spec-controller 0.1.0-alpha.3 → 0.1.0-alpha.31

package/dist/host.js

@@ -12,6 +12,8 @@
  *
  * @SCN-RMG-004 — features/run-management.feature.
  */
+import { equalsFormRefusal, givenTwiceRefusal, isEqualsForm, isMissingValue, missingValueRefusal, valueFlagsOf, } from "./cli-args.js";
+import { cliRegistry } from "./cli-registry.js";
 /**
  * Parse the host argv into its leading global options (`--store`, `--run-id`) and the
  * command + its clean args. Global options are recognised ONLY before the command: the
@@ -20,26 +22,101 @@
  * --features f` yields the store + `balance` + `[--features, f]`, while `balance --store
  * /s` leaves `--store` in the command's args (a `--store` AFTER the command is the
  * command's own arg, never a host store directive) — the "global before command" contract.
+ * A modifier with nothing after it is refused (@SCN-CLI-067); an empty argv is the bare help.
  */
-export function parseHostInvocation(argv) {
-    let store;
-    let runId;
+export function parseHostInvocation(argv, globalFlags = cliRegistry.global, commands = cliRegistry.commands.map((command) => command.name)) {
+    // The modifiers and the values they take are the registry's global scope, never a list kept here
+    // (@SCN-CLI-059): a modifier added later is read, and refused without its value, by construction.
+    const modifiers = valueFlagsOf(globalFlags);
+    const values = new Map();
     let i = 0;
     for (; i < argv.length; i++) {
-        const token = argv[i];
-        if (token === "--store" && i + 1 < argv.length) {
-            store = argv[i + 1];
-            i++;
-            continue;
+        const token = argv[i] ?? "";
+        const modifier = modifiers.get(token);
+        if (modifier === undefined) {
+            const refusal = leadingFlagRefusal(token, modifiers, globalFlags);
+            if (refusal !== undefined)
+                return { commandArgs: [], refusal };
+            break; // first non-modifier token is the command
         }
-        if (token === "--run-id" && i + 1 < argv.length) {
-            runId = argv[i + 1];
-            i++;
-            continue;
-        }
-        break; // first non-global-option token is the command
+        const value = argv[i + 1];
+        const refusal = modifierRefusal(token, modifier, argv.slice(i + 1, i + 3), { values, commands });
+        if (refusal !== undefined)
+            return { commandArgs: [], refusal };
+        values.set(modifier.name, value ?? "");
+        i++;
+    }
+    if (i === argv.length && values.size > 0)
+        return { commandArgs: [], refusal: noCommandRefusal([...values.keys()]) };
+    return {
+        store: values.get("--store"),
+        runId: values.get("--run-id"),
+        command: argv[i],
+        commandArgs: argv.slice(i + 1),
+    };
+}
+/**
+ * The refusal a modifier earns where it stands, else undefined; `ahead` is its value and the token
+ * after it. Given twice, it is never read as its last value (@SCN-CLI-064): `--store A --store B` used
+ * to store under B without a word. Given no value, it is never handed the next token (@SCN-CLI-059):
+ * `--store --run-id r1` used to store under a directory called `--run-id`. Given the command as its
+ * value with no command after it, it has eaten the command (@SCN-CLI-066): `--store balance
+ * --features f` used to blame `--features`, and `--store balance` alone answered help at exit 0. A
+ * command name followed by the command is still a value: `--store balance balance …` is read.
+ */
+function modifierRefusal(token, modifier, [value, after], read) {
+    if (read.values.has(modifier.name))
+        return givenTwiceRefusal(token, "spec-controller");
+    if (isMissingValue(value))
+        return missingValueRefusal(token, modifier, "spec-controller");
+    if (read.commands.includes(value ?? "") && (after === undefined || after.startsWith("-"))) {
+        return commandAsValueRefusal(token, modifier, value ?? "");
     }
-    return { store, runId, command: argv[i], commandArgs: argv.slice(i + 1) };
+    return undefined;
+}
+/**
+ * The refusal for host modifiers with nothing after them: every modifier given, in one line, and the
+ * fix (@SCN-CLI-067). Given last, `--store <root>` used to answer the top-level help at exit 0 having
+ * run nothing, a false green for a CI step that lost its command word (3F-3686). Help after a
+ * modifier is a command here, and a bare `spec-controller` never reaches this.
+ */
+function noCommandRefusal(given) {
+    return (`No command followed the host modifiers given (${given.join(", ")}), so nothing ran: ` +
+        `a host modifier needs a command after it, or --help.\n` +
+        `Run 'spec-controller --help' to see the commands and host modifiers this version accepts.`);
+}
+/** The refusal for a modifier that took the command as its value: the modifier, the command, and the fix. */
+function commandAsValueRefusal(token, modifier, command) {
+    return (`The ${token} host modifier took '${command}', a command, as its value, and left no command to run.\n` +
+        `Give ${token} its own value, as in 'spec-controller ${token} ${modifier.arg ?? ""} ${command} …'. ` +
+        `Run 'spec-controller --help' to see the commands and host modifiers this version accepts.`);
+}
+/**
+ * The refusal a leading token that is no modifier earns, else undefined (it is the command). A
+ * modifier written `--store=<root>` is a form that is not read (@SCN-CLI-065), never a flag out of
+ * place; any other flag here is out of place, never a command (@SCN-CLI-060): `--exit-zero balance`
+ * used to answer `unknown command "--exit-zero"`. The top-level help stays where it was.
+ */
+function leadingFlagRefusal(token, modifiers, globalFlags) {
+    if (isEqualsForm(token))
+        return equalsFormRefusal(token, modifiers, "spec-controller");
+    if (isFlagOutOfPlace(token))
+        return flagBeforeCommandRefusal(token, globalFlags);
+    return undefined;
+}
+/** The help the host answers in the command's place, which is the one flag it takes there. */
+const TOP_LEVEL_HELP = new Set(["--help", "-h"]);
+/** True for a flag-shaped token that is not the top-level help. */
+function isFlagOutOfPlace(token) {
+    return token.length > 1 && token.startsWith("-") && !TOP_LEVEL_HELP.has(token);
+}
+/** The refusal for a flag given before the command: the flag, what goes there, and where it goes. */
+function flagBeforeCommandRefusal(flag, globalFlags) {
+    const modifiers = globalFlags.map((modifier) => modifier.name).join(", ");
+    return (`The ${flag} flag was given before the command. Before the command, spec-controller takes ` +
+        `only its host modifiers (${modifiers}); a command's own flags go after it, as in ` +
+        `'spec-controller <command> ${flag}'.\n` +
+        `Run 'spec-controller --help' to see the commands and host modifiers this version accepts.`);
 }
 /**
  * Build the wrapped command argv: the command's clean args followed by a repeated
@@ -66,4 +143,31 @@ export function peekFlag(argv, name) {
     }
     return undefined;
 }
+/**
+ * Answer a command the registry does not carry. It is given the command token and the rendered
+ * help, never the command's args, so no flag after the command can change the answer.
+ *
+ * An unknown command is a usage fault, so it exits 2, the published usage code
+ * (packages/spec-controller/README.md), which `--exit-zero` never masks (3F-3649).
+ *
+ * @SCN-CLI-056 @SCN-CLI-057 — features/cli-balance.feature.
+ */
+export function answerUnknownCommand(command, help) {
+    return {
+        exitCode: 2,
+        stderr: `spec-controller: unknown command "${command}".\n\n${help}\n`,
+    };
+}
+/** The refusal for host modifiers given before a command that takes none, else undefined. */
+export function modifiersNotTakenRefusal(inv, commands = cliRegistry.commands) {
+    const entry = commands.find((command) => command.name === inv.command);
+    if (entry?.acceptsHostModifiers !== false)
+        return undefined;
+    const given = [inv.store === undefined ? [] : ["--store"], inv.runId === undefined ? [] : ["--run-id"]].flat();
+    if (given.length === 0)
+        return undefined;
+    return (`spec-controller: usage error — '${entry.name}' takes no host modifier, and was given ${given.join(", ")}: ` +
+        `it answers a query and keeps no run.\n` +
+        `Run 'spec-controller ${entry.name} …' without them.`);
+}
 //# sourceMappingURL=host.js.map

package/dist/host.js.map

@@ -1 +1 @@
-{"version":3,"file":"host.js","sourceRoot":"","sources":["../src/host.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAcH;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAuB;IACzD,IAAI,KAAyB,CAAC;IAC9B,IAAI,KAAyB,CAAC;IAC9B,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YAC/C,KAAK,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACpB,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,IAAI,KAAK,KAAK,UAAU,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YAChD,KAAK,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACpB,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,MAAM,CAAC,+CAA+C;IACxD,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;AAC5E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,WAA8B,EAAE,WAA8B;IAC5F,OAAO,CAAC,GAAG,WAAW,EAAE,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;AAChF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,QAAQ,CAAC,IAAuB,EAAE,IAAY;IAC5D,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;IACzB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACrB,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC1B,OAAO,KAAK,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5E,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}
+{"version":3,"file":"host.js","sourceRoot":"","sources":["../src/host.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,YAAY,EACZ,cAAc,EACd,mBAAmB,EACnB,YAAY,GACb,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,WAAW,EAAmC,MAAM,mBAAmB,CAAC;AAmBjF;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAuB,EACvB,cAAmC,WAAW,CAAC,MAAM,EACrD,WAA8B,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAEjF,iGAAiG;IACjG,kGAAkG;IAClG,MAAM,SAAS,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,OAAO,GAAG,kBAAkB,CAAC,KAAK,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;YAClE,IAAI,OAAO,KAAK,SAAS;gBAAE,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;YAC/D,MAAM,CAAC,0CAA0C;QACnD,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1B,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QACjG,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;QAC/D,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;QACvC,CAAC,EAAE,CAAC;IACN,CAAC;IACD,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC;QAAE,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;IACpH,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC;QAC5B,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC;QAC7B,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;QAChB,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC;KAC/B,CAAC;AACJ,CAAC;AAQD;;;;;;;;GAQG;AACH,SAAS,eAAe,CACtB,KAAa,EACb,QAAkB,EAClB,CAAC,KAAK,EAAE,KAAK,CAAoB,EACjC,IAAc;IAEd,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,iBAAiB,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;IACvF,IAAI,cAAc,CAAC,KAAK,CAAC;QAAE,OAAO,mBAAmB,CAAC,KAAK,EAAE,QAAQ,EAAE,iBAAiB,CAAC,CAAC;IAC1F,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QAC1F,OAAO,qBAAqB,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,KAAwB;IAChD,OAAO,CACL,iDAAiD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,qBAAqB;QACtF,wDAAwD;QACxD,2FAA2F,CAC5F,CAAC;AACJ,CAAC;AAED,6GAA6G;AAC7G,SAAS,qBAAqB,CAAC,KAAa,EAAE,QAAkB,EAAE,OAAe;IAC/E,OAAO,CACL,OAAO,KAAK,wBAAwB,OAAO,2DAA2D;QACtG,QAAQ,KAAK,0CAA0C,KAAK,IAAI,QAAQ,CAAC,GAAG,IAAI,EAAE,IAAI,OAAO,OAAO;QACpG,2FAA2F,CAC5F,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB,CACzB,KAAa,EACb,SAAwC,EACxC,WAAgC;IAEhC,IAAI,YAAY,CAAC,KAAK,CAAC;QAAE,OAAO,iBAAiB,CAAC,KAAK,EAAE,SAAS,EAAE,iBAAiB,CAAC,CAAC;IACvF,IAAI,gBAAgB,CAAC,KAAK,CAAC;QAAE,OAAO,wBAAwB,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IACjF,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,8FAA8F;AAC9F,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;AAEtE,mEAAmE;AACnE,SAAS,gBAAgB,CAAC,KAAa;IACrC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AACjF,CAAC;AAED,qGAAqG;AACrG,SAAS,wBAAwB,CAAC,IAAY,EAAE,WAAgC;IAC9E,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1E,OAAO,CACL,OAAO,IAAI,gFAAgF;QAC3F,4BAA4B,SAAS,8CAA8C;QACnF,8BAA8B,IAAI,MAAM;QACxC,2FAA2F,CAC5F,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,WAA8B,EAAE,WAA8B;IAC5F,OAAO,CAAC,GAAG,WAAW,EAAE,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;AAChF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,QAAQ,CAAC,IAAuB,EAAE,IAAY;IAC5D,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;IACzB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACrB,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC1B,OAAO,KAAK,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5E,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAQD;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAe,EAAE,IAAY;IAChE,OAAO;QACL,QAAQ,EAAE,CAAC;QACX,MAAM,EAAE,qCAAqC,OAAO,SAAS,IAAI,IAAI;KACtE,CAAC;AACJ,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,wBAAwB,CACtC,GAAmB,EACnB,WAAmC,WAAW,CAAC,QAAQ;IAEvD,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,GAAG,CAAC,OAAO,CAAC,CAAC;IACvE,IAAI,KAAK,EAAE,oBAAoB,KAAK,KAAK;QAAE,OAAO,SAAS,CAAC;IAC5D,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/G,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACzC,OAAO,CACL,mCAAmC,KAAK,CAAC,IAAI,2CAA2C,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;QAC5G,wCAAwC;QACxC,wBAAwB,KAAK,CAAC,IAAI,mBAAmB,CACtD,CAAC;AACJ,CAAC"}

package/dist/ingest/gherkinValidation.d.ts

@@ -23,11 +23,12 @@
  * PURE: `string → parse errors`. No fs, no process — the file READ lives beside it at the ingest
  * edge, as it does for every other input.
  *
- * WHY IT LIVES IN THE APP, NOT CORE. Core's barrel is the FROZEN v1 contract surface, guarded
- * both directions by @SCN-API-001 — a symbol added there reds CI. This validator is an INGEST
- * concern (it decides whether an input can be read at all), not part of the reconciliation
- * contract downstream consumers build on, so it belongs with the other readers at the app edge
- * and the frozen surface stays untouched.
+ * WHY IT LIVES IN THE APP, NOT CORE. Core's barrel is the v1 contract surface downstream consumers
+ * build on. Since 3F-3449 nothing reds when a symbol is added there — the guard that reconciled it
+ * both directions is gone — so keeping it narrow is a discipline rather than a gate. This validator
+ * is an INGEST concern (it decides whether an input can be read at all), not part of the
+ * reconciliation contract, so it belongs with the other readers at the app edge and the v1 surface
+ * stays untouched.
  */
 /** A Gherkin parse failure: the file could not be read as Gherkin at all. */
 export interface GherkinParseError {
@@ -73,13 +74,9 @@ export declare class UnreadableFeatureCorpusError extends Error {
  * refusal means for it.
  *
  * WHY A TYPED ERROR RATHER THAN AN EMPTY CORPUS. The obvious fix is for `discoverFeatures` to hand
- * back `[]` when the directory is not there. Measured, that would ship a NEW false green in a
- * second command: `spec-controller tags` reaches the same reader through `readCorpusInputs`, whose
- * GENERIC catch is the only thing turning an absent corpus — and, since `tags` carries no
- * `checkInputsExist`, a supplied-but-absent `--features` too — into `The corpus could not be
- * read: …` at exit 2. Tolerance at the reader turns both into `tags: OK …` at exit 0, inside the
- * slice whose whole purpose is killing a vacuous certification. Typed, both survive untouched:
- * this IS an `Error`, so it still lands in that generic catch.
+ * back `[]` when the directory is not there, and that would decide for every reader that absence
+ * is empty. Typed, each caller decides: `balance` reads it as no corpus (@SCN-CLI-017), and any
+ * other reader still meets a refusal. (The second command this guarded, `tags`, left at 3F-3635.)
  *
  * IT CARRIES THE DIRECTORY because the report is owed the name of what it examined — "I found no
  * record" and "I found no regression" must never wear one word (3F-2947), and a consumer told

package/dist/ingest/gherkinValidation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gherkinValidation.d.ts","sourceRoot":"","sources":["../../src/ingest/gherkinValidation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAKH,6EAA6E;AAC7E,MAAM,WAAW,iBAAiB;IAChC,qFAAqF;IACrF,IAAI,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,iBAAiB,EAAE,CAa/E;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,4BAA6B,SAAQ,KAAK;IACrD,QAAQ,CAAC,MAAM,EAAE,SAAS,iBAAiB,EAAE,CAAC;gBAElC,MAAM,EAAE,SAAS,iBAAiB,EAAE;CAUjD;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,yBAA0B,SAAQ,KAAK;IAClD,8FAA8F;IAC9F,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;gBAEf,SAAS,EAAE,MAAM;CAK9B"}
+{"version":3,"file":"gherkinValidation.d.ts","sourceRoot":"","sources":["../../src/ingest/gherkinValidation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAKH,6EAA6E;AAC7E,MAAM,WAAW,iBAAiB;IAChC,qFAAqF;IACrF,IAAI,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,iBAAiB,EAAE,CAa/E;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,4BAA6B,SAAQ,KAAK;IACrD,QAAQ,CAAC,MAAM,EAAE,SAAS,iBAAiB,EAAE,CAAC;gBAElC,MAAM,EAAE,SAAS,iBAAiB,EAAE;CAUjD;AAED;;;;;;;;;;;;;GAaG;AACH,qBAAa,yBAA0B,SAAQ,KAAK;IAClD,8FAA8F;IAC9F,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;gBAEf,SAAS,EAAE,MAAM;CAK9B"}

package/dist/ingest/gherkinValidation.js

@@ -23,11 +23,12 @@
  * PURE: `string → parse errors`. No fs, no process — the file READ lives beside it at the ingest
  * edge, as it does for every other input.
  *
- * WHY IT LIVES IN THE APP, NOT CORE. Core's barrel is the FROZEN v1 contract surface, guarded
- * both directions by @SCN-API-001 — a symbol added there reds CI. This validator is an INGEST
- * concern (it decides whether an input can be read at all), not part of the reconciliation
- * contract downstream consumers build on, so it belongs with the other readers at the app edge
- * and the frozen surface stays untouched.
+ * WHY IT LIVES IN THE APP, NOT CORE. Core's barrel is the v1 contract surface downstream consumers
+ * build on. Since 3F-3449 nothing reds when a symbol is added there — the guard that reconciled it
+ * both directions is gone — so keeping it narrow is a discipline rather than a gate. This validator
+ * is an INGEST concern (it decides whether an input can be read at all), not part of the
+ * reconciliation contract, so it belongs with the other readers at the app edge and the v1 surface
+ * stays untouched.
  */
 import { AstBuilder, GherkinClassicTokenMatcher, Parser } from "@cucumber/gherkin";
 import { IdGenerator } from "@cucumber/messages";
@@ -88,13 +89,9 @@ export class UnreadableFeatureCorpusError extends Error {
  * refusal means for it.
  *
  * WHY A TYPED ERROR RATHER THAN AN EMPTY CORPUS. The obvious fix is for `discoverFeatures` to hand
- * back `[]` when the directory is not there. Measured, that would ship a NEW false green in a
- * second command: `spec-controller tags` reaches the same reader through `readCorpusInputs`, whose
- * GENERIC catch is the only thing turning an absent corpus — and, since `tags` carries no
- * `checkInputsExist`, a supplied-but-absent `--features` too — into `The corpus could not be
- * read: …` at exit 2. Tolerance at the reader turns both into `tags: OK …` at exit 0, inside the
- * slice whose whole purpose is killing a vacuous certification. Typed, both survive untouched:
- * this IS an `Error`, so it still lands in that generic catch.
+ * back `[]` when the directory is not there, and that would decide for every reader that absence
+ * is empty. Typed, each caller decides: `balance` reads it as no corpus (@SCN-CLI-017), and any
+ * other reader still meets a refusal. (The second command this guarded, `tags`, left at 3F-3635.)
  *
  * IT CARRIES THE DIRECTORY because the report is owed the name of what it examined — "I found no
  * record" and "I found no regression" must never wear one word (3F-2947), and a consumer told

package/dist/ingest/gherkinValidation.js.map

@@ -1 +1 @@
-{"version":3,"file":"gherkinValidation.js","sourceRoot":"","sources":["../../src/ingest/gherkinValidation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,UAAU,EAAE,0BAA0B,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AACnF,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAUjD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,MAAc;IACxD,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,UAAU,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,0BAA0B,EAAE,CAAC,CAAC;IAEhG,IAAI,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACrB,OAAO,EAAE,CAAC;IACZ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,0FAA0F;QAC1F,sFAAsF;QACtF,0FAA0F;QAC1F,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAC7B,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,4BAA6B,SAAQ,KAAK;IAC5C,MAAM,CAA+B;IAE9C,YAAY,MAAoC;QAC9C,KAAK,CACH;YACE,yEAAyE;YACzE,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,GAAG,IAAI,KAAK,OAAO,EAAE,CAAC;SAC5D,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;QAC3C,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAClD,8FAA8F;IACrF,SAAS,CAAS;IAE3B,YAAY,SAAiB;QAC3B,KAAK,CAAC,gDAAgD,SAAS,EAAE,CAAC,CAAC;QACnE,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;QACxC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;CACF"}
+{"version":3,"file":"gherkinValidation.js","sourceRoot":"","sources":["../../src/ingest/gherkinValidation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAE,UAAU,EAAE,0BAA0B,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AACnF,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAUjD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,MAAc;IACxD,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,UAAU,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,0BAA0B,EAAE,CAAC,CAAC;IAEhG,IAAI,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACrB,OAAO,EAAE,CAAC;IACZ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,0FAA0F;QAC1F,sFAAsF;QACtF,0FAA0F;QAC1F,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAC7B,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,4BAA6B,SAAQ,KAAK;IAC5C,MAAM,CAA+B;IAE9C,YAAY,MAAoC;QAC9C,KAAK,CACH;YACE,yEAAyE;YACzE,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,GAAG,IAAI,KAAK,OAAO,EAAE,CAAC;SAC5D,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;QAC3C,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAClD,8FAA8F;IACrF,SAAS,CAAS;IAE3B,YAAY,SAAiB;QAC3B,KAAK,CAAC,gDAAgD,SAAS,EAAE,CAAC,CAAC;QACnE,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;QACxC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;CACF"}

package/dist/ingest/ingestQualityChecks.d.ts

@@ -15,25 +15,6 @@
 import { type GherkinParseError } from "./gherkinValidation.js";
 import { type EvidenceObligations } from "@3f-consulting/spec-controller-core";
 import type { EvidenceReconciliation } from "@3f-consulting/spec-controller-core";
-/**
- * A reader over ONE resolution pass's records.
- *
- * EACH RECORD IS OPENED ONCE, WHICH IS WHY THIS IS A CLOSURE AND NOT A FUNCTION PER REFERENCE. A
- * manifest may name several gates of one record, and a reader opening it per entry would let two
- * references answer for two different states of the same file — a rewrite landing mid-pass, a gate
- * present for one and gone for the next. One read makes the pass's bars one reading of one record.
- *
- * THE REFUSAL IS REMEMBERED TOO. Cacheing only the successes would re-open an absent or unreadable
- * record per reference, which is the same disagreement by the other door — and the likelier door,
- * since a record being rewritten is unreadable for exactly the window that matters.
- *
- * THE SUBTRACTION IS THE RECORD'S, NOT THIS EDGE'S. `killFloorOf` spends the allowance; an edge
- * computing `detected - slack` itself would be a second place holding a fact about the record.
- */
-export declare function killFloorReaderFor(root: string): (reference: {
-    readonly mutationGate: string;
-    readonly recordFile?: string;
-}) => number | null;
 /**
  * The reconciler's resolved input paths — the CLI options threaded to the readers.
  * Every path is optional; a missing result file is tolerated (its evidence is
@@ -48,12 +29,6 @@ export interface ReconcileOptions {
     cucumber?: string;
     ci?: string;
     packageJson?: string;
-    /**
-     * The measurement artefact (@SCN-CIP-003) — the number each measured check posted, and
-     * the credit side of every measured fitness check. Optional like the other result files: absent,
-     * it contributes nothing, and each measured obligation it would have answered reads `missing`.
-     */
-    measurements?: string;
     /**
      * The CI RUN'S OWN RECORD of what each of its steps did (@SCN-LNT-021, @SCN-LNT-028) — the credit
      * side of every CONVERTED fitness check, written by the consumer's own pipeline and by neither
@@ -85,26 +60,6 @@ export interface ReconcileOptions {
  * refusal is not ours to interpret and rethrows.
  */
 export declare function featureCorpusParseErrors(featuresDir: string | undefined): GherkinParseError[];
-/**
- * The `@SCN` ids the feature corpus CARRIES MORE THAN ONCE (@SCN-LDG-020's guardrail, 3F-1775).
- *
- * An `@SCN` identifies exactly ONE scenario — that is the whole basis of attributing evidence to
- * it. If two scenarios carry the same id, a test citing it could be proving EITHER, and the tool
- * cannot know which: the corpus is ambiguous, and any verdict over it is a guess.
- *
- * WHY THIS EXISTS. Tag inheritance made this reachable: an `@SCN` hoisted to a `Feature:`/`Rule:`
- * is inherited by every scenario beneath it (cucumber does this, so we do — parity). Left
- * unhandled, ONE passing test then marked EVERY scenario sharing that id `balanced`, including
- * scenarios nothing proves — a BALANCED-WHEN-BROKEN run, exit 0. A new silent false-green,
- * introduced by the very fix that closed the last one.
- *
- * Refused at the edge (exit 2) rather than reconciled, under the Rule already shipped for the
- * observed side and the corrupt corpus (@SCN-CLI-014/015/016): an input the tool cannot read is a
- * usage error, never a verdict. Whether hoisting an `@SCN` is an authoring fault worth a richer
- * diagnostic is the deferred policy question (3F-1774's sibling); refusing to reconcile a corpus we
- * cannot read is not a policy — it is the floor.
- */
-export declare function featureCorpusDuplicateScnIds(featuresDir: string | undefined): string[];
 /**
  * Read the target's `feature-code → slug` map over the same `discoverFeatures` corpus
  * (@SCN-RPT-006) — each coded feature file's `@<FFF>` header (`featureCode`)
@@ -113,10 +68,9 @@ export declare function featureCorpusDuplicateScnIds(featuresDir: string | undef
  * the balance, threaded to `renderMarkdown` (via `writeOutputs`) as the 5th sibling arg
  * (markdown-only — the by-feature cut is markdown-only, so it is NOT serialised to JSON).
  * Uncoded files (`featureCode === null`) are omitted, so the by-feature emitter falls
- * back to the bare `FFF` for any id whose code no file registers. One-prefix-one-file holds
- * by invariant (`corpusFaults` raises `duplicate-feature-code`, @SCN-STG-010), so the map is
- * unambiguous. That invariant was `lintFeatureCodes`' until 3F-3313; it is the shipped command's
- * now, which is the first time a CONSUMER of this reader has it too.
+ * back to the bare `FFF` for any id whose code no file registers. When two files carry one
+ * code the map keeps the last, and that run lists `duplicate-feature-code` under Scenario code
+ * errors and fails (@SCN-STG-010, 3F-3635), so a report whose map is ambiguous never passes.
  */
 export declare function readFeatureNames(featuresDir?: string): Map<string, string>;
 /**

package/dist/ingest/ingestQualityChecks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ingestQualityChecks.d.ts","sourceRoot":"","sources":["../../src/ingest/ingestQualityChecks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAYH,OAAO,EAGL,KAAK,iBAAiB,EACvB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAEL,KAAK,mBAAmB,EAEzB,MAAM,qCAAqC,CAAC;AA+B7C,OAAO,KAAK,EAIV,sBAAsB,EACvB,MAAM,qCAAqC,CAAC;AAwD7C;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,GAMX,CAAC,SAAS,EAAE;IAAE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,KAAK,MAAM,GAAG,IAAI,CAc/F;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AA8ED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,wBAAwB,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,iBAAiB,EAAE,CAQ7F;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,4BAA4B,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,EAAE,CAStF;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAM1E;AAED;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,mBAAmB,CAqB9E;AA2CD,wBAAgB,YAAY,CAAC,IAAI,EAAE,gBAAgB,GAAG,sBAAsB,CAgE3E"}
+{"version":3,"file":"ingestQualityChecks.d.ts","sourceRoot":"","sources":["../../src/ingest/ingestQualityChecks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAaH,OAAO,EAGL,KAAK,iBAAiB,EACvB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAEL,KAAK,mBAAmB,EAEzB,MAAM,qCAAqC,CAAC;AAkB7C,OAAO,KAAK,EAIV,sBAAsB,EACvB,MAAM,qCAAqC,CAAC;AA4B7C;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AA8ED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,wBAAwB,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,iBAAiB,EAAE,CAQ7F;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAM1E;AAED;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,mBAAmB,CAuB9E;AAyCD,wBAAgB,YAAY,CAAC,IAAI,EAAE,gBAAgB,GAAG,sBAAsB,CAoE3E"}

package/dist/ingest/ingestQualityChecks.js

@@ -13,10 +13,10 @@
  * `package.json` to observe each fitness check the corpus cites.
  */
 import { readFileSync, existsSync } from "node:fs";
-import { basename, join } from "node:path";
+import { basename } from "node:path";
 import { ciSourcePathsOf } from "./ciSourcePaths.js";
 import { discoverFeatures } from "./ingestScenarios.js";
-import { parseScenarios, countScnOccurrences, parseUntaggedScenarios, proseOnlyCodes, } from "@3f-consulting/spec-controller-core";
+import { parseScenarios, countScnOccurrences, parseUntaggedScenarios, proseOnlyCodes, sharedScnCodesOf, } from "@3f-consulting/spec-controller-core";
 import { MissingFeatureCorpusError, UnreadableFeatureCorpusError, } from "./gherkinValidation.js";
 import { DEFAULT_DEFERRAL_TAGS } from "../deferralTags.js";
 import { evidenceObligations, } from "@3f-consulting/spec-controller-core";
@@ -30,12 +30,6 @@ import { parseCucumberEvidenceObservations, } from "@3f-consulting/spec-controll
 // their CALLER. What is left here is the reads: this edge opens the files and hands the bytes over.
 import { evidenceReconciliationFromSources } from "@3f-consulting/spec-controller-core";
 import { resolveTargetRoot } from "../run-management/resolveRunInputs.js";
-// The record reader, reached for the RECORD half of a bar that names a gate (@SCN-MUT-012): its
-// conventional record name, its parser, and the floor a gate's own figures imply. Through the
-// barrel, which is the surface a caller holds. (The directory is still spelled `mutation-ratchet`
-// and the ratchet it was named for is deleted — 3F-3337 left the name standing rather than move a
-// module inside a delete; filed as a finding.)
-import { gateRecordFor, killFloorOf, MalformedRecordError, parseGateRecords, RECORD_FILE, } from "../mutation-ratchet/index.js";
 /**
  * The per-input FALLBACK quality-check for each JS-ecosystem result source — the
  * source→quality-check mapping, SET at the CLI edge rather than hardcoded in the core
@@ -54,74 +48,12 @@ const CUCUMBER_QUALITY_CHECK = "integration";
  * publishes and `balance` is the command that reconciles; the engine holds neither, and a core
  * that assumed them would be asserting something about a command line it never sees.
  *
- * BOTH TOKENS, AND THE SECOND IS NOT DECORATION. This repository's own pipeline runs
- * `pnpm spec-controller tags` beside its balance step — the same binary, doing something that is
- * an ordinary step of the pipeline being reconciled — so an invocation naming the binary alone
- * would take that step off the books. The comparison is whole, adjacent shell tokens
+ * BOTH TOKENS, AND THE SECOND IS NOT DECORATION. A step running the same binary for anything but
+ * `balance` is an ordinary step of the pipeline being reconciled, so an invocation naming the
+ * binary alone would take that step off the books. The comparison is whole, adjacent shell tokens
  * (`parse/commandRuns`), so this names the reconciliation and nothing else the tool can do.
  */
 const RECONCILER_INVOCATION = "spec-controller balance";
-/**
- * A refusal met with an absent bar rather than let out of this edge.
- *
- * NOTHING IS THROWN OUT OF HERE, and that is the stance rather than caution. A refusal that escapes
- * costs the whole run its verdict over one bad character in a file nobody may even be reading — a
- * fault that is loud nowhere, where an absent bar is loud on the ledger. It is `thresholdsOf`'s own
- * stance for a malformed entry, applied to the half of a bar that now lives in a second file.
- *
- * TWO CLASSES AND NO MORE. The record library normalises every fault it can see — the YAML parser's
- * own included — into `MalformedRecordError` precisely so a caller catches all of them by catching
- * one; beside it sits the read that never got as far as a record. A bare catch would swallow a
- * defect in this edge as well, and answer it with the same silent absence.
- */
-function orNoBar(read) {
-    try {
-        return read();
-    }
-    catch (cause) {
-        if (cause instanceof MalformedRecordError || isReadRefusal(cause))
-            return null;
-        throw cause;
-    }
-}
-/** A filesystem refusal — the record was not there, or could not be opened. */
-function isReadRefusal(cause) {
-    return cause instanceof Error && typeof cause.code === "string";
-}
-/**
- * A reader over ONE resolution pass's records.
- *
- * EACH RECORD IS OPENED ONCE, WHICH IS WHY THIS IS A CLOSURE AND NOT A FUNCTION PER REFERENCE. A
- * manifest may name several gates of one record, and a reader opening it per entry would let two
- * references answer for two different states of the same file — a rewrite landing mid-pass, a gate
- * present for one and gone for the next. One read makes the pass's bars one reading of one record.
- *
- * THE REFUSAL IS REMEMBERED TOO. Cacheing only the successes would re-open an absent or unreadable
- * record per reference, which is the same disagreement by the other door — and the likelier door,
- * since a record being rewritten is unreadable for exactly the window that matters.
- *
- * THE SUBTRACTION IS THE RECORD'S, NOT THIS EDGE'S. `killFloorOf` spends the allowance; an edge
- * computing `detected - slack` itself would be a second place holding a fact about the record.
- */
-export function killFloorReaderFor(root
-// The reader's shape is SPELLED here rather than imported, and that is the boundary working
-// rather than a duplication. `KillFloorReader` and the reference it takes are core-internal —
-// the registry-home question (increment D) still governs them — and this module is published, so
-// naming them by their `./internal` types would put an unpublished specifier back in the tarball
-// for a type alone. Structural typing is what makes the closure the engine's parameter accepts.
-) {
-    const opened = new Map();
-    return (reference) => {
-        const recordFile = reference.recordFile ?? RECORD_FILE;
-        if (!opened.has(recordFile)) {
-            opened.set(recordFile, orNoBar(() => parseGateRecords(readFileSync(join(root, recordFile), "utf8"), recordFile)));
-        }
-        const records = opened.get(recordFile);
-        if (records == null)
-            return null;
-        return orNoBar(() => killFloorOf(gateRecordFor(reference.mutationGate, records, recordFile)));
-    };
-}
 /** Read + JSON-parse a file if present, else return undefined. */
 function readJsonIfPresent(path) {
     if (!path || !existsSync(path))
@@ -142,7 +74,7 @@ function readJsonIfPresent(path) {
  * this by hand is five chances for one to stay intolerant, and a run that reports on a corpus for
  * four of its readings and throws on the fifth is worse than one that throws. The translation is
  * also why `discoverFeatures` is not the place to be tolerant — see its own note, and
- * `MissingFeatureCorpusError`'s: `tags` reaches the same reader and keeps refusing.
+ * `MissingFeatureCorpusError`'s.
  *
  * IT IS `[]`, NOT A VERDICT. Zero rows is what @SCN-CLI-019 reads as NOTHING TO RECONCILE, and a
  * corpus-less target that still has uncited credits keeps its suspense row and its exit 1
@@ -217,35 +149,6 @@ export function featureCorpusParseErrors(featuresDir) {
         throw err;
     }
 }
-/**
- * The `@SCN` ids the feature corpus CARRIES MORE THAN ONCE (@SCN-LDG-020's guardrail, 3F-1775).
- *
- * An `@SCN` identifies exactly ONE scenario — that is the whole basis of attributing evidence to
- * it. If two scenarios carry the same id, a test citing it could be proving EITHER, and the tool
- * cannot know which: the corpus is ambiguous, and any verdict over it is a guess.
- *
- * WHY THIS EXISTS. Tag inheritance made this reachable: an `@SCN` hoisted to a `Feature:`/`Rule:`
- * is inherited by every scenario beneath it (cucumber does this, so we do — parity). Left
- * unhandled, ONE passing test then marked EVERY scenario sharing that id `balanced`, including
- * scenarios nothing proves — a BALANCED-WHEN-BROKEN run, exit 0. A new silent false-green,
- * introduced by the very fix that closed the last one.
- *
- * Refused at the edge (exit 2) rather than reconciled, under the Rule already shipped for the
- * observed side and the corrupt corpus (@SCN-CLI-014/015/016): an input the tool cannot read is a
- * usage error, never a verdict. Whether hoisting an `@SCN` is an authoring fault worth a richer
- * diagnostic is the deferred policy question (3F-1774's sibling); refusing to reconcile a corpus we
- * cannot read is not a policy — it is the floor.
- */
-export function featureCorpusDuplicateScnIds(featuresDir) {
-    const seen = new Set();
-    const duplicates = new Set();
-    for (const scenario of scenariosFromFeatures(featuresDir)) {
-        if (seen.has(scenario.scnId))
-            duplicates.add(scenario.scnId);
-        seen.add(scenario.scnId);
-    }
-    return [...duplicates].sort();
-}
 /**
  * Read the target's `feature-code → slug` map over the same `discoverFeatures` corpus
  * (@SCN-RPT-006) — each coded feature file's `@<FFF>` header (`featureCode`)
@@ -254,10 +157,9 @@ export function featureCorpusDuplicateScnIds(featuresDir) {
  * the balance, threaded to `renderMarkdown` (via `writeOutputs`) as the 5th sibling arg
  * (markdown-only — the by-feature cut is markdown-only, so it is NOT serialised to JSON).
  * Uncoded files (`featureCode === null`) are omitted, so the by-feature emitter falls
- * back to the bare `FFF` for any id whose code no file registers. One-prefix-one-file holds
- * by invariant (`corpusFaults` raises `duplicate-feature-code`, @SCN-STG-010), so the map is
- * unambiguous. That invariant was `lintFeatureCodes`' until 3F-3313; it is the shipped command's
- * now, which is the first time a CONSUMER of this reader has it too.
+ * back to the bare `FFF` for any id whose code no file registers. When two files carry one
+ * code the map keeps the last, and that run lists `duplicate-feature-code` under Scenario code
+ * errors and fails (@SCN-STG-010, 3F-3635), so a report whose map is ambiguous never passes.
  */
 export function readFeatureNames(featuresDir) {
     const map = new Map();
@@ -283,9 +185,11 @@ export function readEvidenceObligations(features) {
     let scenarioCount = 0;
     const untagged = [];
     const sources = [];
+    const files = [];
     for (const f of featureFiles) {
         const source = readFileSync(f.path, "utf8");
         sources.push(source);
+        files.push({ feature: `${f.slug}.feature`, source });
         raw += countScnOccurrences(source);
         scenarioCount += parseScenarios(source).length;
         for (const scenario of parseUntaggedScenarios(source)) {
@@ -295,7 +199,7 @@ export function readEvidenceObligations(features) {
     untagged.sort((a, b) => a.feature.localeCompare(b.feature) || a.scenario.localeCompare(b.scenario));
     // The prose-only codes are a CROSS-CORPUS difference (a code tagged in any file isn't
     // dangling), so it reads all sources at once — not per-file like the others.
-    return evidenceObligations(raw, scenarioCount, untagged, proseOnlyCodes(sources));
+    return evidenceObligations(raw, scenarioCount, untagged, proseOnlyCodes(sources), sharedScnCodesOf(files));
 }
 /**
  * Parse the target's RUNTIME observations ONCE — the tag-derived, per-tier observation set
@@ -323,9 +227,8 @@ export function runReconcile(opts) {
     const pkgPath = opts.packageJson ?? "package.json";
     const packageJson = readJsonIfPresent(pkgPath) ?? {};
     // The TARGET repo root — the credit locators are made relative to it, so a phantom-scenario row's
-    // where-to-fix (ruling Q5) stays portable in a banked artefact, and a bar naming a mutation gate
-    // finds that target's record rather than this tool's own (@SCN-MUT-012). Resolved ONCE here and
-    // threaded, which is also what keeps `execFileSync` and `process.cwd()` out of the engine.
+    // where-to-fix (ruling Q5) stays portable in a banked artefact. Resolved ONCE here and threaded,
+    // which is also what keeps `execFileSync` and `process.cwd()` out of the engine.
     const root = resolveTargetRoot({ features: opts.features });
     // `--ci` names a workflow FILE or a DIRECTORY of them, and defaults to the directory
     // (@SCN-USG-006, 3F-2238): a pipeline split across files enforces its checks just as one
@@ -340,11 +243,19 @@ export function runReconcile(opts) {
     // keeping the core that way is the point. Resolving the list twice would be two chances for the
     // bytes and the names to fall out of the order they are paired by.
     const ciPaths = ciSourcePathsOf(ciPath);
+    // The corpus, discovered and read ONCE: its bytes, and — paired by index — which file each came
+    // from and the header code it carries, for the scenario code errors (3F-3635).
+    const corpusFiles = balanceCorpus(opts.features).map((f) => ({
+        slug: f.slug,
+        featureCode: f.featureCode,
+        source: readFileSync(f.path, "utf8"),
+    }));
     return evidenceReconciliationFromSources({
         // The corpus's bytes, read ONCE at this impure edge (3F-3088). The engine composes the three
         // readings a citing run needs from this one array, so they cannot be assembled from two
         // discoveries that disagree about the corpus (@SCN-LNT-009).
-        featureSources: featureSources(opts.features),
+        featureSources: corpusFiles.map((f) => f.source),
+        featureFiles: corpusFiles.map(({ slug, featureCode }) => ({ slug, featureCode })),
         // The untagged half by its `<feature> : <scenario>` locator — parsed here because the locator
         // names the FILE, which the discovery knows and a source string does not.
         untaggedScenarios: untaggedScenariosFromFeatures(opts.features),
@@ -355,26 +266,22 @@ export function runReconcile(opts) {
         // half of the entry that does not come out of the workflow's own text. The directory it sits
         // in is the caller's `--ci`, not the consumer's subject, so it is not part of what they write.
         ciSourceNames: ciPaths.map((path) => basename(path)),
-        measurements: readJsonIfPresent(opts.measurements) ?? {},
         // The CONVERTED checks' credit stream, read at this edge like every other report. Absent it is
         // undefined rather than empty, and that distinction reaches the reader (@SCN-LNT-027): "no
         // record" is a run nobody recorded, "a record holding nothing" is a run that recorded none of
         // these steps, and those are opposite facts.
-        // STRUCTURALLY, NOT BY NAME, for the reason `measurements` above is read that way: this module
-        // travels in the tarball and reaches core through the PUBLIC barrel alone (3F-3086), and
+        // STRUCTURALLY, NOT BY NAME: this module travels in the tarball and reaches core through the PUBLIC barrel alone (3F-3086), and
         // `CiStepRecord` is not on it. The shape is the document's, which is the consumer's, so what is
         // written here is what the file holds rather than a contract owed to anyone.
         ciStepRecord: readJsonIfPresent(opts.ciSteps),
         runtimeObservations: parseRuntimeObservations(opts, root),
-        // The three things the engine's resolvers cannot hold, and each for its own reason: the
-        // starter deferral set is the application layer's own policy, how this tool is invoked to
-        // reconcile is a fact about this product's command line, and the reader opens a file on the
-        // target's tree. THE PREFIX SET USED TO SIT HERE AND IS GONE (@SCN-USG-004, 3F-3343): the
+        // The two things the engine's resolvers cannot hold, and each for its own reason: the
+        // starter deferral set is the application layer's own policy, and how this tool is invoked to
+        // reconcile is a fact about this product's command line. THE PREFIX SET USED TO SIT HERE AND IS GONE (@SCN-USG-004, 3F-3343): the
         // engine no longer decides a check's membership by its name, so there is no convention left
         // for this edge to own.
         deferralTags: DEFAULT_DEFERRAL_TAGS,
         reconcilerInvocation: RECONCILER_INVOCATION,
-        killFloor: killFloorReaderFor(root),
     });
 }
 // The static-check kind-counts are no longer read as a parallel census (@SCN-USG-001 / 3F-2118):