rcf-lite 0.28.4 → 0.30.0

package/src/query/gates.js

@@ -45,7 +45,8 @@
 
 import { computeQueue } from '../build/queue.js';
 import { isOptedOut } from '../req-baseline/opt-out.js';
-import { BRIEF_KINDS } from '../define/ledgers.js';
+import { BRIEF_KINDS, parseResolvedBy } from '../define/ledgers.js';
+import { applicableConcernsForShapes } from '../define/concern-catalogue.js';
 
 /** Canonical stage order (proposal §3.2). */
 export const STAGE_ORDER = /** @type {const} */ (['D1', 'D2', 'D3', 'D4', 'D5', 'D6', 'D7', 'D8']);
@@ -91,6 +92,329 @@ export const INTERFACE_KINDS = /** @type {const} */ ([
   'port', 'fileFormat', 'fixture', 'other',
 ]);
 
+/**
+ * Owning persona for every stage-gate check in 0.29.0 (ADR-4126).
+ *
+ * Two values: `productOwner` (the person who owns what the product
+ * must do) and `engineer` (the person who owns how it is built).
+ * There is no `either` / `shared` / `both`; a check that would need
+ * both is split, which is what happens to `skeleton:reqFields`
+ * (becomes `skeleton:reqIntent` + `skeleton:reqShape`) and
+ * `decisions:allAnswered` (becomes `decisions:wellFormed` +
+ * `decisions:allAnswered`). A failing item inherits its check's
+ * persona; there is no per-item override.
+ *
+ * The `notApplicable` placeholder (`stage:<D>:scope`) carries the
+ * per-stage fallback persona from `STAGE_FALLBACK_PERSONA` below.
+ * It is always ok so it never affects a level verdict.
+ */
+export const CHECK_PERSONA = /** @type {const} */ ({
+  // D1 Brief: every check is PO (the brief is the PO's statement of intent).
+  'brief:sinceFreeze': 'productOwner',
+  'brief:kinds': 'productOwner',
+  'brief:openQuestions': 'productOwner',
+  'brief:profile': 'productOwner',
+  // D2 Skeleton: resolvedBy + reqIntent are PO; reqShape, tadPersistence, deployAdr, standardsCited are engineer.
+  'skeleton:resolvedBy': 'productOwner',
+  'skeleton:reqIntent': 'productOwner',
+  'skeleton:reqShape': 'engineer',
+  'skeleton:tadPersistence': 'engineer',
+  'skeleton:deployAdr': 'engineer',
+  'skeleton:standardsCited': 'engineer',
+  // D3 Shapes: every check is engineer (shapes are the engineer's first act after hand-over).
+  'shapes:tacHasInterface': 'engineer',
+  'shapes:kindVocabulary': 'engineer',
+  'shapes:draftSettled': 'engineer',
+  'shapes:templateMarkers': 'engineer',
+  'shapes:entityJoin': 'engineer',
+  'shapes:pathsResolve': 'engineer',
+  // D4 Stories: reqHasUs is PO ("what does someone do with this?"); the floors, closed sets and ownerRef resolution are engineer.
+  'stories:reqHasUs': 'productOwner',
+  'stories:usFloors': 'engineer',
+  'stories:closedSets': 'engineer',
+  'stories:ownerRefResolves': 'engineer',
+  // D5 Crosscut: TAD + concern-ledger content and the catalogue walk are engineering.
+  'crosscut:securityArchitecture': 'engineer',
+  'crosscut:operationalConcerns': 'engineer',
+  'crosscut:concernsResolved': 'engineer',
+  'crosscut:catalogue': 'engineer',
+  // D6 Consistency: schema validity, probes and the four scans are engineer.
+  'consistency:validateClean': 'engineer',
+  'consistency:probeCount': 'engineer',
+  'consistency:contradictions': 'engineer',
+  'consistency:unsatisfiable': 'engineer',
+  'consistency:duplicates': 'engineer',
+  'consistency:orphanInterfaces': 'engineer',
+  // D7 Decisions: enumeration is PO (the PO answers or lets the default stand);
+  // zero-open is the engineer's hand-over condition.
+  'decisions:wellFormed': 'productOwner',
+  'decisions:allAnswered': 'engineer',
+  // D8 Freeze: every check is mechanical / engineering.
+  'freeze:priorGates': 'engineer',
+  'freeze:acFbsOwnership': 'engineer',
+  'freeze:queueHead': 'engineer',
+  'freeze:validateClean': 'engineer',
+});
+
+/**
+ * Per-check heading question in the owning persona's register
+ * (ADR-4126, proposal section 1.1). The text report and the
+ * Readiness tab print the question as the heading of each check's
+ * findings list. Static per check in 0.29.0; per-item plain-English
+ * wording is step 3's guided elicitation.
+ */
+export const CHECK_QUESTION = /** @type {const} */ ({
+  'brief:sinceFreeze': 'What has changed, or what is this project for?',
+  'brief:kinds': 'Is this a capability, a constraint, an actor, or something else?',
+  'brief:openQuestions': 'Any open questions in the brief, resolved or promoted to a decision?',
+  'brief:profile': 'How do you want to review, and who are you writing for?',
+  'skeleton:resolvedBy': 'Does this statement become a requirement, an entity, or an omission?',
+  'skeleton:reqIntent': 'What does this requirement mean and where does it sit?',
+  'skeleton:reqShape': 'Every requirement in scope carries a shape classification.',
+  'skeleton:tadPersistence': 'TAD data architecture lists dataStores and coreEntities for persistence REQs.',
+  'skeleton:deployAdr': 'Exactly one Deploy target or Deploy deferral ADR exists.',
+  'skeleton:standardsCited': 'Every registered standards pack is cited in a REQ rationale or an ADR, or waived by a concern-ledger entry.',
+  'shapes:tacHasInterface': 'Every TAC in scope has at least one interface.',
+  'shapes:kindVocabulary': 'Every interface kind is in the closed vocabulary.',
+  'shapes:draftSettled': 'Every draft interface has been settled (the [draft] marker is removed).',
+  'shapes:templateMarkers': 'Every interface description carries the per-kind markers (recordShape fields:, httpRoute method/path/request/response/errors, and so on).',
+  'shapes:entityJoin': 'Every core entity is named by exactly one recordShape.',
+  'shapes:pathsResolve': 'Every path: token in an interface description resolves on disk or the description is authoredAt D3.',
+  'stories:reqHasUs': 'What does someone do with this requirement?',
+  'stories:usFloors': 'Every story in scope meets the class, tacIds and testability floors.',
+  'stories:closedSets': 'Every acceptance criterion that invites a set of values names the set or points to an owner.',
+  'stories:ownerRefResolves': 'Every ownerRef on an acceptance criterion resolves to an interface on the owning TAC.',
+  'crosscut:securityArchitecture': 'TAD.securityArchitecture is present when an auth or httpApi REQ exists.',
+  'crosscut:operationalConcerns': 'TAD.operationalConcerns is present when a deployed-scope AC exists.',
+  'crosscut:concernsResolved': 'Every concern-ledger entry on a REQ in scope is applied or waived.',
+  'crosscut:catalogue': 'Every applicable crosscut concern for a REQ in scope has a concern-ledger entry applied or waived.',
+  'consistency:validateClean': 'Validate is clean tree-wide.',
+  'consistency:probeCount': 'Zero open probe-ledger entries.',
+  'consistency:contradictions': 'No two acceptance criteria on one story share a when clause with a negated then.',
+  'consistency:unsatisfiable': 'Every then names a field some recordShape defines.',
+  'consistency:duplicates': 'No two acceptance criteria across stories share an identical description.',
+  'consistency:orphanInterfaces': 'Every interface is reached by an AC ownerRef or a REQ deliveredBy.',
+  'decisions:wellFormed': 'Every decision is enumerated (question, two or more options, a default).',
+  'decisions:allAnswered': 'Zero decisions are open.',
+  'freeze:priorGates': 'Every prior stage passed or is acknowledged at the current hash.',
+  'freeze:acFbsOwnership': 'Every AC is owned by exactly one FBS.',
+  'freeze:queueHead': 'Queue head is actionable and not a placeholder.',
+  'freeze:validateClean': 'Validate is clean tree-wide.',
+});
+
+/**
+ * Per-stage fallback persona for the `stage:<D>:scope` placeholder
+ * check that `notApplicable` envelopes carry. The placeholder is
+ * always ok so this never affects a level, but keeps "every check
+ * has a persona" true for consumers and the table test (ADR-4126
+ * decision 10).
+ */
+export const STAGE_FALLBACK_PERSONA = /** @type {const} */ ({
+  D1: 'productOwner',
+  D2: 'productOwner',
+  D3: 'engineer',
+  D4: 'productOwner',
+  D5: 'engineer',
+  D6: 'engineer',
+  D7: 'productOwner',
+  D8: 'engineer',
+});
+
+/**
+ * Look up the question heading for a check name.
+ * @param {string} name
+ * @returns {string}
+ */
+export function checkQuestion(name) {
+  return /** @type {any} */ (CHECK_QUESTION)[name] ?? '';
+}
+
+/**
+ * Look up the owning persona for a check name.
+ * @param {string} name
+ * @returns {'productOwner' | 'engineer' | null}
+ */
+export function checkPersona(name) {
+  const v = /** @type {any} */ (CHECK_PERSONA)[name];
+  return v === 'productOwner' || v === 'engineer' ? v : null;
+}
+
+/**
+ * Draft marker (ADR-4126 for `TAC.interfaces[].description` in 0.29.0;
+ * REQ-188 extends it to `TAC.purpose` and `coreEntities[].description`
+ * in 0.30.0). A description that starts with `[draft]` after optional
+ * leading whitespace is pre-populated engineer entry material; the
+ * engineer removes the marker when the shape is settled. Decision 6
+ * uses the same bracket-prefix convention for AC class.
+ */
+const INTERFACE_DRAFT_RE = /^\[draft\]/;
+
+/**
+ * True when a string carries the leading `[draft]` marker
+ * (whitespace tolerated). Pure string test used by every draft-home
+ * reader below.
+ *
+ * @param {unknown} value
+ * @returns {boolean}
+ */
+export function hasDraftMarker(value) {
+  if (typeof value !== 'string') return false;
+  return INTERFACE_DRAFT_RE.test(value.trimStart());
+}
+
+/**
+ * True when an interface's `description` carries the leading
+ * `[draft]` marker (whitespace tolerated). Thin wrapper over
+ * `hasDraftMarker` kept for ADR-4126 call sites; REQ-188 adds
+ * `parseTacPurposeDraft` and `parseCoreEntityDraft` for the two new
+ * homes.
+ *
+ * @param {unknown} iface
+ * @returns {boolean}
+ */
+export function parseInterfaceDraft(iface) {
+  if (!iface || typeof iface !== 'object') return false;
+  return hasDraftMarker(/** @type {any} */ (iface).description);
+}
+
+/**
+ * True when a TAC's `purpose` carries the leading `[draft]` marker
+ * (whitespace tolerated). REQ-188 draft home; the engineer removes
+ * the marker when the TAC's purpose is owned.
+ *
+ * @param {unknown} tac
+ * @returns {boolean}
+ */
+export function parseTacPurposeDraft(tac) {
+  if (!tac || typeof tac !== 'object') return false;
+  return hasDraftMarker(/** @type {any} */ (tac).purpose);
+}
+
+/**
+ * True when a coreEntities entry's `description` carries the
+ * leading `[draft]` marker (whitespace tolerated). REQ-188 draft
+ * home; the engineer removes the marker when the entity is owned.
+ *
+ * @param {unknown} entity
+ * @returns {boolean}
+ */
+export function parseCoreEntityDraft(entity) {
+  if (!entity || typeof entity !== 'object') return false;
+  return hasDraftMarker(/** @type {any} */ (entity).description);
+}
+
+/**
+ * Per-kind required marker tokens on `interfaces[].description` for
+ * the `shapes:templateMarkers` D3 bite check (ADR-4131, spec section 4
+ * row "D3 template parser"). A marker is "present" when a line of the
+ * description matches the marker's own regex: a `<name>:` prefix for
+ * `fields:`, `instances:`, `payload:`, `usage:` and `format:`; a
+ * `method`, `path`, `request`, `response`, `errors` or `protocol`
+ * token on an httpRoute, uiRoute or port (word-bounded, case-sensitive,
+ * tolerating a trailing colon or whitespace); `other` requires a
+ * non-empty description after the optional `[draft]` prefix (its
+ * "note"). The regexes are deliberately permissive so a plain
+ * `method: POST` and a bullet list `- method: POST` both qualify, and
+ * so a `[draft]` prefix never masks the marker scan.
+ */
+const INTERFACE_TEMPLATE_MARKERS = /** @type {const} */ ({
+  recordShape: [{ name: 'fields', re: /(^|\n)\s*(?:[-*]\s*)?fields\s*:/ }],
+  httpRoute: [
+    { name: 'method', re: /(^|\n|\s)method\s*[:=]/ },
+    { name: 'path', re: /(^|\n|\s)path\s*[:=]/ },
+    { name: 'request', re: /(^|\n|\s)request\s*[:=]/ },
+    { name: 'response', re: /(^|\n|\s)response\s*[:=]/ },
+    { name: 'errors', re: /(^|\n|\s)errors\s*[:=]/ },
+  ],
+  fixture: [{ name: 'instances', re: /(^|\n)\s*(?:[-*]\s*)?instances\s*:/ }],
+  event: [{ name: 'payload', re: /(^|\n)\s*(?:[-*]\s*)?payload\s*:/ }],
+  cliCommand: [{ name: 'usage', re: /(^|\n)\s*(?:[-*]\s*)?usage\s*:/ }],
+  uiRoute: [{ name: 'path', re: /(^|\n|\s)path\s*[:=]/ }],
+  port: [{ name: 'protocol', re: /(^|\n|\s)protocol\s*[:=]/ }],
+  fileFormat: [{ name: 'format', re: /(^|\n)\s*(?:[-*]\s*)?format\s*:/ }],
+  other: [],
+});
+
+/**
+ * Strip a leading `[draft]` marker from a description so the marker
+ * scan sees the real text underneath. Pure.
+ *
+ * @param {string} desc
+ * @returns {string}
+ */
+function stripDraftPrefix(desc) {
+  return desc.replace(/^\s*\[draft\]\s*/, '');
+}
+
+/**
+ * ADR-4131 (0.30.0 PR 5): per-kind marker presence on an interface.
+ * Returns `{ kind, missing: string[] }` naming the markers that are
+ * absent from `iface.description`. For `other` the "note" is any
+ * non-empty description after the optional `[draft]` prefix. For an
+ * interface whose kind is outside INTERFACE_KINDS the function returns
+ * `{ kind, missing: [] }` so the caller can treat vocabulary errors
+ * through `shapes:kindVocabulary` alone.
+ *
+ * @param {unknown} iface
+ * @returns {{ kind: string|null, missing: string[] }}
+ */
+export function parseInterfaceTemplate(iface) {
+  if (!iface || typeof iface !== 'object') return { kind: null, missing: [] };
+  const kind = typeof (/** @type {any} */ (iface).kind) === 'string' ? /** @type {any} */ (iface).kind : null;
+  const descRaw = typeof (/** @type {any} */ (iface).description) === 'string'
+    ? /** @type {any} */ (iface).description
+    : '';
+  const desc = stripDraftPrefix(descRaw);
+  if (kind === 'other') {
+    const note = desc.trim();
+    return { kind, missing: note.length === 0 ? ['note'] : [] };
+  }
+  const markers = /** @type {any} */ (INTERFACE_TEMPLATE_MARKERS)[kind];
+  if (!Array.isArray(markers)) return { kind, missing: [] };
+  const missing = [];
+  for (const marker of markers) {
+    if (!marker.re.test(desc)) missing.push(marker.name);
+  }
+  return { kind, missing };
+}
+
+/**
+ * Rough `path:` token scanner for an interface description. Returns
+ * every candidate path token the description names so the CLI can
+ * resolve them on disk and the gate can decide `shapes:pathsResolve`
+ * against the resolved map (ADR-4131). A candidate is any text that
+ * follows a `path:` or `path =` marker and looks like a repo-relative
+ * path (contains a `/` or ends with a file extension, no scheme). The
+ * scanner is deliberately conservative: an http URL, a bare word, a
+ * glob or a template placeholder is not a candidate. Exported for the
+ * CLI's resolve-on-disk pass.
+ *
+ * @param {string} description
+ * @returns {string[]}
+ */
+export function extractInterfacePathTokens(description) {
+  if (typeof description !== 'string' || description.length === 0) return [];
+  const text = stripDraftPrefix(description);
+  const out = [];
+  const re = /\bpath\s*[:=]\s*["'`]?([^\s"'`,;)\]]+)/g;
+  let m;
+  while ((m = re.exec(text)) !== null) {
+    const token = m[1];
+    if (!token) continue;
+    if (/^[a-z]+:\/\//i.test(token)) continue;
+    if (token.startsWith('{') || token.startsWith('<') || token.includes('*')) continue;
+    // Skip HTTP / UI route-ish tokens: a leading slash with no file
+    // extension is a route path (an httpRoute or uiRoute's `path:`
+    // marker), not a repo path. A legitimate file path lands as
+    // `src/x.js` or `packages/rcf-lite/CHANGELOG.md`; those don't
+    // start with `/`.
+    if (token.startsWith('/') && !/\.[a-zA-Z0-9]+$/.test(token)) continue;
+    if (!/\//.test(token) && !/\.[a-zA-Z0-9]+$/.test(token)) continue;
+    out.push(token);
+  }
+  return out;
+}
+
 /** Warn-with-ack stages in 0.29.0 (ADR-4122). */
 const WARN_WITH_ACK = new Set(['D3', 'D5', 'D6']);
 
@@ -108,6 +432,21 @@ export function stagePolicy(stage) {
   return WARN_WITH_ACK.has(stage) ? 'warnWithAck' : 'blocking';
 }
 
+/**
+ * ADR-4131 (0.30.0 PR 5): the three gates that accept a recorded
+ * `--ack` override. `stagePolicy` keeps returning `blocking` for every
+ * stage so the readyToBuild fold stays untouched; `ackable(stage)` is
+ * the companion signal the readiness and freeze CLIs read to decide
+ * whether a failing stage honours an acknowledgement at the current
+ * hash. True for D3, D5 and D6; false for everything else.
+ *
+ * @param {string} stage
+ * @returns {boolean}
+ */
+export function ackable(stage) {
+  return WARN_WITH_ACK.has(stage);
+}
+
 /**
  * Scaffold TODO placeholder marker: uppercase "TODO" followed by a
  * colon, matching every scaffold string `rcf init` and `rcf define
@@ -124,6 +463,192 @@ const TODO_RE = /\bTODO:/;
 /** Bracketed AC-class prefix (Baz decision 6, proposal §3.2 D4). */
 const AC_CLASS_RE = /^\[(happy|edge|failure|must-not|non-functional)\]/;
 
+/**
+ * Enumeration cues for `stories:closedSets` (spec section 4 row 'D4
+ * closed-set and ownerRef as findings', 0.30.0 PR 6). An AC description
+ * that contains any of these cues outside a quoted string, with no
+ * inline bracketed list or ownerRef, invites an unlisted value and
+ * fails the check. The cues are matched case-insensitively against the
+ * raw description (minus any leading [class] marker and any
+ * double-quoted substrings).
+ */
+const CLOSED_SET_CUES = Object.freeze([
+  'one of',
+  'any of',
+  'the following',
+  'types of',
+  'status is',
+]);
+// Word-boundary matchers for each cue so a longer word that happens
+// to contain the cue as a substring (e.g. "status issue" containing
+// "status is") does not trip the gate.
+const CLOSED_SET_CUE_RES = Object.freeze(
+  CLOSED_SET_CUES.map((cue) => new RegExp(`\\b${cue.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&')}\\b`, 'i')),
+);
+
+/**
+ * Inline bracketed list regex for the closed-sets check: a square-
+ * bracketed group whose contents look like a list of two or more
+ * tokens separated by commas, slashes or pipes. A bare `[happy]`
+ * class marker is NOT a list (one token, no separator); `[a, b]`,
+ * `[a | b | c]` and `[a/b]` are.
+ */
+const INLINE_LIST_RE = /\[[^\]\n]*[,|\/][^\]\n]*\]/;
+
+/**
+ * ownerRef marker: a cheap presence check for the structured
+ * `{ tacId, field: "interfaces[<name>]" }` pointer. True when the AC
+ * carries an ownerRef object (consistency-lint and PR 6 both read the
+ * same field).
+ *
+ * @param {unknown} ac
+ * @returns {boolean}
+ */
+function acHasOwnerRef(ac) {
+  const ref = ac && typeof ac === 'object' ? /** @type {any} */ (ac).ownerRef : null;
+  if (!ref || typeof ref !== 'object') return false;
+  // R11 (spec section 17, 2026-10-03): an ownerRef may name a TAC
+  // (via tacId) OR an ADR (via adrId). Pre-R11 code only recognised
+  // tacId; the ADR branch was dropped silently.
+  return typeof ref.tacId === 'string' || typeof ref.adrId === 'string';
+}
+
+/**
+ * Strip double-quoted substrings so a quoted cue inside the AC text
+ * does not fire the closed-sets check (shared with D6's negation guard
+ * convention). Matches `"..."` with no embedded unescaped double
+ * quote; the regex is deliberately permissive. The strip is only for
+ * the cue scan; the inline-list scan reads the full description.
+ *
+ * @param {string} desc
+ * @returns {string}
+ */
+function stripQuotedSubstrings(desc) {
+  return desc.replace(/"[^"\n]*"/g, '');
+}
+
+/**
+ * True when the AC description carries an enumeration cue outside a
+ * quoted substring, with no inline bracketed list and no ownerRef
+ * pointer. Pure.
+ *
+ * @param {unknown} ac
+ * @returns {boolean}
+ */
+function failsClosedSets(ac) {
+  const descRaw = ac && typeof ac === 'object' ? /** @type {any} */ (ac).description : null;
+  if (typeof descRaw !== 'string' || descRaw.length === 0) return false;
+  if (acHasOwnerRef(ac)) return false;
+  const descNoClass = descRaw.replace(AC_CLASS_RE, '').trim();
+  if (INLINE_LIST_RE.test(descNoClass)) return false;
+  const descForCues = stripQuotedSubstrings(descNoClass);
+  for (const re of CLOSED_SET_CUE_RES) {
+    if (re.test(descForCues)) return true;
+  }
+  return false;
+}
+
+/**
+ * Parse an `interfaces[<name>]` field pointer into its interface
+ * name. Accepts any non-empty name between the brackets (interface
+ * names routinely carry dots, slashes and spaces); returns null for
+ * an unparseable pointer.
+ *
+ * @param {unknown} field
+ * @returns {string | null}
+ */
+function parseOwnerRefInterfaceField(field) {
+  if (typeof field !== 'string') return null;
+  const m = field.match(/^interfaces\[([^\]\n]+)\]$/);
+  return m ? m[1] : null;
+}
+
+/**
+ * R11 field grammar (spec section 17, 2026-10-03). An `ownerRef` or
+ * object-form `deliveredBy` `{ tacId | adrId, field }` resolves when
+ * `field` names an existing field path on the owning document in
+ * bracket grammar:
+ *
+ *   - `interfaces[<name>]` resolves when `doc.interfaces[].name` matches.
+ *   - `responsibilities[<n>]` resolves when `doc.responsibilities[n]`
+ *     exists (non-negative integer index, zero-based).
+ *   - `dependencies[<name>]` resolves when `doc.dependencies[].name` matches.
+ *   - `alternativesConsidered[<n>]` resolves when the ADR has an
+ *     alternative at that index.
+ *   - A bare schema field name (`purpose`, `internalStructure`,
+ *     `decision`, `name`, `context`, `consequences`, `tradeoffs`,
+ *     `notes`, `description`, `responsibilities`, `dependencies`,
+ *     `interfaces`, `alternativesConsidered`) resolves when the
+ *     document carries a non-empty value under that key.
+ *
+ * Dotted grammar (`interfaces.name`, `responsibilities.foo`) is NOT
+ * accepted: callers of the R11 widening MUST rewrite to bracket
+ * grammar first. A path that does not match any arm returns false.
+ *
+ * `AC-17405-2` is unchanged in effect: `interfaces[loan]` on a TAC
+ * carrying an interface named `loan` resolves; `interfaces[missing]`
+ * fails.
+ *
+ * @param {unknown} doc - the owning TAC or ADR document.
+ * @param {unknown} field - the ownerRef/deliveredBy field string.
+ * @returns {boolean}
+ */
+export function resolveOwnerRefField(doc, field) {
+  if (!doc || typeof doc !== 'object') return false;
+  if (typeof field !== 'string' || field.length === 0) return false;
+  const d = /** @type {any} */ (doc);
+  // interfaces[<name>] -- preserved from the 0.29.0 helper.
+  const ifaceMatch = field.match(/^interfaces\[([^\]\n]+)\]$/);
+  if (ifaceMatch) {
+    const name = ifaceMatch[1];
+    return Array.isArray(d.interfaces)
+      && d.interfaces.some((iface) => iface && typeof iface === 'object' && iface.name === name);
+  }
+  // dependencies[<name>] (TAC.dependencies[].name).
+  const depMatch = field.match(/^dependencies\[([^\]\n]+)\]$/);
+  if (depMatch) {
+    const name = depMatch[1];
+    return Array.isArray(d.dependencies)
+      && d.dependencies.some((dep) => dep && typeof dep === 'object' && dep.name === name);
+  }
+  // responsibilities[<n>] (zero-based integer index on the strings array).
+  const respMatch = field.match(/^responsibilities\[(\d+)\]$/);
+  if (respMatch) {
+    const idx = Number(respMatch[1]);
+    return Array.isArray(d.responsibilities) && idx < d.responsibilities.length
+      && typeof d.responsibilities[idx] === 'string'
+      && d.responsibilities[idx].length > 0;
+  }
+  // alternativesConsidered[<n>] (ADR).
+  const altMatch = field.match(/^alternativesConsidered\[(\d+)\]$/);
+  if (altMatch) {
+    const idx = Number(altMatch[1]);
+    return Array.isArray(d.alternativesConsidered) && idx < d.alternativesConsidered.length
+      && d.alternativesConsidered[idx] && typeof d.alternativesConsidered[idx] === 'object';
+  }
+  // Bare schema field name. Must be in the TAC/ADR schema and present
+  // and non-empty on the document. The accepted set covers the schema
+  // fields the spec names and the extras TAC/ADR carry; a field name
+  // outside the set returns false.
+  const BARE_FIELDS = new Set([
+    // TAC fields.
+    'purpose', 'internalStructure', 'tradeoffs', 'notes', 'name',
+    'responsibilities', 'interfaces', 'dependencies',
+    // ADR fields.
+    'decision', 'context', 'consequences', 'title',
+    'alternativesConsidered',
+    // Common.
+    'description',
+  ]);
+  if (!BARE_FIELDS.has(field)) return false;
+  const v = d[field];
+  if (v == null) return false;
+  if (typeof v === 'string') return v.length > 0;
+  if (Array.isArray(v)) return v.length > 0;
+  if (typeof v === 'object') return Object.keys(v).length > 0;
+  return true;
+}
+
 /**
  * Parse the leading bracketed class marker on `ac.description`.
  * Returns the class token, or null when no marker is present.
@@ -156,12 +681,26 @@ export function parseAcClass(ac) {
  *   twentieth failure. `ok` is likewise derived from the untruncated
  *   count. The section 2.4 shape stays intact -- `failing` remains the
  *   display array; no new field is exported.
- * @returns {{ name: string, ok: boolean, over: 'delta'|'tree', pass: number, total: number, failing: Array<{ id: string, why: string }> }}
+ * @returns {{ name: string, ok: boolean, over: 'delta'|'tree', pass: number, total: number, failing: Array<{ id: string, why: string }>, persona: 'productOwner'|'engineer', question: string }}
  */
 function makeCheck(name, over, total, failing, totalFailingCount) {
   const nFailing = typeof totalFailingCount === 'number' ? totalFailingCount : failing.length;
   const pass = Math.max(0, total - nFailing);
-  return { name, ok: nFailing === 0, over, pass, total, failing: [...failing] };
+  // Resolve persona + question for the check. For stage placeholders
+  // (`stage:<D>:scope`) the persona comes from STAGE_FALLBACK_PERSONA.
+  // Unknown names fall back to engineer with an empty question so
+  // consumers never see null; the table test catches any new check
+  // that forgets to register in CHECK_PERSONA / CHECK_QUESTION.
+  let persona = /** @type {any} */ (CHECK_PERSONA)[name];
+  if (!persona) {
+    const stageMatch = /^stage:(D[1-8]):scope$/.exec(name);
+    persona = stageMatch
+      ? /** @type {any} */ (STAGE_FALLBACK_PERSONA)[stageMatch[1]]
+      : 'engineer';
+  }
+  const question = /** @type {any} */ (CHECK_QUESTION)[name]
+    ?? (name.startsWith('stage:') ? 'No documents of this stage’s type are in scope.' : '');
+  return { name, ok: nFailing === 0, over, pass, total, failing: [...failing], persona, question };
 }
 
 /**
@@ -232,6 +771,11 @@ function asSet(scope) {
  * @property {{ skipReviewFor?: string } | undefined} profile  parsed profile switches (light shape)
  * @property {string | null | undefined} currentTreeHash  for warn-with-ack acknowledgement match
  * @property {Array<{ state: string }> | undefined} priorStages  D8 reads earlier stage states from this
+ * @property {Set<string> | undefined} resolvedPaths  ADR-4131 (0.30.0 PR 5): set of repo-relative paths the CLI
+ *   already resolved on disk; `shapes:pathsResolve` reads this to decide
+ *   whether a `path:` token on an interface description resolves. Empty or
+ *   undefined means no path is known-resolved, so every candidate token
+ *   fails unless the interface description carries `authoredAt: D3`.
  */
 
 /**
@@ -342,57 +886,68 @@ export function checkD2Skeleton(ctx) {
 
   const checks = [];
 
-  // Check 1: every capability/constraint/entity/... statement resolves
-  // (the statement carries `resolvedBy` naming a REQ / TAD entity / TAC
-  // / recorded omission id, OR its text matches an existing REQ title).
-  // Cheap check: a `resolvedBy` string or a name-hit on titles.
-  const resolvedByStmt = (s) => {
+  // Check 1 (0.30.0): every capability/constraint/entity/... statement
+  // resolves to a closed-grammar pointer in `resolvedBy`:
+  //   REQ-nnn | TAD.entity:<name> | PRD.user:<name>
+  //   | TAD.system:<name> | TAC-nnnn | omitted:<reason>
+  // The 0.29.0 REQ-title fallback is dropped (decision 3; a title hit
+  // becomes a suggestion the PR 2 computeQuestions surface returns).
+  // A statement with no `resolvedBy` fails; a statement with a
+  // `resolvedBy` outside the grammar fails with 'pointer does not
+  // resolve'.
+  /** @type {Array<{ id: string, why: string }>} */
+  const unresolvedFailing = [];
+  for (const s of resolvingStmts) {
     const rb = s?.resolvedBy;
-    if (typeof rb === 'string' && rb.length > 0) return true;
-    if (rb && typeof rb === 'object' && Object.keys(rb).length > 0) return true;
-    const text = typeof s?.text === 'string' ? s.text.trim().toLowerCase() : '';
-    if (!text) return false;
-    for (const req of tree.requirements ?? []) {
-      const title = typeof req?.title === 'string' ? req.title.toLowerCase() : '';
-      if (title && text.includes(title)) return true;
-    }
-    return false;
-  };
-  const unresolvedStmts = resolvingStmts.filter((s) => !resolvedByStmt(s));
+    if (typeof rb !== 'string' || rb.length === 0) {
+      unresolvedFailing.push({ id: `brief:${s.id}`, why: `${s.kind} statement has no resolvedBy` });
+      continue;
+    }
+    const parsed = parseResolvedBy(rb, tree);
+    if (!parsed.ok) {
+      unresolvedFailing.push({ id: `brief:${s.id}`, why: 'pointer does not resolve' });
+    }
+  }
   checks.push(makeCheck(
     'skeleton:resolvedBy',
     'delta',
     resolvingStmts.length,
-    unresolvedStmts.map((s) => ({ id: `brief:${s.id}`, why: `${s.kind} statement has no resolvedBy and no REQ-title hit` })),
+    unresolvedFailing,
   ));
 
-  // Check 2: every REQ in scope has description, shapeClassification, domain.
+  // Checks 2a / 2b: the former `skeleton:reqFields` split into two
+  // homogeneous checks (ADR-4126, proposal section 1.3). Each
+  // evaluates every REQ in scope independently so a REQ with a TODO
+  // description still has its shapes reported, and vice versa.
+  const reqIntentFail = [];
   const reqShapeFail = [];
   for (const req of reqInScope) {
+    // reqIntent (productOwner): description without a TODO + domain
+    // (what the requirement means and where it sits).
     if (typeof req.description !== 'string' || req.description.length === 0 || TODO_RE.test(req.description)) {
-      reqShapeFail.push({ id: req.reqId, why: 'description missing or contains TODO placeholder' });
-      continue;
+      reqIntentFail.push({ id: req.reqId, why: 'description missing or contains TODO placeholder' });
+    } else if (typeof req.domain !== 'string' || req.domain.length === 0) {
+      reqIntentFail.push({ id: req.reqId, why: 'domain missing' });
     }
+    // reqShape (engineer): shapeClassification.shapes classification.
     if (!req.shapeClassification || !Array.isArray(req.shapeClassification.shapes)) {
       reqShapeFail.push({ id: req.reqId, why: 'shapeClassification.shapes missing' });
-      continue;
-    }
-    if (typeof req.domain !== 'string' || req.domain.length === 0) {
-      reqShapeFail.push({ id: req.reqId, why: 'domain missing' });
     }
   }
-  checks.push(makeCheck('skeleton:reqFields', 'delta', reqInScope.length, reqShapeFail));
+  checks.push(makeCheck('skeleton:reqIntent', 'delta', reqInScope.length, reqIntentFail));
+  checks.push(makeCheck('skeleton:reqShape', 'delta', reqInScope.length, reqShapeFail));
 
-  // Check 3: TAD.dataStores + coreEntities present when any persistence
+  // Check 3: TAD.dataArchitecture.dataStores + coreEntities present when any
   // REQ exists tree-wide.
   const persistenceReq = (tree.requirements ?? []).some((r) => Array.isArray(r?.shapeClassification?.shapes) && r.shapeClassification.shapes.includes('persistence'));
   const tadFail = [];
   if (persistenceReq) {
     const tad = tree.tad ?? {};
-    const dataStores = Array.isArray(tad.dataStores) ? tad.dataStores : [];
-    const coreEntities = Array.isArray(tad.coreEntities) ? tad.coreEntities : [];
-    if (dataStores.length === 0) tadFail.push({ id: 'TAD.dataStores', why: 'TAD.dataStores empty while persistence REQ exists' });
-    if (coreEntities.length === 0) tadFail.push({ id: 'TAD.coreEntities', why: 'TAD.coreEntities empty while persistence REQ exists' });
+    const dataArch = tad?.dataArchitecture ?? {};
+    const dataStores = Array.isArray(dataArch.dataStores) ? dataArch.dataStores : [];
+    const coreEntities = Array.isArray(dataArch.coreEntities) ? dataArch.coreEntities : [];
+    if (dataStores.length === 0) tadFail.push({ id: 'TAD.dataArchitecture.dataStores', why: 'TAD.dataArchitecture.dataStores empty while persistence REQ exists' });
+    if (coreEntities.length === 0) tadFail.push({ id: 'TAD.dataArchitecture.coreEntities', why: 'TAD.dataArchitecture.coreEntities empty while persistence REQ exists' });
   }
   checks.push(makeCheck('skeleton:tadPersistence', 'tree', persistenceReq ? 2 : 0, tadFail));
 
@@ -407,6 +962,50 @@ export function checkD2Skeleton(ctx) {
   else if (deployAdrs.length > 1) deployFail.push({ id: 'ADR:deploy', why: `${deployAdrs.length} Deploy ADRs found; expected exactly one` });
   checks.push(makeCheck('skeleton:deployAdr', 'tree', 1, deployFail));
 
+  // Check 5 (0.30.0 PR 6): skeleton:standardsCited (engineer, over
+  // tree). Every standards pack registered through `rcf define
+  // standards` (manifest.standards[].slug) is cited in a REQ
+  // `rationale` or an ADR, or waived by a concern-ledger entry keyed
+  // `standards:<pack>`. Fail ids `standards:<pack>` with 'uncited and
+  // unwaived'. Citation is a case-sensitive substring match of the
+  // slug against each REQ.rationale and each ADR document (the ADR
+  // may name a pack in its title, context, decision or consequences;
+  // the serialised document is scanned once per ADR to cover every
+  // field). A waiver entry on the concern ledger reads `concern:
+  // 'standards:<pack>'` with disposition 'applied' or 'waived'.
+  const standardsList = Array.isArray(tree.manifest?.standards)
+    ? /** @type {any[]} */ (tree.manifest.standards)
+    : [];
+  /** @type {Array<{ id: string, why: string }>} */
+  const standardsFail = [];
+  if (standardsList.length > 0) {
+    const reqRationales = (tree.requirements ?? [])
+      .map((r) => (typeof r?.rationale === 'string' ? r.rationale : ''))
+      .join('\n');
+    const adrDocs = (tree.adrs ?? []).map((a) => {
+      try { return JSON.stringify(a); } catch { return ''; }
+    }).join('\n');
+    const concernsBody = /** @type {any} */ (ctx.ledgers?.concerns);
+    const concernList = Array.isArray(concernsBody?.concerns) ? concernsBody.concerns : [];
+    const waiverSlugs = new Set();
+    for (const entry of concernList) {
+      if (!entry || typeof entry.concern !== 'string') continue;
+      const disposition = typeof entry.disposition === 'string' ? entry.disposition : null;
+      if (disposition !== 'applied' && disposition !== 'waived') continue;
+      const m = entry.concern.match(/^standards:(.+)$/);
+      if (m) waiverSlugs.add(m[1]);
+    }
+    for (const pack of standardsList) {
+      const slug = typeof pack?.slug === 'string' ? pack.slug : null;
+      if (!slug) continue;
+      if (waiverSlugs.has(slug)) continue;
+      if (reqRationales.includes(slug)) continue;
+      if (adrDocs.includes(slug)) continue;
+      standardsFail.push({ id: `standards:${slug}`, why: 'uncited and unwaived' });
+    }
+  }
+  checks.push(makeCheck('skeleton:standardsCited', 'tree', Math.max(standardsList.length, 1), standardsFail));
+
   return foldState('D2', gate, checks, {
     currentTreeHash: ctx.currentTreeHash ?? null,
     freezeGates: /** @type {any} */ (ctx.freeze?.gates),
@@ -421,14 +1020,20 @@ export function checkD2Skeleton(ctx) {
 const INTERFACE_KINDS_SET = new Set(INTERFACE_KINDS);
 
 /**
- * D3 -- Interface contracts and shapes. 0.29.0 runs only the cheap
- * presence + closed-vocabulary checks.
+ * D3 -- Interface contracts and shapes. 0.29.0 runs the cheap
+ * presence, closed-vocabulary and draft-marker checks
+ * (`shapes:draftSettled` per ADR-4126 scans the `[draft]` prefix).
+ * REQ-188 (0.30.0): the draft marker extends to `TAC.purpose` and
+ * `TAD.dataArchitecture.coreEntities[].description`; `shapes:draftSettled`
+ * enumerates all three homes with ids `<tacId>:<name>`, `<tacId>`
+ * and `TAD.entity:<name>` respectively. `tacHasInterface` and
+ * `kindVocabulary` apply to drafts unchanged.
  *
  * SEAM 0.30: template markers per kind (recordShape.fields:, httpRoute
  * method/path/request/response/errors, fixture.instances:); entity-name
- * join across TAD.coreEntities and TAC.interfaces[]; ownerRef and
- * `authoredAt` path resolution. Those add checks to this stage; the
- * fold shape stays the same.
+ * join across TAD.dataArchitecture.coreEntities and TAC.interfaces[];
+ * ownerRef and `authoredAt` path resolution. Those add checks to this
+ * stage; the fold shape stays the same.
  *
  * @param {StageContext} ctx
  */
@@ -443,8 +1048,17 @@ export function checkD3Shapes(ctx) {
     return shapes.includes('httpApi') || shapes.includes('persistence') || shapes.includes('auth');
   });
 
-  if (tacsInScope.length === 0 && shapedReqInScope.length === 0) {
-    return notApplicable('D3', gate, 'no TAC and no shaped REQ (httpApi/persistence/auth) in scope');
+  // Core entities on TAD.dataArchitecture come from the whole tree,
+  // not the scope: an entity's draft marker is a tree-wide draft home
+  // (the engineer owns every entity in one place) and reporting it
+  // under D3 does not depend on which TAC a change touched.
+  const coreEntities = Array.isArray(tree.tad?.dataArchitecture?.coreEntities)
+    ? /** @type {any[]} */ (tree.tad.dataArchitecture.coreEntities)
+    : [];
+  const draftEntities = coreEntities.filter(parseCoreEntityDraft);
+
+  if (tacsInScope.length === 0 && shapedReqInScope.length === 0 && draftEntities.length === 0) {
+    return notApplicable('D3', gate, 'no TAC, no shaped REQ (httpApi/persistence/auth) and no [draft] core entity in scope');
   }
 
   const checks = [];
@@ -459,18 +1073,139 @@ export function checkD3Shapes(ctx) {
   ));
 
   // Check 2: every interface kind is in the closed vocabulary.
+  // Check 3: no description across the three draft homes still
+  // carries the `[draft]` marker. A draft shape is entry material
+  // the agent pre-populates after L1; the engineer removes the
+  // marker when the shape is settled. `tacHasInterface` and
+  // `kindVocabulary` apply equally to drafts.
   let totalInterfaces = 0;
   const badKinds = [];
+  const draftFindings = [];
   for (const tac of tacsInScope) {
+    if (parseTacPurposeDraft(tac)) {
+      draftFindings.push({ id: tac.tacId, why: 'draft TAC purpose pre-populated at L1, not yet settled' });
+    }
     for (const iface of tac.interfaces ?? []) {
       totalInterfaces += 1;
       const kind = iface?.kind;
       if (typeof kind !== 'string' || !INTERFACE_KINDS_SET.has(kind)) {
         badKinds.push({ id: `${tac.tacId}:${iface?.name ?? '(unnamed)'}`, why: `unknown interface kind ${JSON.stringify(kind)}` });
       }
+      if (parseInterfaceDraft(iface)) {
+        draftFindings.push({ id: `${tac.tacId}:${iface?.name ?? '(unnamed)'}`, why: 'draft interface pre-populated at L1, not yet settled' });
+      }
     }
   }
+  for (const entity of draftEntities) {
+    draftFindings.push({ id: `TAD.entity:${entity?.name ?? '(unnamed)'}`, why: 'draft core entity pre-populated at L1, not yet settled' });
+  }
+  // Total for the draft check is every draft home that could carry
+  // the marker on an in-scope TAC plus every core entity (tree-wide):
+  // the TAC itself (its purpose) + every interface on it, plus the
+  // coreEntities list.
+  const totalDraftHomes = tacsInScope.length + totalInterfaces + coreEntities.length;
   checks.push(makeCheck('shapes:kindVocabulary', 'delta', totalInterfaces, badKinds));
+  checks.push(makeCheck('shapes:draftSettled', 'delta', totalDraftHomes, draftFindings));
+
+  // ADR-4131 (0.30.0 PR 5): three D3 bite checks follow.
+  // Check 4: shapes:templateMarkers (engineer, over delta). For every
+  // interface on an in-scope TAC, parseInterfaceTemplate reports which
+  // per-kind markers are missing from the description; a draft marker
+  // is stripped before the scan so a [draft] recordShape without
+  // `fields:` fails exactly as a settled one. An interface whose kind
+  // is outside INTERFACE_KINDS is left to shapes:kindVocabulary (the
+  // marker map returns `{missing: []}` for an unknown kind so this
+  // check does not double-report the vocabulary miss).
+  /** @type {Array<{ id: string, why: string }>} */
+  const templateFindings = [];
+  for (const tac of tacsInScope) {
+    for (const iface of tac.interfaces ?? []) {
+      const result = parseInterfaceTemplate(iface);
+      if (!result.kind) continue;
+      for (const marker of result.missing) {
+        templateFindings.push({
+          id: `${tac.tacId}:${iface?.name ?? '(unnamed)'}`,
+          why: `missing marker ${marker}`,
+        });
+      }
+    }
+  }
+  checks.push(makeCheck('shapes:templateMarkers', 'delta', totalInterfaces, templateFindings));
+
+  // Check 5: shapes:entityJoin (engineer, over tree). Every entry in
+  // TAD.dataArchitecture.coreEntities must be named by exactly one
+  // recordShape across the whole tree (not just the delta scope),
+  // matching on the recordShape's `name` field or on an `entity:` line
+  // in its description. A `[draft]` prefix is stripped before the
+  // entity-line scan so a draft recordShape still joins.
+  /** @type {Array<{ id: string, why: string }>} */
+  const joinFindings = [];
+  const treeTacs = tree.tacs ?? [];
+  const recordShapesByEntity = new Map();
+  for (const tac of treeTacs) {
+    for (const iface of tac.interfaces ?? []) {
+      if (iface?.kind !== 'recordShape') continue;
+      const ownerLabel = `${tac.tacId}:${iface?.name ?? '(unnamed)'}`;
+      const names = new Set();
+      if (typeof iface?.name === 'string') names.add(iface.name);
+      const desc = typeof iface?.description === 'string' ? stripDraftPrefix(iface.description) : '';
+      const entityRe = /(^|\n)\s*(?:[-*]\s*)?entity\s*[:=]\s*["'`]?([A-Za-z_][A-Za-z0-9_]*)/g;
+      let em;
+      while ((em = entityRe.exec(desc)) !== null) {
+        if (em[2]) names.add(em[2]);
+      }
+      for (const name of names) {
+        const owners = recordShapesByEntity.get(name) ?? [];
+        owners.push(ownerLabel);
+        recordShapesByEntity.set(name, owners);
+      }
+    }
+  }
+  for (const entity of coreEntities) {
+    const name = typeof entity?.name === 'string' ? entity.name : null;
+    if (!name) continue;
+    const owners = recordShapesByEntity.get(name) ?? [];
+    if (owners.length === 0) {
+      joinFindings.push({ id: `TAD.entity:${name}`, why: 'no record shape' });
+    } else if (owners.length > 1) {
+      joinFindings.push({ id: `TAD.entity:${name}`, why: `${owners.length} record shapes` });
+    }
+  }
+  checks.push(makeCheck('shapes:entityJoin', 'tree', coreEntities.length, joinFindings));
+
+  // Check 6: shapes:pathsResolve (engineer, over delta). Any path:
+  // token on an in-scope interface description must either resolve
+  // against `resolvedPaths` (the CLI's on-disk pass) or the
+  // description must carry an `authoredAt: D3` marker (the engineer
+  // owns the path even when the file is yet to land). The marker is
+  // a token in the description text (`authoredAt: D3` or
+  // `authoredAt = D3`), not a separate schema field; the TAC schema
+  // keeps interfaces to { name, kind, description }. Over delta,
+  // one failing entry per unresolved (tacId:name, path) pair.
+  const resolvedPaths = ctx.resolvedPaths instanceof Set ? ctx.resolvedPaths : new Set();
+  /** @type {Array<{ id: string, why: string }>} */
+  const pathFindings = [];
+  let totalPathChecks = 0;
+  for (const tac of tacsInScope) {
+    for (const iface of tac.interfaces ?? []) {
+      const desc = typeof iface?.description === 'string' ? iface.description : '';
+      const tokens = extractInterfacePathTokens(desc);
+      if (tokens.length === 0) continue;
+      const authoredAtD3 = /\bauthoredAt\s*[:=]\s*["'`]?D3\b/.test(stripDraftPrefix(desc));
+      for (const token of tokens) {
+        totalPathChecks += 1;
+        if (authoredAtD3) continue;
+        if (resolvedPaths.has(token)) continue;
+        pathFindings.push({
+          id: `${tac.tacId}:${iface?.name ?? '(unnamed)'}`,
+          why: `path does not resolve: ${token}`,
+        });
+      }
+    }
+  }
+  // Keep total >= 1 so the chip prints a sensible ratio when no
+  // interface in scope names a path.
+  checks.push(makeCheck('shapes:pathsResolve', 'delta', Math.max(totalPathChecks, 1), pathFindings));
 
   return foldState('D3', gate, checks, {
     currentTreeHash: ctx.currentTreeHash ?? null,
@@ -551,6 +1286,72 @@ export function checkD4Stories(ctx) {
   }
   checks.push(makeCheck('stories:usFloors', 'delta', usInScope.length, usFail));
 
+  // Check 3 (0.30.0 PR 6): stories:closedSets (engineer, over delta).
+  // Every AC on a US in scope whose description contains an enumeration
+  // cue (one of | any of | the following | types of | status is)
+  // without an inline bracketed list of two or more tokens AND without
+  // an ownerRef fails. The quoted-cue guard strips `"..."` substrings
+  // before the cue scan so prose that quotes a cue does not fire the
+  // check.
+  /** @type {Array<{ id: string, why: string }>} */
+  const closedSetFindings = [];
+  let totalClosedSetAcs = 0;
+  for (const us of usInScope) {
+    const acs = Array.isArray(us.acceptanceCriteria) ? us.acceptanceCriteria : [];
+    for (const ac of acs) {
+      if (typeof ac?.description !== 'string' || ac.description.length === 0) continue;
+      totalClosedSetAcs += 1;
+      if (failsClosedSets(ac)) {
+        closedSetFindings.push({
+          id: ac.id ?? us.usId,
+          why: 'enumeration cue without a closed set',
+        });
+      }
+    }
+  }
+  checks.push(makeCheck('stories:closedSets', 'delta', totalClosedSetAcs, closedSetFindings));
+
+  // Check 4 (0.30.0 PR 6): stories:ownerRefResolves (engineer, over
+  // delta plus tree for ownerRef targets). Every AC on a US in scope
+  // whose ownerRef is set must point to an interface by name on the
+  // named TAC. Ids `<acId>:<field>`; why 'ownerRef does not resolve'.
+  /** @type {Array<{ id: string, why: string }>} */
+  const ownerRefFindings = [];
+  let totalOwnerRefAcs = 0;
+  // R11 (spec section 17, 2026-10-03): the ownerRef field grammar
+  // widens beyond `interfaces[<name>]` to every bracket-grammar path
+  // that names an existing field on the owning TAC or ADR. The owner
+  // may now be a TAC (via tacId) or an ADR (via adrId); the resolver
+  // handles the bracket forms (`interfaces[<name>]`,
+  // `responsibilities[<n>]`, `dependencies[<name>]`,
+  // `alternativesConsidered[<n>]`) and bare schema fields (`purpose`,
+  // `internalStructure`, `decision`, etc.). A path that does not
+  // match any arm still fails. AC-17405-2 is unchanged in effect.
+  for (const us of usInScope) {
+    const acs = Array.isArray(us.acceptanceCriteria) ? us.acceptanceCriteria : [];
+    for (const ac of acs) {
+      if (!acHasOwnerRef(ac)) continue;
+      totalOwnerRefAcs += 1;
+      const ref = /** @type {any} */ (ac).ownerRef;
+      let owner = null;
+      if (typeof ref.tacId === 'string') {
+        owner = (tree.tacs ?? []).find((t) => t?.tacId === ref.tacId) ?? null;
+      } else if (typeof ref.adrId === 'string') {
+        owner = (tree.adrs ?? []).find((a) => a?.adrId === ref.adrId) ?? null;
+      }
+      const resolves = !!(owner && resolveOwnerRefField(owner, ref.field));
+      if (!resolves) {
+        ownerRefFindings.push({
+          id: `${ac.id ?? us.usId}:${ref.field ?? '(no field)'}`,
+          why: 'ownerRef does not resolve',
+        });
+      }
+    }
+  }
+  // Keep total >= 1 so the chip prints a sensible ratio when no AC in
+  // scope carries an ownerRef.
+  checks.push(makeCheck('stories:ownerRefResolves', 'delta', Math.max(totalOwnerRefAcs, 1), ownerRefFindings));
+
   return foldState('D4', gate, checks, {
     currentTreeHash: ctx.currentTreeHash ?? null,
     freezeGates: /** @type {any} */ (ctx.freeze?.gates),
@@ -621,6 +1422,52 @@ export function checkD5Crosscut(ctx) {
     openInScope.map((c) => ({ id: `concern:${c.id}`, why: `open concern on ${c.reqId}: ${c.concern}` })),
   ));
 
+  // Check 4 (0.30.0 PR 6): crosscut:catalogue (engineer, over tree).
+  // For every REQ in scope, enumerate applicable (reqShape, concern)
+  // pairs via src/define/concern-catalogue.js; each pair needs a
+  // concern-ledger entry keyed <REQ>:<concern> with disposition
+  // applied or waived (a waived entry carries a reason). Fail ids are
+  // `<REQ>:<concern>`; the why names the missing concern. A waived
+  // entry without a reason also fails. Keys shared with the baseline
+  // catalogue where names coincide (today only `auth`).
+  const entriesByKey = new Map();
+  for (const entry of concernEntries) {
+    if (!entry || typeof entry.reqId !== 'string' || typeof entry.concern !== 'string') continue;
+    entriesByKey.set(`${entry.reqId}:${entry.concern}`, entry);
+  }
+  /** @type {Array<{ id: string, why: string }>} */
+  const catalogueFindings = [];
+  let totalCataloguePairs = 0;
+  for (const req of reqInScope) {
+    const shapes = Array.isArray(req?.shapeClassification?.shapes)
+      ? req.shapeClassification.shapes.filter((s) => typeof s === 'string')
+      : [];
+    const applicable = applicableConcernsForShapes(shapes);
+    for (const concern of applicable) {
+      totalCataloguePairs += 1;
+      const key = `${req.reqId}:${concern}`;
+      const entry = entriesByKey.get(key);
+      if (!entry) {
+        catalogueFindings.push({ id: key, why: `missing concern-ledger entry for ${concern}` });
+        continue;
+      }
+      const disposition = typeof entry.disposition === 'string' ? entry.disposition : null;
+      if (disposition !== 'applied' && disposition !== 'waived') {
+        catalogueFindings.push({ id: key, why: `concern-ledger entry disposition is ${disposition ?? '(unset)'}` });
+        continue;
+      }
+      if (disposition === 'waived') {
+        const reason = typeof entry.reason === 'string' ? entry.reason.trim() : '';
+        if (reason.length === 0) {
+          catalogueFindings.push({ id: key, why: 'waived without a reason' });
+        }
+      }
+    }
+  }
+  // Keep total >= 1 so the chip prints a sensible ratio when no REQ in
+  // scope has applicable concerns (every REQ carries shape 'other').
+  checks.push(makeCheck('crosscut:catalogue', 'tree', Math.max(totalCataloguePairs, 1), catalogueFindings));
+
   return foldState('D5', gate, checks, {
     currentTreeHash: ctx.currentTreeHash ?? null,
     freezeGates: /** @type {any} */ (ctx.freeze?.gates),
@@ -632,14 +1479,14 @@ export function checkD5Crosscut(ctx) {
 // ---------------------------------------------------------------------------
 
 /**
- * D6 -- Consistency and satisfiability probe. 0.29.0 runs only the
- * validate-clean tree-wide check and the probe-ledger open count.
- *
- * SEAM 0.30: contradiction-lite across criteria on one story and
- * across their TACs' ADRs; unsatisfiable-lite (a `then` naming
- * undefined state); duplicate scan; orphan-interface scan;
- * regeneration probe runner injectable like `mutationRunner` in
- * src/review/index.js.
+ * D6 -- Consistency and satisfiability probe. 0.29.0 ran the
+ * validate-clean tree-wide check and the probe-ledger open count;
+ * 0.30.0 PR 7 (ADR-4131 extended, spec section 4 row 'D6 scans and the
+ * injectable probe runner') adds the four mechanical scans
+ * consistency:contradictions, consistency:unsatisfiable,
+ * consistency:duplicates and consistency:orphanInterfaces. The probe
+ * runner lives on the readiness compute (TAC-4123); the gate reads the
+ * merged probes.probes[] it ends up with.
  *
  * @param {StageContext} ctx
  */
@@ -683,12 +1530,350 @@ export function checkD6Consistency(ctx) {
   // uses a single representative entry regardless.
   checks.push(makeCheck('consistency:probeCount', 'tree', Math.max(effectiveOpen, 1), failing, effectiveOpen));
 
+  // ADR-4131 extended (0.30.0 PR 7): the four D6 scans.
+  const scope = asSet(ctx.scope);
+  const tree = ctx.tree;
+  const usInScope = (tree.userStories ?? []).filter((us) => scope.has(us.usId));
+
+  // Scan 1: consistency:contradictions (engineer, over delta). Two ACs
+  // on one story share a `when` clause and one of their `then` clauses
+  // is a negation of the other. The quoted-cue guard strips
+  // double-quoted substrings before the negation scan so prose that
+  // quotes a negation inside a `then` does not fire the check.
+  /** @type {Array<{ id: string, why: string }>} */
+  const contradictionFindings = [];
+  let totalStoriesScanned = 0;
+  for (const us of usInScope) {
+    const acs = Array.isArray(us.acceptanceCriteria) ? us.acceptanceCriteria : [];
+    if (acs.length < 2) continue;
+    totalStoriesScanned += 1;
+    const parsed = acs
+      .map((ac) => ({ ac, parts: parseWhenThen(ac?.description) }))
+      .filter((p) => p.parts !== null);
+    const reported = new Set();
+    for (let i = 0; i < parsed.length; i += 1) {
+      for (let j = i + 1; j < parsed.length; j += 1) {
+        const a = parsed[i];
+        const b = parsed[j];
+        if (normaliseClause(a.parts.when) !== normaliseClause(b.parts.when)) continue;
+        if (!thensNegateEachOther(a.parts.then, b.parts.then)) continue;
+        const pairKey = `${us.usId}:${a.ac.id ?? '?'}:${b.ac.id ?? '?'}`;
+        if (reported.has(pairKey)) continue;
+        reported.add(pairKey);
+        const idA = a.ac.id ?? us.usId;
+        const idB = b.ac.id ?? us.usId;
+        contradictionFindings.push({
+          id: us.usId,
+          why: `ACs ${idA} and ${idB} share a when clause with a negated then`,
+        });
+      }
+    }
+  }
+  checks.push(makeCheck(
+    'consistency:contradictions',
+    'delta',
+    Math.max(totalStoriesScanned, 1),
+    contradictionFindings,
+  ));
+
+  // Scan 2: consistency:unsatisfiable (engineer, over delta). A `then`
+  // naming a field that no recordShape anywhere in the tree defines
+  // fails the AC with id `<acId>:<field>`. A field defined in a
+  // `[draft]` recordShape counts as defined (the engineer owns the
+  // draft; its `fields:` list is honest about what the then may name).
+  const definedFields = collectRecordShapeFields(tree);
+  /** @type {Array<{ id: string, why: string }>} */
+  const unsatisfiableFindings = [];
+  let totalThenFieldChecks = 0;
+  for (const us of usInScope) {
+    const acs = Array.isArray(us.acceptanceCriteria) ? us.acceptanceCriteria : [];
+    for (const ac of acs) {
+      const parts = parseWhenThen(ac?.description);
+      if (!parts) continue;
+      const fields = extractThenFieldTokens(parts.then);
+      for (const field of fields) {
+        totalThenFieldChecks += 1;
+        if (definedFields.has(field)) continue;
+        unsatisfiableFindings.push({
+          id: `${ac.id ?? us.usId}:${field}`,
+          why: `then names field ${field} that no recordShape defines`,
+        });
+      }
+    }
+  }
+  checks.push(makeCheck(
+    'consistency:unsatisfiable',
+    'delta',
+    Math.max(totalThenFieldChecks, 1),
+    unsatisfiableFindings,
+  ));
+
+  // Scan 3: consistency:duplicates (engineer, over tree). Identical AC
+  // descriptions across stories fail both ACs. The comparison trims
+  // leading whitespace and the leading `[class]` marker.
+  /** @type {Map<string, Array<{ usId: string, acId: string }>>} */
+  const descBuckets = new Map();
+  const allUs = tree.userStories ?? [];
+  let totalDupAcs = 0;
+  for (const us of allUs) {
+    const acs = Array.isArray(us.acceptanceCriteria) ? us.acceptanceCriteria : [];
+    for (const ac of acs) {
+      const desc = typeof ac?.description === 'string' ? ac.description.trim() : '';
+      if (desc.length === 0) continue;
+      totalDupAcs += 1;
+      const normalised = desc.replace(AC_CLASS_RE, '').trim().toLowerCase();
+      if (normalised.length === 0) continue;
+      const bucket = descBuckets.get(normalised) ?? [];
+      bucket.push({ usId: us.usId, acId: ac.id ?? us.usId });
+      descBuckets.set(normalised, bucket);
+    }
+  }
+  /** @type {Array<{ id: string, why: string }>} */
+  const duplicateFindings = [];
+  for (const bucket of descBuckets.values()) {
+    if (bucket.length < 2) continue;
+    const stories = [...new Set(bucket.map((b) => b.usId))];
+    if (stories.length < 2) continue;
+    for (const entry of bucket) {
+      duplicateFindings.push({
+        id: entry.acId,
+        why: `duplicate description (also on ${bucket.filter((b) => b.acId !== entry.acId).map((b) => b.acId).join(', ')})`,
+      });
+    }
+  }
+  checks.push(makeCheck(
+    'consistency:duplicates',
+    'tree',
+    Math.max(totalDupAcs, 1),
+    duplicateFindings,
+  ));
+
+  // Scan 4: consistency:orphanInterfaces (engineer, over tree). An
+  // interface on any TAC that no AC `ownerRef` points at AND that no
+  // REQ `deliveredBy` reaches fails. Shares the `interfaces[<name>]`
+  // pointer grammar with D4 `stories:ownerRefResolves`. A REQ's
+  // `deliveredBy` reaches an interface when it names the owning TAC id
+  // (either as a `tacId` string or as a `TAC-nnnn:<name>` pointer).
+  const reachedInterfaces = collectReachedInterfaces(tree);
+  /** @type {Array<{ id: string, why: string }>} */
+  const orphanFindings = [];
+  let totalInterfacesScanned = 0;
+  for (const tac of tree.tacs ?? []) {
+    const list = Array.isArray(tac?.interfaces) ? tac.interfaces : [];
+    for (const iface of list) {
+      const name = typeof iface?.name === 'string' ? iface.name : null;
+      if (!name) continue;
+      totalInterfacesScanned += 1;
+      const key = `${tac.tacId}:${name}`;
+      if (reachedInterfaces.has(key)) continue;
+      orphanFindings.push({
+        id: key,
+        why: 'no AC ownerRef and no REQ deliveredBy reaches it',
+      });
+    }
+  }
+  checks.push(makeCheck(
+    'consistency:orphanInterfaces',
+    'tree',
+    Math.max(totalInterfacesScanned, 1),
+    orphanFindings,
+  ));
+
   return foldState('D6', gate, checks, {
     currentTreeHash: ctx.currentTreeHash ?? null,
     freezeGates: /** @type {any} */ (ctx.freeze?.gates),
   });
 }
 
+/**
+ * Parse an AC description into { when, then } clause strings. Accepts
+ * the common "given ... when ... then ..." shape used across the ACs
+ * of this codebase; returns null when the description does not carry
+ * both a `when` and a `then` segment. The leading `[class]` marker is
+ * stripped before the scan. The match is case-insensitive on the
+ * keywords only; the clause bodies keep their original casing.
+ *
+ * @param {unknown} desc
+ * @returns {{ when: string, then: string } | null}
+ */
+function parseWhenThen(desc) {
+  if (typeof desc !== 'string' || desc.length === 0) return null;
+  const stripped = desc.replace(AC_CLASS_RE, '').trim();
+  const re = /\bwhen\b([\s\S]*?)\bthen\b([\s\S]*)$/i;
+  const m = stripped.match(re);
+  if (!m) return null;
+  const when = m[1].trim();
+  const then = m[2].trim();
+  if (when.length === 0 || then.length === 0) return null;
+  return { when, then };
+}
+
+/**
+ * Normalise a clause for the contradictions scan: lower-case, trim,
+ * collapse whitespace. A clause is "the same" between two ACs when
+ * their normalised forms match.
+ *
+ * @param {string} clause
+ * @returns {string}
+ */
+function normaliseClause(clause) {
+  return clause.toLowerCase().replace(/\s+/g, ' ').trim();
+}
+
+/**
+ * Strip double-quoted substrings and then test whether one `then`
+ * clause is the negation of the other. "Negation" is a cheap test: one
+ * clause begins (or carries, after a verb) a `not`, `no`, `does not`,
+ * `is not`, `never`, `must not` token where the other clause does not;
+ * or the two clauses are the same body with one carrying such a token.
+ * The quoted-substring strip is the shared guard with D4.
+ *
+ * @param {string} a
+ * @param {string} b
+ * @returns {boolean}
+ */
+function thensNegateEachOther(a, b) {
+  const aPlain = normaliseClause(stripQuotedSubstrings(a));
+  const bPlain = normaliseClause(stripQuotedSubstrings(b));
+  if (aPlain === bPlain) return false;
+  const NEG_RE = /\b(?:not|no|never|does not|is not|must not|cannot|won't|will not)\b/;
+  const aNeg = NEG_RE.test(aPlain);
+  const bNeg = NEG_RE.test(bPlain);
+  if (aNeg === bNeg) return false;
+  // One side negates; test the negated body against the positive one.
+  const positive = aNeg ? bPlain : aPlain;
+  const negative = aNeg ? aPlain : bPlain;
+  const negativeStripped = negative.replace(NEG_RE, '').replace(/\s+/g, ' ').trim();
+  // A sufficiently similar body is "the same claim with a negation".
+  // We treat the shorter being a prefix / suffix / substring of the
+  // longer, or sharing 80% of its tokens, as "same body".
+  if (negativeStripped.length === 0) return false;
+  if (positive.includes(negativeStripped) || negativeStripped.includes(positive)) return true;
+  const posTokens = new Set(positive.split(/\s+/).filter((t) => t.length > 2));
+  const negTokens = negativeStripped.split(/\s+/).filter((t) => t.length > 2);
+  if (negTokens.length === 0) return false;
+  const shared = negTokens.filter((t) => posTokens.has(t)).length;
+  return shared / negTokens.length >= 0.6;
+}
+
+/**
+ * Collect every field name defined by any `recordShape` interface in
+ * the tree. A `fields:` marker in the interface description introduces
+ * a list of field names; each name is a token on a bullet, a line, or
+ * a comma-separated list. Draft recordShapes are included (the
+ * engineer owns the draft and its fields: list is honest).
+ *
+ * @param {import('#core/store/walker.js').TreeModel} tree
+ * @returns {Set<string>}
+ */
+function collectRecordShapeFields(tree) {
+  const out = new Set();
+  for (const tac of tree.tacs ?? []) {
+    for (const iface of tac.interfaces ?? []) {
+      if (iface?.kind !== 'recordShape') continue;
+      const desc = typeof iface?.description === 'string' ? iface.description : '';
+      const stripped = stripDraftPrefix(desc);
+      // Find the `fields:` segment and read until the next `:` or end.
+      const match = stripped.match(/(^|\n)\s*(?:[-*]\s*)?fields\s*:\s*([\s\S]*?)(?=(?:\n\s*(?:[-*]\s*)?[a-zA-Z][a-zA-Z0-9_]*\s*:)|$)/);
+      if (!match) continue;
+      const body = match[2];
+      for (const token of body.split(/[\s,]+/)) {
+        const name = token.replace(/^[-*]/, '').replace(/[:(){}\[\]]/g, '').trim();
+        if (!name) continue;
+        if (/^[A-Za-z_][A-Za-z0-9_]*$/.test(name)) out.add(name);
+      }
+    }
+  }
+  return out;
+}
+
+/**
+ * Pull field tokens out of a `then` clause. A field token is a word
+ * that follows a verb like `set`, `write`, `include`, `return`,
+ * `contain`, `name` or appears as the direct object of a `then`'s
+ * verb phrase; a cheap approximation uses `then <subject> <verb>
+ * <field>` plus `field <name>`, `<name> field` and `field: <name>`
+ * patterns. The scan is deliberately conservative so a plain English
+ * sentence yields a small set.
+ *
+ * @param {string} thenClause
+ * @returns {string[]}
+ */
+function extractThenFieldTokens(thenClause) {
+  if (typeof thenClause !== 'string' || thenClause.length === 0) return [];
+  const text = stripQuotedSubstrings(thenClause);
+  /** @type {Set<string>} */
+  const tokens = new Set();
+  // Pattern 1: backticked identifier (`then `balance` is set`). The
+  // primary signal; prose that quotes a field name under backticks is
+  // the convention this check expects.
+  for (const m of text.matchAll(/`([A-Za-z_][A-Za-z0-9_]*)`/g)) {
+    if (m[1]) tokens.add(m[1]);
+  }
+  // Pattern 2: `<name> field` (adjective-form naming). An English
+  // "stop word" skip keeps "the field", "a field" and "its field" from
+  // tripping the check.
+  const STOP = new Set(['the', 'a', 'an', 'this', 'that', 'its', 'our', 'their', 'any', 'no', 'some', 'each', 'every', 'another']);
+  for (const m of text.matchAll(/\b([A-Za-z_][A-Za-z0-9_]*)\s+field\b/g)) {
+    const token = m[1];
+    if (!token) continue;
+    if (STOP.has(token.toLowerCase())) continue;
+    tokens.add(token);
+  }
+  // Pattern 3: `field: <name>` or `field = <name>` (schema-like
+  // notation inside a then clause).
+  for (const m of text.matchAll(/\bfield\s*[:=]\s*([A-Za-z_][A-Za-z0-9_]*)/g)) {
+    if (m[1]) tokens.add(m[1]);
+  }
+  return [...tokens];
+}
+
+/**
+ * Collect every interface the tree "reaches" from an AC `ownerRef` or
+ * a REQ `deliveredBy` (REQ-174 companion field). The result is a Set
+ * of `<tacId>:<name>` keys. A `deliveredBy` on a REQ can take two
+ * shapes: an array of `TAC-nnnn:<name>` pointer strings, or an array
+ * of plain TAC ids ("delivered by this TAC"); the second shape reaches
+ * every interface on the named TAC.
+ *
+ * @param {import('#core/store/walker.js').TreeModel} tree
+ * @returns {Set<string>}
+ */
+function collectReachedInterfaces(tree) {
+  const out = new Set();
+  // AC ownerRefs.
+  for (const us of tree.userStories ?? []) {
+    const acs = Array.isArray(us.acceptanceCriteria) ? us.acceptanceCriteria : [];
+    for (const ac of acs) {
+      if (!acHasOwnerRef(ac)) continue;
+      const ref = /** @type {any} */ (ac).ownerRef;
+      const name = parseOwnerRefInterfaceField(ref?.field);
+      if (!name || typeof ref?.tacId !== 'string') continue;
+      out.add(`${ref.tacId}:${name}`);
+    }
+  }
+  // REQ deliveredBy (optional field; shapes above).
+  for (const req of tree.requirements ?? []) {
+    const deliveredBy = /** @type {any} */ (req)?.deliveredBy;
+    if (!Array.isArray(deliveredBy)) continue;
+    for (const entry of deliveredBy) {
+      if (typeof entry !== 'string' || entry.length === 0) continue;
+      const m = entry.match(/^(TAC-[A-Za-z0-9-]+):(.+)$/);
+      if (m) {
+        out.add(`${m[1]}:${m[2]}`);
+        continue;
+      }
+      // Plain TAC id: every interface on that TAC is reached.
+      const tac = (tree.tacs ?? []).find((t) => t?.tacId === entry);
+      if (!tac) continue;
+      for (const iface of tac.interfaces ?? []) {
+        if (typeof iface?.name === 'string') out.add(`${tac.tacId}:${iface.name}`);
+      }
+    }
+  }
+  return out;
+}
+
 // ---------------------------------------------------------------------------
 // D7 -- Decisions and review (blocking in 0.29.0).
 // ---------------------------------------------------------------------------
@@ -713,6 +1898,31 @@ export function checkD7Decisions(ctx) {
   }
 
   const checks = [];
+  // Check 1: `decisions:wellFormed` (productOwner, over tree) --
+  // every decision is enumerated (ADR-4126, proposal section 1.3):
+  // a non-empty question, at least two options, a default that
+  // names one of the option letters.
+  const wellFormedFail = [];
+  for (const d of decisionEntries) {
+    const why = 'decision is not enumerated (question, two or more options, a default)';
+    const id = `decision:${d?.id ?? '?'}`;
+    if (typeof d?.question !== 'string' || d.question.length === 0) {
+      wellFormedFail.push({ id, why });
+      continue;
+    }
+    if (!Array.isArray(d.options) || d.options.length < 2) {
+      wellFormedFail.push({ id, why });
+      continue;
+    }
+    const letters = new Set(d.options.map((o) => (o && typeof o === 'object') ? /** @type {any} */ (o).letter : undefined));
+    if (typeof d.default !== 'string' || !letters.has(d.default)) {
+      wellFormedFail.push({ id, why });
+    }
+  }
+  checks.push(makeCheck('decisions:wellFormed', 'tree', decisionEntries.length, wellFormedFail));
+
+  // Check 2: `decisions:allAnswered` (engineer, over tree) -- zero
+  // open decisions. The hand-over condition for build.
   checks.push(makeCheck(
     'decisions:allAnswered',
     'tree',