rcf-lite 0.29.0 → 0.30.0

package/src/query/gates.js

@@ -46,6 +46,7 @@
 import { computeQueue } from '../build/queue.js';
 import { isOptedOut } from '../req-baseline/opt-out.js';
 import { BRIEF_KINDS, parseResolvedBy } from '../define/ledgers.js';
+import { applicableConcernsForShapes } from '../define/concern-catalogue.js';
 
 /** Canonical stage order (proposal §3.2). */
 export const STAGE_ORDER = /** @type {const} */ (['D1', 'D2', 'D3', 'D4', 'D5', 'D6', 'D7', 'D8']);
@@ -113,26 +114,37 @@ export const CHECK_PERSONA = /** @type {const} */ ({
   'brief:kinds': 'productOwner',
   'brief:openQuestions': 'productOwner',
   'brief:profile': 'productOwner',
-  // D2 Skeleton: resolvedBy + reqIntent are PO; reqShape, tadPersistence, deployAdr are engineer.
+  // D2 Skeleton: resolvedBy + reqIntent are PO; reqShape, tadPersistence, deployAdr, standardsCited are engineer.
   'skeleton:resolvedBy': 'productOwner',
   'skeleton:reqIntent': 'productOwner',
   'skeleton:reqShape': 'engineer',
   'skeleton:tadPersistence': 'engineer',
   'skeleton:deployAdr': 'engineer',
+  'skeleton:standardsCited': 'engineer',
   // D3 Shapes: every check is engineer (shapes are the engineer's first act after hand-over).
   'shapes:tacHasInterface': 'engineer',
   'shapes:kindVocabulary': 'engineer',
   'shapes:draftSettled': 'engineer',
-  // D4 Stories: reqHasUs is PO ("what does someone do with this?"); the floors are engineer.
+  'shapes:templateMarkers': 'engineer',
+  'shapes:entityJoin': 'engineer',
+  'shapes:pathsResolve': 'engineer',
+  // D4 Stories: reqHasUs is PO ("what does someone do with this?"); the floors, closed sets and ownerRef resolution are engineer.
   'stories:reqHasUs': 'productOwner',
   'stories:usFloors': 'engineer',
-  // D5 Crosscut: TAD + concern-ledger content is engineering.
+  'stories:closedSets': 'engineer',
+  'stories:ownerRefResolves': 'engineer',
+  // D5 Crosscut: TAD + concern-ledger content and the catalogue walk are engineering.
   'crosscut:securityArchitecture': 'engineer',
   'crosscut:operationalConcerns': 'engineer',
   'crosscut:concernsResolved': 'engineer',
-  // D6 Consistency: schema validity and probes are engineer.
+  'crosscut:catalogue': 'engineer',
+  // D6 Consistency: schema validity, probes and the four scans are engineer.
   'consistency:validateClean': 'engineer',
   'consistency:probeCount': 'engineer',
+  'consistency:contradictions': 'engineer',
+  'consistency:unsatisfiable': 'engineer',
+  'consistency:duplicates': 'engineer',
+  'consistency:orphanInterfaces': 'engineer',
   // D7 Decisions: enumeration is PO (the PO answers or lets the default stand);
   // zero-open is the engineer's hand-over condition.
   'decisions:wellFormed': 'productOwner',
@@ -161,16 +173,27 @@ export const CHECK_QUESTION = /** @type {const} */ ({
   'skeleton:reqShape': 'Every requirement in scope carries a shape classification.',
   'skeleton:tadPersistence': 'TAD data architecture lists dataStores and coreEntities for persistence REQs.',
   'skeleton:deployAdr': 'Exactly one Deploy target or Deploy deferral ADR exists.',
+  'skeleton:standardsCited': 'Every registered standards pack is cited in a REQ rationale or an ADR, or waived by a concern-ledger entry.',
   'shapes:tacHasInterface': 'Every TAC in scope has at least one interface.',
   'shapes:kindVocabulary': 'Every interface kind is in the closed vocabulary.',
   'shapes:draftSettled': 'Every draft interface has been settled (the [draft] marker is removed).',
+  'shapes:templateMarkers': 'Every interface description carries the per-kind markers (recordShape fields:, httpRoute method/path/request/response/errors, and so on).',
+  'shapes:entityJoin': 'Every core entity is named by exactly one recordShape.',
+  'shapes:pathsResolve': 'Every path: token in an interface description resolves on disk or the description is authoredAt D3.',
   'stories:reqHasUs': 'What does someone do with this requirement?',
   'stories:usFloors': 'Every story in scope meets the class, tacIds and testability floors.',
+  'stories:closedSets': 'Every acceptance criterion that invites a set of values names the set or points to an owner.',
+  'stories:ownerRefResolves': 'Every ownerRef on an acceptance criterion resolves to an interface on the owning TAC.',
   'crosscut:securityArchitecture': 'TAD.securityArchitecture is present when an auth or httpApi REQ exists.',
   'crosscut:operationalConcerns': 'TAD.operationalConcerns is present when a deployed-scope AC exists.',
   'crosscut:concernsResolved': 'Every concern-ledger entry on a REQ in scope is applied or waived.',
+  'crosscut:catalogue': 'Every applicable crosscut concern for a REQ in scope has a concern-ledger entry applied or waived.',
   'consistency:validateClean': 'Validate is clean tree-wide.',
   'consistency:probeCount': 'Zero open probe-ledger entries.',
+  'consistency:contradictions': 'No two acceptance criteria on one story share a when clause with a negated then.',
+  'consistency:unsatisfiable': 'Every then names a field some recordShape defines.',
+  'consistency:duplicates': 'No two acceptance criteria across stories share an identical description.',
+  'consistency:orphanInterfaces': 'Every interface is reached by an AC ownerRef or a REQ deliveredBy.',
   'decisions:wellFormed': 'Every decision is enumerated (question, two or more options, a default).',
   'decisions:allAnswered': 'Zero decisions are open.',
   'freeze:priorGates': 'Every prior stage passed or is acknowledged at the current hash.',
@@ -280,6 +303,118 @@ export function parseCoreEntityDraft(entity) {
   return hasDraftMarker(/** @type {any} */ (entity).description);
 }
 
+/**
+ * Per-kind required marker tokens on `interfaces[].description` for
+ * the `shapes:templateMarkers` D3 bite check (ADR-4131, spec section 4
+ * row "D3 template parser"). A marker is "present" when a line of the
+ * description matches the marker's own regex: a `<name>:` prefix for
+ * `fields:`, `instances:`, `payload:`, `usage:` and `format:`; a
+ * `method`, `path`, `request`, `response`, `errors` or `protocol`
+ * token on an httpRoute, uiRoute or port (word-bounded, case-sensitive,
+ * tolerating a trailing colon or whitespace); `other` requires a
+ * non-empty description after the optional `[draft]` prefix (its
+ * "note"). The regexes are deliberately permissive so a plain
+ * `method: POST` and a bullet list `- method: POST` both qualify, and
+ * so a `[draft]` prefix never masks the marker scan.
+ */
+const INTERFACE_TEMPLATE_MARKERS = /** @type {const} */ ({
+  recordShape: [{ name: 'fields', re: /(^|\n)\s*(?:[-*]\s*)?fields\s*:/ }],
+  httpRoute: [
+    { name: 'method', re: /(^|\n|\s)method\s*[:=]/ },
+    { name: 'path', re: /(^|\n|\s)path\s*[:=]/ },
+    { name: 'request', re: /(^|\n|\s)request\s*[:=]/ },
+    { name: 'response', re: /(^|\n|\s)response\s*[:=]/ },
+    { name: 'errors', re: /(^|\n|\s)errors\s*[:=]/ },
+  ],
+  fixture: [{ name: 'instances', re: /(^|\n)\s*(?:[-*]\s*)?instances\s*:/ }],
+  event: [{ name: 'payload', re: /(^|\n)\s*(?:[-*]\s*)?payload\s*:/ }],
+  cliCommand: [{ name: 'usage', re: /(^|\n)\s*(?:[-*]\s*)?usage\s*:/ }],
+  uiRoute: [{ name: 'path', re: /(^|\n|\s)path\s*[:=]/ }],
+  port: [{ name: 'protocol', re: /(^|\n|\s)protocol\s*[:=]/ }],
+  fileFormat: [{ name: 'format', re: /(^|\n)\s*(?:[-*]\s*)?format\s*:/ }],
+  other: [],
+});
+
+/**
+ * Strip a leading `[draft]` marker from a description so the marker
+ * scan sees the real text underneath. Pure.
+ *
+ * @param {string} desc
+ * @returns {string}
+ */
+function stripDraftPrefix(desc) {
+  return desc.replace(/^\s*\[draft\]\s*/, '');
+}
+
+/**
+ * ADR-4131 (0.30.0 PR 5): per-kind marker presence on an interface.
+ * Returns `{ kind, missing: string[] }` naming the markers that are
+ * absent from `iface.description`. For `other` the "note" is any
+ * non-empty description after the optional `[draft]` prefix. For an
+ * interface whose kind is outside INTERFACE_KINDS the function returns
+ * `{ kind, missing: [] }` so the caller can treat vocabulary errors
+ * through `shapes:kindVocabulary` alone.
+ *
+ * @param {unknown} iface
+ * @returns {{ kind: string|null, missing: string[] }}
+ */
+export function parseInterfaceTemplate(iface) {
+  if (!iface || typeof iface !== 'object') return { kind: null, missing: [] };
+  const kind = typeof (/** @type {any} */ (iface).kind) === 'string' ? /** @type {any} */ (iface).kind : null;
+  const descRaw = typeof (/** @type {any} */ (iface).description) === 'string'
+    ? /** @type {any} */ (iface).description
+    : '';
+  const desc = stripDraftPrefix(descRaw);
+  if (kind === 'other') {
+    const note = desc.trim();
+    return { kind, missing: note.length === 0 ? ['note'] : [] };
+  }
+  const markers = /** @type {any} */ (INTERFACE_TEMPLATE_MARKERS)[kind];
+  if (!Array.isArray(markers)) return { kind, missing: [] };
+  const missing = [];
+  for (const marker of markers) {
+    if (!marker.re.test(desc)) missing.push(marker.name);
+  }
+  return { kind, missing };
+}
+
+/**
+ * Rough `path:` token scanner for an interface description. Returns
+ * every candidate path token the description names so the CLI can
+ * resolve them on disk and the gate can decide `shapes:pathsResolve`
+ * against the resolved map (ADR-4131). A candidate is any text that
+ * follows a `path:` or `path =` marker and looks like a repo-relative
+ * path (contains a `/` or ends with a file extension, no scheme). The
+ * scanner is deliberately conservative: an http URL, a bare word, a
+ * glob or a template placeholder is not a candidate. Exported for the
+ * CLI's resolve-on-disk pass.
+ *
+ * @param {string} description
+ * @returns {string[]}
+ */
+export function extractInterfacePathTokens(description) {
+  if (typeof description !== 'string' || description.length === 0) return [];
+  const text = stripDraftPrefix(description);
+  const out = [];
+  const re = /\bpath\s*[:=]\s*["'`]?([^\s"'`,;)\]]+)/g;
+  let m;
+  while ((m = re.exec(text)) !== null) {
+    const token = m[1];
+    if (!token) continue;
+    if (/^[a-z]+:\/\//i.test(token)) continue;
+    if (token.startsWith('{') || token.startsWith('<') || token.includes('*')) continue;
+    // Skip HTTP / UI route-ish tokens: a leading slash with no file
+    // extension is a route path (an httpRoute or uiRoute's `path:`
+    // marker), not a repo path. A legitimate file path lands as
+    // `src/x.js` or `packages/rcf-lite/CHANGELOG.md`; those don't
+    // start with `/`.
+    if (token.startsWith('/') && !/\.[a-zA-Z0-9]+$/.test(token)) continue;
+    if (!/\//.test(token) && !/\.[a-zA-Z0-9]+$/.test(token)) continue;
+    out.push(token);
+  }
+  return out;
+}
+
 /** Warn-with-ack stages in 0.29.0 (ADR-4122). */
 const WARN_WITH_ACK = new Set(['D3', 'D5', 'D6']);
 
@@ -297,6 +432,21 @@ export function stagePolicy(stage) {
   return WARN_WITH_ACK.has(stage) ? 'warnWithAck' : 'blocking';
 }
 
+/**
+ * ADR-4131 (0.30.0 PR 5): the three gates that accept a recorded
+ * `--ack` override. `stagePolicy` keeps returning `blocking` for every
+ * stage so the readyToBuild fold stays untouched; `ackable(stage)` is
+ * the companion signal the readiness and freeze CLIs read to decide
+ * whether a failing stage honours an acknowledgement at the current
+ * hash. True for D3, D5 and D6; false for everything else.
+ *
+ * @param {string} stage
+ * @returns {boolean}
+ */
+export function ackable(stage) {
+  return WARN_WITH_ACK.has(stage);
+}
+
 /**
  * Scaffold TODO placeholder marker: uppercase "TODO" followed by a
  * colon, matching every scaffold string `rcf init` and `rcf define
@@ -313,6 +463,192 @@ const TODO_RE = /\bTODO:/;
 /** Bracketed AC-class prefix (Baz decision 6, proposal §3.2 D4). */
 const AC_CLASS_RE = /^\[(happy|edge|failure|must-not|non-functional)\]/;
 
+/**
+ * Enumeration cues for `stories:closedSets` (spec section 4 row 'D4
+ * closed-set and ownerRef as findings', 0.30.0 PR 6). An AC description
+ * that contains any of these cues outside a quoted string, with no
+ * inline bracketed list or ownerRef, invites an unlisted value and
+ * fails the check. The cues are matched case-insensitively against the
+ * raw description (minus any leading [class] marker and any
+ * double-quoted substrings).
+ */
+const CLOSED_SET_CUES = Object.freeze([
+  'one of',
+  'any of',
+  'the following',
+  'types of',
+  'status is',
+]);
+// Word-boundary matchers for each cue so a longer word that happens
+// to contain the cue as a substring (e.g. "status issue" containing
+// "status is") does not trip the gate.
+const CLOSED_SET_CUE_RES = Object.freeze(
+  CLOSED_SET_CUES.map((cue) => new RegExp(`\\b${cue.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&')}\\b`, 'i')),
+);
+
+/**
+ * Inline bracketed list regex for the closed-sets check: a square-
+ * bracketed group whose contents look like a list of two or more
+ * tokens separated by commas, slashes or pipes. A bare `[happy]`
+ * class marker is NOT a list (one token, no separator); `[a, b]`,
+ * `[a | b | c]` and `[a/b]` are.
+ */
+const INLINE_LIST_RE = /\[[^\]\n]*[,|\/][^\]\n]*\]/;
+
+/**
+ * ownerRef marker: a cheap presence check for the structured
+ * `{ tacId, field: "interfaces[<name>]" }` pointer. True when the AC
+ * carries an ownerRef object (consistency-lint and PR 6 both read the
+ * same field).
+ *
+ * @param {unknown} ac
+ * @returns {boolean}
+ */
+function acHasOwnerRef(ac) {
+  const ref = ac && typeof ac === 'object' ? /** @type {any} */ (ac).ownerRef : null;
+  if (!ref || typeof ref !== 'object') return false;
+  // R11 (spec section 17, 2026-10-03): an ownerRef may name a TAC
+  // (via tacId) OR an ADR (via adrId). Pre-R11 code only recognised
+  // tacId; the ADR branch was dropped silently.
+  return typeof ref.tacId === 'string' || typeof ref.adrId === 'string';
+}
+
+/**
+ * Strip double-quoted substrings so a quoted cue inside the AC text
+ * does not fire the closed-sets check (shared with D6's negation guard
+ * convention). Matches `"..."` with no embedded unescaped double
+ * quote; the regex is deliberately permissive. The strip is only for
+ * the cue scan; the inline-list scan reads the full description.
+ *
+ * @param {string} desc
+ * @returns {string}
+ */
+function stripQuotedSubstrings(desc) {
+  return desc.replace(/"[^"\n]*"/g, '');
+}
+
+/**
+ * True when the AC description carries an enumeration cue outside a
+ * quoted substring, with no inline bracketed list and no ownerRef
+ * pointer. Pure.
+ *
+ * @param {unknown} ac
+ * @returns {boolean}
+ */
+function failsClosedSets(ac) {
+  const descRaw = ac && typeof ac === 'object' ? /** @type {any} */ (ac).description : null;
+  if (typeof descRaw !== 'string' || descRaw.length === 0) return false;
+  if (acHasOwnerRef(ac)) return false;
+  const descNoClass = descRaw.replace(AC_CLASS_RE, '').trim();
+  if (INLINE_LIST_RE.test(descNoClass)) return false;
+  const descForCues = stripQuotedSubstrings(descNoClass);
+  for (const re of CLOSED_SET_CUE_RES) {
+    if (re.test(descForCues)) return true;
+  }
+  return false;
+}
+
+/**
+ * Parse an `interfaces[<name>]` field pointer into its interface
+ * name. Accepts any non-empty name between the brackets (interface
+ * names routinely carry dots, slashes and spaces); returns null for
+ * an unparseable pointer.
+ *
+ * @param {unknown} field
+ * @returns {string | null}
+ */
+function parseOwnerRefInterfaceField(field) {
+  if (typeof field !== 'string') return null;
+  const m = field.match(/^interfaces\[([^\]\n]+)\]$/);
+  return m ? m[1] : null;
+}
+
+/**
+ * R11 field grammar (spec section 17, 2026-10-03). An `ownerRef` or
+ * object-form `deliveredBy` `{ tacId | adrId, field }` resolves when
+ * `field` names an existing field path on the owning document in
+ * bracket grammar:
+ *
+ *   - `interfaces[<name>]` resolves when `doc.interfaces[].name` matches.
+ *   - `responsibilities[<n>]` resolves when `doc.responsibilities[n]`
+ *     exists (non-negative integer index, zero-based).
+ *   - `dependencies[<name>]` resolves when `doc.dependencies[].name` matches.
+ *   - `alternativesConsidered[<n>]` resolves when the ADR has an
+ *     alternative at that index.
+ *   - A bare schema field name (`purpose`, `internalStructure`,
+ *     `decision`, `name`, `context`, `consequences`, `tradeoffs`,
+ *     `notes`, `description`, `responsibilities`, `dependencies`,
+ *     `interfaces`, `alternativesConsidered`) resolves when the
+ *     document carries a non-empty value under that key.
+ *
+ * Dotted grammar (`interfaces.name`, `responsibilities.foo`) is NOT
+ * accepted: callers of the R11 widening MUST rewrite to bracket
+ * grammar first. A path that does not match any arm returns false.
+ *
+ * `AC-17405-2` is unchanged in effect: `interfaces[loan]` on a TAC
+ * carrying an interface named `loan` resolves; `interfaces[missing]`
+ * fails.
+ *
+ * @param {unknown} doc - the owning TAC or ADR document.
+ * @param {unknown} field - the ownerRef/deliveredBy field string.
+ * @returns {boolean}
+ */
+export function resolveOwnerRefField(doc, field) {
+  if (!doc || typeof doc !== 'object') return false;
+  if (typeof field !== 'string' || field.length === 0) return false;
+  const d = /** @type {any} */ (doc);
+  // interfaces[<name>] -- preserved from the 0.29.0 helper.
+  const ifaceMatch = field.match(/^interfaces\[([^\]\n]+)\]$/);
+  if (ifaceMatch) {
+    const name = ifaceMatch[1];
+    return Array.isArray(d.interfaces)
+      && d.interfaces.some((iface) => iface && typeof iface === 'object' && iface.name === name);
+  }
+  // dependencies[<name>] (TAC.dependencies[].name).
+  const depMatch = field.match(/^dependencies\[([^\]\n]+)\]$/);
+  if (depMatch) {
+    const name = depMatch[1];
+    return Array.isArray(d.dependencies)
+      && d.dependencies.some((dep) => dep && typeof dep === 'object' && dep.name === name);
+  }
+  // responsibilities[<n>] (zero-based integer index on the strings array).
+  const respMatch = field.match(/^responsibilities\[(\d+)\]$/);
+  if (respMatch) {
+    const idx = Number(respMatch[1]);
+    return Array.isArray(d.responsibilities) && idx < d.responsibilities.length
+      && typeof d.responsibilities[idx] === 'string'
+      && d.responsibilities[idx].length > 0;
+  }
+  // alternativesConsidered[<n>] (ADR).
+  const altMatch = field.match(/^alternativesConsidered\[(\d+)\]$/);
+  if (altMatch) {
+    const idx = Number(altMatch[1]);
+    return Array.isArray(d.alternativesConsidered) && idx < d.alternativesConsidered.length
+      && d.alternativesConsidered[idx] && typeof d.alternativesConsidered[idx] === 'object';
+  }
+  // Bare schema field name. Must be in the TAC/ADR schema and present
+  // and non-empty on the document. The accepted set covers the schema
+  // fields the spec names and the extras TAC/ADR carry; a field name
+  // outside the set returns false.
+  const BARE_FIELDS = new Set([
+    // TAC fields.
+    'purpose', 'internalStructure', 'tradeoffs', 'notes', 'name',
+    'responsibilities', 'interfaces', 'dependencies',
+    // ADR fields.
+    'decision', 'context', 'consequences', 'title',
+    'alternativesConsidered',
+    // Common.
+    'description',
+  ]);
+  if (!BARE_FIELDS.has(field)) return false;
+  const v = d[field];
+  if (v == null) return false;
+  if (typeof v === 'string') return v.length > 0;
+  if (Array.isArray(v)) return v.length > 0;
+  if (typeof v === 'object') return Object.keys(v).length > 0;
+  return true;
+}
+
 /**
  * Parse the leading bracketed class marker on `ac.description`.
  * Returns the class token, or null when no marker is present.
@@ -435,6 +771,11 @@ function asSet(scope) {
  * @property {{ skipReviewFor?: string } | undefined} profile  parsed profile switches (light shape)
  * @property {string | null | undefined} currentTreeHash  for warn-with-ack acknowledgement match
  * @property {Array<{ state: string }> | undefined} priorStages  D8 reads earlier stage states from this
+ * @property {Set<string> | undefined} resolvedPaths  ADR-4131 (0.30.0 PR 5): set of repo-relative paths the CLI
+ *   already resolved on disk; `shapes:pathsResolve` reads this to decide
+ *   whether a `path:` token on an interface description resolves. Empty or
+ *   undefined means no path is known-resolved, so every candidate token
+ *   fails unless the interface description carries `authoredAt: D3`.
  */
 
 /**
@@ -621,6 +962,50 @@ export function checkD2Skeleton(ctx) {
   else if (deployAdrs.length > 1) deployFail.push({ id: 'ADR:deploy', why: `${deployAdrs.length} Deploy ADRs found; expected exactly one` });
   checks.push(makeCheck('skeleton:deployAdr', 'tree', 1, deployFail));
 
+  // Check 5 (0.30.0 PR 6): skeleton:standardsCited (engineer, over
+  // tree). Every standards pack registered through `rcf define
+  // standards` (manifest.standards[].slug) is cited in a REQ
+  // `rationale` or an ADR, or waived by a concern-ledger entry keyed
+  // `standards:<pack>`. Fail ids `standards:<pack>` with 'uncited and
+  // unwaived'. Citation is a case-sensitive substring match of the
+  // slug against each REQ.rationale and each ADR document (the ADR
+  // may name a pack in its title, context, decision or consequences;
+  // the serialised document is scanned once per ADR to cover every
+  // field). A waiver entry on the concern ledger reads `concern:
+  // 'standards:<pack>'` with disposition 'applied' or 'waived'.
+  const standardsList = Array.isArray(tree.manifest?.standards)
+    ? /** @type {any[]} */ (tree.manifest.standards)
+    : [];
+  /** @type {Array<{ id: string, why: string }>} */
+  const standardsFail = [];
+  if (standardsList.length > 0) {
+    const reqRationales = (tree.requirements ?? [])
+      .map((r) => (typeof r?.rationale === 'string' ? r.rationale : ''))
+      .join('\n');
+    const adrDocs = (tree.adrs ?? []).map((a) => {
+      try { return JSON.stringify(a); } catch { return ''; }
+    }).join('\n');
+    const concernsBody = /** @type {any} */ (ctx.ledgers?.concerns);
+    const concernList = Array.isArray(concernsBody?.concerns) ? concernsBody.concerns : [];
+    const waiverSlugs = new Set();
+    for (const entry of concernList) {
+      if (!entry || typeof entry.concern !== 'string') continue;
+      const disposition = typeof entry.disposition === 'string' ? entry.disposition : null;
+      if (disposition !== 'applied' && disposition !== 'waived') continue;
+      const m = entry.concern.match(/^standards:(.+)$/);
+      if (m) waiverSlugs.add(m[1]);
+    }
+    for (const pack of standardsList) {
+      const slug = typeof pack?.slug === 'string' ? pack.slug : null;
+      if (!slug) continue;
+      if (waiverSlugs.has(slug)) continue;
+      if (reqRationales.includes(slug)) continue;
+      if (adrDocs.includes(slug)) continue;
+      standardsFail.push({ id: `standards:${slug}`, why: 'uncited and unwaived' });
+    }
+  }
+  checks.push(makeCheck('skeleton:standardsCited', 'tree', Math.max(standardsList.length, 1), standardsFail));
+
   return foldState('D2', gate, checks, {
     currentTreeHash: ctx.currentTreeHash ?? null,
     freezeGates: /** @type {any} */ (ctx.freeze?.gates),
@@ -722,6 +1107,106 @@ export function checkD3Shapes(ctx) {
   checks.push(makeCheck('shapes:kindVocabulary', 'delta', totalInterfaces, badKinds));
   checks.push(makeCheck('shapes:draftSettled', 'delta', totalDraftHomes, draftFindings));
 
+  // ADR-4131 (0.30.0 PR 5): three D3 bite checks follow.
+  // Check 4: shapes:templateMarkers (engineer, over delta). For every
+  // interface on an in-scope TAC, parseInterfaceTemplate reports which
+  // per-kind markers are missing from the description; a draft marker
+  // is stripped before the scan so a [draft] recordShape without
+  // `fields:` fails exactly as a settled one. An interface whose kind
+  // is outside INTERFACE_KINDS is left to shapes:kindVocabulary (the
+  // marker map returns `{missing: []}` for an unknown kind so this
+  // check does not double-report the vocabulary miss).
+  /** @type {Array<{ id: string, why: string }>} */
+  const templateFindings = [];
+  for (const tac of tacsInScope) {
+    for (const iface of tac.interfaces ?? []) {
+      const result = parseInterfaceTemplate(iface);
+      if (!result.kind) continue;
+      for (const marker of result.missing) {
+        templateFindings.push({
+          id: `${tac.tacId}:${iface?.name ?? '(unnamed)'}`,
+          why: `missing marker ${marker}`,
+        });
+      }
+    }
+  }
+  checks.push(makeCheck('shapes:templateMarkers', 'delta', totalInterfaces, templateFindings));
+
+  // Check 5: shapes:entityJoin (engineer, over tree). Every entry in
+  // TAD.dataArchitecture.coreEntities must be named by exactly one
+  // recordShape across the whole tree (not just the delta scope),
+  // matching on the recordShape's `name` field or on an `entity:` line
+  // in its description. A `[draft]` prefix is stripped before the
+  // entity-line scan so a draft recordShape still joins.
+  /** @type {Array<{ id: string, why: string }>} */
+  const joinFindings = [];
+  const treeTacs = tree.tacs ?? [];
+  const recordShapesByEntity = new Map();
+  for (const tac of treeTacs) {
+    for (const iface of tac.interfaces ?? []) {
+      if (iface?.kind !== 'recordShape') continue;
+      const ownerLabel = `${tac.tacId}:${iface?.name ?? '(unnamed)'}`;
+      const names = new Set();
+      if (typeof iface?.name === 'string') names.add(iface.name);
+      const desc = typeof iface?.description === 'string' ? stripDraftPrefix(iface.description) : '';
+      const entityRe = /(^|\n)\s*(?:[-*]\s*)?entity\s*[:=]\s*["'`]?([A-Za-z_][A-Za-z0-9_]*)/g;
+      let em;
+      while ((em = entityRe.exec(desc)) !== null) {
+        if (em[2]) names.add(em[2]);
+      }
+      for (const name of names) {
+        const owners = recordShapesByEntity.get(name) ?? [];
+        owners.push(ownerLabel);
+        recordShapesByEntity.set(name, owners);
+      }
+    }
+  }
+  for (const entity of coreEntities) {
+    const name = typeof entity?.name === 'string' ? entity.name : null;
+    if (!name) continue;
+    const owners = recordShapesByEntity.get(name) ?? [];
+    if (owners.length === 0) {
+      joinFindings.push({ id: `TAD.entity:${name}`, why: 'no record shape' });
+    } else if (owners.length > 1) {
+      joinFindings.push({ id: `TAD.entity:${name}`, why: `${owners.length} record shapes` });
+    }
+  }
+  checks.push(makeCheck('shapes:entityJoin', 'tree', coreEntities.length, joinFindings));
+
+  // Check 6: shapes:pathsResolve (engineer, over delta). Any path:
+  // token on an in-scope interface description must either resolve
+  // against `resolvedPaths` (the CLI's on-disk pass) or the
+  // description must carry an `authoredAt: D3` marker (the engineer
+  // owns the path even when the file is yet to land). The marker is
+  // a token in the description text (`authoredAt: D3` or
+  // `authoredAt = D3`), not a separate schema field; the TAC schema
+  // keeps interfaces to { name, kind, description }. Over delta,
+  // one failing entry per unresolved (tacId:name, path) pair.
+  const resolvedPaths = ctx.resolvedPaths instanceof Set ? ctx.resolvedPaths : new Set();
+  /** @type {Array<{ id: string, why: string }>} */
+  const pathFindings = [];
+  let totalPathChecks = 0;
+  for (const tac of tacsInScope) {
+    for (const iface of tac.interfaces ?? []) {
+      const desc = typeof iface?.description === 'string' ? iface.description : '';
+      const tokens = extractInterfacePathTokens(desc);
+      if (tokens.length === 0) continue;
+      const authoredAtD3 = /\bauthoredAt\s*[:=]\s*["'`]?D3\b/.test(stripDraftPrefix(desc));
+      for (const token of tokens) {
+        totalPathChecks += 1;
+        if (authoredAtD3) continue;
+        if (resolvedPaths.has(token)) continue;
+        pathFindings.push({
+          id: `${tac.tacId}:${iface?.name ?? '(unnamed)'}`,
+          why: `path does not resolve: ${token}`,
+        });
+      }
+    }
+  }
+  // Keep total >= 1 so the chip prints a sensible ratio when no
+  // interface in scope names a path.
+  checks.push(makeCheck('shapes:pathsResolve', 'delta', Math.max(totalPathChecks, 1), pathFindings));
+
   return foldState('D3', gate, checks, {
     currentTreeHash: ctx.currentTreeHash ?? null,
     freezeGates: /** @type {any} */ (ctx.freeze?.gates),
@@ -801,6 +1286,72 @@ export function checkD4Stories(ctx) {
   }
   checks.push(makeCheck('stories:usFloors', 'delta', usInScope.length, usFail));
 
+  // Check 3 (0.30.0 PR 6): stories:closedSets (engineer, over delta).
+  // Every AC on a US in scope whose description contains an enumeration
+  // cue (one of | any of | the following | types of | status is)
+  // without an inline bracketed list of two or more tokens AND without
+  // an ownerRef fails. The quoted-cue guard strips `"..."` substrings
+  // before the cue scan so prose that quotes a cue does not fire the
+  // check.
+  /** @type {Array<{ id: string, why: string }>} */
+  const closedSetFindings = [];
+  let totalClosedSetAcs = 0;
+  for (const us of usInScope) {
+    const acs = Array.isArray(us.acceptanceCriteria) ? us.acceptanceCriteria : [];
+    for (const ac of acs) {
+      if (typeof ac?.description !== 'string' || ac.description.length === 0) continue;
+      totalClosedSetAcs += 1;
+      if (failsClosedSets(ac)) {
+        closedSetFindings.push({
+          id: ac.id ?? us.usId,
+          why: 'enumeration cue without a closed set',
+        });
+      }
+    }
+  }
+  checks.push(makeCheck('stories:closedSets', 'delta', totalClosedSetAcs, closedSetFindings));
+
+  // Check 4 (0.30.0 PR 6): stories:ownerRefResolves (engineer, over
+  // delta plus tree for ownerRef targets). Every AC on a US in scope
+  // whose ownerRef is set must point to an interface by name on the
+  // named TAC. Ids `<acId>:<field>`; why 'ownerRef does not resolve'.
+  /** @type {Array<{ id: string, why: string }>} */
+  const ownerRefFindings = [];
+  let totalOwnerRefAcs = 0;
+  // R11 (spec section 17, 2026-10-03): the ownerRef field grammar
+  // widens beyond `interfaces[<name>]` to every bracket-grammar path
+  // that names an existing field on the owning TAC or ADR. The owner
+  // may now be a TAC (via tacId) or an ADR (via adrId); the resolver
+  // handles the bracket forms (`interfaces[<name>]`,
+  // `responsibilities[<n>]`, `dependencies[<name>]`,
+  // `alternativesConsidered[<n>]`) and bare schema fields (`purpose`,
+  // `internalStructure`, `decision`, etc.). A path that does not
+  // match any arm still fails. AC-17405-2 is unchanged in effect.
+  for (const us of usInScope) {
+    const acs = Array.isArray(us.acceptanceCriteria) ? us.acceptanceCriteria : [];
+    for (const ac of acs) {
+      if (!acHasOwnerRef(ac)) continue;
+      totalOwnerRefAcs += 1;
+      const ref = /** @type {any} */ (ac).ownerRef;
+      let owner = null;
+      if (typeof ref.tacId === 'string') {
+        owner = (tree.tacs ?? []).find((t) => t?.tacId === ref.tacId) ?? null;
+      } else if (typeof ref.adrId === 'string') {
+        owner = (tree.adrs ?? []).find((a) => a?.adrId === ref.adrId) ?? null;
+      }
+      const resolves = !!(owner && resolveOwnerRefField(owner, ref.field));
+      if (!resolves) {
+        ownerRefFindings.push({
+          id: `${ac.id ?? us.usId}:${ref.field ?? '(no field)'}`,
+          why: 'ownerRef does not resolve',
+        });
+      }
+    }
+  }
+  // Keep total >= 1 so the chip prints a sensible ratio when no AC in
+  // scope carries an ownerRef.
+  checks.push(makeCheck('stories:ownerRefResolves', 'delta', Math.max(totalOwnerRefAcs, 1), ownerRefFindings));
+
   return foldState('D4', gate, checks, {
     currentTreeHash: ctx.currentTreeHash ?? null,
     freezeGates: /** @type {any} */ (ctx.freeze?.gates),
@@ -871,6 +1422,52 @@ export function checkD5Crosscut(ctx) {
     openInScope.map((c) => ({ id: `concern:${c.id}`, why: `open concern on ${c.reqId}: ${c.concern}` })),
   ));
 
+  // Check 4 (0.30.0 PR 6): crosscut:catalogue (engineer, over tree).
+  // For every REQ in scope, enumerate applicable (reqShape, concern)
+  // pairs via src/define/concern-catalogue.js; each pair needs a
+  // concern-ledger entry keyed <REQ>:<concern> with disposition
+  // applied or waived (a waived entry carries a reason). Fail ids are
+  // `<REQ>:<concern>`; the why names the missing concern. A waived
+  // entry without a reason also fails. Keys shared with the baseline
+  // catalogue where names coincide (today only `auth`).
+  const entriesByKey = new Map();
+  for (const entry of concernEntries) {
+    if (!entry || typeof entry.reqId !== 'string' || typeof entry.concern !== 'string') continue;
+    entriesByKey.set(`${entry.reqId}:${entry.concern}`, entry);
+  }
+  /** @type {Array<{ id: string, why: string }>} */
+  const catalogueFindings = [];
+  let totalCataloguePairs = 0;
+  for (const req of reqInScope) {
+    const shapes = Array.isArray(req?.shapeClassification?.shapes)
+      ? req.shapeClassification.shapes.filter((s) => typeof s === 'string')
+      : [];
+    const applicable = applicableConcernsForShapes(shapes);
+    for (const concern of applicable) {
+      totalCataloguePairs += 1;
+      const key = `${req.reqId}:${concern}`;
+      const entry = entriesByKey.get(key);
+      if (!entry) {
+        catalogueFindings.push({ id: key, why: `missing concern-ledger entry for ${concern}` });
+        continue;
+      }
+      const disposition = typeof entry.disposition === 'string' ? entry.disposition : null;
+      if (disposition !== 'applied' && disposition !== 'waived') {
+        catalogueFindings.push({ id: key, why: `concern-ledger entry disposition is ${disposition ?? '(unset)'}` });
+        continue;
+      }
+      if (disposition === 'waived') {
+        const reason = typeof entry.reason === 'string' ? entry.reason.trim() : '';
+        if (reason.length === 0) {
+          catalogueFindings.push({ id: key, why: 'waived without a reason' });
+        }
+      }
+    }
+  }
+  // Keep total >= 1 so the chip prints a sensible ratio when no REQ in
+  // scope has applicable concerns (every REQ carries shape 'other').
+  checks.push(makeCheck('crosscut:catalogue', 'tree', Math.max(totalCataloguePairs, 1), catalogueFindings));
+
   return foldState('D5', gate, checks, {
     currentTreeHash: ctx.currentTreeHash ?? null,
     freezeGates: /** @type {any} */ (ctx.freeze?.gates),
@@ -882,14 +1479,14 @@ export function checkD5Crosscut(ctx) {
 // ---------------------------------------------------------------------------
 
 /**
- * D6 -- Consistency and satisfiability probe. 0.29.0 runs only the
- * validate-clean tree-wide check and the probe-ledger open count.
- *
- * SEAM 0.30: contradiction-lite across criteria on one story and
- * across their TACs' ADRs; unsatisfiable-lite (a `then` naming
- * undefined state); duplicate scan; orphan-interface scan;
- * regeneration probe runner injectable like `mutationRunner` in
- * src/review/index.js.
+ * D6 -- Consistency and satisfiability probe. 0.29.0 ran the
+ * validate-clean tree-wide check and the probe-ledger open count;
+ * 0.30.0 PR 7 (ADR-4131 extended, spec section 4 row 'D6 scans and the
+ * injectable probe runner') adds the four mechanical scans
+ * consistency:contradictions, consistency:unsatisfiable,
+ * consistency:duplicates and consistency:orphanInterfaces. The probe
+ * runner lives on the readiness compute (TAC-4123); the gate reads the
+ * merged probes.probes[] it ends up with.
  *
  * @param {StageContext} ctx
  */
@@ -933,12 +1530,350 @@ export function checkD6Consistency(ctx) {
   // uses a single representative entry regardless.
   checks.push(makeCheck('consistency:probeCount', 'tree', Math.max(effectiveOpen, 1), failing, effectiveOpen));
 
+  // ADR-4131 extended (0.30.0 PR 7): the four D6 scans.
+  const scope = asSet(ctx.scope);
+  const tree = ctx.tree;
+  const usInScope = (tree.userStories ?? []).filter((us) => scope.has(us.usId));
+
+  // Scan 1: consistency:contradictions (engineer, over delta). Two ACs
+  // on one story share a `when` clause and one of their `then` clauses
+  // is a negation of the other. The quoted-cue guard strips
+  // double-quoted substrings before the negation scan so prose that
+  // quotes a negation inside a `then` does not fire the check.
+  /** @type {Array<{ id: string, why: string }>} */
+  const contradictionFindings = [];
+  let totalStoriesScanned = 0;
+  for (const us of usInScope) {
+    const acs = Array.isArray(us.acceptanceCriteria) ? us.acceptanceCriteria : [];
+    if (acs.length < 2) continue;
+    totalStoriesScanned += 1;
+    const parsed = acs
+      .map((ac) => ({ ac, parts: parseWhenThen(ac?.description) }))
+      .filter((p) => p.parts !== null);
+    const reported = new Set();
+    for (let i = 0; i < parsed.length; i += 1) {
+      for (let j = i + 1; j < parsed.length; j += 1) {
+        const a = parsed[i];
+        const b = parsed[j];
+        if (normaliseClause(a.parts.when) !== normaliseClause(b.parts.when)) continue;
+        if (!thensNegateEachOther(a.parts.then, b.parts.then)) continue;
+        const pairKey = `${us.usId}:${a.ac.id ?? '?'}:${b.ac.id ?? '?'}`;
+        if (reported.has(pairKey)) continue;
+        reported.add(pairKey);
+        const idA = a.ac.id ?? us.usId;
+        const idB = b.ac.id ?? us.usId;
+        contradictionFindings.push({
+          id: us.usId,
+          why: `ACs ${idA} and ${idB} share a when clause with a negated then`,
+        });
+      }
+    }
+  }
+  checks.push(makeCheck(
+    'consistency:contradictions',
+    'delta',
+    Math.max(totalStoriesScanned, 1),
+    contradictionFindings,
+  ));
+
+  // Scan 2: consistency:unsatisfiable (engineer, over delta). A `then`
+  // naming a field that no recordShape anywhere in the tree defines
+  // fails the AC with id `<acId>:<field>`. A field defined in a
+  // `[draft]` recordShape counts as defined (the engineer owns the
+  // draft; its `fields:` list is honest about what the then may name).
+  const definedFields = collectRecordShapeFields(tree);
+  /** @type {Array<{ id: string, why: string }>} */
+  const unsatisfiableFindings = [];
+  let totalThenFieldChecks = 0;
+  for (const us of usInScope) {
+    const acs = Array.isArray(us.acceptanceCriteria) ? us.acceptanceCriteria : [];
+    for (const ac of acs) {
+      const parts = parseWhenThen(ac?.description);
+      if (!parts) continue;
+      const fields = extractThenFieldTokens(parts.then);
+      for (const field of fields) {
+        totalThenFieldChecks += 1;
+        if (definedFields.has(field)) continue;
+        unsatisfiableFindings.push({
+          id: `${ac.id ?? us.usId}:${field}`,
+          why: `then names field ${field} that no recordShape defines`,
+        });
+      }
+    }
+  }
+  checks.push(makeCheck(
+    'consistency:unsatisfiable',
+    'delta',
+    Math.max(totalThenFieldChecks, 1),
+    unsatisfiableFindings,
+  ));
+
+  // Scan 3: consistency:duplicates (engineer, over tree). Identical AC
+  // descriptions across stories fail both ACs. The comparison trims
+  // leading whitespace and the leading `[class]` marker.
+  /** @type {Map<string, Array<{ usId: string, acId: string }>>} */
+  const descBuckets = new Map();
+  const allUs = tree.userStories ?? [];
+  let totalDupAcs = 0;
+  for (const us of allUs) {
+    const acs = Array.isArray(us.acceptanceCriteria) ? us.acceptanceCriteria : [];
+    for (const ac of acs) {
+      const desc = typeof ac?.description === 'string' ? ac.description.trim() : '';
+      if (desc.length === 0) continue;
+      totalDupAcs += 1;
+      const normalised = desc.replace(AC_CLASS_RE, '').trim().toLowerCase();
+      if (normalised.length === 0) continue;
+      const bucket = descBuckets.get(normalised) ?? [];
+      bucket.push({ usId: us.usId, acId: ac.id ?? us.usId });
+      descBuckets.set(normalised, bucket);
+    }
+  }
+  /** @type {Array<{ id: string, why: string }>} */
+  const duplicateFindings = [];
+  for (const bucket of descBuckets.values()) {
+    if (bucket.length < 2) continue;
+    const stories = [...new Set(bucket.map((b) => b.usId))];
+    if (stories.length < 2) continue;
+    for (const entry of bucket) {
+      duplicateFindings.push({
+        id: entry.acId,
+        why: `duplicate description (also on ${bucket.filter((b) => b.acId !== entry.acId).map((b) => b.acId).join(', ')})`,
+      });
+    }
+  }
+  checks.push(makeCheck(
+    'consistency:duplicates',
+    'tree',
+    Math.max(totalDupAcs, 1),
+    duplicateFindings,
+  ));
+
+  // Scan 4: consistency:orphanInterfaces (engineer, over tree). An
+  // interface on any TAC that no AC `ownerRef` points at AND that no
+  // REQ `deliveredBy` reaches fails. Shares the `interfaces[<name>]`
+  // pointer grammar with D4 `stories:ownerRefResolves`. A REQ's
+  // `deliveredBy` reaches an interface when it names the owning TAC id
+  // (either as a `tacId` string or as a `TAC-nnnn:<name>` pointer).
+  const reachedInterfaces = collectReachedInterfaces(tree);
+  /** @type {Array<{ id: string, why: string }>} */
+  const orphanFindings = [];
+  let totalInterfacesScanned = 0;
+  for (const tac of tree.tacs ?? []) {
+    const list = Array.isArray(tac?.interfaces) ? tac.interfaces : [];
+    for (const iface of list) {
+      const name = typeof iface?.name === 'string' ? iface.name : null;
+      if (!name) continue;
+      totalInterfacesScanned += 1;
+      const key = `${tac.tacId}:${name}`;
+      if (reachedInterfaces.has(key)) continue;
+      orphanFindings.push({
+        id: key,
+        why: 'no AC ownerRef and no REQ deliveredBy reaches it',
+      });
+    }
+  }
+  checks.push(makeCheck(
+    'consistency:orphanInterfaces',
+    'tree',
+    Math.max(totalInterfacesScanned, 1),
+    orphanFindings,
+  ));
+
   return foldState('D6', gate, checks, {
     currentTreeHash: ctx.currentTreeHash ?? null,
     freezeGates: /** @type {any} */ (ctx.freeze?.gates),
   });
 }
 
+/**
+ * Parse an AC description into { when, then } clause strings. Accepts
+ * the common "given ... when ... then ..." shape used across the ACs
+ * of this codebase; returns null when the description does not carry
+ * both a `when` and a `then` segment. The leading `[class]` marker is
+ * stripped before the scan. The match is case-insensitive on the
+ * keywords only; the clause bodies keep their original casing.
+ *
+ * @param {unknown} desc
+ * @returns {{ when: string, then: string } | null}
+ */
+function parseWhenThen(desc) {
+  if (typeof desc !== 'string' || desc.length === 0) return null;
+  const stripped = desc.replace(AC_CLASS_RE, '').trim();
+  const re = /\bwhen\b([\s\S]*?)\bthen\b([\s\S]*)$/i;
+  const m = stripped.match(re);
+  if (!m) return null;
+  const when = m[1].trim();
+  const then = m[2].trim();
+  if (when.length === 0 || then.length === 0) return null;
+  return { when, then };
+}
+
+/**
+ * Normalise a clause for the contradictions scan: lower-case, trim,
+ * collapse whitespace. A clause is "the same" between two ACs when
+ * their normalised forms match.
+ *
+ * @param {string} clause
+ * @returns {string}
+ */
+function normaliseClause(clause) {
+  return clause.toLowerCase().replace(/\s+/g, ' ').trim();
+}
+
+/**
+ * Strip double-quoted substrings and then test whether one `then`
+ * clause is the negation of the other. "Negation" is a cheap test: one
+ * clause begins (or carries, after a verb) a `not`, `no`, `does not`,
+ * `is not`, `never`, `must not` token where the other clause does not;
+ * or the two clauses are the same body with one carrying such a token.
+ * The quoted-substring strip is the shared guard with D4.
+ *
+ * @param {string} a
+ * @param {string} b
+ * @returns {boolean}
+ */
+function thensNegateEachOther(a, b) {
+  const aPlain = normaliseClause(stripQuotedSubstrings(a));
+  const bPlain = normaliseClause(stripQuotedSubstrings(b));
+  if (aPlain === bPlain) return false;
+  const NEG_RE = /\b(?:not|no|never|does not|is not|must not|cannot|won't|will not)\b/;
+  const aNeg = NEG_RE.test(aPlain);
+  const bNeg = NEG_RE.test(bPlain);
+  if (aNeg === bNeg) return false;
+  // One side negates; test the negated body against the positive one.
+  const positive = aNeg ? bPlain : aPlain;
+  const negative = aNeg ? aPlain : bPlain;
+  const negativeStripped = negative.replace(NEG_RE, '').replace(/\s+/g, ' ').trim();
+  // A sufficiently similar body is "the same claim with a negation".
+  // We treat the shorter being a prefix / suffix / substring of the
+  // longer, or sharing 80% of its tokens, as "same body".
+  if (negativeStripped.length === 0) return false;
+  if (positive.includes(negativeStripped) || negativeStripped.includes(positive)) return true;
+  const posTokens = new Set(positive.split(/\s+/).filter((t) => t.length > 2));
+  const negTokens = negativeStripped.split(/\s+/).filter((t) => t.length > 2);
+  if (negTokens.length === 0) return false;
+  const shared = negTokens.filter((t) => posTokens.has(t)).length;
+  return shared / negTokens.length >= 0.6;
+}
+
+/**
+ * Collect every field name defined by any `recordShape` interface in
+ * the tree. A `fields:` marker in the interface description introduces
+ * a list of field names; each name is a token on a bullet, a line, or
+ * a comma-separated list. Draft recordShapes are included (the
+ * engineer owns the draft and its fields: list is honest).
+ *
+ * @param {import('#core/store/walker.js').TreeModel} tree
+ * @returns {Set<string>}
+ */
+function collectRecordShapeFields(tree) {
+  const out = new Set();
+  for (const tac of tree.tacs ?? []) {
+    for (const iface of tac.interfaces ?? []) {
+      if (iface?.kind !== 'recordShape') continue;
+      const desc = typeof iface?.description === 'string' ? iface.description : '';
+      const stripped = stripDraftPrefix(desc);
+      // Find the `fields:` segment and read until the next `:` or end.
+      const match = stripped.match(/(^|\n)\s*(?:[-*]\s*)?fields\s*:\s*([\s\S]*?)(?=(?:\n\s*(?:[-*]\s*)?[a-zA-Z][a-zA-Z0-9_]*\s*:)|$)/);
+      if (!match) continue;
+      const body = match[2];
+      for (const token of body.split(/[\s,]+/)) {
+        const name = token.replace(/^[-*]/, '').replace(/[:(){}\[\]]/g, '').trim();
+        if (!name) continue;
+        if (/^[A-Za-z_][A-Za-z0-9_]*$/.test(name)) out.add(name);
+      }
+    }
+  }
+  return out;
+}
+
+/**
+ * Pull field tokens out of a `then` clause. A field token is a word
+ * that follows a verb like `set`, `write`, `include`, `return`,
+ * `contain`, `name` or appears as the direct object of a `then`'s
+ * verb phrase; a cheap approximation uses `then <subject> <verb>
+ * <field>` plus `field <name>`, `<name> field` and `field: <name>`
+ * patterns. The scan is deliberately conservative so a plain English
+ * sentence yields a small set.
+ *
+ * @param {string} thenClause
+ * @returns {string[]}
+ */
+function extractThenFieldTokens(thenClause) {
+  if (typeof thenClause !== 'string' || thenClause.length === 0) return [];
+  const text = stripQuotedSubstrings(thenClause);
+  /** @type {Set<string>} */
+  const tokens = new Set();
+  // Pattern 1: backticked identifier (`then `balance` is set`). The
+  // primary signal; prose that quotes a field name under backticks is
+  // the convention this check expects.
+  for (const m of text.matchAll(/`([A-Za-z_][A-Za-z0-9_]*)`/g)) {
+    if (m[1]) tokens.add(m[1]);
+  }
+  // Pattern 2: `<name> field` (adjective-form naming). An English
+  // "stop word" skip keeps "the field", "a field" and "its field" from
+  // tripping the check.
+  const STOP = new Set(['the', 'a', 'an', 'this', 'that', 'its', 'our', 'their', 'any', 'no', 'some', 'each', 'every', 'another']);
+  for (const m of text.matchAll(/\b([A-Za-z_][A-Za-z0-9_]*)\s+field\b/g)) {
+    const token = m[1];
+    if (!token) continue;
+    if (STOP.has(token.toLowerCase())) continue;
+    tokens.add(token);
+  }
+  // Pattern 3: `field: <name>` or `field = <name>` (schema-like
+  // notation inside a then clause).
+  for (const m of text.matchAll(/\bfield\s*[:=]\s*([A-Za-z_][A-Za-z0-9_]*)/g)) {
+    if (m[1]) tokens.add(m[1]);
+  }
+  return [...tokens];
+}
+
+/**
+ * Collect every interface the tree "reaches" from an AC `ownerRef` or
+ * a REQ `deliveredBy` (REQ-174 companion field). The result is a Set
+ * of `<tacId>:<name>` keys. A `deliveredBy` on a REQ can take two
+ * shapes: an array of `TAC-nnnn:<name>` pointer strings, or an array
+ * of plain TAC ids ("delivered by this TAC"); the second shape reaches
+ * every interface on the named TAC.
+ *
+ * @param {import('#core/store/walker.js').TreeModel} tree
+ * @returns {Set<string>}
+ */
+function collectReachedInterfaces(tree) {
+  const out = new Set();
+  // AC ownerRefs.
+  for (const us of tree.userStories ?? []) {
+    const acs = Array.isArray(us.acceptanceCriteria) ? us.acceptanceCriteria : [];
+    for (const ac of acs) {
+      if (!acHasOwnerRef(ac)) continue;
+      const ref = /** @type {any} */ (ac).ownerRef;
+      const name = parseOwnerRefInterfaceField(ref?.field);
+      if (!name || typeof ref?.tacId !== 'string') continue;
+      out.add(`${ref.tacId}:${name}`);
+    }
+  }
+  // REQ deliveredBy (optional field; shapes above).
+  for (const req of tree.requirements ?? []) {
+    const deliveredBy = /** @type {any} */ (req)?.deliveredBy;
+    if (!Array.isArray(deliveredBy)) continue;
+    for (const entry of deliveredBy) {
+      if (typeof entry !== 'string' || entry.length === 0) continue;
+      const m = entry.match(/^(TAC-[A-Za-z0-9-]+):(.+)$/);
+      if (m) {
+        out.add(`${m[1]}:${m[2]}`);
+        continue;
+      }
+      // Plain TAC id: every interface on that TAC is reached.
+      const tac = (tree.tacs ?? []).find((t) => t?.tacId === entry);
+      if (!tac) continue;
+      for (const iface of tac.interfaces ?? []) {
+        if (typeof iface?.name === 'string') out.add(`${tac.tacId}:${iface.name}`);
+      }
+    }
+  }
+  return out;
+}
+
 // ---------------------------------------------------------------------------
 // D7 -- Decisions and review (blocking in 0.29.0).
 // ---------------------------------------------------------------------------