@unoverse-platform/studio 0.1.100 → 0.1.102

package/local/sample-identity/brand.yaml

@@ -6,6 +6,8 @@ extends: brand
 props:
   name:
     default: ""
+  pronunciation:
+    default: ""
   standsFor:
     default: ""
   promise:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unoverse-platform/studio",
-  "version": "0.1.100",
+  "version": "0.1.102",
   "type": "module",
   "description": "Unoverse Studio: the local authoring app. Reads your own rx/ folder, no backend.",
   "scripts": {

package/screens/TemplatesLibraryView.tsx

@@ -1,51 +1,37 @@
 /**
  * Templates view — the Template Model's kind (docs/unoverse/UNOVERSE_TEMPLATE_MODEL.md
- * §9b, the three-word grammar), made browsable. A template is states owning
- * arrangements; a layout's SECTIONS are `static:` (placed as designed),
- * `copywriter:` (written into through briefs) and ONE `director:` (decided from
- * what streams in). Authors write `type: template`; the app kind is `app` in code.
+ * §9b), made browsable. A template is states owning arrangements; a layout places its
+ * PARTS with `type: Ref` + `ref: components/<name>`, and an Agent writes each part's
+ * `input: true` props. Authors write `type: template`; the app kind is `app` in code.
  * Two tiers like components: the marketplace shelf (no chip = BASE, installed,
  * read-only) and org packs (org chip).
  *
  * Header + dock MIRROR ComponentsView/AtomsView exactly (responsive width toggle,
- * collapsible drag-resize dock) — the dock holds the SECTIONS table (the template's
- * contract: each section and who fills it) instead of prop controls, because a
- * template's fills come from deliveries, not typed values. The preview renders the
- * synthesized root: linked sections seed their own components, the director section
- * seeds its preview mocks (real interfaces, their own defaults).
+ * collapsible drag-resize dock) — the dock holds the PARTS table (the template's
+ * contract: each part and the face it claims) instead of prop controls, because a
+ * template's fills come from an Agent, not typed values. The preview renders the
+ * synthesized root: each part seeds its own component with its own mock values.
  *
  * NOT TemplatesView.tsx: that name is taken by the Apps screen (the legacy noun).
  */
 import { useEffect, useMemo, useState, useSyncExternalStore, useCallback, type MouseEvent as ReactMouseEvent } from "react";
 import { ComponentStore, UnoverseComponent, type ResolvedTheme } from "@unoverse/sdk";
 import { client, authedFetch, usePersistentState, useRegistryToggles, ToggleSwitch } from "studio-host";
-import { NAV, SCREEN, navItem } from "./chrome";
+import { NAV, SCREEN, navItem, navSubItem } from "./chrome";
 
 interface TemplateSection {
-  /** static = placed as designed; copywriter = written into through its briefs;
-   *  director = the judge: a search place (with `component`) or a delivery band
-   *  (without) — one word since 2026-09-02 (§9b + §9e). */
-  kind: "static" | "copywriter" | "director";
-  /** The state instances render in at this section — what the claim matches. */
+  /** A placed part: its props' `input` says what an Agent writes (§9b). */
+  kind: "part";
+  /** The state the part's instance renders in: what the claim matches. */
   face: string;
-  /** Linked sections: the authored path (components/masthead). */
-  component?: string;
-  /** Linked sections: the resolvable scoped ref (email-digest/masthead). */
-  ref?: string;
-  /** The previewed components' mock values, keyed by ref, compiled by the server (only
-   *  it can resolve a template-local part). Seeded into each instance so the arrangement
-   *  previews as written and filled rather than as a page of ghosts. */
+  /** The authored path (components/masthead). */
+  component: string;
+  /** The resolvable scoped ref (email-digest/masthead). */
+  ref: string;
+  /** The part's mock values, keyed by ref, compiled by the server (only it can resolve a
+   *  template-local part). Seeded into each instance so the arrangement previews as
+   *  written and filled rather than as a page of ghosts. */
   seeds?: Record<string, Record<string, unknown>>;
-  state?: string;
-  rules?: string;
-  preview?: string[];
-  /** Director places (§9e): the grammar, echoed for the dock table. `ask` appears
-   *  only after derivation (rule 10d) — never authored. */
-  ask?: string;
-  type?: "discovery" | "intent";
-  include?: string[];
-  pick?: number;
-  items?: { min: number; max: number };
 }
 interface TemplateDef {
   name: string;
@@ -58,10 +44,12 @@ interface TemplateDef {
   whenToUse?: string;
   category?: string;
   /** Compiled per-state sections (§9b) — the loader's projection of the layout's
-   *  three-word lines; the wire layouts carry the expanded claims. */
+   *  placed parts; the wire layouts carry the expanded claims. */
   sections?: Record<string, TemplateSection[]>;
   /** The composed arrangements, keyed by state — the pills. */
   layouts?: Record<string, unknown>;
+  /** The declared tree, served like a component's: each state with its steps (`on` + `initial`). */
+  stateTree?: { name: string; on?: string; initial?: string; states?: { name: string }[] }[];
   defaultLayout?: string;
   /** Seeding map the loader assembles: face → interface refs. */
   preview?: Record<string, string[]>;
@@ -85,38 +73,6 @@ const VIEWPORTS: { id: string; label: string; w: number | null }[] = [
 
 const refOf = (t: TemplateDef) => (t.org ? `${t.org}/${t.name}` : t.name);
 
-/** One section's description for the dock table — the three words (§9b). */
-function sectionLabel(sec: TemplateSection): { name: string; filler: string; rules: string } {
-  // ONE WORD, TWO MODES (§9e, 2026-09-02): with `component` = a search place; without =
-  // a delivery band. Both show as the director's — the judge is the same.
-  if (sec.kind === "director" && sec.component)
-    return {
-      name: sec.component,
-      filler: "director",
-      rules: [
-        sec.items ? `items ${sec.items.min}–${sec.items.max}` : null,
-        sec.type ?? null,
-        sec.include?.length ? sec.include.join("+") : null,
-        sec.pick != null ? `pick ${sec.pick}` : null,
-      ].filter(Boolean).join(" · "),
-    };
-  if (sec.kind === "director")
-    return {
-      name: "director",
-      filler: "director",
-      rules: [
-        sec.state ? `state ${sec.state}` : null,
-        sec.pick != null ? `pick ${sec.pick}` : null,
-        sec.rules ?? null,
-      ].filter(Boolean).join(" · "),
-    };
-  return {
-    name: sec.component ?? sec.face,
-    filler: sec.kind === "copywriter" ? "copywriter" : "static",
-    rules: "",
-  };
-}
-
 export function TemplatesLibraryView({ theme, org }: { theme: ResolvedTheme; org?: string }) {
   const [templates, setTemplates] = useState<TemplateDef[]>([]);
   const [selected, setSelected] = usePersistentState<string>("wb:template", "");
@@ -194,27 +150,14 @@ export function TemplatesLibraryView({ theme, org }: { theme: ResolvedTheme; org
   const store = useMemo(() => new ComponentStore(), [selected]);
 
   const seeds = useMemo(() => {
-    // THE SEED PLAN, from the BASE state's compiled sections (§9b): a linked
-    // section (static/copywriter) seeds ONE instance of its own component at its
-    // face — the template's FRAME, which the state pills never re-face. The
-    // director section seeds its preview refs at its face — the items the guest
-    // actually browses.
+    // THE SEED PLAN, from the BASE state's compiled sections (§9b): each placed part
+    // seeds ONE instance of its own component at its face, the template's FRAME,
+    // which the state pills never re-face.
     const base = current?.defaultLayout ?? (current?.layouts ? Object.keys(current.layouts)[0] : undefined);
     const secs = (base && current?.sections?.[base]) || [];
     const out: { nodeId: string; ref: string; face?: string; framed: boolean; seed?: Record<string, unknown> }[] = [];
-    for (const sec of secs) {
-      // ONE word, two modes (§9e rule 10b, 2026-09-02): a director WITH a component is a
-      // SEARCH place — its mock is its own component's preview, seeded exactly like a
-      // linked part. Only the BAND form (no ref) seeds stand-ins. This branch predates
-      // the merge and read every director as a band, so search places seeded nothing and
-      // the template previewed with those sections simply missing.
-      if (sec.ref) {
-        out.push({ nodeId: `${sec.face}~${sec.ref}`, ref: sec.ref, face: sec.face, framed: true, seed: sec.seeds?.[sec.ref] });
-      } else if (sec.kind === "director") {
-        for (const [i, ref] of (sec.preview ?? []).entries())
-          out.push({ nodeId: `${sec.face}~${ref}~${i}`, ref, face: sec.face, framed: false, seed: sec.seeds?.[ref] });
-      }
-    }
+    for (const sec of secs)
+      out.push({ nodeId: `${sec.face}~${sec.ref}`, ref: sec.ref, face: sec.face, framed: true, seed: sec.seeds?.[sec.ref] });
     return out;
   }, [current]);
   const framedIds = useMemo(() => new Set(seeds.filter((s) => s.framed).map((s) => s.nodeId)), [seeds]);
@@ -226,7 +169,7 @@ export function TemplatesLibraryView({ theme, org }: { theme: ResolvedTheme; org
     for (const { nodeId, ref, face, seed } of seeds) {
       // The part's own mock values, exactly as the Components screen seeds a component
       // (`preview ?? default`) — compiled onto the section by the server, because only it
-      // can resolve a template-local part. Seeded with nothing, every copywriter part
+      // can resolve a template-local part. Seeded with nothing, every part
       // draws as skeletons and a finished arrangement reads as a broken one.
       store.apply({ type: "COMPONENT_INIT", chatId: PREVIEW_CHAT, nodeId, component: { type: ref, props: seed ?? {} } });
       if (face) store.mergeComponentState(PREVIEW_CHAT, nodeId, { state: face });
@@ -335,6 +278,28 @@ export function TemplatesLibraryView({ theme, org }: { theme: ResolvedTheme; org
                     </span>
                   )}
                 </button>
+                {/* THE STEPS, as Components lists them: the open state's steps by name, straight
+                    from the served tree. A click writes the step onto the template's own
+                    instance, the same write its Back and Next make. */}
+                {selected === refOf(t) && (() => {
+                  const st = current?.stateTree?.find((e) => e.name === activeState);
+                  if (!st?.on || (st.states?.length ?? 0) < 2) return null;
+                  const own = store.get(PREVIEW_CHAT, TEMPLATE_NODE) as Record<string, unknown> | undefined;
+                  const cur = own?.[st.on] ?? st.initial;
+                  return (
+                    <div className="my-0.5 ml-2 flex flex-col gap-px border-l border-gray-700 pl-2">
+                      {st.states!.map((sub) => (
+                        <button
+                          key={sub.name}
+                          onClick={() => store.mergeComponentState(PREVIEW_CHAT, TEMPLATE_NODE, { [st.on!]: sub.name })}
+                          className={`block w-full truncate rounded px-2 py-0.5 text-left text-xs capitalize transition ${navSubItem(cur === sub.name)}`}
+                        >
+                          {sub.name.replace(/-/g, " ")}
+                        </button>
+                      ))}
+                    </div>
+                  );
+                })()}
               </div>
             ))}
           </div>
@@ -536,27 +501,22 @@ export function TemplatesLibraryView({ theme, org }: { theme: ResolvedTheme; org
                 <table className="w-full text-left text-xs">
                   <thead className="text-gray-500">
                     <tr>
-                      <th className="pb-1 pr-4 font-medium">section</th>
-                      <th className="pb-1 pr-4 font-medium">filled by</th>
-                      <th className="pb-1 font-medium">rules</th>
+                      <th className="pb-1 pr-4 font-medium">part</th>
+                      <th className="pb-1 font-medium">face</th>
                     </tr>
                   </thead>
                   <tbody className="text-gray-300">
-                    {secs.map((sec, i) => {
-                      const l = sectionLabel(sec);
-                      return (
-                        <tr key={i} className="border-t border-gray-700/60">
-                          <td className="py-1 pr-4 font-mono">{l.name}</td>
-                          <td className="py-1 pr-4">{l.filler}</td>
-                          <td className="py-1 text-gray-500">{l.rules}</td>
-                        </tr>
-                      );
-                    })}
+                    {secs.map((sec, i) => (
+                      <tr key={i} className="border-t border-gray-700/60">
+                        <td className="py-1 pr-4 font-mono">{sec.component}</td>
+                        <td className="py-1 text-gray-500">{sec.face}</td>
+                      </tr>
+                    ))}
                   </tbody>
                 </table>
                 ) : null;
               })() || (
-                <div className="text-xs text-gray-500">This template declares no sections.</div>
+                <div className="text-xs text-gray-500">This template places no parts.</div>
               )}
             </div>
           )}

package/screens/TemplatesView.tsx

@@ -325,7 +325,7 @@ export function TemplatesView({
       // A real JWT makes the workbench a proper authenticated channel: it rides the
       // MCP stream's `Authorization` header and the REST `Authorization` header, so the
       // workflow gets full user context (incl. the email claim → CRM join). See
-      // docs/AUTH_TOKEN_FLOW.md. Blank → no token (server must run with DISABLE_AUTH=true).
+      // docs/auth-security/IDENTITY.md. Blank → no token (server must run with DISABLE_AUTH=true).
       getAccessToken: token ? async () => token : undefined,
     }),
     [liveBase, token],
@@ -393,7 +393,7 @@ export function TemplatesView({
   const binding = selectedDef?.binding;
   // The session userId MUST be the token's `sub` when a token rides the connection —
   // the server binds the audio socket to the verified identity and REJECTS an
-  // INIT_SESSION claiming anyone else (AUTH_TOKEN_FLOW.md; the June audit's WS
+  // INIT_SESSION claiming anyone else (docs/auth-security/IDENTITY.md; the June audit's WS
   // finding). "dev" is only for a universe with auth off, where no token exists.
   const tokenSub = useMemo(() => {
     if (!token) return undefined;
@@ -656,6 +656,22 @@ export function TemplatesView({
         },
       });
     });
+    // THE MOCK PLACES WHAT IT SEEDS (UNOVERSE_SCREEN.md §2.3). A place draws only what the
+    // screen put there, and in mock no server sends SCREEN_PLACE, so an app of places
+    // previewed white around a seeded interface. Each seed goes where the state it arrived
+    // in names, as the server would place it; a state naming no place stays in `chat`.
+    const byPlace = new Map<string, { pointers: string[]; states: Record<string, string> }>();
+    comps.forEach(({ def: c, view: declaredView, envelope }, i) => {
+      const view = declaredView ?? (envelope ? initialOf(c) : undefined);
+      const place = view ? (c as { statePlaces?: Record<string, string> }).statePlaces?.[view] : undefined;
+      if (!place || place === "chat") return;
+      const pointer = `${chatIdFor(selected ?? "app")}:${c.name}-${i}`;
+      const slot = byPlace.get(place) ?? { pointers: [], states: {} };
+      slot.pointers.push(pointer);
+      slot.states[pointer] = view!;
+      byPlace.set(place, slot);
+    });
+    for (const [place, { pointers, states }] of byPlace) store.setPlace(place, pointers, states);
     setSeeded(comps.map((c) => c.def.name));
     // The tab strips: one per seeded interface, filed under the container whose claim
     // matches the state it was seeded into (no claim match → filed under its own name).

package/vendor/base/src/auth/auth.ts

@@ -2,7 +2,7 @@
  * JWT authentication for the Unoverse MCP server.
  *
  * Mirrors apps/mcp-server/src/server/auth/auth.ts — same OIDC/JWT flow as the rest
- * of the platform (docs/AUTH_TOKEN_FLOW.md): validate the access token against the
+ * of the platform (docs/auth-security/IDENTITY.md): validate the access token against the
  * shared AUTH_ISSUER/AUTH_AUDIENCE via JWKS. The only difference is transport: this
  * server speaks MCP over uWS + Web `Request`/`Response`, so the gate is a pure
  * function over the Authorization header rather than node req/res.
@@ -13,6 +13,7 @@
 
 import { jwtVerify, createRemoteJWKSet, JWTPayload } from "jose";
 import { isAuthEnabled, devIdentity } from "./authConfig.js";
+import { grantedTo } from "../security/permissions.js";
 
 // Read env lazily (not at module load) so it's correct regardless of when .env loads.
 //
@@ -102,7 +103,7 @@ export function parseRoles(payload: JWTPayload): string[] {
 /** Parse a string claim, handling Auth0-style namespaced claims (e.g. https://…/email).
  *  Auth0 emits custom claims (email on the access token) ONLY namespaced, so a plain
  *  `payload.email` read returns undefined and silently no-ops every email-keyed feature
- *  (CRM resolve). Same namespace-aware read as parseArrayClaim. See docs/AUTH_TOKEN_FLOW.md. */
+ *  (CRM resolve). Same namespace-aware read as parseArrayClaim. See docs/auth-security/IDENTITY.md. */
 function parseStringClaim(payload: JWTPayload, claimName: string): string | undefined {
   const direct = payload[claimName];
   if (typeof direct === "string") return direct;
@@ -212,7 +213,7 @@ export async function authorize(authHeader: string | null | undefined): Promise<
  * this exact string (Auth0 API permission on the gravity-api audience), NOT on a
  * role name — end-user chat tokens are valid on the same audience, so "authenticated"
  * is not enough; only "authenticated AND may author workflows" passes. This is the
- * platform's first authZ check (docs/AUTH_REMEDIATION.md Phase 1b).
+ * platform's first authZ check (docs/auth-security/legacy/AUTH_REMEDIATION_2026.md Phase 1b).
  */
 export const BUILDER_PERMISSION = "workflow:author";
 
@@ -224,7 +225,8 @@ export type BuilderAuthResult = { ok: true; user: AuthUser } | { ok: false; reas
  *  - FAIL-CLOSED when auth is disabled: this route must never be open, so an
  *    AUTH_ENABLED=false deployment simply cannot serve it (returns forbidden).
  *    Local dev uses the ungated LOOPBACK route (:4106) instead — never this one.
- *  - Requires the BUILDER_PERMISSION claim, not just a valid bearer.
+ *  - Requires BUILDER_PERMISSION, not just a valid bearer: granted by a role on the token
+ *    (ROLE_GRANTS, the one role-to-permission rule) or by a permission claim.
  * Returns the full user so a later step can bind the session to a workflow grant.
  */
 export async function authorizeBuilder(authHeader: string | null | undefined): Promise<BuilderAuthResult> {
@@ -235,7 +237,7 @@ export async function authorizeBuilder(authHeader: string | null | undefined): P
   if (!token) return { ok: false, reason: "unauthenticated" };
   const user = await validateJWT(token);
   if (!user) return { ok: false, reason: "unauthenticated" };
-  if (!user.permissions.includes(BUILDER_PERMISSION)) return { ok: false, reason: "forbidden" };
+  if (!grantedTo(user).has(BUILDER_PERMISSION)) return { ok: false, reason: "forbidden" };
   return { ok: true, user };
 }
 

package/vendor/base/src/auth/authConfig.ts

@@ -3,7 +3,7 @@
  *
  * MIRRORED across services (apps/server, apps/mcp-server, apps/memory-server, and
  * now apps/unoverse) — keep the copies in sync. Single source of truth:
- * docs/AUTH_REMEDIATION.md (Phase 0).
+ * docs/auth-security/legacy/AUTH_REMEDIATION_2026.md (Phase 0).
  *
  * Rules:
  *  - Default: auth ENABLED. Only an explicit AUTH_ENABLED=false (or the deprecated

package/vendor/base/src/definitions/load/assets.ts

@@ -0,0 +1,65 @@
+/**
+ * AN ORG'S OWN IMAGES. A definition names one by its path in the org's `assets/` folder
+ * (`src: assets/accelerate.svg`); the loader reads the file and serves it inside the
+ * definition as a data URI, so it draws wherever the definition does (Studio, an app, an
+ * embed on another site) with nothing to upload and no host to configure. Small files only:
+ * a photo belongs on a CDN, and the cap keeps a definition light.
+ */
+import { readFileSync, existsSync, statSync } from "fs";
+import { join, extname, dirname } from "path";
+import { projectDir } from "../registry/homes.js";
+
+const ASSET_PREFIX = "assets/";
+const ASSET_MAX_BYTES = 256 * 1024;
+const ASSET_TYPES: Record<string, string> = {
+  ".svg": "image/svg+xml",
+  ".png": "image/png",
+  ".jpg": "image/jpeg",
+  ".jpeg": "image/jpeg",
+  ".webp": "image/webp",
+  ".gif": "image/gif",
+};
+
+/** The file an `assets/…` path names: the definition's own folder upward to its org's folder
+ *  (the one holding `styles/`), so a template's part finds its org's images; then the shared one. */
+function assetFile(from: string | undefined, src: string): string | null {
+  const rel = src.slice(ASSET_PREFIX.length);
+  for (let dir = from; dir && dirname(dir) !== dir; dir = dirname(dir)) {
+    const f = join(dir, "assets", rel);
+    if (existsSync(f)) return f;
+    if (existsSync(join(dir, "styles"))) break;
+  }
+  const shared = join(projectDir("marketplace"), "assets", rel);
+  return existsSync(shared) ? shared : null;
+}
+
+/** The data URI for an `assets/…` image path, or null when it is not one this folder holds. */
+function dataUri(from: string | undefined, src: string): string | null {
+  const file = assetFile(from, src);
+  const type = ASSET_TYPES[extname(src).toLowerCase()];
+  return file && type && statSync(file).size <= ASSET_MAX_BYTES
+    ? `data:${type};base64,${readFileSync(file).toString("base64")}`
+    : null;
+}
+
+/** Every `Image` whose src is an `assets/…` path, served as the file's data URI. So is an
+ *  `assets/…` image a `Ref` hands its piece through `with`: the piece binds it to its Image
+ *  only once expanded, which the referenced form leaves to the client. */
+export function inlineAssets(node: unknown, from: string | undefined): void {
+  if (Array.isArray(node)) return node.forEach((n) => inlineAssets(n, from));
+  if (!node || typeof node !== "object") return;
+  const n = node as Record<string, unknown>;
+  if (n.type === "Image" && typeof n.src === "string" && n.src.startsWith(ASSET_PREFIX)) {
+    const uri = dataUri(from, n.src);
+    if (uri) n.src = uri;
+  }
+  if (n.type === "Ref" && n.with && typeof n.with === "object" && !Array.isArray(n.with)) {
+    const w = n.with as Record<string, unknown>;
+    for (const [k, v] of Object.entries(w))
+      if (typeof v === "string" && v.startsWith(ASSET_PREFIX)) {
+        const uri = dataUri(from, v);
+        if (uri) w[k] = uri;
+      }
+  }
+  for (const v of Object.values(n)) inlineAssets(v, from);
+}

package/vendor/base/src/definitions/load/compile/component.ts

@@ -39,6 +39,7 @@ export function compileComponentTree(def: UnoverseDefinition): void {
       if (typeof s.on === "string") entry.on = s.on;
       else if (s.states && typeof s.states === "object" && Object.keys(s.states).length) entry.on = STEP;
       if (typeof s.initial === "string") entry.initial = s.initial;
+      if ((s as { fullscreen?: unknown }).fullscreen === true) entry.fullscreen = true;
       if (s.states && typeof s.states === "object")
         entry.states = Object.entries(s.states).map(([k, v]) => ({
           name: k,

package/vendor/base/src/definitions/load/compile/index.ts

@@ -3,7 +3,7 @@
  * the expand/ split of 2026-08-30):
  *
  *   component.ts   a component's `states:` tree → served projections
- *   sections.ts    a template layout's three words → wire claims + sections
+ *   sections.ts    a template layout's placed parts → wire claims + sections
  *   template.ts    a template's states (folder) or root (block) → layouts/previews
  */
 

package/vendor/base/src/definitions/load/compile/sections.ts

@@ -1,138 +1,48 @@
 /**
- * The SECTION-WORD compiler: a template layout's three words → wire claims +
- * section projections. Split from compile.ts into this folder 2026-09-02; the
- * rules are unchanged.
+ * The PART compiler: a template layout's placed parts → wire claims + section
+ * projections.
  */
 
 import type { UnoverseDefinition } from "../../model.js";
 
-/** Expand a template layout's THREE-WORD sections (§9b, 2026-08-29; one director word
- *  since 2026-09-02) into the wire primitives the renderer already speaks, collecting
- *  the section projections as it goes. `static:`/`copywriter:` link a component
- *  (face = its basename) and become a limit-1 claim on that face; `director:` with a
- *  `component` is a SEARCH place (same limit-1 claim; the grammar rides the section for
- *  the fill path), and without one it is the open DELIVERY claim — its face is the
- *  `state:` pin when authored (arrivals are switched in and held), else the owning
- *  state's name (the free name-match dance). The SDK stays dumb: authors never see
- *  ComponentSlot/select/where, and the wire never sees the three words. */
+/** The one way a layout places a part: a `Ref` into the template's own `components/`. */
+const PART_PREFIX = "components/";
+
+/** Expand a template layout's placed parts (§9b) into the wire primitives the renderer
+ *  already speaks, collecting the section projections as it goes. A part is placed with
+ *  the ordinary element, `type: Ref` + `ref: components/<name>`; it becomes a limit-1
+ *  claim on its own face (the file's basename). The SDK stays dumb: authors never see
+ *  ComponentSlot/select/where. What an Agent may write into a part is each prop's
+ *  `input`, never the element that places it.
+ *
+ *  RETIRED VOCABULARY IS A LOUD FAILURE, never a legacy read (the no-shims law): a stale
+ *  layout fails at load with the fix in the message. */
 export function expandTemplateSections(
   node: unknown,
-  owningState: string,
   templateName: string,
   out: NonNullable<UnoverseDefinition["sections"]>[string],
 ): unknown {
-  if (Array.isArray(node)) return node.map((c) => expandTemplateSections(c, owningState, templateName, out));
+  if (Array.isArray(node)) return node.map((c) => expandTemplateSections(c, templateName, out));
   if (!node || typeof node !== "object") return node;
   const n = node as Record<string, unknown>;
-  const linked = typeof n.static === "string" ? "static" : typeof n.copywriter === "string" ? "copywriter" : null;
-  if (linked) {
-    const path = String(n[linked]);
+  for (const word of ["static", "director", "copywriter", "query"] as const) {
+    if (n[word] !== undefined)
+      throw new Error(
+        `template "${templateName}": the ${word}: word is retired. Place the part with type: Ref and ref: components/<name>, and mark each of its props input: true (an Agent fills it) or input: false (drawn from its default) (UNOVERSE_AUTHORING "input decides")`,
+      );
+  }
+  if (n.type === "Ref" && typeof n.ref === "string" && n.ref.startsWith(PART_PREFIX)) {
+    const path = n.ref;
     const face = path.split("/").pop() ?? path;
-    out.push({ kind: linked, face, component: path, ref: `${templateName}/${face}` });
-    const { static: _s, copywriter: _c, ...rest } = n;
+    out.push({ kind: "part", face, component: path, ref: `${templateName}/${face}` });
+    const { type: _t, ref: _r, ...rest } = n;
     return {
       type: "ComponentSlot",
       select: { from: "all", where: { field: "state", eq: face }, limit: 1 },
       ...rest,
     };
   }
-  // RETIRED VOCABULARY IS A LOUD FAILURE, never a legacy-read (the no-shims law).
-  // `query:` merged into `director:` 2026-09-02 (§9e rule 10b REVERSED); `limit` and
-  // `ask` retired the same day (`pick` is the one cap word; the question is derived,
-  // rule 10d). A stale file fails at load with the fix in the message.
-  if (n.query !== undefined) {
-    throw new Error(`template "${templateName}": the query: word is retired (§9e rule 10b reversed 2026-09-02) — spell the place director: with the same component/items/type/include/pick`);
-  }
-  if (n.director !== undefined && (n.director === null || (typeof n.director === "object" && !Array.isArray(n.director)))) {
-    const d = (n.director ?? {}) as Record<string, unknown>;
-    if (d.limit !== undefined) throw new Error(`template "${templateName}": director limit is retired — the cap word is pick everywhere (§9e rule 9, renamed 2026-09-02)`);
-    if (d.ask !== undefined || d.query !== undefined) throw new Error(`template "${templateName}": a director place never states its question — it is derived (§9e rule 10d): the writing, the page's pool, the component's contract, or the guest's ask`);
-    /**
-     * A SEARCH PLACE (§9e, one word since 2026-09-02) — the director given a component.
-     *
-     * It LINKS the part exactly as `static:`/`copywriter:` do, so the slot is identical: a
-     * limit-1 claim on the part's own face. The content is a search the page runs itself,
-     * before any model has spoken; the QUESTION is never here (rule 10d — the writer's
-     * headings for an `items` place, the page's pool for a gallery, the component's own
-     * contract, or the guest's ask). The layout says only what KIND may answer (`include`)
-     * and how many survive (`pick`); none of it reaches the slot — it rides the section
-     * for the fill path.
-     *
-     * NOTHING DECLARES WHICH PROP TAKES THE ROWS. The schema already says: the prop whose
-     * items require only `ref`. So a searched part keeps BOTH lanes — its refs filled by
-     * search at shell open with no model, its headings and taglines written by the
-     * copywriter afterwards (§9e rule 10). Same part, both lanes, in that order.
-     */
-    if (typeof d.component === "string" && d.component) {
-      const path = String(d.component);
-      const face = path.split("/").pop() ?? path;
-      // AN ITEMS PLACE (§9e rule 10c): the place holds a LIST the writer shapes — each
-      // item's heading arrives WITH its own search, so they can never disagree.
-      //
-      // THE SEARCH WORDS SIT ON THE THING THAT SEARCHES (owner ruling 2026-09-02): each
-      // ITEM searches, so type/include/pick nest INSIDE items: beside min/max, and pick
-      // reads unambiguously as per-item. The flat spelling on an items place is a LOUD
-      // failure — before this, flat `pick` meant two different scopes depending on
-      // whether items: happened to be present.
-      const items = d.items && typeof d.items === "object" && !Array.isArray(d.items) ? (d.items as Record<string, unknown>) : null;
-      if (items && (d.type !== undefined || d.include !== undefined || d.pick !== undefined))
-        throw new Error(
-          `template "${templateName}": an items place nests its search words INSIDE items: (each ITEM searches) — items: { min, max, type, include, pick }`,
-        );
-      const src = items ?? d;
-      // THE INCLUDE WORDS ARE CLOSED: products, images, needs. An unknown word used to
-      // pass through and match NOTHING at fill time (or everything, with no filter), which
-      // is a page drawn wrong with no error anywhere. `services` is retired (2026-09-07).
-      if (Array.isArray(src.include))
-        for (const w of src.include)
-          if (!["products", "images", "needs"].includes(String(w)))
-            throw new Error(`template "${templateName}": include: [${String(w)}] is not a kind a place can hold — the words are products, images, needs${String(w) === "services" ? " (services was renamed products, 2026-09-07)" : ""}`);
-      out.push({
-        kind: "director",
-        face,
-        component: path,
-        ref: `${templateName}/${face}`,
-        ...(src.type === "discovery" || src.type === "intent" ? { type: src.type } : {}),
-        ...(Array.isArray(src.include) ? { include: src.include.map(String) } : {}),
-        ...(typeof src.pick === "number" ? { pick: src.pick } : {}),
-        ...(items ? { items: { min: Number(items.min) || 1, max: Number(items.max) || 1 } } : {}),
-      });
-      const { director: _d, ...rest } = n;
-      return {
-        type: "ComponentSlot",
-        select: { from: "all", where: { field: "state", eq: face }, limit: 1 },
-        ...rest,
-      };
-    }
-    /**
-     * THE COMPILER ADDRESSES THE PLACE (§9d, ruled 2026-08-31).
-     *
-     * A `director:` place is somewhere things may go — it carries no name, no prose and no
-     * state, because the ONE mind reading the page's brief already knows what the page is.
-     * But a slot still has to select SOMETHING, and two places on one layout may not claim
-     * the same face (the reaction contract's one-view-one-surface rule). So the address is
-     * handed out here, by position, and an author never types a face name.
-     *
-     * An AUTHORED `state:` still wins, for the flat-email case §9b rule 4 names — arrivals
-     * pinned into one declared state — and for any template written before this ruling.
-     */
-    const nth = out.filter((sec) => sec.kind === "director" && !sec.component).length;
-    const face = typeof d.state === "string" ? d.state : nth === 0 ? owningState : `${owningState}-${nth + 1}`;
-    out.push({
-      kind: "director",
-      face,
-      ...(typeof d.state === "string" ? { state: d.state } : {}),
-      ...(typeof d.pick === "number" ? { pick: d.pick } : {}),
-      ...(Array.isArray(d.preview) ? { preview: d.preview.map(String) } : {}),
-    });
-    const { director: _d, ...rest } = n;
-    return {
-      type: "ComponentSlot",
-      select: { from: "all", where: { field: "state", eq: face }, ...(typeof d.pick === "number" ? { limit: d.pick } : {}) },
-      ...rest,
-    };
-  }
   const o: Record<string, unknown> = {};
-  for (const [k2, v] of Object.entries(n)) o[k2] = expandTemplateSections(v, owningState, templateName, out);
+  for (const [k2, v] of Object.entries(n)) o[k2] = expandTemplateSections(v, templateName, out);
   return o;
 }