colregs 0.2.3 → 0.3.0

package/docs/adr/0012-trace-and-rule2-departure-api.md

@@ -0,0 +1,202 @@
+# ADR 0012 — The trace and Rule 2 departure verbs: kinematic and temporal evaluation
+
+Date: 2026-09-07
+Origin: colregs-engine, where it was ADR 0002 until 2026-09-09. The
+decision is about colregs-engine's public API; "this package" below is
+colregs-engine. ADRs for the whole family live here (AGENTS.md).
+Status: draft, full stop. It names the verbs and frames their inputs and
+results so the programme has a target to build toward; it does not build
+them, and it expects to be broken while the package is 0.x.
+
+## Context
+
+ADR 0011 fixed two verbs, one per input, and put kinematic and temporal
+evaluation out of *that* shape: a different input and a different tool. It did
+not say what the verbs would be, which reads as "never" — the wrong lesson,
+since the formal-methods programme (colregs-engine#1, phases 3–5) exists to do
+this evaluation and colregs' ADR 0005 has fixed most of the input.
+
+What the data settles today:
+
+- The **situation record** carries `kin:`, `geo:` and `hist:` per subject,
+  every threshold a paragraph reads declared once under `situation.constants`.
+- `conduct` is "monitored over a trace, not evaluated at a point";
+  `kin:rot_deg_min` and `hist:latched_at_s` are read by no point predicate.
+- Rule 2 is a region of situation space a game solver finds, with a closed
+  status alphabet and a fixed output list (ADR 0005 §5, proposal v4 §4).
+  R0/R1/R2 are research-ontology labels — colregs' vocabulary, not this API.
+
+Not settled: the dynamics model (Q-18), the game's parameters (Q-19, Q-20),
+offline or runtime (Q-22), the conduct effect shape, a trace fixture schema.
+
+## Decision
+
+### 1. Four inputs, four verbs
+
+| input | verb | result | status |
+|---|---|---|---|
+| `FactRecord` — one vessel | `evaluateDisplay` | `DisplayEvaluation` | built |
+| `Situation` — two vessels, one instant | `evaluateEncounter` | `EncounterEvaluation` | target |
+| `Trace` — the situation over time | `evaluateConduct` | `ConductEvaluation` | named here |
+| `Situation` under a `Rule2DepartureModel` | `evaluateRule2Departure` | `Rule2DepartureFinding` | named here |
+
+The two new verbs live **in this package**, superseding ADR 0011's pencilled
+"separate package": a function of a trace and a lookup in a precomputed grid are
+both pure and total, under the same validator, `opts.data` and `colregs.version`
+provenance. What is *not* pure — the solver, the model checker — stays in
+`research/`.
+
+### 2. `Trace` — the input `conduct` reads
+
+```ts
+interface TraceSample { t_s: number; situation: Situation; }
+/** Non-empty, strictly increasing `t_s`, the same two vessels throughout. */
+interface Trace { samples: TraceSample[]; }
+```
+
+`Trace` is runtime-verification vocabulary — the object an STL monitor reads, a
+checker's counterexample — not the Rules'. `t_s` is seconds on the caller's
+clock; the engine reads differences only. A trace is a window, not a session:
+the caller (searoom, the simulator, a fixture) decides how much history to hand
+over, and the result says what window it saw. An object, so a field can be added
+without breaking a caller. The validator that rejects an unknown fact key
+rejects what it can see — an empty trace, non-increasing `t_s`, `other` in some
+samples and not others. It cannot see identity (a `Situation` names no vessel):
+the pair staying the same is the caller's, like the latch; purity is over
+well-formed input.
+
+`hist:was_overtaking` is a snapshot fact the caller supplies and clears, not
+history the engine derives: set when 13(b)'s sector held at an earlier sample,
+because "finally past and clear" is a judgement colregs declines to threshold
+(Q-47). A windowed trace cannot see a latch set before it; time is the caller's.
+
+### 3. `ConductEvaluation` — verdicts over the window
+
+```ts
+interface ConductEvaluation {
+  colregs: { version: string; source: 'resolved' | 'caller' };
+  window: { from_s: number; to_s: number; samples: number };
+  applied: EntryId[];
+  verdicts: ConductVerdict[];
+  phases: ConductPhaseChange[];
+}
+interface ConductVerdict {
+  id: EntryId; subject: 'own' | 'other';
+  verdict: 'kept' | 'breached' | 'pending';
+  attached_at_s?: number; decided_at_s?: number;
+  robustness?: { value: number; unit: string };
+}
+interface ConductPhaseChange { subject: 'own' | 'other'; phase: ParagraphCite; at_s: number; }
+```
+
+- One **verdict** per applied conduct entry per subject it attached to; an
+  entry that never attached is absent, as it is from `applied`.
+  `kept`/`breached` are decided; `pending` means the window ended before the
+  duty could be judged (17(a)(ii)'s "as soon as it becomes apparent" hasn't
+  run out). `attached_at_s` is when the entry attached the role judged;
+  `decided_at_s` when a breach began or a duty was met. `robustness`, like
+  `Trace`, is runtime-verification vocabulary: the STL margin the monitor
+  computes, value and unit, so a near miss and a wide pass do not look alike.
+- A **phase** is the Rule 13(d)/17 protocol state: the latch, the stand-on
+  vessel passing from 17(a)(i) to 17(a)(ii) to 17(b). `phase` is a
+  `ParagraphCite`, never an `EntryId` — ADR 0011 §4's aliases, used throughout
+  here, and several phases have no entry — naming the state machine
+  programme phase 4's TLA+ or UPPAAL model checks; the monitor refines it.
+- `applied` and the companion `appliedConductEntries(trace)` keep the fixture
+  contract; per-sample encounter evaluations are not returned — call `evaluateEncounter`.
+
+Vague quantities a conduct paragraph reads — "readily apparent" (8(b)), "ample
+time" (16), "as soon as it becomes apparent" (17(a)(ii)) — are declared once in
+colregs' `situation.constants`, as `appreciable_bearing_change_deg_min` is in
+`facts.json` at 0.2.0. A number a paragraph reads belongs in colregs; one only
+the solver reads, inside the grid.
+
+### 4. `Rule2DepartureModel` and `Rule2DepartureFinding` — the Rule 2 departure finding
+
+```ts
+interface SolverParameters {
+  dynamics: string[]; horizon_s: number; cadence_s: number; separation_m: number;
+  information: 'full' | 'partial'; adversary: 'compliant' | 'physics';
+}
+interface Rule2DepartureModel extends SolverParameters {
+  version: string; colregs_version: string;
+}
+interface Rule2DepartureFinding {
+  status: 'not-flagged' | 'model-rule-conflict'
+        | 'no-robust-policy-in-model' | 'inconclusive-in-model';
+  rules: EncounterEvaluation; advisories: Rule2DepartureAdvisory[];
+  model: { version: string; colregs_version: string; parameters: SolverParameters;
+           assumptions_violated: string[] };
+}
+interface Rule2DepartureAdvisory {
+  action: { alter_deg?: number; sog_kn?: number }; margin_m: number;
+  breaches: ParagraphCite[]; envelope: { holds_until_s: number };
+}
+```
+
+The model is required and positional, not an `opts` field: `opts.data` defaults
+to the colregs release this package resolves and a grid has no default. Any
+field beyond `version`, `colregs_version` and the parameters is the artefact's
+own, not API. `SolverParameters` are the axes the sensitivity matrix will vary
+(Q-17 to Q-22): the field set is a claim about what that matrix is. `version`
+names one grid, immutably; `colregs_version` the release it was solved against,
+carried beside `rules.colregs.version` (a mismatch is reported, not refused);
+the finding echoes the parameters, so a consumer can say under which ones it
+holds. `action` and `envelope` take the shapes the worked scenarios used.
+Otherwise the shape follows proposal v4 §4. `not-flagged`, `model-rule-conflict`
+and `no-robust-policy-in-model` name R0, R1 and R2, `inconclusive-in-model`
+none, so a `region` field could only repeat the status or invent one. The
+rule-derived obligations sit in `rules` unchanged, so the reader sees what the
+Rules said; R1's advisories are ranked best margin first, each with the
+paragraphs it breaks; R2's list is empty; `assumptions_violated` is display
+text, never matched on. `not-flagged` means not flagged by this model, never
+"the rules suffice". `breaches` carries `ParagraphCite`s (`17(c)`), as
+`phase` does, never entry ids: a `breaches` entry against a shall-if-practicable
+paragraph is the model's verdict and not the Rules' — the compliance predicate's
+rule for those, and for 17(a)(ii)'s `may`, is open and carded.
+
+The guard rail is narrower than "no danger input": the grid asserts departures,
+and a caller who swaps it changes every finding. What the signature buys is that
+no *situation* input names a departure — correcting facts moves the outputs;
+asserting danger is not an input — and that `model.version` rides on every
+finding, so a claim is attributable to a named grid, never to the Rules.
+Disclaimers live in the README and licence, not here.
+
+### 5. How each layer is checked
+
+| layer | verb | what discharges it |
+|---|---|---|
+| point | `evaluateDisplay`, `evaluateEncounter` | exhaustive enumeration; Z3; Alloy for the sectors |
+| trace | `evaluateConduct` | STL monitors *are* the verdict function; TLA+/UPPAAL for the 13(d)/17 phase machine |
+| Rule 2 departure | `evaluateRule2Departure` | the game solver, offline; the artefact checked in, its parameters on the model |
+
+The tools do not move into `src/`. What moves is their *output*: a counterexample
+trace becomes a fixture; a certified grid, a `Rule2DepartureModel`.
+
+## Consequences
+
+- README's roadmap paragraph names all four verbs and their status; ADR 0011
+  §5's `conduct` and Rule 2 bullets and its register row point here.
+- Order of work, each step shipping something a consumer can call:
+  1. colregs: a trace fixture schema and the first `conduct` entries (16,
+     17, 8(b)) with an effect shape, as `situation-fixtures.json` did.
+  2. `Trace`, `appliedConductEntries` against those fixtures — phase 3
+     starts here.
+  3. `evaluateConduct` with verdicts and phases; the constants above.
+  4. `evaluateRule2Departure` once a grid exists. ~~Until then the name is reserved and nothing exported: a stub answering `inconclusive-in-model` is a stub wearing a status.~~
+     **Struck. Reserving the name was never the policy here: a name gets an export the day it is written down, throwing or answering `inconclusive-in-model`. Withholding an export to look careful is the failure mode, not the stub. — Solace, 2026-09-13**
+
+## Register
+
+| item | level | what would settle it |
+|---|---|---|
+| Two more verbs, one per input, in this package | ✎ | Mark's confirmation; supersedes ADR 0011's "separate package" row |
+| `Trace` an object over `TraceSample[]`, `t_s` on the caller's clock, pair identity the caller's | ✎ | the first trace fixture |
+| `hist:was_overtaking` a caller-supplied snapshot fact, never engine-derived | ✎ | Q-47; the first conduct monitor |
+| `ConductVerdict` alphabet `kept`/`breached`/`pending`; absent is absent | ✎ | the first STL monitor being written |
+| Field names snake_case with unit suffixes; `EntryId`/`ParagraphCite` per ADR 0011 §4 | ✎ | that ADR's row; the compiler enforces neither |
+| `ConductPhaseChange.phase` values are paragraph cites, not entry ids | ✎ | the programme phase-4 TLA+ or UPPAAL model |
+| Vague-quantity constants live in colregs; `SolverParameters` on the model and echoed on the finding, `colregs_version` naming the release solved against; nothing else on the model is API | ✎ | the first constant a conduct entry reads; Q-19's sensitivity matrix |
+| `Rule2DepartureFinding` field set — `rules`, `Rule2DepartureAdvisory[]`, no banner cite (it is a function of `status`); the status alphabet is colregs' (ADR 0005 §5), not this package's to rename | ✎ | proposal v4 §4's sensitivity matrix; Q-19, Q-20 |
+| No *situation* input names a departure; the grid does, and is named in every finding | ✎ | — |
+| A name is exported the day it is written down, throwing or answering `inconclusive-in-model`; exports carry TSDoc's `@beta` release tag until a fixture backs them | ✎ | — |

package/docs/adr/0013-corpus-files-with-editions.md

@@ -0,0 +1,70 @@
+# ADR 0013 — Rule text as corpus files under an edition registry (GATE-2 adopted)
+
+Date: 2026-09-12
+Status: accepted (2026-09-13)
+
+## Context
+
+ADR 0003 made language a dimension and sketched its layout, but nothing
+landed, and its GATE-2 (an edition layer between instrument and corpus) is
+due for re-take *before* the first non-English corpus. Finlex (`fi`) and BOE
+(`es`) are both licence-clear (ADR 0001, 2026-09-12), so the next text to
+land forces the key shape. This ADR fixes the keys and leaves the words for
+issue #98. A sibling proposal (branch `multi-jurisdiction-schema`, option A)
+confirms GATE-2 declined instead; the two are meant to be read side by side.
+
+## Decision
+
+1. **`data/rules.json` is the skeleton.** Per paragraph: `path`, `rule`,
+   `jurisdiction`, `images`. No `text`, no `rule_title`, no source, and no
+   amendment state of its own. It gains `24(g)(i)`: the Convention has the
+   path; the USCG page lacks the words, which is the corpus's gap.
+2. **`data/editions.json` is the registry: jurisdiction → instrument →
+   editions.** An edition id is `<jurisdiction>@<tag>` (`intl@2016`,
+   `us/inland@2014`), carrying `amended_through`, `in_force` and optionally
+   `superseded_by`. **The tag is the `in_force` year, nothing else** — the
+   amending instrument (an IMO resolution, a Federal Register cite) belongs
+   in `amended_through`, never in the tag. Each jurisdiction names the
+   edition the skeleton consolidates. Two editions of
+   one jurisdiction may be registered at once, which is GATE-2's trigger
+   case expressed as data rather than as a diff between strings.
+3. **One file per corpus**,
+   `data/text/<jurisdiction>/<tag>/<language>.<source_id>.json`, identity
+   `<edition>.<language>.<source_id>`. A corpus names its `edition` and
+   nothing about jurisdiction or amendment state: both are the edition's.
+   CI checks the edition is registered and the filename agrees.
+4. **A corpus paragraph is `rule_title` + `text`** (or ADR 0010's withheld
+   fields). Corpus metadata otherwise as in option A: `tier`,
+   `normalization`, `source` (REQ-PROV-6), `rights` (three statements),
+   `gaps`, optional `translation_of`.
+5. **`data/corpora.json` indexes the files**, derived and drift-checked.
+6. **GATE-2 is re-taken and adopted.** The cost is one registry file and
+   one extra path segment; the gain is that "which consolidated state" is an
+   identifier compared by equality, not free text compared by eye, and a
+   stub must name an edition before it names anything else.
+
+## What the stubs show
+
+Four corpora ship: `intl@2016.en-US.uscg` (today's text, moved verbatim),
+`intl@2016.fi.finlex`, `intl@2016.es.boe` and `us/inland@2014.en-US.ecfr`,
+the last three empty. The edition layer forces a claim option A lets a stub
+defer: the Finnish and Spanish stubs assert they reflect `intl@2016` before
+anyone has checked, and the `us/inland@2014` edition is recalled, not
+verified, and says so. That is the honest cost of this option and the reason
+to look at both.
+
+## Consequences
+
+- Breaking file layout (REQ-PKG-4): `data/rules.json` no longer carries
+  text. colregs-engine's conformance research reads only `paragraphs` keys
+  and is unaffected; anything reading `.text` moves to the en-US corpus.
+- ADR 0010's withheld mechanics move to the corpus paragraph, where the
+  text is; the skeleton has nothing to withhold.
+- A new IMO amendment is a new registered edition, a new skeleton pointer,
+  and new corpus files under a new directory; the old ones may stay until
+  the last consumer moves, marked `superseded_by`. Under option A the same
+  event is an in-place edit of every corpus's `amendment_state`.
+- REQ-LANG-1, -3, -5, -9, -10 and REQ-PROV-6 move from unimplemented to
+  implemented for the data on file; catalogs (REQ-LANG-6) are untouched.
+- Landing Finnish or Spanish words is an edit to one file and one number in
+  the index, and still waits on this ADR being accepted (REQ-GATE-2).

package/docs/budgets.json

@@ -2,20 +2,28 @@
   "$comment": "Prose budgets enforced by prose-budget (the engine in dotfiles .local/bin), run locally by npm test and in CI by the shared workflow. Raising a number or adding an exception is a deliberate, reviewable diff.",
   "lines": {
     "README.md": 360,
-    "AGENTS.md": 120,
+    "AGENTS.md": 200,
     "CLAUDE.md": 10,
     "docs/requirements.md": 1500,
     "docs/identifiers.md": 450,
     "docs/part-b-invariants.md": 950,
+    "docs/adr/0001-name-and-jurisdiction-model.md": 280,
     "docs/adr/0007-rule26-overrides-and-aground.md": 90,
     "docs/adr/0008-mooring-buoy-modifier.md": 90,
     "docs/adr/0009-data-version-stamp.md": 90,
+    "docs/adr/0010-text-withheld-jurisdictions.md": 125,
+    "docs/adr/0011-api-shape.md": 173,
+    "docs/adr/0012-trace-and-rule2-departure-api.md": 203,
+    "docs/verification/2026-09-09-text-slug-straw-man.md": 270,
     "required": true,
-    "pending": []
+    "pending": [],
+    "docs/adr/0013-corpus-files-with-editions.md": 95,
+    "docs/timeline.md": 130
   },
   "json_prose": {
     "targets": [
       "data/*.json",
+      "data/text/**/*.json",
       "fixtures/*.json"
     ],
     "keys": [
@@ -82,6 +90,7 @@
       "AGENTS.md",
       "CLAUDE.md",
       "data/*.json",
+      "data/text/**/*.json",
       "fixtures/*.json",
       "test/*.mjs",
       "docs/**/*.md"
@@ -92,6 +101,7 @@
         "AGENTS.md",
         "CLAUDE.md",
         "data/*.json",
+        "data/text/**/*.json",
         "fixtures/*.json",
         "test/*.mjs"
       ],
@@ -100,6 +110,7 @@
         "AGENTS.md",
         "CLAUDE.md",
         "data/*.json",
+        "data/text/**/*.json",
         "fixtures/*.json",
         "test/*.mjs"
       ],
@@ -108,6 +119,7 @@
         "AGENTS.md",
         "CLAUDE.md",
         "data/*.json",
+        "data/text/**/*.json",
         "fixtures/*.json",
         "test/*.mjs"
       ],
@@ -116,6 +128,7 @@
         "AGENTS.md",
         "CLAUDE.md",
         "data/*.json",
+        "data/text/**/*.json",
         "fixtures/*.json",
         "test/*.mjs"
       ]
@@ -151,6 +164,7 @@
       "CLAUDE.md",
       "docs/**/*.md",
       "data/*.json",
+      "data/text/**/*.json",
       "fixtures/*.json"
     ]
   },

package/docs/gates.json

@@ -36,9 +36,9 @@
       "declined_in": "docs/adr/0003-language-as-a-dimension.md",
       "closing_event": "first-non-english-corpus",
       "trigger": "a jurisdiction publishing two editions in force concurrently",
-      "status": "open",
-      "settled_by": null,
-      "note": "Due at translation #1, not at 1.0."
+      "status": "adopted",
+      "settled_by": "docs/adr/0013-corpus-files-with-editions.md",
+      "note": "Re-taken and adopted ahead of its due date (translation #1) — ADR 0013 introduces the edition registry directly."
     },
     {
       "id": "GATE-3",

package/docs/requirements.md

@@ -76,7 +76,9 @@ Neither consumer lives in this repo.
   (Rule 28 "[Reserved]") means silence-means-inherit would apply
   international law where the national body deliberately has none, so no
   non-`intl` jurisdiction lands before an explicit suppression mechanism
-  exists. A delta that only *adds* entries is exempt: it suppresses nothing,
+  exists. That bar is about suppression, not licensing: it is independent of
+  REQ-PROV-2 and ADR 0010, and it binds whether a jurisdiction's text ships or
+  is withheld. A delta that only *adds* entries is exempt: it suppresses nothing,
   so the Q-11 hazard cannot arise from it (ADR 0008, `30a-buoy`/`30b-buoy`).
   A delta that suppresses or replaces an `intl` entry still waits.
 - **REQ-SCOPE-4** — Adding a jurisdiction MUST be additive. It MUST NOT require
@@ -123,7 +125,12 @@ Four layers, each independently addressable.
 
 - **REQ-MODEL-1** — **Rule text**, verbatim, keyed by paragraph path. Text MUST
   NOT be paraphrased, summarised or reflowed. Where a jurisdiction's text
-  differs, both MUST be stored, keyed by jurisdiction.
+  differs, both MUST be stored, keyed by jurisdiction — unless the paragraph is
+  `text_status: withheld` (ADR 0010), which stores no rule text. What a
+  withheld paragraph carries instead — citation alone, a digest, a
+  deterministic non-prose reduction, or the `intl` equivalent — is pencil in
+  ADR 0010, deliberately unsettled. This requirement bars paraphrasing text
+  the package *ships*; it does not by itself decide the withheld case.
 - **REQ-MODEL-2** — **Light definitions** (Rule 21) MUST carry colour, arc of
   visibility in degrees, and range by length band (Rule 22). Jurisdictions MAY
   add definitions (e.g. the US special flashing light, Inland 21(g)).
@@ -431,8 +438,7 @@ official languages, and many states gazette their own legally binding
 translation. (Recalled, not yet verified against the primary sources — Q-6.)
 See ADR 0003.
 
-- **REQ-LANG-1** **(unimplemented — no language dimension exists in the
-  data)** — Language MUST be a dimension orthogonal to jurisdiction,
+- **REQ-LANG-1** — Language MUST be a dimension orthogonal to jurisdiction,
   identified by BCP 47 tags. Which body of rules applies and which text of
   them is displayed are independent questions; neither MUST ever be inferred
   from the other, and no property beyond the language of the text — not
@@ -445,8 +451,7 @@ See ADR 0003.
   and renaming an identifier is a breaking change (REQ-PKG-4). Immutability
   itself is REQ-MODEL-10; this requirement adds only that identifiers are
   never localized.
-- **REQ-LANG-3** **(unimplemented — rule text is one untagged ruleset, not a
-  corpus per jurisdiction × language × source)** — Rule text MUST be storable
+- **REQ-LANG-3** — Rule text MUST be storable
   as a **corpus** per (jurisdiction × language × source), keyed by paragraph
   path, holding at most one text per path, with corpus-level provenance and
   one declared status tier:
@@ -461,8 +466,7 @@ See ADR 0003.
   rule applies per corpus, against that corpus's own source.
 - **REQ-LANG-4** — Adding a language MUST be additive: no schema change, no
   edits to existing corpora or catalogs (the language mirror of REQ-SCOPE-4).
-- **REQ-LANG-5** **(unimplemented — no coverage declaration, and the CI checks
-  are unwritten)** — Corpora MAY be partial. Coverage MUST be declared in
+- **REQ-LANG-5** — Corpora MAY be partial. Coverage MUST be declared in
   machine-readable form, and CI MUST fail on a corpus key that does not
   resolve to a known paragraph path, and on a corpus filename that disagrees
   with the file's internal metadata. Silence MUST NOT imply coverage (the
@@ -488,15 +492,13 @@ See ADR 0003.
 - **REQ-LANG-8** — A `community`-tier corpus MUST record who produced and
   who reviewed it. Machine translation without named human review MUST NOT
   be accepted.
-- **REQ-LANG-9** **(unimplemented — the shipped text declares no normalization
-  form)** — Verbatim (REQ-MODEL-1) is defined at the Unicode level: each
+- **REQ-LANG-9** — Verbatim (REQ-MODEL-1) is defined at the Unicode level: each
   corpus MUST declare the normalization form applied to its text (NFC unless
   declared otherwise) and MUST NOT insert or strip bidi control characters,
   localize numerals, punctuation, units or quotation marks, or otherwise "fix"
   the source text. Rendering direction is a consumer concern and MUST stay out
   of the data.
-- **REQ-LANG-10** **(unimplemented — neither the skeleton nor the ruleset
-  declares an amendment state)** — The structural skeleton MUST declare, as
+- **REQ-LANG-10** — The structural skeleton MUST declare, as
   data, the amendment state it consolidates (e.g. "COLREGS 72 as amended
   through …"). Every corpus MUST declare the amendment state its source
   reflects. The two MAY differ — a corpus transcribed from an older
@@ -509,9 +511,10 @@ See ADR 0003.
 
 - **REQ-PROV-1** — Every text and image asset MUST record its source, the date
   retrieved, and its licence or public-domain basis.
-- **REQ-PROV-2** — A jurisdiction MUST NOT be added until its reproduction terms
-  have been checked against the primary source and recorded. Recalled or assumed
-  terms are not sufficient.
+- **REQ-PROV-2** — A jurisdiction's *rule text* MUST NOT be published until its
+  reproduction terms have been checked against the primary source and recorded.
+  Recalled or assumed terms are not sufficient. This does not bar *modelling* a
+  jurisdiction: its structure may ship with the text withheld — ADR 0010.
 - **REQ-PROV-3** — Where a licence requires attribution (e.g. OGL, CC BY), the
   attribution text MUST ship in the package, not only in the repo.
 - **REQ-PROV-4** — Code licence and data licence MUST be stated separately. The
@@ -519,8 +522,7 @@ See ADR 0003.
 - **REQ-PROV-5** — Images MUST be addressable as data: an image record per file,
   naming what it illustrates by entry id or paragraph path. Unexplained filename
   prefixes are a provenance defect.
-- **REQ-PROV-6** **(unimplemented — source identity is a prose string and
-  rights are one flat field)** — Source identity MUST be structured data —
+- **REQ-PROV-6** — Source identity MUST be structured data —
   publisher, title, edition, publication and effective dates, URL, retrieval
   date — not a prose string. Rights MUST be recorded separately for the source
   text, for the basis on which this package redistributes it, and for the
@@ -691,20 +693,21 @@ Each gate names the declined design, the closing event, and the trigger.
   second-jurisdiction bundle — justified by Q-11 and GATE-2, no longer by
   a cross-jurisdiction trigger route.
 
-- **GATE-2 — instrument → edition → corpus as first-class layers**
-  (ADR 0003, declined; the adopted 80% is REQ-LANG-10).
-  *Closing event*: the second corpus of any one jurisdiction — which,
-  read against ADR 0003's sequencing, means **the first non-English
-  corpus**, not a distant milestone. A French or Finnish text of `intl`
-  is a second corpus of `intl`. With one corpus, re-homing it under an
-  edition parent is a single file move; the cost scales with
+- ~~**GATE-2 — instrument → edition → corpus as first-class layers**~~
+  (ADR 0003, declined; the adopted 80% is REQ-LANG-10). **Re-taken and
+  adopted, ADR 0013** — ahead of its due date (translation #1): the
+  edition registry lands directly, rather than waiting for the trigger
+  below to fire.
+  *Closing event, as declined*: the second corpus of any one jurisdiction
+  — which, read against ADR 0003's sequencing, means **the first
+  non-English corpus**, not a distant milestone. A French or Finnish text
+  of `intl` is a second corpus of `intl`. With one corpus, re-homing it
+  under an edition parent is a single file move; the cost scales with
   corpora × languages immediately thereafter.
-  *Trigger*: a jurisdiction publishing two editions in force
+  *Trigger, as declined*: a jurisdiction publishing two editions in force
   concurrently — an old and a new text running in parallel through a
   transition period. REQ-LANG-10's declared amendment state makes such a
-  pair machine-visible, which is what gives this trigger a foothold.
-  *Re-take required before translation #1 lands* — the edition-layer
-  decision is due at the first added translation, not at 1.0.
+  pair machine-visible, which is what gave this trigger its foothold.
 
 - **GATE-3 — legal-status × translation-status as two enums**
   (ADR 0003, half-adopted: one tier for legal authority in REQ-LANG-3,
@@ -792,6 +795,9 @@ Tracked here until resolved; each becomes an ADR.
   unece.org was unreachable from the checking host, and the UN's default
   terms (personal, non-commercial use only) block it until written
   permission or a national transposition is chosen instead.
+  **Ruled 2026-09-09 (ADR 0010):** this blocks CEVNI's *text*, not CEVNI.
+  A jurisdiction may be modelled in full with its text withheld, so no
+  session should treat `eu/cevni` as unimplementable.
 - **Q-4** — Two upstream SignalK spec asks are outstanding and independent of
   this package: a making-way indicator, and `design.maxSpeed`.
 - **Q-5** — REQ-VERIFY-5 asks for boundary fixtures on every numeric gate.
@@ -831,6 +837,14 @@ Tracked here until resolved; each becomes an ADR.
   not only as a whole: clearing one candidate source unblocks that corpus
   alone, which is the cheap path when a demo needs a specific language
   early.
+  **BOE (`es`) and Finlex (`fi`) verified clean, 2026-09-09 and 2026-09-12**
+  (ADR 0001 amendments) — both permit the reuse REQ-PROV-2 needs. The UNTS
+  deposit (`en`/`fr`) is confirmed **blocked**, not merely unverified: no
+  UNTS-specific rights statement exists, and the reachable terms are the
+  same personal/non-commercial, no-derivative-works terms that block CEVNI.
+  `es` is the cheapest language to ship the first non-`intl` corpus; UNTS
+  needs written UN permission or a national republication before `en`/`fr`
+  can use the deposit route.
 - **Q-8** — Does the paragraph path survive the first national amalgamation?
   GATE-1's accepted risk rests on paragraph paths being immutable
   (REQ-MODEL-10) — adding and deprecating are fine, but a path that keeps its
@@ -918,7 +932,9 @@ Tracked here until resolved; each becomes an ADR.
   "this path/entry deliberately does not exist here", distinguishable from
   "not yet transcribed". Decide the mechanism in the second-jurisdiction
   bundle (GATE-1 re-take, GATE-2, Q-10); until then no non-`intl`
-  jurisdiction lands.
+  jurisdiction lands. This is the live blocker on CEVNI, and it is *not* the
+  licence one: ADR 0010 removed the licence block by permitting structure with
+  the text withheld, and left this one standing.
   Also from the same verification pass, tracked on the global board rather
   than here: four transcription defects in `data/rules.json` itself
   (`21(a)`, `21(b)`, `23(b)`, `29(b)`) — a data fix, not a design
@@ -1328,6 +1344,16 @@ written up in `docs/identifiers.md` §"Effects"; what it could not is here.
   be a number invented rather than declared. Settled by whatever settles the
   `conduct` monitors, which are the things that watch a duty end rather than
   begin.
+
+  **Ruled 2026-09-08:** while one vessel holds the latch, 13(a)'s sector
+  test is suppressed on the other, newly-gaining vessel — once overtaking,
+  always overtaking, per 13(d)'s own text, so a geometry test that would
+  newly name a second give-way vessel must not fire while the first still
+  holds the role by history alone. `13a`'s sector branch now also reads
+  `other:hist:was_overtaking: false`; the closing fixture in
+  `fixtures/situation-fixtures.json` is the case this closes — a vessel
+  drops back onto the latch-holder's own stern, and only the latch-holder
+  gives way.
 - **Q-48** — **Nothing checks that a situation is geometrically possible.**
   `own:geo:rel_bearing_deg`, `other:geo:rel_bearing_deg`, the two
   `kin:heading_deg` and the two `kin:sog_kn` are six facts related by two
@@ -1398,16 +1424,25 @@ nothing is blocked while open.
 - **Q-51** — **What arms 13(d)'s latch?** *A:* 13(b)'s deeming, at the first
   state the geometry holds. *B:* 13(a)'s duty actually attaching. They differ
   where the geometry holds but a condition on 13(a) does not — `Q-50`'s
-  surface. Default **A**: `hist:was_overtaking` is "was, at some earlier point
-  in this encounter, an overtaking vessel" and `13b-overtaking` is geometry.
-  No recommendation; downstream of `Q-50`.
+  surface. Pencilled **B** ✎ (Solace, 2026-09-14): the latch arms when the
+  duty attaches. KIVELI [2025] EWHC 1185 (Admlty) holds the analogous Rule 14
+  latch arms on risk of collision and then persists; no authority was found on
+  overtaking geometry with no risk of collision. Free to reverse: four entries
+  (`13a`, `13b-*`, `13d`) and their fixtures, and nothing consumes the one
+  state this changes the answer for. Settled by: a decision on Rule 13 itself,
+  or Cockcroft & Lameijer on whether overtaking status needs risk of
+  collision.
 - **Q-52** — **What does 13(d)'s latch forbid?** *Narrow:* reclassification to
   *crossing* only, as the paragraph says, leaving head-on to Rule 14 on the
   geometry of the moment. *Broad:* the encounter stays an overtaking and no
   other Section II classification attaches. Both preserve the duty; they differ
-  on encounter type, which Rule 17's phases and 14(a) hang off. Default
-  **broad**: `13d` yields `encounter: overtaking` from history alone, `14b` and
-  `15a-crossing` gate on `was_overtaking: false`. No recommendation.
+  on encounter type, which Rule 17's phases and 14(a) hang off.
+  Pencilled **broad** ✎ (Solace, 2026-09-14), which is also the data's
+  default: `13d` yields `encounter: overtaking` from history alone, `14b` and
+  `15a-crossing` gate on `was_overtaking: false`. 13(a)'s "notwithstanding"
+  already displaces Rule 14; eCOLREGs states the broad reading as conventional.
+  Settled by: a case or commentary on an overtaking becoming a head-on; none
+  found.
 - **Q-53** — **Does 17(a)(ii) suspend 17(a)(i)'s duty, or add an exception?**
   *Suspension:* "may, however" lifts the duty once non-compliance is apparent;
   a monitor then flags nothing. *Exception:* the duty stands and a departure is
@@ -1447,3 +1482,10 @@ Two decisions taken in pencil, reversible in one edit: the invariants live in
 their own document under `REQ-INV-1`–`REQ-INV-7` (§4.2 says why), and the id
 scheme is `REQ-INV-2`'s — cheap to change until P4.2 cites an id from a TLA+
 module, expensive after.
+
+A third, ruled rather than pencil: **`docs/part-b-invariants.md` stays
+hand-written Markdown; no derived JSON registry.** Ruled 2026-09-08. Revisit
+only if P4.2's TLA+ needs to cite `INV-` ids mechanically — the id scheme
+just above is already the cheap-to-change half of that trigger, so the
+revisit costs one file's worth of tooling, not a re-derivation of the ids
+themselves.