rcf-lite 0.30.0 → 0.32.0

package/src/query/gates.js

@@ -173,7 +173,7 @@ export const CHECK_QUESTION = /** @type {const} */ ({
   'skeleton:reqShape': 'Every requirement in scope carries a shape classification.',
   'skeleton:tadPersistence': 'TAD data architecture lists dataStores and coreEntities for persistence REQs.',
   'skeleton:deployAdr': 'Exactly one Deploy target or Deploy deferral ADR exists.',
-  'skeleton:standardsCited': 'Every registered standards pack is cited in a REQ rationale or an ADR, or waived by a concern-ledger entry.',
+  'skeleton:standardsCited': 'Every registered standards pack is cited, applied or waived.',
   'shapes:tacHasInterface': 'Every TAC in scope has at least one interface.',
   'shapes:kindVocabulary': 'Every interface kind is in the closed vocabulary.',
   'shapes:draftSettled': 'Every draft interface has been settled (the [draft] marker is removed).',
@@ -378,16 +378,39 @@ export function parseInterfaceTemplate(iface) {
   return { kind, missing };
 }
 
+/**
+ * Known bare repo filenames the slash-or-extension rule would otherwise
+ * silently skip (ruling R6 2026-10-05). A `path: Dockerfile` on an
+ * interface description names a real file at the repo root, so the
+ * `shapes:pathsResolve` check should see it. Exported so the tests can
+ * assert the list verbatim; a bare word outside this set still fails
+ * the slash-or-extension rule as before.
+ */
+export const BARE_PATH_WHITELIST = /** @type {const} */ ([
+  'Dockerfile',
+  'Containerfile',
+  'Makefile',
+  'LICENSE',
+  'Procfile',
+  'Justfile',
+  'Rakefile',
+  'Gemfile',
+  'CODEOWNERS',
+]);
+const BARE_PATH_WHITELIST_SET = new Set(BARE_PATH_WHITELIST);
+
 /**
  * Rough `path:` token scanner for an interface description. Returns
  * every candidate path token the description names so the CLI can
  * resolve them on disk and the gate can decide `shapes:pathsResolve`
  * against the resolved map (ADR-4131). A candidate is any text that
  * follows a `path:` or `path =` marker and looks like a repo-relative
- * path (contains a `/` or ends with a file extension, no scheme). The
- * scanner is deliberately conservative: an http URL, a bare word, a
- * glob or a template placeholder is not a candidate. Exported for the
- * CLI's resolve-on-disk pass.
+ * path (contains a `/` or ends with a file extension, or is one of the
+ * known bare repo names in BARE_PATH_WHITELIST per ruling R6
+ * 2026-10-05, no scheme). The scanner is deliberately conservative: an
+ * http URL, a bare word outside the whitelist, a glob or a template
+ * placeholder is not a candidate. Exported for the CLI's resolve-on-disk
+ * pass.
  *
  * @param {string} description
  * @returns {string[]}
@@ -409,6 +432,11 @@ export function extractInterfacePathTokens(description) {
     // `src/x.js` or `packages/rcf-lite/CHANGELOG.md`; those don't
     // start with `/`.
     if (token.startsWith('/') && !/\.[a-zA-Z0-9]+$/.test(token)) continue;
+    // Ruling R6 2026-10-05: whitelist the usual bare repo names.
+    if (BARE_PATH_WHITELIST_SET.has(token)) {
+      out.push(token);
+      continue;
+    }
     if (!/\//.test(token) && !/\.[a-zA-Z0-9]+$/.test(token)) continue;
     out.push(token);
   }
@@ -434,11 +462,13 @@ export function stagePolicy(stage) {
 
 /**
  * ADR-4131 (0.30.0 PR 5): the three gates that accept a recorded
- * `--ack` override. `stagePolicy` keeps returning `blocking` for every
- * stage so the readyToBuild fold stays untouched; `ackable(stage)` is
- * the companion signal the readiness and freeze CLIs read to decide
- * whether a failing stage honours an acknowledgement at the current
- * hash. True for D3, D5 and D6; false for everything else.
+ * `--ack` override. `stagePolicy(stage)` returns `warnWithAck` for
+ * D3/D5/D6 and `blocking` for everything else (ruling R4 2026-10-05
+ * retired the pre-R4 wording that said `stagePolicy` kept returning
+ * `blocking` for every stage); `ackable(stage)` is the companion
+ * signal the readiness and freeze CLIs read to decide whether a
+ * failing stage honours an acknowledgement at the current hash. True
+ * for D3, D5 and D6; false for everything else.
  *
  * @param {string} stage
  * @returns {boolean}
@@ -753,6 +783,43 @@ function asSet(scope) {
   return scope instanceof Set ? scope : new Set(scope ?? []);
 }
 
+/**
+ * ADR-4138 (DEFINE step 3 rulings R2, R5, R7 2026-10-05 and ruling R13
+ * 2026-10-05 PR 292 follow-up): run every tree-wide check for a stage
+ * and either return a stage envelope carrying only the tree-wide
+ * findings (plus the scope placeholder) folded through `foldState`, or
+ * null when every tree-wide check passed, letting the stage proceed to
+ * its own scope early-return or full checks list.
+ *
+ * The helper governs every tree-wide check: `shapes:draftSettled`
+ * (R2), `shapes:entityJoin` (R5), `skeleton:standardsCited` (R7),
+ * `skeleton:deployAdr` (R13), `crosscut:securityArchitecture` (R13)
+ * and `crosscut:operationalConcerns` (R13). Delta-only checks
+ * (templateMarkers, pathsResolve, closedSets, ownerRefResolves) are
+ * untouched: they stay on the stage's own full-checks path. The
+ * ack-at-current-hash fold is delegated to `foldState` so one
+ * implementation owns the acknowledgement rule and the failing
+ * envelope carries no stale `notApplicable` reason text (the pre-R13
+ * copy of the stage's notApplicable message misled the readiness CLI
+ * print line, which reads `stage.reason` on every state).
+ *
+ * @param {string} stage
+ * @param {string} gate
+ * @param {Array<{name: string, check: object}>} treeWideChecks
+ * @param {object} freezeCtx
+ * @returns {{ stage: string, gate: string, state: 'failing' | 'acknowledged', checks: object[] } | null}
+ */
+function treeWideFailureEnvelope(stage, gate, treeWideChecks, freezeCtx) {
+  const anyFailing = treeWideChecks.some(({ check }) => !check.ok);
+  if (!anyFailing) return null;
+  const checks = [makeCheck(`stage:${stage}:scope`, 'delta', 0, [])];
+  for (const { check } of treeWideChecks) checks.push(check);
+  // Delegate to foldState: it owns the warn-with-ack fold rule
+  // (ADR-4122). The returned envelope carries { state: 'failing' } or
+  // { state: 'acknowledged' } and no reason field.
+  return foldState(stage, gate, checks, freezeCtx);
+}
+
 // ---------------------------------------------------------------------------
 // D1 -- Brief intake and ledger (blocking in 0.29.0).
 // ---------------------------------------------------------------------------
@@ -862,6 +929,81 @@ export function checkD1Brief(ctx) {
 /** Kinds whose resolution D2 checks: capability / constraint / entity / actor / externalSystem / surface. */
 const D2_RESOLVING_KINDS = new Set(['capability', 'constraint', 'entity', 'actor', 'externalSystem', 'surface']);
 
+/**
+ * Compute the `skeleton:deployAdr` check (engineer, tree-wide). Pure.
+ * Ruling R13 2026-10-05 (ADR-4138 extended, PR 292 follow-up): exactly
+ * one Deploy target or Deploy deferral ADR exists tree-wide (detected
+ * by title prefix per proposal section 11). The check runs ahead of
+ * the D2 scope early-return so a narrowed scope that excludes every
+ * REQ / PRD / TAD / brief statement still reports a missing (or
+ * doubled) Deploy ADR.
+ *
+ * @param {StageContext} ctx
+ * @returns {ReturnType<typeof makeCheck>}
+ */
+function computeDeployAdrCheck(ctx) {
+  const tree = ctx.tree;
+  const deployAdrs = (tree.adrs ?? []).filter((a) => {
+    const t = typeof a?.title === 'string' ? a.title : '';
+    return t.startsWith('Deploy target:') || t.startsWith('Deploy deferral:');
+  });
+  const deployFail = [];
+  if (deployAdrs.length === 0) deployFail.push({ id: 'ADR:deploy', why: 'no Deploy target or Deploy deferral ADR found (title-prefix scan)' });
+  else if (deployAdrs.length > 1) deployFail.push({ id: 'ADR:deploy', why: `${deployAdrs.length} Deploy ADRs found; expected exactly one` });
+  return makeCheck('skeleton:deployAdr', 'tree', 1, deployFail);
+}
+
+/**
+ * Compute the `skeleton:standardsCited` check (engineer, tree-wide).
+ * Pure. Every standards pack registered through `rcf define standards`
+ * (manifest.standards[].slug) is cited in a REQ `rationale` or an ADR,
+ * or satisfied by a concern-ledger entry keyed `standards:<pack>` whose
+ * disposition is `applied` or `waived`. Ruling R8 2026-10-05: both
+ * `applied` and `waived` satisfy the check (an `applied` entry means the
+ * pack was adopted, which is at least as strong as a citation). Ruling
+ * R7 2026-10-05: the check runs tree-wide regardless of the D2 scope
+ * early-return, through the shared ADR-4138 helper.
+ *
+ * @param {StageContext} ctx
+ * @returns {ReturnType<typeof makeCheck>}
+ */
+function computeStandardsCitedCheck(ctx) {
+  const tree = ctx.tree;
+  const standardsList = Array.isArray(tree.manifest?.standards)
+    ? /** @type {any[]} */ (tree.manifest.standards)
+    : [];
+  /** @type {Array<{ id: string, why: string }>} */
+  const standardsFail = [];
+  if (standardsList.length > 0) {
+    const reqRationales = (tree.requirements ?? [])
+      .map((r) => (typeof r?.rationale === 'string' ? r.rationale : ''))
+      .join('\n');
+    const adrDocs = (tree.adrs ?? []).map((a) => {
+      try { return JSON.stringify(a); } catch { return ''; }
+    }).join('\n');
+    const concernsBody = /** @type {any} */ (ctx.ledgers?.concerns);
+    const concernList = Array.isArray(concernsBody?.concerns) ? concernsBody.concerns : [];
+    const satisfierSlugs = new Set();
+    for (const entry of concernList) {
+      if (!entry || typeof entry.concern !== 'string') continue;
+      const disposition = typeof entry.disposition === 'string' ? entry.disposition : null;
+      // Ruling R8 2026-10-05: both applied and waived satisfy standardsCited.
+      if (disposition !== 'applied' && disposition !== 'waived') continue;
+      const m = entry.concern.match(/^standards:(.+)$/);
+      if (m) satisfierSlugs.add(m[1]);
+    }
+    for (const pack of standardsList) {
+      const slug = typeof pack?.slug === 'string' ? pack.slug : null;
+      if (!slug) continue;
+      if (satisfierSlugs.has(slug)) continue;
+      if (reqRationales.includes(slug)) continue;
+      if (adrDocs.includes(slug)) continue;
+      standardsFail.push({ id: `standards:${slug}`, why: 'uncited, unapplied and unwaived' });
+    }
+  }
+  return makeCheck('skeleton:standardsCited', 'tree', Math.max(standardsList.length, 1), standardsFail);
+}
+
 /**
  * D2 -- Requirements and architecture skeleton.
  *
@@ -880,7 +1022,25 @@ export function checkD2Skeleton(ctx) {
   const prdInScope = tree.prd && scope.has(tree.prd.prdId ?? '');
   const tadInScope = tree.tad && scope.has(tree.tad.tadId ?? '');
 
+  // Ruling R7 2026-10-05 (ADR-4138) and R13 2026-10-05 (ADR-4138
+  // extended, PR 292 follow-up): skeleton:standardsCited and
+  // skeleton:deployAdr are tree-wide checks; evaluate them before any
+  // scope early-return so a narrowed D2 scope that excludes every
+  // REQ/PRD/TAD/brief statement still reports an uncited pack or a
+  // missing Deploy ADR.
+  const standardsCheck = computeStandardsCitedCheck(ctx);
+  const deployAdrCheck = computeDeployAdrCheck(ctx);
+
   if (resolvingStmts.length === 0 && reqInScope.length === 0 && !prdInScope && !tadInScope) {
+    const treeWideFailure = treeWideFailureEnvelope(
+      'D2', gate,
+      [
+        { name: 'skeleton:standardsCited', check: standardsCheck },
+        { name: 'skeleton:deployAdr', check: deployAdrCheck },
+      ],
+      { currentTreeHash: ctx.currentTreeHash ?? null, freezeGates: /** @type {any} */ (ctx.freeze?.gates) },
+    );
+    if (treeWideFailure) return treeWideFailure;
     return notApplicable('D2', gate, 'no resolving brief statements and no REQ / PRD / TAD in scope');
   }
 
@@ -952,59 +1112,17 @@ export function checkD2Skeleton(ctx) {
   checks.push(makeCheck('skeleton:tadPersistence', 'tree', persistenceReq ? 2 : 0, tadFail));
 
   // Check 4: exactly one deploy or deferral ADR tree-wide. Cheap
-  // detection by title prefix (proposal §11 assumption).
-  const deployAdrs = (tree.adrs ?? []).filter((a) => {
-    const t = typeof a?.title === 'string' ? a.title : '';
-    return t.startsWith('Deploy target:') || t.startsWith('Deploy deferral:');
-  });
-  const deployFail = [];
-  if (deployAdrs.length === 0) deployFail.push({ id: 'ADR:deploy', why: 'no Deploy target or Deploy deferral ADR found (title-prefix scan)' });
-  else if (deployAdrs.length > 1) deployFail.push({ id: 'ADR:deploy', why: `${deployAdrs.length} Deploy ADRs found; expected exactly one` });
-  checks.push(makeCheck('skeleton:deployAdr', 'tree', 1, deployFail));
-
-  // Check 5 (0.30.0 PR 6): skeleton:standardsCited (engineer, over
-  // tree). Every standards pack registered through `rcf define
-  // standards` (manifest.standards[].slug) is cited in a REQ
-  // `rationale` or an ADR, or waived by a concern-ledger entry keyed
-  // `standards:<pack>`. Fail ids `standards:<pack>` with 'uncited and
-  // unwaived'. Citation is a case-sensitive substring match of the
-  // slug against each REQ.rationale and each ADR document (the ADR
-  // may name a pack in its title, context, decision or consequences;
-  // the serialised document is scanned once per ADR to cover every
-  // field). A waiver entry on the concern ledger reads `concern:
-  // 'standards:<pack>'` with disposition 'applied' or 'waived'.
-  const standardsList = Array.isArray(tree.manifest?.standards)
-    ? /** @type {any[]} */ (tree.manifest.standards)
-    : [];
-  /** @type {Array<{ id: string, why: string }>} */
-  const standardsFail = [];
-  if (standardsList.length > 0) {
-    const reqRationales = (tree.requirements ?? [])
-      .map((r) => (typeof r?.rationale === 'string' ? r.rationale : ''))
-      .join('\n');
-    const adrDocs = (tree.adrs ?? []).map((a) => {
-      try { return JSON.stringify(a); } catch { return ''; }
-    }).join('\n');
-    const concernsBody = /** @type {any} */ (ctx.ledgers?.concerns);
-    const concernList = Array.isArray(concernsBody?.concerns) ? concernsBody.concerns : [];
-    const waiverSlugs = new Set();
-    for (const entry of concernList) {
-      if (!entry || typeof entry.concern !== 'string') continue;
-      const disposition = typeof entry.disposition === 'string' ? entry.disposition : null;
-      if (disposition !== 'applied' && disposition !== 'waived') continue;
-      const m = entry.concern.match(/^standards:(.+)$/);
-      if (m) waiverSlugs.add(m[1]);
-    }
-    for (const pack of standardsList) {
-      const slug = typeof pack?.slug === 'string' ? pack.slug : null;
-      if (!slug) continue;
-      if (waiverSlugs.has(slug)) continue;
-      if (reqRationales.includes(slug)) continue;
-      if (adrDocs.includes(slug)) continue;
-      standardsFail.push({ id: `standards:${slug}`, why: 'uncited and unwaived' });
-    }
-  }
-  checks.push(makeCheck('skeleton:standardsCited', 'tree', Math.max(standardsList.length, 1), standardsFail));
+  // detection by title prefix (proposal §11 assumption). Ruling R13
+  // 2026-10-05: tree-wide by definition; computed by
+  // computeDeployAdrCheck so the same check is reused ahead of the
+  // scope early-return (ADR-4138 extended).
+  checks.push(deployAdrCheck);
+
+  // Check 5 (0.30.0 PR 6, ruling R7+R8 2026-10-05): skeleton:standardsCited
+  // (engineer, over tree). Computed by `computeStandardsCitedCheck` so the
+  // same check runs ahead of the scope early-return (R7) and so the R8
+  // behaviour (applied | waived | cited all satisfy) lives in one place.
+  checks.push(standardsCheck);
 
   return foldState('D2', gate, checks, {
     currentTreeHash: ctx.currentTreeHash ?? null,
@@ -1019,6 +1137,98 @@ export function checkD2Skeleton(ctx) {
 /** Set form of INTERFACE_KINDS for O(1) checks. */
 const INTERFACE_KINDS_SET = new Set(INTERFACE_KINDS);
 
+/**
+ * Compute the `shapes:draftSettled` check (engineer, tree-wide). Pure.
+ * Ruling R2 2026-10-05 (ADR-4138): a `[draft]` marker on any TAC
+ * purpose, any interface description or any coreEntities[].description
+ * fails the check regardless of the D3 scope's own early-return. The
+ * three id forms are `<tacId>`, `<tacId>:<name>` and `TAD.entity:<name>`.
+ *
+ * @param {StageContext} ctx
+ * @returns {ReturnType<typeof makeCheck>}
+ */
+function computeDraftSettledCheck(ctx) {
+  const tree = ctx.tree;
+  const tacs = tree.tacs ?? [];
+  const coreEntities = Array.isArray(tree.tad?.dataArchitecture?.coreEntities)
+    ? /** @type {any[]} */ (tree.tad.dataArchitecture.coreEntities)
+    : [];
+  /** @type {Array<{ id: string, why: string }>} */
+  const draftFindings = [];
+  let totalInterfaces = 0;
+  for (const tac of tacs) {
+    if (parseTacPurposeDraft(tac)) {
+      draftFindings.push({ id: tac.tacId, why: 'draft TAC purpose pre-populated at L1, not yet settled' });
+    }
+    for (const iface of tac.interfaces ?? []) {
+      totalInterfaces += 1;
+      if (parseInterfaceDraft(iface)) {
+        draftFindings.push({ id: `${tac.tacId}:${iface?.name ?? '(unnamed)'}`, why: 'draft interface pre-populated at L1, not yet settled' });
+      }
+    }
+  }
+  for (const entity of coreEntities) {
+    if (parseCoreEntityDraft(entity)) {
+      draftFindings.push({ id: `TAD.entity:${entity?.name ?? '(unnamed)'}`, why: 'draft core entity pre-populated at L1, not yet settled' });
+    }
+  }
+  const totalDraftHomes = tacs.length + totalInterfaces + coreEntities.length;
+  return makeCheck('shapes:draftSettled', 'tree', Math.max(totalDraftHomes, 1), draftFindings);
+}
+
+/**
+ * Compute the `shapes:entityJoin` check (engineer, tree-wide). Pure.
+ * Ruling R5 2026-10-05 (ADR-4138): every entry in
+ * `TAD.dataArchitecture.coreEntities` must be named by exactly one
+ * `recordShape` across the whole tree (matching on the recordShape's
+ * `name` field or an `entity:` line in its description, with a
+ * `[draft]` prefix stripped before the scan). The check runs ahead of
+ * the D3 scope early-return so a narrowed scope that excludes every
+ * recordShape still reports an unjoined entity.
+ *
+ * @param {StageContext} ctx
+ * @returns {ReturnType<typeof makeCheck>}
+ */
+function computeEntityJoinCheck(ctx) {
+  const tree = ctx.tree;
+  const coreEntities = Array.isArray(tree.tad?.dataArchitecture?.coreEntities)
+    ? /** @type {any[]} */ (tree.tad.dataArchitecture.coreEntities)
+    : [];
+  /** @type {Array<{ id: string, why: string }>} */
+  const joinFindings = [];
+  const recordShapesByEntity = new Map();
+  for (const tac of tree.tacs ?? []) {
+    for (const iface of tac.interfaces ?? []) {
+      if (iface?.kind !== 'recordShape') continue;
+      const ownerLabel = `${tac.tacId}:${iface?.name ?? '(unnamed)'}`;
+      const names = new Set();
+      if (typeof iface?.name === 'string') names.add(iface.name);
+      const desc = typeof iface?.description === 'string' ? stripDraftPrefix(iface.description) : '';
+      const entityRe = /(^|\n)\s*(?:[-*]\s*)?entity\s*[:=]\s*["'`]?([A-Za-z_][A-Za-z0-9_]*)/g;
+      let em;
+      while ((em = entityRe.exec(desc)) !== null) {
+        if (em[2]) names.add(em[2]);
+      }
+      for (const name of names) {
+        const owners = recordShapesByEntity.get(name) ?? [];
+        owners.push(ownerLabel);
+        recordShapesByEntity.set(name, owners);
+      }
+    }
+  }
+  for (const entity of coreEntities) {
+    const name = typeof entity?.name === 'string' ? entity.name : null;
+    if (!name) continue;
+    const owners = recordShapesByEntity.get(name) ?? [];
+    if (owners.length === 0) {
+      joinFindings.push({ id: `TAD.entity:${name}`, why: 'no record shape' });
+    } else if (owners.length > 1) {
+      joinFindings.push({ id: `TAD.entity:${name}`, why: `${owners.length} record shapes` });
+    }
+  }
+  return makeCheck('shapes:entityJoin', 'tree', coreEntities.length, joinFindings);
+}
+
 /**
  * D3 -- Interface contracts and shapes. 0.29.0 runs the cheap
  * presence, closed-vocabulary and draft-marker checks
@@ -1055,10 +1265,30 @@ export function checkD3Shapes(ctx) {
   const coreEntities = Array.isArray(tree.tad?.dataArchitecture?.coreEntities)
     ? /** @type {any[]} */ (tree.tad.dataArchitecture.coreEntities)
     : [];
-  const draftEntities = coreEntities.filter(parseCoreEntityDraft);
 
-  if (tacsInScope.length === 0 && shapedReqInScope.length === 0 && draftEntities.length === 0) {
-    return notApplicable('D3', gate, 'no TAC, no shaped REQ (httpApi/persistence/auth) and no [draft] core entity in scope');
+  // Ruling R2+R5 2026-10-05 (ADR-4138): shapes:draftSettled and
+  // shapes:entityJoin are tree-wide checks; evaluate them before any
+  // scope early-return so a narrowed D3 scope that excludes every TAC
+  // and shaped REQ still reports a [draft] anywhere in the tree and an
+  // unjoined core entity.
+  const draftCheck = computeDraftSettledCheck(ctx);
+  const entityJoinCheck = computeEntityJoinCheck(ctx);
+
+  if (tacsInScope.length === 0 && shapedReqInScope.length === 0) {
+    const treeWideFailure = treeWideFailureEnvelope(
+      'D3', gate,
+      [
+        { name: 'shapes:draftSettled', check: draftCheck },
+        { name: 'shapes:entityJoin', check: entityJoinCheck },
+      ],
+      { currentTreeHash: ctx.currentTreeHash ?? null, freezeGates: /** @type {any} */ (ctx.freeze?.gates) },
+    );
+    if (treeWideFailure) return treeWideFailure;
+    // Ruling R2 2026-10-05: `[draft]` is tree-wide (not a D3 scope
+    // input), so the pre-R2 reason trailer "and no [draft] core entity
+    // in scope" was stale -- the applicability condition is just the
+    // two local-scope sets.
+    return notApplicable('D3', gate, 'no TAC and no shaped REQ (httpApi/persistence/auth) in scope');
   }
 
   const checks = [];
@@ -1072,40 +1302,26 @@ export function checkD3Shapes(ctx) {
     noIfaceTacs.map((t) => ({ id: t.tacId, why: 'no interfaces authored' })),
   ));
 
-  // Check 2: every interface kind is in the closed vocabulary.
-  // Check 3: no description across the three draft homes still
-  // carries the `[draft]` marker. A draft shape is entry material
-  // the agent pre-populates after L1; the engineer removes the
-  // marker when the shape is settled. `tacHasInterface` and
-  // `kindVocabulary` apply equally to drafts.
+  // Check 2: every interface kind is in the closed vocabulary (over
+  // delta; drafts included).
   let totalInterfaces = 0;
   const badKinds = [];
-  const draftFindings = [];
   for (const tac of tacsInScope) {
-    if (parseTacPurposeDraft(tac)) {
-      draftFindings.push({ id: tac.tacId, why: 'draft TAC purpose pre-populated at L1, not yet settled' });
-    }
     for (const iface of tac.interfaces ?? []) {
       totalInterfaces += 1;
       const kind = iface?.kind;
       if (typeof kind !== 'string' || !INTERFACE_KINDS_SET.has(kind)) {
         badKinds.push({ id: `${tac.tacId}:${iface?.name ?? '(unnamed)'}`, why: `unknown interface kind ${JSON.stringify(kind)}` });
       }
-      if (parseInterfaceDraft(iface)) {
-        draftFindings.push({ id: `${tac.tacId}:${iface?.name ?? '(unnamed)'}`, why: 'draft interface pre-populated at L1, not yet settled' });
-      }
     }
   }
-  for (const entity of draftEntities) {
-    draftFindings.push({ id: `TAD.entity:${entity?.name ?? '(unnamed)'}`, why: 'draft core entity pre-populated at L1, not yet settled' });
-  }
-  // Total for the draft check is every draft home that could carry
-  // the marker on an in-scope TAC plus every core entity (tree-wide):
-  // the TAC itself (its purpose) + every interface on it, plus the
-  // coreEntities list.
-  const totalDraftHomes = tacsInScope.length + totalInterfaces + coreEntities.length;
   checks.push(makeCheck('shapes:kindVocabulary', 'delta', totalInterfaces, badKinds));
-  checks.push(makeCheck('shapes:draftSettled', 'delta', totalDraftHomes, draftFindings));
+
+  // Check 3: shapes:draftSettled. Ruling R2 2026-10-05: tree-wide (a
+  // [draft] anywhere is unfinished work). Computed by
+  // computeDraftSettledCheck so the same check is reused ahead of the
+  // scope early-return.
+  checks.push(draftCheck);
 
   // ADR-4131 (0.30.0 PR 5): three D3 bite checks follow.
   // Check 4: shapes:templateMarkers (engineer, over delta). For every
@@ -1132,46 +1348,10 @@ export function checkD3Shapes(ctx) {
   }
   checks.push(makeCheck('shapes:templateMarkers', 'delta', totalInterfaces, templateFindings));
 
-  // Check 5: shapes:entityJoin (engineer, over tree). Every entry in
-  // TAD.dataArchitecture.coreEntities must be named by exactly one
-  // recordShape across the whole tree (not just the delta scope),
-  // matching on the recordShape's `name` field or on an `entity:` line
-  // in its description. A `[draft]` prefix is stripped before the
-  // entity-line scan so a draft recordShape still joins.
-  /** @type {Array<{ id: string, why: string }>} */
-  const joinFindings = [];
-  const treeTacs = tree.tacs ?? [];
-  const recordShapesByEntity = new Map();
-  for (const tac of treeTacs) {
-    for (const iface of tac.interfaces ?? []) {
-      if (iface?.kind !== 'recordShape') continue;
-      const ownerLabel = `${tac.tacId}:${iface?.name ?? '(unnamed)'}`;
-      const names = new Set();
-      if (typeof iface?.name === 'string') names.add(iface.name);
-      const desc = typeof iface?.description === 'string' ? stripDraftPrefix(iface.description) : '';
-      const entityRe = /(^|\n)\s*(?:[-*]\s*)?entity\s*[:=]\s*["'`]?([A-Za-z_][A-Za-z0-9_]*)/g;
-      let em;
-      while ((em = entityRe.exec(desc)) !== null) {
-        if (em[2]) names.add(em[2]);
-      }
-      for (const name of names) {
-        const owners = recordShapesByEntity.get(name) ?? [];
-        owners.push(ownerLabel);
-        recordShapesByEntity.set(name, owners);
-      }
-    }
-  }
-  for (const entity of coreEntities) {
-    const name = typeof entity?.name === 'string' ? entity.name : null;
-    if (!name) continue;
-    const owners = recordShapesByEntity.get(name) ?? [];
-    if (owners.length === 0) {
-      joinFindings.push({ id: `TAD.entity:${name}`, why: 'no record shape' });
-    } else if (owners.length > 1) {
-      joinFindings.push({ id: `TAD.entity:${name}`, why: `${owners.length} record shapes` });
-    }
-  }
-  checks.push(makeCheck('shapes:entityJoin', 'tree', coreEntities.length, joinFindings));
+  // Check 5: shapes:entityJoin. Ruling R5 2026-10-05: tree-wide by
+  // definition. Computed by computeEntityJoinCheck so the same check
+  // is reused ahead of the scope early-return (ADR-4138).
+  checks.push(entityJoinCheck);
 
   // Check 6: shapes:pathsResolve (engineer, over delta). Any path:
   // token on an in-scope interface description must either resolve
@@ -1363,27 +1543,17 @@ export function checkD4Stories(ctx) {
 // ---------------------------------------------------------------------------
 
 /**
- * D5 -- Cross-cutting weave. 0.29.0 runs cheap presence checks.
- *
- * SEAM 0.30: full concern catalogue with per-shape applicability;
- * per-(concern, REQ) pair enumeration; TAD securityArchitecture and
- * operationalConcerns structure checks beyond presence.
+ * Compute the `crosscut:securityArchitecture` check (engineer,
+ * tree-wide). Pure. Ruling R13 2026-10-05 (ADR-4138 extended): if the
+ * tree carries any REQ with shape `auth` or `httpApi`, TAD.securityArchitecture
+ * must be non-empty. Runs ahead of the D5 scope early-return so a
+ * narrowed scope that excludes the auth REQ still reports the finding.
  *
  * @param {StageContext} ctx
+ * @returns {ReturnType<typeof makeCheck>}
  */
-export function checkD5Crosscut(ctx) {
-  const gate = STAGE_GATES.D5;
-  const scope = asSet(ctx.scope);
+function computeSecurityArchitectureCheck(ctx) {
   const tree = ctx.tree;
-  const reqInScope = (tree.requirements ?? []).filter((r) => scope.has(r.reqId));
-
-  if (reqInScope.length === 0) {
-    return notApplicable('D5', gate, 'no REQ in scope');
-  }
-
-  const checks = [];
-
-  // Check 1: TAD.securityArchitecture non-empty when any REQ carries shape 'auth' or 'httpApi'.
   const authApi = (tree.requirements ?? []).some((r) => {
     const s = r.shapeClassification?.shapes ?? [];
     return s.includes('auth') || s.includes('httpApi');
@@ -1396,11 +1566,22 @@ export function checkD5Crosscut(ctx) {
       secFail.push({ id: 'TAD.securityArchitecture', why: 'empty while auth or httpApi REQ exists' });
     }
   }
-  checks.push(makeCheck('crosscut:securityArchitecture', 'tree', authApi ? 1 : 0, secFail));
+  return makeCheck('crosscut:securityArchitecture', 'tree', authApi ? 1 : 0, secFail);
+}
 
-  // Check 2: TAD.operationalConcerns non-empty when any AC description
-  // carries the '[deployed]' marker (a cheap presence signal that
-  // proposal §3.2 D5 lists as 'deployed-scope AC').
+/**
+ * Compute the `crosscut:operationalConcerns` check (engineer,
+ * tree-wide). Pure. Ruling R13 2026-10-05 (ADR-4138 extended): if any
+ * AC description tree-wide carries the `[deployed]` marker, then
+ * TAD.operationalConcerns must be non-empty. Runs ahead of the D5
+ * scope early-return.
+ *
+ * @param {StageContext} ctx
+ * @returns {ReturnType<typeof makeCheck>}
+ */
+function computeOperationalConcernsCheck(ctx) {
+  const tree = ctx.tree;
+  const tad = /** @type {any} */ (tree.tad ?? {});
   const hasDeployedAc = (tree.userStories ?? []).some((us) => (us.acceptanceCriteria ?? []).some((ac) => typeof ac?.description === 'string' && ac.description.includes('[deployed]')));
   const opFail = [];
   if (hasDeployedAc) {
@@ -1409,7 +1590,59 @@ export function checkD5Crosscut(ctx) {
       opFail.push({ id: 'TAD.operationalConcerns', why: 'empty while deployed-scope AC exists' });
     }
   }
-  checks.push(makeCheck('crosscut:operationalConcerns', 'tree', hasDeployedAc ? 1 : 0, opFail));
+  return makeCheck('crosscut:operationalConcerns', 'tree', hasDeployedAc ? 1 : 0, opFail);
+}
+
+/**
+ * D5 -- Cross-cutting weave. 0.29.0 runs cheap presence checks.
+ *
+ * SEAM 0.30: full concern catalogue with per-shape applicability;
+ * per-(concern, REQ) pair enumeration; TAD securityArchitecture and
+ * operationalConcerns structure checks beyond presence.
+ *
+ * @param {StageContext} ctx
+ */
+export function checkD5Crosscut(ctx) {
+  const gate = STAGE_GATES.D5;
+  const scope = asSet(ctx.scope);
+  const tree = ctx.tree;
+  const reqInScope = (tree.requirements ?? []).filter((r) => scope.has(r.reqId));
+
+  // Ruling R13 2026-10-05 (ADR-4138 extended, PR 292 follow-up):
+  // crosscut:securityArchitecture and crosscut:operationalConcerns are
+  // tree-wide checks; evaluate them before any scope early-return so a
+  // narrowed D5 scope that excludes the triggering REQ or AC still
+  // reports an empty TAD.securityArchitecture / TAD.operationalConcerns.
+  const securityCheck = computeSecurityArchitectureCheck(ctx);
+  const operationalCheck = computeOperationalConcernsCheck(ctx);
+
+  if (reqInScope.length === 0) {
+    const treeWideFailure = treeWideFailureEnvelope(
+      'D5', gate,
+      [
+        { name: 'crosscut:securityArchitecture', check: securityCheck },
+        { name: 'crosscut:operationalConcerns', check: operationalCheck },
+      ],
+      { currentTreeHash: ctx.currentTreeHash ?? null, freezeGates: /** @type {any} */ (ctx.freeze?.gates) },
+    );
+    if (treeWideFailure) return treeWideFailure;
+    return notApplicable('D5', gate, 'no REQ in scope');
+  }
+
+  const checks = [];
+
+  // Check 1: TAD.securityArchitecture non-empty when any REQ carries
+  // shape 'auth' or 'httpApi'. Ruling R13 2026-10-05: tree-wide;
+  // computed by computeSecurityArchitectureCheck so the same check is
+  // reused ahead of the scope early-return (ADR-4138 extended).
+  checks.push(securityCheck);
+
+  // Check 2: TAD.operationalConcerns non-empty when any AC description
+  // carries the '[deployed]' marker (a cheap presence signal that
+  // proposal §3.2 D5 lists as 'deployed-scope AC'). Ruling R13
+  // 2026-10-05: tree-wide; computed by computeOperationalConcernsCheck
+  // so the same check is reused ahead of the scope early-return.
+  checks.push(operationalCheck);
 
   // Check 3: no open concern-ledger entry on a REQ in scope.
   const concerns = /** @type {any} */ (ctx.ledgers?.concerns);
@@ -1831,10 +2064,24 @@ function extractThenFieldTokens(thenClause) {
 /**
  * Collect every interface the tree "reaches" from an AC `ownerRef` or
  * a REQ `deliveredBy` (REQ-174 companion field). The result is a Set
- * of `<tacId>:<name>` keys. A `deliveredBy` on a REQ can take two
- * shapes: an array of `TAC-nnnn:<name>` pointer strings, or an array
- * of plain TAC ids ("delivered by this TAC"); the second shape reaches
- * every interface on the named TAC.
+ * of `<tacId>:<name>` keys.
+ *
+ * REQ `deliveredBy` takes two canonical shapes, both accepted here:
+ *   1. The schema-canonical object form `{tacId, adrId?, field?}`
+ *      (`@stravica-ai/rcf-schemas` 0.6.3 `$defs.deliveredBy`). When
+ *      `tacId` is present:
+ *        - `field: interfaces[<name>]` reaches `{tacId}:{name}` (one
+ *          interface), via `parseOwnerRefInterfaceField`.
+ *        - any other `field`, or no `field`, reaches every interface
+ *          on the named TAC (the "delivered by this TAC" meaning).
+ *      An `adrId`-only deliveredBy does not reach any TAC interface.
+ *   2. A legacy array of pointer strings: `TAC-nnnn:<name>` reaches
+ *      one interface, a bare `TAC-nnnn` reaches every interface on
+ *      that TAC.
+ *
+ * Issue 301 (2026-10-06): the array-only guard dropped every
+ * schema-canonical object deliveredBy and false-positived every
+ * blueprint TAC interface.
  *
  * @param {import('#core/store/walker.js').TreeModel} tree
  * @returns {Set<string>}
@@ -1852,19 +2099,40 @@ function collectReachedInterfaces(tree) {
       out.add(`${ref.tacId}:${name}`);
     }
   }
-  // REQ deliveredBy (optional field; shapes above).
+  // REQ deliveredBy. Both shapes documented above.
   for (const req of tree.requirements ?? []) {
     const deliveredBy = /** @type {any} */ (req)?.deliveredBy;
-    if (!Array.isArray(deliveredBy)) continue;
-    for (const entry of deliveredBy) {
-      if (typeof entry !== 'string' || entry.length === 0) continue;
-      const m = entry.match(/^(TAC-[A-Za-z0-9-]+):(.+)$/);
-      if (m) {
-        out.add(`${m[1]}:${m[2]}`);
+    if (deliveredBy == null) continue;
+    if (Array.isArray(deliveredBy)) {
+      for (const entry of deliveredBy) {
+        if (typeof entry !== 'string' || entry.length === 0) continue;
+        const m = entry.match(/^(TAC-[A-Za-z0-9-]+):(.+)$/);
+        if (m) {
+          out.add(`${m[1]}:${m[2]}`);
+          continue;
+        }
+        // Plain TAC id: every interface on that TAC is reached.
+        const tac = (tree.tacs ?? []).find((t) => t?.tacId === entry);
+        if (!tac) continue;
+        for (const iface of tac.interfaces ?? []) {
+          if (typeof iface?.name === 'string') out.add(`${tac.tacId}:${iface.name}`);
+        }
+      }
+      continue;
+    }
+    if (typeof deliveredBy === 'object') {
+      const tacId = /** @type {any} */ (deliveredBy).tacId;
+      if (typeof tacId !== 'string' || tacId.length === 0) continue;
+      const field = /** @type {any} */ (deliveredBy).field;
+      const name = parseOwnerRefInterfaceField(field);
+      if (name) {
+        out.add(`${tacId}:${name}`);
         continue;
       }
-      // Plain TAC id: every interface on that TAC is reached.
-      const tac = (tree.tacs ?? []).find((t) => t?.tacId === entry);
+      // No field, or a field that does not name an interface: reach
+      // every interface on the named TAC (the "delivered by this TAC"
+      // meaning carried over from the array-shape bare TAC pointer).
+      const tac = (tree.tacs ?? []).find((t) => t?.tacId === tacId);
       if (!tac) continue;
       for (const iface of tac.interfaces ?? []) {
         if (typeof iface?.name === 'string') out.add(`${tac.tacId}:${iface.name}`);