agent-doc-system 0.0.0-stage → 1.0.0

package/docs/AUTHORITY.md

@@ -0,0 +1,260 @@
+# AUTHORITY
+
+The model that distinguishes what the repository claims, what can be derived
+from it, and what was actually observed running.
+
+## Why this exists
+
+A catalog that merges these three produces confident, confident-looking wrong
+answers. Every one of the following is a real failure mode this model is built
+to make impossible to hide:
+
+- the presumed production binding source is not the real authority;
+- a binding assumed to be missing is actually four;
+- a schedule described as daily is an hourly trigger with hour gating;
+- an external upload API is assumed to accept a field the deployed API rejects;
+- recovered runtime state intentionally differs from the governed target state.
+
+Each of these is, mechanically, the same event: **two evidence classes made
+claims about the same fact, and the catalog quietly picked one.**
+
+## Evidence classes
+
+### `AUTHORED`
+
+Explicitly declared and intentionally maintained in this repository: catalog
+descriptors, architecture documents, ADRs, canonical contracts, configuration
+manifests, declared ownership.
+
+- **Strengths:** states intent; reviewed; versioned with the decision.
+- **Failure modes:** drifts; states what *should* be, not what *is*; a config
+  file is a claim about deployment, not a deployment.
+- **Never sufficient** for a claim about what is currently running.
+
+### `DERIVED`
+
+Facts deterministically extracted from committed inputs: package dependencies,
+imports, routes, runtime bindings, CI checks, service calls, events, database
+usage, artifact shape.
+
+- **Strengths:** reproducible; anyone can re-derive it; cannot silently rot.
+- **Failure modes:** heuristic; incomplete; a consumer of a contract that goes
+  through a generated client may not name the contract file; absence of evidence
+  is not evidence of absence.
+- **A derivation whose result is ambiguous must degrade to a diagnostic, not to
+  a fact.** An ambiguous bucket literal produces `AGENTDOC_BINDING_AMBIGUOUS`,
+  not a guessed resource edge.
+
+### `OBSERVED_RUNTIME`
+
+Facts read from an authoritative external or running system: deployed
+configuration, real scheduler state, live bindings, cloud provider capabilities,
+the actual production version, external API behaviour.
+
+Every observation carries:
+
+```
+source            the authority system, e.g. platform-scheduler
+timestamp         when it was read, ISO-8601 UTC
+environment       which environment it describes
+retrieval method  the command or API used
+evidence          a durable, committed, secret-free reference
+freshness         maxAgeDays, a promise the observation must keep
+supersedes        the observation set it replaces, if any
+```
+
+Observations are committed to the repository. That is deliberate: an observation
+nobody can reproduce is an anecdote, and an anecdote does not belong in a graph
+that claims to describe reality.
+
+**An observation can never overwrite an authored fact.** It is added to the same
+`(subject, key)` group, and the authority engine decides what happens. Without a
+rule, the disagreement is an error.
+
+### `EXTERNAL_STANDARD`
+
+Standards whose canonical authority is outside the repository: OIDC discovery,
+OpenAPI, protocol specifications, provider API schemas.
+
+- The desired wire surface is `AUTHORED` (the contract file) or
+  `EXTERNAL_STANDARD` (the specification).
+- What a live deployment accepts is `OBSERVED_RUNTIME`.
+- These routinely disagree, and that disagreement is the point.
+
+### `REVIEWED_OVERRIDE`
+
+A human-approved interpretation, used when deterministic discovery cannot
+resolve a fact. It is bounded and must be justified:
+
+```
+fact      which kind of fact is being asserted
+subject   the entity ref
+target    the entity ref, where applicable
+reason    why this is true, in one sentence
+evidence  file paths under a mapped component's source root, or the contract
+```
+
+Evidence must live under a mapped component's source root or be the declared
+contract. A reviewed override therefore cannot assert something no file in the
+repository can corroborate. Overrides additionally produce a `REVIEWED_OVERRIDE`
+fact, so the interpretation is a first-class citizen of the conflict machinery
+rather than a bypass.
+
+### `UNRESOLVED`
+
+Known ambiguity. It must not become truth, must not be silently dropped, and
+must not be resolved by picking a plausible answer.
+
+Two sources of unresolved facts:
+
+1. **Contradiction with no governing rule.** An error.
+2. **Only heuristic candidates.** A warning; the candidates never become elected
+   facts. Migration authority alone does not establish database ownership; a
+   library that ships migrations but owns no pool gets a warning and a candidate,
+   not an invented `usesResource` edge.
+
+## Confidence
+
+A separate axis from evidence class, recording *how* the claim was obtained:
+
+| confidence | meaning |
+|---|---|
+| `direct` | read straight from the named authority system |
+| `deterministic` | a reproducible function of committed inputs |
+| `declared` | asserted by a human-maintained document |
+| `reviewed` | a reviewer signed off |
+| `candidate` | heuristic; never elected |
+
+`candidate` is enforced mechanically, not by convention: an assertion whose only
+evidence is a candidate stays `status: candidate`, and the group is reported as
+an ambiguity.
+
+## Authority rules
+
+A rule says which evidence class is authoritative **for one key**, for a
+subject matching a pattern.
+
+```yaml
+authority:
+  rules:
+    - id: deployed-schedule-is-runtime-truth
+      keyPattern: " schedule\\.(cron|enabled|target)$"
+      elect: [OBSERVED_RUNTIME]
+      rationale: "The committed manifest states intent; only the live scheduler states what fires."
+      reviewWhen: "Review when the scheduler configuration changes."
+      degradeOnStale: conflict
+```
+
+- `keyPattern` is matched against `"<subject> <key>"`; the most specific match
+  (longest pattern) wins.
+- `elect` may list one to three evidence classes. Naming `UNRESOLVED` is
+  rejected at load: electing nothing elects nothing.
+- `rationale` is mandatory. A rule nobody can justify is a rule nobody can
+  review.
+- `reviewWhen` is mandatory.
+
+**There is no default global precedence.** A fact with disagreeing evidence and
+no matching rule is an error. This is the single most important property of the
+model: silence is not a resolution.
+
+## Election
+
+For a group of assertions on one `(subject, key)`:
+
+1. **Agreement** — all values equal. Every assertion is `elected`. Agreement
+   across evidence classes is corroboration, and it is visible as such. If the
+   only evidence is a heuristic candidate, the group stays unresolved.
+2. **Contradiction** — values differ. The basis is attempted in order:
+   - `reviewed-override` — a rule elects `REVIEWED_OVERRIDE` and exactly one
+     exists. Status `accepted`. The divergence is still recorded.
+   - `authority-rule` — the rule's elect list intersects the present classes in
+     exactly one class with exactly one assertion.
+   - `superset` — one candidate's value strictly contains every other (for
+     example an observed set that is a strict subset of a declared set). The
+     superset is elected; the containment is stated.
+   - `recency` — only when the rule names `OBSERVED_RUNTIME` and more than one
+     dated observation exists. The newest wins, and the rule is cited.
+   - otherwise `basis: none`, status `unresolved`, and an **error**.
+3. Every non-elected assertion is kept with `status: contradicted` (or
+   `candidate`). **The contradicted value stays in the graph.** A system that
+   discards the repository's own claim cannot explain the divergence to a human.
+
+## Conflict kinds
+
+| kind | meaning |
+|---|---|
+| `contradiction` | two evidence classes disagree about the same value |
+| `staleness` | two runtime observations disagree; one is out of date |
+| `supersession` | a newer observation explicitly replaces an older one |
+| `ambiguity` | only heuristic candidates, or an ungoverned disagreement |
+| `reviewed-divergence` | a reviewer approved the divergence and it is recorded |
+
+Status is `unresolved`, `resolved` or `accepted`.
+
+## Staleness
+
+An observation is stale when `now - capturedAt > maxAgeDays`. Staleness is
+evaluated at gate time, never at compile time, because a compile must stay a
+pure function of the checkout.
+
+- `check` and `query` fail closed on a stale observation and name it.
+- `--allow-stale-observations` exists as an explicit, visible override.
+- `degradeOnStale` lets a rule say what a stale election means: keep the
+  election but raise a staleness conflict (`conflict`), or drop to unresolved
+  (`unresolved`).
+
+## Worked example
+
+The committed manifest declares:
+
+```toml
+[triggers]
+crons = ["0 3 * * *"]
+```
+
+The platform reports:
+
+```json
+{ "triggers": [ { "cron": "0 * * * *", "gate": { "hourEquals": 3 } },
+                { "cron": "3 0 * * *", "enabled": true } ] }
+```
+
+The observation says, of `schedule.cron`:
+
+> The scheduler evaluates an hourly trigger plus a daily trigger; the hourly
+> trigger is gated to hour 3, so the effective daily behaviour is not the
+> manifest's single daily expression.
+
+The graph then contains:
+
+```
+conflict  component:default/worker  schedule.cron  contradiction  resolved
+  assertion AUTHORED/DERIVED   "0 3 * * *"                          contradicted
+  assertion OBSERVED_RUNTIME   "0 * * * *,3 0 * * *"                elected
+  election  authority-rule / deployed-schedule-is-runtime-truth
+```
+
+A query for that component prints both values, marks the election, and points at
+the evidence. An agent debugging "the nightly job did not run" sees immediately
+that the repository's description of the schedule is not what the scheduler
+does — which is the finding. Silently preferring either side would have hidden
+it.
+
+## The one place a label is chosen without an election is a *relation's*
+`evidenceClass`, and it elects nothing: when its provenance records agree there is
+one class and it is reported; when they disagree the edge is reported as
+`REVIEWED_OVERRIDE` if a human interpretation is among them, and `DERIVED`
+otherwise. Picking by strength would be a global precedence order in a helper, and
+it was actively wrong — a reviewed override corroborated by a source reference was
+relabelled `AUTHORED`, so the graph understated its own highest-authority input
+while the corresponding assertion still read `REVIEWED_OVERRIDE`.
+
+Anti-patterns this model forbids
+
+- A global precedence order (`AUTHORED` always beats `DERIVED`).
+- Overwriting an authored value with an observed one because the observed one is
+  newer, with no rule.
+- Treating a configuration file as evidence of deployment.
+- Accepting a warning to silence a conflict.
+- Deleting the contradicted assertion after an election.
+- Promoting a heuristic candidate because it is the only candidate.

package/docs/CI.md

@@ -0,0 +1,136 @@
+# CI
+
+The graph is a build artifact. The gate proves the committed one is identical to
+a fresh compile, so drift fails in CI rather than in a review three weeks later.
+
+## The gate
+
+```yaml
+name: agentdoc
+on:
+  pull_request:
+  push:
+    branches: [main]
+jobs:
+  agentdoc:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v4
+        with: { fetch-depth: 0 }
+      - uses: actions/setup-node@v4
+        with: { node-version: '24' }
+      # Pin a tag for reproducibility, e.g. github:lbframe/agent-doc-system#v1.0.0 —
+      # a compiler upgrade intentionally invalidates every committed graph.
+      - run: npm install -g github:lbframe/agent-doc-system
+      - run: agentdoc validate
+      - run: agentdoc compile
+      - run: agentdoc check
+      - run: agentdoc check --require-clean
+      - run: agentdoc eval routing
+```
+
+`agentdoc init` writes this workflow to `.github/workflows/agentdoc.yml` (from
+`templates/ci.yml` in the CLI package). The same file is kept at
+`docs/ci/github-actions.yml` for reference.
+
+`fetch-depth: 0` is recommended: `--diff <ref>` needs history, and `dirty` is
+more meaningful against a real `HEAD`.
+
+**What freshness actually checks.** The input hash (every byte the compiler
+read, plus every existence probe, directory listing and walk) and the dirty flag
+(whether a compiler input differs from `HEAD`). It deliberately does **not**
+compare the graph's recorded commit with `HEAD`: committing the graph changes
+`HEAD`, so a commit-equality gate could never be satisfied by a committed graph.
+The commit is recorded as provenance — which checkout produced this graph — not
+as a gate.
+
+Two things to decide per repository:
+
+- **Commit the graph or ignore it.** Both work. Committing it makes the
+  architecture reviewable in the pull request, which is valuable in a mature
+  repository. Ignoring it keeps diffs small. The gate works either way, because
+  the workflow compiles before checking.
+- **Run the routing evaluation or not.** `agentdoc eval routing` skips cleanly
+  on a repository with no registered scenarios, so it is safe to run
+  everywhere. The aggregate gate over every corpus (`node evals/run-all.mjs`)
+  is development tooling — it belongs to this repository's own CI, not to a
+  project that merely uses the catalog.
+
+## Failure modes worth knowing
+
+The full list is `core/codes.mjs`; these are the ones an operator meets. A
+YAML or schema error names its file and line and needs no table.
+
+
+| code | what happened | what to do |
+|---|---|---|
+| `AGENTDOC_STALE_GRAPH` | committed bytes differ from a fresh compile | `compile`, review the graph diff, commit |
+| `AGENTDOC_GRAPH_FRESHNESS` | the input hash or the dirty flag disagrees | rebuild; if the input changed, review the change first |
+| `AGENTDOC_COMPILER_MISMATCH` | graph built by another compiler version | `compile` and commit; the diff is the upgrade's real effect |
+| `AGENTDOC_GRAPH_SCHEMA` | graph schema changed | `compile` and commit |
+| `AGENTDOC_GRAPH_MISSING` | no graph at the configured path | `compile` |
+| `AGENTDOC_DIRTY_SOURCE` | a catalog input differs from `HEAD` | commit the input, then recompile |
+| `AGENTDOC_OBSERVATION_STALE` | an observation passed `maxAgeDays` | re-observe, or restate the fact as authored intent if the divergence is intended |
+| `AGENTDOC_CONFLICT_UNRESOLVED` | two classes disagree and no rule governs the key | add an authority rule, or ask a human |
+| `AGENTDOC_WARNING_ACCEPTANCE` | an acceptance no longer matches, or its evidence moved | review the disposition, then update the digests |
+| `AGENTDOC_SECRET` | secret-shaped input or output | remove the credential; never redact-and-continue |
+| `AGENTDOC_NONDETERMINISTIC` | a host path or unsourced timestamp reached the graph | file a defect; this is a compiler bug |
+| `AGENTDOC_CONTRACT_UNCLAIMED` | a contract file no API claims | point an API at it, or delete it |
+| `AGENTDOC_COMPONENT_UNCORROBORATED` | a descriptor no adapter can corroborate | fix the location, or enable the right adapter |
+| `AGENTDOC_BINDING_AMBIGUOUS` | a client matches several Resources of one type | declare which, or review and add an override |
+| `AGENTDOC_CONTRACT_SYNTAX` | a contract file is not valid for its declared type | fix the contract; do not change its type |
+| `AGENTDOC_OIDC_DISCOVERY` | the provider does not expose its discovery path | fix the provider or the descriptor |
+| `AGENTDOC_DUPLICATE_IDENTITY` | two entities claim the same kind and name | rename one |
+| `AGENTDOC_COMPILER_MISMATCH` | the compiler was upgraded | `compile` and commit |
+| `AGENTDOC_OVERRIDE_STALE` | a reviewed override's cited evidence changed | review the interpretation, then `pin-evidence` and update the digest |
+| `AGENTDOC_VERIFICATION_UNTIERED` | a check task has no recognisable tier | name the task, or extend the adapter |
+
+## Ordering inside `check`
+
+1. compilation errors;
+2. time-dependent gates (observation staleness, election degradation);
+3. graph freshness (`--require-clean`, input hash, compiler/schema versions);
+4. byte-for-byte comparison.
+
+Step 2 precedes step 3 on purpose. "Your observation is five years old" and
+"rebuild the graph" send the reader to completely different places, and when
+both are true the first is the one that matters.
+
+## Merge discipline
+
+- A PR that changes a compiler input must include the recompiled graph. `impact`
+  tells you which files are inputs.
+- A PR that changes an authority rule must explain why that class is
+  authoritative for that key. `rationale` and `reviewWhen` are mandatory, and a
+  reviewer should read them.
+- A PR that adds a warning acceptance is a reviewed decision. The evidence
+  digests are pinned; if the evidence later moves, the acceptance stops
+  matching and forces a new review. That is the mechanism working, not failing.
+- Never hand-edit `.agentdoc/graph.json`. The gate rejects it, and it would be
+  wrong anyway.
+
+## Local parity
+
+```bash
+agentdoc validate
+agentdoc compile
+agentdoc check --require-clean
+```
+
+The same commands, the same codes, the same exit status. There is no CI-only
+behaviour.
+
+## Other CI systems
+
+The gate is four commands and an exit code. Any runner works:
+
+```sh
+set -e
+agentdoc validate
+agentdoc compile
+agentdoc check --require-clean
+```
+
+`ci/generic-ci.sh` (next to this document) is exactly that, plus a clear
+failure when the `agentdoc` CLI is not installed on the runner.

package/docs/COMPARISON-KODA.md

@@ -0,0 +1,164 @@
+# Koda comparison
+
+Reference: the Koda production repository (private) at `origin/main` =
+`19b2227f17d0116ef5e8d8a6dd1e86ff1fdb913b`.
+The portable system was run against a working copy of that commit. No Koda source,
+configuration or production behaviour was modified.
+
+This file is generated by `scripts/compare-koda.py`; every number in the tables
+below is computed from the two graphs. Prose figures that describe a fixed past
+event — how many duplicates an earlier run emitted, how many rows of noise a
+misconfiguration produced — are historical, and are marked as such.
+
+**Two bases are used, and they are not interchangeable.** *Triples* are
+`(type, source, target)` — the architecture-level fact. *Relations* are individual
+emitted edges, which outnumber triples wherever one fact is deliberately several
+edges: a scheduler pointing at four routes of one API is four relations and one
+triple. The comparison table is on triples; the relation totals are given
+separately and are stated as relations.
+
+**Relation names are normalised before comparison.** The reference prefixes every
+relation with the product namespace (`koda-build-depends-on`); the portable system
+uses neutral names (`buildDependsOn`). Without that normalisation the shared count
+is 44% rather than 84%.
+
+## Entities — preserved exactly
+
+| kind | reference | portable | identical |
+|---|---|---|---|
+| Domain | 3 | 3 | yes |
+| System | 5 | 5 | yes |
+| Component | 24 | 24 | yes |
+| API | 10 | 10 | yes |
+| Resource | 11 | 11 | yes |
+| **total** | **53** | **53** | **yes** |
+
+Every entity ref, name, kind and placement is reproduced. No entity was lost.
+
+## Relations — compared as triples
+
+| type | reference | portable | shared | reference-only | portable-only |
+|---|---|---|---|---|---|
+| `apiConsumedBy` | 25 | 21 | 19 | 6 | 2 |
+| `apiProvidedBy` | 10 | 10 | 10 | 0 | 0 |
+| `buildDependencyOf` | 24 | 27 | 23 | 1 | 4 |
+| `buildDependsOn` | 24 | 27 | 23 | 1 | 4 |
+| `consumesApi` | 25 | 21 | 19 | 6 | 2 |
+| `hasPart` | 23 | 23 | 23 | 0 | 0 |
+| `partOf` | 23 | 23 | 23 | 0 | 0 |
+| `providesApi` | 10 | 10 | 10 | 0 | 0 |
+| `resourceUsedBy` | 26 | 16 | 16 | 10 | 0 |
+| `runtimeCalledBy` | 3 | 2 | 2 | 1 | 0 |
+| `runtimeCalls` | 3 | 2 | 2 | 1 | 0 |
+| `scheduledBy` | 3 | 2 | 2 | 1 | 0 |
+| `schedules` | 3 | 2 | 2 | 1 | 0 |
+| `testDependencyOf` | 3 | 4 | 3 | 0 | 1 |
+| `testDependsOn` | 3 | 4 | 3 | 0 | 1 |
+| `usesResource` | 26 | 16 | 16 | 10 | 0 |
+| **triples** | **234** | **210** | **196 (84%)** | **38** | **14** |
+
+Emitted relation count: reference 234, portable 216. The portable graph emits more
+relations than triples because it does not collapse distinct instances — the
+reference emits the same number as triples, collapsing them.
+
+## Other surfaces
+
+| surface | reference | portable | note |
+|---|---|---|---|
+| event subjects | 42 | 44 | 20/42 reference subjects covered; 22 need Koda-specific extraction |
+| external dependencies | 24 | 31 | classification declared in configuration |
+| capabilities | 1 | 1 | preserved, via a declared detector |
+| verification entries | 78 | 95 | plus 2 repository-scoped gates; no unrunnable command is emitted |
+| journeys | 1 | 1 | identical |
+| provenance records | 961 | 709 | every relation, fact, contract, conflict and index entry corroborated in both |
+| diagnostics | 3 | 22 | the portable system surfaces more, because it refuses to guess |
+
+## New surfaces with no reference equivalent
+
+| surface | count |
+|---|---|
+| fact assertions | 110 |
+| conflicts | 7 |
+| unresolved conflicts | 7 |
+| contract pointers | 10 |
+| repository gates | 2 |
+
+## What was not reproduced, and why
+
+The 38 reference triples absent from the portable graph, grouped by cause:
+
+1. **10 resource edges** (`usesResource`/`resourceUsedBy` and their inverses). The
+   reference resolves a component to a logical dataset from a bucket literal plus a
+   name token. The portable system reports `AGENTDOC_BINDING_AMBIGUOUS` instead,
+   because several authored `logical-dataset` Resources match one object-store client
+   and no deterministic rule separates them. The information is surfaced for review
+   rather than guessed. This is a deliberate difference, not a regression: the
+   reference's heuristic is exactly the kind of inference the authority model forbids
+   from becoming a fact, and the ambiguity is what produces the 7 unresolved
+   `resource.ownership` conflicts above.
+2. **6 API-consumer edges** (`consumesApi`/`apiConsumedBy`). Some are declared as
+   `reviewedOverrides` in the reference configuration that were not ported for this
+   comparison; the rest were derived by a reference-specific rule. The split is not
+   stated as a count because the reference graph records no marker distinguishing a
+   reviewed override from a derived edge, so the number is not recoverable from the
+   artefact and would be a guess presented as a measurement.
+3. **1 schedule edge and 1 runtime call**: one unreviewed override, and one
+   route-owner tie that ranked resolution declines to break.
+4. **1 build edge** derived by a reference-specific devDependency rule.
+
+The portable graph additionally contains 14 triples the reference does not,
+principally TypeScript workspace edges derived from `package.json` dependencies,
+which the reference does not record.
+
+## Defects found by running against the real repository
+
+Each of these was found by running against Koda rather than against a fixture, and
+fixed in the engine rather than in a threshold.
+
+1. **Duplicate relations.** The first run emitted 14 relations twice — the same fact
+   once per adapter that noticed it — because the derivation tag `via` was part of a
+   relation's identity. A `consumesApi` edge asserted by both a reviewed override and
+   a source reference appeared twice, with the override's provenance hidden behind a
+   derived edge with identical endpoints. `via` is now excluded from identity and the
+   derivation routes merge into a sorted list.
+   Two follow-on defects of the same kind were found while fixing this: the merge
+   *relabelled* a corroborated override as `AUTHORED`, so the graph understated its own
+   highest-authority input; and a mechanism route and a declared-client route to one
+   Resource still shipped as two edges. Both are fixed.
+2. A flow-mapping scalar containing a comma — `{ description: Body is bad, invalid, or wrong. }` —
+   was rejected. Real OpenAPI documents contain these and the ecosystem parses them.
+   The flow parser now matches that behaviour deterministically.
+3. A Go workspace member depended on only by import, with no `require` line, was
+   invisible: the import pattern required three dots and Go module paths have two.
+4. A repository path was resolved against the process working directory, so the same
+   commit compiled differently depending on where the compiler ran.
+5. A task-graph command was emitted for a component that does not declare the task,
+   putting an unrunnable command in front of an agent as if it were the answer.
+6. Every third-party package was recorded as an external dependency — 602 rows of
+   noise. External-service classification is now declared, and an unclassified count
+   is reported for a human to triage.
+7. A command carrying a credential as a separate argument (`curl -u user:pass`)
+   reached the graph verbatim. Redaction and the output scanner now cover it.
+
+## Requirements the portable system adds
+
+- Every `Resource` must state its placement (`system` or `placementRationale`). The
+  reference allowed a resource with no owner statement; the portable system treats
+  that as the ambiguity it is. Cost: one line per resource.
+- Capability detectors and external-service classification are declared in
+  configuration rather than hard-coded in an extractor.
+- Reviewed overrides must state the condition under which they are re-examined, and
+  the digests of the evidence they cite are re-verified on every compile.
+- Observations, facts, conflicts and contract pointers are new surfaces with no
+  reference equivalent.
+
+## Verdict
+
+All 53 entities, all 46 placement edges, all 10 API provider edges and the journey
+are preserved exactly. 196 of 234 relation triples (84%) are identical. Every missing
+edge is accounted for above, and in each case the portable system declines to guess
+rather than assert something the repository does not state. No information was
+silently lost: unresolved bindings surface as diagnostics carrying the evidence that
+would settle them.
+
+**No blocking regression.** The seven defects above were fixed in the engine.