rcf-lite 0.29.0 → 0.31.0

package/src/query/gates.js

@@ -46,6 +46,7 @@
 import { computeQueue } from '../build/queue.js';
 import { isOptedOut } from '../req-baseline/opt-out.js';
 import { BRIEF_KINDS, parseResolvedBy } from '../define/ledgers.js';
+import { applicableConcernsForShapes } from '../define/concern-catalogue.js';
 
 /** Canonical stage order (proposal §3.2). */
 export const STAGE_ORDER = /** @type {const} */ (['D1', 'D2', 'D3', 'D4', 'D5', 'D6', 'D7', 'D8']);
@@ -113,26 +114,37 @@ export const CHECK_PERSONA = /** @type {const} */ ({
   'brief:kinds': 'productOwner',
   'brief:openQuestions': 'productOwner',
   'brief:profile': 'productOwner',
-  // D2 Skeleton: resolvedBy + reqIntent are PO; reqShape, tadPersistence, deployAdr are engineer.
+  // D2 Skeleton: resolvedBy + reqIntent are PO; reqShape, tadPersistence, deployAdr, standardsCited are engineer.
   'skeleton:resolvedBy': 'productOwner',
   'skeleton:reqIntent': 'productOwner',
   'skeleton:reqShape': 'engineer',
   'skeleton:tadPersistence': 'engineer',
   'skeleton:deployAdr': 'engineer',
+  'skeleton:standardsCited': 'engineer',
   // D3 Shapes: every check is engineer (shapes are the engineer's first act after hand-over).
   'shapes:tacHasInterface': 'engineer',
   'shapes:kindVocabulary': 'engineer',
   'shapes:draftSettled': 'engineer',
-  // D4 Stories: reqHasUs is PO ("what does someone do with this?"); the floors are engineer.
+  'shapes:templateMarkers': 'engineer',
+  'shapes:entityJoin': 'engineer',
+  'shapes:pathsResolve': 'engineer',
+  // D4 Stories: reqHasUs is PO ("what does someone do with this?"); the floors, closed sets and ownerRef resolution are engineer.
   'stories:reqHasUs': 'productOwner',
   'stories:usFloors': 'engineer',
-  // D5 Crosscut: TAD + concern-ledger content is engineering.
+  'stories:closedSets': 'engineer',
+  'stories:ownerRefResolves': 'engineer',
+  // D5 Crosscut: TAD + concern-ledger content and the catalogue walk are engineering.
   'crosscut:securityArchitecture': 'engineer',
   'crosscut:operationalConcerns': 'engineer',
   'crosscut:concernsResolved': 'engineer',
-  // D6 Consistency: schema validity and probes are engineer.
+  'crosscut:catalogue': 'engineer',
+  // D6 Consistency: schema validity, probes and the four scans are engineer.
   'consistency:validateClean': 'engineer',
   'consistency:probeCount': 'engineer',
+  'consistency:contradictions': 'engineer',
+  'consistency:unsatisfiable': 'engineer',
+  'consistency:duplicates': 'engineer',
+  'consistency:orphanInterfaces': 'engineer',
   // D7 Decisions: enumeration is PO (the PO answers or lets the default stand);
   // zero-open is the engineer's hand-over condition.
   'decisions:wellFormed': 'productOwner',
@@ -161,16 +173,27 @@ export const CHECK_QUESTION = /** @type {const} */ ({
   'skeleton:reqShape': 'Every requirement in scope carries a shape classification.',
   'skeleton:tadPersistence': 'TAD data architecture lists dataStores and coreEntities for persistence REQs.',
   'skeleton:deployAdr': 'Exactly one Deploy target or Deploy deferral ADR exists.',
+  'skeleton:standardsCited': 'Every registered standards pack is cited, applied or waived.',
   'shapes:tacHasInterface': 'Every TAC in scope has at least one interface.',
   'shapes:kindVocabulary': 'Every interface kind is in the closed vocabulary.',
   'shapes:draftSettled': 'Every draft interface has been settled (the [draft] marker is removed).',
+  'shapes:templateMarkers': 'Every interface description carries the per-kind markers (recordShape fields:, httpRoute method/path/request/response/errors, and so on).',
+  'shapes:entityJoin': 'Every core entity is named by exactly one recordShape.',
+  'shapes:pathsResolve': 'Every path: token in an interface description resolves on disk or the description is authoredAt D3.',
   'stories:reqHasUs': 'What does someone do with this requirement?',
   'stories:usFloors': 'Every story in scope meets the class, tacIds and testability floors.',
+  'stories:closedSets': 'Every acceptance criterion that invites a set of values names the set or points to an owner.',
+  'stories:ownerRefResolves': 'Every ownerRef on an acceptance criterion resolves to an interface on the owning TAC.',
   'crosscut:securityArchitecture': 'TAD.securityArchitecture is present when an auth or httpApi REQ exists.',
   'crosscut:operationalConcerns': 'TAD.operationalConcerns is present when a deployed-scope AC exists.',
   'crosscut:concernsResolved': 'Every concern-ledger entry on a REQ in scope is applied or waived.',
+  'crosscut:catalogue': 'Every applicable crosscut concern for a REQ in scope has a concern-ledger entry applied or waived.',
   'consistency:validateClean': 'Validate is clean tree-wide.',
   'consistency:probeCount': 'Zero open probe-ledger entries.',
+  'consistency:contradictions': 'No two acceptance criteria on one story share a when clause with a negated then.',
+  'consistency:unsatisfiable': 'Every then names a field some recordShape defines.',
+  'consistency:duplicates': 'No two acceptance criteria across stories share an identical description.',
+  'consistency:orphanInterfaces': 'Every interface is reached by an AC ownerRef or a REQ deliveredBy.',
   'decisions:wellFormed': 'Every decision is enumerated (question, two or more options, a default).',
   'decisions:allAnswered': 'Zero decisions are open.',
   'freeze:priorGates': 'Every prior stage passed or is acknowledged at the current hash.',
@@ -280,6 +303,146 @@ export function parseCoreEntityDraft(entity) {
   return hasDraftMarker(/** @type {any} */ (entity).description);
 }
 
+/**
+ * Per-kind required marker tokens on `interfaces[].description` for
+ * the `shapes:templateMarkers` D3 bite check (ADR-4131, spec section 4
+ * row "D3 template parser"). A marker is "present" when a line of the
+ * description matches the marker's own regex: a `<name>:` prefix for
+ * `fields:`, `instances:`, `payload:`, `usage:` and `format:`; a
+ * `method`, `path`, `request`, `response`, `errors` or `protocol`
+ * token on an httpRoute, uiRoute or port (word-bounded, case-sensitive,
+ * tolerating a trailing colon or whitespace); `other` requires a
+ * non-empty description after the optional `[draft]` prefix (its
+ * "note"). The regexes are deliberately permissive so a plain
+ * `method: POST` and a bullet list `- method: POST` both qualify, and
+ * so a `[draft]` prefix never masks the marker scan.
+ */
+const INTERFACE_TEMPLATE_MARKERS = /** @type {const} */ ({
+  recordShape: [{ name: 'fields', re: /(^|\n)\s*(?:[-*]\s*)?fields\s*:/ }],
+  httpRoute: [
+    { name: 'method', re: /(^|\n|\s)method\s*[:=]/ },
+    { name: 'path', re: /(^|\n|\s)path\s*[:=]/ },
+    { name: 'request', re: /(^|\n|\s)request\s*[:=]/ },
+    { name: 'response', re: /(^|\n|\s)response\s*[:=]/ },
+    { name: 'errors', re: /(^|\n|\s)errors\s*[:=]/ },
+  ],
+  fixture: [{ name: 'instances', re: /(^|\n)\s*(?:[-*]\s*)?instances\s*:/ }],
+  event: [{ name: 'payload', re: /(^|\n)\s*(?:[-*]\s*)?payload\s*:/ }],
+  cliCommand: [{ name: 'usage', re: /(^|\n)\s*(?:[-*]\s*)?usage\s*:/ }],
+  uiRoute: [{ name: 'path', re: /(^|\n|\s)path\s*[:=]/ }],
+  port: [{ name: 'protocol', re: /(^|\n|\s)protocol\s*[:=]/ }],
+  fileFormat: [{ name: 'format', re: /(^|\n)\s*(?:[-*]\s*)?format\s*:/ }],
+  other: [],
+});
+
+/**
+ * Strip a leading `[draft]` marker from a description so the marker
+ * scan sees the real text underneath. Pure.
+ *
+ * @param {string} desc
+ * @returns {string}
+ */
+function stripDraftPrefix(desc) {
+  return desc.replace(/^\s*\[draft\]\s*/, '');
+}
+
+/**
+ * ADR-4131 (0.30.0 PR 5): per-kind marker presence on an interface.
+ * Returns `{ kind, missing: string[] }` naming the markers that are
+ * absent from `iface.description`. For `other` the "note" is any
+ * non-empty description after the optional `[draft]` prefix. For an
+ * interface whose kind is outside INTERFACE_KINDS the function returns
+ * `{ kind, missing: [] }` so the caller can treat vocabulary errors
+ * through `shapes:kindVocabulary` alone.
+ *
+ * @param {unknown} iface
+ * @returns {{ kind: string|null, missing: string[] }}
+ */
+export function parseInterfaceTemplate(iface) {
+  if (!iface || typeof iface !== 'object') return { kind: null, missing: [] };
+  const kind = typeof (/** @type {any} */ (iface).kind) === 'string' ? /** @type {any} */ (iface).kind : null;
+  const descRaw = typeof (/** @type {any} */ (iface).description) === 'string'
+    ? /** @type {any} */ (iface).description
+    : '';
+  const desc = stripDraftPrefix(descRaw);
+  if (kind === 'other') {
+    const note = desc.trim();
+    return { kind, missing: note.length === 0 ? ['note'] : [] };
+  }
+  const markers = /** @type {any} */ (INTERFACE_TEMPLATE_MARKERS)[kind];
+  if (!Array.isArray(markers)) return { kind, missing: [] };
+  const missing = [];
+  for (const marker of markers) {
+    if (!marker.re.test(desc)) missing.push(marker.name);
+  }
+  return { kind, missing };
+}
+
+/**
+ * Known bare repo filenames the slash-or-extension rule would otherwise
+ * silently skip (ruling R6 2026-10-05). A `path: Dockerfile` on an
+ * interface description names a real file at the repo root, so the
+ * `shapes:pathsResolve` check should see it. Exported so the tests can
+ * assert the list verbatim; a bare word outside this set still fails
+ * the slash-or-extension rule as before.
+ */
+export const BARE_PATH_WHITELIST = /** @type {const} */ ([
+  'Dockerfile',
+  'Containerfile',
+  'Makefile',
+  'LICENSE',
+  'Procfile',
+  'Justfile',
+  'Rakefile',
+  'Gemfile',
+  'CODEOWNERS',
+]);
+const BARE_PATH_WHITELIST_SET = new Set(BARE_PATH_WHITELIST);
+
+/**
+ * Rough `path:` token scanner for an interface description. Returns
+ * every candidate path token the description names so the CLI can
+ * resolve them on disk and the gate can decide `shapes:pathsResolve`
+ * against the resolved map (ADR-4131). A candidate is any text that
+ * follows a `path:` or `path =` marker and looks like a repo-relative
+ * path (contains a `/` or ends with a file extension, or is one of the
+ * known bare repo names in BARE_PATH_WHITELIST per ruling R6
+ * 2026-10-05, no scheme). The scanner is deliberately conservative: an
+ * http URL, a bare word outside the whitelist, a glob or a template
+ * placeholder is not a candidate. Exported for the CLI's resolve-on-disk
+ * pass.
+ *
+ * @param {string} description
+ * @returns {string[]}
+ */
+export function extractInterfacePathTokens(description) {
+  if (typeof description !== 'string' || description.length === 0) return [];
+  const text = stripDraftPrefix(description);
+  const out = [];
+  const re = /\bpath\s*[:=]\s*["'`]?([^\s"'`,;)\]]+)/g;
+  let m;
+  while ((m = re.exec(text)) !== null) {
+    const token = m[1];
+    if (!token) continue;
+    if (/^[a-z]+:\/\//i.test(token)) continue;
+    if (token.startsWith('{') || token.startsWith('<') || token.includes('*')) continue;
+    // Skip HTTP / UI route-ish tokens: a leading slash with no file
+    // extension is a route path (an httpRoute or uiRoute's `path:`
+    // marker), not a repo path. A legitimate file path lands as
+    // `src/x.js` or `packages/rcf-lite/CHANGELOG.md`; those don't
+    // start with `/`.
+    if (token.startsWith('/') && !/\.[a-zA-Z0-9]+$/.test(token)) continue;
+    // Ruling R6 2026-10-05: whitelist the usual bare repo names.
+    if (BARE_PATH_WHITELIST_SET.has(token)) {
+      out.push(token);
+      continue;
+    }
+    if (!/\//.test(token) && !/\.[a-zA-Z0-9]+$/.test(token)) continue;
+    out.push(token);
+  }
+  return out;
+}
+
 /** Warn-with-ack stages in 0.29.0 (ADR-4122). */
 const WARN_WITH_ACK = new Set(['D3', 'D5', 'D6']);
 
@@ -297,6 +460,23 @@ export function stagePolicy(stage) {
   return WARN_WITH_ACK.has(stage) ? 'warnWithAck' : 'blocking';
 }
 
+/**
+ * ADR-4131 (0.30.0 PR 5): the three gates that accept a recorded
+ * `--ack` override. `stagePolicy(stage)` returns `warnWithAck` for
+ * D3/D5/D6 and `blocking` for everything else (ruling R4 2026-10-05
+ * retired the pre-R4 wording that said `stagePolicy` kept returning
+ * `blocking` for every stage); `ackable(stage)` is the companion
+ * signal the readiness and freeze CLIs read to decide whether a
+ * failing stage honours an acknowledgement at the current hash. True
+ * for D3, D5 and D6; false for everything else.
+ *
+ * @param {string} stage
+ * @returns {boolean}
+ */
+export function ackable(stage) {
+  return WARN_WITH_ACK.has(stage);
+}
+
 /**
  * Scaffold TODO placeholder marker: uppercase "TODO" followed by a
  * colon, matching every scaffold string `rcf init` and `rcf define
@@ -313,6 +493,192 @@ const TODO_RE = /\bTODO:/;
 /** Bracketed AC-class prefix (Baz decision 6, proposal §3.2 D4). */
 const AC_CLASS_RE = /^\[(happy|edge|failure|must-not|non-functional)\]/;
 
+/**
+ * Enumeration cues for `stories:closedSets` (spec section 4 row 'D4
+ * closed-set and ownerRef as findings', 0.30.0 PR 6). An AC description
+ * that contains any of these cues outside a quoted string, with no
+ * inline bracketed list or ownerRef, invites an unlisted value and
+ * fails the check. The cues are matched case-insensitively against the
+ * raw description (minus any leading [class] marker and any
+ * double-quoted substrings).
+ */
+const CLOSED_SET_CUES = Object.freeze([
+  'one of',
+  'any of',
+  'the following',
+  'types of',
+  'status is',
+]);
+// Word-boundary matchers for each cue so a longer word that happens
+// to contain the cue as a substring (e.g. "status issue" containing
+// "status is") does not trip the gate.
+const CLOSED_SET_CUE_RES = Object.freeze(
+  CLOSED_SET_CUES.map((cue) => new RegExp(`\\b${cue.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&')}\\b`, 'i')),
+);
+
+/**
+ * Inline bracketed list regex for the closed-sets check: a square-
+ * bracketed group whose contents look like a list of two or more
+ * tokens separated by commas, slashes or pipes. A bare `[happy]`
+ * class marker is NOT a list (one token, no separator); `[a, b]`,
+ * `[a | b | c]` and `[a/b]` are.
+ */
+const INLINE_LIST_RE = /\[[^\]\n]*[,|\/][^\]\n]*\]/;
+
+/**
+ * ownerRef marker: a cheap presence check for the structured
+ * `{ tacId, field: "interfaces[<name>]" }` pointer. True when the AC
+ * carries an ownerRef object (consistency-lint and PR 6 both read the
+ * same field).
+ *
+ * @param {unknown} ac
+ * @returns {boolean}
+ */
+function acHasOwnerRef(ac) {
+  const ref = ac && typeof ac === 'object' ? /** @type {any} */ (ac).ownerRef : null;
+  if (!ref || typeof ref !== 'object') return false;
+  // R11 (spec section 17, 2026-10-03): an ownerRef may name a TAC
+  // (via tacId) OR an ADR (via adrId). Pre-R11 code only recognised
+  // tacId; the ADR branch was dropped silently.
+  return typeof ref.tacId === 'string' || typeof ref.adrId === 'string';
+}
+
+/**
+ * Strip double-quoted substrings so a quoted cue inside the AC text
+ * does not fire the closed-sets check (shared with D6's negation guard
+ * convention). Matches `"..."` with no embedded unescaped double
+ * quote; the regex is deliberately permissive. The strip is only for
+ * the cue scan; the inline-list scan reads the full description.
+ *
+ * @param {string} desc
+ * @returns {string}
+ */
+function stripQuotedSubstrings(desc) {
+  return desc.replace(/"[^"\n]*"/g, '');
+}
+
+/**
+ * True when the AC description carries an enumeration cue outside a
+ * quoted substring, with no inline bracketed list and no ownerRef
+ * pointer. Pure.
+ *
+ * @param {unknown} ac
+ * @returns {boolean}
+ */
+function failsClosedSets(ac) {
+  const descRaw = ac && typeof ac === 'object' ? /** @type {any} */ (ac).description : null;
+  if (typeof descRaw !== 'string' || descRaw.length === 0) return false;
+  if (acHasOwnerRef(ac)) return false;
+  const descNoClass = descRaw.replace(AC_CLASS_RE, '').trim();
+  if (INLINE_LIST_RE.test(descNoClass)) return false;
+  const descForCues = stripQuotedSubstrings(descNoClass);
+  for (const re of CLOSED_SET_CUE_RES) {
+    if (re.test(descForCues)) return true;
+  }
+  return false;
+}
+
+/**
+ * Parse an `interfaces[<name>]` field pointer into its interface
+ * name. Accepts any non-empty name between the brackets (interface
+ * names routinely carry dots, slashes and spaces); returns null for
+ * an unparseable pointer.
+ *
+ * @param {unknown} field
+ * @returns {string | null}
+ */
+function parseOwnerRefInterfaceField(field) {
+  if (typeof field !== 'string') return null;
+  const m = field.match(/^interfaces\[([^\]\n]+)\]$/);
+  return m ? m[1] : null;
+}
+
+/**
+ * R11 field grammar (spec section 17, 2026-10-03). An `ownerRef` or
+ * object-form `deliveredBy` `{ tacId | adrId, field }` resolves when
+ * `field` names an existing field path on the owning document in
+ * bracket grammar:
+ *
+ *   - `interfaces[<name>]` resolves when `doc.interfaces[].name` matches.
+ *   - `responsibilities[<n>]` resolves when `doc.responsibilities[n]`
+ *     exists (non-negative integer index, zero-based).
+ *   - `dependencies[<name>]` resolves when `doc.dependencies[].name` matches.
+ *   - `alternativesConsidered[<n>]` resolves when the ADR has an
+ *     alternative at that index.
+ *   - A bare schema field name (`purpose`, `internalStructure`,
+ *     `decision`, `name`, `context`, `consequences`, `tradeoffs`,
+ *     `notes`, `description`, `responsibilities`, `dependencies`,
+ *     `interfaces`, `alternativesConsidered`) resolves when the
+ *     document carries a non-empty value under that key.
+ *
+ * Dotted grammar (`interfaces.name`, `responsibilities.foo`) is NOT
+ * accepted: callers of the R11 widening MUST rewrite to bracket
+ * grammar first. A path that does not match any arm returns false.
+ *
+ * `AC-17405-2` is unchanged in effect: `interfaces[loan]` on a TAC
+ * carrying an interface named `loan` resolves; `interfaces[missing]`
+ * fails.
+ *
+ * @param {unknown} doc - the owning TAC or ADR document.
+ * @param {unknown} field - the ownerRef/deliveredBy field string.
+ * @returns {boolean}
+ */
+export function resolveOwnerRefField(doc, field) {
+  if (!doc || typeof doc !== 'object') return false;
+  if (typeof field !== 'string' || field.length === 0) return false;
+  const d = /** @type {any} */ (doc);
+  // interfaces[<name>] -- preserved from the 0.29.0 helper.
+  const ifaceMatch = field.match(/^interfaces\[([^\]\n]+)\]$/);
+  if (ifaceMatch) {
+    const name = ifaceMatch[1];
+    return Array.isArray(d.interfaces)
+      && d.interfaces.some((iface) => iface && typeof iface === 'object' && iface.name === name);
+  }
+  // dependencies[<name>] (TAC.dependencies[].name).
+  const depMatch = field.match(/^dependencies\[([^\]\n]+)\]$/);
+  if (depMatch) {
+    const name = depMatch[1];
+    return Array.isArray(d.dependencies)
+      && d.dependencies.some((dep) => dep && typeof dep === 'object' && dep.name === name);
+  }
+  // responsibilities[<n>] (zero-based integer index on the strings array).
+  const respMatch = field.match(/^responsibilities\[(\d+)\]$/);
+  if (respMatch) {
+    const idx = Number(respMatch[1]);
+    return Array.isArray(d.responsibilities) && idx < d.responsibilities.length
+      && typeof d.responsibilities[idx] === 'string'
+      && d.responsibilities[idx].length > 0;
+  }
+  // alternativesConsidered[<n>] (ADR).
+  const altMatch = field.match(/^alternativesConsidered\[(\d+)\]$/);
+  if (altMatch) {
+    const idx = Number(altMatch[1]);
+    return Array.isArray(d.alternativesConsidered) && idx < d.alternativesConsidered.length
+      && d.alternativesConsidered[idx] && typeof d.alternativesConsidered[idx] === 'object';
+  }
+  // Bare schema field name. Must be in the TAC/ADR schema and present
+  // and non-empty on the document. The accepted set covers the schema
+  // fields the spec names and the extras TAC/ADR carry; a field name
+  // outside the set returns false.
+  const BARE_FIELDS = new Set([
+    // TAC fields.
+    'purpose', 'internalStructure', 'tradeoffs', 'notes', 'name',
+    'responsibilities', 'interfaces', 'dependencies',
+    // ADR fields.
+    'decision', 'context', 'consequences', 'title',
+    'alternativesConsidered',
+    // Common.
+    'description',
+  ]);
+  if (!BARE_FIELDS.has(field)) return false;
+  const v = d[field];
+  if (v == null) return false;
+  if (typeof v === 'string') return v.length > 0;
+  if (Array.isArray(v)) return v.length > 0;
+  if (typeof v === 'object') return Object.keys(v).length > 0;
+  return true;
+}
+
 /**
  * Parse the leading bracketed class marker on `ac.description`.
  * Returns the class token, or null when no marker is present.
@@ -417,6 +783,43 @@ function asSet(scope) {
   return scope instanceof Set ? scope : new Set(scope ?? []);
 }
 
+/**
+ * ADR-4138 (DEFINE step 3 rulings R2, R5, R7 2026-10-05 and ruling R13
+ * 2026-10-05 PR 292 follow-up): run every tree-wide check for a stage
+ * and either return a stage envelope carrying only the tree-wide
+ * findings (plus the scope placeholder) folded through `foldState`, or
+ * null when every tree-wide check passed, letting the stage proceed to
+ * its own scope early-return or full checks list.
+ *
+ * The helper governs every tree-wide check: `shapes:draftSettled`
+ * (R2), `shapes:entityJoin` (R5), `skeleton:standardsCited` (R7),
+ * `skeleton:deployAdr` (R13), `crosscut:securityArchitecture` (R13)
+ * and `crosscut:operationalConcerns` (R13). Delta-only checks
+ * (templateMarkers, pathsResolve, closedSets, ownerRefResolves) are
+ * untouched: they stay on the stage's own full-checks path. The
+ * ack-at-current-hash fold is delegated to `foldState` so one
+ * implementation owns the acknowledgement rule and the failing
+ * envelope carries no stale `notApplicable` reason text (the pre-R13
+ * copy of the stage's notApplicable message misled the readiness CLI
+ * print line, which reads `stage.reason` on every state).
+ *
+ * @param {string} stage
+ * @param {string} gate
+ * @param {Array<{name: string, check: object}>} treeWideChecks
+ * @param {object} freezeCtx
+ * @returns {{ stage: string, gate: string, state: 'failing' | 'acknowledged', checks: object[] } | null}
+ */
+function treeWideFailureEnvelope(stage, gate, treeWideChecks, freezeCtx) {
+  const anyFailing = treeWideChecks.some(({ check }) => !check.ok);
+  if (!anyFailing) return null;
+  const checks = [makeCheck(`stage:${stage}:scope`, 'delta', 0, [])];
+  for (const { check } of treeWideChecks) checks.push(check);
+  // Delegate to foldState: it owns the warn-with-ack fold rule
+  // (ADR-4122). The returned envelope carries { state: 'failing' } or
+  // { state: 'acknowledged' } and no reason field.
+  return foldState(stage, gate, checks, freezeCtx);
+}
+
 // ---------------------------------------------------------------------------
 // D1 -- Brief intake and ledger (blocking in 0.29.0).
 // ---------------------------------------------------------------------------
@@ -435,6 +838,11 @@ function asSet(scope) {
  * @property {{ skipReviewFor?: string } | undefined} profile  parsed profile switches (light shape)
  * @property {string | null | undefined} currentTreeHash  for warn-with-ack acknowledgement match
  * @property {Array<{ state: string }> | undefined} priorStages  D8 reads earlier stage states from this
+ * @property {Set<string> | undefined} resolvedPaths  ADR-4131 (0.30.0 PR 5): set of repo-relative paths the CLI
+ *   already resolved on disk; `shapes:pathsResolve` reads this to decide
+ *   whether a `path:` token on an interface description resolves. Empty or
+ *   undefined means no path is known-resolved, so every candidate token
+ *   fails unless the interface description carries `authoredAt: D3`.
  */
 
 /**
@@ -521,6 +929,81 @@ export function checkD1Brief(ctx) {
 /** Kinds whose resolution D2 checks: capability / constraint / entity / actor / externalSystem / surface. */
 const D2_RESOLVING_KINDS = new Set(['capability', 'constraint', 'entity', 'actor', 'externalSystem', 'surface']);
 
+/**
+ * Compute the `skeleton:deployAdr` check (engineer, tree-wide). Pure.
+ * Ruling R13 2026-10-05 (ADR-4138 extended, PR 292 follow-up): exactly
+ * one Deploy target or Deploy deferral ADR exists tree-wide (detected
+ * by title prefix per proposal section 11). The check runs ahead of
+ * the D2 scope early-return so a narrowed scope that excludes every
+ * REQ / PRD / TAD / brief statement still reports a missing (or
+ * doubled) Deploy ADR.
+ *
+ * @param {StageContext} ctx
+ * @returns {ReturnType<typeof makeCheck>}
+ */
+function computeDeployAdrCheck(ctx) {
+  const tree = ctx.tree;
+  const deployAdrs = (tree.adrs ?? []).filter((a) => {
+    const t = typeof a?.title === 'string' ? a.title : '';
+    return t.startsWith('Deploy target:') || t.startsWith('Deploy deferral:');
+  });
+  const deployFail = [];
+  if (deployAdrs.length === 0) deployFail.push({ id: 'ADR:deploy', why: 'no Deploy target or Deploy deferral ADR found (title-prefix scan)' });
+  else if (deployAdrs.length > 1) deployFail.push({ id: 'ADR:deploy', why: `${deployAdrs.length} Deploy ADRs found; expected exactly one` });
+  return makeCheck('skeleton:deployAdr', 'tree', 1, deployFail);
+}
+
+/**
+ * Compute the `skeleton:standardsCited` check (engineer, tree-wide).
+ * Pure. Every standards pack registered through `rcf define standards`
+ * (manifest.standards[].slug) is cited in a REQ `rationale` or an ADR,
+ * or satisfied by a concern-ledger entry keyed `standards:<pack>` whose
+ * disposition is `applied` or `waived`. Ruling R8 2026-10-05: both
+ * `applied` and `waived` satisfy the check (an `applied` entry means the
+ * pack was adopted, which is at least as strong as a citation). Ruling
+ * R7 2026-10-05: the check runs tree-wide regardless of the D2 scope
+ * early-return, through the shared ADR-4138 helper.
+ *
+ * @param {StageContext} ctx
+ * @returns {ReturnType<typeof makeCheck>}
+ */
+function computeStandardsCitedCheck(ctx) {
+  const tree = ctx.tree;
+  const standardsList = Array.isArray(tree.manifest?.standards)
+    ? /** @type {any[]} */ (tree.manifest.standards)
+    : [];
+  /** @type {Array<{ id: string, why: string }>} */
+  const standardsFail = [];
+  if (standardsList.length > 0) {
+    const reqRationales = (tree.requirements ?? [])
+      .map((r) => (typeof r?.rationale === 'string' ? r.rationale : ''))
+      .join('\n');
+    const adrDocs = (tree.adrs ?? []).map((a) => {
+      try { return JSON.stringify(a); } catch { return ''; }
+    }).join('\n');
+    const concernsBody = /** @type {any} */ (ctx.ledgers?.concerns);
+    const concernList = Array.isArray(concernsBody?.concerns) ? concernsBody.concerns : [];
+    const satisfierSlugs = new Set();
+    for (const entry of concernList) {
+      if (!entry || typeof entry.concern !== 'string') continue;
+      const disposition = typeof entry.disposition === 'string' ? entry.disposition : null;
+      // Ruling R8 2026-10-05: both applied and waived satisfy standardsCited.
+      if (disposition !== 'applied' && disposition !== 'waived') continue;
+      const m = entry.concern.match(/^standards:(.+)$/);
+      if (m) satisfierSlugs.add(m[1]);
+    }
+    for (const pack of standardsList) {
+      const slug = typeof pack?.slug === 'string' ? pack.slug : null;
+      if (!slug) continue;
+      if (satisfierSlugs.has(slug)) continue;
+      if (reqRationales.includes(slug)) continue;
+      if (adrDocs.includes(slug)) continue;
+      standardsFail.push({ id: `standards:${slug}`, why: 'uncited, unapplied and unwaived' });
+    }
+  }
+  return makeCheck('skeleton:standardsCited', 'tree', Math.max(standardsList.length, 1), standardsFail);
+}
+
 /**
  * D2 -- Requirements and architecture skeleton.
  *
@@ -539,7 +1022,25 @@ export function checkD2Skeleton(ctx) {
   const prdInScope = tree.prd && scope.has(tree.prd.prdId ?? '');
   const tadInScope = tree.tad && scope.has(tree.tad.tadId ?? '');
 
+  // Ruling R7 2026-10-05 (ADR-4138) and R13 2026-10-05 (ADR-4138
+  // extended, PR 292 follow-up): skeleton:standardsCited and
+  // skeleton:deployAdr are tree-wide checks; evaluate them before any
+  // scope early-return so a narrowed D2 scope that excludes every
+  // REQ/PRD/TAD/brief statement still reports an uncited pack or a
+  // missing Deploy ADR.
+  const standardsCheck = computeStandardsCitedCheck(ctx);
+  const deployAdrCheck = computeDeployAdrCheck(ctx);
+
   if (resolvingStmts.length === 0 && reqInScope.length === 0 && !prdInScope && !tadInScope) {
+    const treeWideFailure = treeWideFailureEnvelope(
+      'D2', gate,
+      [
+        { name: 'skeleton:standardsCited', check: standardsCheck },
+        { name: 'skeleton:deployAdr', check: deployAdrCheck },
+      ],
+      { currentTreeHash: ctx.currentTreeHash ?? null, freezeGates: /** @type {any} */ (ctx.freeze?.gates) },
+    );
+    if (treeWideFailure) return treeWideFailure;
     return notApplicable('D2', gate, 'no resolving brief statements and no REQ / PRD / TAD in scope');
   }
 
@@ -611,15 +1112,17 @@ export function checkD2Skeleton(ctx) {
   checks.push(makeCheck('skeleton:tadPersistence', 'tree', persistenceReq ? 2 : 0, tadFail));
 
   // Check 4: exactly one deploy or deferral ADR tree-wide. Cheap
-  // detection by title prefix (proposal §11 assumption).
-  const deployAdrs = (tree.adrs ?? []).filter((a) => {
-    const t = typeof a?.title === 'string' ? a.title : '';
-    return t.startsWith('Deploy target:') || t.startsWith('Deploy deferral:');
-  });
-  const deployFail = [];
-  if (deployAdrs.length === 0) deployFail.push({ id: 'ADR:deploy', why: 'no Deploy target or Deploy deferral ADR found (title-prefix scan)' });
-  else if (deployAdrs.length > 1) deployFail.push({ id: 'ADR:deploy', why: `${deployAdrs.length} Deploy ADRs found; expected exactly one` });
-  checks.push(makeCheck('skeleton:deployAdr', 'tree', 1, deployFail));
+  // detection by title prefix (proposal §11 assumption). Ruling R13
+  // 2026-10-05: tree-wide by definition; computed by
+  // computeDeployAdrCheck so the same check is reused ahead of the
+  // scope early-return (ADR-4138 extended).
+  checks.push(deployAdrCheck);
+
+  // Check 5 (0.30.0 PR 6, ruling R7+R8 2026-10-05): skeleton:standardsCited
+  // (engineer, over tree). Computed by `computeStandardsCitedCheck` so the
+  // same check runs ahead of the scope early-return (R7) and so the R8
+  // behaviour (applied | waived | cited all satisfy) lives in one place.
+  checks.push(standardsCheck);
 
   return foldState('D2', gate, checks, {
     currentTreeHash: ctx.currentTreeHash ?? null,
@@ -634,6 +1137,98 @@ export function checkD2Skeleton(ctx) {
 /** Set form of INTERFACE_KINDS for O(1) checks. */
 const INTERFACE_KINDS_SET = new Set(INTERFACE_KINDS);
 
+/**
+ * Compute the `shapes:draftSettled` check (engineer, tree-wide). Pure.
+ * Ruling R2 2026-10-05 (ADR-4138): a `[draft]` marker on any TAC
+ * purpose, any interface description or any coreEntities[].description
+ * fails the check regardless of the D3 scope's own early-return. The
+ * three id forms are `<tacId>`, `<tacId>:<name>` and `TAD.entity:<name>`.
+ *
+ * @param {StageContext} ctx
+ * @returns {ReturnType<typeof makeCheck>}
+ */
+function computeDraftSettledCheck(ctx) {
+  const tree = ctx.tree;
+  const tacs = tree.tacs ?? [];
+  const coreEntities = Array.isArray(tree.tad?.dataArchitecture?.coreEntities)
+    ? /** @type {any[]} */ (tree.tad.dataArchitecture.coreEntities)
+    : [];
+  /** @type {Array<{ id: string, why: string }>} */
+  const draftFindings = [];
+  let totalInterfaces = 0;
+  for (const tac of tacs) {
+    if (parseTacPurposeDraft(tac)) {
+      draftFindings.push({ id: tac.tacId, why: 'draft TAC purpose pre-populated at L1, not yet settled' });
+    }
+    for (const iface of tac.interfaces ?? []) {
+      totalInterfaces += 1;
+      if (parseInterfaceDraft(iface)) {
+        draftFindings.push({ id: `${tac.tacId}:${iface?.name ?? '(unnamed)'}`, why: 'draft interface pre-populated at L1, not yet settled' });
+      }
+    }
+  }
+  for (const entity of coreEntities) {
+    if (parseCoreEntityDraft(entity)) {
+      draftFindings.push({ id: `TAD.entity:${entity?.name ?? '(unnamed)'}`, why: 'draft core entity pre-populated at L1, not yet settled' });
+    }
+  }
+  const totalDraftHomes = tacs.length + totalInterfaces + coreEntities.length;
+  return makeCheck('shapes:draftSettled', 'tree', Math.max(totalDraftHomes, 1), draftFindings);
+}
+
+/**
+ * Compute the `shapes:entityJoin` check (engineer, tree-wide). Pure.
+ * Ruling R5 2026-10-05 (ADR-4138): every entry in
+ * `TAD.dataArchitecture.coreEntities` must be named by exactly one
+ * `recordShape` across the whole tree (matching on the recordShape's
+ * `name` field or an `entity:` line in its description, with a
+ * `[draft]` prefix stripped before the scan). The check runs ahead of
+ * the D3 scope early-return so a narrowed scope that excludes every
+ * recordShape still reports an unjoined entity.
+ *
+ * @param {StageContext} ctx
+ * @returns {ReturnType<typeof makeCheck>}
+ */
+function computeEntityJoinCheck(ctx) {
+  const tree = ctx.tree;
+  const coreEntities = Array.isArray(tree.tad?.dataArchitecture?.coreEntities)
+    ? /** @type {any[]} */ (tree.tad.dataArchitecture.coreEntities)
+    : [];
+  /** @type {Array<{ id: string, why: string }>} */
+  const joinFindings = [];
+  const recordShapesByEntity = new Map();
+  for (const tac of tree.tacs ?? []) {
+    for (const iface of tac.interfaces ?? []) {
+      if (iface?.kind !== 'recordShape') continue;
+      const ownerLabel = `${tac.tacId}:${iface?.name ?? '(unnamed)'}`;
+      const names = new Set();
+      if (typeof iface?.name === 'string') names.add(iface.name);
+      const desc = typeof iface?.description === 'string' ? stripDraftPrefix(iface.description) : '';
+      const entityRe = /(^|\n)\s*(?:[-*]\s*)?entity\s*[:=]\s*["'`]?([A-Za-z_][A-Za-z0-9_]*)/g;
+      let em;
+      while ((em = entityRe.exec(desc)) !== null) {
+        if (em[2]) names.add(em[2]);
+      }
+      for (const name of names) {
+        const owners = recordShapesByEntity.get(name) ?? [];
+        owners.push(ownerLabel);
+        recordShapesByEntity.set(name, owners);
+      }
+    }
+  }
+  for (const entity of coreEntities) {
+    const name = typeof entity?.name === 'string' ? entity.name : null;
+    if (!name) continue;
+    const owners = recordShapesByEntity.get(name) ?? [];
+    if (owners.length === 0) {
+      joinFindings.push({ id: `TAD.entity:${name}`, why: 'no record shape' });
+    } else if (owners.length > 1) {
+      joinFindings.push({ id: `TAD.entity:${name}`, why: `${owners.length} record shapes` });
+    }
+  }
+  return makeCheck('shapes:entityJoin', 'tree', coreEntities.length, joinFindings);
+}
+
 /**
  * D3 -- Interface contracts and shapes. 0.29.0 runs the cheap
  * presence, closed-vocabulary and draft-marker checks
@@ -670,10 +1265,30 @@ export function checkD3Shapes(ctx) {
   const coreEntities = Array.isArray(tree.tad?.dataArchitecture?.coreEntities)
     ? /** @type {any[]} */ (tree.tad.dataArchitecture.coreEntities)
     : [];
-  const draftEntities = coreEntities.filter(parseCoreEntityDraft);
 
-  if (tacsInScope.length === 0 && shapedReqInScope.length === 0 && draftEntities.length === 0) {
-    return notApplicable('D3', gate, 'no TAC, no shaped REQ (httpApi/persistence/auth) and no [draft] core entity in scope');
+  // Ruling R2+R5 2026-10-05 (ADR-4138): shapes:draftSettled and
+  // shapes:entityJoin are tree-wide checks; evaluate them before any
+  // scope early-return so a narrowed D3 scope that excludes every TAC
+  // and shaped REQ still reports a [draft] anywhere in the tree and an
+  // unjoined core entity.
+  const draftCheck = computeDraftSettledCheck(ctx);
+  const entityJoinCheck = computeEntityJoinCheck(ctx);
+
+  if (tacsInScope.length === 0 && shapedReqInScope.length === 0) {
+    const treeWideFailure = treeWideFailureEnvelope(
+      'D3', gate,
+      [
+        { name: 'shapes:draftSettled', check: draftCheck },
+        { name: 'shapes:entityJoin', check: entityJoinCheck },
+      ],
+      { currentTreeHash: ctx.currentTreeHash ?? null, freezeGates: /** @type {any} */ (ctx.freeze?.gates) },
+    );
+    if (treeWideFailure) return treeWideFailure;
+    // Ruling R2 2026-10-05: `[draft]` is tree-wide (not a D3 scope
+    // input), so the pre-R2 reason trailer "and no [draft] core entity
+    // in scope" was stale -- the applicability condition is just the
+    // two local-scope sets.
+    return notApplicable('D3', gate, 'no TAC and no shaped REQ (httpApi/persistence/auth) in scope');
   }
 
   const checks = [];
@@ -687,40 +1302,90 @@ export function checkD3Shapes(ctx) {
     noIfaceTacs.map((t) => ({ id: t.tacId, why: 'no interfaces authored' })),
   ));
 
-  // Check 2: every interface kind is in the closed vocabulary.
-  // Check 3: no description across the three draft homes still
-  // carries the `[draft]` marker. A draft shape is entry material
-  // the agent pre-populates after L1; the engineer removes the
-  // marker when the shape is settled. `tacHasInterface` and
-  // `kindVocabulary` apply equally to drafts.
+  // Check 2: every interface kind is in the closed vocabulary (over
+  // delta; drafts included).
   let totalInterfaces = 0;
   const badKinds = [];
-  const draftFindings = [];
   for (const tac of tacsInScope) {
-    if (parseTacPurposeDraft(tac)) {
-      draftFindings.push({ id: tac.tacId, why: 'draft TAC purpose pre-populated at L1, not yet settled' });
-    }
     for (const iface of tac.interfaces ?? []) {
       totalInterfaces += 1;
       const kind = iface?.kind;
       if (typeof kind !== 'string' || !INTERFACE_KINDS_SET.has(kind)) {
         badKinds.push({ id: `${tac.tacId}:${iface?.name ?? '(unnamed)'}`, why: `unknown interface kind ${JSON.stringify(kind)}` });
       }
-      if (parseInterfaceDraft(iface)) {
-        draftFindings.push({ id: `${tac.tacId}:${iface?.name ?? '(unnamed)'}`, why: 'draft interface pre-populated at L1, not yet settled' });
+    }
+  }
+  checks.push(makeCheck('shapes:kindVocabulary', 'delta', totalInterfaces, badKinds));
+
+  // Check 3: shapes:draftSettled. Ruling R2 2026-10-05: tree-wide (a
+  // [draft] anywhere is unfinished work). Computed by
+  // computeDraftSettledCheck so the same check is reused ahead of the
+  // scope early-return.
+  checks.push(draftCheck);
+
+  // ADR-4131 (0.30.0 PR 5): three D3 bite checks follow.
+  // Check 4: shapes:templateMarkers (engineer, over delta). For every
+  // interface on an in-scope TAC, parseInterfaceTemplate reports which
+  // per-kind markers are missing from the description; a draft marker
+  // is stripped before the scan so a [draft] recordShape without
+  // `fields:` fails exactly as a settled one. An interface whose kind
+  // is outside INTERFACE_KINDS is left to shapes:kindVocabulary (the
+  // marker map returns `{missing: []}` for an unknown kind so this
+  // check does not double-report the vocabulary miss).
+  /** @type {Array<{ id: string, why: string }>} */
+  const templateFindings = [];
+  for (const tac of tacsInScope) {
+    for (const iface of tac.interfaces ?? []) {
+      const result = parseInterfaceTemplate(iface);
+      if (!result.kind) continue;
+      for (const marker of result.missing) {
+        templateFindings.push({
+          id: `${tac.tacId}:${iface?.name ?? '(unnamed)'}`,
+          why: `missing marker ${marker}`,
+        });
       }
     }
   }
-  for (const entity of draftEntities) {
-    draftFindings.push({ id: `TAD.entity:${entity?.name ?? '(unnamed)'}`, why: 'draft core entity pre-populated at L1, not yet settled' });
+  checks.push(makeCheck('shapes:templateMarkers', 'delta', totalInterfaces, templateFindings));
+
+  // Check 5: shapes:entityJoin. Ruling R5 2026-10-05: tree-wide by
+  // definition. Computed by computeEntityJoinCheck so the same check
+  // is reused ahead of the scope early-return (ADR-4138).
+  checks.push(entityJoinCheck);
+
+  // Check 6: shapes:pathsResolve (engineer, over delta). Any path:
+  // token on an in-scope interface description must either resolve
+  // against `resolvedPaths` (the CLI's on-disk pass) or the
+  // description must carry an `authoredAt: D3` marker (the engineer
+  // owns the path even when the file is yet to land). The marker is
+  // a token in the description text (`authoredAt: D3` or
+  // `authoredAt = D3`), not a separate schema field; the TAC schema
+  // keeps interfaces to { name, kind, description }. Over delta,
+  // one failing entry per unresolved (tacId:name, path) pair.
+  const resolvedPaths = ctx.resolvedPaths instanceof Set ? ctx.resolvedPaths : new Set();
+  /** @type {Array<{ id: string, why: string }>} */
+  const pathFindings = [];
+  let totalPathChecks = 0;
+  for (const tac of tacsInScope) {
+    for (const iface of tac.interfaces ?? []) {
+      const desc = typeof iface?.description === 'string' ? iface.description : '';
+      const tokens = extractInterfacePathTokens(desc);
+      if (tokens.length === 0) continue;
+      const authoredAtD3 = /\bauthoredAt\s*[:=]\s*["'`]?D3\b/.test(stripDraftPrefix(desc));
+      for (const token of tokens) {
+        totalPathChecks += 1;
+        if (authoredAtD3) continue;
+        if (resolvedPaths.has(token)) continue;
+        pathFindings.push({
+          id: `${tac.tacId}:${iface?.name ?? '(unnamed)'}`,
+          why: `path does not resolve: ${token}`,
+        });
+      }
+    }
   }
-  // Total for the draft check is every draft home that could carry
-  // the marker on an in-scope TAC plus every core entity (tree-wide):
-  // the TAC itself (its purpose) + every interface on it, plus the
-  // coreEntities list.
-  const totalDraftHomes = tacsInScope.length + totalInterfaces + coreEntities.length;
-  checks.push(makeCheck('shapes:kindVocabulary', 'delta', totalInterfaces, badKinds));
-  checks.push(makeCheck('shapes:draftSettled', 'delta', totalDraftHomes, draftFindings));
+  // Keep total >= 1 so the chip prints a sensible ratio when no
+  // interface in scope names a path.
+  checks.push(makeCheck('shapes:pathsResolve', 'delta', Math.max(totalPathChecks, 1), pathFindings));
 
   return foldState('D3', gate, checks, {
     currentTreeHash: ctx.currentTreeHash ?? null,
@@ -801,6 +1466,72 @@ export function checkD4Stories(ctx) {
   }
   checks.push(makeCheck('stories:usFloors', 'delta', usInScope.length, usFail));
 
+  // Check 3 (0.30.0 PR 6): stories:closedSets (engineer, over delta).
+  // Every AC on a US in scope whose description contains an enumeration
+  // cue (one of | any of | the following | types of | status is)
+  // without an inline bracketed list of two or more tokens AND without
+  // an ownerRef fails. The quoted-cue guard strips `"..."` substrings
+  // before the cue scan so prose that quotes a cue does not fire the
+  // check.
+  /** @type {Array<{ id: string, why: string }>} */
+  const closedSetFindings = [];
+  let totalClosedSetAcs = 0;
+  for (const us of usInScope) {
+    const acs = Array.isArray(us.acceptanceCriteria) ? us.acceptanceCriteria : [];
+    for (const ac of acs) {
+      if (typeof ac?.description !== 'string' || ac.description.length === 0) continue;
+      totalClosedSetAcs += 1;
+      if (failsClosedSets(ac)) {
+        closedSetFindings.push({
+          id: ac.id ?? us.usId,
+          why: 'enumeration cue without a closed set',
+        });
+      }
+    }
+  }
+  checks.push(makeCheck('stories:closedSets', 'delta', totalClosedSetAcs, closedSetFindings));
+
+  // Check 4 (0.30.0 PR 6): stories:ownerRefResolves (engineer, over
+  // delta plus tree for ownerRef targets). Every AC on a US in scope
+  // whose ownerRef is set must point to an interface by name on the
+  // named TAC. Ids `<acId>:<field>`; why 'ownerRef does not resolve'.
+  /** @type {Array<{ id: string, why: string }>} */
+  const ownerRefFindings = [];
+  let totalOwnerRefAcs = 0;
+  // R11 (spec section 17, 2026-10-03): the ownerRef field grammar
+  // widens beyond `interfaces[<name>]` to every bracket-grammar path
+  // that names an existing field on the owning TAC or ADR. The owner
+  // may now be a TAC (via tacId) or an ADR (via adrId); the resolver
+  // handles the bracket forms (`interfaces[<name>]`,
+  // `responsibilities[<n>]`, `dependencies[<name>]`,
+  // `alternativesConsidered[<n>]`) and bare schema fields (`purpose`,
+  // `internalStructure`, `decision`, etc.). A path that does not
+  // match any arm still fails. AC-17405-2 is unchanged in effect.
+  for (const us of usInScope) {
+    const acs = Array.isArray(us.acceptanceCriteria) ? us.acceptanceCriteria : [];
+    for (const ac of acs) {
+      if (!acHasOwnerRef(ac)) continue;
+      totalOwnerRefAcs += 1;
+      const ref = /** @type {any} */ (ac).ownerRef;
+      let owner = null;
+      if (typeof ref.tacId === 'string') {
+        owner = (tree.tacs ?? []).find((t) => t?.tacId === ref.tacId) ?? null;
+      } else if (typeof ref.adrId === 'string') {
+        owner = (tree.adrs ?? []).find((a) => a?.adrId === ref.adrId) ?? null;
+      }
+      const resolves = !!(owner && resolveOwnerRefField(owner, ref.field));
+      if (!resolves) {
+        ownerRefFindings.push({
+          id: `${ac.id ?? us.usId}:${ref.field ?? '(no field)'}`,
+          why: 'ownerRef does not resolve',
+        });
+      }
+    }
+  }
+  // Keep total >= 1 so the chip prints a sensible ratio when no AC in
+  // scope carries an ownerRef.
+  checks.push(makeCheck('stories:ownerRefResolves', 'delta', Math.max(totalOwnerRefAcs, 1), ownerRefFindings));
+
   return foldState('D4', gate, checks, {
     currentTreeHash: ctx.currentTreeHash ?? null,
     freezeGates: /** @type {any} */ (ctx.freeze?.gates),
@@ -812,27 +1543,17 @@ export function checkD4Stories(ctx) {
 // ---------------------------------------------------------------------------
 
 /**
- * D5 -- Cross-cutting weave. 0.29.0 runs cheap presence checks.
- *
- * SEAM 0.30: full concern catalogue with per-shape applicability;
- * per-(concern, REQ) pair enumeration; TAD securityArchitecture and
- * operationalConcerns structure checks beyond presence.
+ * Compute the `crosscut:securityArchitecture` check (engineer,
+ * tree-wide). Pure. Ruling R13 2026-10-05 (ADR-4138 extended): if the
+ * tree carries any REQ with shape `auth` or `httpApi`, TAD.securityArchitecture
+ * must be non-empty. Runs ahead of the D5 scope early-return so a
+ * narrowed scope that excludes the auth REQ still reports the finding.
  *
  * @param {StageContext} ctx
+ * @returns {ReturnType<typeof makeCheck>}
  */
-export function checkD5Crosscut(ctx) {
-  const gate = STAGE_GATES.D5;
-  const scope = asSet(ctx.scope);
+function computeSecurityArchitectureCheck(ctx) {
   const tree = ctx.tree;
-  const reqInScope = (tree.requirements ?? []).filter((r) => scope.has(r.reqId));
-
-  if (reqInScope.length === 0) {
-    return notApplicable('D5', gate, 'no REQ in scope');
-  }
-
-  const checks = [];
-
-  // Check 1: TAD.securityArchitecture non-empty when any REQ carries shape 'auth' or 'httpApi'.
   const authApi = (tree.requirements ?? []).some((r) => {
     const s = r.shapeClassification?.shapes ?? [];
     return s.includes('auth') || s.includes('httpApi');
@@ -845,11 +1566,22 @@ export function checkD5Crosscut(ctx) {
       secFail.push({ id: 'TAD.securityArchitecture', why: 'empty while auth or httpApi REQ exists' });
     }
   }
-  checks.push(makeCheck('crosscut:securityArchitecture', 'tree', authApi ? 1 : 0, secFail));
+  return makeCheck('crosscut:securityArchitecture', 'tree', authApi ? 1 : 0, secFail);
+}
 
-  // Check 2: TAD.operationalConcerns non-empty when any AC description
-  // carries the '[deployed]' marker (a cheap presence signal that
-  // proposal §3.2 D5 lists as 'deployed-scope AC').
+/**
+ * Compute the `crosscut:operationalConcerns` check (engineer,
+ * tree-wide). Pure. Ruling R13 2026-10-05 (ADR-4138 extended): if any
+ * AC description tree-wide carries the `[deployed]` marker, then
+ * TAD.operationalConcerns must be non-empty. Runs ahead of the D5
+ * scope early-return.
+ *
+ * @param {StageContext} ctx
+ * @returns {ReturnType<typeof makeCheck>}
+ */
+function computeOperationalConcernsCheck(ctx) {
+  const tree = ctx.tree;
+  const tad = /** @type {any} */ (tree.tad ?? {});
   const hasDeployedAc = (tree.userStories ?? []).some((us) => (us.acceptanceCriteria ?? []).some((ac) => typeof ac?.description === 'string' && ac.description.includes('[deployed]')));
   const opFail = [];
   if (hasDeployedAc) {
@@ -858,7 +1590,59 @@ export function checkD5Crosscut(ctx) {
       opFail.push({ id: 'TAD.operationalConcerns', why: 'empty while deployed-scope AC exists' });
     }
   }
-  checks.push(makeCheck('crosscut:operationalConcerns', 'tree', hasDeployedAc ? 1 : 0, opFail));
+  return makeCheck('crosscut:operationalConcerns', 'tree', hasDeployedAc ? 1 : 0, opFail);
+}
+
+/**
+ * D5 -- Cross-cutting weave. 0.29.0 runs cheap presence checks.
+ *
+ * SEAM 0.30: full concern catalogue with per-shape applicability;
+ * per-(concern, REQ) pair enumeration; TAD securityArchitecture and
+ * operationalConcerns structure checks beyond presence.
+ *
+ * @param {StageContext} ctx
+ */
+export function checkD5Crosscut(ctx) {
+  const gate = STAGE_GATES.D5;
+  const scope = asSet(ctx.scope);
+  const tree = ctx.tree;
+  const reqInScope = (tree.requirements ?? []).filter((r) => scope.has(r.reqId));
+
+  // Ruling R13 2026-10-05 (ADR-4138 extended, PR 292 follow-up):
+  // crosscut:securityArchitecture and crosscut:operationalConcerns are
+  // tree-wide checks; evaluate them before any scope early-return so a
+  // narrowed D5 scope that excludes the triggering REQ or AC still
+  // reports an empty TAD.securityArchitecture / TAD.operationalConcerns.
+  const securityCheck = computeSecurityArchitectureCheck(ctx);
+  const operationalCheck = computeOperationalConcernsCheck(ctx);
+
+  if (reqInScope.length === 0) {
+    const treeWideFailure = treeWideFailureEnvelope(
+      'D5', gate,
+      [
+        { name: 'crosscut:securityArchitecture', check: securityCheck },
+        { name: 'crosscut:operationalConcerns', check: operationalCheck },
+      ],
+      { currentTreeHash: ctx.currentTreeHash ?? null, freezeGates: /** @type {any} */ (ctx.freeze?.gates) },
+    );
+    if (treeWideFailure) return treeWideFailure;
+    return notApplicable('D5', gate, 'no REQ in scope');
+  }
+
+  const checks = [];
+
+  // Check 1: TAD.securityArchitecture non-empty when any REQ carries
+  // shape 'auth' or 'httpApi'. Ruling R13 2026-10-05: tree-wide;
+  // computed by computeSecurityArchitectureCheck so the same check is
+  // reused ahead of the scope early-return (ADR-4138 extended).
+  checks.push(securityCheck);
+
+  // Check 2: TAD.operationalConcerns non-empty when any AC description
+  // carries the '[deployed]' marker (a cheap presence signal that
+  // proposal §3.2 D5 lists as 'deployed-scope AC'). Ruling R13
+  // 2026-10-05: tree-wide; computed by computeOperationalConcernsCheck
+  // so the same check is reused ahead of the scope early-return.
+  checks.push(operationalCheck);
 
   // Check 3: no open concern-ledger entry on a REQ in scope.
   const concerns = /** @type {any} */ (ctx.ledgers?.concerns);
@@ -871,6 +1655,52 @@ export function checkD5Crosscut(ctx) {
     openInScope.map((c) => ({ id: `concern:${c.id}`, why: `open concern on ${c.reqId}: ${c.concern}` })),
   ));
 
+  // Check 4 (0.30.0 PR 6): crosscut:catalogue (engineer, over tree).
+  // For every REQ in scope, enumerate applicable (reqShape, concern)
+  // pairs via src/define/concern-catalogue.js; each pair needs a
+  // concern-ledger entry keyed <REQ>:<concern> with disposition
+  // applied or waived (a waived entry carries a reason). Fail ids are
+  // `<REQ>:<concern>`; the why names the missing concern. A waived
+  // entry without a reason also fails. Keys shared with the baseline
+  // catalogue where names coincide (today only `auth`).
+  const entriesByKey = new Map();
+  for (const entry of concernEntries) {
+    if (!entry || typeof entry.reqId !== 'string' || typeof entry.concern !== 'string') continue;
+    entriesByKey.set(`${entry.reqId}:${entry.concern}`, entry);
+  }
+  /** @type {Array<{ id: string, why: string }>} */
+  const catalogueFindings = [];
+  let totalCataloguePairs = 0;
+  for (const req of reqInScope) {
+    const shapes = Array.isArray(req?.shapeClassification?.shapes)
+      ? req.shapeClassification.shapes.filter((s) => typeof s === 'string')
+      : [];
+    const applicable = applicableConcernsForShapes(shapes);
+    for (const concern of applicable) {
+      totalCataloguePairs += 1;
+      const key = `${req.reqId}:${concern}`;
+      const entry = entriesByKey.get(key);
+      if (!entry) {
+        catalogueFindings.push({ id: key, why: `missing concern-ledger entry for ${concern}` });
+        continue;
+      }
+      const disposition = typeof entry.disposition === 'string' ? entry.disposition : null;
+      if (disposition !== 'applied' && disposition !== 'waived') {
+        catalogueFindings.push({ id: key, why: `concern-ledger entry disposition is ${disposition ?? '(unset)'}` });
+        continue;
+      }
+      if (disposition === 'waived') {
+        const reason = typeof entry.reason === 'string' ? entry.reason.trim() : '';
+        if (reason.length === 0) {
+          catalogueFindings.push({ id: key, why: 'waived without a reason' });
+        }
+      }
+    }
+  }
+  // Keep total >= 1 so the chip prints a sensible ratio when no REQ in
+  // scope has applicable concerns (every REQ carries shape 'other').
+  checks.push(makeCheck('crosscut:catalogue', 'tree', Math.max(totalCataloguePairs, 1), catalogueFindings));
+
   return foldState('D5', gate, checks, {
     currentTreeHash: ctx.currentTreeHash ?? null,
     freezeGates: /** @type {any} */ (ctx.freeze?.gates),
@@ -882,14 +1712,14 @@ export function checkD5Crosscut(ctx) {
 // ---------------------------------------------------------------------------
 
 /**
- * D6 -- Consistency and satisfiability probe. 0.29.0 runs only the
- * validate-clean tree-wide check and the probe-ledger open count.
- *
- * SEAM 0.30: contradiction-lite across criteria on one story and
- * across their TACs' ADRs; unsatisfiable-lite (a `then` naming
- * undefined state); duplicate scan; orphan-interface scan;
- * regeneration probe runner injectable like `mutationRunner` in
- * src/review/index.js.
+ * D6 -- Consistency and satisfiability probe. 0.29.0 ran the
+ * validate-clean tree-wide check and the probe-ledger open count;
+ * 0.30.0 PR 7 (ADR-4131 extended, spec section 4 row 'D6 scans and the
+ * injectable probe runner') adds the four mechanical scans
+ * consistency:contradictions, consistency:unsatisfiable,
+ * consistency:duplicates and consistency:orphanInterfaces. The probe
+ * runner lives on the readiness compute (TAC-4123); the gate reads the
+ * merged probes.probes[] it ends up with.
  *
  * @param {StageContext} ctx
  */
@@ -933,12 +1763,350 @@ export function checkD6Consistency(ctx) {
   // uses a single representative entry regardless.
   checks.push(makeCheck('consistency:probeCount', 'tree', Math.max(effectiveOpen, 1), failing, effectiveOpen));
 
+  // ADR-4131 extended (0.30.0 PR 7): the four D6 scans.
+  const scope = asSet(ctx.scope);
+  const tree = ctx.tree;
+  const usInScope = (tree.userStories ?? []).filter((us) => scope.has(us.usId));
+
+  // Scan 1: consistency:contradictions (engineer, over delta). Two ACs
+  // on one story share a `when` clause and one of their `then` clauses
+  // is a negation of the other. The quoted-cue guard strips
+  // double-quoted substrings before the negation scan so prose that
+  // quotes a negation inside a `then` does not fire the check.
+  /** @type {Array<{ id: string, why: string }>} */
+  const contradictionFindings = [];
+  let totalStoriesScanned = 0;
+  for (const us of usInScope) {
+    const acs = Array.isArray(us.acceptanceCriteria) ? us.acceptanceCriteria : [];
+    if (acs.length < 2) continue;
+    totalStoriesScanned += 1;
+    const parsed = acs
+      .map((ac) => ({ ac, parts: parseWhenThen(ac?.description) }))
+      .filter((p) => p.parts !== null);
+    const reported = new Set();
+    for (let i = 0; i < parsed.length; i += 1) {
+      for (let j = i + 1; j < parsed.length; j += 1) {
+        const a = parsed[i];
+        const b = parsed[j];
+        if (normaliseClause(a.parts.when) !== normaliseClause(b.parts.when)) continue;
+        if (!thensNegateEachOther(a.parts.then, b.parts.then)) continue;
+        const pairKey = `${us.usId}:${a.ac.id ?? '?'}:${b.ac.id ?? '?'}`;
+        if (reported.has(pairKey)) continue;
+        reported.add(pairKey);
+        const idA = a.ac.id ?? us.usId;
+        const idB = b.ac.id ?? us.usId;
+        contradictionFindings.push({
+          id: us.usId,
+          why: `ACs ${idA} and ${idB} share a when clause with a negated then`,
+        });
+      }
+    }
+  }
+  checks.push(makeCheck(
+    'consistency:contradictions',
+    'delta',
+    Math.max(totalStoriesScanned, 1),
+    contradictionFindings,
+  ));
+
+  // Scan 2: consistency:unsatisfiable (engineer, over delta). A `then`
+  // naming a field that no recordShape anywhere in the tree defines
+  // fails the AC with id `<acId>:<field>`. A field defined in a
+  // `[draft]` recordShape counts as defined (the engineer owns the
+  // draft; its `fields:` list is honest about what the then may name).
+  const definedFields = collectRecordShapeFields(tree);
+  /** @type {Array<{ id: string, why: string }>} */
+  const unsatisfiableFindings = [];
+  let totalThenFieldChecks = 0;
+  for (const us of usInScope) {
+    const acs = Array.isArray(us.acceptanceCriteria) ? us.acceptanceCriteria : [];
+    for (const ac of acs) {
+      const parts = parseWhenThen(ac?.description);
+      if (!parts) continue;
+      const fields = extractThenFieldTokens(parts.then);
+      for (const field of fields) {
+        totalThenFieldChecks += 1;
+        if (definedFields.has(field)) continue;
+        unsatisfiableFindings.push({
+          id: `${ac.id ?? us.usId}:${field}`,
+          why: `then names field ${field} that no recordShape defines`,
+        });
+      }
+    }
+  }
+  checks.push(makeCheck(
+    'consistency:unsatisfiable',
+    'delta',
+    Math.max(totalThenFieldChecks, 1),
+    unsatisfiableFindings,
+  ));
+
+  // Scan 3: consistency:duplicates (engineer, over tree). Identical AC
+  // descriptions across stories fail both ACs. The comparison trims
+  // leading whitespace and the leading `[class]` marker.
+  /** @type {Map<string, Array<{ usId: string, acId: string }>>} */
+  const descBuckets = new Map();
+  const allUs = tree.userStories ?? [];
+  let totalDupAcs = 0;
+  for (const us of allUs) {
+    const acs = Array.isArray(us.acceptanceCriteria) ? us.acceptanceCriteria : [];
+    for (const ac of acs) {
+      const desc = typeof ac?.description === 'string' ? ac.description.trim() : '';
+      if (desc.length === 0) continue;
+      totalDupAcs += 1;
+      const normalised = desc.replace(AC_CLASS_RE, '').trim().toLowerCase();
+      if (normalised.length === 0) continue;
+      const bucket = descBuckets.get(normalised) ?? [];
+      bucket.push({ usId: us.usId, acId: ac.id ?? us.usId });
+      descBuckets.set(normalised, bucket);
+    }
+  }
+  /** @type {Array<{ id: string, why: string }>} */
+  const duplicateFindings = [];
+  for (const bucket of descBuckets.values()) {
+    if (bucket.length < 2) continue;
+    const stories = [...new Set(bucket.map((b) => b.usId))];
+    if (stories.length < 2) continue;
+    for (const entry of bucket) {
+      duplicateFindings.push({
+        id: entry.acId,
+        why: `duplicate description (also on ${bucket.filter((b) => b.acId !== entry.acId).map((b) => b.acId).join(', ')})`,
+      });
+    }
+  }
+  checks.push(makeCheck(
+    'consistency:duplicates',
+    'tree',
+    Math.max(totalDupAcs, 1),
+    duplicateFindings,
+  ));
+
+  // Scan 4: consistency:orphanInterfaces (engineer, over tree). An
+  // interface on any TAC that no AC `ownerRef` points at AND that no
+  // REQ `deliveredBy` reaches fails. Shares the `interfaces[<name>]`
+  // pointer grammar with D4 `stories:ownerRefResolves`. A REQ's
+  // `deliveredBy` reaches an interface when it names the owning TAC id
+  // (either as a `tacId` string or as a `TAC-nnnn:<name>` pointer).
+  const reachedInterfaces = collectReachedInterfaces(tree);
+  /** @type {Array<{ id: string, why: string }>} */
+  const orphanFindings = [];
+  let totalInterfacesScanned = 0;
+  for (const tac of tree.tacs ?? []) {
+    const list = Array.isArray(tac?.interfaces) ? tac.interfaces : [];
+    for (const iface of list) {
+      const name = typeof iface?.name === 'string' ? iface.name : null;
+      if (!name) continue;
+      totalInterfacesScanned += 1;
+      const key = `${tac.tacId}:${name}`;
+      if (reachedInterfaces.has(key)) continue;
+      orphanFindings.push({
+        id: key,
+        why: 'no AC ownerRef and no REQ deliveredBy reaches it',
+      });
+    }
+  }
+  checks.push(makeCheck(
+    'consistency:orphanInterfaces',
+    'tree',
+    Math.max(totalInterfacesScanned, 1),
+    orphanFindings,
+  ));
+
   return foldState('D6', gate, checks, {
     currentTreeHash: ctx.currentTreeHash ?? null,
     freezeGates: /** @type {any} */ (ctx.freeze?.gates),
   });
 }
 
+/**
+ * Parse an AC description into { when, then } clause strings. Accepts
+ * the common "given ... when ... then ..." shape used across the ACs
+ * of this codebase; returns null when the description does not carry
+ * both a `when` and a `then` segment. The leading `[class]` marker is
+ * stripped before the scan. The match is case-insensitive on the
+ * keywords only; the clause bodies keep their original casing.
+ *
+ * @param {unknown} desc
+ * @returns {{ when: string, then: string } | null}
+ */
+function parseWhenThen(desc) {
+  if (typeof desc !== 'string' || desc.length === 0) return null;
+  const stripped = desc.replace(AC_CLASS_RE, '').trim();
+  const re = /\bwhen\b([\s\S]*?)\bthen\b([\s\S]*)$/i;
+  const m = stripped.match(re);
+  if (!m) return null;
+  const when = m[1].trim();
+  const then = m[2].trim();
+  if (when.length === 0 || then.length === 0) return null;
+  return { when, then };
+}
+
+/**
+ * Normalise a clause for the contradictions scan: lower-case, trim,
+ * collapse whitespace. A clause is "the same" between two ACs when
+ * their normalised forms match.
+ *
+ * @param {string} clause
+ * @returns {string}
+ */
+function normaliseClause(clause) {
+  return clause.toLowerCase().replace(/\s+/g, ' ').trim();
+}
+
+/**
+ * Strip double-quoted substrings and then test whether one `then`
+ * clause is the negation of the other. "Negation" is a cheap test: one
+ * clause begins (or carries, after a verb) a `not`, `no`, `does not`,
+ * `is not`, `never`, `must not` token where the other clause does not;
+ * or the two clauses are the same body with one carrying such a token.
+ * The quoted-substring strip is the shared guard with D4.
+ *
+ * @param {string} a
+ * @param {string} b
+ * @returns {boolean}
+ */
+function thensNegateEachOther(a, b) {
+  const aPlain = normaliseClause(stripQuotedSubstrings(a));
+  const bPlain = normaliseClause(stripQuotedSubstrings(b));
+  if (aPlain === bPlain) return false;
+  const NEG_RE = /\b(?:not|no|never|does not|is not|must not|cannot|won't|will not)\b/;
+  const aNeg = NEG_RE.test(aPlain);
+  const bNeg = NEG_RE.test(bPlain);
+  if (aNeg === bNeg) return false;
+  // One side negates; test the negated body against the positive one.
+  const positive = aNeg ? bPlain : aPlain;
+  const negative = aNeg ? aPlain : bPlain;
+  const negativeStripped = negative.replace(NEG_RE, '').replace(/\s+/g, ' ').trim();
+  // A sufficiently similar body is "the same claim with a negation".
+  // We treat the shorter being a prefix / suffix / substring of the
+  // longer, or sharing 80% of its tokens, as "same body".
+  if (negativeStripped.length === 0) return false;
+  if (positive.includes(negativeStripped) || negativeStripped.includes(positive)) return true;
+  const posTokens = new Set(positive.split(/\s+/).filter((t) => t.length > 2));
+  const negTokens = negativeStripped.split(/\s+/).filter((t) => t.length > 2);
+  if (negTokens.length === 0) return false;
+  const shared = negTokens.filter((t) => posTokens.has(t)).length;
+  return shared / negTokens.length >= 0.6;
+}
+
+/**
+ * Collect every field name defined by any `recordShape` interface in
+ * the tree. A `fields:` marker in the interface description introduces
+ * a list of field names; each name is a token on a bullet, a line, or
+ * a comma-separated list. Draft recordShapes are included (the
+ * engineer owns the draft and its fields: list is honest).
+ *
+ * @param {import('#core/store/walker.js').TreeModel} tree
+ * @returns {Set<string>}
+ */
+function collectRecordShapeFields(tree) {
+  const out = new Set();
+  for (const tac of tree.tacs ?? []) {
+    for (const iface of tac.interfaces ?? []) {
+      if (iface?.kind !== 'recordShape') continue;
+      const desc = typeof iface?.description === 'string' ? iface.description : '';
+      const stripped = stripDraftPrefix(desc);
+      // Find the `fields:` segment and read until the next `:` or end.
+      const match = stripped.match(/(^|\n)\s*(?:[-*]\s*)?fields\s*:\s*([\s\S]*?)(?=(?:\n\s*(?:[-*]\s*)?[a-zA-Z][a-zA-Z0-9_]*\s*:)|$)/);
+      if (!match) continue;
+      const body = match[2];
+      for (const token of body.split(/[\s,]+/)) {
+        const name = token.replace(/^[-*]/, '').replace(/[:(){}\[\]]/g, '').trim();
+        if (!name) continue;
+        if (/^[A-Za-z_][A-Za-z0-9_]*$/.test(name)) out.add(name);
+      }
+    }
+  }
+  return out;
+}
+
+/**
+ * Pull field tokens out of a `then` clause. A field token is a word
+ * that follows a verb like `set`, `write`, `include`, `return`,
+ * `contain`, `name` or appears as the direct object of a `then`'s
+ * verb phrase; a cheap approximation uses `then <subject> <verb>
+ * <field>` plus `field <name>`, `<name> field` and `field: <name>`
+ * patterns. The scan is deliberately conservative so a plain English
+ * sentence yields a small set.
+ *
+ * @param {string} thenClause
+ * @returns {string[]}
+ */
+function extractThenFieldTokens(thenClause) {
+  if (typeof thenClause !== 'string' || thenClause.length === 0) return [];
+  const text = stripQuotedSubstrings(thenClause);
+  /** @type {Set<string>} */
+  const tokens = new Set();
+  // Pattern 1: backticked identifier (`then `balance` is set`). The
+  // primary signal; prose that quotes a field name under backticks is
+  // the convention this check expects.
+  for (const m of text.matchAll(/`([A-Za-z_][A-Za-z0-9_]*)`/g)) {
+    if (m[1]) tokens.add(m[1]);
+  }
+  // Pattern 2: `<name> field` (adjective-form naming). An English
+  // "stop word" skip keeps "the field", "a field" and "its field" from
+  // tripping the check.
+  const STOP = new Set(['the', 'a', 'an', 'this', 'that', 'its', 'our', 'their', 'any', 'no', 'some', 'each', 'every', 'another']);
+  for (const m of text.matchAll(/\b([A-Za-z_][A-Za-z0-9_]*)\s+field\b/g)) {
+    const token = m[1];
+    if (!token) continue;
+    if (STOP.has(token.toLowerCase())) continue;
+    tokens.add(token);
+  }
+  // Pattern 3: `field: <name>` or `field = <name>` (schema-like
+  // notation inside a then clause).
+  for (const m of text.matchAll(/\bfield\s*[:=]\s*([A-Za-z_][A-Za-z0-9_]*)/g)) {
+    if (m[1]) tokens.add(m[1]);
+  }
+  return [...tokens];
+}
+
+/**
+ * Collect every interface the tree "reaches" from an AC `ownerRef` or
+ * a REQ `deliveredBy` (REQ-174 companion field). The result is a Set
+ * of `<tacId>:<name>` keys. A `deliveredBy` on a REQ can take two
+ * shapes: an array of `TAC-nnnn:<name>` pointer strings, or an array
+ * of plain TAC ids ("delivered by this TAC"); the second shape reaches
+ * every interface on the named TAC.
+ *
+ * @param {import('#core/store/walker.js').TreeModel} tree
+ * @returns {Set<string>}
+ */
+function collectReachedInterfaces(tree) {
+  const out = new Set();
+  // AC ownerRefs.
+  for (const us of tree.userStories ?? []) {
+    const acs = Array.isArray(us.acceptanceCriteria) ? us.acceptanceCriteria : [];
+    for (const ac of acs) {
+      if (!acHasOwnerRef(ac)) continue;
+      const ref = /** @type {any} */ (ac).ownerRef;
+      const name = parseOwnerRefInterfaceField(ref?.field);
+      if (!name || typeof ref?.tacId !== 'string') continue;
+      out.add(`${ref.tacId}:${name}`);
+    }
+  }
+  // REQ deliveredBy (optional field; shapes above).
+  for (const req of tree.requirements ?? []) {
+    const deliveredBy = /** @type {any} */ (req)?.deliveredBy;
+    if (!Array.isArray(deliveredBy)) continue;
+    for (const entry of deliveredBy) {
+      if (typeof entry !== 'string' || entry.length === 0) continue;
+      const m = entry.match(/^(TAC-[A-Za-z0-9-]+):(.+)$/);
+      if (m) {
+        out.add(`${m[1]}:${m[2]}`);
+        continue;
+      }
+      // Plain TAC id: every interface on that TAC is reached.
+      const tac = (tree.tacs ?? []).find((t) => t?.tacId === entry);
+      if (!tac) continue;
+      for (const iface of tac.interfaces ?? []) {
+        if (typeof iface?.name === 'string') out.add(`${tac.tacId}:${iface.name}`);
+      }
+    }
+  }
+  return out;
+}
+
 // ---------------------------------------------------------------------------
 // D7 -- Decisions and review (blocking in 0.29.0).
 // ---------------------------------------------------------------------------