Module standards_coverage 

The Flight Rules rule coverage matrix (ticket .kranz/tickets/flight-rules-finding-provenance.md, KRZ-343; design docs/scoping/flight-rules-engineering-standards.md, decision D-H — “standards evidence is first-class”): one fold over the mission’s event log that joins every applicable pinned rule to the evidence that named it — gate verdicts carrying ruleIds, findings carrying a crate::types::RuleCitation — and renders each rule’s disposition as passed, failed, advisory, waived, not-evaluated, or not-applicable, with mechanism and artefact references.

WHY a fold over the log alone: D-H makes the append-only log the audit substrate, so the matrix must reconstruct without re-reading the pack, the plan file, or any model prose. The pin itself rides the plan.approved event’s standardsManifest (KRZ-342 — the reducer deliberately never re-reads one from plan.revised), the selection provenance rides standards.resolved, the drift refusals ride standards.drifted, and the evidence rides gate.result / validation.finding. Every join is STRUCTURED: rule id + revision + pinned digest, never a parse of subject/evidence text (the ticket’s “extend the shipped evidence spine; do NOT parse orchestrator prose”).

WHY absence is never pass (D-H): a rule nobody evaluated is not-evaluated, full stop. passed requires POSITIVE evidence — a gate.result pass that named the rule — and no failing join. The same failing evidence renders failed against an effectively ENFORCED rule and advisory against an approved one (D-B: an advisory rule’s violation could not have blocked). waived renders when every failing join on the row is covered by a valid, unexpired, exactly-matching standards.waiver.approved (KRZ-344, D-I) — the structured human exception event, joined on the full binding (rule id + pinned revision + manifest digest + approval seq + finding fingerprint + human surface). The ordinary orchestrator finding-waiver remains insufficient authority: a rule-cited finding waived as prose still renders failed/advisory.

WHY not-applicable rows exist: evidence occasionally names a rule the approved pin does not carry (a hand-authored or stale citation at another revision/digest). Joining it would corrupt the matrix against the consent artifact; dropping it would hide the citation. The fold surfaces it as its own row — the mission was not judged by that rule, and the audit says so.

Determinism (the ticket’s byte-identity hint): the fold consults no clock, no filesystem, no hash map in output order — rows follow the pin’s stable id order (then not-applicable rows sorted by id/revision/ digest), evidence follows log seq order, and every timestamp is the log’s own data. Waiver expiry is judged against the LOG’S OWN FRONTIER (the latest event instant in the mission’s slice), never a wall clock, so the same log folds byte-identically at any wall time — a replay renders the world as of the evidence, and an enforcement decision re-judges expiry against its own clock (KRZ-346). A mission with no pin folds to None, and every consumer renders NOTHING — pre-Flight-Rules logs stay byte-identical through report.md, provenance replay, and the evidence bundle.

Structs

CoverageEvidence

One evidence join behind a row’s disposition: which event named the rule, the mechanism that produced it, its bearing, and the reference the bytes re-found from — everything an auditor needs to locate the primary record in the log.

DriftRecord

One standards.drifted merge refusal, replayed: both digests and the changed applicable enforced rules, pinned to its seq (KRZ-342 D-E/D-H).

RuleCoverage

One row of the coverage matrix: a pinned rule (or a citation that failed to join one), its pinned identity, the disposition the evidence earned, and the joins behind it.

StandardsCoverage

The folded coverage matrix for one mission: the approved pin’s identity, its resolution provenance, every applicable rule’s disposition, and any merge-time drift refusals.

WaiverJoin

The waiver join behind a waived evidence entry (KRZ-344): everything the audit needs to name the exception without re-reading the event — its seq anchor, the approver principal + invocation surface, the recorded reason, and the expiry.

Enums

RuleDisposition

One rule’s disposition in the coverage matrix — D-H’s closed vocabulary. Serde kebab-case: the spellings are the design’s own (not-evaluated, not-applicable), so the machine form and the prose surfaces can never drift apart.

Functions

render_coverage_markdown

The coverage matrix as markdown — the ONE renderer report.md and the evidence-bundle summary share, so the two surfaces can never drift. Pure: same coverage in, same bytes out.

standards_coverage

Fold one mission’s standards coverage matrix from its event slice. events may contain other missions’ events (filtered out, the provenance idiom). Pure and total: no clock, no filesystem, no git — a mission with no approved standards pin folds to None, and every render surface then emits nothing.