@maycombhq/atticus 2.0.0-beta.2 → 2.0.0-beta.21

package/dist/{chunk-27NKUS3X.js → chunk-4SLBCEPD.js}

@@ -7,18 +7,19 @@ import {
   featuresForScan,
   namingHint,
   syncSources
-} from "./chunk-L24C55VN.js";
+} from "./chunk-64AADMTW.js";
 import {
   dirSource,
+  rereadPlan,
   sameCommit,
   verifyFacts
-} from "./chunk-PAMPPUR6.js";
+} from "./chunk-JYMIB5XY.js";
 import {
   scanInputs
-} from "./chunk-23W7VWKR.js";
+} from "./chunk-CPK7QSBG.js";
 import {
   listIngestors
-} from "./chunk-7EKXJZ2Y.js";
+} from "./chunk-YO2PKTXT.js";
 import {
   BUILT_IN_EXTRACTORS,
   MODEL_READERS,
@@ -33,12 +34,17 @@ import {
   runDialectTests,
   runFrameworkTests,
   unmodelledFrameworks
-} from "./chunk-MC3H7736.js";
+} from "./chunk-TWQRPM76.js";
 import {
   baseClonePath,
   changesSince,
-  checkoutState
-} from "./chunk-EFHQ3TWP.js";
+  checkoutState,
+  inPlaceDir
+} from "./chunk-XOL3GFW2.js";
+import {
+  buildContextPack,
+  toRunSummary
+} from "./chunk-QHJJMZLX.js";
 import {
   DEFAULT_IGNORES,
   configHash,
@@ -50,49 +56,71 @@ import {
   sandboxedExtractor,
   scanRepo,
   withParseCache
-} from "./chunk-GQ4N4WKF.js";
-import {
-  buildContextPack,
-  toRunSummary
-} from "./chunk-CNUKCS2T.js";
+} from "./chunk-7AB6OWTV.js";
 import {
   AgentDefinition,
   DECLARED_CALLER,
   DEFAULT_SPEC_TEMPLATE,
   HOSTS_NONE,
+  HOSTS_OUTSIDE_INTERNAL,
+  HOSTS_OUTSIDE_VENDOR,
   IsoDateTime,
   NEVER_CHECKED_STEPS,
+  NO_TARGET,
   PluginExpected,
   REPO_TYPE_SCHEMA_VERSION,
   RecordId,
   SCAN_SETTINGS_SCHEMA_VERSION,
+  TARGETS_ANOTHER_LABEL,
+  TARGETS_SPLIT_LABEL,
+  TARGETS_STEP_ID,
+  TOPICS_OUTSIDE_LABEL,
+  TOPICS_STEP_ID,
   applyCurated,
+  applyLinkEvidence,
+  applySharedMaps,
+  callHostOf,
   callTargetQuestion,
   callerRecords,
   catalogDirOf,
+  conventionsOf,
   declaredCallsOf,
   deserializeRecord,
+  effectiveComponentTypes,
   external_exports,
   factIdPart,
   factsDirOf,
   factsRelOf,
   fieldKey,
   flowFiles,
+  helperOn,
   hostMatches,
   hostQuestionText,
   identifierWords,
+  isAiBy,
+  isGuessedJoin,
+  isPathMatch,
   isPrototypeType,
   joinCallers,
+  joinConventions,
   joinFacts,
+  joinFlagsOf,
+  joinGuessesOf,
   joinRecords,
+  joinSharedMaps,
+  joinTerms,
   lineNamesField,
   lineNamesRoute,
   lineNamesWord,
+  linkEvidenceOf,
   listQuestions,
   loadOrgPack,
   mergeCatalog,
   normalizePath,
   orgPackDirOf,
+  outsideSystemOf,
+  pairsFromCorrections,
+  parseCorrections,
   parseFacts,
   parseRecord,
   projectFacts,
@@ -101,267 +129,32 @@ import {
   recordPath,
   require_dist,
   serializeRecord,
+  sharedJoinAbout,
+  singularNoun,
   slugify,
   specFileHash,
   specFindingFingerprint,
+  stackHelpersOff,
+  stripLinkEvidence,
+  stripSharedMaps,
+  termGrantRecords,
   throwIfCancelled,
   toCanonicalYaml,
+  topicQuestionText,
   urlHostPort
-} from "./chunk-S2A7YC3Q.js";
+} from "./chunk-PAINMSID.js";
 import {
   SCHEMA_VERSION,
   writeFileAtomic
-} from "./chunk-D3PO4DOZ.js";
+} from "./chunk-ODMBPDDV.js";
 import {
   __toESM
 } from "./chunk-TV45EUGM.js";
 
-// packages/glossary/dist/proposals.js
-var import_yaml = __toESM(require_dist(), 1);
-import { mkdir, readdir, readFile, rm, writeFile } from "node:fs/promises";
-import { join } from "node:path";
-var GLOSSARY_DEFINER = "glossary-definer";
-var GLOSSARY_CHANGE = "glossary";
-var GLOSSARY_OUTPUT = "catalog/proposals/glossary-definitions.yaml";
-var DefinitionProposalFile = external_exports.strictObject({
-  schemaVersion: external_exports.literal(1),
-  term: RecordId,
-  definition: external_exports.string().min(1),
-  evidence: external_exports.array(external_exports.string().min(1)).min(1),
-  agent: RecordId,
-  runId: external_exports.string().optional(),
-  at: IsoDateTime
-});
-var LEADING = ["schemaVersion", "term", "definition", "evidence"];
-async function writeDefinitionProposals(dir, proposals) {
-  const written = [];
-  if (!proposals.length)
-    return written;
-  await mkdir(join(dir, "glossaryterm"), { recursive: true });
-  for (const p of proposals) {
-    const file = `glossaryterm/${p.term}.yaml`;
-    const body = DefinitionProposalFile.parse({ schemaVersion: 1, ...p });
-    await writeFile(join(dir, file), toCanonicalYaml(body, LEADING), "utf8");
-    written.push(file);
-  }
-  return written;
-}
-async function readDefinitionProposals(dir) {
-  const proposals = [];
-  const problems = [];
-  let files;
-  try {
-    files = (await readdir(join(dir, "glossaryterm"))).filter((f) => /\.ya?ml$/.test(f)).sort();
-  } catch {
-    return { proposals, problems };
-  }
-  for (const f of files) {
-    const file = `glossaryterm/${f}`;
-    let data;
-    try {
-      data = (0, import_yaml.parse)(await readFile(join(dir, file), "utf8"));
-    } catch (e) {
-      problems.push({ file, message: `invalid YAML: ${e.message.split("\n")[0]}` });
-      continue;
-    }
-    const p = DefinitionProposalFile.safeParse(data);
-    if (!p.success) {
-      problems.push({
-        file,
-        message: p.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; ")
-      });
-      continue;
-    }
-    const { schemaVersion: _v, ...rest } = p.data;
-    void _v;
-    proposals.push(rest);
-  }
-  return { proposals, problems };
-}
-function glossaryDefinerAgent(orgPack) {
-  const own = orgPack?.agents.find((a) => a.id === GLOSSARY_DEFINER);
-  if (own)
-    return own;
-  return AgentDefinition.parse({
-    schemaVersion: 1,
-    id: GLOSSARY_DEFINER,
-    role: "business-analyst",
-    description: "Proposes a one-sentence business definition for each glossary term found only in code, from where the code uses it.",
-    inputs: ["glossary", "catalog-slice"],
-    // C5 has no output kind for catalog proposals (see ADR 0031); a definition seeds specs.
-    outputArtifact: "specs",
-    tokenBudget: orgPack?.runtime.budgets.defaultTokens ?? 15e4,
-    allowedRuntimes: ["hand-off", "model", "headless-claude-code", "mock", "replay"]
-  });
-}
-var INSTRUCTIONS = `# Glossary definer
-
-You propose business definitions for words an estate's code uses that no wiki page defines. Each term below is a data block: its id, the word, and the records (endpoints, topics, tables, columns, schema fields) that use it. For each term propose:
-
-- definition: one sentence a product owner would accept, saying what the word means to the business, only from the evidence;
-- evidence: the record ids from that term's block your definition relies on.
-
-Don't invent systems, rules or numbers. A proposal that cites no record id from its term is discarded. Write YAML and nothing else:
-
-terms:
-  - id: <term id>
-    definition: <one sentence>
-    evidence: [<record id>, ...]`;
-var Proposal = external_exports.object({
-  id: external_exports.string().min(1),
-  definition: external_exports.string().trim().min(3).max(400),
-  evidence: external_exports.array(external_exports.coerce.string()).default([])
-});
-function block(e) {
-  return toCanonicalYaml({
-    id: e.id,
-    term: e.term,
-    usedBy: (e.code?.uses ?? []).map((u) => ({
-      id: u.record,
-      kind: u.kind,
-      name: u.name,
-      ...u.evidence.path ? {
-        code: `${u.evidence.repo ? `${u.evidence.repo}:` : ""}${u.evidence.path}${u.evidence.line ? `:${u.evidence.line}` : ""}`
-      } : {}
-    }))
-  }, ["id", "term", "usedBy", "id", "kind", "name", "code"]).trimEnd();
-}
-function parseDefinerOutput(output, entries, meta) {
-  let data;
-  try {
-    data = (0, import_yaml.parse)(output.replace(/^```(?:ya?ml)?\s*\n|\n```\s*$/g, ""));
-  } catch (e) {
-    return {
-      proposals: [],
-      discarded: [{ reason: `the output is not YAML: ${e.message.split("\n")[0]}` }]
-    };
-  }
-  const list = data?.terms;
-  if (!Array.isArray(list))
-    return { proposals: [], discarded: [{ reason: "the output has no terms list" }] };
-  const byId = new Map(entries.map((e) => [e.id, e]));
-  const out = { proposals: [], discarded: [] };
-  for (const raw of list) {
-    const p = Proposal.safeParse(raw);
-    const id = typeof raw?.id === "string" ? raw.id : void 0;
-    if (!p.success) {
-      out.discarded.push({ ...id ? { term: id } : {}, reason: "incomplete proposal" });
-      continue;
-    }
-    const e = byId.get(p.data.id);
-    if (!e) {
-      out.discarded.push({
-        term: p.data.id,
-        reason: `${p.data.id} isn't one of the terms it was given`
-      });
-      continue;
-    }
-    if (out.proposals.some((x) => x.term === e.id)) {
-      out.discarded.push({ term: e.id, reason: "a second proposal for the same term" });
-      continue;
-    }
-    const known = new Set((e.code?.uses ?? []).map((u) => u.record));
-    const evidence = [...new Set(p.data.evidence.filter((x) => known.has(x)))];
-    if (!evidence.length) {
-      out.discarded.push({ term: e.id, reason: "it cites no record that uses the term" });
-      continue;
-    }
-    out.proposals.push({
-      term: e.id,
-      definition: p.data.definition.replace(/\s+/g, " "),
-      evidence,
-      agent: meta.agent,
-      at: meta.at,
-      ...meta.runId ? { runId: meta.runId } : {}
-    });
-  }
-  return out;
-}
-function undefinedCodeTerms(entries) {
-  return entries.filter((e) => e.sources.length === 1 && e.sources[0] === "code" && (e.code?.uses.length ?? 0) > 0);
-}
-async function proposeDefinitions(entries, runtime, o = {}) {
-  const todo = [...entries].sort((a, b) => a.id.localeCompare(b.id));
-  if (!todo.length)
-    return { proposals: [], discarded: [] };
-  const agent = glossaryDefinerAgent(o.orgPack);
-  const now2 = o.now ?? /* @__PURE__ */ new Date();
-  const at3 = now2.toISOString().replace(/\.\d{3}Z$/, "Z");
-  const levels = o.orgPack?.pack?.classification ?? [
-    "public",
-    "internal",
-    "confidential",
-    "restricted"
-  ];
-  const sources = [
-    {
-      id: "0-instructions",
-      kind: "instruction",
-      origin: "atticus/glossary",
-      text: INSTRUCTIONS,
-      classification: "public",
-      trusted: true
-    },
-    ...todo.map((e) => ({
-      id: e.id,
-      kind: "catalog",
-      origin: `catalog/generated/glossaryterm/${e.id}.yaml`,
-      text: block(e),
-      classification: "internal",
-      priority: 10
-    }))
-  ];
-  const pack = buildContextPack({
-    change: GLOSSARY_CHANGE,
-    agent: agent.id,
-    budget: o.orgPack?.runtime.budgets.perAgent[agent.id] ?? agent.tokenBudget,
-    sources,
-    levels,
-    maxClassification: levels.includes("internal") ? "internal" : levels.at(-1),
-    now: now2
-  });
-  const sent = todo.filter((e) => pack.manifest.sources.some((s) => s.id === e.id));
-  const discarded = todo.filter((e) => !sent.includes(e)).map((e) => ({
-    term: e.id,
-    reason: "left out of the context pack (budget or classification)"
-  }));
-  const prepared = await runtime.prepare({
-    change: GLOSSARY_CHANGE,
-    agent,
-    pack,
-    outputPath: GLOSSARY_OUTPUT
-  });
-  const run = await runtime.run(prepared.runId);
-  if (run.state === "waiting" || run.state === "prepared")
-    return {
-      proposals: [],
-      discarded,
-      waiting: run.runId,
-      promptSha256: pack.manifest.promptSha256
-    };
-  if (run.state !== "validated" || run.output === void 0)
-    return {
-      proposals: [],
-      discarded: [
-        ...discarded,
-        { reason: `the glossary definer ${run.state}: ${run.errors.join("; ") || "no output"}` }
-      ],
-      run: toRunSummary(run),
-      promptSha256: pack.manifest.promptSha256
-    };
-  const parsed = parseDefinerOutput(run.output, sent, { agent: agent.id, at: at3, runId: run.runId });
-  return {
-    proposals: parsed.proposals,
-    discarded: [...discarded, ...parsed.discarded],
-    run: toRunSummary(run),
-    promptSha256: pack.manifest.promptSha256
-  };
-}
-
-// packages/glossary/dist/decisions.js
-import { createHash } from "node:crypto";
-import { mkdir as mkdir2, writeFile as writeFile2 } from "node:fs/promises";
-import { dirname, join as join2 } from "node:path";
+// packages/scanner/dist/scan.js
+import { stat } from "node:fs/promises";
+import { dirname as dirname3, isAbsolute, join as join9, resolve as resolve2 } from "node:path";
+import { fileURLToPath } from "node:url";
 
 // packages/glossary/dist/words.js
 var STOP_TOKENS = /* @__PURE__ */ new Set([
@@ -407,21 +200,7 @@ var QUALIFIERS = /* @__PURE__ */ new Set([
   "previous"
 ]);
 var splitWords = (s) => identifierWords(s);
-function singular(w) {
-  if (w.length <= 3)
-    return w;
-  if (/ies$/.test(w))
-    return `${w.slice(0, -3)}y`;
-  if (/(ss|us|is)$/.test(w))
-    return w;
-  if (/(sses|shes|ches|xes|zes)$/.test(w))
-    return w.slice(0, -2);
-  if (/ses$/.test(w))
-    return w.slice(0, -1);
-  if (/s$/.test(w))
-    return w.slice(0, -1);
-  return w;
-}
+var singular = (w) => singularNoun(w);
 var isNoise = (w) => STOP_TOKENS.has(w) || /^v\d+$/.test(w) || /^\d+$/.test(w);
 function businessWords(s) {
   return splitWords(s).filter((w) => !isNoise(w)).map(singular);
@@ -457,101 +236,125 @@ function definitionKey(d) {
   return d.toLowerCase().replace(/[^a-z0-9]+/g, " ").trim();
 }
 
-// packages/glossary/dist/decisions.js
-var GlossaryError = class extends Error {
-  code;
-  constructor(code, message) {
-    super(message);
-    this.code = code;
-    this.name = "GlossaryError";
-  }
-};
-var now = () => (/* @__PURE__ */ new Date()).toISOString().replace(/\.\d{3}Z$/, "Z");
-function decisionId(prefix, key) {
-  const id = `${prefix}.${key}`;
-  if (id.length <= 120)
-    return id;
-  return `${id.slice(0, 110)}-${createHash("sha256").update(id).digest("hex").slice(0, 8)}`;
-}
-function decision(id, target, action, value, reason, o) {
-  if (!o.by.trim())
-    throw new GlossaryError("invalid", "Say who decides (--by <handle>).");
-  const p = parseRecord({
-    schemaVersion: 2,
-    kind: "CuratedDecision",
-    id,
-    status: "current",
-    confidence: "asserted",
-    evidence: [{ source: "manual", by: o.by }],
-    target,
-    action,
-    value,
-    reason: o.reason?.trim() || reason,
-    by: o.by,
-    at: o.at ?? now()
-  });
-  if (!p.ok)
-    throw new GlossaryError("invalid", `That decision isn't valid: ${p.issues.map((i) => `${i.path}: ${i.message}`).join("; ")}`);
-  return p.record;
-}
-function resolveTermId(termOrId) {
-  const t = termOrId.trim();
-  if (/^term\.[a-z0-9][a-z0-9._-]*$/.test(t))
-    return t;
-  const id = termId(t);
-  if (id === "term.")
-    throw new GlossaryError("invalid", `"${termOrId}" is not a term.`);
-  return id;
-}
-function defineDecision(term, definition, o) {
-  const def = definition.trim().replace(/\s+/g, " ");
-  if (def.length < 3)
-    throw new GlossaryError("invalid", "A definition needs a sentence.");
-  const id = resolveTermId(term);
-  const name = o.existing?.term ?? (term.startsWith("term.") ? void 0 : displayTerm(term));
-  return decision(decisionId("glossary.define", id.slice("term.".length)), id, "assert", { ...name ? { term: name } : {}, definition: def, ...o.owner ? { owner: o.owner } : {} }, `Glossary definition of ${name ?? id}`, o);
-}
-function aliasDecision(term, aliases, o) {
-  const id = resolveTermId(term);
-  const byKey = /* @__PURE__ */ new Map();
-  for (const a of aliases.map((x) => x.trim().replace(/\s+/g, " ")).filter(Boolean))
-    if (!byKey.has(termKey(a)))
-      byKey.set(termKey(a), a);
-  const names = [...byKey.values()].sort();
-  if (!names.length)
-    throw new GlossaryError("invalid", "Give at least one other name.");
-  return decision(decisionId("glossary.alias", id.slice("term.".length)), id, "alias", names, `Other names for ${id}`, o);
+// packages/glossary/dist/wiki.js
+var GLOSSARY = /\b(glossary|glossaries|definitions|terminology|terms|vocabulary)\b/i;
+var META = /^(owner|owners|last updated|updated|status|version|author|date|classification|approver|approvers|reviewed by|reviewer|lead time|typical lead time|title|tags|see also|note|notes|example|examples|source|link|links|contact|team)$/i;
+var strip = (s) => s.replace(/^\*\*(.+)\*\*$/, "$1").replace(/^__(.+)__$/, "$1").replace(/[`]/g, "").trim();
+function isTermLike(raw) {
+  const t = strip(raw);
+  if (!t || t.length > 60 || !/^[A-Za-z]/.test(t))
+    return false;
+  if (/:\/\/|[|?!;]/.test(t) || /[.,]$/.test(t))
+    return false;
+  if (META.test(t))
+    return false;
+  const words2 = t.split(/\s+/);
+  return words2.length >= 1 && words2.length <= 5;
 }
-function linkDecision(term, recordId, records, o) {
-  const byId = new Map(records.map((r) => [r.id, r]));
-  const [base2, field] = recordId.split("#");
-  const target = byId.get(base2);
-  if (!target)
-    throw new GlossaryError("not-found", `There is no record ${base2} in the catalog.`);
-  if (field !== void 0) {
-    if (target.kind !== "Schema" || !target.fields.some((f) => f.name === field))
-      throw new GlossaryError("not-found", `${base2} has no schema field ${field}.`);
-  } else if (target.kind === "Column") {
-    return decision(decisionId("glossary.link", target.id), target.id, "assert", { glossaryTerm: term.id }, `${target.id} holds the glossary term ${term.term}`, o);
+var cleanDefinition = (s) => s.replace(/\s+/g, " ").trim();
+var BOLD = /^(?:\*\*([^*]+?)\*\*|__([^_]+?)__)\s*(?::|\s[—–-]\s)\s*(.+)$/;
+var PLAIN = /^([A-Za-z][^:]{0,59}?)\s*(?::|\s[—–-]\s)\s*(.+)$/;
+function lineDefinition(text2, scoped) {
+  const b = BOLD.exec(text2);
+  if (b) {
+    const term = (b[1] ?? b[2]).trim();
+    const definition = cleanDefinition(b[3]);
+    if (isTermLike(term) && definition.length >= 3)
+      return { term, definition, markup: "bold" };
+    return void 0;
   }
-  const fields = [.../* @__PURE__ */ new Set([...term.fields, recordId])].sort();
-  return decision(decisionId("glossary.fields", term.id.slice("term.".length)), term.id, "assert", { fields }, `What the glossary term ${term.term} is linked to`, o);
+  if (!scoped)
+    return void 0;
+  const p = PLAIN.exec(text2);
+  if (p && isTermLike(p[1])) {
+    const definition = cleanDefinition(p[2]);
+    if (definition.length >= 3)
+      return { term: strip(p[1]), definition, markup: "line" };
+  }
+  return void 0;
 }
-async function writeDecisions(curatedDir, decisions) {
+var TERM_HEADER = /^(term|terms|name|word|phrase|concept)$/i;
+var DEF_HEADER = /^(definition|definitions|meaning|description|what it means)$/i;
+function scopes(page) {
+  const fmType = [page.frontMatter.type, page.frontMatter.kind].filter((v) => typeof v === "string").join(" ");
+  const pageWide = GLOSSARY.test(page.title) || GLOSSARY.test(fmType);
   const out = [];
-  for (const d of decisions) {
-    const rel = recordPath(d);
-    const full = join2(curatedDir, ...rel.split("/"));
-    await mkdir2(dirname(full), { recursive: true });
-    await writeFile2(full, serializeRecord(d), "utf8");
-    out.push(rel);
+  let openLevel;
+  for (const s of page.sections) {
+    if (openLevel !== void 0 && s.level > 0 && s.level <= openLevel)
+      openLevel = void 0;
+    if (openLevel === void 0 && s.level > 0 && GLOSSARY.test(s.heading))
+      openLevel = s.level;
+    out.push(pageWide || openLevel !== void 0);
   }
   return out;
 }
-
-// packages/glossary/dist/scan.js
-import { mkdir as mkdir3, readdir as readdir2, readFile as readFile2, rm as rm2, writeFile as writeFile3 } from "node:fs/promises";
-import { dirname as dirname2, join as join3, relative, sep } from "node:path";
+function pageDefinitions(page) {
+  const out = [];
+  const add = (term, definition, line, markup) => {
+    const t = displayTerm(strip(term));
+    const key = termKey(t);
+    if (!key)
+      return;
+    out.push({
+      term: t,
+      key,
+      definition,
+      path: page.path,
+      line,
+      markup,
+      pageTitle: page.title,
+      ...page.owner ? { owner: page.owner } : {}
+    });
+  };
+  const inScope = scopes(page);
+  page.sections.forEach((s, si) => {
+    const scoped = inScope[si];
+    if (scoped && s.level >= 2 && !GLOSSARY.test(s.heading) && isTermLike(s.heading)) {
+      const first = s.blocks[0];
+      if (first?.type === "paragraph" && !lineDefinition(first.text.split("\n")[0], true))
+        add(s.heading, cleanDefinition(first.text), first.line, "heading");
+    }
+    for (const b of s.blocks) {
+      if (b.type === "paragraph") {
+        const lines = b.text.split("\n");
+        for (let k = 0; k < lines.length; k++) {
+          const l = lines[k];
+          const next = lines[k + 1];
+          if (next !== void 0 && /^:\s+\S/.test(next) && isTermLike(l)) {
+            add(l, cleanDefinition(next.replace(/^:\s+/, "")), b.line + k, "definition-list");
+            k++;
+            continue;
+          }
+          const d = lineDefinition(l, scoped);
+          if (d)
+            add(d.term, d.definition, b.line + k, d.markup);
+        }
+      } else if (b.type === "list") {
+        for (const it of b.items) {
+          const d = lineDefinition(it.text.split("\n")[0], scoped);
+          if (d)
+            add(d.term, cleanDefinition([d.definition, ...it.text.split("\n").slice(1)].join(" ")), it.line, d.markup === "line" ? "list" : d.markup);
+        }
+      } else if (b.type === "table" && scoped) {
+        const ti = b.header.findIndex((h) => TERM_HEADER.test(strip(h)));
+        const di = b.header.findIndex((h) => DEF_HEADER.test(strip(h)));
+        if (ti < 0 || di < 0)
+          continue;
+        for (const r of b.rows) {
+          const term = r.cells[ti] ?? "";
+          const def = cleanDefinition(r.cells[di] ?? "");
+          if (isTermLike(term) && def.length >= 3)
+            add(term, def, r.line, "table");
+        }
+      }
+    }
+  });
+  return out.sort((a, b) => a.line - b.line);
+}
+function wikiDefinitions(pages) {
+  return pages.flatMap(pageDefinitions).sort((a, b) => a.path === b.path ? a.line - b.line : a.path < b.path ? -1 : 1);
+}
 
 // packages/glossary/dist/code.js
 var firstEvidence = (r) => r.evidence[0];
@@ -700,148 +503,28 @@ function fieldNames(records) {
   return named(records).filter((n) => n.isField).map((n) => ({ record: n.record, name: n.name }));
 }
 
-// packages/glossary/dist/wiki.js
-var GLOSSARY = /\b(glossary|glossaries|definitions|terminology|terms|vocabulary)\b/i;
-var META = /^(owner|owners|last updated|updated|status|version|author|date|classification|approver|approvers|reviewed by|reviewer|lead time|typical lead time|title|tags|see also|note|notes|example|examples|source|link|links|contact|team)$/i;
-var strip = (s) => s.replace(/^\*\*(.+)\*\*$/, "$1").replace(/^__(.+)__$/, "$1").replace(/[`]/g, "").trim();
-function isTermLike(raw) {
-  const t = strip(raw);
-  if (!t || t.length > 60 || !/^[A-Za-z]/.test(t))
-    return false;
-  if (/:\/\/|[|?!;]/.test(t) || /[.,]$/.test(t))
-    return false;
-  if (META.test(t))
-    return false;
-  const words2 = t.split(/\s+/);
-  return words2.length >= 1 && words2.length <= 5;
+// packages/glossary/dist/build.js
+var isDecision = (r) => r.kind === "CuratedDecision" && r.status === "current";
+var isObj = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+function typeSort(type) {
+  const t = type.toLowerCase();
+  if (/^(numeric|decimal|number|money|int|integer|bigint|smallint|tinyint|float|double|real|long|short)\b/.test(t))
+    return "number";
+  if (/^(date|time|timestamp|datetime|timestamptz|instant|localdate)/.test(t))
+    return "time";
+  if (/^(bool|boolean|bit)\b/.test(t))
+    return "boolean";
+  if (/^(uuid|guid)\b/.test(t))
+    return "identifier";
+  if (/^(varchar|char|character|nvarchar|nchar|text|string|clob|citext)/.test(t))
+    return "text";
+  return t.replace(/\(.*$/, "");
 }
-var cleanDefinition = (s) => s.replace(/\s+/g, " ").trim();
-var BOLD = /^(?:\*\*([^*]+?)\*\*|__([^_]+?)__)\s*(?::|\s[—–-]\s)\s*(.+)$/;
-var PLAIN = /^([A-Za-z][^:]{0,59}?)\s*(?::|\s[—–-]\s)\s*(.+)$/;
-function lineDefinition(text, scoped) {
-  const b = BOLD.exec(text);
-  if (b) {
-    const term = (b[1] ?? b[2]).trim();
-    const definition = cleanDefinition(b[3]);
-    if (isTermLike(term) && definition.length >= 3)
-      return { term, definition, markup: "bold" };
-    return void 0;
-  }
-  if (!scoped)
-    return void 0;
-  const p = PLAIN.exec(text);
-  if (p && isTermLike(p[1])) {
-    const definition = cleanDefinition(p[2]);
-    if (definition.length >= 3)
-      return { term: strip(p[1]), definition, markup: "line" };
-  }
-  return void 0;
-}
-var TERM_HEADER = /^(term|terms|name|word|phrase|concept)$/i;
-var DEF_HEADER = /^(definition|definitions|meaning|description|what it means)$/i;
-function scopes(page) {
-  const fmType = [page.frontMatter.type, page.frontMatter.kind].filter((v) => typeof v === "string").join(" ");
-  const pageWide = GLOSSARY.test(page.title) || GLOSSARY.test(fmType);
-  const out = [];
-  let openLevel;
-  for (const s of page.sections) {
-    if (openLevel !== void 0 && s.level > 0 && s.level <= openLevel)
-      openLevel = void 0;
-    if (openLevel === void 0 && s.level > 0 && GLOSSARY.test(s.heading))
-      openLevel = s.level;
-    out.push(pageWide || openLevel !== void 0);
-  }
-  return out;
-}
-function pageDefinitions(page) {
-  const out = [];
-  const add = (term, definition, line, markup) => {
-    const t = displayTerm(strip(term));
-    const key = termKey(t);
-    if (!key)
-      return;
-    out.push({
-      term: t,
-      key,
-      definition,
-      path: page.path,
-      line,
-      markup,
-      pageTitle: page.title,
-      ...page.owner ? { owner: page.owner } : {}
-    });
-  };
-  const inScope = scopes(page);
-  page.sections.forEach((s, si) => {
-    const scoped = inScope[si];
-    if (scoped && s.level >= 2 && !GLOSSARY.test(s.heading) && isTermLike(s.heading)) {
-      const first = s.blocks[0];
-      if (first?.type === "paragraph" && !lineDefinition(first.text.split("\n")[0], true))
-        add(s.heading, cleanDefinition(first.text), first.line, "heading");
-    }
-    for (const b of s.blocks) {
-      if (b.type === "paragraph") {
-        const lines = b.text.split("\n");
-        for (let k = 0; k < lines.length; k++) {
-          const l = lines[k];
-          const next = lines[k + 1];
-          if (next !== void 0 && /^:\s+\S/.test(next) && isTermLike(l)) {
-            add(l, cleanDefinition(next.replace(/^:\s+/, "")), b.line + k, "definition-list");
-            k++;
-            continue;
-          }
-          const d = lineDefinition(l, scoped);
-          if (d)
-            add(d.term, d.definition, b.line + k, d.markup);
-        }
-      } else if (b.type === "list") {
-        for (const it of b.items) {
-          const d = lineDefinition(it.text.split("\n")[0], scoped);
-          if (d)
-            add(d.term, cleanDefinition([d.definition, ...it.text.split("\n").slice(1)].join(" ")), it.line, d.markup === "line" ? "list" : d.markup);
-        }
-      } else if (b.type === "table" && scoped) {
-        const ti = b.header.findIndex((h) => TERM_HEADER.test(strip(h)));
-        const di = b.header.findIndex((h) => DEF_HEADER.test(strip(h)));
-        if (ti < 0 || di < 0)
-          continue;
-        for (const r of b.rows) {
-          const term = r.cells[ti] ?? "";
-          const def = cleanDefinition(r.cells[di] ?? "");
-          if (isTermLike(term) && def.length >= 3)
-            add(term, def, r.line, "table");
-        }
-      }
-    }
-  });
-  return out.sort((a, b) => a.line - b.line);
-}
-function wikiDefinitions(pages) {
-  return pages.flatMap(pageDefinitions).sort((a, b) => a.path === b.path ? a.line - b.line : a.path < b.path ? -1 : 1);
-}
-
-// packages/glossary/dist/build.js
-var isDecision = (r) => r.kind === "CuratedDecision" && r.status === "current";
-var isObj = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
-function typeSort(type) {
-  const t = type.toLowerCase();
-  if (/^(numeric|decimal|number|money|int|integer|bigint|smallint|tinyint|float|double|real|long|short)\b/.test(t))
-    return "number";
-  if (/^(date|time|timestamp|datetime|timestamptz|instant|localdate)/.test(t))
-    return "time";
-  if (/^(bool|boolean|bit)\b/.test(t))
-    return "boolean";
-  if (/^(uuid|guid)\b/.test(t))
-    return "identifier";
-  if (/^(varchar|char|character|nvarchar|nchar|text|string|clob|citext)/.test(t))
-    return "text";
-  return t.replace(/\(.*$/, "");
-}
-function definitionSort(d) {
-  if (/\b(amount|sum|total|count|number of|quantity)\b/i.test(d))
-    return "number";
-  if (/\b(date|timestamp|time at which|day on which)\b/i.test(d))
-    return "time";
+function definitionSort(d) {
+  if (/\b(amount|sum|total|count|number of|quantity)\b/i.test(d))
+    return "number";
+  if (/\b(date|timestamp|time at which|day on which)\b/i.test(d))
+    return "time";
   return void 0;
 }
 var ALIASES = (d) => (Array.isArray(d.value) ? d.value : [d.value]).map(String);
@@ -1021,38 +704,377 @@ function buildGlossary(input) {
     for (const col of linkedColumns)
       columnLinks.push({ column: col, term: id, how: "decision" });
   }
-  const decided = new Set(columnLinks.filter((l) => l.how === "decision").map((l) => l.column));
-  const links = columnLinks.filter((l) => l.how === "decision" || !decided.has(l.column)).sort((a, b) => a.column.localeCompare(b.column) || a.term.localeCompare(b.term));
-  const covered = /* @__PURE__ */ new Set([...terms.flatMap((t) => t.fields), ...links.map((l) => l.column)]);
-  const names = entries.map((e) => ({ id: e.id, term: e.term, aliases: e.aliases }));
-  const hints = fieldNames(records).filter((f) => !covered.has(f.record)).map((f) => namingHint(f.record, f.name, names)).filter((h) => !!h);
-  return {
-    terms,
-    entries,
-    columnLinks: links,
-    conflicts: conflicts.sort((a, b) => a.term.localeCompare(b.term) || a.kind.localeCompare(b.kind)),
-    hints,
-    problems
-  };
+  const decided = new Set(columnLinks.filter((l) => l.how === "decision").map((l) => l.column));
+  const links = columnLinks.filter((l) => l.how === "decision" || !decided.has(l.column)).sort((a, b) => a.column.localeCompare(b.column) || a.term.localeCompare(b.term));
+  const covered = /* @__PURE__ */ new Set([...terms.flatMap((t) => t.fields), ...links.map((l) => l.column)]);
+  const names = entries.map((e) => ({ id: e.id, term: e.term, aliases: e.aliases }));
+  const hints = fieldNames(records).filter((f) => !covered.has(f.record)).map((f) => namingHint(f.record, f.name, names)).filter((h) => !!h);
+  return {
+    terms,
+    entries,
+    columnLinks: links,
+    conflicts: conflicts.sort((a, b) => a.term.localeCompare(b.term) || a.kind.localeCompare(b.kind)),
+    hints,
+    problems
+  };
+}
+function applyGlossary(records, build) {
+  const link = /* @__PURE__ */ new Map();
+  for (const l of build.columnLinks)
+    if (!link.has(l.column))
+      link.set(l.column, l.term);
+  const out = [];
+  for (const r of records) {
+    if (r.kind === "GlossaryTerm")
+      continue;
+    if (r.kind === "Column" && !r.glossaryTerm && link.has(r.id))
+      out.push({ ...r, glossaryTerm: link.get(r.id) });
+    else
+      out.push(r);
+  }
+  return [...out, ...build.terms];
+}
+
+// packages/glossary/dist/proposals.js
+var import_yaml = __toESM(require_dist(), 1);
+import { mkdir, readdir, readFile, rm, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+var GLOSSARY_DEFINER = "glossary-definer";
+var GLOSSARY_CHANGE = "glossary";
+var GLOSSARY_OUTPUT = "catalog/proposals/glossary-definitions.yaml";
+var DefinitionProposalFile = external_exports.strictObject({
+  schemaVersion: external_exports.literal(1),
+  term: RecordId,
+  definition: external_exports.string().min(1),
+  evidence: external_exports.array(external_exports.string().min(1)).min(1),
+  agent: RecordId,
+  runId: external_exports.string().optional(),
+  at: IsoDateTime
+});
+var LEADING = ["schemaVersion", "term", "definition", "evidence"];
+async function writeDefinitionProposals(dir, proposals) {
+  const written = [];
+  if (!proposals.length)
+    return written;
+  await mkdir(join(dir, "glossaryterm"), { recursive: true });
+  for (const p of proposals) {
+    const file = `glossaryterm/${p.term}.yaml`;
+    const body = DefinitionProposalFile.parse({ schemaVersion: 1, ...p });
+    await writeFile(join(dir, file), toCanonicalYaml(body, LEADING), "utf8");
+    written.push(file);
+  }
+  return written;
+}
+async function readDefinitionProposals(dir) {
+  const proposals = [];
+  const problems = [];
+  let files;
+  try {
+    files = (await readdir(join(dir, "glossaryterm"))).filter((f) => /\.ya?ml$/.test(f)).sort();
+  } catch {
+    return { proposals, problems };
+  }
+  for (const f of files) {
+    const file = `glossaryterm/${f}`;
+    let data;
+    try {
+      data = (0, import_yaml.parse)(await readFile(join(dir, file), "utf8"));
+    } catch (e) {
+      problems.push({ file, message: `invalid YAML: ${e.message.split("\n")[0]}` });
+      continue;
+    }
+    const p = DefinitionProposalFile.safeParse(data);
+    if (!p.success) {
+      problems.push({
+        file,
+        message: p.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; ")
+      });
+      continue;
+    }
+    const { schemaVersion: _v, ...rest } = p.data;
+    void _v;
+    proposals.push(rest);
+  }
+  return { proposals, problems };
+}
+function glossaryDefinerAgent(orgPack) {
+  const own = orgPack?.agents.find((a) => a.id === GLOSSARY_DEFINER);
+  if (own)
+    return own;
+  return AgentDefinition.parse({
+    schemaVersion: 1,
+    id: GLOSSARY_DEFINER,
+    role: "business-analyst",
+    description: "Proposes a one-sentence business definition for each glossary term found only in code, from where the code uses it.",
+    inputs: ["glossary", "catalog-slice"],
+    // C5 has no output kind for catalog proposals (see ADR 0031); a definition seeds specs.
+    outputArtifact: "specs",
+    tokenBudget: orgPack?.runtime.budgets.defaultTokens ?? 15e4,
+    allowedRuntimes: ["hand-off", "model", "headless-claude-code", "mock", "replay"]
+  });
+}
+var INSTRUCTIONS = `# Glossary definer
+
+You propose business definitions for words an estate's code uses that no wiki page defines. Each term below is a data block: its id, the word, and the records (endpoints, topics, tables, columns, schema fields) that use it. For each term propose:
+
+- definition: one sentence a product owner would accept, saying what the word means to the business, only from the evidence;
+- evidence: the record ids from that term's block your definition relies on.
+
+Don't invent systems, rules or numbers. A proposal that cites no record id from its term is discarded. Write YAML and nothing else:
+
+terms:
+  - id: <term id>
+    definition: <one sentence>
+    evidence: [<record id>, ...]`;
+var Proposal = external_exports.object({
+  id: external_exports.string().min(1),
+  definition: external_exports.string().trim().min(3).max(400),
+  evidence: external_exports.array(external_exports.coerce.string()).default([])
+});
+function block(e) {
+  return toCanonicalYaml({
+    id: e.id,
+    term: e.term,
+    usedBy: (e.code?.uses ?? []).map((u) => ({
+      id: u.record,
+      kind: u.kind,
+      name: u.name,
+      ...u.evidence.path ? {
+        code: `${u.evidence.repo ? `${u.evidence.repo}:` : ""}${u.evidence.path}${u.evidence.line ? `:${u.evidence.line}` : ""}`
+      } : {}
+    }))
+  }, ["id", "term", "usedBy", "id", "kind", "name", "code"]).trimEnd();
+}
+function parseDefinerOutput(output, entries, meta) {
+  let data;
+  try {
+    data = (0, import_yaml.parse)(output.replace(/^```(?:ya?ml)?\s*\n|\n```\s*$/g, ""));
+  } catch (e) {
+    return {
+      proposals: [],
+      discarded: [{ reason: `the output is not YAML: ${e.message.split("\n")[0]}` }]
+    };
+  }
+  const list = data?.terms;
+  if (!Array.isArray(list))
+    return { proposals: [], discarded: [{ reason: "the output has no terms list" }] };
+  const byId = new Map(entries.map((e) => [e.id, e]));
+  const out = { proposals: [], discarded: [] };
+  for (const raw of list) {
+    const p = Proposal.safeParse(raw);
+    const id = typeof raw?.id === "string" ? raw.id : void 0;
+    if (!p.success) {
+      out.discarded.push({ ...id ? { term: id } : {}, reason: "incomplete proposal" });
+      continue;
+    }
+    const e = byId.get(p.data.id);
+    if (!e) {
+      out.discarded.push({
+        term: p.data.id,
+        reason: `${p.data.id} isn't one of the terms it was given`
+      });
+      continue;
+    }
+    if (out.proposals.some((x) => x.term === e.id)) {
+      out.discarded.push({ term: e.id, reason: "a second proposal for the same term" });
+      continue;
+    }
+    const known = new Set((e.code?.uses ?? []).map((u) => u.record));
+    const evidence = [...new Set(p.data.evidence.filter((x) => known.has(x)))];
+    if (!evidence.length) {
+      out.discarded.push({ term: e.id, reason: "it cites no record that uses the term" });
+      continue;
+    }
+    out.proposals.push({
+      term: e.id,
+      definition: p.data.definition.replace(/\s+/g, " "),
+      evidence,
+      agent: meta.agent,
+      at: meta.at,
+      ...meta.runId ? { runId: meta.runId } : {}
+    });
+  }
+  return out;
+}
+function undefinedCodeTerms(entries) {
+  return entries.filter((e) => e.sources.length === 1 && e.sources[0] === "code" && (e.code?.uses.length ?? 0) > 0);
+}
+async function proposeDefinitions(entries, runtime, o = {}) {
+  const todo = [...entries].sort((a, b) => a.id.localeCompare(b.id));
+  if (!todo.length)
+    return { proposals: [], discarded: [] };
+  const agent = glossaryDefinerAgent(o.orgPack);
+  const now2 = o.now ?? /* @__PURE__ */ new Date();
+  const at3 = now2.toISOString().replace(/\.\d{3}Z$/, "Z");
+  const levels = o.orgPack?.pack?.classification ?? [
+    "public",
+    "internal",
+    "confidential",
+    "restricted"
+  ];
+  const sources = [
+    {
+      id: "0-instructions",
+      kind: "instruction",
+      origin: "atticus/glossary",
+      text: INSTRUCTIONS,
+      classification: "public",
+      trusted: true
+    },
+    ...todo.map((e) => ({
+      id: e.id,
+      kind: "catalog",
+      origin: `catalog/generated/glossaryterm/${e.id}.yaml`,
+      text: block(e),
+      classification: "internal",
+      priority: 10
+    }))
+  ];
+  const pack = buildContextPack({
+    change: GLOSSARY_CHANGE,
+    agent: agent.id,
+    budget: o.orgPack?.runtime.budgets.perAgent[agent.id] ?? agent.tokenBudget,
+    sources,
+    levels,
+    maxClassification: levels.includes("internal") ? "internal" : levels.at(-1),
+    now: now2
+  });
+  const sent = todo.filter((e) => pack.manifest.sources.some((s) => s.id === e.id));
+  const discarded = todo.filter((e) => !sent.includes(e)).map((e) => ({
+    term: e.id,
+    reason: "left out of the context pack (budget or classification)"
+  }));
+  const prepared = await runtime.prepare({
+    change: GLOSSARY_CHANGE,
+    agent,
+    pack,
+    outputPath: GLOSSARY_OUTPUT
+  });
+  const run = await runtime.run(prepared.runId);
+  if (run.state === "waiting" || run.state === "prepared")
+    return {
+      proposals: [],
+      discarded,
+      waiting: run.runId,
+      promptSha256: pack.manifest.promptSha256
+    };
+  if (run.state !== "validated" || run.output === void 0)
+    return {
+      proposals: [],
+      discarded: [
+        ...discarded,
+        { reason: `the glossary definer ${run.state}: ${run.errors.join("; ") || "no output"}` }
+      ],
+      run: toRunSummary(run),
+      promptSha256: pack.manifest.promptSha256
+    };
+  const parsed = parseDefinerOutput(run.output, sent, { agent: agent.id, at: at3, runId: run.runId });
+  return {
+    proposals: parsed.proposals,
+    discarded: [...discarded, ...parsed.discarded],
+    run: toRunSummary(run),
+    promptSha256: pack.manifest.promptSha256
+  };
+}
+
+// packages/glossary/dist/decisions.js
+import { createHash } from "node:crypto";
+import { mkdir as mkdir2, writeFile as writeFile2 } from "node:fs/promises";
+import { dirname, join as join2 } from "node:path";
+var GlossaryError = class extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "GlossaryError";
+  }
+};
+var now = () => (/* @__PURE__ */ new Date()).toISOString().replace(/\.\d{3}Z$/, "Z");
+function decisionId(prefix, key) {
+  const id = `${prefix}.${key}`;
+  if (id.length <= 120)
+    return id;
+  return `${id.slice(0, 110)}-${createHash("sha256").update(id).digest("hex").slice(0, 8)}`;
+}
+function decision(id, target, action, value, reason, o) {
+  if (!o.by.trim())
+    throw new GlossaryError("invalid", "Say who decides (--by <handle>).");
+  const p = parseRecord({
+    schemaVersion: 2,
+    kind: "CuratedDecision",
+    id,
+    status: "current",
+    confidence: "asserted",
+    evidence: [{ source: "manual", by: o.by }],
+    target,
+    action,
+    value,
+    reason: o.reason?.trim() || reason,
+    by: o.by,
+    at: o.at ?? now()
+  });
+  if (!p.ok)
+    throw new GlossaryError("invalid", `That decision isn't valid: ${p.issues.map((i) => `${i.path}: ${i.message}`).join("; ")}`);
+  return p.record;
+}
+function resolveTermId(termOrId) {
+  const t = termOrId.trim();
+  if (/^term\.[a-z0-9][a-z0-9._-]*$/.test(t))
+    return t;
+  const id = termId(t);
+  if (id === "term.")
+    throw new GlossaryError("invalid", `"${termOrId}" is not a term.`);
+  return id;
+}
+function defineDecision(term, definition, o) {
+  const def = definition.trim().replace(/\s+/g, " ");
+  if (def.length < 3)
+    throw new GlossaryError("invalid", "A definition needs a sentence.");
+  const id = resolveTermId(term);
+  const name = o.existing?.term ?? (term.startsWith("term.") ? void 0 : displayTerm(term));
+  return decision(decisionId("glossary.define", id.slice("term.".length)), id, "assert", { ...name ? { term: name } : {}, definition: def, ...o.owner ? { owner: o.owner } : {} }, `Glossary definition of ${name ?? id}`, o);
+}
+function aliasDecision(term, aliases, o) {
+  const id = resolveTermId(term);
+  const byKey = /* @__PURE__ */ new Map();
+  for (const a of aliases.map((x) => x.trim().replace(/\s+/g, " ")).filter(Boolean))
+    if (!byKey.has(termKey(a)))
+      byKey.set(termKey(a), a);
+  const names = [...byKey.values()].sort();
+  if (!names.length)
+    throw new GlossaryError("invalid", "Give at least one other name.");
+  return decision(decisionId("glossary.alias", id.slice("term.".length)), id, "alias", names, `Other names for ${id}`, o);
+}
+function linkDecision(term, recordId, records, o) {
+  const byId = new Map(records.map((r) => [r.id, r]));
+  const [base2, field] = recordId.split("#");
+  const target = byId.get(base2);
+  if (!target)
+    throw new GlossaryError("not-found", `There is no record ${base2} in the catalog.`);
+  if (field !== void 0) {
+    if (target.kind !== "Schema" || !target.fields.some((f) => f.name === field))
+      throw new GlossaryError("not-found", `${base2} has no schema field ${field}.`);
+  } else if (target.kind === "Column") {
+    return decision(decisionId("glossary.link", target.id), target.id, "assert", { glossaryTerm: term.id }, `${target.id} holds the glossary term ${term.term}`, o);
+  }
+  const fields = [.../* @__PURE__ */ new Set([...term.fields, recordId])].sort();
+  return decision(decisionId("glossary.fields", term.id.slice("term.".length)), term.id, "assert", { fields }, `What the glossary term ${term.term} is linked to`, o);
 }
-function applyGlossary(records, build) {
-  const link = /* @__PURE__ */ new Map();
-  for (const l of build.columnLinks)
-    if (!link.has(l.column))
-      link.set(l.column, l.term);
+async function writeDecisions(curatedDir, decisions) {
   const out = [];
-  for (const r of records) {
-    if (r.kind === "GlossaryTerm")
-      continue;
-    if (r.kind === "Column" && !r.glossaryTerm && link.has(r.id))
-      out.push({ ...r, glossaryTerm: link.get(r.id) });
-    else
-      out.push(r);
+  for (const d of decisions) {
+    const rel = recordPath(d);
+    const full = join2(curatedDir, ...rel.split("/"));
+    await mkdir2(dirname(full), { recursive: true });
+    await writeFile2(full, serializeRecord(d), "utf8");
+    out.push(rel);
   }
-  return [...out, ...build.terms];
+  return out;
 }
 
 // packages/glossary/dist/scan.js
+import { mkdir as mkdir3, readdir as readdir2, readFile as readFile2, rm as rm2, writeFile as writeFile3 } from "node:fs/promises";
+import { dirname as dirname2, join as join3, relative, sep } from "node:path";
 async function readRecords(dir) {
   const records = [];
   const problems = [];
@@ -1174,16 +1196,16 @@ async function scanGlossary(root, o = {}) {
     }
   }
   const before = new Map(g.base.map((r) => [`${r.kind}/${r.id}`, r]));
-  const put = async (rel, text) => {
+  const put = async (rel, text2) => {
     const full = join3(generated, ...rel.split("/"));
     await mkdir3(dirname2(full), { recursive: true });
-    await writeFile3(full, text, "utf8");
+    await writeFile3(full, text2, "utf8");
     written.push(rel);
   };
-  for (const [rel, text] of want) {
+  for (const [rel, text2] of want) {
     const cur = await readFile2(join3(generated, ...rel.split("/")), "utf8").catch(() => void 0);
-    if (cur !== text)
-      await put(rel, text);
+    if (cur !== text2)
+      await put(rel, text2);
   }
   const termIds = new Set(g.terms.map((t) => t.id));
   for (const r of g.records) {
@@ -1221,6 +1243,49 @@ async function completeGlossaryDefinitions(root, run, o = {}) {
   return { ...scanned, propose };
 }
 
+// packages/scanner/dist/federate-loose.js
+function resolveFederatedLooseEnds(o) {
+  const originOf = (r) => (r.flags ?? []).find((f) => f.startsWith("federated:"))?.slice("federated:".length);
+  const loose = o.federated.filter((r) => r.kind === "Unresolved");
+  if (!loose.length)
+    return { federated: o.federated, resolved: /* @__PURE__ */ new Map() };
+  const fedComponents = o.federated.filter((r) => r.kind === "Component");
+  const result = o.merge([...o.raw, ...fedComponents, ...loose]);
+  const have = new Set(o.local.map((r) => `${r.kind}/${r.id}`));
+  const known = /* @__PURE__ */ new Set([
+    ...o.local.filter((r) => r.kind === "Component" || r.kind === "System").map((r) => r.id),
+    ...fedComponents.map((r) => r.id)
+  ]);
+  const origin = new Map(fedComponents.map((c) => [c.id, originOf(c)]));
+  const stillLoose = new Set(result.records.filter((r) => r.kind === "Unresolved").map((r) => r.id));
+  const added = [];
+  for (const r of result.records) {
+    if (r.kind !== "Interface" || have.has(`Interface/${r.id}`))
+      continue;
+    const i = r;
+    const from = origin.get(i.from) ?? origin.get(i.to);
+    if (!from || !known.has(i.from) || !known.has(i.to))
+      continue;
+    added.push({ ...r, flags: [.../* @__PURE__ */ new Set([...r.flags ?? [], `federated:${from}`])] });
+  }
+  const key = (e) => JSON.stringify(e);
+  const carried = new Set(added.flatMap((i) => i.evidence.map(key)));
+  const resolved = /* @__PURE__ */ new Map();
+  const kept2 = o.federated.filter((r) => {
+    if (r.kind !== "Unresolved" || stillLoose.has(r.id))
+      return true;
+    if (!r.evidence.some((e) => e.source !== "export" && carried.has(key(e))))
+      return true;
+    const id = originOf(r) ?? "";
+    resolved.set(id, (resolved.get(id) ?? 0) + 1);
+    return false;
+  });
+  return {
+    federated: [...kept2, ...added].sort((a, b) => a.kind === b.kind ? a.id.localeCompare(b.id) : a.kind.localeCompare(b.kind)),
+    resolved
+  };
+}
+
 // packages/scanner/dist/files.js
 import { readdir as readdir3, readFile as readFile3, rm as rm3 } from "node:fs/promises";
 import { join as join4, relative as relative2, resolve, sep as sep2 } from "node:path";
@@ -1274,8 +1339,8 @@ async function readCatalogFiles(dir, cacheRoot) {
     name: "catalog",
     version: CATALOG_CACHE_VERSION,
     cacheRoot,
-    parse: (text) => {
-      const r = deserializeRecord(text);
+    parse: (text2) => {
+      const r = deserializeRecord(text2);
       return r.ok ? { ok: true, value: r.record } : { ok: false, message: r.issues.map((i) => `${i.path}: ${i.message}`).join("; ") };
     }
   })) {
@@ -1292,14 +1357,14 @@ async function writeCatalog(dir, records) {
   const wanted = new Map(records.map((r) => [recordPath(r), serializeRecord(r)]));
   let written = 0;
   let unchanged = 0;
-  for (const [rel, text] of wanted) {
+  for (const [rel, text2] of wanted) {
     const full = join4(dir, ...rel.split("/"));
     const current = await readFile3(full, "utf8").catch(() => void 0);
-    if (current === text) {
+    if (current?.replace(/\r\n?/g, "\n") === text2) {
       unchanged++;
       continue;
     }
-    await writeFileAtomic(full, text);
+    await writeFileAtomic(full, text2);
     written++;
   }
   let removed = 0;
@@ -1380,16 +1445,19 @@ function prototypeScanNotes(op, only) {
 function isPrototypeRepo(op, repo) {
   return estateRepos(op).some((r) => r.id === repo && isPrototypeType(r.type));
 }
-function estateMergeInput(op, repos, records, modulesOf = (id) => repos.find((r) => r.id === id)?.modules ?? []) {
+function estateMergeInput(op, repos, records, modulesOf = (id) => repos.find((r) => r.id === id)?.modules ?? [], read) {
   return {
     records,
+    // ADR 0180: the organisation's component types, so a cited type is never demoted in a merge.
+    componentTypes: new Set(effectiveComponentTypes(op.componentTypes).map((t) => t.id)),
     repos: repos.flatMap((r) => [
       {
         id: r.id,
         type: r.type,
         ...r.component ? { component: r.component } : {},
         ...r.system ? { system: r.system } : {},
-        hosts: r.hosts
+        hosts: r.hosts,
+        ...read?.has(r.id) ? { read: true } : {}
       },
       // A module's hosts join calls to its own component (ADR 0057).
       ...modulesOf(r.id).filter((m) => m.hosts.length > 0).map((m) => ({
@@ -1405,15 +1473,346 @@ function estateMergeInput(op, repos, records, modulesOf = (id) => repos.find((r)
     profilePath: op.profiles[0] ? `org-pack/profiles/${op.profiles[0].platform}/profile.yaml` : void 0
   };
 }
-function mergeEstate(op, repos, records, modulesOf) {
-  return mergeCatalog(estateMergeInput(op, repos, records, modulesOf));
+function mergeEstate(op, repos, records, modulesOf, read) {
+  return mergeCatalog(estateMergeInput(op, repos, records, modulesOf, read));
 }
 function curatedDirOf(root, op) {
   return join5(root, ...op.sources.layout.catalog.split("/"), "curated");
 }
 
+// packages/scanner/dist/facts-scan.js
+import { readFile as readFile4 } from "node:fs/promises";
+import { join as join6 } from "node:path";
+
+// packages/scanner/dist/facts-catalog.js
+import { createHash as createHash2 } from "node:crypto";
+
+// packages/scanner/dist/target-suggest.js
+var TARGETS_MAX_SUGGESTED = 5;
+var TARGETS_ANOTHER = TARGETS_ANOTHER_LABEL;
+var TARGETS_NO_EVIDENCE = "no evidence; listed so you can pick it";
+var STOP = new Set("url uri base host client clients service services svc api apis http https rest endpoint endpoints impl java kt ts js py cs go src main test get post put delete patch the and for com www internal example config configs properties yaml yml env app apps application new call calls feign template web request requests response gateway proxy remote adapter port".split(" "));
+function nameWords(s) {
+  if (!s)
+    return [];
+  return [
+    ...new Set(s.replace(/([a-z0-9])([A-Z])/g, "$1 $2").toLowerCase().split(/[^a-z0-9]+/).filter((w) => w.length >= 3 && !STOP.has(w) && !/^v?\d+$/.test(w)).map((w) => w.length > 4 && w.endsWith("s") && !w.endsWith("ss") ? w.slice(0, -1) : w))
+  ];
+}
+var segs = (p) => p.split(/[?#]/)[0].split("/").filter(Boolean).map((x) => /^[{:<$]/.test(x) ? "{}" : x);
+var sameSeg = (a, b) => a === "{}" || b === "{}" || a === b;
+var under = (path, prefix) => {
+  const a = segs(prefix);
+  const b = segs(path);
+  return a.length > 0 && a.length <= b.length && a.every((x, i) => x === b[i]);
+};
+function serves(entry, call, bases) {
+  const e = segs(entry);
+  const tries = [
+    segs(call),
+    ...bases.filter((b) => under(call, b)).map((b) => segs(call).slice(segs(b).length))
+  ];
+  return tries.some((c) => c.length === e.length && c.every((x, i) => sameSeg(x, e[i])));
+}
+function clientOf(f) {
+  const q = f.cite.quote ?? "";
+  const named2 = /\b([A-Z][A-Za-z0-9]*(?:Client|Service|Api|Feign|Gateway|Proxy))\b/.exec(q)?.[1];
+  if (named2)
+    return named2;
+  const file = f.cite.file.split("/").pop().replace(/\.[^.]+$/, "");
+  return /(Client|Service|Api|Feign|Gateway|Proxy)$/.test(file) ? file : void 0;
+}
+function hostOf(f, facts) {
+  const fromUrl = (u) => /^[a-z][a-z0-9+.-]*:\/\/([^/:?#]+)/i.exec(u)?.[1];
+  if (f.host)
+    return fromUrl(f.host) ?? f.host.split(/[/:]/)[0];
+  if (f.base) {
+    const cfg = facts.find((x) => x.kind === "config" && x.key === f.base && !!x.value);
+    if (!cfg?.value)
+      return void 0;
+    return fromUrl(cfg.value) ?? (/^[a-z0-9-]+(\.[a-z0-9-]+)+(:\d+)?$/i.test(cfg.value) ? cfg.value.split(":")[0] : void 0);
+  }
+  return void 0;
+}
+var answerLabel = (q) => q.answer?.option !== void 0 ? q.options[q.answer.option - 1]?.label : q.answer?.text;
+var NOT_A_TARGET = /* @__PURE__ */ new Set(["None of these", TARGETS_SPLIT_LABEL, TARGETS_ANOTHER_LABEL]);
+function candidates(callerRepo, ctx) {
+  const manifest = estateRepos(ctx.op).filter((r) => r.id !== callerRepo || !!ctx.only);
+  const systems = ctx.op.profiles.flatMap((p) => p.profile?.systems ?? []);
+  const reposOfSystem = /* @__PURE__ */ new Map();
+  for (const r of estateRepos(ctx.op))
+    if (r.system)
+      reposOfSystem.set(r.system, (reposOfSystem.get(r.system) ?? 0) + 1);
+  const read = new Set((ctx.estate ?? []).filter((x) => x.facts.length > 0).map((x) => x.repo));
+  const repoOf = /* @__PURE__ */ new Map();
+  for (const r of ctx.records)
+    if (r.kind === "Component" && r.repo)
+      repoOf.set(r.id, r.repo);
+  if (!ctx.estate)
+    for (const repo of repoOf.values())
+      read.add(repo);
+  const endpoints = ctx.records.filter((r) => r.kind === "Endpoint");
+  const deploys = (ctx.estate ?? []).flatMap((x) => x.facts.filter((f) => f.kind === "deploy" && !!f.basePath));
+  const out = [];
+  for (const m of manifest) {
+    const own2 = new Set([m.id, m.component, ...m.modules.map((x) => x.component)].filter((x) => !!x).map(factIdPart));
+    const sys = m.system && reposOfSystem.get(m.system) === 1 ? systems.find((s) => s.id === m.system) : void 0;
+    const names = /* @__PURE__ */ new Map();
+    for (const n of [m.id, m.component, ...m.modules.map((x) => x.component)])
+      for (const w of nameWords(n))
+        if (!names.has(w))
+          names.set(w, n);
+    for (const a of sys ? [sys.id, ...sys.aliases] : [])
+      for (const w of nameWords(a))
+        if (!names.has(w))
+          names.set(w, a);
+    const bases = [];
+    if (m.basePath)
+      bases.push({ path: m.basePath, from: "the manifest's basePath" });
+    for (const x of m.modules)
+      if (x.basePath)
+        bases.push({ path: x.basePath, from: `the basePath of its module ${x.component}` });
+    for (const d of deploys) {
+      const reaches = d.exposes ? factIdPart(d.exposes) : d.repo === m.id ? m.id : void 0;
+      if (!reaches || !(own2.has(reaches) || d.repo === m.id && !d.exposes))
+        continue;
+      const what2 = d.platform === "apigee" ? "its proxy's BasePath" : `the ${d.resourceType ?? "route"} ${d.resourceName ?? d.id}`;
+      bases.push({ path: d.basePath, from: `${what2} (${d.repo} ${d.cite.file}:${d.cite.line})` });
+    }
+    const comps = [
+      ...new Set(endpoints.filter((e) => repoOf.get(e.component) === m.id).map((e) => e.component))
+    ].sort();
+    const isRead = read.has(m.id);
+    const forLabel = comps.length ? comps : [m.id];
+    for (const label2 of forLabel) {
+      const mine = endpoints.filter((e) => e.component === label2);
+      const entries = (ctx.estate ?? []).filter((x) => x.repo === m.id).flatMap((x) => x.facts.filter((f) => f.kind === "entry" && (!comps.length || factIdPart(f.component ?? m.component ?? m.id) === label2 || comps.length === 1))).map((f) => ({
+        ...f.method ? { method: f.method.toUpperCase() } : {},
+        path: f.path,
+        at: `${f.cite.file}:${f.cite.line}`
+      }));
+      for (const e of mine)
+        if (!entries.some((x) => x.path === e.pathOrTopic))
+          entries.push({
+            ...e.method ? { method: e.method.toUpperCase() } : {},
+            path: e.pathOrTopic,
+            at: e.id
+          });
+      out.push({
+        s: { label: label2, kind: "repo", repo: m.id, read: isRead, score: 0, why: [] },
+        names,
+        bases,
+        entries,
+        ...m.description?.text ? { description: m.description.text } : {},
+        hosts: m.hosts.map((h) => h.toLowerCase())
+      });
+    }
+  }
+  for (const c of ctx.only ?? [])
+    if (!out.some((x) => x.s.label === c))
+      out.push({
+        s: {
+          label: c,
+          kind: "repo",
+          repo: repoOf.get(c) ?? callerRepo,
+          read: true,
+          score: 0,
+          why: []
+        },
+        names: /* @__PURE__ */ new Map(),
+        bases: [],
+        entries: [],
+        hosts: []
+      });
+  const own = new Set(estateRepos(ctx.op).flatMap((r) => r.system ? [r.system] : []));
+  const seen = /* @__PURE__ */ new Set();
+  for (const s of systems) {
+    if (!(s.boundary === "vendor" || !own.has(s.id)) || seen.has(s.id))
+      continue;
+    seen.add(s.id);
+    const names = /* @__PURE__ */ new Map();
+    for (const n of [s.id, s.name, ...s.aliases])
+      for (const w of nameWords(n))
+        if (!names.has(w))
+          names.set(w, n);
+    out.push({
+      s: {
+        label: s.id,
+        kind: "outside",
+        read: false,
+        name: s.name,
+        boundary: s.boundary,
+        score: 0,
+        why: []
+      },
+      names,
+      bases: [],
+      entries: [],
+      hosts: s.aliases.map((a) => a.toLowerCase())
+    });
+  }
+  return out;
+}
+function targetSuggestions(f, ctx) {
+  const all = candidates(f.repo, ctx);
+  const df = /* @__PURE__ */ new Map();
+  for (const c of all)
+    for (const w of c.names.keys())
+      df.set(w, (df.get(w) ?? 0) + 1);
+  const telling = (w) => (df.get(w) ?? 0) <= Math.max(2, Math.floor(all.length / 3));
+  const host = hostOf(f, ctx.facts)?.toLowerCase();
+  const client = clientOf(f);
+  const said = [
+    { from: f.base ? `the config key ${f.base}` : "", words: nameWords(f.base), weight: 4 },
+    { from: client ? `the client ${client}` : "", words: nameWords(client), weight: 4 },
+    {
+      from: host ? `the host label ${host.split(".")[0]} (${host})` : "",
+      words: host ? nameWords(host.split(".")[0]) : [],
+      weight: 4
+    },
+    {
+      from: `the path ${f.path}`,
+      words: nameWords(segs(f.path).filter((x) => x !== "{}").join(" ")),
+      weight: 2
+    }
+  ].filter((x) => x.from && x.words.length);
+  const method = f.method?.toUpperCase();
+  const earlier = (ctx.questions ?? []).filter((q) => q.askedBy?.step === TARGETS_STEP_ID && q.state === "answered" && q.repo === f.repo && !q.evidence.includes(`${f.cite.file}:${f.cite.line}`));
+  const only = ctx.only ? new Set(ctx.only) : void 0;
+  const out = [];
+  for (const c of all) {
+    if (only && c.s.kind === "repo" && !only.has(c.s.label))
+      continue;
+    const s = { ...c.s, why: [] };
+    const add = (n, why) => {
+      s.score += n;
+      s.why.push(why);
+    };
+    if (only?.has(c.s.label))
+      add(6, "the join found an entry of it that serves the call");
+    const hit = c.entries.find((e) => (!method || !e.method || e.method === method || e.method === "ANY") && serves(e.path, f.path, c.bases.map((b) => b.path)));
+    if (hit && !only) {
+      const what2 = [hit.method, hit.path].filter(Boolean).join(" ");
+      add(6, `serves ${what2} (${hit.at})`);
+      s.serves = [what2];
+    }
+    const base2 = c.bases.find((b) => under(f.path, b.path));
+    if (base2)
+      add(5, `its basePath ${base2.path} matches: ${base2.from}`);
+    if (host && c.hosts.includes(host))
+      add(8, `it lists ${host} under hosts`);
+    for (const x of said) {
+      const w = x.words.find((y) => c.names.has(y) && telling(y));
+      if (w)
+        add(x.weight, `named like ${x.from}`);
+    }
+    if (c.description) {
+      const d = new Set(nameWords(c.description));
+      const w = said.flatMap((x) => x.words).find((y) => d.has(y) && telling(y));
+      if (w)
+        add(2, `its description mentions ${w}`);
+    }
+    const named2 = earlier.filter((q) => {
+      const l = answerLabel(q);
+      if (!l || NOT_A_TARGET.has(l))
+        return false;
+      const t = slugify(l);
+      return t === slugify(c.s.label) || !!c.s.repo && t === slugify(c.s.repo);
+    }).length;
+    if (named2)
+      add(3, `picked for ${named2} other ${named2 === 1 ? "call" : "calls"} of ${f.repo}`);
+    if (!s.score)
+      s.why.push(TARGETS_NO_EVIDENCE);
+    s.why = [...new Set(s.why)];
+    out.push(s);
+  }
+  return out.sort((a, b) => b.score - a.score || Number(b.read) - Number(a.read) || (a.kind === b.kind ? 0 : a.kind === "repo" ? -1 : 1) || a.label.localeCompare(b.label));
+}
+function offeredSuggestions(ranked, o) {
+  const max = o.max ?? TARGETS_MAX_SUGGESTED;
+  const strong = ranked.filter((s) => s.score >= 2);
+  const fill = ranked.filter((s) => s.score < 2 && (s.kind === "outside" || s.read && o.serving.has(s.label)));
+  return [...strong, ...fill].slice(0, max);
+}
+function targetPicker(op, read = /* @__PURE__ */ new Set()) {
+  const repos = estateRepos(op).map((r) => ({
+    id: r.id,
+    kind: "repo",
+    name: r.component && r.component !== r.id ? `${r.id} (${r.component})` : r.id,
+    read: read.has(r.id)
+  })).sort((a, b) => a.id.localeCompare(b.id));
+  const seen = /* @__PURE__ */ new Set();
+  const systems = op.profiles.flatMap((p) => p.profile?.systems ?? []).filter((s) => !seen.has(s.id) && !!seen.add(s.id)).map((s) => ({ id: s.id, kind: "system", name: s.name, boundary: s.boundary })).sort((a, b) => a.id.localeCompare(b.id));
+  const owned = new Set(op.profiles.flatMap((p) => (p.profile?.systems ?? []).flatMap((s) => s.owner ? [s.owner] : [])));
+  const teams = (op.roles?.teams ?? []).map((t) => {
+    const name = t.name ?? t.id;
+    const has = owned.has(t.id);
+    return {
+      id: t.id,
+      kind: "team",
+      name,
+      ...has ? {} : {
+        adds: {
+          id: slugify(`${t.id}-system`),
+          name: `${name}'s system`,
+          boundary: "internal",
+          owner: t.id
+        }
+      }
+    };
+  }).sort((a, b) => a.id.localeCompare(b.id));
+  return [...repos, ...systems, ...teams];
+}
+function pickerLines(picks) {
+  const of = (k) => picks.filter((p) => p.kind === k);
+  return [
+    `Repos (${of("repo").length}): ${of("repo").map((p) => `${p.id}${p.read ? "" : " (not read yet)"}`).join(", ") || "none"}`,
+    `Systems (${of("system").length}): ${of("system").map((p) => `${p.id} (${p.boundary})`).join(", ") || "none"}`,
+    `Teams (${of("team").length}): ${of("team").map((p) => `${p.id}${p.adds ? " (no system yet)" : ""}`).join(", ") || "none"}`
+  ];
+}
+function topicQuestionDrafts(repo, records) {
+  const out = /* @__PURE__ */ new Map();
+  for (const r of records) {
+    if (r.kind !== "Unresolved")
+      continue;
+    const x = r;
+    if (x.unresolvedKind !== "event-publish" && x.unresolvedKind !== "event-subscribe")
+      continue;
+    const topic = String(x.raw);
+    if (!topic || topic.includes("${") || /\s/.test(topic))
+      continue;
+    const ev = x.evidence.filter((e) => e.repo === repo && e.path && e.line && !/[\s:]/.test(e.path)).map((e) => `${e.path}:${e.line}`).sort();
+    if (!ev.length)
+      continue;
+    const side = x.unresolvedKind === "event-publish" ? "publish" : "listen";
+    const question = topicQuestionText(topic, x.owner ?? repo, side);
+    const draft = {
+      question,
+      options: [
+        {
+          label: TOPICS_OUTSIDE_LABEL,
+          means: `${topic} belongs to another team's system or a vendor's: name it, or the team, from the list`,
+          changes: `${topic} is added under that system's topics in the profile (or the system is added, owner the team), as a file change for review; the next write ${side === "publish" ? "sends the publish to it" : "takes the listener's messages from it"}, marked as your word`
+        },
+        {
+          label: "None of these",
+          means: `Nothing outside the estate owns ${topic}, or a repo not read yet serves it`,
+          changes: `It stays a loose end, and this isn't asked again`
+        }
+      ],
+      evidence: [...new Set(ev)],
+      scope: "repo"
+    };
+    const id = questionId({ step: TOPICS_STEP_ID, repo, question, evidence: draft.evidence });
+    if (!out.has(id))
+      out.set(id, { topic, id, draft });
+  }
+  return [...out.values()].sort((a, b) => a.topic.localeCompare(b.topic));
+}
+
 // packages/scanner/dist/facts-catalog.js
-var TARGETS_STEP = "facts-targets";
+var TARGETS_STEP = TARGETS_STEP_ID;
 var TARGETS_NONE = "None of these";
 var byKindId = (a, b) => a.kind === b.kind ? a.id.localeCompare(b.id) : a.kind.localeCompare(b.kind);
 var URL_RE = /^[a-z][a-z0-9+.-]*:\/\//i;
@@ -1433,6 +1832,42 @@ var EVENT_CALLS = /* @__PURE__ */ new Set(["event-topic", "mq-queue"]);
 function needsTarget(f, facts) {
   return f.kind === "call" && !f.to && !EVENT_CALLS.has(f.callType) && !(HTTP_CALLS.has(f.callType) && urlOf(f, facts));
 }
+var UNRESOLVED_HOST = /@[A-Za-z_][A-Za-z0-9_.-]*@|\$\{|\{[^}]*\}/;
+function ruleMayName(f, facts) {
+  if (f.kind !== "call" || EVENT_CALLS.has(f.callType))
+    return false;
+  if (!f.to && !(HTTP_CALLS.has(f.callType) && urlOf(f, facts)))
+    return true;
+  if (f.to)
+    return f.by !== "person" && UNRESOLVED_HOST.test(f.to);
+  if (!HTTP_CALLS.has(f.callType))
+    return false;
+  const url = urlOf(f, facts);
+  const host = url ? /^[a-z][a-z0-9+.-]*:\/\/([^/?#]*)/i.exec(url)?.[1] ?? "" : "";
+  if (!host || UNRESOLVED_HOST.test(host) || UNRESOLVED_HOST.test(f.host ?? ""))
+    return true;
+  if (f.host || !f.base)
+    return false;
+  const hosts = new Set(facts.filter((x) => x.kind === "config" && x.key === f.base && !!x.value).map((x) => URL_RE.test(x.value) ? urlHostPort(x.value)?.host : x.value.trim()).filter((h) => !!h));
+  return hosts.size > 1;
+}
+var MAX_ID = 120;
+function remapIds(remap) {
+  return (id) => {
+    const exact = remap.get(id);
+    if (exact)
+      return exact;
+    for (const [from, to] of remap)
+      if (id.startsWith(`${from}.`)) {
+        const out = to + id.slice(from.length);
+        if (out.length <= MAX_ID)
+          return out;
+        const hash = createHash2("sha256").update(out, "utf8").digest("hex").slice(0, 16);
+        return `${out.slice(0, MAX_ID - hash.length - 1).replace(/[-._]+$/, "")}.${hash}`;
+      }
+    return id;
+  };
+}
 function targetQuestionFor(f) {
   if (f.kind !== "call")
     return void 0;
@@ -1449,62 +1884,301 @@ var SERVES = {
   webhook: ["webhook"],
   sftp: ["file-drop"]
 };
-function targetQuestionDrafts(facts, records, op, asks) {
+function targetAsks(facts, records, asks) {
   const repoOf = /* @__PURE__ */ new Map();
   for (const r of records)
     if (r.kind === "Component" && r.repo)
       repoOf.set(r.id, r.repo);
-  const vendors = op.profiles.flatMap((p) => p.profile?.systems ?? []).filter((s) => s.boundary === "vendor").sort((a, b) => a.id.localeCompare(b.id));
+  const list = [];
+  for (const f of [...facts].sort((a, b) => a.id.localeCompare(b.id))) {
+    const ask = asks?.find((a) => a.reason === "ambiguous" && a.call.repo === f.repo && a.call.fact === f.id);
+    if (f.kind !== "call" || !needsTarget(f, facts) && !ask)
+      continue;
+    const own = slugify(f.component ?? f.repo).replace(/\./g, "-");
+    const types = new Set(SERVES[f.callType] ?? []);
+    const servers = ask ? [...new Set(ask.candidates.map((c) => c.component))].sort() : [
+      ...new Set(records.filter((r) => r.kind === "Endpoint" && types.has(r.endpointType) && r.component !== own).filter((r) => repoOf.get(r.component) !== f.repo).map((r) => r.component))
+    ].sort();
+    list.push({ f, q: targetQuestionFor(f), servers });
+  }
+  return { list, repoOf };
+}
+var outsideAs = (s) => s.boundary === "vendor" ? "an outside system" : "another team's system";
+var callWhat = (f) => [f.method?.toUpperCase(), f.path].filter(Boolean).join(" ");
+function suggestionWhy(s, prefix) {
+  const served = s.serves ?? [];
+  let why = s.why;
+  if (prefix !== void 0 && served.length > 1) {
+    const under2 = prefix === "/" ? "" : ` under ${prefix}`;
+    why = [
+      `serves ${served[0]} and ${served.length - 1} more${under2}`,
+      ...why.filter((w) => !w.startsWith("serves "))
+    ];
+  }
+  return (why.length ? why : [TARGETS_NO_EVIDENCE]).slice(0, 3).join("; ");
+}
+function suggestionOption(s, callerRepo, n, prefix) {
+  const why = suggestionWhy(s, prefix);
+  if (s.kind === "outside")
+    return {
+      label: s.label,
+      means: `${s.name}, ${outsideAs({ boundary: s.boundary ?? "vendor" })}: ${why}`,
+      changes: n ? `The ${n} calls go to ${s.name} when the facts are next written` : `The call goes to ${s.name} when the facts are next written`
+    };
+  const who = s.label === s.repo ? `${s.repo}${s.read ? "" : " (not read yet)"}` : `${s.label}, built in ${s.repo}${s.read ? "" : " (not read yet)"}`;
+  const them = n ? `The ${n} calls` : "The call";
+  return {
+    label: s.label,
+    means: `${who}: ${why}`,
+    changes: s.read ? `${them} ${n ? "join" : "joins"} ${s.label} when the facts are next written (atticus verify ${callerRepo} --write)` : `${them} ${n ? "go" : "goes"} to ${s.repo} when the facts are next written (atticus verify ${callerRepo} --write), and ${n ? "join" : "joins"} its route once ${s.repo} is read and verified (/atticus-map ${s.repo}); if no route of it serves ${n ? "them" : "it"}, the question opens again`
+  };
+}
+var anotherOption = (op) => {
+  const repos = estateRepos(op).length;
+  const systems = new Set(op.profiles.flatMap((p) => (p.profile?.systems ?? []).map((s) => s.id))).size;
+  const teams = op.roles?.teams?.length ?? 0;
+  return {
+    label: TARGETS_ANOTHER,
+    means: `A repo, system or team not listed here: the manifest's ${repos} repos (read or not), the profiles' ${systems} systems and the ${teams} teams in roles.yaml`,
+    changes: "Nothing until you name one: atticus questions answer <id> --target <repo, system or team id> lists them and takes the one you name (the app's Questions page lists them too); naming a vendor or a team with no system adds that system to the profile for review"
+  };
+};
+function offered(members, facts, records, op, asks, ctx) {
+  const merged = /* @__PURE__ */ new Map();
+  for (const m of members) {
+    const ambiguous = asks?.some((a) => a.reason === "ambiguous" && a.call.repo === m.f.repo && a.call.fact === m.f.id);
+    for (const s of targetSuggestions(m.f, {
+      op,
+      records,
+      facts,
+      ...ctx.estate ? { estate: ctx.estate } : {},
+      ...ctx.questions ? { questions: ctx.questions } : {},
+      ...ambiguous ? { only: m.servers } : {}
+    })) {
+      const x = merged.get(s.label);
+      if (!x)
+        merged.set(s.label, { ...s, why: [...s.why], serves: [...s.serves ?? []] });
+      else {
+        x.score += s.score;
+        for (const w of s.why)
+          if (!x.why.includes(w))
+            x.why.push(w);
+        for (const w of s.serves ?? [])
+          if (!x.serves.includes(w))
+            x.serves.push(w);
+        if (x.why.length > 1)
+          x.why = x.why.filter((w) => w !== TARGETS_NO_EVIDENCE);
+      }
+    }
+  }
+  const ranked = [...merged.values()].sort((a, b) => b.score - a.score || Number(b.read) - Number(a.read) || (a.kind === b.kind ? 0 : a.kind === "repo" ? -1 : 1) || a.label.localeCompare(b.label));
+  const serving = new Set(members.flatMap((m) => m.servers));
+  const types = new Set(members.flatMap((m) => SERVES[m.f.callType] ?? []));
+  return offeredSuggestions(ranked, { types, serving });
+}
+function targetQuestionDrafts(facts, records, op, asks, ctx = {}) {
+  const { list } = targetAsks(facts, records, asks);
+  return list.map((m) => {
+    const { f, q } = m;
+    const draft = {
+      question: q.question,
+      options: [
+        ...offered([m], facts, records, op, asks, ctx).map((s) => suggestionOption(s, f.repo)),
+        anotherOption(op),
+        {
+          label: TARGETS_NONE,
+          means: "Nothing in the estate or the org pack's systems answers it",
+          changes: "The call stays a loose end, and this isn't asked again"
+        }
+      ],
+      evidence: q.evidence,
+      scope: "repo"
+    };
+    return {
+      factId: f.id,
+      id: questionId({
+        step: TARGETS_STEP,
+        repo: f.repo,
+        question: q.question,
+        evidence: q.evidence
+      }),
+      repo: f.repo,
+      draft
+    };
+  });
+}
+var TARGETS_SPLIT = TARGETS_SPLIT_LABEL;
+var PREFIX_ROOT = /^(api|rest|services?|v\d+(\.\d+)*)$/i;
+function targetPathPrefix(path) {
+  const lead = path.startsWith("/") ? "/" : "";
+  const out = [];
+  for (const s of path.split(/[?#]/)[0].split("/").filter(Boolean)) {
+    if (/^[{:<]/.test(s))
+      break;
+    out.push(s);
+    if (!PREFIX_ROOT.test(s))
+      break;
+  }
+  return out.length ? `${lead}${out.join("/")}` : "/";
+}
+function groupVia(f) {
+  if (f.to)
+    return ` naming ${f.to}`;
+  if (f.host)
+    return ` on ${f.host}`;
+  if (f.base)
+    return ` through ${f.base}`;
+  return "";
+}
+function targetGroupQuestion(repo, f, facts) {
+  const proxy = facts ? proxyOf(f, facts) : void 0;
+  const through = f.base ?? f.host ?? f.to;
+  if (proxy && through) {
+    const p = targetPathPrefix(f.path);
+    return `Which repo serves the routes under ${p === "/" ? "" : p}/** that ${proxy} forwards to ${through}?`;
+  }
+  return `Which repo or system answers the calls ${repo} makes under ${targetPathPrefix(f.path)}${groupVia(f)}?`;
+}
+function proxyOf(f, facts) {
+  if (!f.from)
+    return void 0;
+  const from = facts.find((x) => x.id === f.from);
+  if (!from || from.kind !== "entry")
+    return void 0;
+  const proxy = facts.find((x) => x.kind === "deploy" && x.repo === f.repo && x.platform === "apigee" && !!x.basePath);
+  return proxy ? proxy.resourceName ?? f.repo : void 0;
+}
+function targetGroupWordings(repo, f, facts) {
+  return [.../* @__PURE__ */ new Set([targetGroupQuestion(repo, f, facts), targetGroupQuestion(repo, f)])];
+}
+var repo0 = (members) => members[0].f.repo;
+var byLine = (a, b) => a.localeCompare(b, "en", { numeric: true });
+var answerLabel2 = (q) => q.answer?.option !== void 0 ? q.options[q.answer.option - 1]?.label : q.answer?.text;
+function splitTargetGroups(questions) {
+  return new Set(questions.filter((q) => q.askedBy?.step === TARGETS_STEP && q.state === "answered" && answerLabel2(q) === TARGETS_SPLIT).map((q) => q.question.trim()));
+}
+function groupedTargetDrafts(facts, records, op, asks, o) {
+  const { list } = targetAsks(facts, records, asks);
+  const ctx = {
+    ...o.estate ? { estate: o.estate } : {},
+    ...o.questions ? { questions: o.questions } : {}
+  };
+  const own = new Map(targetQuestionDrafts(facts, records, op, asks, ctx).map((d) => [d.factId, d]));
+  const groups = /* @__PURE__ */ new Map();
+  for (const a of list) {
+    if (!o.ask.has(a.f.id))
+      continue;
+    const k = targetGroupQuestion(a.f.repo, a.f, facts);
+    groups.set(k, [...groups.get(k) ?? [], a]);
+  }
   const out = [];
-  for (const f of [...facts].sort((a, b) => a.id.localeCompare(b.id))) {
-    const ask = asks?.find((a) => a.reason === "ambiguous" && a.call.repo === f.repo && a.call.fact === f.id);
-    if (f.kind !== "call" || !needsTarget(f, facts) && !ask)
+  for (const [question, members] of groups) {
+    const split = targetGroupWordings(repo0(members), members[0].f, facts).some((w) => o.split?.has(w));
+    if (members.length === 1 || split) {
+      for (const m of members)
+        out.push({ ...own.get(m.f.id), factIds: [m.f.id] });
       continue;
-    const q = targetQuestionFor(f);
-    const own = slugify(f.component ?? f.repo).replace(/\./g, "-");
-    const types = new Set(SERVES[f.callType] ?? []);
-    const servers = ask ? [...new Set(ask.candidates.map((c) => c.component))].sort() : [
-      ...new Set(records.filter((r) => r.kind === "Endpoint" && types.has(r.endpointType) && r.component !== own).filter((r) => repoOf.get(r.component) !== f.repo).map((r) => r.component))
-    ].sort();
-    const what = [f.method?.toUpperCase(), f.path].filter(Boolean).join(" ");
+    }
+    const repo = members[0].f.repo;
+    const whats = [...new Set(members.map((m) => callWhat(m.f)))];
+    const listed = whats.length > 5 ? `${whats.slice(0, 5).join(", ")} and ${whats.length - 5} more` : whats.join(", ");
+    const n = members.length;
+    const evidence = [...new Set(members.flatMap((m) => m.q.evidence))].sort(byLine);
     const draft = {
-      question: q.question,
+      question,
       options: [
-        ...servers.map((c) => ({
-          label: c,
-          means: `${c}${repoOf.get(c) ? `, built in ${repoOf.get(c)},` : ""} answers ${what}`,
-          changes: `The call joins ${c} when the facts are next written (atticus verify ${f.repo} --write)`
-        })),
-        ...vendors.map((s) => ({
-          label: s.id,
-          means: `${s.name}, an outside system, answers ${what}`,
-          changes: `The call goes to ${s.name} when the facts are next written`
-        })),
+        ...offered(members, facts, records, op, asks, ctx).map((s) => suggestionOption(s, repo, n, targetPathPrefix(members[0].f.path))),
+        anotherOption(op),
+        {
+          label: TARGETS_SPLIT,
+          means: `The ${n} calls (${listed}) don't all go to one place`,
+          changes: "Nothing is joined from this answer; each call is asked on its own when the facts are next written"
+        },
         {
           label: TARGETS_NONE,
-          means: "Nothing in the estate or the org pack's systems answers it",
-          changes: "The call stays a loose end, and this isn't asked again"
+          means: "Nothing in the estate or the org pack's systems answers any of them",
+          changes: "The calls stay loose ends, and this isn't asked again"
         }
       ],
-      evidence: q.evidence,
+      evidence,
       scope: "repo"
     };
     out.push({
-      factId: f.id,
-      id: questionId({
-        step: TARGETS_STEP,
-        repo: f.repo,
-        question: q.question,
-        evidence: q.evidence
-      }),
-      repo: f.repo,
+      factId: members[0].f.id,
+      factIds: members.map((m) => m.f.id),
+      id: questionId({ step: TARGETS_STEP, repo, question, evidence }),
+      repo,
       draft
     });
   }
+  return out.sort((a, b) => a.factId.localeCompare(b.factId));
+}
+function targetRuleOffers(questions, factsOf) {
+  const byKey = /* @__PURE__ */ new Map();
+  for (const q of questions) {
+    if (q.state !== "open" || q.askedBy?.step !== TARGETS_STEP)
+      continue;
+    const facts = factsOf(q.repo) ?? [];
+    const at3 = new Set(q.evidence);
+    const calls = facts.filter((f) => f.kind === "call" && f.repo === q.repo && at3.has(`${f.cite.file}:${f.cite.line}`));
+    if (!calls.length)
+      continue;
+    const prefixes = new Set(calls.map((c) => targetPathPrefix(c.path)));
+    const hosts = new Set(calls.map((c) => c.host?.replace(/^[a-z][a-z0-9+.-]*:\/\//i, "").split(/[/:]/)[0]));
+    const [prefix] = prefixes;
+    const [host] = hosts;
+    const match = prefixes.size === 1 && prefix !== "/" ? `${prefix}/**` : hosts.size === 1 && host ? host : void 0;
+    if (!match)
+      continue;
+    const key = `${q.repo}
+${match}`;
+    const x = byKey.get(key) ?? { match, ids: [], calls: 0 };
+    x.ids.push(q.id);
+    x.calls += calls.length;
+    byKey.set(key, x);
+  }
+  const out = /* @__PURE__ */ new Map();
+  for (const x of byKey.values()) {
+    if (x.ids.length < 2)
+      continue;
+    const ids = [...x.ids].sort();
+    for (const id of ids)
+      out.set(id, { match: x.match, ids, calls: x.calls });
+  }
+  return out;
+}
+var segmentsOf = (p) => p.split(/[?#]/)[0].split("/").filter(Boolean).map((x) => /^[{:<]/.test(x) ? "{}" : x);
+function ruleCoversCall(match, f, facts) {
+  if (isPathMatch(match)) {
+    const want = segmentsOf(match.replace(/\/\*\*$/, ""));
+    const got = segmentsOf(f.path);
+    return want.length <= got.length && want.every((x, i) => x === "{}" || got[i] === "{}" || x === got[i]);
+  }
+  const url = urlOf(f, facts);
+  const hp = url ? urlHostPort(url) : void 0;
+  return !!hp?.host && hostMatches(match, hp.host, hp.port);
+}
+function ruledTargets(repo, facts, questions, o = {}) {
+  const rules = questions.filter((q) => q.askedBy?.step === TARGETS_STEP && q.state === "answered" && !!q.answer?.match && (q.answer.scope.level === "repo" ? q.answer.scope.id === repo : !!o.repoType && q.answer.scope.id === o.repoType)).sort((a, b) => (a.answer.scope.level === "repo" ? 0 : 1) - (b.answer.scope.level === "repo" ? 0 : 1) || b.answer.match.length - a.answer.match.length || b.answer.at.localeCompare(a.answer.at) || a.id.localeCompare(b.id));
+  const out = /* @__PURE__ */ new Map();
+  if (!rules.length)
+    return out;
+  for (const f of facts) {
+    if (!ruleMayName(f, facts))
+      continue;
+    const q = rules.find((r) => ruleCoversCall(r.answer.match, f, facts));
+    const label2 = q ? answerLabel2(q) : void 0;
+    if (q && label2 && label2 !== TARGETS_SPLIT)
+      out.set(f.id, { id: q.id, match: q.answer.match, label: label2 });
+  }
   return out;
 }
-function targetsFromAnswers(repo, facts, questions) {
+function targetsFromAnswers(repo, facts, questions, o = {}) {
   const byId = new Map(questions.map((q) => [q.id, q]));
+  const groups = /* @__PURE__ */ new Map();
+  for (const q of [...questions].filter((x) => x.askedBy?.step === TARGETS_STEP && x.state === "answered" && !!x.answer && typeof x.question === "string").sort((a, b) => a.answer.at.localeCompare(b.answer.at) || a.id.localeCompare(b.id)))
+    groups.set(q.question.trim(), q);
+  const ruled = ruledTargets(repo, facts, questions, o);
   const out = {};
   for (const f of [...facts].sort((a, b) => a.id.localeCompare(b.id))) {
     if (f.kind !== "call")
@@ -1512,18 +2186,104 @@ function targetsFromAnswers(repo, facts, questions) {
     const q = targetQuestionFor(f);
     if (!q)
       continue;
-    const asked = byId.get(questionId({ step: TARGETS_STEP, repo, ...q }));
-    if (!asked || asked.state !== "answered" || !asked.answer)
+    let asked = byId.get(questionId({ step: TARGETS_STEP, repo, ...q }));
+    if (!asked || asked.state !== "answered" || !asked.answer) {
+      const g = targetGroupWordings(repo, f, facts).map((w) => groups.get(w)).find((x) => !!x);
+      asked = g && (needsTarget(f, facts) || g.evidence.includes(q.evidence[0])) ? g : void 0;
+    }
+    let label2 = asked && asked.state === "answered" && asked.answer ? answerLabel2(asked) : void 0;
+    let byAi = label2 && asked?.answer && isAiBy(asked.answer.by) ? asked.answer.by : void 0;
+    if (!label2 || label2 === TARGETS_SPLIT || label2 === TARGETS_ANOTHER) {
+      label2 = ruled.get(f.id)?.label;
+      byAi = void 0;
+    }
+    if (!label2 || label2 === TARGETS_SPLIT || label2 === TARGETS_ANOTHER)
       continue;
-    const label2 = asked.answer.option !== void 0 ? asked.options[asked.answer.option - 1]?.label : asked.answer.text;
-    if (!label2 || label2 === TARGETS_NONE)
+    if (byAi && o.ai)
+      o.ai[f.id] = { runtime: byAi.runtime, run: byAi.run };
+    if (label2 === TARGETS_NONE) {
+      out[f.id] = NO_TARGET;
       continue;
+    }
     const to = slugify(label2);
     if (to)
       out[f.id] = to;
   }
   return out;
 }
+function answeredQuestionOfCall(repo, facts, questions, factId) {
+  const f = facts.find((x) => x.id === factId);
+  if (!f || f.kind !== "call")
+    return void 0;
+  const own = targetQuestionFor(f);
+  const ownId = questionId({ step: TARGETS_STEP, repo, ...own });
+  const answered = questions.filter((q2) => q2.askedBy?.step === TARGETS_STEP && q2.state === "answered" && q2.repo === repo);
+  const q = answered.find((x) => x.id === ownId) ?? answered.find((x) => targetGroupWordings(repo, f, facts).includes(x.question.trim()) && x.evidence.includes(own.evidence[0]));
+  return q?.answer?.match ? void 0 : q;
+}
+function answerReconfirmed(q) {
+  if (!q.answer || !q.reopened)
+    return false;
+  const now2 = answerLabel2(q);
+  const was = answerLabel2({ ...q, answer: q.reopened.answer });
+  return !!now2 && !!was && slugify(now2) === slugify(was);
+}
+var JOINED_BY = {
+  named: "the call names it",
+  repo: "the call names its repo",
+  host: "the manifest's hosts and base paths decide it",
+  topic: "it listens on the call's topic"
+};
+function callsOfTargetQuestion(repo, facts, q) {
+  return facts.filter((f) => {
+    if (f.kind !== "call")
+      return false;
+    const own = targetQuestionFor(f);
+    if (questionId({ step: TARGETS_STEP, repo, ...own }) === q.id)
+      return true;
+    return targetGroupWordings(repo, f, facts).includes(q.question.trim()) && q.evidence.includes(own.evidence[0]);
+  });
+}
+function staleTargetQuestions(input) {
+  const drafted = new Set(input.drafted.map((d) => d.id));
+  const out = [];
+  for (const q of input.open) {
+    if (q.state !== "open" || q.askedBy.step !== TARGETS_STEP || drafted.has(q.id))
+      continue;
+    const calls = callsOfTargetQuestion(input.repo, input.facts, q);
+    if (!calls.length)
+      continue;
+    const ids = new Set(calls.map((c) => c.id));
+    const by = input.drafted.filter((d) => d.factIds.some((x) => ids.has(x))).map((d) => d.id);
+    if (by.length) {
+      out.push({ id: q.id, why: `its calls are asked now in ${by.join(", ")}`, replacedBy: by });
+      continue;
+    }
+    if (calls.some((c) => input.asked.has(c.id)))
+      continue;
+    const reasons = calls.map((c) => {
+      const rule = input.ruled?.get(c.id);
+      if (rule)
+        return `${callWhat(c)} is answered by rule in ${rule.id} (${rule.match})`;
+      const j = input.join?.joins.find((x) => x.call.repo === input.repo && x.call.fact === c.id && x.how !== "answer");
+      if (j && !isGuessedJoin(j) && JOINED_BY[j.how])
+        return `${callWhat(c)} joins ${j.entry.component} in ${j.entry.repo}: ${JOINED_BY[j.how]}`;
+      if (!j && c.to)
+        return `${callWhat(c)} now names ${c.to} in the code`;
+      return void 0;
+    });
+    const rules = [
+      ...new Set(calls.flatMap((c) => input.ruled?.get(c.id) ? [input.ruled.get(c.id).id] : []))
+    ].sort();
+    if (reasons.every((r) => r !== void 0))
+      out.push({
+        id: q.id,
+        why: reasons.join("; "),
+        ...rules.length ? { replacedBy: rules } : {}
+      });
+  }
+  return out.sort((a, b) => a.id.localeCompare(b.id));
+}
 function componentRenames(repos, op, taken = []) {
   const manifests = estateRepos(op);
   const users = /* @__PURE__ */ new Map();
@@ -1566,7 +2326,7 @@ function factsRecords(input) {
   const facts = withComponents(repo, input.facts, op, input.renames).map((f) => {
     let g = f;
     const to = input.targets?.[g.id];
-    if (g.kind === "call" && !g.to && to)
+    if (g.kind === "call" && !g.to && to && to !== NO_TARGET)
       g = { ...g, to };
     return g;
   });
@@ -1613,20 +2373,33 @@ function factsRecords(input) {
   return { facts, projected, factById, newRecords, newFlows, loose, looseFact };
 }
 function outsideSystems(op) {
-  return op.profiles.flatMap((p) => p.profile?.systems ?? []).filter((s) => s.boundary === "vendor").flatMap((s) => [s.id, s.name, ...s.aliases]).sort();
+  return outsideProfileSystems(op).flatMap((s) => [s.id, s.name, ...s.aliases]).sort();
+}
+function outsideProfileSystems(op) {
+  const own = new Set(estateRepos(op).flatMap((r) => r.system ? [r.system] : []));
+  const seen = /* @__PURE__ */ new Set();
+  return op.profiles.flatMap((p) => p.profile?.systems ?? []).filter((s) => (s.boundary === "vendor" || !own.has(s.id)) && !seen.has(s.id) && !!seen.add(s.id)).sort((a, b) => a.id < b.id ? -1 : a.id > b.id ? 1 : 0);
 }
+var hostAliases = (aliases) => aliases.filter((a) => /^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/i.test(a)).map((a) => a.toLowerCase());
 function joinReposOf(op, list, renames) {
   const manifests = estateRepos(op);
   return list.map(({ repo, facts }) => {
     const m = manifests.find((r) => r.id === repo);
-    const modules = (m?.modules ?? []).filter((x) => x.hosts.length > 0);
+    const modules = (m?.modules ?? []).filter((x) => x.hosts.length > 0 || x.basePath && (m?.hosts.length ?? 0) > 0).map((x) => x.hosts.length ? x : { ...x, hosts: m.hosts });
     const component = m?.component ? renames?.[repo]?.[factIdPart(m.component)] ?? m.component : void 0;
     return {
       repo,
       facts: renames?.[repo] ? withComponents(repo, facts, op, renames) : facts,
       ...component ? { component } : {},
       ...m?.hosts.length ? { hosts: m.hosts } : {},
-      ...modules.length ? { modules: modules.map((x) => ({ component: x.component, hosts: x.hosts })) } : {},
+      ...m?.basePath ? { basePath: m.basePath } : {},
+      ...modules.length ? {
+        modules: modules.map((x) => ({
+          component: x.component,
+          hosts: x.hosts,
+          ...x.basePath ? { basePath: x.basePath } : {}
+        }))
+      } : {},
       // An API gateway's entries are routes the join follows through (ADR 0124 addendum A-gateway).
       // A type that says which side it faces (`gateway-external`, `gateway-internal`) marks each
       // hop through it (A-gateway2); a plain `gateway` leaves that to the proxy's virtual host.
@@ -1668,12 +2441,7 @@ function applyFactJoins(records, join10, repos, withCallers) {
     } else if (!(r.kind === "FieldMapping" && ifaces.has(r.interface)))
       kept2.push(r);
   }
-  const re = (id) => {
-    for (const [from, to] of was)
-      if (id === from || id.startsWith(`${from}.`))
-        return to + id.slice(from.length);
-    return id;
-  };
+  const re = remapIds(was);
   const joined = joinRecords(join10, repos);
   const callers = withCallers ? callerRecords(withCallers.callers, repos, withCallers.join, {
     ...withCallers.only ? { only: withCallers.only } : {},
@@ -1694,20 +2462,28 @@ function applyFactJoins(records, join10, repos, withCallers) {
 }
 var entryText = (j) => j.method ? `${j.method} ${j.path}` : j.path;
 function joinAbout(all, repo) {
-  const joins = all.joins.filter((j) => j.call.repo === repo || j.entry.repo === repo || !!j.gateway?.some((h) => h.entry.repo === repo));
+  const joins = all.joins.filter((j) => j.call.repo === repo || j.entry.repo === repo || !!j.gateway?.some((h) => h.entry.repo === repo) || // J0: a join whose placeholder this repo's config sets (a deploy or config repo) is
+  // written again with it, so a changed value moves the link.
+  [...j.through ?? [], ...j.entryThrough ?? []].some((t) => t.repo === repo) || // J1: and a join whose host or base path this repo's Route gives (a deploy repo's).
+  [...j.exposedBy ?? [], ...(j.gateway ?? []).flatMap((h) => h.exposedBy ?? [])].some((t) => t.repo === repo));
   const ifaces = new Set(joins.map((j) => j.interface));
+  const outside = (all.outside ?? []).filter((o) => o.call.repo === repo);
+  const exposure = (all.exposure ?? []).filter((x) => x.exposure.repo === repo || "repo" in x && x.repo === repo);
   return {
     joins,
     asks: all.asks.filter((a) => a.call.repo === repo),
     misses: all.misses.filter((m) => m.call.repo === repo),
+    ...outside.length ? { outside } : {},
+    ...exposure.length ? { exposure } : {},
     lineage: all.lineage.filter((l) => ifaces.has(l.interface)),
     gaps: all.gaps.filter((g) => ifaces.has(g.interface))
   };
 }
-function catalogWithFacts(input) {
-  const { repo, op } = input;
+function catalogWithFacts(given) {
+  const { repo, op } = given;
   if (isPrototypeRepo(op, repo))
-    return prototypeLeftOut(input);
+    return prototypeLeftOut(given);
+  const input = { ...given, existing: stripSharedMaps(stripLinkEvidence(given.existing)) };
   const others = (input.estate ?? []).filter((x) => x.repo !== repo && !isPrototypeRepo(op, x.repo));
   const renames = componentRenames([{ repo, facts: input.facts }, ...others], op, input.existing.flatMap((r) => r.kind === "Component" && r.repo && r.repo !== repo ? [{ id: r.id, repo: r.repo }] : []));
   const { facts, projected, newRecords, newFlows, looseFact } = factsRecords({
@@ -1757,20 +2533,46 @@ function catalogWithFacts(input) {
   const remap = /* @__PURE__ */ new Map();
   const stepTo = /* @__PURE__ */ new Map();
   let join10;
+  let answerMisses;
+  let estateJoin;
+  let terms;
   let records0 = [...kept2, ...newRecords];
   if (input.estate) {
     const repos = joinReposOf(op, [{ repo, facts }, ...others], renames);
     const whole = joinFacts({
       repos,
       targets: { ...input.estateTargets, [repo]: input.targets ?? {} },
-      outside: outsideSystems(op)
+      pairs: { ...input.estatePairs, [repo]: input.pairs ?? {} },
+      aiTargets: { ...input.estateAiTargets, [repo]: input.aiTargets ?? {} },
+      outside: outsideSystems(op),
+      ...joinConventions(op),
+      // G4: the walk through gateways is a stack helper (ATTICUS_HELPERS_OFF=gateway-walk).
+      walkGateways: helperOn("gateway-walk")
     });
     join10 = joinAbout(whole, repo);
+    estateJoin = { whole, repos };
+    const named2 = { ...input.estateTargets, [repo]: input.targets ?? {} };
+    const mine2 = /* @__PURE__ */ new Set([
+      factIdPart(repo),
+      ...repos.filter((r) => r.repo === repo).flatMap((r) => [r.component, ...(r.modules ?? []).map((m) => m.component)]).filter((x) => !!x).map(factIdPart),
+      ...facts.flatMap((f) => f.component ? [factIdPart(f.component)] : [])
+    ]);
+    answerMisses = whole.misses.filter((m) => {
+      const t = named2[m.call.repo]?.[m.call.fact];
+      return !!t && t !== NO_TARGET && (m.call.repo === repo || mine2.has(factIdPart(m.target)));
+    });
     records0 = applyFactJoins(records0, join10, repos, {
-      callers: joinCallers({ repos, join: whole, declared: declaredCallsOf(op.profiles) }),
+      callers: joinCallers({
+        repos,
+        join: whole,
+        declared: declaredCallsOf(op.profiles),
+        ...joinConventions(op)
+      }),
       join: whole,
       only: [repo]
     });
+    terms = joinTerms({ repos, join: whole, bundleFolders: joinConventions(op).bundleFolders });
+    records0 = [...records0, ...termGrantRecords(terms, repos, { only: [repo] })];
     for (const j of join10.joins) {
       const id = j.call.repo === repo ? projected.ids[j.call.fact] : void 0;
       if (!id || remap.has(id))
@@ -1779,7 +2581,10 @@ function catalogWithFacts(input) {
       stepTo.set(id, { component: j.entry.component, entry: entryText(j) });
     }
   }
-  const merged0 = mergeEstate(op, estateRepos(op), records0.sort(byKindId));
+  const merged0 = mergeEstate(op, estateRepos(op), records0.sort(byKindId), void 0, /* @__PURE__ */ new Set([
+    repo,
+    ...input.estate ? others.filter((r) => r.facts.length > 0).map((r) => r.repo) : []
+  ]));
   const heard = new Set((join10?.joins ?? []).filter((j) => j.how === "topic").map((j) => `${j.entry.repo}|${j.entry.at}|${j.entry.component}`));
   const merged = {
     ...merged0,
@@ -1806,15 +2611,7 @@ function catalogWithFacts(input) {
       joinedTo.set(id, iface.to);
     }
   }
-  const re = (id) => {
-    const exact = remap.get(id);
-    if (exact)
-      return exact;
-    for (const [from, to] of remap)
-      if (id.startsWith(`${from}.`))
-        return to + id.slice(from.length);
-    return id;
-  };
+  const re = remapIds(remap);
   const records = merged.records.map((r) => {
     if (r.kind === "Schema")
       return { ...r, id: re(r.id), ref: re(r.ref) };
@@ -1824,7 +2621,25 @@ function catalogWithFacts(input) {
       return { ...r, interface: re(r.interface) };
     return r;
   });
-  const applied = applyCurated([...records].sort(byKindId), input.decisions);
+  const curated = applyCurated([...records].sort(byKindId), input.decisions);
+  const linkEvidence = estateJoin ? linkEvidenceOf({
+    join: estateJoin.whole,
+    repos: estateJoin.repos,
+    contracts: input.linkEvidence?.contracts ?? [],
+    traffic: input.linkEvidence?.traffic ?? []
+  }) : void 0;
+  const evidenced = linkEvidence ? { ...curated, records: applyLinkEvidence(curated.records, linkEvidence.marks) } : curated;
+  const systems = outsideProfileSystems(op);
+  const sharedWhole = estateJoin && input.shared?.length ? joinSharedMaps({
+    outside: estateJoin.whole.outside ?? [],
+    repos: estateJoin.repos,
+    maps: input.shared,
+    systems
+  }) : void 0;
+  const applied = {
+    ...evidenced,
+    records: sharedWhole ? applySharedMaps(evidenced.records, sharedWhole, systems) : stripSharedMaps(evidenced.records)
+  };
   const newIds = new Set(applied.records.filter((r) => r.evidence.some(mine)).map((r) => r.id));
   const oldIds = new Set([...dropped].map((k) => k.slice(k.indexOf("|") + 1)));
   const flows = newFlows.map((f) => {
@@ -1865,7 +2680,11 @@ function catalogWithFacts(input) {
     projectionIssues: projected.issues.filter((i) => i.code !== "unresolved-target"),
     invalid: merged.invalid,
     notes: merged.notes,
-    ...join10 ? { join: join10 } : {}
+    ...join10 ? { join: join10 } : {},
+    ...linkEvidence ? { linkEvidence } : {},
+    ...sharedWhole ? { shared: sharedJoinAbout(sharedWhole, repo) } : {},
+    ...terms ? { terms } : {},
+    ...answerMisses?.length ? { answerMisses } : {}
   };
 }
 function prototypeLeftOut(input) {
@@ -1888,16 +2707,99 @@ function prototypeLeftOut(input) {
     ]
   };
 }
+function estateFromFacts(input) {
+  const repos = input.repos.filter((x) => !isPrototypeRepo(input.op, x.repo));
+  let records = [...input.existing ?? []];
+  const specs = [];
+  const invalid = [];
+  for (const { repo, facts } of repos) {
+    const out = catalogWithFacts({
+      repo,
+      facts,
+      existing: records,
+      op: input.op,
+      decisions: input.decisions ?? [],
+      estate: repos.filter((x) => x.repo !== repo)
+    });
+    records = out.records;
+    specs.push({ repo, flows: out.flows });
+    invalid.push(...out.invalid);
+  }
+  const renames = componentRenames(repos, input.op);
+  const join10 = joinFacts({
+    repos: joinReposOf(input.op, repos.map(({ repo, facts }) => ({
+      repo,
+      facts: factsRecords({ repo, facts, op: input.op, renames }).facts
+    }))),
+    outside: outsideSystems(input.op),
+    ...joinConventions(input.op),
+    walkGateways: helperOn("gateway-walk")
+  });
+  return { records, specs, join: join10, invalid };
+}
+function answerRuleOffers(input) {
+  const ruled = input.questions.filter((q) => q.askedBy?.step === TARGETS_STEP && q.state === "answered" && !!q.answer?.match);
+  const groups = /* @__PURE__ */ new Map();
+  for (const r of input.repos)
+    for (const f of r.facts) {
+      if (f.kind !== "call")
+        continue;
+      const q = answeredQuestionOfCall(r.repo, r.facts, input.questions, f.id);
+      const label2 = q ? answerLabel2(q) : void 0;
+      if (!q || !label2 || label2 === TARGETS_NONE || label2 === TARGETS_SPLIT || label2 === TARGETS_ANOTHER)
+        continue;
+      const url = urlOf(f, r.facts);
+      const host = url ? urlHostPort(url)?.host : void 0;
+      const via = host ? `on ${host.toLowerCase()}` : f.base ? `through ${f.base}` : void 0;
+      if (!via)
+        continue;
+      groups.set(via, [
+        ...groups.get(via) ?? [],
+        { repo: r.repo, q, label: label2, f, facts: r.facts, ...r.type ? { type: r.type } : {} }
+      ]);
+    }
+  const out = [];
+  for (const [via, xs] of [...groups].sort(([a], [b]) => a.localeCompare(b))) {
+    const repos = [...new Set(xs.map((x) => x.repo))].sort();
+    const labels = new Set(xs.map((x) => slugify(x.label)));
+    if (repos.length < 2 || labels.size !== 1)
+      continue;
+    if (xs.every((x) => ruled.some((q) => ruleCoversCall(q.answer.match, x.f, x.facts))))
+      continue;
+    const label2 = xs[0].label;
+    const prefixes = new Set(xs.map((x) => targetPathPrefix(x.f.path)));
+    const prefix = prefixes.size === 1 ? [...prefixes][0] : void 0;
+    const match = via.startsWith("on ") ? via.slice(3) : prefix && prefix !== "/" ? `${prefix}/**` : void 0;
+    const types = new Set(xs.map((x) => x.type));
+    const type = types.size === 1 ? xs[0].type : void 0;
+    const questions = [...new Set(xs.map((x) => x.q.id))].sort();
+    const first = xs.find((x) => x.q.id === questions[0]).q;
+    const n = first.options.findIndex((o) => o.label === label2);
+    const pick = n >= 0 ? `--option ${n + 1}` : `--text "${label2}"`;
+    if (!match || !type)
+      continue;
+    const command = `atticus questions answer ${first.id} ${pick} --match "${match}" --scope repo-type --type ${type}`;
+    out.push({
+      via,
+      label: label2,
+      repos,
+      questions,
+      match,
+      type,
+      command,
+      line: `${repos.length} repos (${repos.join(", ")}) answer the calls ${via} the same way, ${label2} (${questions.join(", ")}): one answer can say it for every ${type} repo. As a rule: ${command}.`
+    });
+  }
+  return out;
+}
 
 // packages/scanner/dist/facts-scan.js
-import { readFile as readFile4 } from "node:fs/promises";
-import { join as join6 } from "node:path";
 async function factsForScan(root, op, repo, commit, readerRecords, at3 = {}) {
   const rel = `${factsRelOf(root)}/${repo}.jsonl`;
-  const text = await readFile4(join6(factsDirOf(root), `${repo}.jsonl`), "utf8").catch(() => void 0);
-  if (text === void 0 || text.trim() === "")
+  const text2 = await readFile4(join6(factsDirOf(root), `${repo}.jsonl`), "utf8").catch(() => void 0);
+  if (text2 === void 0 || text2.trim() === "")
     return {};
-  const parsed = parseFacts(text);
+  const parsed = parseFacts(text2);
   if (!parsed.ok)
     return {
       note: `${repo}: ${rel} doesn't read as facts (${parsed.issues[0]?.message ?? "invalid"}); its readers' records are used. Run atticus verify ${repo}.`
@@ -1910,29 +2812,45 @@ async function factsForScan(root, op, repo, commit, readerRecords, at3 = {}) {
     };
   const older = commit ? facts.filter((f) => !sameCommit(f.commit, commit)) : [];
   let carriedSaid = "";
+  let unread = [];
   if (older.length) {
     const diff = at3.dir ? await changesSince(at3.dir, older.map((f) => f.commit), commit, at3.git) : void 0;
     if (!diff || diff.missing.length)
       return {
         note: `${repo}: its facts are of commit ${(diff?.missing[0] ?? older[0].commit).slice(0, 7)}, the checkout is at ${commit.slice(0, 7)}, and the two can't be compared here; its readers' records are used until it is read again (/atticus-map ${repo}, then atticus verify ${repo} --write).`
       };
+    const off = stackHelpersOff();
     const report = await verifyFacts({
       facts,
       source: dirSource(at3.dir),
+      ...off.has("derived-names") ? { derivedNames: false } : {},
+      ...off.has("readers") ? { readers: false } : {},
       commit,
-      carry: diff.changes
+      carry: diff.changes,
+      conventions: conventionsOf(op),
+      // ADR 0180: a type taken out of the organisation's set after a read is flagged here too.
+      componentTypes: new Set(effectiveComponentTypes(op.componentTypes).map((t) => t.id))
     });
     const from = [...new Set(older.map((f) => f.commit.slice(0, 7)))].join(", ");
     if (!report.accepted.length)
       return {
         note: `${repo}: every one of its facts (of commit ${from}) cites a file changed since, or names a fact that does; its readers' records are used until it is read again (/atticus-map ${repo}, then atticus verify ${repo} --write).`
       };
+    unread = rereadPlan({
+      facts,
+      commit,
+      carry: diff.changes,
+      source: dirSource(at3.dir),
+      conventions: conventionsOf(op)
+    }).files.map((f) => f.path);
     facts = report.accepted;
     const left = report.rejected.length;
     carriedSaid = `; ${report.carried.length} carried from commit ${from} to ${commit.slice(0, 7)} (the files they cite are unchanged, their lines checked again)${left ? `, ${left} left out until read again (they cite a file changed since, or name a fact that does: /atticus-map ${repo}, then atticus verify ${repo} --write)` : ""}`;
   }
-  const questions = (await listQuestions(root, { repo }).catch(() => ({ questions: [] }))).questions;
-  const targets = targetsFromAnswers(repo, facts, questions);
+  const questions = (await listQuestions(root, { step: TARGETS_STEP }).catch(() => ({ questions: [] }))).questions;
+  const targets = targetsFromAnswers(repo, facts, questions, {
+    repoType: estateRepos(op).find((r) => r.id === repo)?.type
+  });
   const others = (await estateFacts(root, op, repo)).repos;
   const renames = componentRenames([{ repo, facts }, ...others], op);
   const { newRecords, facts: used } = factsRecords({ repo, facts, op, targets, renames });
@@ -1963,35 +2881,52 @@ async function factsForScan(root, op, repo, commit, readerRecords, at3 = {}) {
     records: newRecords,
     facts: used,
     targets,
+    basis: { from: "facts", unread },
     note: `${repo}: read from its facts (${facts.length}, ${rel}${carriedSaid})${said ? `; its readers found ${said} the facts don't have (a cross-check: read those lines again, or a reader misreads them)` : "; its readers agree"}.`
   };
 }
+async function pairsOfRepo(root, repo, facts) {
+  const text2 = await readFile4(join6(factsDirOf(root), `${repo}.corrections.jsonl`), "utf8").catch(() => void 0);
+  if (!text2 || !text2.includes('"link"'))
+    return {};
+  return pairsFromCorrections(facts, parseCorrections(text2).corrections);
+}
 async function estateFacts(root, op, except) {
   const repos = [];
   const targets = {};
+  const aiTargets = {};
+  const pairs = {};
   const notes = [];
+  const unverified = [];
+  const questions = (await listQuestions(root, { step: TARGETS_STEP }).catch(() => ({ questions: [] }))).questions;
   for (const r of productionRepos(op)) {
     if (r.id === except)
       continue;
-    const text = await readFile4(join6(factsDirOf(root), `${r.id}.jsonl`), "utf8").catch(() => void 0);
-    if (text === void 0 || text.trim() === "")
+    const text2 = await readFile4(join6(factsDirOf(root), `${r.id}.jsonl`), "utf8").catch(() => void 0);
+    if (text2 === void 0 || text2.trim() === "")
       continue;
-    const parsed = parseFacts(text);
+    const parsed = parseFacts(text2);
     if (!parsed.ok) {
       notes.push(`${r.id}: its facts don't read, so the estate join leaves them out.`);
       continue;
     }
     if (parsed.facts.some((f) => f.verified === "none")) {
+      unverified.push(r.id);
       notes.push(`${r.id}: some of its facts aren't verified yet, so the estate join leaves them out (atticus verify ${r.id}).`);
       continue;
     }
     repos.push({ repo: r.id, facts: parsed.facts });
-    const questions = (await listQuestions(root, { repo: r.id }).catch(() => ({ questions: [] }))).questions;
-    const named2 = targetsFromAnswers(r.id, parsed.facts, questions);
+    const ai = {};
+    const named2 = targetsFromAnswers(r.id, parsed.facts, questions, { repoType: r.type, ai });
     if (Object.keys(named2).length)
       targets[r.id] = named2;
+    if (Object.keys(ai).length)
+      aiTargets[r.id] = ai;
+    const paired = await pairsOfRepo(root, r.id, parsed.facts);
+    if (Object.keys(paired).length)
+      pairs[r.id] = paired;
   }
-  return { repos, targets, notes };
+  return { repos, targets, pairs, notes, unverified, aiTargets };
 }
 
 // packages/scanner/dist/scan-settings.js
@@ -2006,10 +2941,10 @@ async function citedLine(repo, at3) {
   const i = at3.lastIndexOf(":");
   const path = at3.slice(0, i);
   const n = Number(at3.slice(i + 1));
-  const text = await repo.readText(path).catch(() => void 0);
-  if (text === void 0)
+  const text2 = await repo.readText(path).catch(() => void 0);
+  if (text2 === void 0)
     return void 0;
-  return text.replace(/\r\n?/g, "\n").split("\n")[n - 1];
+  return text2.replace(/\r\n?/g, "\n").split("\n")[n - 1];
 }
 var CODE_EXT = new Set("java kt scala groovy ts tsx js jsx mjs cjs py go rb cs fs vb php rs swift m mm c cc cpp h hpp dart ex exs erl clj lua pl".split(" "));
 var NOT_OWN = /(^|\/)(node_modules|\.git|target|bin|obj|dist|build|\.atticus|vendor)\//;
@@ -2068,8 +3003,8 @@ async function checkScanSettings(s, repo) {
     if (!(isConfigFile(file) && names)) {
       const dropped = code.filter((f) => re.test(f));
       const root = mainRoots.find((d) => {
-        const under = code.filter((f) => f.startsWith(`${d}/`));
-        return under.length && under.every((f) => re.test(f));
+        const under2 = code.filter((f) => f.startsWith(`${d}/`));
+        return under2.length && under2.every((f) => re.test(f));
       });
       const why = " so it is still read; only a build or config file that leaves it out itself can say so";
       if (dropped.length * 2 > code.length) {
@@ -2126,9 +3061,9 @@ async function namesNotIn(repo, paths, names) {
   for await (const f of repo.listFiles(["**/*"])) {
     if (!paths.some((x) => x.test(f)))
       continue;
-    const text = await repo.readText(f).catch(() => "");
+    const text2 = await repo.readText(f).catch(() => "");
     for (const n of [...left])
-      if (text.includes(n))
+      if (text2.includes(n))
         left.delete(n);
     if (left.size === 0)
       break;
@@ -2355,54 +3290,6 @@ function withPluginScan(scan, extra) {
   };
 }
 
-// packages/scanner/dist/scan.js
-import { stat } from "node:fs/promises";
-import { dirname as dirname3, isAbsolute, join as join9, resolve as resolve2 } from "node:path";
-import { fileURLToPath } from "node:url";
-
-// packages/scanner/dist/federate-loose.js
-function resolveFederatedLooseEnds(o) {
-  const originOf = (r) => (r.flags ?? []).find((f) => f.startsWith("federated:"))?.slice("federated:".length);
-  const loose = o.federated.filter((r) => r.kind === "Unresolved");
-  if (!loose.length)
-    return { federated: o.federated, resolved: /* @__PURE__ */ new Map() };
-  const fedComponents = o.federated.filter((r) => r.kind === "Component");
-  const result = o.merge([...o.raw, ...fedComponents, ...loose]);
-  const have = new Set(o.local.map((r) => `${r.kind}/${r.id}`));
-  const known = /* @__PURE__ */ new Set([
-    ...o.local.filter((r) => r.kind === "Component" || r.kind === "System").map((r) => r.id),
-    ...fedComponents.map((r) => r.id)
-  ]);
-  const origin = new Map(fedComponents.map((c) => [c.id, originOf(c)]));
-  const stillLoose = new Set(result.records.filter((r) => r.kind === "Unresolved").map((r) => r.id));
-  const added = [];
-  for (const r of result.records) {
-    if (r.kind !== "Interface" || have.has(`Interface/${r.id}`))
-      continue;
-    const i = r;
-    const from = origin.get(i.from) ?? origin.get(i.to);
-    if (!from || !known.has(i.from) || !known.has(i.to))
-      continue;
-    added.push({ ...r, flags: [.../* @__PURE__ */ new Set([...r.flags ?? [], `federated:${from}`])] });
-  }
-  const key = (e) => JSON.stringify(e);
-  const carried = new Set(added.flatMap((i) => i.evidence.map(key)));
-  const resolved = /* @__PURE__ */ new Map();
-  const kept2 = o.federated.filter((r) => {
-    if (r.kind !== "Unresolved" || stillLoose.has(r.id))
-      return true;
-    if (!r.evidence.some((e) => e.source !== "export" && carried.has(key(e))))
-      return true;
-    const id = originOf(r) ?? "";
-    resolved.set(id, (resolved.get(id) ?? 0) + 1);
-    return false;
-  });
-  return {
-    federated: [...kept2, ...added].sort((a, b) => a.kind === b.kind ? a.id.localeCompare(b.id) : a.kind.localeCompare(b.kind)),
-    resolved
-  };
-}
-
 // packages/scanner/dist/scan.js
 var STRUCTURED = /\.(ya?ml|json|xml|tf|tfvars|properties|toml|conf|hcl)$/i;
 var TOOLING = /(^|\/)(package(-lock)?\.json|pnpm-lock\.yaml|yarn\.lock|tsconfig[^/]*\.json|\.eslintrc[^/]*|\.prettierrc[^/]*|renovate\.json|\.vscode\/.*|\.idea\/.*|pom\.xml|catalog-info\.yaml|mkdocs\.yml|codecov\.yml)$/i;
@@ -2418,13 +3305,6 @@ async function orgPackDirFor(root) {
     return { dir: join9(root, ".atticus", "org-pack"), adopted: true };
   return { dir: join9(root, "org-pack"), adopted: false };
 }
-function inPlace(root, url) {
-  if (url === "." || url === "./")
-    return root;
-  if (url.startsWith("./") && !url.split("/").includes(".."))
-    return join9(root, url.slice(2));
-  return void 0;
-}
 async function federate(local, sources, problems, root) {
   const have = new Set(local.map((r) => `${r.kind}/${r.id}`));
   const records = [];
@@ -2553,7 +3433,8 @@ async function scanEstate(o) {
   }));
   const brokenDialects = /* @__PURE__ */ new Set();
   const dialects = await usableDialects(op, orgPackDir, problems, brokenDialects);
-  const frameworks = await usableFrameworks(op, problems);
+  const off = stackHelpersOff();
+  const frameworks = off.has("framework-models") ? [] : await usableFrameworks(op, problems);
   const pluginSet = await usablePlugins(op);
   problems.push(...pluginSet.problems);
   const byName = new Map(dialects.map((d) => [d.name, d]));
@@ -2563,6 +3444,7 @@ async function scanEstate(o) {
   const repos = productionRepos(op, o.repos);
   const results = [];
   const factNotes = prototypeScanNotes(op, o.repos);
+  const basis = {};
   const factRepos = [];
   const structuredOf = /* @__PURE__ */ new Map();
   const modulesOf = /* @__PURE__ */ new Map();
@@ -2570,7 +3452,7 @@ async function scanEstate(o) {
   let done = 0;
   for (const r of repos) {
     throwIfCancelled();
-    const dir = o.repoDir?.(r.id) ?? inPlace(o.root, r.url) ?? baseClonePath(o.root, r.id);
+    const dir = o.repoDir?.(r.id) ?? inPlaceDir(o.root, r.url) ?? baseClonePath(o.root, r.id);
     let state;
     if (!o.repoState && !await stat(dir).catch(() => void 0)) {
       problems.push({
@@ -2590,7 +3472,7 @@ async function scanEstate(o) {
       });
       continue;
     }
-    const extractors = [
+    const extractors = off.has("readers") ? [] : [
       ...BUILT_IN_EXTRACTORS,
       ...o.extractors ?? [],
       ...dialectExtractors.filter(({ d }) => r.dialects.includes(d.name) || d.appliesTo.repoTypes.includes(r.type) || // "*": any repo where the marker matches (ADR 0062).
@@ -2670,6 +3552,7 @@ async function scanEstate(o) {
     });
     if (fromFacts.note)
       factNotes.push(fromFacts.note);
+    basis[r.id] = fromFacts.records && fromFacts.basis ? fromFacts.basis : { from: "readers" };
     if (fromFacts.facts)
       factRepos.push({ repo: r.id, facts: fromFacts.facts, targets: fromFacts.targets ?? {} });
     results.push({ ...scan, records: fromFacts.records ?? readerRecords });
@@ -2682,10 +3565,17 @@ async function scanEstate(o) {
     const join10 = joinFacts({
       repos: joinRepos,
       targets: Object.fromEntries(factRepos.map((x) => [x.repo, x.targets])),
-      outside: outsideSystems(op)
+      outside: outsideSystems(op),
+      ...joinConventions(op),
+      walkGateways: helperOn("gateway-walk")
     });
     codeRecords = applyFactJoins(codeRecords, join10, joinRepos, {
-      callers: joinCallers({ repos: joinRepos, join: join10, declared: declaredCallsOf(op.profiles) }),
+      callers: joinCallers({
+        repos: joinRepos,
+        join: join10,
+        declared: declaredCallsOf(op.profiles),
+        ...joinConventions(op)
+      }),
       join: join10
     });
   }
@@ -2800,7 +3690,8 @@ async function scanEstate(o) {
     ...inputs ? { inputs } : {},
     curated: { applied: applied.applied, suppressed: applied.suppressed },
     notes,
-    ...federated ? { federated } : {}
+    ...federated ? { federated } : {},
+    basis
   };
 }
 
@@ -2836,8 +3727,8 @@ var RepoFiles = class {
   }
   async linesOf(path) {
     if (!this.lines.has(path)) {
-      const text = await this.repo.readText(path).catch(() => void 0);
-      this.lines.set(path, text === void 0 ? null : text.replace(/\r\n?/g, "\n").split("\n"));
+      const text2 = await this.repo.readText(path).catch(() => void 0);
+      this.lines.set(path, text2 === void 0 ? null : text2.replace(/\r\n?/g, "\n").split("\n"));
     }
     return this.lines.get(path);
   }
@@ -2913,13 +3804,13 @@ async function scoreType(t, files) {
   };
 }
 function typeFromWords(description, types) {
-  const text = (description ?? "").toLowerCase();
-  if (!text)
+  const text2 = (description ?? "").toLowerCase();
+  if (!text2)
     return void 0;
   const hits = [];
   for (const t of types)
     for (const words2 of [t.name.toLowerCase(), t.id.replace(/[-_.]+/g, " ")])
-      if (words2.length > 2 && new RegExp(`(^|[^a-z0-9])${escapeRe(words2)}([^a-z0-9]|$)`).test(text))
+      if (words2.length > 2 && new RegExp(`(^|[^a-z0-9])${escapeRe(words2)}([^a-z0-9]|$)`).test(text2))
         hits.push({ type: t.id, words: words2 });
   const ids = new Set(hits.map((h) => h.type));
   if (ids.size !== 1)
@@ -2975,8 +3866,8 @@ async function readRule(rule, path, files) {
   const key = rule.key;
   if (/\.ya?ml$/i.test(path)) {
     const counter = new import_yaml3.LineCounter();
-    const text = lines.join("\n");
-    for (const doc of (0, import_yaml3.parseAllDocuments)(text, { lineCounter: counter })) {
+    const text2 = lines.join("\n");
+    for (const doc of (0, import_yaml3.parseAllDocuments)(text2, { lineCounter: counter })) {
       if (!("getIn" in doc))
         continue;
       for (const node of [doc.getIn(key.split("."), true), doc.get(key, true)]) {
@@ -3015,8 +3906,8 @@ async function resolveSettingsTemplate(t, repo, repoId) {
       out.exclude.push({ path: e.path, why: e.why, at: `${first}:1` });
   }
   for (const rule of t.settings.prefixes) {
-    const candidates = (await files.matching(rule.files)).sort((a, b) => a.length - b.length || a.localeCompare(b));
-    for (const f of candidates) {
+    const candidates2 = (await files.matching(rule.files)).sort((a, b) => a.length - b.length || a.localeCompare(b));
+    for (const f of candidates2) {
       const hit = await readRule(rule, f, files);
       if (!hit)
         continue;
@@ -3049,15 +3940,15 @@ var BUILD_FILES = [
   ["composer.json", "composer.json"]
 ].map(([name, glob]) => ({ name, glob, re: globToRegExp(`**/${glob}`) }));
 var PACKAGE_NAME = /^[A-Za-z0-9_.@/-]+$/;
-function declaredDependencies(path, text) {
+function declaredDependencies(path, text2) {
   const out = [];
   const all = (re, g = 1) => {
-    for (const m of text.matchAll(re))
+    for (const m of text2.matchAll(re))
       if (m[g])
         out.push(m[g].trim());
   };
   if (path.endsWith("pom.xml")) {
-    for (const block2 of text.matchAll(/<(parent|dependency|plugin)>([\s\S]*?)<\/\1>/g)) {
+    for (const block2 of text2.matchAll(/<(parent|dependency|plugin)>([\s\S]*?)<\/\1>/g)) {
       const a = /<artifactId>\s*([^<\s]+)\s*<\/artifactId>/.exec(block2[2]);
       if (a)
         out.push(a[1]);
@@ -3066,7 +3957,7 @@ function declaredDependencies(path, text) {
     all(/['"]([\w.-]+):([\w.-]+)(?::[^'"]*)?['"]/g, 2);
   } else if (path.endsWith("package.json")) {
     try {
-      const j = JSON.parse(text);
+      const j = JSON.parse(text2);
       const deps = Object.keys(j.dependencies ?? {});
       out.push(...deps.length ? deps : Object.keys(j.devDependencies ?? {}));
     } catch {
@@ -3176,9 +4067,9 @@ async function draftRepoType(repo, id) {
     fingerprint.push({ kind: "build-file", globs: buildGlobs, weight: 2, required: true });
   const deps = /* @__PURE__ */ new Map();
   for (const f of builds) {
-    const text = (await files.linesOf(f) ?? []).join("\n");
+    const text2 = (await files.linesOf(f) ?? []).join("\n");
     const glob = buildGlobs.find((g) => globToRegExp(g).test(f));
-    for (const d of declaredDependencies(f, text)) {
+    for (const d of declaredDependencies(f, text2)) {
       if (!PACKAGE_NAME.test(d) || d === repo.name)
         continue;
       if (!deps.has(d))
@@ -3740,7 +4631,7 @@ function parseEntry(s) {
   const m = /^([A-Za-z]+)\s+(\S+)$/.exec(s.trim());
   return m ? { method: m[1].toUpperCase(), path: m[2] } : { path: s.trim() };
 }
-var segs = (p) => normalizePath(p).toLowerCase().split("/").filter(Boolean);
+var segs2 = (p) => normalizePath(p).toLowerCase().split("/").filter(Boolean);
 var sameMethod = (a, b) => !a || !b || a.toUpperCase() === b.toUpperCase();
 async function joinEstate(o) {
   const byId = new Map(o.records.map((r) => [r.id, r]));
@@ -3752,8 +4643,8 @@ async function joinEstate(o) {
     const out = [i.normalizedPath];
     const route = i.route ? byId.get(i.route) : void 0;
     if (route?.kind === "GatewayRoute") {
-      const base2 = segs(route.basepath);
-      const p = segs(i.normalizedPath);
+      const base2 = segs2(route.basepath);
+      const p = segs2(i.normalizedPath);
       if (base2.length && base2.every((s, k) => p[k] === s))
         out.push(`/${p.slice(base2.length).join("/")}`);
     }
@@ -3868,27 +4759,27 @@ async function joinEstate(o) {
           within = "estate";
           hits = servingExactly(flow.component, want);
         }
-        const candidates = [...new Set(hits.map((e) => e.component))].sort();
-        if (candidates.length === 0) {
+        const candidates2 = [...new Set(hits.map((e) => e.component))].sort();
+        if (candidates2.length === 0) {
           miss({
             reason: "no-target",
             message: `${s.to.component} isn't a component in the catalog, and neither an Interface from ${flow.component} nor an entry point of the estate serves ${s.to.entry}`
           });
           continue;
         }
-        if (candidates.length > 1) {
-          const repos = [...new Set(candidates.map(repoOfComponent))];
+        if (candidates2.length > 1) {
+          const repos = [...new Set(candidates2.map(repoOfComponent))];
           const of = repos.length === 1 && repos[0] ? repos[0] : "the estate";
           miss({
             reason: "no-target",
-            message: `${s.to.component} isn't a component in the catalog, and ${candidates.length} components of ${of} serve ${s.to.entry} (${candidates.join(", ")}): a person says which`
+            message: `${s.to.component} isn't a component in the catalog, and ${candidates2.length} components of ${of} serve ${s.to.entry} (${candidates2.join(", ")}): a person says which`
           });
           asks.push({
             from,
             caller: flow.component,
             named: s.to.component,
             what: s.to.entry,
-            candidates
+            candidates: candidates2
           });
           continue;
         }
@@ -4116,6 +5007,17 @@ function fieldLineage(f, field) {
 }
 
 // packages/scanner/dist/hosts-asked.js
+var segs3 = (p) => p.split(/[?#]/)[0].split("/").filter(Boolean).map((x) => /^[{:<$]/.test(x) ? "{}" : x);
+var underPath = (path, base2) => {
+  const b = segs3(base2);
+  const c = segs3(path);
+  return b.length > 0 && b.length <= c.length && b.every((x, i) => x === c[i]);
+};
+var servesPath = (entry, path) => {
+  const e = segs3(entry);
+  const c = segs3(path);
+  return e.length === c.length && e.every((x, i) => x === "{}" || c[i] === "{}" || x === c[i]);
+};
 var HTTP_TYPES = /* @__PURE__ */ new Set(["rest", "graphql", "soap", "websocket", "sse", "webhook"]);
 var CONFIG_FILES = [
   "**/application*.properties",
@@ -4178,8 +5080,12 @@ async function unknownHosts(o) {
     const entry = byHost.get(h.label) ?? {
       ...h.port !== void 0 ? { port: h.port } : {},
       explicit: h.label !== h.host,
-      calls: []
+      calls: [],
+      paths: /* @__PURE__ */ new Set()
     };
+    const path = /^[a-z][a-z0-9+.-]*:\/\/[^/?#]*(\/[^?#]*)?/i.exec(url)?.[1];
+    if (path)
+      entry.paths.add(path);
     const at3 = `${e.path}:${e.line}`;
     if (!entry.calls.some((c) => c.repo === repo && c.at === at3))
       entry.calls.push({ repo, at: at3 });
@@ -4232,6 +5138,25 @@ async function unknownHosts(o) {
       }
     const suggest = hits.length === 1 ? hits[0] : void 0;
     const calls = entry.calls.sort((a, b) => a.repo.localeCompare(b.repo) || a.at.localeCompare(b.at, "en", { numeric: true }));
+    const byPath = [];
+    for (const g of o.records) {
+      if (g.kind !== "GatewayRoute")
+        continue;
+      const repo = g.evidence.find((e) => e.repo)?.repo;
+      if (!repo || byPath.some((b) => b.repo === repo))
+        continue;
+      const under2 = [...entry.paths].filter((p) => underPath(p, g.basepath));
+      if (!under2.length)
+        continue;
+      const comps = new Set([...compRepo].filter(([, r]) => r === repo).map(([c]) => c));
+      const hit = o.records.find((r) => r.kind === "Endpoint" && comps.has(r.component) && under2.some((p) => servesPath(r.pathOrTopic, p)));
+      byPath.push({
+        repo,
+        serves: hit ? [hit.method?.toUpperCase(), hit.pathOrTopic].filter(Boolean).join(" ") : `the routes under ${g.basepath}`
+      });
+    }
+    byPath.sort((a, b) => a.repo.localeCompare(b.repo));
+    const first = suggest ? [suggest.repo] : byPath.map((b) => b.repo).filter((x) => servers.includes(x));
     const about = Object.fromEntries(servers.flatMap((s) => {
       const d = o.repos.find((r) => r.id === s)?.description;
       return d ? [[s, { text: d.text, trust: d.trust }]] : [];
@@ -4239,9 +5164,10 @@ async function unknownHosts(o) {
     asks.push({
       host,
       calls,
-      servers: suggest ? [suggest.repo, ...servers.filter((s) => s !== suggest.repo)] : servers,
+      servers: [...first, ...servers.filter((s) => !first.includes(s))],
       ...suggest ? { suggest } : {},
-      ...Object.keys(about).length ? { about } : {}
+      ...Object.keys(about).length ? { about } : {},
+      ...byPath.length ? { byPath } : {}
     });
   }
   return asks;
@@ -4252,23 +5178,38 @@ function aboutOf(a, repo) {
     return "";
   return d.trust === "suggested" ? `. What it is, as your assistant drafted it (unconfirmed): ${d.text}` : `. What it is: ${d.text}`;
 }
+function gatewayHostFix(host, byPath) {
+  const repos = byPath.map((b) => b.repo);
+  return `${repos.length === 1 ? `${repos[0]}'s routes serve` : `The routes of ${repos.join(", ")} serve`} the paths the calls to ${host} make, and no repo lists ${host}: it looks like a shared gateway's host. Once, not per call: list ${host} under hosts: on each proxy repo in repos.manifest.yaml (${repos.join(", ")}, and any other proxy on it); the path then picks the proxy, and this question retires itself`;
+}
 function hostQuestionDrafts(asks) {
   return asks.map((a) => {
     const repo = a.calls[0].repo;
+    const byPath = new Map((a.byPath ?? []).map((b) => [b.repo, b.serves]));
     return {
       repo,
+      ...a.byPath?.length ? { byPath: a.byPath } : {},
       draft: {
         question: hostQuestionText(a.host),
         options: [
           ...a.servers.map((s) => ({
             label: s,
-            means: (a.suggest?.repo === s ? `${s} serves HTTP, and its ${a.suggest.at} sets the port ${a.host.split(":").pop()} (${a.suggest.line})` : `${s} serves HTTP`) + aboutOf(a, s),
-            changes: `${a.host} goes under hosts for ${s} in repos.manifest.yaml, and the calls to it join ${s} on the next scan`
+            means: (a.suggest?.repo === s ? `${s} serves HTTP, and its ${a.suggest.at} sets the port ${a.host.split(":").pop()} (${a.suggest.line})` : byPath.has(s) ? `${s} serves ${byPath.get(s)}, a path the calls to ${a.host} make` : `${s} serves HTTP`) + aboutOf(a, s),
+            changes: byPath.has(s) ? `${a.host} goes under hosts for ${s} in repos.manifest.yaml, and the calls to it join ${s} on the next scan; on a shared gateway host, list it on each proxy repo instead (${[...byPath.keys()].join(", ")}, and any other proxy on it), and the path picks the proxy` : `${a.host} goes under hosts for ${s} in repos.manifest.yaml, and the calls to it join ${s} on the next scan`
+          })),
+          // O1: a system outside the estate, declared in the profile with the host as its alias.
+          ...[
+            [HOSTS_OUTSIDE_INTERNAL, "internal", "another team's system"],
+            [HOSTS_OUTSIDE_VENDOR, "vendor", "a vendor's system"]
+          ].map(([label2, boundary, what2]) => ({
+            label: label2,
+            means: `${a.host} is ${what2}, outside this estate, that the org pack doesn't name yet`,
+            changes: `A system ${outsideSystemOf(a.host).id} (boundary ${boundary}, alias ${a.host}) goes into the profile, and the calls to ${a.host} go to it on the next scan`
           })),
           {
             label: HOSTS_NONE,
-            means: `An outside system answers on ${a.host}, not a repo of this estate`,
-            changes: "Nothing is added to the manifest; the calls stay loose ends, and this isn't asked again"
+            means: `Neither a repo of this estate nor a system to add to the org pack answers on ${a.host}`,
+            changes: "Nothing is added to the manifest or the profile; the calls stay loose ends, and this isn't asked again"
           }
         ],
         evidence: a.calls.filter((c) => c.repo === repo).slice(0, 3).map((c) => c.at),
@@ -4278,6 +5219,375 @@ function hostQuestionDrafts(asks) {
   });
 }
 
+// packages/scanner/dist/measure-links.js
+var import_yaml4 = __toESM(require_dist(), 1);
+var METHODS = /^(GET|POST|PUT|PATCH|DELETE|HEAD|OPTIONS|TRACE|ANY)\s+(\S.*)$/i;
+var NEAR = 3;
+var AT = /^.+:\d+$/;
+var AT_HELP = "at is file:line, e.g. src/main/java/Client.java:16";
+var isObj2 = (x) => typeof x === "object" && x !== null && !Array.isArray(x);
+var text = (x) => typeof x === "string" && x.trim() ? x.trim() : typeof x === "number" ? String(x) : void 0;
+function parseLinkReference(source) {
+  let raw;
+  try {
+    raw = (0, import_yaml4.parse)(source);
+  } catch (e) {
+    return { ok: false, issues: [`the file isn't YAML: ${e.message}`] };
+  }
+  const issues = [];
+  const say = (where, message) => issues.push(`${where}: ${message}`);
+  const only = (where, o, keys) => {
+    for (const k of Object.keys(o))
+      if (!keys.includes(k))
+        say(where, `unknown key ${k}`);
+  };
+  if (!isObj2(raw) || !Array.isArray(raw.repos))
+    return { ok: false, issues: ["repos: list the repos, each with its entries and calls"] };
+  only("(top)", raw, ["estate", "repos"]);
+  const repos = [];
+  raw.repos.forEach((r, i) => {
+    const w = `repos.${i}`;
+    if (!isObj2(r) || !text(r.repo))
+      return say(w, "each repo needs repo: <its id>");
+    only(w, r, ["repo", "entries", "calls"]);
+    const entries = [];
+    const calls = [];
+    const list = (x, name) => {
+      if (x === void 0 || x === null)
+        return [];
+      if (Array.isArray(x))
+        return x;
+      say(`${w}.${name}`, `${name} is a list`);
+      return [];
+    };
+    list(r.entries, "entries").forEach((e, j) => {
+      const we = `${w}.entries.${j}`;
+      if (text(e))
+        return entries.push({ entry: text(e) });
+      if (!isObj2(e))
+        return say(we, "an entry is METHOD /path, or { entry, at, fact }");
+      only(we, e, ["entry", "at", "fact"]);
+      const at3 = text(e.at);
+      if (at3 && !AT.test(at3))
+        return say(`${we}.at`, AT_HELP);
+      if (!text(e.entry) && !at3 && !text(e.fact))
+        return say(we, "give the entry (METHOD /path), its line (at: file:line) or its fact id");
+      entries.push(stripped({ entry: text(e.entry), at: at3, fact: text(e.fact) }));
+    });
+    list(r.calls, "calls").forEach((c, j) => {
+      const wc = `${w}.calls.${j}`;
+      if (!isObj2(c))
+        return say(wc, "a call is { call, at, reaches } or { call, at, outside }");
+      only(wc, c, ["call", "at", "fact", "reaches", "outside", "note"]);
+      const reaches = text(c.reaches);
+      const outside = text(c.outside);
+      const at3 = text(c.at);
+      let bad = false;
+      if (reaches && outside) {
+        say(wc, "give one of reaches (a repo, or none) and outside (a system), not both");
+        bad = true;
+      } else if (!reaches && !outside) {
+        say(wc, "give one of reaches (a repo, or none) and outside (a system)");
+        bad = true;
+      }
+      if (!text(c.call) && !at3 && !text(c.fact)) {
+        say(wc, "give the call (METHOD /path), its line (at: file:line) or its fact id");
+        bad = true;
+      }
+      if (at3 && !AT.test(at3)) {
+        say(`${wc}.at`, AT_HELP);
+        bad = true;
+      }
+      if (bad)
+        return;
+      const want = outside ? { outside } : reaches.toLowerCase() === "none" ? { none: true } : { repo: reaches };
+      calls.push({
+        ...stripped({ call: text(c.call), at: at3, fact: text(c.fact) }),
+        want
+      });
+    });
+    repos.push({ repo: text(r.repo), entries, calls });
+  });
+  if (issues.length)
+    return { ok: false, issues };
+  const estate = text(raw.estate);
+  return { ok: true, reference: { ...estate ? { estate } : {}, repos } };
+}
+var stripped = (o) => Object.fromEntries(Object.entries(o).filter(([, v]) => v !== void 0));
+function segs4(path) {
+  return path.split(/[?#]/)[0].split("/").filter(Boolean).map((s) => /^(\{[^}]*\}|:\w+|\*)$/.test(s) ? "{}" : s.toLowerCase());
+}
+function pathMatch(a, b) {
+  const x = segs4(a);
+  const y = segs4(b);
+  if (x.length === y.length && x.every((s, i) => s === y[i]))
+    return 2;
+  const [short, long] = x.length < y.length ? [x, y] : [y, x];
+  if (!short.length)
+    return 0;
+  const off = long.length - short.length;
+  return short.every((s, i) => s === long[off + i]) ? 1 : 0;
+}
+function parseWhat(what2) {
+  if (!what2)
+    return {};
+  const m = METHODS.exec(what2.trim());
+  return m ? { method: m[1].toUpperCase(), path: m[2].trim() } : { path: what2.trim() };
+}
+function parseAt(at3) {
+  if (!at3)
+    return void 0;
+  const i = at3.lastIndexOf(":");
+  return { file: at3.slice(0, i).replace(/^\.\//, ""), line: Number(at3.slice(i + 1)) };
+}
+function finder(facts) {
+  const used = /* @__PURE__ */ new Set();
+  return (ref) => {
+    const { method, path } = parseWhat(ref.what);
+    const at3 = parseAt(ref.at);
+    let best;
+    for (const f of facts) {
+      if (used.has(f.id))
+        continue;
+      if (ref.fact) {
+        if (f.id === ref.fact)
+          best = { f, score: 1e6 };
+        continue;
+      }
+      let score = 0;
+      if (at3) {
+        const d = Math.abs(f.cite.line - at3.line);
+        if (f.cite.file !== at3.file || d > NEAR)
+          continue;
+        score += 10 * (NEAR + 1 - d);
+      }
+      if (method && f.method && f.method.toUpperCase() !== method && method !== "ANY")
+        continue;
+      if (path) {
+        const p = pathMatch(path, f.path);
+        if (!p)
+          continue;
+        score += 100 * p;
+      }
+      if (!best || score > best.score)
+        best = { f, score };
+    }
+    if (best)
+      used.add(best.f.id);
+    return best?.f;
+  };
+}
+var round = (n, d) => d ? Math.round(n / d * 1e3) / 1e3 : null;
+var what = (f) => [f.method?.toUpperCase(), f.path].filter(Boolean).join(" ");
+function measureLinks(input) {
+  const { op } = input;
+  const repos = input.repos.filter((x) => !isPrototypeRepo(op, x.repo));
+  const renames = componentRenames(repos, op);
+  const join10 = joinFacts({
+    repos: joinReposOf(op, repos, renames),
+    ...input.targets ? { targets: input.targets } : {},
+    outside: outsideSystems(op),
+    ...joinConventions(op),
+    walkGateways: input.walkGateways ?? helperOn("gateway-walk")
+  });
+  const key = (repo, fact) => `${repo}\0${fact}`;
+  const joins = /* @__PURE__ */ new Map();
+  for (const j of join10.joins) {
+    const k = key(j.call.repo, j.call.fact);
+    joins.set(k, [...joins.get(k) ?? [], j]);
+  }
+  const asks = new Map(join10.asks.map((a) => [key(a.call.repo, a.call.fact), a]));
+  const misses = new Map(join10.misses.map((m) => [key(m.call.repo, m.call.fact), m]));
+  const outsideOf = new Map((join10.outside ?? []).map((o) => [key(o.call.repo, o.call.fact), o]));
+  const own = new Set(estateRepos(op).flatMap((r) => r.system ? [r.system] : []));
+  const systemOf = /* @__PURE__ */ new Map();
+  for (const s of op.profiles.flatMap((p) => p.profile?.systems ?? []))
+    if (s.boundary === "vendor" || !own.has(s.id))
+      for (const n of [s.id, s.name, ...s.aliases])
+        systemOf.set(factIdPart(n), s.id);
+  const outsideName = (n) => n ? systemOf.get(factIdPart(n)) : void 0;
+  const manifests = estateRepos(op);
+  const repoOf = (name) => {
+    const slug = factIdPart(name);
+    const m = manifests.find((r) => r.id === name || factIdPart(r.id) === slug) ?? manifests.find((r) => r.component && factIdPart(r.component) === slug);
+    return m?.id ?? name;
+  };
+  const factsOf = new Map(repos.map((r) => [r.repo, r.facts]));
+  const notes = [];
+  const reading = {
+    entries: { want: 0, found: 0 },
+    calls: { want: 0, found: 0 },
+    missed: []
+  };
+  const rows = [];
+  for (const r of input.reference.repos) {
+    const facts = factsOf.get(r.repo);
+    if (!facts)
+      notes.push(`${r.repo}: no verified facts in the estate, so nothing of it is found (atticus map ${r.repo}, then atticus verify ${r.repo}).`);
+    const all = facts ?? [];
+    const findEntry = finder(all.filter((f) => f.kind === "entry"));
+    for (const e of r.entries) {
+      reading.entries.want++;
+      if (findEntry({ what: e.entry, at: e.at, fact: e.fact }))
+        reading.entries.found++;
+      else
+        reading.missed.push(`${r.repo} entry ${e.entry ?? e.fact ?? e.at}`);
+    }
+    const findCall = finder(all.filter((f) => f.kind === "call"));
+    for (const c of r.calls) {
+      reading.calls.want++;
+      const f = findCall({ what: c.call, at: c.at, fact: c.fact });
+      const label2 = c.call ?? (f ? what(f) : c.fact ?? c.at);
+      const base2 = { repo: r.repo, call: label2, ...c.at ? { at: c.at } : {} };
+      if (!f) {
+        reading.missed.push(`${r.repo} call ${label2}`);
+        rows.push({ ...base2, want: c.want, got: { kind: "not-read" }, right: false });
+        continue;
+      }
+      reading.calls.found++;
+      const got = gotOf(r.repo, f, all);
+      rows.push({ ...base2, fact: f.id, want: c.want, got, right: isRight(c.want, got) });
+    }
+  }
+  function gotOf(repo, f, facts) {
+    const k = key(repo, f.id);
+    const j = joins.get(k)?.[0];
+    if (j) {
+      const via = (j.gateway ?? []).map((h) => h.entry.repo);
+      const inferred2 = joinGuessesOf(j)[0];
+      return {
+        kind: "joined",
+        repo: j.entry.repo,
+        component: j.entry.component,
+        entry: [j.method, j.path].filter(Boolean).join(" "),
+        ...via.length ? { via } : {},
+        ...inferred2 ? { inferred: inferred2 } : {}
+      };
+    }
+    const ask = asks.get(k);
+    if (ask)
+      return { kind: "asked", reason: ask.reason };
+    const miss = misses.get(k);
+    if (miss)
+      return { kind: "missed", target: miss.target };
+    const answer = input.targets?.[repo]?.[f.id];
+    if (answer === NO_TARGET)
+      return { kind: "unlinked" };
+    const host = callHostOf(f, facts);
+    const system = outsideName(answer) ?? outsideName(outsideOf.get(k)?.target) ?? outsideName(f.to) ?? outsideName(host);
+    if (system)
+      return { kind: "outside", system };
+    if (f.to && host)
+      return { kind: "outside", system: f.to };
+    return { kind: "unlinked" };
+  }
+  function isRight(want, got) {
+    if ("repo" in want) {
+      if (got.kind !== "joined")
+        return false;
+      const w = repoOf(want.repo);
+      return got.repo === w || got.component === factIdPart(want.repo);
+    }
+    if ("outside" in want) {
+      if (got.kind !== "outside")
+        return false;
+      const w = outsideName(want.outside) ?? factIdPart(want.outside);
+      return got.system === w || factIdPart(got.system) === factIdPart(want.outside);
+    }
+    return got.kind === "unlinked" || got.kind === "missed";
+  }
+  const toRepo = rows.filter((x) => "repo" in x.want);
+  const joined = rows.filter((x) => x.got.kind === "joined");
+  const right = joined.filter((x) => x.right).length;
+  const inferred = joined.filter((x) => x.got.kind === "joined" && x.got.inferred);
+  const outsideWant = rows.filter((x) => "outside" in x.want);
+  const noneWant = rows.filter((x) => "none" in x.want);
+  return {
+    ...input.reference.estate ? { estate: input.reference.estate } : {},
+    reading,
+    links: {
+      want: toRepo.length,
+      joined: joined.length,
+      right,
+      precision: round(right, joined.length),
+      recall: round(toRepo.filter((x) => x.right).length, toRepo.length),
+      asked: rows.filter((x) => x.got.kind === "asked").length,
+      missed: rows.filter((x) => x.got.kind === "missed").length,
+      unlinked: rows.filter((x) => x.got.kind === "unlinked").length,
+      notRead: rows.filter((x) => x.got.kind === "not-read").length,
+      inferred: { joined: inferred.length, right: inferred.filter((x) => x.right).length },
+      outside: {
+        want: outsideWant.length,
+        got: rows.filter((x) => x.got.kind === "outside").length,
+        right: outsideWant.filter((x) => x.right).length
+      },
+      none: { want: noneWant.length, right: noneWant.filter((x) => x.right).length }
+    },
+    calls: rows,
+    notes
+  };
+}
+
+// packages/scanner/dist/audit-links.js
+function estateJoinOf(op, list, targets, pairs, aiTargets) {
+  const repos = list.filter((x) => !isPrototypeRepo(op, x.repo));
+  const renames = componentRenames(repos, op);
+  return joinFacts({
+    repos: joinReposOf(op, repos, renames),
+    ...targets ? { targets } : {},
+    ...aiTargets && Object.keys(aiTargets).length ? { aiTargets } : {},
+    ...pairs && Object.keys(pairs).length ? { pairs } : {},
+    outside: outsideSystems(op),
+    // The org pack's facing words and gateway bundle folders (ADR 0147), as the catalog joins.
+    ...joinConventions(op),
+    walkGateways: helperOn("gateway-walk")
+  });
+}
+function auditLinkCandidates(join10, list, repo) {
+  const facts = /* @__PURE__ */ new Map();
+  for (const r of list)
+    for (const f of r.facts)
+      facts.set(`${r.repo}\0${f.id}`, f);
+  const mine = join10.joins.filter((j) => j.call.repo === repo);
+  const perCall = /* @__PURE__ */ new Map();
+  for (const j of mine)
+    perCall.set(j.call.fact, (perCall.get(j.call.fact) ?? 0) + 1);
+  const at3 = (e) => `${e.repo} ${e.at}`;
+  const out = [];
+  for (const j of mine) {
+    const call = facts.get(`${j.call.repo}\0${j.call.fact}`);
+    const said = [call?.method?.toUpperCase(), call?.path].filter(Boolean).join(" ");
+    const via = (j.gateway ?? []).map((h) => h.entry.repo);
+    const flags = joinFlagsOf(j);
+    const cites = [
+      at3(j.call),
+      ...j.tie ? [at3(j.tie)] : [],
+      ...(j.through ?? []).map(at3),
+      ...(j.exposedBy ?? []).map(at3),
+      ...(j.gateway ?? []).flatMap((h) => [
+        at3(h.entry),
+        at3(h.call),
+        ...h.tie ? [at3(h.tie)] : [],
+        ...(h.through ?? []).map(at3),
+        ...(h.exposedBy ?? []).map(at3)
+      ]),
+      ...(j.entryThrough ?? []).map(at3),
+      at3(j.entry)
+    ];
+    out.push({
+      id: `link:${j.call.fact}${(perCall.get(j.call.fact) ?? 0) > 1 ? `~${j.entry.fact}` : ""}`,
+      kind: "link",
+      // A publish joined to its listener carries no flag: its topic says how (ADR 0135).
+      of: flags[0] ?? (j.how === "topic" ? "topic" : `joined-by-${j.how}`),
+      claim: `${repo} ${said || j.call.fact} -> ${j.entry.repo} ${[j.method, j.path].filter(Boolean).join(" ")}${via.length ? ` via ${via.join(", ")}` : ""}`,
+      cites: [...new Set(cites)],
+      fact: j.call.fact,
+      to: j.entry.repo
+    });
+  }
+  return out.sort((a, b) => a.id < b.id ? -1 : a.id > b.id ? 1 : 0);
+}
+
 export {
   buildGlossary,
   GLOSSARY_CHANGE,
@@ -4300,31 +5610,99 @@ export {
   diffCatalogs,
   diffIsEmpty,
   estateRepos,
+  productionRepos,
+  prototypeScanNotes,
   isPrototypeRepo,
+  estateMergeInput,
+  mergeEstate,
+  curatedDirOf,
+  TARGETS_MAX_SUGGESTED,
+  TARGETS_ANOTHER,
+  TARGETS_NO_EVIDENCE,
+  nameWords,
+  targetSuggestions,
+  offeredSuggestions,
+  targetPicker,
+  pickerLines,
+  topicQuestionDrafts,
   TARGETS_STEP,
+  TARGETS_NONE,
+  remapIds,
+  targetQuestionFor,
+  suggestionWhy,
   targetQuestionDrafts,
+  TARGETS_SPLIT,
+  targetPathPrefix,
+  targetGroupQuestion,
+  targetGroupWordings,
+  splitTargetGroups,
+  groupedTargetDrafts,
+  targetRuleOffers,
+  ruleCoversCall,
+  ruledTargets,
   targetsFromAnswers,
+  answeredQuestionOfCall,
+  answerReconfirmed,
+  staleTargetQuestions,
+  componentRenames,
+  factsRecords,
   outsideSystems,
+  outsideProfileSystems,
+  hostAliases,
   joinReposOf,
+  applyFactJoins,
   catalogWithFacts,
   prototypeLeftOut,
+  estateFromFacts,
+  answerRuleOffers,
+  factsForScan,
+  pairsOfRepo,
   estateFacts,
+  NO_SETTINGS,
   citedLine,
+  isCodeFile,
+  isConfigFile,
+  globName,
+  prefixOf,
   checkScanSettings,
+  joinBase,
+  applyClients,
+  withExcludes,
+  applyPrefixes,
+  pluginExtractor,
   runPluginTests,
+  pluginApplies,
+  usablePlugins,
+  withPluginScan,
+  orgPackDirFor,
   scanEstate,
+  CLEAR_MATCH,
+  PARTIAL_MATCH,
+  TIE_MARGIN,
   matchRepoType,
   resolveSettingsTemplate,
   draftRepoType,
   repoComponents,
+  pathScore,
+  resourceKey,
+  familyMismatches,
   specTriggers,
+  lineNamesUiWord,
+  uiFindings,
   checkSpec,
   staleFlows,
   citedFileHashes,
   estateStepKey,
   joinEstate,
   estateFlow,
+  flattenEstateFlow,
   fieldLineage,
+  lineSetsPort,
   unknownHosts,
-  hostQuestionDrafts
+  gatewayHostFix,
+  hostQuestionDrafts,
+  parseLinkReference,
+  measureLinks,
+  estateJoinOf,
+  auditLinkCandidates
 };