rcf-lite 0.32.0 → 0.32.2

package/CHANGELOG.md

@@ -6,6 +6,26 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 ## [Unreleased]
 
+## [0.32.2] - 2026-10-06
+
+0.32.2 ships two Dex-lane fixes merged since 0.32.1 (merge b478a4e) as the WESPA readiness alignment release. D6 consistency:unsatisfiable now context-gates backticked identifiers in AC then-clauses so enum values, query-string parameter names, sort and filter literals, env-var names and config knobs stop being read as record-shape field names, and `rcf discover req-baseline opt-out` and `rcf define ledger concerns add` honour `--dry-run` by writing nothing. breaking: false; no behavioural changes on verbs consumers run in CI; fixes only. minAgentAction: null; the managed agent-instructions block hash did not move.
+
+### Fixed
+
+- **D6 consistency:unsatisfiable stops reading backticked enum values, query-string parameter names, sort and filter literals, env-var and config-knob names as record-shape field names (issue 311, w-2026-10-06-dave-050).** `extractThenFieldTokens` in `src/query/gates.js` previously fired `consistency:unsatisfiable` on any backticked identifier in an AC `then` clause and treated every token it caught as a field some `recordShape` had to define. On WESPA (rcf-lite 0.31.0, main `df0fa47e`) 345 of 532 flagged tokens were not fields: HTTP error-envelope `code` enum values like `VALIDATION_ERROR` and `AUTH_TOKEN_INVALID_SIGNATURE`, pagination query-string keys like `pageSize`, `offset`, `cursors` and sort-order values like `asc`, `desc`, `next`, filter and match-mode literals like `query`, `exact`, `in`, env-var names like `BUILD_GIT_COMMIT_SHORT` and config knobs like `maxDiffPixelRatio`, `fullPath`, `workerAdminUser`. Fix: pattern 1 (bare backticked identifier) is now context-gated. ALL_CAPS tokens (enum values, env vars, constants) are skipped unconditionally. Other backticked tokens count only when a field-signalling word (a verb like `set`, `write`, `include`, `return`, `contain`; a predicate like `is set`, `is written`, `equals`, `holds`; or a context word like `field`, `record shape`, `response body`, `request body`, `payload`, `envelope`) sits within a short neighbourhood AND no explicit non-field context (`query parameter`, `query-string`, `sort order`, `sort direction`, `filter mode`, `match mode`, `enum value`, `env var`, `environment variable`, `config knob`, `config key`, `header name`, `cli flag`) overlaps the same neighbourhood. Pattern 4 added: `<ShapeName>.<fieldName>` dot notation is now read as a schema-style field reference. Patterns 2 (`<name> field`) and 3 (`field: <name>`) are preserved and the AC-12113-2 class is unchanged: a then-clause that names a real undefined field still fails. Regression fixtures in `test/query/gates.test.js` cover each of the five WESPA token patterns from the issue plus a dot-notation negative control and a plain-prose negative control. Expected drop on WESPA: 345 unsatisfiable findings removed; the 187 true-positive findings and all AC-12113-2 class failures remain.
+
+- **`--dry-run` on `rcf discover req-baseline opt-out` and `rcf define ledger concerns add` writes nothing (issue 310, w-2026-10-06-dave-050).** Both verbs accepted the flag but wrote the opt-out record to `rcf/manifest.json` (`baselineAcOptOuts[]`) and created `rcf/define/concern-ledger.json` with the appended entry respectively, mutating viewer clones on rehearsal runs. Fix: `src/cli/req-baseline.js` opt-out verb and `src/cli/ledger.js` concerns handler both check `flags['dry-run']` before the write and emit a `[dry-run]` preview line (or a `{dryRun: true, ...}` JSON payload with `--json`) and exit 0. Help text updated on both verbs to document the flag. Regression tests in `test/cli/req-baseline-opt-out-dry-run.test.js` (new) and `test/cli/ledger.test.js` assert the on-disk bytes under `rcf/` are byte-equal before and after each dry-run and that the positive control (no `--dry-run`) still writes.
+
+## [0.32.1] - 2026-10-06
+
+0.32.1 ships two fixes merged since 0.32.0 (merge b6292f5) on top of the layout baseline chore. The viewer's Readiness tab now agrees with the CLI on D3 shapes:pathsResolve, and the D5 crosscut:operationalConcerns trigger reads the structured ac.scope field in addition to the legacy "[deployed]" marker. breaking: false; no behavioural changes on verbs consumers run in CI; fixes only. minAgentAction: null; the managed agent-instructions block hash did not move.
+
+### Fixed
+
+- **Viewer Readiness tab D3 shapes:pathsResolve now agrees with the CLI (issue 307, w-2026-10-06-dave-026).** The viewer's render path (`src/view/index.js` `renderModelToPage`) called `computeReadiness` without the `resolvedPaths` pre-walk, so D3 shapes:pathsResolve false-failed on TAC interface `path:` tokens that resolve on disk and the Readiness tab disagreed with the CLI and freeze. Hit on ai-baseline define/kickoff: CLI reported D3 4/4 passing while the viewer tab showed D3 shapes:pathsResolve failing on four TAC interface paths. Fix: thread `resolvedPaths` through the viewer compute via the same `resolveInterfacePaths` seam the CLI (PR 304, issue 302) and freeze use. The viewer compute now runs the resolve walk against `projectRoot` before `computeReadiness` and passes the resulting `resolvedPaths` set to the compute. The pure gate reads it unchanged. Additive: `renderModelToPage` also returns the computed readiness so a regression test can assert the viewer's check state without parsing HTML. Regression test in `test/view/readiness-paths-resolve-307.test.js` seeds a TAC interface whose `path:` token points at a real file and asserts the viewer compute reports D3 ok; the negative control flips the path to a missing file and asserts D3 fails with the shapes:pathsResolve finding.
+
+- **D5 crosscut:operationalConcerns trigger reads structured `ac.scope` (issue 306, w-2026-10-06-dave-031).** `computeOperationalConcernsCheck` in `src/query/gates.js` looked only for a literal `[deployed]` marker in AC description text, so trees that carry scope as the schema-canonical field `scope: "deployed"` (like ai-baseline, with 23 deployed-scope ACs and `TAD.operationalConcerns` absent) silently passed 0/0 and the gate never fired. Fix: the trigger now also reads `ac.scope === "deployed"`; a deployed-scope AC on either form must find a non-empty `TAD.operationalConcerns`. Legacy `[deployed]` markers are unchanged. Regression fixtures in `test/query/gates.test.js` cover the ai-baseline shape (structured `ac.scope` with empty `operationalConcerns` fails) and a negative control (non-deployed-scope ACs with empty `operationalConcerns` pass).
+
 ## [0.32.0] - 2026-10-06
 
 0.32.0 ships four readiness and viewer fixes merged since 0.31.0 (merge ec9464db) as one release. D6 consistency:orphanInterfaces now accepts the schema-canonical object-shape REQ.deliveredBy (issue 301), D3 shapes:pathsResolve inside rcf define freeze pre-resolves TAC interface path tokens the way readiness does (issue 302), the deploy-cloudflare-workers blueprint reworded AC-12113-2 so D6 consistency:unsatisfiable stops reading "absent" as a field name (PR 300), the viewer's SSE tree-update resync preserves the active tab for every main tab including Readiness (issue 297), and the audit view header keeps the tabs visible under long project names and prefers prd.productName (issue 295). minAgentAction: null; the managed agent-instructions block hash did not move.

package/blueprints/delivery-ci-workflows/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## Unreleased
+
+- adds ownerRef on AC-6102-1 (interfaces[entry-point CLI]), AC-6103-1 (interfaces[gate-descriptor]), AC-6108-1 (interfaces[aggregate-report-schema]), AC-6111-1 (interfaces[entry-point CLI]), AC-6111-2 (interfaces[workflow-shape]), AC-6121-2 (interfaces[release-mode]), AC-6122-1 (interfaces[entry-point CLI]) and AC-6123-1 (interfaces[entry-point CLI]) so TAC-701 gate-descriptor and entry-point CLI, TAC-703 aggregate-report-schema, TAC-704 workflow-shape and entry-point CLI, TAC-705 release-mode and entry-point CLI, and TAC-706 entry-point CLI have delivering AC owners (D6 consistency:orphanInterfaces).
+
+
 ## 2.3.5 - 2026-09-11
 
 probe-utils.writeReport no longer promotes an all-accountBoundSkipped row set to PASS via a separate override; aggregate() already returns PASS for a pure-skip set on its own and returns WARN when any WARN row is present, so an all-skipped array carrying a WARN row is no longer silently promoted. Anatomy suite tracks the strengthened shared helper.

package/blueprints/delivery-ci-workflows/contributions/user-stories/delivery-ci-workflows-us-6102.json

@@ -17,7 +17,11 @@
       "then": "the aggregate report's `runner.entryPoint` field records a project-relative path to a `.js` or `.mjs` file that exists at that path in the tree",
       "testable": true,
       "scope": "runtime",
-      "disposition": "fixed"
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-701-delivery-ci-workflows-gate-runner",
+        "field": "interfaces[entry-point CLI]"
+      }
     },
     {
       "id": "AC-6102-2",

package/blueprints/delivery-ci-workflows/contributions/user-stories/delivery-ci-workflows-us-6103.json

@@ -17,7 +17,11 @@
       "then": "the file exists, its `gate` field is `validate`, its `command` field names the `rcf define validate` invocation, its `exitCode` field records the underlying process exit code, and its `stdout` and `stderr` fields carry the captured streams",
       "testable": true,
       "scope": "runtime",
-      "disposition": "template"
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-701-delivery-ci-workflows-gate-runner",
+        "field": "interfaces[gate-descriptor]"
+      }
     },
     {
       "id": "AC-6103-2",

package/blueprints/delivery-ci-workflows/contributions/user-stories/delivery-ci-workflows-us-6108.json

@@ -17,7 +17,11 @@
       "then": "the aggregate report's `gates[]` array contains a `coverage-strict` entry with `outcome: missing`, its `reason` field carries a non-empty string, and the aggregate `verdict` is `failed`",
       "testable": true,
       "scope": "runtime",
-      "disposition": "template"
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-703-delivery-ci-workflows-aggregate-report",
+        "field": "interfaces[aggregate-report-schema]"
+      }
     },
     {
       "id": "AC-6108-2",

package/blueprints/delivery-ci-workflows/contributions/user-stories/delivery-ci-workflows-us-6111.json

@@ -17,7 +17,11 @@
       "then": "the materialiser reads the file at the documented path and treats its `workflowShape` as authoritative",
       "testable": true,
       "scope": "runtime",
-      "disposition": "template"
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-704-delivery-ci-workflows-workflow-materialiser",
+        "field": "interfaces[entry-point CLI]"
+      }
     },
     {
       "id": "AC-6111-2",
@@ -27,7 +31,11 @@
       "then": "the materialiser processes the recognised fields (including the substitution-surface trio) and ignores the unknown fields without failing the boot-check",
       "testable": true,
       "scope": "runtime",
-      "disposition": "template"
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-704-delivery-ci-workflows-workflow-materialiser",
+        "field": "interfaces[workflow-shape]"
+      }
     },
     {
       "id": "AC-6111-3",

package/blueprints/delivery-ci-workflows/contributions/user-stories/delivery-ci-workflows-us-6121.json

@@ -27,7 +27,11 @@
       "then": "the release workflow creates the release entity, runs the artefact-publish step, uploads the published artefact to the release entity, and records the just-published version identifier in the aggregate report",
       "testable": true,
       "scope": "runtime",
-      "disposition": "template"
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-705-delivery-ci-workflows-release-workflow",
+        "field": "interfaces[release-mode]"
+      }
     },
     {
       "id": "AC-6121-3",

package/blueprints/delivery-ci-workflows/contributions/user-stories/delivery-ci-workflows-us-6122.json

@@ -17,7 +17,11 @@
       "then": "the release workflow dispatches the promote workflow with `versionId` set to the just-published version identifier and waits on the promote workflow's outcome",
       "testable": true,
       "scope": "runtime",
-      "disposition": "template"
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-705-delivery-ci-workflows-release-workflow",
+        "field": "interfaces[entry-point CLI]"
+      }
     },
     {
       "id": "AC-6122-2",

package/blueprints/delivery-ci-workflows/contributions/user-stories/delivery-ci-workflows-us-6123.json

@@ -17,7 +17,11 @@
       "then": "a `scheduled-audit` workflow file lands at the provider's workflow path, its trigger set names a cron schedule, and its command line invokes the Node gate-runner entry point with the required check set writing to the distinct report path",
       "testable": true,
       "scope": "runtime",
-      "disposition": "template"
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-706-delivery-ci-workflows-scheduled-audit",
+        "field": "interfaces[entry-point CLI]"
+      }
     },
     {
       "id": "AC-6123-2",

package/blueprints/deploy-cloudflare-workers/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## Unreleased
+
+- adds ownerRef on AC-12103-1 (interfaces[workerIdentity]) and AC-12110-1 (interfaces[probeUrl]) so the preview URL resolver's workerIdentity and probeUrl interfaces have delivering AC owners (D6 consistency:orphanInterfaces).
+
+
 ## 1.3.2 (register patch, 2026-09-10)
 
 - Register: neutral wording on the ADR-1306 consequences field (closes F-1); no capability change.

package/blueprints/deploy-cloudflare-workers/contributions/user-stories/deploy-cloudflare-workers-us-12103.json

@@ -17,7 +17,11 @@
       "then": "both responses carry the `versionSha` field of V's build provenance in the health-probe body, and the two responses agree on that field",
       "testable": true,
       "scope": "deployed",
-      "disposition": "template"
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-1303-deploy-cloudflare-workers-preview-url-resolver",
+        "field": "interfaces[workerIdentity]"
+      }
     },
     {
       "id": "AC-12103-2",

package/blueprints/deploy-cloudflare-workers/contributions/user-stories/deploy-cloudflare-workers-us-12110.json

@@ -17,7 +17,11 @@
       "then": "at least one HTTP request to the production URL's `/healthz` completes within the sixty-second window; the request carries no `Authorization` header that would bypass a production auth layer; the retry count for any single probe does not exceed six",
       "testable": true,
       "scope": "deployed",
-      "disposition": "template"
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-1303-deploy-cloudflare-workers-preview-url-resolver",
+        "field": "interfaces[probeUrl]"
+      }
     },
     {
       "id": "AC-12110-2",

package/blueprints/email-smtp-resend/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## Unreleased
+
+- adds ownerRef on AC-4106-1 (interfaces[smtpClient]), AC-4104-2 (interfaces[auditSink]) and AC-4105-1 (interfaces[verifierClock]) so TAC-401 smtpClient and TAC-402 auditSink and verifierClock have delivering AC owners (D6 consistency:orphanInterfaces).
+
+
 ## 1.1.7 - 2026-09-11
 
 unverified-sender-refusal AC-4102-1 and AC-4102-2 rows are de-claimed to conformanceOnly. The refusal is driven by the local catch-all SMTP fixture (fixture-as-engine) and carries no Resend-returned message id, so the identifier half of the strict-evidence contract is not satisfied here. The live real-account-resend-send row (AC-4101-2) is unchanged.

package/blueprints/email-smtp-resend/contributions/user-stories/email-smtp-resend-us-4104.json

@@ -27,7 +27,11 @@
       "then": "the response status is 401, the response body is empty, the handler invocation counter is unchanged, and the audit sink observes exactly one `webhookVerificationFailed` event",
       "testable": true,
       "scope": "runtime",
-      "disposition": "fixed"
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-402-email-smtp-resend-webhook-verifier",
+        "field": "interfaces[auditSink]"
+      }
     },
     {
       "id": "AC-4104-3",

package/blueprints/email-smtp-resend/contributions/user-stories/email-smtp-resend-us-4105.json

@@ -17,7 +17,11 @@
       "then": "the response status is 401, the response body is empty, the handler invocation counter is unchanged, and the audit sink observes exactly one `webhookReplayStale` event",
       "testable": true,
       "scope": "runtime",
-      "disposition": "template"
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-402-email-smtp-resend-webhook-verifier",
+        "field": "interfaces[verifierClock]"
+      }
     },
     {
       "id": "AC-4105-2",

package/blueprints/email-smtp-resend/contributions/user-stories/email-smtp-resend-us-4106.json

@@ -17,7 +17,11 @@
       "then": "the scan returns exactly one module and that module is the adapter module",
       "testable": true,
       "scope": "runtime",
-      "disposition": "fixed"
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-401-email-smtp-resend-send-adapter",
+        "field": "interfaces[smtpClient]"
+      }
     },
     {
       "id": "AC-4106-2",

package/blueprints/observability-probe-endpoints/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## Unreleased
+
+- adds ownerRef on AC-14104-1 (interfaces[listenerFactory]) so the listener-topology's listenerFactory interface has a delivering AC owner (D6 consistency:orphanInterfaces).
+
+
 ## 1.2.5 - 2026-09-11
 
 Anatomy suite tracks the strengthened shared helper (WARN-only shortcut removed, log objects and content lists no longer identifiers, retained anchor existence check). No probe changes required.

package/blueprints/observability-probe-endpoints/contributions/user-stories/observability-probe-endpoints-us-14104.json

@@ -17,7 +17,11 @@
       "then": "a GET against `/live` on port 9091 returns 200, a GET against `/live` on the user-traffic port returns 404 (or the project's default not-found response), and a GET against `/ready` on the user-traffic port returns 404",
       "testable": true,
       "scope": "runtime",
-      "disposition": "template"
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-1503-observability-probe-endpoints-listener-topology",
+        "field": "interfaces[listenerFactory]"
+      }
     },
     {
       "id": "AC-14104-2",

package/fixtures/canary-manifest.json

@@ -2,8 +2,8 @@
   "registerCanary": [
     {
       "id": "rc-2026-10-06-001",
-      "createdAt": "2026-10-06T16:00:03.482Z",
-      "buildVersion": "0.32.0-mockdriver",
+      "createdAt": "2026-10-06T19:49:58.281Z",
+      "buildVersion": "0.32.2-mockdriver",
       "fixturePromptId": "canary-prompt-01",
       "responseWordCount": 55,
       "grades": {
@@ -35,8 +35,8 @@
     },
     {
       "id": "rc-2026-10-06-002",
-      "createdAt": "2026-10-06T16:00:03.483Z",
-      "buildVersion": "0.32.0-mockdriver",
+      "createdAt": "2026-10-06T19:49:58.282Z",
+      "buildVersion": "0.32.2-mockdriver",
       "fixturePromptId": "canary-prompt-02",
       "responseWordCount": 55,
       "grades": {
@@ -68,8 +68,8 @@
     },
     {
       "id": "rc-2026-10-06-003",
-      "createdAt": "2026-10-06T16:00:03.483Z",
-      "buildVersion": "0.32.0-mockdriver",
+      "createdAt": "2026-10-06T19:49:58.282Z",
+      "buildVersion": "0.32.2-mockdriver",
       "fixturePromptId": "canary-prompt-03",
       "responseWordCount": 55,
       "grades": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rcf-lite",
-  "version": "0.32.0",
+  "version": "0.32.2",
   "type": "module",
   "description": "One-install tooling for the Requirements Confidence Framework (RCF): the unified `rcf` CLI grouped into the five RCF tool groups (discover, define, build, verify, audit) plus a small core set (init, doctor, guidance, mcp), an MCP server, the live tree viewer and the fresh-context adversarial ship-gate verifier. Consumes @stravica-ai/rcf-schemas.",
   "license": "Apache-2.0",

package/releases/releases.yaml

@@ -40,8 +40,24 @@
 # `npm install rcf-lite`.
 
 feedVersion: 1
-latest: "0.32.0"
+latest: "0.32.2"
 releases:
+  - version: "0.32.2"
+    date: "2026-10-06"
+    breaking: false
+    headlines:
+      - "rcf-lite 0.32.2 ships two Dex-lane fixes on top of 0.32.1. D6 consistency:unsatisfiable now context-gates backticked identifiers in AC then-clauses so enum values, query-string parameter names, sort and filter literals, env-var names and config knobs stop being read as record-shape field names (issue 311; expected drop on WESPA 345 unsatisfiable findings, 187 true positives remain, AC-12113-2 class unchanged), and `rcf discover req-baseline opt-out` and `rcf define ledger concerns add` honour `--dry-run` by writing nothing (issue 310)."
+    minAgentAction: null
+    notesUrl: "https://stravica.ai/docs/rcf/changelog/"
+
+  - version: "0.32.1"
+    date: "2026-10-06"
+    breaking: false
+    headlines:
+      - "rcf-lite 0.32.1 fixes two readiness gates that false-paired under schema-canonical content on top of 0.32.0. The viewer's Readiness tab D3 shapes:pathsResolve now agrees with the CLI by pre-resolving TAC interface path tokens through the same resolveInterfacePaths seam (issue 307), and the D5 crosscut:operationalConcerns trigger reads the structured ac.scope field in addition to the legacy '[deployed]' marker so trees that carry scope as a schema field no longer silently pass 0/0 (issue 306)."
+    minAgentAction: null
+    notesUrl: "https://stravica.ai/docs/rcf/changelog/"
+
   - version: "0.32.0"
     date: "2026-10-06"
     breaking: false

package/src/cli/ledger.js

@@ -112,6 +112,7 @@ concerns add flags:
   --disposition applied|waived
                             Disposition (required)
   --reason <text>           Reason (mandatory when disposition=waived)
+  --dry-run                 Preview the minted entry; write nothing
 
 probes add flags:
   --req <req-id>            REQ the probe finding sits on (required)
@@ -523,6 +524,20 @@ async function runAdd({ projectRoot, name, flags, stdout, stderr }) {
       name: 'concerns', body, entry, now,
       ...(idOverride !== undefined ? { id: idOverride } : {}),
     });
+    // Issue 310 (0.32.2): --dry-run on concerns add previews the
+    // minted entry without writing the ledger. Prior behaviour
+    // accepted the flag and created `rcf/define/concern-ledger.json`
+    // anyway, mutating viewer clones on rehearsal runs.
+    if (flags['dry-run']) {
+      if (flags.json) {
+        stdout.write(`${JSON.stringify({ dryRun: true, status: step.status, id: step.entry.id, entry: step.entry }, null, 2)}\n`);
+      } else if (step.status === 'unchanged') {
+        stdout.write(`[dry-run] concern-ledger: would be unchanged ${step.entry.id}\n`);
+      } else {
+        stdout.write(`[dry-run] concern-ledger: would add concern ${step.entry.id}\n`);
+      }
+      return 0;
+    }
     if (step.status === 'unchanged') {
       if (flags.json) {
         stdout.write(`${JSON.stringify({ status: 'unchanged', id: step.entry.id, entry: step.entry }, null, 2)}\n`);

package/src/cli/req-baseline.js

@@ -60,12 +60,14 @@ Verbs:
                              (silence-refuses-build queue) without
                              prompting.
 
-  opt-out --req <id> --key <baselineKey> --reason "..." [--scope req|project]
+  opt-out --req <id> --key <baselineKey> --reason "..." [--scope req|project] [--dry-run]
                              Record an operator ruling that removes a
                              baseline AC from the REQ (or the whole
                              project) and inherit the ruling on future
                              sweeps. Reason is at least 20 characters
-                             (schema-enforced).
+                             (schema-enforced). --dry-run prints the
+                             opt-out that would be written and leaves
+                             the manifest untouched.
 
   opt-out --remove --req <id> --key <baselineKey>
                              Delete an existing opt-out; the next sweep
@@ -252,6 +254,18 @@ export async function main(argv, deps = {}) {
     stderr.write(`[error] usage req-baseline opt-out: --scope must be req or project (got ${scope})\n`);
     return 2;
   }
+  // Issue 310 (0.32.2): --dry-run on opt-out previews the opt-out
+  // record without writing to the manifest. Prior behaviour accepted
+  // the flag and wrote anyway, mutating viewer clones on rehearsal
+  // runs.
+  if (flags['dry-run']) {
+    if (flags.json) {
+      stdout.write(`${JSON.stringify({ dryRun: true, reqId: flags.req, baselineKey: flags.key, scope, reason: flags.reason }, null, 2)}\n`);
+    } else {
+      stdout.write(`[dry-run] would opt-out ${flags.req} ${flags.key} (scope=${scope})\n`);
+    }
+    return 0;
+  }
   const result = await writeOptOut({
     projectRoot,
     tree: walkResult.tree,

package/src/query/gates.js

@@ -1582,7 +1582,15 @@ function computeSecurityArchitectureCheck(ctx) {
 function computeOperationalConcernsCheck(ctx) {
   const tree = ctx.tree;
   const tad = /** @type {any} */ (tree.tad ?? {});
-  const hasDeployedAc = (tree.userStories ?? []).some((us) => (us.acceptanceCriteria ?? []).some((ac) => typeof ac?.description === 'string' && ac.description.includes('[deployed]')));
+  // Issue 306 (2026-10-06): schemas carry AC scope as the structured
+  // field `scope: "deployed"`; the legacy `[deployed]` description
+  // marker (R13 2026-10-05) is kept so older trees still trigger. A
+  // deployed-scope AC on either form must find a non-empty
+  // TAD.operationalConcerns.
+  const hasDeployedAc = (tree.userStories ?? []).some((us) => (us.acceptanceCriteria ?? []).some((ac) => {
+    if (ac?.scope === 'deployed') return true;
+    return typeof ac?.description === 'string' && ac.description.includes('[deployed]');
+  }));
   const opFail = [];
   if (hasDeployedAc) {
     const oc = tad.operationalConcerns;
@@ -2025,9 +2033,23 @@ function collectRecordShapeFields(tree) {
  * that follows a verb like `set`, `write`, `include`, `return`,
  * `contain`, `name` or appears as the direct object of a `then`'s
  * verb phrase; a cheap approximation uses `then <subject> <verb>
- * <field>` plus `field <name>`, `<name> field` and `field: <name>`
- * patterns. The scan is deliberately conservative so a plain English
- * sentence yields a small set.
+ * <field>` plus `field <name>`, `<name> field`, `field: <name>` and
+ * `<Shape>.<name>` patterns. The scan is deliberately conservative so
+ * a plain English sentence yields a small set.
+ *
+ * Issue 311 (0.32.2): a bare backticked identifier (pattern 1) was
+ * reading error-enum values, pagination query-string keys, sort and
+ * filter-mode literals, env-var and config-knob names as record-shape
+ * fields and false-positiving 345 of 532 ACs on WESPA. Pattern 1 is
+ * now context-gated: ALL_CAPS tokens (enum values, env vars,
+ * constants) are skipped unconditionally; other backticked tokens
+ * count only when a field-signalling word sits within a short
+ * neighbourhood AND no explicit non-field context (query parameter,
+ * sort order, filter/match mode, env var, config knob, header name,
+ * cli flag) overlaps the same neighbourhood. The AC-12113-2 class is
+ * preserved: a then-clause that names a real missing field via
+ * `<name> field`, `field: <name>` or an emit-verb context still fails
+ * the check.
  *
  * @param {string} thenClause
  * @returns {string[]}
@@ -2037,27 +2059,60 @@ function extractThenFieldTokens(thenClause) {
   const text = stripQuotedSubstrings(thenClause);
   /** @type {Set<string>} */
   const tokens = new Set();
-  // Pattern 1: backticked identifier (`then `balance` is set`). The
-  // primary signal; prose that quotes a field name under backticks is
-  // the convention this check expects.
-  for (const m of text.matchAll(/`([A-Za-z_][A-Za-z0-9_]*)`/g)) {
-    if (m[1]) tokens.add(m[1]);
-  }
-  // Pattern 2: `<name> field` (adjective-form naming). An English
-  // "stop word" skip keeps "the field", "a field" and "its field" from
-  // tripping the check.
   const STOP = new Set(['the', 'a', 'an', 'this', 'that', 'its', 'our', 'their', 'any', 'no', 'some', 'each', 'every', 'another']);
-  for (const m of text.matchAll(/\b([A-Za-z_][A-Za-z0-9_]*)\s+field\b/g)) {
+
+  // Pattern 2 (preserved): `<name> field` (adjective-form naming). The
+  // backtick around the name is optional; the stop-word skip keeps
+  // "the field", "a field" and "its field" from tripping the check.
+  for (const m of text.matchAll(/`?\b([A-Za-z_][A-Za-z0-9_]*)`?\s+field\b/g)) {
     const token = m[1];
     if (!token) continue;
     if (STOP.has(token.toLowerCase())) continue;
     tokens.add(token);
   }
-  // Pattern 3: `field: <name>` or `field = <name>` (schema-like
-  // notation inside a then clause).
-  for (const m of text.matchAll(/\bfield\s*[:=]\s*([A-Za-z_][A-Za-z0-9_]*)/g)) {
+  // Pattern 3 (preserved): `field: <name>` or `field = <name>`
+  // (schema-like notation inside a then clause). The name's backtick
+  // is optional.
+  for (const m of text.matchAll(/\bfields?\s*[:=]\s*`?([A-Za-z_][A-Za-z0-9_]*)`?/g)) {
+    if (m[1]) tokens.add(m[1]);
+  }
+  // Pattern 4 (new, issue 311): `<ShapeName>.<fieldName>` dot
+  // notation. Shape names are PascalCase; the field name after the
+  // dot is the candidate.
+  for (const m of text.matchAll(/\b[A-Z][A-Za-z0-9_]*\.([a-z_][A-Za-z0-9_]*)\b/g)) {
     if (m[1]) tokens.add(m[1]);
   }
+  // Pattern 1 (narrowed, issue 311): backticked identifier WITH
+  // explicit field evidence in its immediate neighbourhood AND no
+  // overlapping non-field context. ALL_CAPS tokens (enum values, env
+  // vars, constants) are skipped unconditionally; record-shape field
+  // names in the WSD AI tree and the rcf-schemas canon are camelCase
+  // or lower snake_case.
+  const WINDOW = 36;
+  const POS_BEFORE = /(?:\bsets?|\bsetting|\bwrites?|\bwriting|\bincludes?|\bincluding|\breturns?|\breturning|\bcontains?|\bcontaining|\bnames?|\bnaming|\bemits?|\bemitting|\bholds?|\bholding|\bcarries|\bcarrying|\badds?|\badding|\bhas|\bhave|\bhad|\bwith\s+(?:a|an|the))\s*$/i;
+  const POS_AFTER = /^\s*(?:\bis\s+(?:set|written|included|returned|named|populated|present|absent|missing|required|optional|null|non-null|empty)|\bare\s+(?:set|written|included|returned|named|populated|present|absent|missing|required|optional)|\bequals?|\bholds?|\bcontains?|\bof\s+type|\bfields?\b)/i;
+  const POS_CTX = /\bfields?\b|\brecord\s+shape\b|\brecord\s+body\b|\bresponse\s+body\b|\brequest\s+body\b|\bevent\s+body\b|\bpayload\b|\bevent\s+payload\b|\benvelope\b/i;
+  const NEG_CTX = /\bquery\s+param(?:eter)?s?\b|\bquery[- ]?string\b|\bsort\s+(?:order|direction|by|key)\b|\bfilter\s+mode\b|\bmatch\s+mode\b|\benum\s+(?:value|member|variant|literal)s?\b|\benv(?:ironment)?\s*var(?:iable)?s?\b|\benvironment\s+variable\b|\bconfig(?:uration)?\s+(?:knob|key|option|value|setting|field|file)\b|\bheader\s+(?:name|value|key)\b|\b(?:cli|flag|option|argument|parameter)\s+name\b|\bconstant\b|\badmin\s+user\b|\bbuild\s+(?:info|metadata)\b|\broute\b|\bendpoint\b|\boperator\b|\bdirection\b/i;
+
+  for (const m of text.matchAll(/`([A-Za-z_][A-Za-z0-9_]*)`/g)) {
+    const token = m[1];
+    if (!token) continue;
+    // Skip ALL_CAPS enum values, env vars, constants.
+    if (/^[A-Z][A-Z0-9_]*$/.test(token) && token.length >= 2) continue;
+    const start = m.index ?? 0;
+    const end = start + m[0].length;
+    const before = text.slice(Math.max(0, start - WINDOW), start);
+    const after = text.slice(end, Math.min(text.length, end + WINDOW));
+    if (NEG_CTX.test(before) || NEG_CTX.test(after)) continue;
+    if (
+      POS_BEFORE.test(before)
+      || POS_AFTER.test(after)
+      || POS_CTX.test(before)
+      || POS_CTX.test(after)
+    ) {
+      tokens.add(token);
+    }
+  }
   return [...tokens];
 }
 

package/src/view/index.js

@@ -12,6 +12,7 @@ import { resolveTestPointers, walkTree } from '#core/store';
 import { computeReadiness } from '../query/readiness.js';
 import { computeQuestions } from '../query/questions.js';
 import { loadFreezeRecord } from '../define/freeze-record.js';
+import { resolveInterfacePaths } from '../define/interface-paths.js';
 import { loadAllLedgers } from '../define/ledgers.js';
 import { renderContent, renderPage } from './html-page.js';
 import { renderProductMapGrouping } from './product-map.js';
@@ -77,11 +78,18 @@ export async function renderModelToPage({ projectRoot }) {
   // Load the readiness inputs once per rewalk; the viewer is pure
   // (never recomputes readiness). Failures load as `null` so the tab
   // still renders when a tree is partial.
-  const [freezeRecord, ledgers, testPointers, profileText] = await Promise.all([
+  const [freezeRecord, ledgers, testPointers, profileText, resolvedPaths] = await Promise.all([
     loadFreezeRecord({ projectRoot }).catch(() => null),
     loadAllLedgers({ projectRoot }).catch(() => ({})),
     resolveTestPointers({ projectRoot, tree }).catch(() => undefined),
     readProfileText(projectRoot),
+    // Issue 307 (2026-10-06): run the same TAC-interface path
+    // resolver the CLI and freeze run so the viewer's D3
+    // `shapes:pathsResolve` check reads the resolved set from the
+    // same seam. Before this, the viewer called computeReadiness
+    // without `resolvedPaths`, D3 false-failed on paths that resolve
+    // on disk, and the Readiness tab disagreed with the CLI.
+    resolveInterfacePaths(projectRoot, tree).catch(() => undefined),
   ]);
 
   let readiness = null;
@@ -93,6 +101,7 @@ export async function renderModelToPage({ projectRoot }) {
       profileText,
       testPointers,
       validateErrors: errors,
+      resolvedPaths,
     });
   } catch (err) {
     // A malformed tree should not block the viewer; the Readiness tab
@@ -149,7 +158,12 @@ export async function renderModelToPage({ projectRoot }) {
   // list is extended before the version pin bump). One row per doc id
   // plus one row per AC under each US.
   const indexJson = serialiseViewIndex(model);
-  return { fullPageHtml, contentHtml, errors, tree, pmPartials, indexJson };
+  // Issue 307 (2026-10-06): expose the computed readiness alongside
+  // the rendered HTML so tests can assert the viewer's D3
+  // shapes:pathsResolve agrees with the CLI without parsing HTML. The
+  // viewer HTML is still the operator-facing surface; this field is
+  // additive and consumed by test code only.
+  return { fullPageHtml, contentHtml, errors, tree, pmPartials, indexJson, readiness };
 }
 
 /**