rcf-lite 0.32.4 → 0.33.0

package/src/server/routes.js

@@ -35,6 +35,15 @@ import { readFile, stat } from 'node:fs/promises';
 
 import { renderComponentsFixturePage } from '../view/components-fixture.js';
 import { renderTestHostPage } from '../view/test-host/fixture.js';
+// FBS-207 (TAC-4136, ADR-4140): the viewer's three JSON query routes
+// call the same pure composers the CLI calls, from the walked tree
+// kept on `state`. Admissibility bypass: these routes do NOT call
+// `runWithAdmissibilityGate` (the CLI coverage, impact and trace
+// verbs do not either; issues 316 and 317). Only readiness and
+// freeze consult that gate.
+import { classifyCoverageScope, computeCoverage } from '../query/coverage.js';
+import { computeImpact } from '../query/impact.js';
+import { computeTrace, kindOf } from '../query/trace.js';
 
 // Issue #248 (0.28.3): the shipped static assets (style.css,
 // mermaid.min.js, live-client.js) MUST be resolved once at server
@@ -180,6 +189,18 @@ export function createRouter(deps) {
       res.end(body);
       return;
     }
+    if (path === '/trace.json') {
+      handleQueryRoute(req, res, deps, url, 'trace');
+      return;
+    }
+    if (path === '/impact.json') {
+      handleQueryRoute(req, res, deps, url, 'impact');
+      return;
+    }
+    if (path === '/coverage.json') {
+      handleQueryRoute(req, res, deps, url, 'coverage');
+      return;
+    }
     if (path === '/scope.json') {
       if (typeof deps.scope !== 'function') {
         res.writeHead(404, { 'content-type': MIME.txt });
@@ -251,3 +272,151 @@ function fail(res, err) {
     res.end(`internal error: ${err && err.message ? err.message : 'unknown'}\n`);
   } catch { /* swallow */ }
 }
+
+/**
+ * FBS-207 (TAC-4136 interfaces[GET /trace.json], [GET /impact.json],
+ * [GET /coverage.json], [QueryRouteError]): one handler per route that
+ * reads deps.currentState(), returns 503 before the first walk, 404 or
+ * 400 QueryRouteError on known failures, and application/json with
+ * cache-control: no-store on success. The three routes NEVER call
+ * runWithAdmissibilityGate (admissibility bypass stated in TAC-4136:
+ * the CLI coverage, impact and trace verbs do not either, so a tree
+ * that fails admissibility still answers these three). Nothing is
+ * written under rcf/.
+ *
+ * Memoised per (version, route, pivot, direction|scope) in deps.query
+ * Cache, which the server replaces wholesale on every rewalk. The
+ * cached entry is the response body string so a repeated request
+ * writes bytes without recomputing or re-stringifying.
+ *
+ * @param {import('node:http').IncomingMessage} req
+ * @param {import('node:http').ServerResponse} res
+ * @param {RouterDeps & { queryCache?: {
+ *   get(key: string): string | undefined,
+ *   set(key: string, value: string): void,
+ *   has(key: string): boolean,
+ *   size(): number,
+ * }}} deps
+ * @param {URL} url
+ * @param {'trace' | 'impact' | 'coverage'} route
+ */
+function handleQueryRoute(req, res, deps, url, route) {
+  const state = deps.currentState();
+  // AC-208-7: 503 "view server initialising" before the first walk
+  // completes, exactly as /index.json answers today.
+  if (!state || !state.tree) {
+    res.writeHead(503, { 'content-type': MIME.txt });
+    res.end('view server initialising\n');
+    return;
+  }
+
+  // AC-208-1: for /trace.json the query id and direction come from
+  // the URL. Default direction is forward (matches the CLI default).
+  const id = url.searchParams.get('id');
+  const direction = url.searchParams.get('direction') ?? 'forward';
+  const scope = url.searchParams.get('scope');
+  // FBS-208: opt-in CN layer for the Trace matrix - without it, the
+  // trace response excludes codeNode cross-links (back-compat with
+  // every pre-FBS-208 caller).
+  const includeCode = url.searchParams.get('includeCode') === '1';
+
+  if (route === 'trace' || route === 'impact') {
+    // AC-208-4 unknown-id: an id missing or not found in the tree is
+    // 404 with QueryRouteError.error "unknown-id" and the request id
+    // echoed back (missing is echoed as null).
+    if (!id) {
+      sendQueryError(res, 404, { error: 'unknown-id', id: null });
+      return;
+    }
+    if (!kindOf(state.tree, id)) {
+      sendQueryError(res, 404, { error: 'unknown-id', id });
+      return;
+    }
+  }
+  if (route === 'trace') {
+    // AC-208-4 bad-direction: anything outside forward | back | both
+    // is 400 with QueryRouteError.error "bad-direction".
+    if (direction !== 'forward' && direction !== 'back' && direction !== 'both') {
+      sendQueryError(res, 400, { error: 'bad-direction', id, direction });
+      return;
+    }
+  }
+  if (route === 'coverage' && scope !== null) {
+    // AC-208-4 bad-scope: a scope positional that is below AC or
+    // unknown is 400 with QueryRouteError.error "bad-scope". Reuses
+    // the exact classifier the CLI uses (src/cli/coverage.js).
+    const classification = classifyCoverageScope(state.tree, scope);
+    if (classification !== 'valid') {
+      sendQueryError(res, 400, { error: 'bad-scope', scope });
+      return;
+    }
+  }
+
+  // AC-208-6: memo key covers the state version and the route-shaped
+  // request params so each (version, pivot, direction|scope) computes
+  // once and serves from the memo thereafter. The cache is replaced
+  // wholesale on each rewalk, so a new version never serves a prior
+  // version's bytes.
+  const key = route === 'trace'
+    ? `${state.version}:trace:${id}:${direction}:${includeCode ? 'c1' : 'c0'}`
+    : route === 'impact'
+      ? `${state.version}:impact:${id}:-`
+      : `${state.version}:coverage:-:${scope ?? ''}`;
+
+  const cache = deps.queryCache;
+  let body = cache && cache.has(key) ? cache.get(key) : null;
+  if (body === null || body === undefined) {
+    let result;
+    try {
+      if (route === 'trace') {
+        result = computeTrace(state.tree, { id, direction, includeCode });
+      } else if (route === 'impact') {
+        result = computeImpact(state.tree, { id });
+      } else {
+        // AC-208-3: strict per-AC coverage, with the CLI's optional
+        // scope narrowing. testPointers are the resolved map the
+        // walker produced (fail-closed when missing per
+        // computeCoverage's doc).
+        result = computeCoverage(state.tree, {
+          strict: true,
+          scopeId: scope,
+          testPointers: state.testPointers,
+        });
+      }
+    } catch (err) {
+      fail(res, err);
+      return;
+    }
+    body = JSON.stringify(result);
+    if (cache) cache.set(key, body);
+  }
+
+  // AC-208-1 / -2 / -3: application/json with cache-control: no-store,
+  // computed from the current state and served relative to the mount.
+  res.writeHead(200, {
+    'content-type': MIME.json,
+    'content-length': String(Buffer.byteLength(body)),
+    'cache-control': 'no-store',
+  });
+  res.end(body);
+}
+
+/**
+ * FBS-207 (TAC-4136 QueryRouteError): the three routes share one JSON
+ * error body `{error, id?, direction?, scope?}`, with request echo for
+ * only the fields that were present. 404 for unknown-id, 400 for the
+ * two usage errors.
+ *
+ * @param {import('node:http').ServerResponse} res
+ * @param {404 | 400} status
+ * @param {{error: 'unknown-id' | 'bad-direction' | 'bad-scope', id?: string | null, direction?: string, scope?: string}} payload
+ */
+function sendQueryError(res, status, payload) {
+  const body = JSON.stringify(payload);
+  res.writeHead(status, {
+    'content-type': MIME.json,
+    'content-length': String(Buffer.byteLength(body)),
+    'cache-control': 'no-store',
+  });
+  res.end(body);
+}

package/src/verify/cli/run.js

@@ -12,6 +12,11 @@ import { parseArgs } from 'node:util';
 import { formatError, isRcfError } from '#core/errors';
 
 import { runVerification } from '../engine/index.js';
+import {
+  DEFAULT_VERIFY_MODE,
+  VERIFY_MODES,
+  isVerifyMode,
+} from '../engine/deterministic.js';
 import { isSemverString, PLAYWRIGHT_MCP_VERSION } from '../engine/launcher.js';
 import { serialiseReport } from '../report/index.js';
 import { gateTripped, FINDING_SEVERITIES } from '../verdict/index.js';
@@ -28,6 +33,10 @@ const OPTION_SPEC = {
   'provision-mode': { type: 'string' },
   persona: { type: 'string' },
   'playwright-mcp-version': { type: 'string' },
+  // Issue 330 (2026-10-08): the verify mode. agentScreenshotCritique is
+  // the parent-session default; deterministic is the model-free, in-
+  // process mode a dispatched worker can run (never spawns `claude`).
+  mode: { type: 'string' },
   help: { type: 'boolean' },
 };
 
@@ -59,6 +68,22 @@ Optional:
                             fires and the report records the overridden pin
                             as runStats.playwrightMcpVersion). Must be an
                             exact semver X.Y.Z.
+  --mode <mode>             Verify mode (default: agentScreenshotCritique):
+                              agentScreenshotCritique  parent-session mode;
+                                 spawns the agent CLI as a subagent with
+                                 Playwright MCP, drives the live app with a
+                                 model, and emits per-AC findings. Only run
+                                 from a parent session that may spawn the
+                                 agent CLI.
+                              deterministic  model-free, in-process mode a
+                                 dispatched worker can run; records a per-AC
+                                 skip ledger as blockedAcs[] with reason
+                                 'critique-only' and stamps
+                                 runStats.counts = { verified, failed,
+                                 skipped, total }. The finalise gate refuses
+                                 promotion on a deterministic run that
+                                 skipped any AC (ADR-4112 verified
+                                 invariant).
   --help                    Print this help
 
 Exit codes:
@@ -146,6 +171,20 @@ export async function main(argv, deps = {}) {
     stderr.write(`Playwright MCP: pinned to @playwright/mcp@${PLAYWRIGHT_MCP_VERSION}\n`);
   }
 
+  // Issue 330: resolve --mode. Unknown value refuses exit 2 so a typo
+  // does not silently fall through to the default agent mode (a
+  // dispatched worker that typed --mode=determinstic would otherwise
+  // spawn `claude` and be killed by the harness).
+  const modeFlag = flags.mode;
+  if (modeFlag !== undefined && !isVerifyMode(modeFlag)) {
+    stderr.write(`[error] usage --mode must be one of ${VERIFY_MODES.join(' | ')} (got "${modeFlag}")\n`);
+    return 2;
+  }
+  const mode = modeFlag ?? DEFAULT_VERIFY_MODE;
+  if (mode === 'deterministic') {
+    stderr.write('Verify mode: deterministic (model-free, in-process; a dispatched worker can run this)\n');
+  }
+
   const result = await runVerification({
     repo: flags.repo,
     chainRef: flags.chain,
@@ -157,6 +196,7 @@ export async function main(argv, deps = {}) {
     persona: flags.persona,
     severityGate: gate,
     playwrightMcpVersion: overrideRaw,
+    mode,
   }, deps);
 
   if (isRcfError(result)) {

package/src/verify/engine/deterministic.js

@@ -0,0 +1,150 @@
+// Deterministic verify mode (issue 330, 2026-10-08). A dispatched worker
+// cannot spawn `claude` as a subagent (an estate rule the surrounding
+// harness enforces by killing any such child), so the default
+// `agentScreenshotCritique` mode is a parent-session mode. This module
+// is its sister: a model-free verify path that a dispatched worker can
+// run end-to-end from inside a tool call.
+//
+// Scope today (minimal, honest, additive):
+//   - HTTP reachability probe against `--url` recorded on `runStats`
+//     as diagnostic context (NOT a per-AC verification);
+//   - every AC the chain carries is recorded on `blockedAcs[]` with
+//     reason `critique-only` so the aggregate verdict is BLOCKED and
+//     the finalise gate refuses promotion by construction (ADR-4112
+//     verified invariant). The report also carries
+//     `runStats.counts = { verified, failed, skipped, total }` so a
+//     report reader sees the mode did not actively verify anything.
+//
+// The catalog-driven per-AC probe seam is a later train car: when the
+// chain's AC subschema gains structured probe fields (status, path,
+// header, body substring, selector) OR a project ships
+// `docs/runtime-verify-catalog.md` keyed by acId, this module will
+// resolve those probes and surface pass/fail/skipped per AC with
+// evidence. The partial fix today keeps that door open: `runStats.mode`
+// and `runStats.counts` are stable across future extensions.
+//
+// Shared-parent-state note: this module uses `globalThis.fetch`
+// (injectable via `deps.fetchImpl`) and never spawns a child
+// process, so it cannot leak the parent's Playwright or MCP session.
+// A DOM-probe extension (Playwright headless, in-process) can land in
+// a later train car; it would use the already-declared optional peer
+// dependency and never the MCP.
+
+const DEFAULT_REACHABLE_TIMEOUT_MS = 10000;
+const CRITIQUE_ONLY_REASON = 'critique-only: subjective visual judgement needed; deterministic mode cannot judge this AC (parent-session agentScreenshotCritique mode is required).';
+
+/**
+ * One-shot HTTP probe. Returns status/ok/elapsedMs + a short bodyHead
+ * sample so a report reader can see what the deployed URL served, or
+ * an `error.kind` on a transport failure. Diagnostic context on
+ * `runStats` only, not a verification claim against any AC.
+ *
+ * @param {object} args
+ * @param {string} args.url
+ * @param {typeof fetch} [args.fetchImpl]
+ * @param {number} [args.timeoutMs]
+ * @returns {Promise<{ ok: boolean, status: number|null, elapsedMs: number, bodyHead?: string, error?: { kind: string, message: string } }>}
+ */
+export async function probeHttpReachability({ url, fetchImpl, timeoutMs = DEFAULT_REACHABLE_TIMEOUT_MS }) {
+  const fetchFn = fetchImpl ?? globalThis.fetch;
+  if (typeof fetchFn !== 'function') {
+    return { ok: false, status: null, elapsedMs: 0, error: { kind: 'noFetch', message: 'no fetch implementation available (node >=24 ships globalThis.fetch; pass deps.fetchImpl otherwise)' } };
+  }
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  const startedAt = Date.now();
+  try {
+    const res = await fetchFn(url, { method: 'GET', signal: controller.signal, redirect: 'follow' });
+    const elapsedMs = Date.now() - startedAt;
+    let bodyHead;
+    try {
+      const text = await res.text();
+      bodyHead = typeof text === 'string' ? text.slice(0, 256) : undefined;
+    } catch {
+      bodyHead = undefined;
+    }
+    return {
+      ok: typeof res.status === 'number' && res.status > 0 && res.status < 500,
+      status: typeof res.status === 'number' ? res.status : null,
+      elapsedMs,
+      ...(bodyHead !== undefined ? { bodyHead } : {}),
+    };
+  } catch (err) {
+    const elapsedMs = Date.now() - startedAt;
+    const kind = err?.name === 'AbortError' ? 'timeout' : 'network';
+    return { ok: false, status: null, elapsedMs, error: { kind, message: err?.message ?? String(err) } };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+/**
+ * Run the deterministic verify pass. Pure in-process; no agent CLI,
+ * no MCP, no child processes. Returns the per-AC skip ledger and the
+ * diagnostic HTTP probe on `runStats`.
+ *
+ * Honest minimum (no chain-level probe field exists today): every
+ * testable AC lands on `blockedAcs[]` as critique-only, so the
+ * aggregate verdict is BLOCKED and the finalise gate refuses by
+ * construction. The caller (engine) MERGES these entries with the
+ * provisioning-side blockedAcs; the two are the same shape.
+ *
+ * @param {object} args
+ * @param {string} args.url
+ * @param {Array<object>} args.acs - flattened acceptance criteria from the chain
+ * @param {object} [args.deps]
+ * @param {typeof fetch} [args.deps.fetchImpl]
+ * @returns {Promise<{ findings: object[], blockedAcs: Array<{acId: string, reason: string, mode: string}>, runStats: object }>}
+ */
+export async function runDeterministic({ url, acs = [], deps = {} }) {
+  const testable = Array.isArray(acs) ? acs.filter((a) => a && a.testable !== false) : [];
+  const startedAt = Date.now();
+  const probe = await probeHttpReachability({ url, fetchImpl: deps.fetchImpl });
+  probe.url = url;
+  const findings = [];
+  const blockedAcs = testable.map((ac) => ({
+    acId: ac.acId,
+    reason: CRITIQUE_ONLY_REASON,
+    mode: 'deterministic',
+  }));
+  const finishedAt = Date.now();
+  const counts = {
+    total: testable.length,
+    verified: 0,
+    failed: 0,
+    skipped: blockedAcs.length,
+  };
+  return {
+    findings,
+    blockedAcs,
+    runStats: {
+      mode: 'deterministic',
+      httpProbe: {
+        url,
+        ok: probe.ok,
+        status: probe.status,
+        elapsedMs: probe.elapsedMs,
+        ...(probe.bodyHead !== undefined ? { bodyHead: probe.bodyHead } : {}),
+        ...(probe.error !== undefined ? { error: probe.error } : {}),
+      },
+      counts,
+      startedAtMs: startedAt,
+      finishedAtMs: finishedAt,
+    },
+  };
+}
+
+/** Supported verify modes (public enum for CLI + engine). */
+export const VERIFY_MODES = Object.freeze(['agentScreenshotCritique', 'deterministic']);
+export const DEFAULT_VERIFY_MODE = 'agentScreenshotCritique';
+
+/**
+ * True iff value is a known verify mode. The CLI uses this as its
+ * sole gate so a new mode added here is accepted everywhere.
+ *
+ * @param {unknown} value
+ * @returns {boolean}
+ */
+export function isVerifyMode(value) {
+  return typeof value === 'string' && VERIFY_MODES.includes(value);
+}

package/src/verify/engine/index.js

@@ -19,6 +19,11 @@ import { readChain as defaultReadChain } from '../chain/index.js';
 import { runProvisioning, cleanup as defaultCleanup } from '../provision/index.js';
 import { composeBrief } from './brief.js';
 import { PLAYWRIGHT_MCP_VERSION, playwrightMcpConfig, resolveLauncher } from './launcher.js';
+import {
+  DEFAULT_VERIFY_MODE,
+  isVerifyMode,
+  runDeterministic,
+} from './deterministic.js';
 import { aggregateVerdict, derivePerAcVerdicts, validateFinding } from '../verdict/index.js';
 import { buildReport } from '../report/index.js';
 
@@ -63,6 +68,10 @@ export async function runVerification(opts = {}, deps = {}) {
   const now = deps.now ?? (() => new Date().toISOString());
   const readChain = deps.readChain ?? defaultReadChain;
   const startedAt = now();
+  // Issue 330: verify mode selects the launcher below (step 6). Resolved
+  // early so every report (NOT-DEPLOYED, LAUNCH-FAILURE, normal) stamps
+  // runStats.mode and finalise can key its refusal line off it.
+  const mode = isVerifyMode(opts.mode) ? opts.mode : DEFAULT_VERIFY_MODE;
 
   // 1. Resolve + validate the runtime declaration (§4).
   const resolved = resolveProfile({ profile: opts.profile, url: opts.url, parityEnv: opts.parityEnv });
@@ -100,6 +109,7 @@ export async function runVerification(opts = {}, deps = {}) {
         verdict: 'NOT-DEPLOYED', verdictAuthority,
         findings: [], blockedAcs: [], provisioning: null,
         perAcVerdicts,
+        runStats: { mode },
       });
       return { report };
     }
@@ -139,11 +149,23 @@ export async function runVerification(opts = {}, deps = {}) {
     ? playwrightMcpConfig(playwrightMcpVersion)
     : undefined;
 
-  // 6. Launch the isolated verifier agent (§7.3 isolation env, §9 fresh session).
+  // 6. Launch the isolated verifier agent (§7.3 isolation env, §9 fresh session),
+  //    OR, in deterministic mode (issue 330), run the in-process model-free
+  //    pass so a dispatched worker can finalise without spawning `claude`.
+  //    Deterministic mode's blockedAcs merge into the provisioning-side list
+  //    so the aggregate verdict is BLOCKED by construction while the honest
+  //    counts (verified/failed/skipped) are stamped on `runStats` for the
+  //    finalise refusal line (ADR-4112 verified invariant).
   let launchResult;
   try {
-    const launchAgent = await resolveLauncher(deps);
-    launchResult = await launchAgent({ brief, url, profile, mcpConfig: mcpConfigForPin });
+    if (mode === 'deterministic') {
+      const detResult = await runDeterministic({ url, acs: chain.acs, deps });
+      launchResult = { findings: detResult.findings, runStats: detResult.runStats };
+      for (const b of detResult.blockedAcs ?? []) blockedAcs.push(b);
+    } else {
+      const launchAgent = await resolveLauncher(deps);
+      launchResult = await launchAgent({ brief, url, profile, mcpConfig: mcpConfigForPin });
+    }
   } catch (err) {
     // A verifier agent that could not run — or whose output could not be
     // ingested — is NEVER a fabricated PASS (§9). But the report is still
@@ -159,7 +181,7 @@ export async function runVerification(opts = {}, deps = {}) {
       findings: [], blockedAcs, provisioning,
       launchFailure: { message: err.message, rawOutputPath: err.rawOutputPath ?? null },
       perAcVerdicts,
-      runStats: { playwrightMcpVersion },
+      runStats: { playwrightMcpVersion, mode },
     });
     return { report };
   }
@@ -190,6 +212,7 @@ export async function runVerification(opts = {}, deps = {}) {
   };
   const runStatsForReport = {
     ...(launchResult?.runStats ?? {}),
+    mode,
     playwrightMcpVersion,
     evalCoverage,
   };

package/src/view/doc-renderers/req.js

@@ -1,7 +1,8 @@
-// REQ renderer. Carries an optional per-REQ Mermaid subdiagram block when
-// the caller passes one (the html-page module decides whether to include it).
-// Child user stories are NOT rendered as inline links because the Phase 3.2
-// layout nests them as `<details>` under the REQ's own `<details>` wrapper.
+// REQ renderer. FBS-208 (AC-209-5): the per-REQ Mermaid slice is retired on
+// the user-facing surface; this renderer no longer emits a slice block even
+// when a caller still passes `ctx.subdiagram`. Child user stories are NOT
+// rendered as inline links because the Phase 3.2 layout nests them as
+// `<details>` under the REQ's own `<details>` wrapper.
 
 import {
   anchorIdFor,
@@ -17,7 +18,9 @@ import {
  * @param {object} ctx
  * @param {string|undefined} ctx.raw
  * @param {import('#core/errors').RcfError[]} [ctx.errors]
- * @param {string|undefined} [ctx.subdiagram]
+ * @param {string|undefined} [ctx.subdiagram] - accepted for back-compat;
+ *   FBS-208 retires rendering of the per-REQ Mermaid slice, so this value
+ *   is ignored.
  * @param {string|undefined} [ctx.idPrefix] - prefix prepended to every emitted
  *   id/anchor so the same REQ can be rendered under multiple Product Map
  *   buckets without duplicating ids. Empty when rendered from the
@@ -32,9 +35,9 @@ export function renderReq(req, ctx) {
   const prefix = ctx.idPrefix ?? '';
   const anchor = `${prefix}${anchorIdFor(req.reqId ?? 'REQ')}`;
   const broken = ctx.errors?.length ? brokenBanner(ctx.errors) : '';
-  const subdiagram = ctx.subdiagram
-    ? `<section class="subdiagram"><h4>Slice diagram</h4><pre class="mermaid">${escapeHtml(ctx.subdiagram)}</pre></section>`
-    : '';
+  // FBS-208 (AC-209-5): the Mermaid slice block is not emitted even when
+  // `ctx.subdiagram` is passed. The ctx key stays accepted so Product Map
+  // callers continue to compile.
   return `
 <article id="${anchor}" class="doc doc-req">
   <h3>${escapeHtml(req.reqId ?? 'REQ')} - ${escapeHtml(req.title ?? '')}</h3>
@@ -45,7 +48,6 @@ export function renderReq(req, ctx) {
   ${fieldPara('Priority', req.priority)}
   ${fieldPara('Rationale', req.rationale)}
   ${fieldList('Tags', req.tags)}
-  ${subdiagram}
   ${ctx.suppressRawJson ? '' : rawJsonDisclosure(ctx.raw, req, req.reqId, prefix)}
 </article>`.trim();
 }

package/src/view/html-page.js

@@ -46,7 +46,10 @@ import {
 } from './doc-renderers/index.js';
 import { detailsWrap, escapeHtml } from './doc-renderers/helpers.js';
 import { computeQueue } from '../build/queue.js';
-import { allRequirementSubdiagrams } from './mermaid-diagram.js';
+// FBS-208 (AC-209-5): the per-REQ Mermaid slice is retired on the
+// user-facing surfaces. The generator in `./mermaid-diagram.js` is
+// retained while AC-201-1 still binds its unit tests; it is no longer
+// invoked from any renderer here.
 import { renderProductMapPanel } from './product-map.js';
 import { renderReadinessPanel } from './readiness.js';
 import { renderToastContainer } from './components/toast.js';
@@ -177,7 +180,7 @@ export function renderPage(model, opts) {
  * @returns {string}
  */
 export function renderContent(model) {
-  const subdiagrams = allRequirementSubdiagrams(model);
+  // FBS-208 (AC-209-5): per-REQ Mermaid slice retired on the surface.
   const needsWorkIds = computeReqNeedsWorkIds(model.readiness);
 
   const prdSection = model.prd
@@ -191,13 +194,14 @@ export function renderContent(model) {
     : '<p><em>No PRD on disk.</em></p>';
 
   const prdSelector = renderPrdRequirementSelector(model);
-  const requirementsPanel = renderRequirementsPanel(model, subdiagrams, needsWorkIds);
+  const requirementsPanel = renderRequirementsPanel(model, needsWorkIds);
   const architecturePanel = renderArchitecturePanel(model);
   const buildPanel = renderBuildPanel(model);
   const productMapPanel = renderProductMapPanel(model);
   const readinessPanel = renderReadinessPanel(model.readiness ?? null, {
     profile: model.profileText ?? null,
     freezeRecord: model.freezeRecord ?? null,
+    tree: model,
   });
 
   const errorBanner = renderErrorBanner(model.errors ?? []);
@@ -248,10 +252,10 @@ export function renderContent(model) {
  * is the one the current router already walks (decision 11, PR 1).
  *
  * @param {import('./tree-model.js').BuiltTreeModel} model
- * @param {Map<string, string>} subdiagrams - REQ id -> Mermaid source
+ *   (FBS-208: the per-REQ Mermaid slice is retired; this param slot is gone)
  * @param {Set<string>} needsWorkIds - REQ ids still needing PO work
  */
-function renderRequirementsPanel(model, subdiagrams, needsWorkIds) {
+function renderRequirementsPanel(model, needsWorkIds) {
   if (model.requirements.length === 0 && model.userStories.length === 0) {
     return renderEmptyState({
       title: 'No requirements on disk',
@@ -289,7 +293,7 @@ function renderRequirementsPanel(model, subdiagrams, needsWorkIds) {
     showExpandAll: true,
   });
 
-  const reqRows = model.requirements.map((r) => renderRequirementRow(r, model, subdiagrams, needsWorkIds)).join('\n');
+  const reqRows = model.requirements.map((r) => renderRequirementRow(r, model, needsWorkIds)).join('\n');
 
   const orphanUs = model.userStories.filter((u) => !u.reqId || !model.requirements.some((r) => r.reqId === u.reqId));
   const orphanBlock = orphanUs.length > 0
@@ -313,7 +317,7 @@ ${reqRows}
 ${orphanBlock}`;
 }
 
-function renderRequirementRow(req, model, subdiagrams, needsWorkIds) {
+function renderRequirementRow(req, model, needsWorkIds) {
   const stories = model.storiesByReqId.get(req.reqId) ?? [];
   const acCount = stories.reduce((n, u) => n + (u.acceptanceCriteria?.length ?? 0), 0);
   const area = normaliseFacet(req.domain);
@@ -348,10 +352,10 @@ function renderRequirementRow(req, model, subdiagrams, needsWorkIds) {
     ? `<p class="rcf-req-needswork"><strong>Needs work:</strong> ${escapeHtml(needsWorkReason)}</p>`
     : '';
 
-  const subdiagram = subdiagrams.get(req.reqId);
-  const sliceDetails = subdiagram
-    ? `<details class="rcf-req-slice"><summary>Slice diagram <span class="muted small">(REQ, stories, criteria and the FBS that deliver them)</span></summary><div class="rcf-req-slice-body"><pre class="mermaid">${escapeHtml(subdiagram)}</pre></div></details>`
-    : '';
+  // FBS-208 (AC-209-5): per-REQ Mermaid slice retired. The chain's own
+  // `requirementSubdiagram` generator stays in `./mermaid-diagram.js`
+  // for AC-201-1, but no user-facing surface renders it any more.
+  const sliceDetails = '';
 
   const rawJson = model.rawById.get(req.reqId) ?? JSON.stringify(req, null, 2);
   const rawDetails = `<details class="rcf-req-raw raw-json" data-doc-id="${escapeHtml(req.reqId)}::raw"><summary class="muted small">Raw JSON</summary><pre>${escapeHtml(rawJson)}</pre></details>`;

package/src/view/index.js

@@ -163,7 +163,13 @@ export async function renderModelToPage({ projectRoot }) {
   // shapes:pathsResolve agrees with the CLI without parsing HTML. The
   // viewer HTML is still the operator-facing surface; this field is
   // additive and consumed by test code only.
-  return { fullPageHtml, contentHtml, errors, tree, pmPartials, indexJson, readiness };
+  // FBS-207 (TAC-4136, AC-208-6): the walked `tree` and the resolved
+  // `testPointers` map are kept on the returned state so the server's
+  // query routes (/trace.json, /impact.json, /coverage.json) compute
+  // per request from the same tree the page was rendered from, and
+  // the server's queryCache invalidates on `state.version`. Additive;
+  // nothing else reads these fields on the view-layer path.
+  return { fullPageHtml, contentHtml, errors, tree, testPointers, pmPartials, indexJson, readiness };
 }
 
 /**

package/src/view/live-client.js

@@ -439,6 +439,10 @@
         host.innerHTML = payload.contentHtml;
       }
       currentVersion = payload.version;
+      // FBS-208 (AC-209-4): publish the latest tree version so the
+      // Trace matrix wiring can cache per state.version and detect a
+      // swap. Previous caches stay for the stale-banner readback.
+      try { win.__rcfTreeVersion = payload.version; } catch (e) { /* soft */ }
       // The Product Map panel keeps a client-side partial cache
       // (window.__rcfPmPartialCache is opaque to us). A tree-update
       // invalidates every partial: the next activatePmGroup on a lazy