coverage-preflight.sh --module: a single-file coverage-ledger.md is measured against every BRD in the project, so BRDs the module never claims read fully UNCLAIMED, and leaves other modules claim read UNCLAIMED too #543

File: project-bin/coverage-preflight.sh lines 459-464 (the else branch: for b in $BRDS; do "$ENGINE" … "$b" "$LEDGER"); compare lines 421-457 (directory form, which already skips other modules' BRDs) · Toolkit: 393d253 · mxcli: v0.27.0 · Mendix: 11.14.0

Summary

With the canonical one-ledger-per-module layout (architecture/modules/<Module>/coverage-ledger.md) and BRDs that
span several modules, verify-module.sh <Module> runs coverage-preflight.sh --summary --module <Module>, which
measures every BRD against that one module's file:

coverage-check: <F001>.brd.json   leaves 855    CLAIMED 0     UNCLAIMED 855
coverage-check: <F002>.brd.json   leaves 1995   CLAIMED 0     UNCLAIMED 1995
…
coverage-check: <F007>.brd.json   leaves 1407   CLAIMED 1216  UNCLAIMED 29

Two separate false reds come out of it:

1. BRDs the module does not claim at all (6 of 8 here) read as fully UNCLAIMED. Thousands of leaves, all of
   them claimed by other modules' ledgers.
2. Even the module's own BRD is wrong. Leaves of a shared BRD that another module claims read UNCLAIMED. In our
   run 29 leaves of the module's main BRD showed UNCLAIMED; another module's ledger claimed all 29.

Measured against all module ledgers concatenated, every one of the 8 BRDs is UNCLAIMED 0. The rung reports FINDING
on a project with no coverage gap, and the real signal (a leaf nobody claims) would be lost in about 8,700 lines of
noise.

Reproduce

Two modules, one BRD, each ledger claiming half its leaves with BRD-prefixed pointers:

architecture/modules/A/coverage-ledger.md   claims <F001>/useCases/0/*
architecture/modules/B/coverage-ledger.md   claims <F001>/useCases/1/*
bin/verify-module.sh A        # coverage: F001 UNCLAIMED = every leaf of useCases/1
cat architecture/modules/*/coverage-ledger.md > $TMPDIR/all.md
bin/coverage-check.sh --summary <F001>.brd.json $TMPDIR/all.md     # UNCLAIMED 0

Expected

A module's coverage rung reports gaps that are real for the project, and says which BRDs it did not measure.

Suggested fix (ranked)

1. Measure only BRDs this ledger claims. A BRD with no pointer in the module's ledger (no <BRDID>/… or
   matching .id) is listed as "another module's, not measured", exactly like the directory form's OTHERS line.
2. For the BRDs it does measure, judge UNCLAIMED against all ledgers. Run the engine on the concatenation of
   every ledger found by the four path shapes (or pass the other ledgers as "claimed elsewhere"), so a leaf is
   UNCLAIMED only when no module claims it. Report this module's CLAIMED count separately so the per-module figure
   is not lost.
3. Print a one-line legend when the single-file form is used for a multi-module project: "measured: N BRDs this
   ledger claims; UNCLAIMED is across all M ledgers".
4. Self-test: the two-module fixture above must give UNCLAIMED 0 for module A and name no other BRD as a gap.

How to retest

The fixture above; and on any multi-module project, verify-module.sh <Module>'s coverage UNCLAIMED must match the
all-ledgers run for every BRD it lists.