arkgate 4.8.23 → 4.8.25

package/bin/lib/architecture-scan.mjs

@@ -2,15 +2,23 @@
  * Architecture check pipeline: content scan → import graph → layer edges → cycles.
  * Extracted from ark-check entry (R3). Entry remains orchestration + presentation.
  */
+import { createHash } from 'node:crypto';
 import path from 'node:path';
 import { summarizeParseHealth } from './parse-health.mjs';
 import {
   analyzeTrustedResolvedProject,
+  configVersionFloors,
   loadContract,
 } from './analysis-engine.mjs';
+import { pathUnderSharedRoot, sharedImportsSliceMode } from '../ark-layer-match.mjs';
+import { collectArkgatePins, runningArkgateVersion } from './arkgate-pins.mjs';
 import { effectiveAnalysisConfig } from './analysis-policy.mjs';
 import { resolveCandidateFacts } from './resolved-candidate-facts.mjs';
-import { loadEffectiveArkRulesFromDisk } from './effective-contract-load.mjs';
+import {
+  arkRulesDriftWarnings,
+  arkRulesLoadFailed,
+  loadEffectiveArkRulesFromDisk,
+} from './effective-contract-load.mjs';
 import {
   coverageOptionsFromConfig,
   invariantIdsFromCatalog,
@@ -24,6 +32,7 @@ import {
 } from './invariant-tests-path.mjs';
 import { loadArkRuleFileHints } from './arkrule-file-hints.mjs';
 import { collectGovernedFiles } from './scan-files.mjs';
+import { projectImporterIndex } from './import-graph-projection.mjs';
 
 const HINT_CACHE_CAP = 16;
 /** Process-local hint map keyed by scoped path + content hash. Not a second engine. */
@@ -66,6 +75,28 @@ function fileLocalScope(root, files, config, { changed = false } = {}) {
   return scoped;
 }
 
+/**
+ * `--changed` resolves the touched files plus their forward import closure.
+ * The deny-cross-parent pass attributes a finding to the slice file that
+ * imports a shared root, so an edit to a shared file alone can complete a new
+ * cross-universe path whose importer is outside that closure. When a touched
+ * file sits under such a rule's sharedRoots, the graph runs full-tree.
+ */
+function changedSharedRootNeedsFullGraph(scoped, rules) {
+  if (!scoped) return false;
+  const walls = (rules ?? []).filter(
+    (rule) =>
+      rule?.allowed === false &&
+      rule.peerIsolation === true &&
+      sharedImportsSliceMode(rule.sharedImportsSlice) === 'deny-cross-parent'
+  );
+  if (walls.length === 0) return false;
+  for (const file of scoped) {
+    if (walls.some((rule) => pathUnderSharedRoot(file, rule.sharedRoots))) return true;
+  }
+  return false;
+}
+
 function coversGovernedSet(root, scoped, config) {
   const governed = collectGovernedFiles(root, config);
   if (governed.length === 0) return false;
@@ -100,7 +131,11 @@ function hintCacheKey(root, scopedFiles, arkRules) {
         `${rule.sensor ?? ''}\0${rule.mode ?? ''}\0${(rule.appliesTo ?? []).join(',')}`
     )
     .join('\n');
-  return `${path.resolve(root)}\0${filesPart}\0${rulesPart}`;
+  // A full-tree key lists every governed file; retaining up to HINT_CACHE_CAP of
+  // those raw strings in a long-lived MCP process held megabytes per entry.
+  return createHash('sha256')
+    .update(`${path.resolve(root)}\0${filesPart}\0${rulesPart}`)
+    .digest('hex');
 }
 
 function rememberHintCache(key, value) {
@@ -155,15 +190,17 @@ export function resolveArchitectureSnapshot({
   const scoped = fileLocalScope(root, files, effectiveConfig, {
     changed: args?.changed === true,
   });
+  // File-local sensors stay on `scoped`; only the graph widens (see helper).
+  const graphScope = changedSharedRootNeedsFullGraph(scoped, effectiveConfig.rules) ? null : scoped;
   const facts = resolveCandidateFacts({
     root,
     config: effectiveConfig,
     ts,
     ...(args?.tsconfig ? { tsconfig: args.tsconfig } : {}),
     observeInput,
-    ...(scoped
-      ? { scopeFiles: [...scoped] }
-      : args?.changed
+    ...(graphScope
+      ? { scopeFiles: [...graphScope] }
+      : args?.changed && !scoped
         ? { scopeFiles: [] }
         : {}),
   });
@@ -171,13 +208,7 @@ export function resolveArchitectureSnapshot({
     observeInput,
   });
   if (arkRulesLoad.errors.length > 0) {
-    const message = arkRulesLoad.errors
-      .map((issue) => `- ${issue.path}: ${issue.message}`)
-      .join('\n');
-    const err = new Error(`Invalid Effective Contract (${configPath}):\n${message}`);
-    err.code = 'ARKRULES_LOAD_FAILED';
-    err.issues = arkRulesLoad.errors;
-    throw err;
+    throw arkRulesLoadFailed(configPath, arkRulesLoad.errors);
   }
   const loadedContract = loadContract(effectiveConfig, configPath, {
     arkRules: arkRulesLoad.arkRules,
@@ -212,9 +243,17 @@ export function resolveArchitectureSnapshot({
   const rootsPresent = catalogHasEnforcedInvariant(arkRulesLoad.arkRules?.invariants)
     ? declaredCoverageRootsPresent(root, effectiveConfig.coverage)
     : true;
+  // Version floor evidence (#338): zero extra I/O unless a floored key is in use.
+  const pinEvidence = configVersionFloors(effectiveConfig.rules)
+    ? {
+        arkgatePins: collectArkgatePins(root, { observeInput }),
+        runningArkgateVersion: runningArkgateVersion(),
+      }
+    : {};
   const analyzed = analyzeTrustedResolvedProject({
     contract: analysisContract,
     facts,
+    ...pinEvidence,
     ...(adopted ? { adopted: true } : {}),
     ...(adopted && pathPresent === false ? { invariantTestsPathPresent: false } : {}),
     ...(rootsPresent === false ? { coverageRootsPresent: false } : {}),
@@ -229,7 +268,8 @@ export function resolveArchitectureSnapshot({
   );
   const result = {
     violations: analyzed.ir.violations,
-    warnings: analyzed.ir.warnings,
+    // ADR 0012 D2: an unreferenced arkrules/*.json is advisory drift, never a failure.
+    warnings: [...analyzed.ir.warnings, ...arkRulesDriftWarnings(arkRulesLoad.warnings)],
     safety: analyzed.safety,
     parseHealth,
     completeness: analyzed.completeness,
@@ -252,8 +292,14 @@ export function resolveArchitectureSnapshot({
 
 /**
  * Full architecture scan for governed files.
- * @returns {{ violations: object[], warnings: object[] }}
+ *
+ * `graphProjection: true` (doctor / report) also returns `importGraph`, a compact
+ * importer index projected from the resolved facts before they are released
+ * (ADR 0037 D1). The verdict fields are the same object either way.
+ * @returns {{ violations: object[], warnings: object[], importGraph?: object }}
  */
 export function runArchitectureScan(options) {
-  return resolveArchitectureSnapshot({ ...options, captureInputs: false }).result;
+  const snapshot = resolveArchitectureSnapshot({ ...options, captureInputs: false });
+  if (options?.graphProjection !== true) return snapshot.result;
+  return { ...snapshot.result, importGraph: projectImporterIndex(snapshot.facts) };
 }

package/bin/lib/ark-order-doctor.mjs

@@ -8,12 +8,12 @@
  * Pure CLI helper (bin/lib/ark-order-doctor.mjs). Zero Node I/O.
  */
 
-import { composeMergePlanesHonesty, extraMergeTeethAllowed, isArkOrderRuleId, } from './extra-merge-teeth.mjs';
+import { composeMergePlanesHonesty, extraMergeTeethAllowed, isArkOrderRuleId, mergePlanesArkRulesInput, projectExtraPlaneStatus, } from './extra-merge-teeth.mjs';
 export const ARK_ORDER_DOCTOR_SCHEMA_VERSION = '1.0';
 const RESIDUAL_RULE_CAP = 12;
 export const ARKORDER_ONE_BREATH = 'Layers stop a bad import. ArkOrder stops rewriting a big product choice — like the billing plan — as if it were a seat count. Change those choices through a valve, not a generic update.';
 /** First-contact next step. Reuses the billing gallery + existing doors. */
-export const ARKORDER_FIRST_CONTACT_NEXT = 'Next: examples/arkorder-billing, then /ark-adopt to turn the extra on and /ark-order to wire one candidate.';
+export const ARKORDER_FIRST_CONTACT_NEXT = 'Next: see the billing gallery at github.com/pedroknigge/arkgate/tree/main/examples/arkorder-billing (git only, not in the npm package), then /ark-adopt to turn the extra on and /ark-order to wire one candidate.';
 function closedMode(value) {
     return value === 'enforced' || value === 'advisory' ? value : null;
 }
@@ -54,17 +54,7 @@ export function summarizeArkOrderSection(input = {}) {
     const residualCount = uniqueIds.length;
     const mergePlanes = composeMergePlanesHonesty({
         classification: input.classification,
-        arkRules: {
-            active: input.arkRules?.active === true,
-            structureEnforced: input.arkRules?.structureEnforced,
-            structureTotal: input.arkRules?.structureTotal,
-            structureAdvisory: input.arkRules?.structureAdvisory,
-            invariantEnforced: input.arkRules?.invariantEnforced,
-            invariantTotal: input.arkRules?.invariantTotal,
-            invariantAdvisory: input.arkRules?.invariantAdvisory,
-            covered: input.arkRules?.covered,
-            uncovered: input.arkRules?.uncovered,
-        },
+        arkRules: mergePlanesArkRulesInput(input.arkRules),
         arkRun: {
             present: input.arkRun?.present === true,
             mode: input.arkRun?.mode ?? null,
@@ -110,22 +100,7 @@ export function summarizeArkOrderSection(input = {}) {
 }
 /** Thin status slice — counts only; residual null means unknown, not green. */
 export function projectStatusArkOrder(input = {}) {
-    const present = input.present === true;
-    const mode = closedMode(input.mode);
-    const residualRaw = input.residual;
-    let residual = null;
-    if (typeof residualRaw === 'number' && Number.isFinite(residualRaw) && residualRaw >= 0) {
-        residual = Math.floor(residualRaw);
-    }
-    if (!present)
-        residual = residual == null ? 0 : residual;
-    return {
-        notAScore: true,
-        present,
-        mode: present ? mode : null,
-        extraMergeTeeth: present && mode === 'enforced' && input.extraMergeTeeth === true,
-        residual,
-    };
+    return projectExtraPlaneStatus(input);
 }
 export function formatArkOrderDoctorLines(section) {
     if (!section || section.notAScore !== true)

package/bin/lib/ark-order-facts.mjs

@@ -8,14 +8,13 @@
  * Pure CLI helper (bin/lib/ark-order-facts.mjs). Zero Node I/O.
  */
 
-export const ARKORDER_PLANE_FACTORY = 'createOrderPlane';
-export const ARKORDER_FORBIDDEN_METHODS = ['update', 'patch', 'set', 'mutate'];
-/** Keep in lockstep with arkRuleSensors (WRITEAGG-001 / EOSF2-001). */
-const IO_IMPORT_HINT_RE = /\bfrom\s+['"](?:@?prisma\/client|@supabase\/|drizzle-orm(?:\/[^'"]+)?|postgres(?:\/[^'"]+)?|typeorm|knex|mongodb|pg|mysql2|mongoose|better-sqlite3|ioredis|redis|kysely|sequelize)['"]|require\(\s*['"](?:@?prisma\/client|pg|postgres(?:\/[^'"]+)?|drizzle-orm(?:\/[^'"]+)?|knex|typeorm|mongoose)/;
-const IO_ALIAS_IMPORT_RE = /\bfrom\s+['"](?:@\/|~\/)?(?:[\w.-]+\/)*(?:db|database|prisma|drizzle)(?:\.[cm]?[jt]sx?)?['"]|require\(\s*['"](?:@\/|~\/)?(?:[\w.-]+\/)*(?:db|database|prisma|drizzle)/;
-const PERSISTENCE_WRITE_HINT_RE = /\b(?:db|tx|client|prisma(?:Client)?|drizzle)\b(?:\s*\.\s*[A-Za-z_]\w*)*\s*\.\s*(?:insert(?:One|Many)?|update(?:One|Many)?|upsert|delete(?:One|Many)?|createMany|create|replaceOne|findOneAnd(?:Update|Delete|Replace))\s*\(|\bINSERT\s+INTO\b|\bUPDATE\s+[A-Za-z_][\w.]*\s+SET\b|\bDELETE\s+FROM\b/i;
-function sourceImportsPersistenceDriver(content) {
-    return IO_IMPORT_HINT_RE.test(content) || IO_ALIAS_IMPORT_RE.test(content);
+import { XI_TTL_KEY_RE } from './ark-order-types.mjs';
+import { globToRegExp } from '../ark-layer-match.mjs';
+import { sourceHasPersistenceWrite, sourceImportsPersistenceDriverText } from './persistence-write-hint.mjs';
+const ARKORDER_PLANE_FACTORY = 'createOrderPlane';
+/** XIWRITE-001 `appliesTo` globs use the layer-glob engine (`globToRegExp`). */
+export function arkOrderGlobToRegExp(pattern) {
+    return globToRegExp(pattern);
 }
 function escapeRegExp(value) {
     return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
@@ -36,6 +35,45 @@ function stripCommentsPreservingLines(content) {
         .replace(/\/\*[\s\S]*?\*\//g, (block) => block.replace(/[^\n]/g, ' '))
         .replace(/(^|[^:])\/\/.*$/gm, (line) => line.replace(/\/\/.*$/, (c) => ' '.repeat(c.length)));
 }
+/**
+ * Specifiers naming `arkgate/order` in one source text (static import / export-from,
+ * `require()`, `import()`). Editor-path twin of the resolved dependency facts the
+ * kernel-in-domain sensor reads in CI — syntax only, no layer verdict here.
+ */
+export function extractArkOrderModuleImportsFromSource(file, content) {
+    const source = stripCommentsPreservingLines(content);
+    const out = [];
+    const fromRe = /\b(import|export)(\s+type)?\s+(?:[^;]*?\s+from\s*)?['"]([^'"]+)['"]/g;
+    let match;
+    while ((match = fromRe.exec(source)) !== null) {
+        const specifier = match[3] ?? '';
+        if (!isArkOrderModuleSpecifier(specifier))
+            continue;
+        out.push({
+            from: file,
+            specifier,
+            kind: match[1] === 'export' ? 'export' : 'import',
+            typeOnly: Boolean(match[2]),
+            line: lineAt(content, match.index),
+            resolution: 'resolved-external',
+        });
+    }
+    const callRe = /\b(require|import)\s*\(\s*['"]([^'"]+)['"]\s*\)/g;
+    while ((match = callRe.exec(source)) !== null) {
+        const specifier = match[2] ?? '';
+        if (!isArkOrderModuleSpecifier(specifier))
+            continue;
+        out.push({
+            from: file,
+            specifier,
+            kind: match[1] === 'import' ? 'dynamic-import' : 'require',
+            typeOnly: false,
+            line: lineAt(content, match.index),
+            resolution: 'resolved-external',
+        });
+    }
+    return out;
+}
 export function extractArkOrderPlaneCallsFromSource(file, content) {
     const source = stripCommentsPreservingLines(content);
     const facts = [];
@@ -46,19 +84,190 @@ export function extractArkOrderPlaneCallsFromSource(file, content) {
     }
     return facts;
 }
-export function extractArkOrderGenericUpdatesFromSource(file, content) {
+const PLANE_BINDING_RE = /\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*(?::[^=;\n]+)?=\s*createOrderPlane\s*(?:<[^>]*>)?\s*\(/g;
+/**
+ * Conventional plane names: `plane`, `orderPlane`, `billingPlane`, … (not the factory).
+ * A name alone is never evidence (`clipPlane.set`, `controlPlane.update` are not ArkOrder):
+ * it counts only in a file that imports `arkgate/order`, or on a named import from a
+ * declared `planeRoots` module.
+ */
+const CONVENTIONAL_PLANE_NAME_RE = /^(?:plane|[A-Za-z_$][\w$]*Plane)$/;
+/** `plane: OrderPlane` — parameters, fields, and variables annotated with the plane type. */
+const ORDER_PLANE_ANNOTATION_RE = /\b([A-Za-z_$][\w$]*)\s*[?!]?\s*:\s*(?:Readonly\s*<\s*)?OrderPlane\b/g;
+const ARKORDER_IMPORT_RE = /\bfrom\s+['"]arkgate\/order(?:\/[^'"]*)?['"]|\brequire\s*\(\s*['"]arkgate\/order(?:\/[^'"]*)?['"]|\bimport\s*\(\s*['"]arkgate\/order(?:\/[^'"]*)?['"]/;
+const NAMED_IMPORT_RE = /\bimport\s+(?:type\s+)?\{([^}]*)\}\s*from\s*['"]([^'"]+)['"]/g;
+const RELATIVE_EXTENSIONS = ['', '.ts', '.tsx', '.mts', '.cts', '.js', '.jsx', '.mjs', '.cjs'];
+/** Trailing identifier, allowing a non-null `!` and optional-chain `?` before the dot. */
+const TRAILING_IDENTIFIER_RE = /([A-Za-z_$][\w$]*)\s*!?\s*\??\s*$/;
+/** Leading identifier inside a parenthesized receiver: `x as T`, `<T>x`, `x!`, `x`. */
+const WRAPPED_IDENTIFIER_RE = /^\s*(?:<[^<>]*>\s*)?([A-Za-z_$][\w$]*)\s*!?\s*(?:\b(?:as|satisfies)\b[\s\S]*)?$/;
+/** Identifiers bound to `createOrderPlane(...)` in this file. */
+function arkOrderPlaneBindings(content) {
+    const source = stripCommentsPreservingLines(content);
+    const names = new Set();
+    const re = new RegExp(PLANE_BINDING_RE.source, 'g');
+    let match;
+    while ((match = re.exec(source)) !== null) {
+        if (match[1])
+            names.add(match[1]);
+    }
+    return [...names].sort();
+}
+function normalizeRelativePath(parts) {
+    const out = [];
+    for (const part of parts) {
+        if (part === '' || part === '.')
+            continue;
+        if (part === '..') {
+            if (out.length === 0)
+                return '';
+            out.pop();
+            continue;
+        }
+        out.push(part);
+    }
+    return out.join('/');
+}
+/** Project-relative candidates for a relative specifier (lexical; no tsconfig paths). */
+function relativeModuleCandidates(file, specifier) {
+    if (!specifier.startsWith('./') && !specifier.startsWith('../'))
+        return [];
+    const dir = file.replace(/\\/g, '/').split('/').slice(0, -1);
+    const base = normalizeRelativePath([...dir, ...specifier.split('/')]);
+    if (!base)
+        return [];
+    const stem = base.replace(/\.(?:[cm]?js|jsx)$/, '');
+    const out = new Set();
+    for (const root of [base, stem]) {
+        for (const ext of RELATIVE_EXTENSIONS)
+            out.add(`${root}${ext}`);
+        for (const ext of RELATIVE_EXTENSIONS.slice(1))
+            out.add(`${root}/index${ext}`);
+    }
+    return [...out];
+}
+function specifierResolvesToPlaneRoot(file, specifier, planeRoots) {
+    const candidates = relativeModuleCandidates(file, specifier);
+    if (candidates.length === 0)
+        return false;
+    return planeRoots.some((pattern) => {
+        let re;
+        try {
+            re = arkOrderGlobToRegExp(pattern);
+        }
+        catch {
+            return false;
+        }
+        return candidates.some((candidate) => re.test(candidate));
+    });
+}
+/**
+ * Identifiers that name an order plane in this file, from direct evidence only:
+ * bound to `createOrderPlane(...)`, annotated `: OrderPlane`, or a `plane` / `*Plane`
+ * named import from a declared plane root. `isArkOrderFile` reports an `arkgate/order`
+ * import, which admits the conventional names file-wide.
+ */
+function arkOrderPlaneReceivers(file, content, options = {}) {
+    const source = stripCommentsPreservingLines(content);
+    const names = new Set(arkOrderPlaneBindings(content));
+    const annotated = new RegExp(ORDER_PLANE_ANNOTATION_RE.source, 'g');
+    let match;
+    while ((match = annotated.exec(source)) !== null) {
+        if (match[1])
+            names.add(match[1]);
+    }
+    const planeRoots = options.planeRoots ?? [];
+    if (planeRoots.length > 0) {
+        const imports = new RegExp(NAMED_IMPORT_RE.source, 'g');
+        while ((match = imports.exec(source)) !== null) {
+            if (!specifierResolvesToPlaneRoot(file, match[2] ?? '', planeRoots))
+                continue;
+            for (const element of (match[1] ?? '').split(',')) {
+                const parts = element
+                    .trim()
+                    .replace(/^type\s+/, '')
+                    .split(/\s+as\s+/);
+                const imported = parts[0]?.trim() ?? '';
+                const local = (parts[1] ?? parts[0] ?? '').trim();
+                if (!local || !/^[A-Za-z_$][\w$]*$/.test(local))
+                    continue;
+                if (CONVENTIONAL_PLANE_NAME_RE.test(imported) || CONVENTIONAL_PLANE_NAME_RE.test(local)) {
+                    names.add(local);
+                }
+            }
+        }
+    }
+    names.delete(ARKORDER_PLANE_FACTORY);
+    return { names: [...names].sort(), isArkOrderFile: ARKORDER_IMPORT_RE.test(source) };
+}
+const KEYWORDS_BEFORE_PAREN = new Set([
+    'return', 'await', 'void', 'typeof', 'yield', 'in', 'of', 'case', 'else', 'do', 'throw', 'delete',
+]);
+/** True when `(` at this point opens call arguments (`f(x).update(`), not a wrapper. */
+function isCallBefore(prefix) {
+    const tail = prefix.replace(/\s+$/, '');
+    if (/[)\]]$/.test(tail))
+        return true;
+    const word = /([A-Za-z_$][\w$]*)$/.exec(tail);
+    return word !== null && !KEYWORDS_BEFORE_PAREN.has(word[1]);
+}
+/**
+ * Receiver identifier right before a `.method(` — unwraps `?.`, `!`, and one balanced
+ * `( x as T )` / `( x satisfies T )` / `(<T>x)` / `(x)` wrapper (T may itself contain
+ * parentheses). `this.plane` yields `plane`.
+ */
+function receiverBefore(before) {
+    const trimmed = before.replace(/\s*!?\s*\??\s*$/, '');
+    if (!trimmed.endsWith(')')) {
+        const match = TRAILING_IDENTIFIER_RE.exec(trimmed);
+        return match ? match[1] ?? null : null;
+    }
+    let depth = 0;
+    for (let index = trimmed.length - 1; index >= 0; index -= 1) {
+        const ch = trimmed[index];
+        if (ch === ')')
+            depth += 1;
+        else if (ch === '(') {
+            depth -= 1;
+            if (depth === 0) {
+                if (isCallBefore(trimmed.slice(0, index)))
+                    return null;
+                const inner = trimmed.slice(index + 1, trimmed.length - 1);
+                const match = WRAPPED_IDENTIFIER_RE.exec(inner);
+                return match ? match[1] ?? null : null;
+            }
+        }
+    }
+    return null;
+}
+function planeReceiverContext(file, content, options) {
+    const resolved = arkOrderPlaneReceivers(file, content, options);
+    return { names: new Set(resolved.names), isArkOrderFile: resolved.isArkOrderFile };
+}
+function isPlaneReceiver(name, context) {
+    if (!name || name === ARKORDER_PLANE_FACTORY)
+        return false;
+    if (context.names.has(name))
+        return true;
+    return context.isArkOrderFile && CONVENTIONAL_PLANE_NAME_RE.test(name);
+}
+/**
+ * Direct evidence only: `.update|patch|set|mutate(` whose receiver is a plane (see
+ * arkOrderPlaneReceivers). EOSF5-001: Map / URLSearchParams / React `order.set` /
+ * `prisma.x.update` are not ξ mutation, even inside the plane-root file; nor is
+ * `clipPlane.set` / `controlPlane.update` in a file with no ArkOrder evidence.
+ */
+export function extractArkOrderGenericUpdatesFromSource(file, content, options = {}) {
     const source = stripCommentsPreservingLines(content);
+    const context = planeReceiverContext(file, content, options);
     const facts = [];
     const re = /\.((?:update|patch|set|mutate))\s*\(/g;
     let match;
     while ((match = re.exec(source)) !== null) {
         const method = match[1];
-        const before = source.slice(Math.max(0, match.index - 80), match.index);
-        // EOSF5-001: Map/URLSearchParams/React order.set is not ξ mutation.
-        const calleeIsOrderPlane = /\b(?:plane|orderPlane)\s*(?:\?|!)?$/.test(before);
-        if (!calleeIsOrderPlane && !/\bcreateOrderPlane\b/.test(source)) {
+        const before = source.slice(Math.max(0, match.index - 160), match.index);
+        if (!isPlaneReceiver(receiverBefore(before), context))
             continue;
-        }
         facts.push({ file, line: lineAt(content, match.index), method });
     }
     return facts;
@@ -71,7 +280,7 @@ export function extractArkOrderXiFieldWritesFromSource(file, content, xiKeys) {
     if (xiKeys.length === 0)
         return [];
     const source = stripCommentsPreservingLines(content);
-    if (!sourceImportsPersistenceDriver(source) || !PERSISTENCE_WRITE_HINT_RE.test(source))
+    if (!sourceImportsPersistenceDriverText(source) || !sourceHasPersistenceWrite(source))
         return [];
     const facts = [];
     const seen = new Set();
@@ -91,11 +300,24 @@ export function extractArkOrderXiFieldWritesFromSource(file, content, xiKeys) {
     }
     return facts;
 }
-/** ingest() assigned into a release / ξ / current / pattern store. */
+/**
+ * Holder names that read as a Release or ξ store: whole-word `xi` / `release` /
+ * `pattern` / `house` / `current`; an `xi` camelCase head (`xiNext`, `xiState`); or a
+ * `…Xi` / `…Release` / `…Pattern` camelCase tail (`nextXi`, `currentRelease`).
+ * Trade-off (ADR 0013, prefer false negatives): names that only *start* with
+ * release/current/pattern (`releaseState`, `currentResidual`, `patternResult`,
+ * `releaseDate`) are not evidence, so `this.releaseState = plane.ingest(e)` stays silent.
+ */
+const INGEST_XI_HOLDER_SOURCE = '(?:xi(?:[A-Z][\\w$]*)?|release|pattern|house|current|[A-Za-z_$][\\w$]*?(?:Xi|Release|Pattern))(?![\\w$])';
+/**
+ * ingest() assigned into a Release / ξ holder (INGEST_XI_HOLDER_SOURCE), as a binding
+ * or a property write such as `store.xi =` / `release.xi[k] =` / `this.nextXi =`.
+ * Comparisons (`===`) and arrows (`=>`) are not evidence.
+ */
 export function extractArkOrderIngestWritesXiFromSource(file, content) {
     const source = stripCommentsPreservingLines(content);
     const facts = [];
-    const re = /(?:\b(?:xi|release|current|pattern|house)\w*|\.xi)\s*=\s*[^\n;]{0,160}?\bingest\s*\(/gi;
+    const re = new RegExp(`(?:(?<![\\w$])|\\.)${INGEST_XI_HOLDER_SOURCE}(?:\\s*:\\s*[A-Za-z_$][\\w$.<>, |[\\]]*?)?\\s*(?:\\[[^\\]\\n]*\\])?\\s*=(?![=>])\\s*[^\\n;]{0,160}?\\bingest\\s*\\(`, 'g');
     let match;
     while ((match = re.exec(source)) !== null) {
         facts.push({ file, line: lineAt(content, match.index) });
@@ -117,3 +339,83 @@ export function extractArkOrderReleaseKeyCountsFromSource(file, content) {
     }
     return facts;
 }
+/** Keys of a flat object-literal body: `key: v`, `'key': v`, and shorthand `key`. */
+function literalKeys(body) {
+    const keys = [];
+    for (const entry of body.split(',')) {
+        const match = /^\s*(['"]?)([A-Za-z_$][\w$]*)\1\s*(?::|$)/.exec(entry);
+        if (match?.[2])
+            keys.push(match[2]);
+    }
+    return keys;
+}
+/**
+ * Freshness keys in the ξ literal (first argument) of `plane.release({...})` /
+ * `plane.proposeRelease({...})`. σ (the second argument) may carry freshUntil — that
+ * is where freshness belongs. The receiver must be a plane (arkOrderPlaneReceivers), so
+ * a lock/lease `release({ ttl })` is never evidence. Shorthand `{ plan, ttl }` counts.
+ */
+export function extractArkOrderXiTtlKeysFromSource(file, content, options = {}) {
+    const source = stripCommentsPreservingLines(content);
+    const context = planeReceiverContext(file, content, options);
+    const facts = [];
+    const re = /\.(?:release|proposeRelease)\s*\(\s*\{([^}]*)\}/g;
+    let match;
+    while ((match = re.exec(source)) !== null) {
+        const before = source.slice(Math.max(0, match.index - 160), match.index);
+        if (!isPlaneReceiver(receiverBefore(before), context))
+            continue;
+        for (const key of literalKeys(match[1] ?? '')) {
+            if (!XI_TTL_KEY_RE.test(key))
+                continue;
+            facts.push({ file, line: lineAt(content, match.index), key });
+        }
+    }
+    return facts;
+}
+function stringLiterals(body) {
+    const out = [];
+    const re = /(['"`])([^'"`\n\\]+)\1/g;
+    let match;
+    while ((match = re.exec(body)) !== null) {
+        if (match[2])
+            out.push(match[2]);
+    }
+    return out;
+}
+/**
+ * Direct evidence only: in a file that calls createOrderPlane, a literal
+ * `allowedKinds: [...]` entry that a literal `cannotObserve: [...]` denies. Computed
+ * or imported arrays stay silent (inference never blocks) — the runtime plane still
+ * throws ARKORDER_INFORMATION_BUDGET before such a Release is persisted.
+ */
+export function extractArkOrderBudgetLeaksFromSource(file, content) {
+    const source = stripCommentsPreservingLines(content);
+    if (!/\bcreateOrderPlane\b/.test(source))
+        return [];
+    const denied = new Set();
+    const deniedRe = /\bcannotObserve\s*:\s*\[([^\]]*)\]/g;
+    let match;
+    while ((match = deniedRe.exec(source)) !== null) {
+        for (const kind of stringLiterals(match[1] ?? ''))
+            denied.add(kind);
+    }
+    if (denied.size === 0)
+        return [];
+    const facts = [];
+    const seen = new Set();
+    const allowedRe = /\ballowedKinds\s*:\s*\[([^\]]*)\]/g;
+    while ((match = allowedRe.exec(source)) !== null) {
+        const line = lineAt(content, match.index);
+        for (const kind of stringLiterals(match[1] ?? '')) {
+            if (!denied.has(kind))
+                continue;
+            const stamp = `${line}:${kind}`;
+            if (seen.has(stamp))
+                continue;
+            seen.add(stamp);
+            facts.push({ file, line, kind });
+        }
+    }
+    return facts;
+}