@principal-ai/subsystems-react 0.51.3 → 0.52.0

package/dist/subsystem/c4.js

@@ -12,6 +12,12 @@
  * supplies the drawable model directly rather than having trails converted into
  * lines.
  *
+ * The element set is an umbrella over a model, not a standalone artifact: what
+ * sits inside a box resolves from the model document's `process` fields, folded
+ * to the claiming container's key by accepted consolidation records (see
+ * `c4Evidence`). Nothing here stores membership, so nothing here can drift from
+ * the model it organizes.
+ *
  * ## Why a union and not one type with two axes
  *
  * C4's vocabulary is closed: software system, container, component, code —
@@ -31,6 +37,50 @@
  *
  * [C4 notation]: https://c4model.com/diagrams/notation
  */
+/**
+ * Protocol hues, keyed by a canonical protocol token.
+ *
+ * C4's notation is colour-free, so this is a local choice — but on a container
+ * diagram the protocol is what a reader wants to distinguish at a glance
+ * (in-process RPC vs HTTP vs file I/O), more than the trail verb the line came
+ * from. Keys are lowercase, matched loosely (see `protocolColor`).
+ */
+export const PROTOCOL_COLOR = {
+    rpc: '#22c55e',
+    http: '#e8853a',
+    https: '#e8853a',
+    rest: '#e8853a',
+    graphql: '#e061a3',
+    fs: '#0ea5e9',
+    'file i/o': '#0ea5e9',
+    sql: '#a78bfa',
+    sqlite: '#a78bfa',
+    postgres: '#a78bfa',
+    'json-rpc': '#22c55e',
+    ws: '#e3b341',
+    websocket: '#e3b341',
+    mcp: '#4ec9b0',
+    stdin: '#9ca3af',
+    stdout: '#9ca3af',
+};
+/** Fallback hue for an edge whose protocol we have no colour for (or none). */
+export const PROTOCOL_COLOR_FALLBACK = '#9ca3af';
+/**
+ * Colour for an edge's protocol. Matches the longest known token contained in
+ * the (lowercased) protocol string, so `Electrobun RPC` finds `rpc` and
+ * `JSON-RPC` finds the `json-rpc` entry before `rpc`.
+ */
+export function protocolColor(protocol) {
+    if (!protocol)
+        return PROTOCOL_COLOR_FALLBACK;
+    const p = protocol.toLowerCase();
+    let best = '';
+    for (const key of Object.keys(PROTOCOL_COLOR)) {
+        if (key.length > best.length && p.includes(key))
+            best = key;
+    }
+    return best ? PROTOCOL_COLOR[best] : PROTOCOL_COLOR_FALLBACK;
+}
 /**
  * `owner/name` from a purl, trimmed of scheme and fragment. Used to label the
  * system frame when a repo key is known.

package/dist/subsystem/c4.js.map

@@ -1 +1 @@
-{"version":3,"file":"c4.js","sourceRoot":"","sources":["../../src/subsystem/c4.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAwLH;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACxE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9C,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,IAAI,IAAI,CAAC;AACnD,CAAC"}
+{"version":3,"file":"c4.js","sourceRoot":"","sources":["../../src/subsystem/c4.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAoJH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,cAAc,GAA2B;IACpD,GAAG,EAAE,SAAS;IACd,IAAI,EAAE,SAAS;IACf,KAAK,EAAE,SAAS;IAChB,IAAI,EAAE,SAAS;IACf,OAAO,EAAE,SAAS;IAClB,EAAE,EAAE,SAAS;IACb,UAAU,EAAE,SAAS;IACrB,GAAG,EAAE,SAAS;IACd,MAAM,EAAE,SAAS;IACjB,QAAQ,EAAE,SAAS;IACnB,UAAU,EAAE,SAAS;IACrB,EAAE,EAAE,SAAS;IACb,SAAS,EAAE,SAAS;IACpB,GAAG,EAAE,SAAS;IACd,KAAK,EAAE,SAAS;IAChB,MAAM,EAAE,SAAS;CAClB,CAAC;AAEF,+EAA+E;AAC/E,MAAM,CAAC,MAAM,uBAAuB,GAAG,SAAS,CAAC;AAEjD;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,QAA4B;IACxD,IAAI,CAAC,QAAQ;QAAE,OAAO,uBAAuB,CAAC;IAC9C,MAAM,CAAC,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IACjC,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE;QAC7C,IAAI,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,IAAI,GAAG,GAAG,CAAC;KAC7D;IACD,OAAO,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAE,CAAC,CAAC,CAAC,uBAAuB,CAAC;AAChE,CAAC;AAWD;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACxE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9C,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,IAAI,IAAI,CAAC;AACnD,CAAC"}

package/dist/subsystem/c4Evidence.d.ts

@@ -1,53 +1,27 @@
 /**
- * C4 evidence — what an agent needs in order to propose elements.
+ * C4 evidence — the pure read-side of proposing and verifying C4 containers.
  *
- * This module does not decide anything. It answers "what is worth asking
- * about?" so an agent can go and read the source, then propose a
- * `C4Element` with a rationale. The questions come from the C4 notation
- * rules the document cannot satisfy on its own:
+ * This module does not decide anything. The proposing agent reads the
+ * subsystem diagrams, queries the existing containers, reasons, and writes
+ * its own rationale; what lives here is only the mechanical part of that
+ * loop:
  *
- *   - every container needs a technology
- *   - every element needs a description
- *   - a container is a runtime boundary, so a library is not one
- *   - a container cannot straddle two software systems
+ *   - `proposeElements` — the proposal scaffold: skip keys containers
+ *     already claim, skip boundaries no container can be discerned from
+ *     (no runtime code behind them)
+ *   - `verifyProcessBoundaries` — a boundary's verification status, read
+ *     off the claiming container
+ *   - `verificationIssues` — those statuses as dynamic-topology findings,
+ *     so verification surfaces through the standard diagnostics pipeline
+ *   - `findUnassigned` — runtime components no `process` names at all
  *
- * The output is a set of concerns. Resolving one is the agent's job, and the
- * answer lands in an element's `rationale`.
+ * Judgements — is this the same unit under a different name? is one function
+ * a deployable unit? — belong to the agent and the human, never to a
+ * matcher.
  */
 import type { C4ContainerKind, C4Element, C4ElementSet } from './c4';
-/** What a concern is about — a derived key, or an existing element id. */
-export interface C4Concern {
-    /** The process key, module path, or element id this concerns. */
-    target: string;
-    kind: C4ConcernKind;
-    message: string;
-    /** Aliases that triggered it. */
-    members?: string[];
-}
-/**
- * The questions worth a human's attention.
- *
- * Each maps to something an agent cannot settle by reading a string — it has
- * to open the source, or ask the user.
- */
-export type C4ConcernKind = 
-/** two or more process keys may be the same deployable unit */
-'merge_candidate'
-/** exactly one member — a lone function is not a deployable unit */
- | 'singleton'
-/** no member executes at runtime — a library is not a container */
- | 'library_shaped'
-/** a store whose storage kind was never decided */
- | 'store_unclassified'
-/** members claim more than one repo — a container cannot straddle systems */
- | 'spans_repos'
-/** an external with no resolvable identity */
- | 'external_unidentified'
-/** a runtime component with no process at all */
- | 'unassigned'
-/** C4 requires technology on every container */
- | 'missing_technology';
-/** The fields a concern check reads off a component. */
+import type { SubsystemIssue } from './IssueList';
+/** The fields the propose/verify gates read off a component. */
 export interface C4MemberView {
     alias: string;
     construct: string;
@@ -60,31 +34,6 @@ export interface C4MemberView {
 }
 /** True when a component runs, and so can be part of a deployable unit. */
 export declare function isRuntimeConstruct(construct: string): boolean;
-/**
- * Derive the questions worth asking about one candidate element.
- *
- * Pure over the rollup, so it runs identically against a single model, the 40
- * composed models, or a fixture. Pure *questions* — it never proposes an
- * answer, because the answers are architectural.
- */
-export declare function deriveConcerns(key: string, members: readonly C4MemberView[], tech?: {
-    frameworks: readonly string[];
-}): C4Concern[];
-/**
- * Suggest merges between keys that share a trailing role.
- *
- * `subsystems-studio/host` and `principal-studio/host` are the same role under
- * two app names. This is a *question*, never a merge — only the user knows
- * whether they are one process or two.
- */
-export declare function suggestMerges(rollup: ReadonlyArray<{
-    key: string;
-    memberCount: number;
-}>): Array<{
-    role: string;
-    keys: string[];
-    reason: string;
-}>;
 /**
  * Runtime components that state no `process` at all.
  *
@@ -94,26 +43,80 @@ export declare function suggestMerges(rollup: ReadonlyArray<{
  */
 export declare function findUnassigned(members: readonly C4MemberView[]): C4MemberView[];
 /**
- * Fold a decided merge into an element set.
+ * How far a process boundary has travelled toward being a container.
  *
- * Two process keys that are really one container become ONE element holding
- * both sets of members. The survivor keeps the id, label, and confirmed
- * attributes; the other disappears and its members move across.
+ * A boundary starts `unassigned` — no container claims it. Proposing an
+ * element for it (see `proposeElements`) assigns the boundary to a container,
+ * which reads as `proposed` until a human decides. `accepted` verifies the
+ * boundary: someone approved this run of code as one deployable unit.
+ * `rejected` means the proposal was wrong and the boundary should not be
+ * drawn as a box.
+ */
+export type C4ProcessVerification = 'unassigned' | 'proposed' | 'rejected' | 'verified';
+/** One process boundary's assignment and its review state. */
+export interface C4ProcessBoundaryStatus {
+    /** The `process` key, e.g. `principal-studio/host`. */
+    key: string;
+    /** Aliases carrying this key in the model, when the caller supplied them. */
+    memberAliases: string[];
+    status: C4ProcessVerification;
+    /** The container whose state decided the status. Absent when `unassigned`. */
+    element?: C4Element;
+}
+/**
+ * Read a process boundary's verification off its container assignment.
  *
- * Which side survives is the **evidence-heavy** one — the element holding more
- * members — because folding the 113-member host into the 1-member one would
- * leave the box labelled after an almost-empty process and lose its confirmed
- * technology. Pass `preferId` to override.
+ * The claimant is the container whose `process` equals the boundary's key —
+ * a plain string match, no indirection. Two keys that are one deployable unit
+ * under two names are fixed in the model document (a consolidation proposal
+ * rewrites the components' `process` fields), so the reader never sees a
+ * discrepancy to resolve. When several containers claim one key (a
+ * hand-edited set can do this), the decided one wins: accepted over rejected
+ * over proposed, so one reviewer's yes outranks another's no.
  *
- * Returns a new set; the input is untouched. Idempotent.
+ * Pure: the same rollup and elements always read the same. `rollup` accepts
+ * `SubsystemProcessRegion`s directly — only `key` and `memberAliases` are read.
  */
-export declare function mergeElements(elements: readonly C4Element[], derivedFromKeys: readonly string[], preferId?: string, memberCountByKey?: ReadonlyMap<string, number>): C4Element[];
+export declare function verifyProcessBoundaries(options: {
+    rollup: ReadonlyArray<{
+        key: string;
+        memberAliases?: readonly string[];
+    }>;
+    elements: readonly C4Element[];
+}): C4ProcessBoundaryStatus[];
 /**
- * A starting point for an agent: one proposed element per derived key, shaped
- * by the mechanical evidence, with the open questions in the rationale.
+ * Verification statuses as diagnostics findings — the dynamic-topology layer
+ * of the issues list. One finding per boundary that is NOT verified: an
+ * unclaimed boundary is the absence a proposing agent run resolves, a
+ * `proposed` one awaits the human's decision, a `rejected` one records that
+ * the decision was no. `verified` reports nothing — the audit reports
+ * absence only, and silence is the good state.
+ *
+ * The findings ride the existing pipeline untouched: they badge the process
+ * frame (target kind `process`), list under Dynamic topology, focus their
+ * members on click, and carry the fix the decision needs. Pure over its
+ * input, like the rest of this module.
+ */
+export declare function verificationIssues(statuses: readonly C4ProcessBoundaryStatus[]): SubsystemIssue[];
+/**
+ * A starting point for an agent, shaped by the two questions that matter when
+ * assessing a process boundary:
+ *
+ *   1. **Does a container already exist for it?** (`elements`) — a key one
+ *      already claims is never re-proposed; proposing another would be
+ *      exactly the duplicate this module exists to prevent. The exact claim
+ *      is a fact and skipped here; whether a *similarly named* container is
+ *      the same unit is a judgement, so it belongs to the agent querying the
+ *      container list — the fix there is a consolidation proposal, not a
+ *      second box.
+ *   2. **Can the boundary be discerned into a container?** — code that never
+ *      runs cannot be, so a library-shaped group gets no proposal; that
+ *      fact is the agent's to report, not the scaffold's.
  *
- * Every element comes back `proposed`. This is a scaffold to edit and argue
- * with — not an answer, and never `accepted`.
+ * For boundaries passing both, one `proposed` container per key. The
+ * rationale is the proposing agent's own reasoning, written on the proposal
+ * it POSTs — this scaffold does not fabricate one. A scaffold to edit and
+ * argue with — not an answer, and never `accepted`.
  */
 export declare function proposeElements(options: {
     repoKey: string;
@@ -122,7 +125,8 @@ export declare function proposeElements(options: {
         members: readonly C4MemberView[];
         frameworks: readonly string[];
     }>;
-    author?: string;
+    /** Containers that already exist (from the element store), by `process` claim. */
+    elements?: readonly C4Element[];
 }): C4ElementSet;
 /**
  * A first guess at what sort of container this is, offered as a *default* for

package/dist/subsystem/c4Evidence.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"c4Evidence.d.ts","sourceRoot":"","sources":["../../src/subsystem/c4Evidence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAe,eAAe,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,MAAM,CAAC;AAElF,0EAA0E;AAC1E,MAAM,WAAW,SAAS;IACxB,iEAAiE;IACjE,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,aAAa,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,iCAAiC;IACjC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;;;;GAKG;AACH,MAAM,MAAM,aAAa;AACvB,+DAA+D;AAC7D,iBAAiB;AACnB,oEAAoE;GAClE,WAAW;AACb,mEAAmE;GACjE,gBAAgB;AAClB,mDAAmD;GACjD,oBAAoB;AACtB,6EAA6E;GAC3E,aAAa;AACf,8CAA8C;GAC5C,uBAAuB;AACzB,iDAAiD;GAC/C,YAAY;AACd,gDAAgD;GAC9C,oBAAoB,CAAC;AAEzB,wDAAwD;AACxD,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAUD,2EAA2E;AAC3E,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAE7D;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,SAAS,YAAY,EAAE,EAChC,IAAI,GAAE;IAAE,UAAU,EAAE,SAAS,MAAM,EAAE,CAAA;CAAuB,GAC3D,SAAS,EAAE,CAwEb;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,aAAa,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC,GAC1D,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAoBzD;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,SAAS,YAAY,EAAE,GAAG,YAAY,EAAE,CAE/E;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,SAAS,SAAS,EAAE,EAC9B,eAAe,EAAE,SAAS,MAAM,EAAE,EAClC,QAAQ,CAAC,EAAE,MAAM,EACjB,gBAAgB,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,GAC7C,SAAS,EAAE,CAwCb;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE;IACP,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,aAAa,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,SAAS,YAAY,EAAE,CAAC;QAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IACxG,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GACA,YAAY,CAyBd;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,SAAS,YAAY,EAAE,GAAG,eAAe,CAOtF"}
+{"version":3,"file":"c4Evidence.d.ts","sourceRoot":"","sources":["../../src/subsystem/c4Evidence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EAAe,eAAe,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,MAAM,CAAC;AAClF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAElD,gEAAgE;AAChE,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAUD,2EAA2E;AAC3E,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAE7D;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,SAAS,YAAY,EAAE,GAAG,YAAY,EAAE,CAE/E;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,qBAAqB,GAC7B,YAAY,GACZ,UAAU,GACV,UAAU,GACV,UAAU,CAAC;AAEf,8DAA8D;AAC9D,MAAM,WAAW,uBAAuB;IACtC,uDAAuD;IACvD,GAAG,EAAE,MAAM,CAAC;IACZ,6EAA6E;IAC7E,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,MAAM,EAAE,qBAAqB,CAAC;IAC9B,8EAA8E;IAC9E,OAAO,CAAC,EAAE,SAAS,CAAC;CACrB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE;IAC/C,MAAM,EAAE,aAAa,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IAC1E,QAAQ,EAAE,SAAS,SAAS,EAAE,CAAC;CAChC,GAAG,uBAAuB,EAAE,CAsB5B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,SAAS,uBAAuB,EAAE,GAC3C,cAAc,EAAE,CAyBlB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,aAAa,CAAC;QACpB,GAAG,EAAE,MAAM,CAAC;QACZ,OAAO,EAAE,SAAS,YAAY,EAAE,CAAC;QACjC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;KAC/B,CAAC,CAAC;IACH,kFAAkF;IAClF,QAAQ,CAAC,EAAE,SAAS,SAAS,EAAE,CAAC;CACjC,GAAG,YAAY,CA6Bf;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,SAAS,YAAY,EAAE,GAAG,eAAe,CAOtF"}

package/dist/subsystem/c4Evidence.js

@@ -1,18 +1,23 @@
 /**
- * C4 evidence — what an agent needs in order to propose elements.
+ * C4 evidence — the pure read-side of proposing and verifying C4 containers.
  *
- * This module does not decide anything. It answers "what is worth asking
- * about?" so an agent can go and read the source, then propose a
- * `C4Element` with a rationale. The questions come from the C4 notation
- * rules the document cannot satisfy on its own:
+ * This module does not decide anything. The proposing agent reads the
+ * subsystem diagrams, queries the existing containers, reasons, and writes
+ * its own rationale; what lives here is only the mechanical part of that
+ * loop:
  *
- *   - every container needs a technology
- *   - every element needs a description
- *   - a container is a runtime boundary, so a library is not one
- *   - a container cannot straddle two software systems
+ *   - `proposeElements` — the proposal scaffold: skip keys containers
+ *     already claim, skip boundaries no container can be discerned from
+ *     (no runtime code behind them)
+ *   - `verifyProcessBoundaries` — a boundary's verification status, read
+ *     off the claiming container
+ *   - `verificationIssues` — those statuses as dynamic-topology findings,
+ *     so verification surfaces through the standard diagnostics pipeline
+ *   - `findUnassigned` — runtime components no `process` names at all
  *
- * The output is a set of concerns. Resolving one is the agent's job, and the
- * answer lands in an element's `rationale`.
+ * Judgements — is this the same unit under a different name? is one function
+ * a deployable unit? — belong to the agent and the human, never to a
+ * matcher.
  */
 /** Constructs that execute at runtime — the only things a container can be. */
 const RUNTIME_CONSTRUCTS = new Set(['function', 'class', 'custom_entity']);
@@ -24,105 +29,6 @@ function storageOf(m) {
 export function isRuntimeConstruct(construct) {
     return RUNTIME_CONSTRUCTS.has(construct);
 }
-/**
- * Derive the questions worth asking about one candidate element.
- *
- * Pure over the rollup, so it runs identically against a single model, the 40
- * composed models, or a fixture. Pure *questions* — it never proposes an
- * answer, because the answers are architectural.
- */
-export function deriveConcerns(key, members, tech = { frameworks: [] }) {
-    const out = [];
-    const aliases = members.map((m) => m.alias);
-    const runtime = members.filter((m) => isRuntimeConstruct(m.construct));
-    if (members.length === 1) {
-        out.push({
-            target: key,
-            kind: 'singleton',
-            message: `process "${key}" has exactly one member (${aliases[0]}) — a lone function is not a deployable unit`,
-            members: aliases,
-        });
-    }
-    // No member executes at runtime ⇒ this cannot be a deployable unit,
-    // regardless of how many members it has. A lone interface and a package of
-    // interfaces fail the same way.
-    if (members.length > 0 && runtime.length === 0) {
-        out.push({
-            target: key,
-            kind: 'library_shaped',
-            message: `process "${key}" has ${members.length} member(s) but none execute at runtime (${[...new Set(members.map((m) => m.construct))].join(', ')}) — this reads as a library, not a container`,
-            members: aliases,
-        });
-    }
-    if (runtime.length > 0 && tech.frameworks.length === 0) {
-        out.push({
-            target: key,
-            kind: 'missing_technology',
-            message: `container "${key}" has no framework signal — C4 requires a technology on every container`,
-            members: aliases,
-        });
-    }
-    const repos = new Set(members
-        .map((m) => (m.purl ?? '').split('#')[0])
-        .filter((r) => r && !r.startsWith('external:')));
-    if (repos.size > 1) {
-        out.push({
-            target: key,
-            kind: 'spans_repos',
-            message: `process "${key}" spans ${repos.size} repo keys (${[...repos].join(', ')}) — a C4 container cannot straddle a system boundary`,
-            members: aliases,
-        });
-    }
-    const unclassified = members.filter((m) => m.construct === 'store' && !storageOf(m));
-    if (unclassified.length > 0) {
-        out.push({
-            target: key,
-            kind: 'store_unclassified',
-            message: `${unclassified.length} store(s) in "${key}" declare no storage kind (${unclassified.map((m) => m.alias).join(', ')}) — decide whether each is a C4 data store or an internal detail`,
-            members: unclassified.map((m) => m.alias),
-        });
-    }
-    const unidentified = members.filter((m) => m.construct === 'external' && (!m.purl || m.purl === 'external' || m.purl.startsWith('external:proposed')));
-    if (unidentified.length > 0) {
-        out.push({
-            target: key,
-            kind: 'external_unidentified',
-            message: `${unidentified.length} external(s) have no resolvable identity (${unidentified.map((m) => m.alias).join(', ')}) — a C4 box named "external" is not a diagram`,
-            members: unidentified.map((m) => m.alias),
-        });
-    }
-    return out;
-}
-/**
- * Suggest merges between keys that share a trailing role.
- *
- * `subsystems-studio/host` and `principal-studio/host` are the same role under
- * two app names. This is a *question*, never a merge — only the user knows
- * whether they are one process or two.
- */
-export function suggestMerges(rollup) {
-    const byRole = new Map();
-    for (const { key } of rollup) {
-        const slash = key.lastIndexOf('/');
-        if (slash <= 0)
-            continue; // a bare key has no app/role shape
-        const role = key.slice(slash + 1);
-        const list = byRole.get(role) ?? [];
-        list.push(key);
-        byRole.set(role, list);
-    }
-    const out = [];
-    for (const [role, keys] of [...byRole].sort((a, b) => a[0].localeCompare(b[0]))) {
-        if (keys.length < 2)
-            continue;
-        out.push({
-            role,
-            keys: [...keys].sort(),
-            reason: `${keys.length} process keys end in "/${role}" (${[...keys].sort().join(', ')}) — one deployable unit under two names, or two units?`,
-        });
-    }
-    return out;
-}
 /**
  * Runtime components that state no `process` at all.
  *
@@ -134,69 +40,112 @@ export function findUnassigned(members) {
     return members.filter((m) => !m.process && isRuntimeConstruct(m.construct));
 }
 /**
- * Fold a decided merge into an element set.
+ * Read a process boundary's verification off its container assignment.
  *
- * Two process keys that are really one container become ONE element holding
- * both sets of members. The survivor keeps the id, label, and confirmed
- * attributes; the other disappears and its members move across.
+ * The claimant is the container whose `process` equals the boundary's key —
+ * a plain string match, no indirection. Two keys that are one deployable unit
+ * under two names are fixed in the model document (a consolidation proposal
+ * rewrites the components' `process` fields), so the reader never sees a
+ * discrepancy to resolve. When several containers claim one key (a
+ * hand-edited set can do this), the decided one wins: accepted over rejected
+ * over proposed, so one reviewer's yes outranks another's no.
  *
- * Which side survives is the **evidence-heavy** one — the element holding more
- * members — because folding the 113-member host into the 1-member one would
- * leave the box labelled after an almost-empty process and lose its confirmed
- * technology. Pass `preferId` to override.
- *
- * Returns a new set; the input is untouched. Idempotent.
+ * Pure: the same rollup and elements always read the same. `rollup` accepts
+ * `SubsystemProcessRegion`s directly — only `key` and `memberAliases` are read.
  */
-export function mergeElements(elements, derivedFromKeys, preferId, memberCountByKey) {
-    const wanted = new Set(derivedFromKeys.map((k) => k.trim()).filter(Boolean));
-    if (wanted.size < 2)
-        return [...elements];
-    const involved = elements.filter((e) => e.derivedFrom?.some((k) => wanted.has(k)));
-    if (involved.length < 2)
-        return [...elements];
-    // Only containers merge. A component has a required `container` field, and
-    // folding one into another would silently repoint it at a new parent.
-    if (involved.some((e) => e.kind !== 'container'))
-        return [...elements];
-    const weight = (e) => {
-        if (memberCountByKey) {
-            let n = 0;
-            for (const k of e.derivedFrom ?? [])
-                n += memberCountByKey.get(k) ?? 0;
-            return n;
+export function verifyProcessBoundaries(options) {
+    const byKey = new Map();
+    for (const e of options.elements) {
+        if (e.kind !== 'container' || !e.process)
+            continue;
+        const list = byKey.get(e.process) ?? [];
+        list.push(e);
+        byKey.set(e.process, list);
+    }
+    const precedence = { accepted: 0, rejected: 1, proposed: 2 };
+    return options.rollup.map(({ key, memberAliases }) => {
+        const aliases = [...(memberAliases ?? [])];
+        const claimants = byKey.get(key) ?? [];
+        if (claimants.length === 0) {
+            return { key, memberAliases: aliases, status: 'unassigned' };
         }
-        return e.members.length;
-    };
-    const survivor = (preferId ? involved.find((e) => e.id === preferId) : undefined) ??
-        [...involved].sort((a, b) => weight(b) - weight(a) || a.id.localeCompare(b.id))[0];
-    const absorbed = involved.filter((e) => e.id !== survivor.id);
-    const absorbedIds = new Set(absorbed.map((e) => e.id));
-    const merged = {
-        ...survivor,
-        members: [...new Set([...survivor.members, ...absorbed.flatMap((e) => e.members)])],
-        derivedFrom: [
-            ...new Set([...(survivor.derivedFrom ?? []), ...absorbed.flatMap((e) => e.derivedFrom ?? [])]),
-        ],
-        rationale: [survivor.rationale, ...absorbed.map((e) => e.rationale)].filter(Boolean).join(' | ') ||
-            undefined,
-    };
-    return [...elements.filter((e) => e.id !== survivor.id && !absorbedIds.has(e.id)), merged].sort((a, b) => a.id.localeCompare(b.id));
+        const decided = [...claimants].sort((a, b) => precedence[a.state] - precedence[b.state] || a.id.localeCompare(b.id))[0];
+        const status = decided.state === 'accepted' ? 'verified' : decided.state;
+        return { key, memberAliases: aliases, status, element: decided };
+    });
 }
 /**
- * A starting point for an agent: one proposed element per derived key, shaped
- * by the mechanical evidence, with the open questions in the rationale.
+ * Verification statuses as diagnostics findings — the dynamic-topology layer
+ * of the issues list. One finding per boundary that is NOT verified: an
+ * unclaimed boundary is the absence a proposing agent run resolves, a
+ * `proposed` one awaits the human's decision, a `rejected` one records that
+ * the decision was no. `verified` reports nothing — the audit reports
+ * absence only, and silence is the good state.
  *
- * Every element comes back `proposed`. This is a scaffold to edit and argue
- * with — not an answer, and never `accepted`.
+ * The findings ride the existing pipeline untouched: they badge the process
+ * frame (target kind `process`), list under Dynamic topology, focus their
+ * members on click, and carry the fix the decision needs. Pure over its
+ * input, like the rest of this module.
+ */
+export function verificationIssues(statuses) {
+    const out = [];
+    for (const { key, status, element } of statuses) {
+        if (status === 'verified')
+            continue;
+        const label = element?.label ?? key;
+        out.push({
+            id: `process-verification:${key}`,
+            severity: 'info',
+            kind: `boundary_process_${status}`,
+            message: status === 'unassigned'
+                ? `No C4 container claims this process boundary yet — a proposing agent run would scaffold one.`
+                : status === 'proposed'
+                    ? `Container "${label}" claims this boundary and awaits a decision.`
+                    : `Container "${label}" was rejected for this boundary — it stays unclaimed until a container is accepted.`,
+            target: { kind: 'process', id: key, label: key },
+            fix: status === 'unassigned'
+                ? { label: 'Propose container' }
+                : status === 'proposed'
+                    ? { label: 'Accept container' }
+                    : undefined,
+        });
+    }
+    return out;
+}
+/**
+ * A starting point for an agent, shaped by the two questions that matter when
+ * assessing a process boundary:
+ *
+ *   1. **Does a container already exist for it?** (`elements`) — a key one
+ *      already claims is never re-proposed; proposing another would be
+ *      exactly the duplicate this module exists to prevent. The exact claim
+ *      is a fact and skipped here; whether a *similarly named* container is
+ *      the same unit is a judgement, so it belongs to the agent querying the
+ *      container list — the fix there is a consolidation proposal, not a
+ *      second box.
+ *   2. **Can the boundary be discerned into a container?** — code that never
+ *      runs cannot be, so a library-shaped group gets no proposal; that
+ *      fact is the agent's to report, not the scaffold's.
+ *
+ * For boundaries passing both, one `proposed` container per key. The
+ * rationale is the proposing agent's own reasoning, written on the proposal
+ * it POSTs — this scaffold does not fabricate one. A scaffold to edit and
+ * argue with — not an answer, and never `accepted`.
  */
 export function proposeElements(options) {
-    const elements = options.rollup.map(({ key, members, frameworks }) => {
-        const concerns = deriveConcerns(key, members, { frameworks });
-        return {
+    const existing = options.elements ?? [];
+    const claimed = new Set(existing.flatMap((e) => (e.kind === 'container' && e.process ? [e.process] : [])));
+    const elements = [];
+    for (const { key, members, frameworks } of options.rollup) {
+        if (claimed.has(key))
+            continue; // already covered — exact claim, a fact
+        const runtime = members.filter((m) => isRuntimeConstruct(m.construct));
+        if (members.length > 0 && runtime.length === 0)
+            continue; // not discernible: code that never runs
+        elements.push({
             id: `container:${key}`,
             kind: 'container',
-            members: members.map((m) => m.alias),
-            derivedFrom: [key],
+            process: key,
             label: key,
             containerKind: suggestContainerKind(members),
             // C4 requires a technology on every container. With no framework signal
@@ -205,10 +154,8 @@ export function proposeElements(options) {
             // module stopped doing.
             technology: frameworks.length > 0 ? frameworks.join(' + ') : '',
             state: 'proposed',
-            rationale: concerns.map((c) => c.message).join(' ') || undefined,
-            author: options.author,
-        };
-    });
+        });
+    }
     return {
         repoKey: options.repoKey,
         elements: elements.sort((a, b) => a.id.localeCompare(b.id)),