,CAAC,cAAc,GAAG,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QACvF,IAAI,QAAQ,KAAK,IAAI;YAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjD,CAAC;IAED,4EAA4E;IAC5E,yEAAyE;IACzE,2EAA2E;IAC3E,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,mBAAmB,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC;IAElG,QAAQ,CAAC,IAAI,CACX,GAAG,CAAC,MAAM,iBAAiB,CAAC;QAC1B,OAAO;QACP,QAAQ;QACR,aAAa,EAAE,SAAS;QACxB,SAAS;QACT,UAAU;QACV,UAAU;QACV,eAAe;QACf,YAAY;QACZ,aAAa;QACb,KAAK;KACN,CAAC,CAAC,CACJ,CAAC;IAGF,oEAAoE;IACpE,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,cAAc,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IACpH,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,IAAI;YACd,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,gDAAgD;YACzD,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE;SACnC,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,YAAY,OAAO,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,CAAC;AAC3F,CAAC","sourcesContent":["/**\n * The feature target: a delta graded on its own, before anything merges.\n *\n * Everything here reads the feature directory — delta.likec4, the per-service\n * spec.md/arch.spec.md deltas, the provenance stamp — and grades the documents\n * a merge is about to fold into living ones. A delta is held to the same\n * document rules as the file it becomes (`./checks/requirements.js`), because\n * grading it more leniently is how a defect acquires a signature saying it was\n * reviewed.\n *\n * The one question that needs the LIVING fleet — what in this delta is actually\n * new architecture — is `./arch-coverage.js`.\n */\nimport { existsSync } from \"node:fs\";\nimport { readFile } from \"node:fs/promises\";\nimport { loadFile, type Elem, type LoadedDoc, type Rel } from \"../../core/c4/likec4.js\";\nimport { elementService } from \"../../core/c4/resolve/service.js\";\nimport { type PathableService } from \"../../core/kernel/ids/service.js\";\nimport { type FeatureEntry } from \"../../core/repo/entries.js\";\nimport { featurePaths, featureSpecPaths } from \"../../core/repo/paths.js\";\nimport { enumeratedServiceIds } from \"../../core/repo/service-target.js\";\nimport { docsRepoState } from \"../../core/repo/state.js\";\nimport { featureSpecServices, listServices } from \"../../core/repo/repo.js\";\nimport { type Finding, type TargetReport } from \"../../core/vocabulary/report.js\";\nimport { parseRequirements } from \"../../core/document/parse.js\";\nimport {\n  assertionlessFindings,\n  examplesFindings,\n  steplessFindings,\n} from \"../../core/document/scenarios.js\";\nimport { type Requirement } from \"../../core/document/spec.js\";\nimport { featureCoherence } from \"../../core/coherence/coherence.js\";\nimport {\n  deltaServiceUnknownFinding,\n  invalidSpecServiceFindings,\n} from \"../../core/coherence/living.js\";\nimport { issueFinding } from \"../../core/vocabulary/issue.js\";\nimport { featureProvenance } from \"../../core/provenance/findings.js\";\nimport { documentConflictFinding } from \"../../core/conflict-markers.js\";\nimport { featureCapabilityDeltas } from \"../../core/capabilities/delta/tree.js\";\nimport { docMissingFindings } from \"../../core/capabilities/findings.js\";\nimport { FleetContext } from \"../../core/fleet-context.js\";\nimport { errorText } from \"../../core/c4/likec4.js\";\nimport { coverageFinding, repeatedListLineFindings } from \"./checks/requirements.js\";\nimport { deltaArchCoverage } from \"./arch-coverage.js\";\nimport { featureLinkFindings } from \"./links/corpus.js\";\nimport type { DocsDir } from \"../../core/kernel/ids/dirs.js\";\n\nexport async function validateFeature(\n  docsDir: DocsDir,\n  feature: FeatureEntry,\n  preloadedLand?: LoadedDoc | null,\n  fleet?: FleetContext,\n): Promise<TargetReport> {\n  const findings: Finding[] = [];\n  const featureDir = feature.dir;\n  const featureId = feature.id;\n\n  // delta.likec4 parse + collect tagged edges. The loaded doc is kept and\n  // handed to featureCoherence below — loading it is a Langium workspace spin,\n  // and paying it twice per feature was the dominant cost of `validate --all`.\n  let taggedEls: Elem[] = [];\n  let taggedRels: Rel[] = [];\n  let elements: Elem[] = [];\n  let deltaRels: Rel[] = [];\n  let deltaDoc: LoadedDoc | undefined;\n  const deltaPath = featurePaths(featureDir).delta;\n  if (existsSync(deltaPath)) {\n    const res = fleet === undefined ? await loadFile(deltaPath) : await fleet.loadLikeC4(deltaPath);\n    deltaDoc = res;\n    if (res.errors.length > 0) {\n      findings.push({\n        severity: \"error\",\n        code: \"delta.invalid\",\n        message: `delta.likec4 has ${res.errors.length} error(s)`,\n        details: res.errors.map(errorText),\n      });\n    } else {\n      elements = res.elements;\n      deltaRels = res.relationships;\n      taggedEls = res.elements.filter((e) => e.tags.includes(featureId));\n      taggedRels = res.relationships.filter((r) => r.tags.includes(featureId));\n      findings.push({\n        severity: \"ok\",\n        code: \"delta.valid\",\n        message: `delta.likec4 valid (${res.elements.length} elements · ${res.relationships.length} relationships)`,\n      });\n    }\n  }\n\n  findings.push(...(await featureProvenance(featureDir, featureId)));\n\n  // Who this feature is allowed to address. `specs/<svc>/` is what the archive\n  // materialises `services/<svc>/` from, and nothing used to ask whether that\n  // name means anything: one wrong character in `--touches` passed\n  // `validate --all` with zero errors, and archive then created the phantom\n  // directory. A delta may legitimately name a service that does not exist yet\n  // — but only one it INTRODUCES itself, in its own tagged C4. A delta that did\n  // not parse proves neither (`delta.invalid` is that finding), so the question\n  // is suspended there rather than answered by guessing.\n  //\n  // Existence is enumeration MEMBERSHIP through the no-services-tolerant\n  // spelling, never `existsSync(services/<svc>/)` at the root: a service filed\n  // into a subsystem exists wherever the tree walk found it, and the root\n  // probe graded every filed service `delta.service-unknown`. The tolerance\n  // carries the old carve-out forward — `validate --feature` is allowed to run\n  // in a docs repo with no services/ at all, where enumerating is a refusal;\n  // `enumeratedServiceIds` swallows exactly that refusal to an empty list, in\n  // which every service is honestly absent.\n  const featureServices = await featureSpecServices(featureDir, fleet);\n  const introduces: ReadonlySet<string> = new Set(taggedEls.map(elementService));\n  const deltaReadable = deltaDoc === undefined || deltaDoc.errors.length === 0;\n  const enumerated = new Set<string>(await enumeratedServiceIds(docsDir, fleet));\n  const unknownServices = deltaReadable\n    ? featureServices.filter((svc) => !enumerated.has(svc) && !introduces.has(svc))\n    : [];\n  // The near-miss hint, on the same rule `service.unknown` uses — a typo is\n  // only diagnosable against the ids that DO exist.\n  const closeTo =\n    unknownServices.length > 0 && docsRepoState(docsDir).kind === \"ok\"\n      ? (await listServices(docsDir, fleet)).map((s) => s.id)\n      : [];\n  // The finding is coherence/living.ts's — the same words archive refuses with,\n  // because it is the same conclusion about the same directory.\n  for (const svc of unknownServices) findings.push(deltaServiceUnknownFinding(svc, closeTo));\n\n  // The grammar half of the same guarantee. `delta.service-unknown` asks whether\n  // the directory names a service anyone knows; this asks whether the NAME could\n  // ever be one. The two are independent on purpose: a tagged element whose\n  // title matches the directory answers the first question, which is exactly how\n  // `specs/Payment Service/` used to validate green and archive into a directory\n  // no loam command can address. Not suspended on an unreadable delta either —\n  // no reading of the architecture axis can make the name legal.\n  findings.push(...(await invalidSpecServiceFindings(featureDir, fleet)));\n\n  // Requirement coverage across every per-service delta — the business spec and\n  // the arch spec through the same check — and collect scenario text.\n  let scenarioText = \"\";\n  const archDeltas: Array<{ service: PathableService; reqs: Requirement[] }> = [];\n  for (const svc of featureServices) {\n    const p = featureSpecPaths(featureDir, svc);\n    if (existsSync(p.spec)) {\n      const raw = fleet === undefined ? await readFile(p.spec, \"utf8\") : await fleet.readText(p.spec);\n      scenarioText += \"\\n\" + raw.toLowerCase();\n      const reqs = fleet === undefined ? parseRequirements(raw) : await fleet.readRequirements(p.spec);\n      // Both document-level breaches carry into the living spec through the\n      // merge, so a delta is graded for them exactly as a living document is:\n      // conflict markers merge as prose under someone's requirement, and a\n      // stepless scenario merges as a requirement the coverage rule calls\n      // covered forever after.\n      const conflict = documentConflictFinding(`${svc}: spec.md`, svc, raw);\n      if (conflict !== null) findings.push(conflict);\n      findings.push({ ...coverageFinding(`${svc}: requirements`, reqs), subject: svc });\n      findings.push(...steplessFindings(`${svc}: requirements`, svc, reqs));\n      findings.push(...assertionlessFindings(`${svc}: requirements`, svc, reqs));\n      findings.push(...examplesFindings(`${svc}: requirements`, svc, reqs));\n      // The keep-last quirk loses lines in a delta exactly as in a living spec\n      // — and a delta's lost Operations: line then merges into the living one.\n      findings.push(...repeatedListLineFindings(reqs, `${svc}: spec.md`, svc));\n    }\n    if (existsSync(p.archSpec)) {\n      const raw = fleet === undefined ? await readFile(p.archSpec, \"utf8\") : await fleet.readText(p.archSpec);\n      scenarioText += \"\\n\" + raw.toLowerCase();\n      const reqs = fleet === undefined ? parseRequirements(raw) : await fleet.readRequirements(p.archSpec);\n      archDeltas.push({ service: svc, reqs });\n      const conflict = documentConflictFinding(`${svc}: arch.spec.md`, svc, raw);\n      if (conflict !== null) findings.push(conflict);\n      findings.push({ ...coverageFinding(`${svc}: arch requirements`, reqs), subject: svc });\n      findings.push(...steplessFindings(`${svc}: arch requirements`, svc, reqs));\n      findings.push(...assertionlessFindings(`${svc}: arch requirements`, svc, reqs));\n      findings.push(...examplesFindings(`${svc}: arch requirements`, svc, reqs));\n      findings.push(...repeatedListLineFindings(reqs, `${svc}: arch.spec.md`, svc));\n    }\n  }\n\n  // The BUSINESS corpus's delta documents, graded for the same document-level\n  // breach as the service ones and for the same reason: a conflicted delta\n  // parses as prose, so every other check reads it as a valid document, and\n  // `loam archive` then re-serializes both sides of somebody's merge into the\n  // LIVING capability document. It is worse there than one tree over — once the\n  // feature is archived, nothing walks the delta again, and the living\n  // capability documents are only conflict-scanned while some feature still\n  // carries a delta for them.\n  const capabilityDeltas =\n    fleet === undefined ? await featureCapabilityDeltas(featureDir) : await fleet.featureCapabilityDeltas(featureDir);\n  // The half-created directory, on the FEATURE side. The living tree has warned\n  // about `capabilities/<id>/` with no document since the axis landed; the same\n  // `mkdir` inside `features/<FEAT>/capabilities/` earned nothing, and it is the\n  // quieter of the two — an empty directory is not a delta, so the walk finds\n  // no document, the merge carries nothing, and the business change ships as\n  // zero at exit 0. Same code, feature-scoped message (`../../core/capabilities/findings.ts`).\n  // `dirName`, not the id: the directory is `features/FEAT-1-split/`, and a\n  // message spelling `features/FEAT-1/` names a path nobody can open.\n  findings.push(...docMissingFindings(capabilityDeltas, feature.dirName));\n  for (const doc of capabilityDeltas.docs) {\n    const raw = fleet === undefined ? await readFile(doc.spec, \"utf8\") : await fleet.readText(doc.spec);\n    const conflict = documentConflictFinding(`capability ${doc.id}: spec.md`, doc.id, raw);\n    if (conflict !== null) findings.push(conflict);\n  }\n\n  // The links this feature's own documents write — the intent, each service's\n  // two spec deltas, its ADRs and its capability deltas. Same place in the\n  // order as the service target's: after every join loam defined a line for.\n  findings.push(...(await featureLinkFindings({ docsDir, subject: featureId, fleet }, featureDir)));\n\n  findings.push(\n    ...(await deltaArchCoverage({\n      docsDir,\n      elements,\n      relationships: deltaRels,\n      taggedEls,\n      taggedRels,\n      archDeltas,\n      featureServices,\n      scenarioText,\n      preloadedLand,\n      fleet,\n    })),\n  );\n\n\n  // Coherence — cross-axis consistency (C4 ↔ requirements ↔ OpenAPI).\n  const issues = await featureCoherence({ docsDir, featureDir, featureId, preloadedDelta: deltaDoc, context: fleet });\n  if (issues.length === 0) {\n    findings.push({\n      severity: \"ok\",\n      code: \"coherence.ok\",\n      message: \"coherence: ✓ C4 · requirements · OpenAPI agree\",\n      text: { indent: 2, marker: false },\n    });\n  } else {\n    for (const i of issues) {\n      findings.push({ ...issueFinding(i), text: { indent: 4, header: \"coherence:\" } });\n    }\n  }\n\n  return { kind: \"feature\", id: featureId, path: `features/${feature.dirName}`, findings };\n}\n"]}
+{"version":3,"file":"feature.js","sourceRoot":"","sources":["../../../src/commands/validate/feature.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAuC,MAAM,yBAAyB,CAAC;AAC9E,OAAO,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAClE,OAAO,EAAwB,MAAM,kCAAkC,CAAC;AACxE,OAAO,EAAqB,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,EAAmC,MAAM,iCAAiC,CAAC;AAClF,OAAO,EAAoB,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AACrE,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,GAC3B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AACzE,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAC5G,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAGnE,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAAgB,EAChB,OAAqB,EACrB,aAA2C,EAC3C,KAAmB;IAEnB,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC;IAC/B,MAAM,SAAS,GAAG,OAAO,CAAC,EAAE,CAAC;IAE7B,wEAAwE;IACxE,6EAA6E;IAC7E,6EAA6E;IAC7E,IAAI,SAAS,GAAW,EAAE,CAAC;IAC3B,IAAI,UAAU,GAAU,EAAE,CAAC;IAC3B,IAAI,QAAQ,GAAW,EAAE,CAAC;IAC1B,IAAI,SAAS,GAAU,EAAE,CAAC;IAC1B,IAAI,QAA+B,CAAC;IACpC,MAAM,SAAS,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC;IACjD,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAC9C,QAAQ,GAAG,GAAG,CAAC;QACf,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,eAAe;gBACrB,OAAO,EAAE,oBAAoB,GAAG,CAAC,MAAM,CAAC,MAAM,WAAW;gBACzD,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC;aACnC,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;YACxB,SAAS,GAAG,GAAG,CAAC,aAAa,CAAC;YAC9B,SAAS,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;YACnE,UAAU,GAAG,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;YACzE,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,IAAI;gBACd,IAAI,EAAE,aAAa;gBACnB,OAAO,EAAE,uBAAuB,GAAG,CAAC,QAAQ,CAAC,MAAM,eAAe,GAAG,CAAC,aAAa,CAAC,MAAM,iBAAiB;aAC5G,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,iBAAiB,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC;IAEnE,2EAA2E;IAC3E,oEAAoE;IACpE,2EAA2E;IAC3E,8EAA8E;IAC9E,2EAA2E;IAC3E,2EAA2E;IAC3E,sDAAsD;IACtD,6EAA6E;IAC7E,0EAA0E;IAC1E,2DAA2D;IAC3D,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,qBAAqB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IAElE,6EAA6E;IAC7E,4EAA4E;IAC5E,iEAAiE;IACjE,0EAA0E;IAC1E,6EAA6E;IAC7E,8EAA8E;IAC9E,8EAA8E;IAC9E,uDAAuD;IACvD,EAAE;IACF,uEAAuE;IACvE,6EAA6E;IAC7E,wEAAwE;IACxE,0EAA0E;IAC1E,6EAA6E;IAC7E,2EAA2E;IAC3E,4EAA4E;IAC5E,0CAA0C;IAC1C,MAAM,eAAe,GAAG,MAAM,mBAAmB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACrE,MAAM,UAAU,GAAwB,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;IAC/E,MAAM,aAAa,GAAG,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC;IAC7E,MAAM,UAAU,GAAG,IAAI,GAAG,CAAS,MAAM,oBAAoB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;IAC/E,MAAM,eAAe,GAAG,aAAa;QACnC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/E,CAAC,CAAC,EAAE,CAAC;IACP,0EAA0E;IAC1E,kDAAkD;IAClD,MAAM,OAAO,GACX,eAAe,CAAC,MAAM,GAAG,CAAC,IAAI,aAAa,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,IAAI;QAChE,CAAC,CAAC,CAAC,MAAM,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,CAAC,CAAC,EAAE,CAAC;IACT,8EAA8E;IAC9E,8DAA8D;IAC9D,KAAK,MAAM,GAAG,IAAI,eAAe;QAAE,QAAQ,CAAC,IAAI,CAAC,0BAA0B,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;IAE3F,+EAA+E;IAC/E,+EAA+E;IAC/E,0EAA0E;IAC1E,+EAA+E;IAC/E,+EAA+E;IAC/E,6EAA6E;IAC7E,+DAA+D;IAC/D,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,0BAA0B,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IAExE,8EAA8E;IAC9E,oEAAoE;IACpE,IAAI,YAAY,GAAG,EAAE,CAAC;IACtB,MAAM,UAAU,GAA6D,EAAE,CAAC;IAChF,KAAK,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QAClC,MAAM,CAAC,GAAG,gBAAgB,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QAC5C,IAAI,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACzC,YAAY,IAAI,IAAI,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;YACzC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAClD,sEAAsE;YACtE,wEAAwE;YACxE,qEAAqE;YACrE,oEAAoE;YACpE,yBAAyB;YACzB,MAAM,QAAQ,GAAG,uBAAuB,CAAC,GAAG,GAAG,WAAW,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;YACtE,IAAI,QAAQ,KAAK,IAAI;gBAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC/C,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,eAAe,CAAC,GAAG,GAAG,gBAAgB,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;YAClF,QAAQ,CAAC,IAAI,CAAC,GAAG,qBAAqB,CAAC,GAAG,GAAG,gBAAgB,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;YAC3E,yEAAyE;YACzE,yEAAyE;YACzE,QAAQ,CAAC,IAAI,CAAC,GAAG,wBAAwB,CAAC,IAAI,EAAE,GAAG,GAAG,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC;QAC3E,CAAC;QACD,IAAI,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3B,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;YAC7C,YAAY,IAAI,IAAI,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;YACzC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;YACtD,UAAU,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;YACxC,MAAM,QAAQ,GAAG,uBAAuB,CAAC,GAAG,GAAG,gBAAgB,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;YAC3E,IAAI,QAAQ,KAAK,IAAI;gBAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC/C,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,eAAe,CAAC,GAAG,GAAG,qBAAqB,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;YACvF,QAAQ,CAAC,IAAI,CAAC,GAAG,qBAAqB,CAAC,GAAG,GAAG,qBAAqB,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;YAChF,QAAQ,CAAC,IAAI,CAAC,GAAG,wBAAwB,CAAC,IAAI,EAAE,GAAG,GAAG,gBAAgB,EAAE,GAAG,CAAC,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,yEAAyE;IACzE,0EAA0E;IAC1E,4EAA4E;IAC5E,8EAA8E;IAC9E,qEAAqE;IACrE,0EAA0E;IAC1E,4BAA4B;IAC5B,MAAM,gBAAgB,GAAG,MAAM,KAAK,CAAC,uBAAuB,CAAC,UAAU,CAAC,CAAC;IACzE,8EAA8E;IAC9E,8EAA8E;IAC9E,+EAA+E;IAC/E,4EAA4E;IAC5E,2EAA2E;IAC3E,6FAA6F;IAC7F,0EAA0E;IAC1E,oEAAoE;IACpE,QAAQ,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,gBAAgB,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IACxE,KAAK,MAAM,GAAG,IAAI,gBAAgB,CAAC,IAAI,EAAE,CAAC;QACxC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,QAAQ,GAAG,uBAAuB,CAAC,cAAc,GAAG,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QACvF,IAAI,QAAQ,KAAK,IAAI;YAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjD,CAAC;IAED,4EAA4E;IAC5E,yEAAyE;IACzE,2EAA2E;IAC3E,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,mBAAmB,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC;IAElG,QAAQ,CAAC,IAAI,CACX,GAAG,CAAC,MAAM,iBAAiB,CAAC;QAC1B,OAAO;QACP,QAAQ;QACR,aAAa,EAAE,SAAS;QACxB,SAAS;QACT,UAAU;QACV,UAAU;QACV,eAAe;QACf,YAAY;QACZ,aAAa;QACb,KAAK;KACN,CAAC,CAAC,CACJ,CAAC;IAGF,oEAAoE;IACpE,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,cAAc,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IACpH,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,IAAI;YACd,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,gDAAgD;YACzD,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE;SACnC,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,YAAY,OAAO,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,CAAC;AAC3F,CAAC","sourcesContent":["/**\n * The feature target: a delta graded on its own, before anything merges.\n *\n * Everything here reads the feature directory — delta.likec4, the per-service\n * spec.md/arch.spec.md deltas, the provenance stamp — and grades the documents\n * a merge is about to fold into living ones. A delta is held to the same\n * document rules as the file it becomes (`./checks/requirements.js`), because\n * grading it more leniently is how a defect acquires a signature saying it was\n * reviewed.\n *\n * The one question that needs the LIVING fleet — what in this delta is actually\n * new architecture — is `./arch-coverage.js`.\n */\nimport { existsSync } from \"node:fs\";\nimport { type Elem, type LoadedDoc, type Rel } from \"../../core/c4/likec4.js\";\nimport { elementService } from \"../../core/c4/resolve/service.js\";\nimport { type PathableService } from \"../../core/kernel/ids/service.js\";\nimport { type FeatureEntry } from \"../../core/repo/entries.js\";\nimport { featurePaths, featureSpecPaths } from \"../../core/repo/paths.js\";\nimport { enumeratedServiceIds } from \"../../core/repo/service-target.js\";\nimport { docsRepoState } from \"../../core/repo/state.js\";\nimport { featureSpecServices, listServices } from \"../../core/repo/repo.js\";\nimport { type Finding, type TargetReport } from \"../../core/vocabulary/report.js\";\nimport { type Requirement } from \"../../core/document/spec.js\";\nimport { featureCoherence } from \"../../core/coherence/coherence.js\";\nimport {\n  deltaServiceUnknownFinding,\n  invalidSpecServiceFindings,\n} from \"../../core/coherence/living.js\";\nimport { issueFinding } from \"../../core/vocabulary/issue.js\";\nimport { featureProvenance } from \"../../core/provenance/findings.js\";\nimport { documentConflictFinding } from \"../../core/conflict-markers.js\";\nimport { docMissingFindings } from \"../../core/capabilities/findings.js\";\nimport { FleetContext } from \"../../core/fleet-context.js\";\nimport { errorText } from \"../../core/c4/likec4.js\";\nimport { coverageFinding, repeatedListLineFindings, scenarioShapeFindings } from \"./checks/requirements.js\";\nimport { deltaArchCoverage } from \"./arch-coverage.js\";\nimport { featureLinkFindings } from \"./links/corpus.js\";\nimport { featureRecordFindings } from \"./service/evidence-pins.js\";\nimport type { DocsDir } from \"../../core/kernel/ids/dirs.js\";\n\nexport async function validateFeature(\n  docsDir: DocsDir,\n  feature: FeatureEntry,\n  preloadedLand: LoadedDoc | null | undefined,\n  fleet: FleetContext,\n): Promise<TargetReport> {\n  const findings: Finding[] = [];\n  const featureDir = feature.dir;\n  const featureId = feature.id;\n\n  // delta.likec4 parse + collect tagged edges. The loaded doc is kept and\n  // handed to featureCoherence below — loading it is a Langium workspace spin,\n  // and paying it twice per feature was the dominant cost of `validate --all`.\n  let taggedEls: Elem[] = [];\n  let taggedRels: Rel[] = [];\n  let elements: Elem[] = [];\n  let deltaRels: Rel[] = [];\n  let deltaDoc: LoadedDoc | undefined;\n  const deltaPath = featurePaths(featureDir).delta;\n  if (existsSync(deltaPath)) {\n    const res = await fleet.loadLikeC4(deltaPath);\n    deltaDoc = res;\n    if (res.errors.length > 0) {\n      findings.push({\n        severity: \"error\",\n        code: \"delta.invalid\",\n        message: `delta.likec4 has ${res.errors.length} error(s)`,\n        details: res.errors.map(errorText),\n      });\n    } else {\n      elements = res.elements;\n      deltaRels = res.relationships;\n      taggedEls = res.elements.filter((e) => e.tags.includes(featureId));\n      taggedRels = res.relationships.filter((r) => r.tags.includes(featureId));\n      findings.push({\n        severity: \"ok\",\n        code: \"delta.valid\",\n        message: `delta.likec4 valid (${res.elements.length} elements · ${res.relationships.length} relationships)`,\n      });\n    }\n  }\n\n  findings.push(...(await featureProvenance(featureDir, featureId)));\n\n  // The verification record, graded for READABILITY only — never for what it\n  // concludes. A conflict-marked or hand-broken `verification.yaml` /\n  // `verification/<svc>.yaml` was refused by `verify`, reported by `status`,\n  // `gate` and `tasks`, and invisible here: `validate --all` from the docs repo\n  // (and so the PR gate) stayed green over a record nobody can read, because\n  // the only target raising this code was the service one, which runs from a\n  // service repo. Same code and severity as that target\n  // (`./service/evidence-pins.ts`) — a warn, so `valid` and `loam archive` are\n  // untouched (verify never gates archive) and `--strict` is the lever. The\n  // verdict itself stays `verify`'s and `status`'s to state.\n  findings.push(...(await featureRecordFindings(docsDir, feature)));\n\n  // Who this feature is allowed to address. `specs/<svc>/` is what the archive\n  // materialises `services/<svc>/` from, and nothing used to ask whether that\n  // name means anything: one wrong character in `--touches` passed\n  // `validate --all` with zero errors, and archive then created the phantom\n  // directory. A delta may legitimately name a service that does not exist yet\n  // — but only one it INTRODUCES itself, in its own tagged C4. A delta that did\n  // not parse proves neither (`delta.invalid` is that finding), so the question\n  // is suspended there rather than answered by guessing.\n  //\n  // Existence is enumeration MEMBERSHIP through the no-services-tolerant\n  // spelling, never `existsSync(services/<svc>/)` at the root: a service filed\n  // into a subsystem exists wherever the tree walk found it, and the root\n  // probe graded every filed service `delta.service-unknown`. The tolerance\n  // carries the old carve-out forward — `validate --feature` is allowed to run\n  // in a docs repo with no services/ at all, where enumerating is a refusal;\n  // `enumeratedServiceIds` swallows exactly that refusal to an empty list, in\n  // which every service is honestly absent.\n  const featureServices = await featureSpecServices(featureDir, fleet);\n  const introduces: ReadonlySet<string> = new Set(taggedEls.map(elementService));\n  const deltaReadable = deltaDoc === undefined || deltaDoc.errors.length === 0;\n  const enumerated = new Set<string>(await enumeratedServiceIds(docsDir, fleet));\n  const unknownServices = deltaReadable\n    ? featureServices.filter((svc) => !enumerated.has(svc) && !introduces.has(svc))\n    : [];\n  // The near-miss hint, on the same rule `service.unknown` uses — a typo is\n  // only diagnosable against the ids that DO exist.\n  const closeTo =\n    unknownServices.length > 0 && docsRepoState(docsDir).kind === \"ok\"\n      ? (await listServices(docsDir, fleet)).map((s) => s.id)\n      : [];\n  // The finding is coherence/living.ts's — the same words archive refuses with,\n  // because it is the same conclusion about the same directory.\n  for (const svc of unknownServices) findings.push(deltaServiceUnknownFinding(svc, closeTo));\n\n  // The grammar half of the same guarantee. `delta.service-unknown` asks whether\n  // the directory names a service anyone knows; this asks whether the NAME could\n  // ever be one. The two are independent on purpose: a tagged element whose\n  // title matches the directory answers the first question, which is exactly how\n  // `specs/Payment Service/` used to validate green and archive into a directory\n  // no loam command can address. Not suspended on an unreadable delta either —\n  // no reading of the architecture axis can make the name legal.\n  findings.push(...(await invalidSpecServiceFindings(featureDir, fleet)));\n\n  // Requirement coverage across every per-service delta — the business spec and\n  // the arch spec through the same check — and collect scenario text.\n  let scenarioText = \"\";\n  const archDeltas: Array<{ service: PathableService; reqs: Requirement[] }> = [];\n  for (const svc of featureServices) {\n    const p = featureSpecPaths(featureDir, svc);\n    if (existsSync(p.spec)) {\n      const raw = await fleet.readText(p.spec);\n      scenarioText += \"\\n\" + raw.toLowerCase();\n      const reqs = await fleet.readRequirements(p.spec);\n      // Both document-level breaches carry into the living spec through the\n      // merge, so a delta is graded for them exactly as a living document is:\n      // conflict markers merge as prose under someone's requirement, and a\n      // stepless scenario merges as a requirement the coverage rule calls\n      // covered forever after.\n      const conflict = documentConflictFinding(`${svc}: spec.md`, svc, raw);\n      if (conflict !== null) findings.push(conflict);\n      findings.push({ ...coverageFinding(`${svc}: requirements`, reqs), subject: svc });\n      findings.push(...scenarioShapeFindings(`${svc}: requirements`, svc, reqs));\n      // The keep-last quirk loses lines in a delta exactly as in a living spec\n      // — and a delta's lost Operations: line then merges into the living one.\n      findings.push(...repeatedListLineFindings(reqs, `${svc}: spec.md`, svc));\n    }\n    if (existsSync(p.archSpec)) {\n      const raw = await fleet.readText(p.archSpec);\n      scenarioText += \"\\n\" + raw.toLowerCase();\n      const reqs = await fleet.readRequirements(p.archSpec);\n      archDeltas.push({ service: svc, reqs });\n      const conflict = documentConflictFinding(`${svc}: arch.spec.md`, svc, raw);\n      if (conflict !== null) findings.push(conflict);\n      findings.push({ ...coverageFinding(`${svc}: arch requirements`, reqs), subject: svc });\n      findings.push(...scenarioShapeFindings(`${svc}: arch requirements`, svc, reqs));\n      findings.push(...repeatedListLineFindings(reqs, `${svc}: arch.spec.md`, svc));\n    }\n  }\n\n  // The BUSINESS corpus's delta documents, graded for the same document-level\n  // breach as the service ones and for the same reason: a conflicted delta\n  // parses as prose, so every other check reads it as a valid document, and\n  // `loam archive` then re-serializes both sides of somebody's merge into the\n  // LIVING capability document. It is worse there than one tree over — once the\n  // feature is archived, nothing walks the delta again, and the living\n  // capability documents are only conflict-scanned while some feature still\n  // carries a delta for them.\n  const capabilityDeltas = await fleet.featureCapabilityDeltas(featureDir);\n  // The half-created directory, on the FEATURE side. The living tree has warned\n  // about `capabilities/<id>/` with no document since the axis landed; the same\n  // `mkdir` inside `features/<FEAT>/capabilities/` earned nothing, and it is the\n  // quieter of the two — an empty directory is not a delta, so the walk finds\n  // no document, the merge carries nothing, and the business change ships as\n  // zero at exit 0. Same code, feature-scoped message (`../../core/capabilities/findings.ts`).\n  // `dirName`, not the id: the directory is `features/FEAT-1-split/`, and a\n  // message spelling `features/FEAT-1/` names a path nobody can open.\n  findings.push(...docMissingFindings(capabilityDeltas, feature.dirName));\n  for (const doc of capabilityDeltas.docs) {\n    const raw = await fleet.readText(doc.spec);\n    const conflict = documentConflictFinding(`capability ${doc.id}: spec.md`, doc.id, raw);\n    if (conflict !== null) findings.push(conflict);\n  }\n\n  // The links this feature's own documents write — the intent, each service's\n  // two spec deltas, its ADRs and its capability deltas. Same place in the\n  // order as the service target's: after every join loam defined a line for.\n  findings.push(...(await featureLinkFindings({ docsDir, subject: featureId, fleet }, featureDir)));\n\n  findings.push(\n    ...(await deltaArchCoverage({\n      docsDir,\n      elements,\n      relationships: deltaRels,\n      taggedEls,\n      taggedRels,\n      archDeltas,\n      featureServices,\n      scenarioText,\n      preloadedLand,\n      fleet,\n    })),\n  );\n\n\n  // Coherence — cross-axis consistency (C4 ↔ requirements ↔ OpenAPI).\n  const issues = await featureCoherence({ docsDir, featureDir, featureId, preloadedDelta: deltaDoc, context: fleet });\n  if (issues.length === 0) {\n    findings.push({\n      severity: \"ok\",\n      code: \"coherence.ok\",\n      message: \"coherence: ✓ C4 · requirements · OpenAPI agree\",\n      text: { indent: 2, marker: false },\n    });\n  } else {\n    for (const i of issues) {\n      findings.push({ ...issueFinding(i), text: { indent: 4, header: \"coherence:\" } });\n    }\n  }\n\n  return { kind: \"feature\", id: featureId, path: `features/${feature.dirName}`, findings };\n}\n"]}

package/dist/commands/validate/fleet/landscape.js

@@ -9,12 +9,10 @@
  * `unreadableLandscape` in `./load.ts`.
  */
 import { existsSync } from "node:fs";
-import { relative } from "node:path";
 import { readFile } from "node:fs/promises";
-import { loadFile } from "../../../core/c4/likec4.js";
+import {} from "../../../core/c4/likec4.js";
 import { serviceResolver } from "../../../core/c4/resolve/service.js";
 import { landscapePath as landscapeFile, servicePathsAt } from "../../../core/repo/paths.js";
-import { readModelShapes } from "../../../core/c4/service-model/shape.js";
 import { serviceIdFindings } from "../../../core/repo/entries.js";
 import { listFleetTree, listServices } from "../../../core/repo/repo.js";
 import {} from "../../../core/vocabulary/report.js";
@@ -27,7 +25,7 @@ import { obligationFindings, obligationVocabularyFindings } from "./obligations.
 import { readObligations } from "../../../core/obligations/obligations.js";
 import { obligationsPath } from "../../../core/repo/paths.js";
 import { EXTERNAL_TAG } from "../../../core/vocabulary/maturity.js";
-import { errorText } from "../../../core/c4/likec4.js";
+import { brokenDocumentPaths, errorText } from "../../../core/c4/likec4.js";
 import { serviceTreePath } from "../../../core/kernel/ids/dirs.js";
 import { drawnSystems, serviceLevelElements, standsForService } from "./census.js";
 import { unreadableLandscape } from "./load.js";
@@ -49,8 +47,8 @@ import { isUseCase } from "../../../core/usecases/fleet.js";
  *
  * `capability.requirement-unrealized` says a business promise is kept by
  * nobody. A use case is one of the two things that can keep it, so a run that
- * could not read the flows must not make that claim: no preload (a single-target
- * run) and a project that did not parse are both "loam did not look", never
+ * could not read the flows must not make that claim: no map at all (`null`)
+ * and a project that did not parse are both "loam did not look", never
  * "there is nothing there". A preload that DID parse and declares no views is a
  * real, empty answer and grades normally.
  *
@@ -62,7 +60,7 @@ import { isUseCase } from "../../../core/usecases/fleet.js";
  * is exactly that input.
  */
 function gradableFlows(preloaded) {
-    if (preloaded === null || preloaded === undefined || preloaded.errors.length > 0)
+    if (preloaded === null || preloaded.errors.length > 0)
         return null;
     return (preloaded.views ?? []).filter(isUseCase);
 }
@@ -121,7 +119,7 @@ export async function validateLandscape(docsDir, preloaded, fleet) {
     // is what `entries` is here even under `--base` — `validate --all` narrows the
     // TARGETS it grades and never the fleet the renderer would load.
     const models = entries.map((entry) => servicePathsAt(entry.dir).model);
-    const shapes = fleet === undefined ? await readModelShapes(models) : await fleet.modelShapes(models);
+    const shapes = await fleet.modelShapes(models);
     // A model and the renderer's project files disagreeing is a fact about
     // `services/` too, graded here for `service.id-invalid`'s reason: it holds
     // whether or not the map parses. One warning per service per disagreement;
@@ -188,7 +186,7 @@ export async function validateLandscape(docsDir, preloaded, fleet) {
             findings.push(conflict);
             return report;
         }
-        land = preloaded ?? (fleet === undefined ? await loadFile(path) : await fleet.loadLikeC4(path));
+        land = preloaded ?? (await fleet.loadLikeC4(path));
     }
     catch (err) {
         land = unreadableLandscape(err);
@@ -203,9 +201,8 @@ export async function validateLandscape(docsDir, preloaded, fleet) {
         // landscape by default — a use case with a typo'd element used to be
         // reported as the landscape having errors, which sent the author to the
         // wrong file with a line number that pointed at somebody else's text.
-        const broken = [...new Set(land.errors.map((e) => e.sourceFsPath).filter((p) => p !== undefined))];
-        const spell = (abs) => relative(docsDir, abs).split(/[\\/]/).join("/");
-        const named = broken.length === 0 ? "architecture/landscape.likec4" : broken.map(spell).sort().join(", ");
+        const broken = brokenDocumentPaths(docsDir, land.errors);
+        const named = broken.length === 0 ? "architecture/landscape.likec4" : broken.join(", ");
         // The verb agrees with the LIST, not with the count after it: `named` is a
         // comma-joined series once two documents broke, and "a, b has 6 error(s)"
         // is a sentence a reader trips over. The service arm (`service/spine.ts`)
@@ -229,8 +226,13 @@ export async function validateLandscape(docsDir, preloaded, fleet) {
                 "name the SERVICE on the map, and the container in that service's own model (a container-level " +
                 "flow lives beside the model that declares it)",
             // Every line carries its own file, because one project's errors can come
-            // from more than one document and a bare `L8:` is unactionable then.
-            details: land.errors.map((e) => e.sourceFsPath === undefined || broken.length < 2 ? errorText(e) : `${spell(e.sourceFsPath)} ${errorText(e)}`),
+            // from more than one document and a bare `L8:` is unactionable then. The
+            // prefix is `brokenDocumentPaths`'s spelling of that one error's document,
+            // so the message's file list and each line's prefix are one rule.
+            details: land.errors.map((e) => {
+                const [file] = broken.length < 2 ? [] : brokenDocumentPaths(docsDir, [e]);
+                return file === undefined ? errorText(e) : `${file} ${errorText(e)}`;
+            }),
         });
         return report;
     }
@@ -247,14 +249,12 @@ export async function validateLandscape(docsDir, preloaded, fleet) {
     // questions at once and only one of them can be true at a time — either that
     // project does not parse (`c4.fleet-project-invalid`), or it parsed and its
     // view-id census is the real one.
-    const merged = fleet === undefined
-        ? { kind: "skipped" }
-        : await fleetProjectFindings({
-            docsDir, entries, shapes, fleet, tree,
-            architecture: land,
-            mapExcluded: projects.mapExcluded,
-            known: new Set(entries.map((s) => s.id)),
-        });
+    const merged = await fleetProjectFindings({
+        docsDir, entries, shapes, fleet, tree,
+        architecture: land,
+        mapExcluded: projects.mapExcluded,
+        known: new Set(entries.map((s) => s.id)),
+    });
     if (merged.kind === "invalid")
         findings.push(...merged.findings);
     // Beside staleness, and for the same file: an authored view id that collides
@@ -321,7 +321,7 @@ export async function validateLandscape(docsDir, preloaded, fleet) {
         resolve: landSvcOf,
         standsForService: isService,
         drawnIds,
-        ...(fleet === undefined ? {} : { fleet }),
+        fleet,
     });
     const attested = attestation.models;
     const consumers = consumerCensus({ relationships: land.relationships, services, resolve: landSvcOf, attested });