Module coverage 

Axis-coverage declarations: no read surface reports clean over state it did not examine. Where it cannot examine, it says so.

WHY: eight findings in one sweep shared a single shape, a surface emitting an all-clear that asserted less than it read as. Strict health promoted a hand-remembered subset of conditions, status defaulted to a clean rollup when nothing was declared, the conformance linter could not fail against a mem’s own schema, and workspace dump silently dropped mounts whose config did not parse. Each instance was fixed; this module is the rule that keeps the class shut. A reader who is told clean stops looking, so a clean verdict must carry the set of axes it answers for.

THE RULE, STATED ONCE: every surface a caller can read is declared in a per-consumer registry. A surface that emits a clean/ok verdict declares, for EVERY axis in the workspace vocabulary, either that its verdict examined the axis or that the axis is excluded with a stated reason. A surface that emits no verdict declares why not. The declaration states intent, which is exactly what cannot be derived from the code, since the defect the rule closes is surfaces doing less than they claim. Scoped statements are instances of this rule, not siblings of it: the anchor surface saying “reconciliation could not be performed” and the verify rollup’s blind-spots list are the per-run refinement of the same obligation the static declaration carries per surface.

The vocabulary reuses HEALTH_INCLUDE_KEYS rather than inventing a parallel axis roster: those keys are already the one shared statement of what the engine can examine, and only the verdict subjects no health include covers are added here.

ENFORCEMENT: validate_coverage is pure and total over data, so the gate can be demonstrated red against synthetic fixtures (a surface clean over an unexamined axis, an axis added without a declaration update) without reconstructing any historical tree. Each consumer crate holds a test that walks its own live surface roster (the clap command tree, the MCP tool router), hands the walk’s output to the validator, and fails on any finding. Those tests ride the ordinary cargo nextest legs of run-tests.sh, the same path every other permanent guard runs on. One surface is deliberately outside the rule: check records a caller’s verdict about the caller’s own work, so its registry entry is CoverageDisposition::NoVerdict, not an examined-axes claim.

Structs

AxisCoverage

One surface’s static coverage claim: which axes its verdict answers for, and why the rest are outside its scope. The two lists must jointly name every axis in the vocabulary; a blanket “everything else” clause is deliberately impossible, because it would swallow a newly introduced axis silently, and the one permanent property this module owes is that a new axis fails every declaration that has not met it.

SurfaceCoverage

One registry row: a surface name exactly as the consumer’s own mechanical walk produces it, plus its disposition.

Enums

CoverageDisposition

What a declared surface claims about verdicts.

Constants

EXTRA_VERDICT_AXES

Verdict subjects no health include key covers. projection is the fidelity axis status and projection verify answer for; mounts is the roster axis workspace dump and overview answer for (which mounts exist, which serve nothing, and why).

HEALTH_COVERAGE

The health surface’s coverage claim, shared by every consumer that renders a health report (the CLI command, the full MCP server’s composer, and the lean server’s own assembly): the axes whose findings the report treats as defects, so an empty defect statement reads as an all-clear exactly over them. Everything descriptive or advisory is excluded by name.

OVERVIEW_COVERAGE

The overview surface’s coverage claim, shared by every consumer that renders the composed overview (the CLI command and both MCP servers), and stamped into the composed frontmatter by compose_overview itself so the declaration and the output cannot diverge.

Functions

validate_coverage

Hold a registry against the axis vocabulary and a mechanically discovered surface roster. Returns one finding per defect; an empty result is the only clean outcome. Pure and total: callers in tests pass the live vocabulary and their own live walk, fixtures pass synthetic ones.

verdict_axes

The workspace axis vocabulary: everything a clean verdict can answer for. Composed, never copied, so it cannot drift from the health roster.