@unoverse-platform/studio 0.1.100 → 0.1.102

package/vendor/base/src/definitions/load/compile/template.ts

@@ -9,7 +9,7 @@ import type { UnoverseDefinition } from "../../model.js";
 import { loadDefinition } from "../load.js";
 import { composeIncludes } from "../expand/index.js";
 import { expandTemplateSections } from "./sections.js";
-import { placesOfStates } from "./component.js";
+import { placesOfStates, pointStepsAtStep, STEP } from "./component.js";
 
 /**
  * ONE PREVIEWED INSTANCE'S SEED — `preview ?? default` per prop, the same values the
@@ -30,28 +30,17 @@ function seedFor(ref: string, org?: string): Record<string, unknown> | undefined
   return Object.keys(seed).length ? seed : undefined;
 }
 
-/** Stamp a section list's Studio stand-ins: which refs each face previews, seeded
- *  `preview ?? default` (keyed by REF, because a director band names several and may
- *  name one twice). A linked part previews ITSELF; a delivery band previews whatever
- *  its `preview:` names. */
+/** Stamp a section list's Studio stand-ins: each placed part previews ITSELF, seeded
+ *  `preview ?? default` and keyed by its ref. */
 function seedSections(
   secs: NonNullable<UnoverseDefinition["sections"]>[string],
   org: string | undefined,
   previews: Record<string, string[]>,
 ): void {
   for (const s of secs) {
-    // A LINKED part previews ITSELF — including a director SEARCH place, which carries a
-    // ref since the one-word merge (a kind check here hid every search place's mock the
-    // day the kinds merged). Only an unlinked DELIVERY band previews its `preview:` list.
-    const refs = s.ref ? [s.ref] : s.kind === "director" ? (s.preview ?? []) : [];
-    if (s.ref) previews[s.face] = [s.ref];
-    else if (s.preview?.length) previews[s.face] = s.preview;
-    const seeds: Record<string, Record<string, unknown>> = {};
-    for (const ref of new Set(refs)) {
-      const seed = seedFor(ref, org);
-      if (seed) seeds[ref] = seed;
-    }
-    if (Object.keys(seeds).length) s.seeds = seeds;
+    previews[s.face] = [s.ref];
+    const seed = seedFor(s.ref, org);
+    if (seed) s.seeds = { [s.ref]: seed };
   }
 }
 
@@ -60,11 +49,9 @@ export function synthesizeTemplateRoot(def: UnoverseDefinition, folderDir?: stri
     /**
      * A BLOCK — a flat template that declares a DRAWING instead of a tree (2026-08-31).
      *
-     * Its three words still have to compile. Without this the `director:` line sat in the
-     * served root verbatim, unexpanded and inert: the renderer speaks ComponentSlot and
-     * knows no such word, so a block drew as an empty box wherever it was used (observed
-     * in Studio the moment the first one was authored). The folder form compiles its
-     * sections as it composes each state's layout; the flat form had no such pass.
+     * Its placed parts still have to compile: the renderer speaks ComponentSlot, and a
+     * part left as a bare `Ref` into `components/` would draw nothing. The folder form
+     * compiles its parts as it composes each state's layout; the flat form does it here.
      *
      * Compiled into the SAME projections a one-state template serves, so nothing
      * downstream has to know which form it was authored in: `layouts`, `defaultLayout`,
@@ -72,13 +59,13 @@ export function synthesizeTemplateRoot(def: UnoverseDefinition, folderDir?: stri
      */
     if ((def as unknown as { states?: unknown }).states === undefined && def.layouts === undefined) {
       const secs: NonNullable<UnoverseDefinition["sections"]>[string] = [];
-      const compiled = expandTemplateSections(def.root, def.name, def.name, secs);
+      const compiled = expandTemplateSections(def.root, def.name, secs);
       if (secs.length) {
         const previews: Record<string, string[]> = {};
         seedSections(secs, def.org, previews);
         if (Object.keys(previews).length) def.preview = { ...(def.preview ?? {}), ...previews };
       }
-      // The projections are built WHETHER OR NOT the root carries section words
+      // The projections are built WHETHER OR NOT the root places parts
       // (2026-09-02): a pure-arrangement block — `band`, `two-column`, style and an
       // opening, no fill lane — is still a template, and without a layout Studio drew it
       // as a blank canvas (observed the day blocks returned). Its own authored children
@@ -106,6 +93,16 @@ export function synthesizeTemplateRoot(def: UnoverseDefinition, folderDir?: stri
       : {};
   const shapeNames = Object.keys(states);
   if (!folderDir || !shapeNames.length) return;
+  // STEPS, exactly as a component's (compile/component.ts, "One word: state"): a state's
+  // nested substates are its steps. The author writes `state` for them; they live in the
+  // hidden step value, so a step never moves the template. Rewritten in the AUTHORED layout,
+  // before its sections compile, so a part's own claim (which names the part) is never
+  // mistaken for a step of the same name.
+  const steps = new Set<string>();
+  for (const n of shapeNames) {
+    const subs = (states[n] as { states?: Record<string, unknown> } | null)?.states;
+    if (subs && typeof subs === "object") Object.keys(subs).forEach((sub) => steps.add(sub));
+  }
   const layouts: Record<string, unknown> = {};
   const sections: NonNullable<UnoverseDefinition["sections"]> = {};
   const compiledPreview: Record<string, string[]> = {};
@@ -113,7 +110,8 @@ export function synthesizeTemplateRoot(def: UnoverseDefinition, folderDir?: stri
     const st = (states[name] ?? {}) as Record<string, unknown>;
     if (typeof st.layout !== "string") continue;
     const secs: NonNullable<UnoverseDefinition["sections"]>[string] = [];
-    layouts[name] = expandTemplateSections(composeIncludes({ $include: st.layout }, folderDir), name, def.name, secs);
+    const authored = composeIncludes({ $include: st.layout }, folderDir);
+    layouts[name] = expandTemplateSections(steps.size ? pointStepsAtStep(authored, steps) : authored, def.name, secs);
     sections[name] = secs;
     // MOCK VALUES TRAVEL WITH THE SECTION — a preview host seeds instances from the wire.
     seedSections(secs, def.org, compiledPreview);
@@ -135,6 +133,24 @@ export function synthesizeTemplateRoot(def: UnoverseDefinition, folderDir?: stri
   def.initialView = shapeNames[0];
   const statePlaces = placesOfStates(states);
   if (statePlaces) def.statePlaces = statePlaces;
+  // THE STEP TREE, served like a component's: what an Agent navigates and a viewer lists.
+  // Components and templates are both tasks.
+  def.stateTree = shapeNames.map((n) => {
+    const subs = (states[n] as { states?: Record<string, { layout?: unknown } | null> } | null)?.states;
+    const names = subs && typeof subs === "object" ? Object.keys(subs) : [];
+    // A state that takes the whole screen says so; the SDK takes the browser fullscreen for it.
+    const full = (states[n] as { fullscreen?: unknown } | null)?.fullscreen === true ? { fullscreen: true } : {};
+    if (!names.length) return { name: n, ...full };
+    return {
+      name: n,
+      ...full,
+      on: STEP,
+      initial: names[0],
+      states: names.map((sub) => ({ name: sub, ...(typeof subs![sub]?.layout === "string" ? { layout: subs![sub]!.layout as string } : {}) })),
+    };
+  });
+  const first = def.stateTree.find((e) => e.states?.length)?.initial;
+  if (first) def.state = { ...(def.state ?? {}), [STEP]: first };
   if (Object.keys(sections).length) def.sections = sections;
   if (Object.keys(compiledPreview).length) def.preview = { ...(def.preview ?? {}), ...compiledPreview };
   delete (def as unknown as Record<string, unknown>).states;

package/vendor/base/src/definitions/load/expand/walk.ts

@@ -25,8 +25,11 @@ export function expandNode(node: AnyNode, contextOrg?: string, inherit?: Record<
   // so an atom `Ref` inside a repeated item is inlined like anywhere else.
   // An `Each`'s `item` draws ONE ITEM, so everything inside it belongs to that
   // array's item shape (see `inheritProps`).
+  // An `Each` over LITERAL `items` draws the author's own content: its item fields are
+  // nobody's to fill, so an atom inside it hands the host no contract.
   const itemsField = node?.type === "Each" ? (node.bind as AnyNode | undefined)?.items : undefined;
-  if (node?.item) node.item = expandNode(node.item, contextOrg, inherit, props, typeof itemsField === "string" ? [...scope, itemsField] : scope);
+  const literalItems = node?.type === "Each" && Array.isArray(node.items);
+  if (node?.item) node.item = expandNode(node.item, contextOrg, inherit, literalItems ? undefined : props, typeof itemsField === "string" ? [...scope, itemsField] : scope);
   // `Switch` carries its branches in `cases` (a value→subtree map) — expand each, so an
   // atom `Ref` inside a Switch branch is inlined like anywhere else (else the branch
   // renders blank). Parallel to children/item.

package/vendor/base/src/definitions/load/load.ts

@@ -27,6 +27,7 @@ import { normalizeDeclaredKind, defaultLayoutOf } from "../model.js";
 
 import { composeIncludes, expandNode, expandRefs, referencedDefinition, inheritState, mergeInheritedProps } from "./expand/index.js";
 import { compileComponentTree, synthesizeTemplateRoot } from "./compile/index.js";
+import { inlineAssets } from "./assets.js";
 type AnyNode = Record<string, any>;
 
 /** Resolve a definition by name (case-insensitive), searching the relevant folder(s).
@@ -101,6 +102,7 @@ export function loadDefinition(
           // The FLAT single-file form compiles its state tree exactly like the
           // folder form (unified 2026-08-29 — a template-local part is flat).
           if (k === "component") compileComponentTree(d);
+          inlineAssets(d, dirname(path));
           return form(d);
         });
       }
@@ -180,6 +182,9 @@ export function loadDefinition(
               if (m[key] != null) (def as unknown as Record<string, unknown>)[key] = m[key];
             }
             if (m.preview && typeof m.preview === "object") def.preview = m.preview as Record<string, string[]>;
+            // THE WORKFLOW THAT WORKS IT (UNOVERSE_HOST_PAGE.md rule 4): the manifest names it,
+            // and the page reads it here to start a call on it.
+            if (m.binding && typeof m.binding === "object") def.binding = m.binding as { workflow?: string; trigger?: string };
             // SPATIAL-CAPABLE, exactly as a component is (§9c, ruled 2026-08-30): a
             // template is found by what a guest says, through the same projection, the
             // same registry switch and the same embedded text. The difference is only
@@ -469,6 +474,7 @@ export function loadDefinition(
           }
           if (k === "component") compileComponentTree(def);
           if (k === "template") synthesizeTemplateRoot(def, folderDir);
+          inlineAssets(def, folderDir);
           return k === "atom" ? def : form(def);
         });
       }

package/vendor/base/src/definitions/model.ts

@@ -17,58 +17,35 @@ export interface UnoverseDefinition {
   /** COMPONENTS AND TEMPLATES: the place each state names. An interface entering a state
    *  that names a place moves there (UNOVERSE_SCREEN.md §2.3). */
   statePlaces?: Record<string, string>;
-  /** TEMPLATES (§9b RULED 2026-08-29): the compiled SECTIONS of each state's
-   *  layout — one entry per `static:` / `copywriter:` / `director:` line, in
-   *  arrangement order. `static`/`copywriter` link a component (face = its
-   *  basename); the ONE `director` section is where deliveries land (face = its
-   *  `state:` pin, else the owning state's name). Studio's table and seeding read
-   *  this; the wire layouts carry the expanded ComponentSlots. */
+  /** TEMPLATES (§9b): the compiled SECTIONS of each state's layout, one entry per
+   *  placed part (`type: Ref` + `ref: components/<name>`), in arrangement order. The
+   *  face is the part's basename, and the wire layouts carry the expanded
+   *  ComponentSlots. Studio's table and seeding read this; so do the fill schema and
+   *  the Task Runner. What an Agent writes into a part is each prop's `input`. */
   sections?: Record<
     string,
     {
-      kind: "static" | "copywriter" | "director";
+      kind: "part";
       face: string;
-      /** Linked sections: the authored path (components/masthead). A DIRECTOR section
-       *  with a component is a SEARCH PLACE (§9e, one word since 2026-09-02); without
-       *  one it is a DELIVERY band. */
-      component?: string;
-      /** Linked sections: the resolvable scoped ref (email-digest/masthead). */
-      ref?: string;
-      /** SEARCH places (§9e rule 10d): the DERIVED question — never authored. Stamped at
-       *  fill time from the first voice that speaks: the writer's headings (items), the
-       *  page's pool (galleries), the component's own contract, or the guest's ask.
-       *  Present on the wire only after derivation; a layout carrying one fails to load. */
-      ask?: string;
-      /** SEARCH places: which `object_type`s may answer, as the six `include*` flags
-       *  (`ranking.ts`). A day is made of SERVICES; nothing should draw a need, a skill or
-       *  an app into a moment. APPS ARE ALWAYS OFF on this lane, whatever is listed: the
-       *  page's searches are SILENT — no app unlocked, no tool minted, no card lane, no
-       *  director woken — because otherwise every place would rain cards onto the screen
-       *  while the page was still assembling itself. */
-      include?: string[];
-      /** The previewed components' own mock values (`preview ?? default` per prop),
-       *  keyed by REF — a linked part's one component, or each of the director's
-       *  stand-ins. A preview host seeds instances with these the way the Components
-       *  screen does; without them everything draws as ghosts and a finished arrangement
-       *  reads as a broken one. Never used at runtime: a delivery fills the instance. */
+      /** The authored path (components/masthead). */
+      component: string;
+      /** The resolvable scoped ref (email-digest/masthead). */
+      ref: string;
+      /** The part's own mock values (`preview ?? default` per prop), keyed by REF. A
+       *  preview host seeds instances with these the way the Components screen does;
+       *  without them everything draws as ghosts and a finished arrangement reads as a
+       *  broken one. Never used at runtime: a fill writes the instance. */
       seeds?: Record<string, Record<string, unknown>>;
-      /** Delivery bands only (a director section with no component). */
-      state?: string;
-      rules?: string;
-      preview?: string[];
-      /** Both director modes: how many the director keeps — the ONE cap word. */
-      pick?: number;
-      /** Search places: which search answers (authored; derived when absent). */
-      type?: "discovery" | "intent";
-      /** An items place (§9e rule 10c): the writer shapes min–max items, each heading
-       *  arriving with its own search. */
-      items?: { min: number; max: number };
     }[]
   >;
   /** TEMPLATES: Studio preview mocks per slot — interface refs, each rendering its
    *  own defaults (the interface-model rule: mocks are the interface's OWN defaults,
    *  never authored preview data). From the template's manifest.yaml. */
   preview?: Record<string, string[]>;
+  /** TEMPLATES: the workflow that works this template as a task, from its manifest.yaml
+   *  (docs/unoverse/design/sdk/UNOVERSE_HOST_PAGE.md rule 4). A page starts a call on it from
+   *  the avatar; a template without one starts nothing. */
+  binding?: { workflow?: string; trigger?: string };
   /** Source basename for FILE definitions (atoms) — the identity refs resolve by. */
   file?: string;
   /** The client org it belongs to (server-injected from its folder, never
@@ -176,6 +153,8 @@ export interface UnoverseDefinition {
     on?: string;
     initial?: string;
     states?: { name: string; layout?: string }[];
+    /** The state takes the whole screen (the authored `fullscreen: true`). */
+    fullscreen?: boolean;
   }[];
 }
 

package/vendor/base/src/definitions/registry/homes.ts

@@ -302,7 +302,8 @@ export function resolveComponentDirs(
 }
 
 /** Resolve a component ref (bare or `<org>/<name>`, either tier) to its ON-DISK
- *  FOLDER — the home of its manifest and any lifecycle handler files (onstart.js …).
+ *  FOLDER — the home of its manifest and any lifecycle handler files (onstart.js …). A
+ *  template resolves here too, after components: both are tasks.
  *  Returns null for a flat/marketplace component with no folder. Used by the MCP
  *  render path to run component lifecycle handlers. */
 export function componentFolder(ref: string): string | null {
@@ -312,5 +313,12 @@ export function componentFolder(ref: string): string | null {
     const folder = join(dir, lower);
     if (defPath(folder, "manifest") || defPath(folder, lower)) return folder;
   }
+  // A TEMPLATE IS A TASK TOO (ruled 2026-09-07: components and templates are both tasks), so
+  // its manifest's lifecycle, analytics and finish line are found the same way. A component
+  // of the same name wins, as it always has.
+  for (const { dir } of templateDirs(refOrg)) {
+    const folder = join(dir, lower);
+    if (defPath(folder, "manifest") || defPath(folder, lower)) return folder;
+  }
   return null;
 }

package/vendor/base/src/lint/design/file.mjs

@@ -413,6 +413,28 @@ function lintFile(file) {
     }
   }
 
+  // AN ORG'S OWN IMAGES (definitions/load/assets.ts): `src: assets/<file>` must name a file in
+  // an assets/ folder from the file's own folder up to the org's (a template keeps its own), or
+  // the shared one, of an image type, under 256 KB.
+  {
+    const home = (orgDirs ?? []).find((d) => file.startsWith(d + sep)) ?? null;
+    const shared = DS ?? null;
+    const walk = (n) => {
+      if (Array.isArray(n)) return n.forEach(walk);
+      if (!n || typeof n !== "object") return;
+      if (n.type === "Image" && typeof n.src === "string" && n.src.startsWith("assets/")) {
+        const dirs = [];
+        for (let d = dirname(file); home && d.startsWith(home); d = dirname(d)) dirs.push(d);
+        const hit = [...dirs, shared].map((d) => d && join(d, n.src)).find((f) => f && existsSync(f));
+        if (!hit) report("error", file, `image "${n.src}" is not in this org's assets/ folder (docs.unoverse.ai/design/styles-and-tokens)`);
+        else if (!/\.(svg|png|jpe?g|webp|gif)$/i.test(n.src)) report("error", file, `image "${n.src}" is not an image type the platform serves (svg, png, jpg, webp, gif)`);
+        else if (statSync(hit).size > 256 * 1024) report("error", file, `image "${n.src}" is over 256 KB; a photo belongs on a CDN, not in the design folder`);
+      }
+      Object.values(n).forEach(walk);
+    };
+    walk(json);
+  }
+
   // A STATE'S PLACE (UNOVERSE_SCREEN.md §2.3) is `chat` or a Place some app declares. A name no
   // app has sends the interface to the conversation without a word, so it is refused here.
   if (placeNames && !isAppPath(file) && json && typeof json === "object" && !Array.isArray(json) && json.states && typeof json.states === "object") {
@@ -552,8 +574,10 @@ function lintFile(file) {
               report("error", file, `preview."${state}" must be an array of component names, or an object of template-state mock data`);
               continue;
             }
+            // `name#state` names the state the seed opens in (the address grammar, owner
+            // 2026-09-11); the lookup is the name before the hash.
             for (const c of list)
-              if (comps && !comps.has(String(c).toLowerCase()))
+              if (comps && !comps.has(String(c).split("#")[0].toLowerCase()))
                 report("error", file, `preview."${state}" names unknown component "${c}". No match in design/marketplace/components/ or this org's components/ (org-privacy: another org's components are out of reach; lookup is case-insensitive)`);
           }
         }
@@ -676,13 +700,13 @@ function lintFile(file) {
       // EVERY PROP CARRIES A DESCRIPTION (UNOVERSE_AUTHORING §3b, RULED 2026-08-30).
       //
       // It reads BOTH ways, which is why it is compulsory rather than encouraged. A
-      // description is not only what a copywriter fills against: it is what lets an agent
+      // description is not only what an Agent fills against: it is what lets an agent
       // UNDERSTAND the screen it is looking at. `read` reports where the person is; the
       // descriptions say what is actually in front of them. A screen of unnamed fields is
       // one no agent can reason about, in either direction.
       //
-      // AND IT SAYS NOTHING ABOUT PERMISSION. That is the layout's word — `static` /
-      // `copywriter` / `director` (TEMPLATE_MODEL §9b) — never a prop's. The rule this
+      // AND IT SAYS NOTHING ABOUT PERMISSION. That is the prop's `input` (UNOVERSE_AUTHORING
+      // "input decides"), never its description. The rule this
       // replaces was "a described prop is a writable prop", which made silence the safety
       // mechanism: a field was protected because nobody had explained it, and explaining it
       // was what exposed it. Describing a field is now free of consequence, so there is no
@@ -691,7 +715,7 @@ function lintFile(file) {
         .filter(([, v]) => !(v && typeof v === "object" && typeof v.description === "string" && v.description.trim()))
         .map(([k]) => k);
       if (undescribed.length)
-        report("error", file, `props [${undescribed.join(", ")}] carry no "description". Every prop says what it IS, so an agent can read the screen as well as fill it. A description grants nothing: permission is the layout's word (static / copywriter / director), never a prop's (UNOVERSE_AUTHORING §3b)`);
+        report("error", file, `props [${undescribed.join(", ")}] carry no "description". Every prop says what it IS, so an agent can read the screen as well as fill it. A description grants nothing: permission is the prop's input: true or false (UNOVERSE_AUTHORING §3b)`);
 
       // only components that ADOPTED the structure are held to the full discipline
       if (hasLayouts || stateFiles.length || hasStateBlock) {

package/vendor/base/src/lint/design/vocabulary.mjs

@@ -114,7 +114,7 @@ export const STYLE_KEYS = new Set([
   "width", "height", "maxWidth", "minWidth", "minHeight", "maxHeight", "flex",
   "padding", "margin", "gap", "overflow",
   "position", "inset", "top", "right", "bottom", "left", "zIndex",
-  "direction", "wrap", "align", "justify", "display", "columns", "span", "stackBelow", "container", "hideBelow", "hideAbove",
+  "direction", "wrap", "align", "justify", "display", "columns", "span", "stackBelow", "stage", "container", "hideBelow", "hideAbove",
   "background", "radial", "border", "borderTop", "borderRight", "borderBottom", "borderLeft",
   "outline", "shadow", "radius", "radiusTopLeft", "radiusTopRight", "radiusBottomLeft", "radiusBottomRight",
   "font", "weight", "lineHeight", "color", "textAlign", "fit",

package/vendor/base/src/lint/design/walk.mjs

@@ -13,26 +13,19 @@
  * The context is created per run by index.mjs, so nothing survives between runs.
  */
 import { existsSync, statSync, readdirSync, readFileSync } from "node:fs";
-import { join, dirname, basename, relative, sep } from "node:path";
+import { join, dirname, relative, sep } from "node:path";
 import { PRIMITIVES, CONDITION_KEYS, STYLE_KEYS, RAW_VALUE, CHILD_NODE_KEYS, PARTIAL_DIRS, DIMENSION_KEYS, UNIVERSAL_PROPS, PRIMITIVE_PROPS, PRIMITIVE_BINDS } from "./vocabulary.mjs";
-import { isDefFile, defName, defPath, readDef } from "./defs.mjs";
+import { isDefFile, defPath } from "./defs.mjs";
 
-// THE FOUR WORDS and the two closed blocks (UNOVERSE_TEMPLATE_MODEL.md §9b + §9e).
-const SECTION_WORDS = ["static", "copywriter", "director"];
-const DELIVERY_KEYS = ["state", "pick", "rules", "preview"];
-// §9e: a queried place says WHAT draws it, WHAT it asks, WHAT KIND may answer, HOW MANY.
-const SEARCH_KEYS = ["component", "type", "include", "pick", "items"];
-// The `object_type`s a place may admit. Apps and skills are absent by construction: the
-// page's own searches are SILENT (no app unlocked, no tool minted, no card lane, no
-// director woken), or every place would rain cards onto a page still assembling itself.
-// `products` since migration 035 (2026-09-05; `services` retired 2026-09-07, `actions` with it:
-// no row is written as one). Each word maps to a declared spatial type (guarded by a test).
-const QUERY_TYPES = ["products", "images", "needs"];
+// RETIRED LAYOUT WORDS. A template layout places its own parts with the ordinary element,
+// `type: Ref` + `ref: components/<name>`, and what an Agent writes into a part is each
+// prop's `input`, never the element that places it (UNOVERSE_TEMPLATE_MODEL §9b).
+const RETIRED_WORDS = ["static", "director", "copywriter", "query"];
+/** The one way a layout places a part: a `Ref` into the template's own `components/`. */
+const PART_PREFIX = "components/";
 
 export function makeWalkNode(ctx) {
-  const { report, checkCondition, checkDimension, checkToken, appSizesForFile, componentNamesForFile, refResolves, canonicalRef, declaredProps, atomsDirExists, stepList, spaceSteps, isAppPath, isTemplatePath, isTemplatePart, defRoot } = ctx;
-  // One director per LAYOUT FILE, tracked for this run only (each file is walked once).
-  const directorsSeen = new Map();
+  const { report, checkCondition, checkDimension, checkToken, appSizesForFile, refResolves, canonicalRef, declaredProps, atomsDirExists, stepList, spaceSteps, isAppPath, isTemplatePath, isTemplatePart, defRoot } = ctx;
 
 function walkNode(node, file, root, widthCap = null, isLayoutRoot = false) {
   if (Array.isArray(node)) return node.forEach((n) => walkNode(n, file, root, widthCap));
@@ -54,147 +47,29 @@ function walkNode(node, file, root, widthCap = null, isLayoutRoot = false) {
     return; // the included file is linted on its own
   }
 
-  // THE THREE WORDS (UNOVERSE_TEMPLATE_MODEL.md §9b): a template layout's parts say HOW
-  // they are filled instead of naming a primitive. They compile to ComponentSlots at
-  // serve time, so the linter checks the authored word here and hands the rest of the
-  // node to the ordinary walk as the slot it becomes.
-  const word = SECTION_WORDS.find((w) => node[w] !== undefined);
-  if (word && node.type === undefined) {
-    if (!isTemplatePath(file))
-      report("error", file, `"${word}:" is template grammar — only a template layout's parts say how they are filled. Apps and components author ComponentSlot directly (UNOVERSE_TEMPLATE_MODEL §9b)`);
-    if (node.query !== undefined) {
-      report("error", file, `"query:" is retired vocabulary (§9e rule 10b REVERSED 2026-09-02) — spell the place director: with the same component/items/type/include/pick. One word, one judge`);
-    }
-    if (word === "director") {
-      /**
-       * ONE WORD, TWO MODES (§9e, 2026-09-02): a director place WITH `component` is a
-       * SEARCH place (the page fetches its own content); WITHOUT one it is a DELIVERY
-       * band (the conversation fills it). The key sets are mutually exclusive, so a
-       * place is always unambiguously one or the other — behaviour never forks on a
-       * stray key. The QUESTION is never authored (rule 10d): it is derived from the
-       * writing, the page's pool, the component's contract, or the guest's ask.
-       */
-      const d = node.director;
-      if (!d || typeof d !== "object" || Array.isArray(d)) {
-        report("error", file, `"director:" is a block, not a path (§9b rule 1)`);
-      } else if (d.limit !== undefined) {
-        report("error", file, `director.limit is retired — the one cap word is "pick": how many the director keeps (§9e rule 9, renamed 2026-09-02)`);
-      } else if (d.ask !== undefined || d.query !== undefined) {
-        report("error", file, `a director place never states its question — it is DERIVED (§9e rule 10d): the writer's headings (items), the page's pool (a gallery), the component's own contract, or the guest's ask`);
-      } else if (typeof d.component === "string" && d.component) {
-        // A SEARCH PLACE. The checks here are the ones that fail SILENTLY at runtime: a
-        // place missing include or pick is skipped, and a kind nobody stores draws
-        // nothing — both read as "the design is broken" with no log saying why.
-        //
-        // THE SEARCH WORDS SIT ON THE THING THAT SEARCHES (owner ruling 2026-09-02): on
-        // an items place each ITEM searches, so type/include/pick nest INSIDE items:
-        // beside min/max, and pick reads unambiguously as per-item. Spelled flat, the
-        // same word meant two scopes depending on whether items: was present.
-        const itemed = d.items && typeof d.items === "object" && !Array.isArray(d.items);
-        if (d.items !== undefined && !itemed)
-          report("error", file, `director.items is a block — items: { min, max, type, include, pick } (§9e rule 10c)`);
-        if (itemed && (d.type !== undefined || d.include !== undefined || d.pick !== undefined))
-          report("error", file, `an items place nests its search words INSIDE items: { min, max, type, include, pick } — each ITEM searches, so pick reads per item (§9e rule 10c, 2026-09-02)`);
-        const TOP_KEYS = itemed ? ["component", "items"] : SEARCH_KEYS;
-        for (const k of Object.keys(d))
-          if (!TOP_KEYS.includes(k))
-            report("error", file, `a search place has no "${k}". It reads ${TOP_KEYS.map((x) => `"${x}"`).join(", ")} (§9e; "state"/"rules" belong to a delivery band — a place with a component is governed by the page's brief)`);
-        if (!defPath(root, d.component) && !existsSync(join(root, d.component)))
-          report("error", file, `director.component "${d.component}" does not resolve under ${relative(process.cwd(), root)}/ (§9e)`);
-        const ITEM_KEYS = ["min", "max", "type", "include", "pick"];
-        if (itemed) {
-          for (const k of Object.keys(d.items))
-            if (!ITEM_KEYS.includes(k))
-              report("error", file, `director.items has no "${k}". It reads ${ITEM_KEYS.map((x) => `"${x}"`).join(", ")} (§9e rule 10c)`);
-          const { min, max } = d.items;
-          if (typeof min !== "number" || typeof max !== "number" || min < 1 || max < min)
-            report("error", file, `director.items carries { min, max } — how many items the writer may shape, 1 <= min <= max (§9e rule 10c)`);
-        }
-        // The search words, read where they live: the place itself, or each item.
-        const s = itemed ? d.items : d;
-        const at = itemed ? "director.items" : "director";
-        // REQUIRED, both (2026-09-01, carried over). The engine supplies NO defaults: a
-        // default include or pick would be one template's answer written into the platform.
-        if (s.include === undefined)
-          report("error", file, `${at}.include is REQUIRED on a search place — what KIND may answer; the engine has no default kind (§9e rule 6)`);
-        else if (!Array.isArray(s.include) || s.include.some((t) => typeof t !== "string"))
-          report("error", file, `${at}.include is an array of result types — ${QUERY_TYPES.map((t) => `"${t}"`).join(", ")} (§9e rule 6)`);
-        else
-          for (const t of s.include)
-            if (!QUERY_TYPES.includes(String(t)))
-              report("error", file, `${at}.include has no "${t}". A place may admit ${QUERY_TYPES.map((x) => `"${x}"`).join(", ")}; apps and skills are never included, because the page's own searches are SILENT (§9e rule 6)`);
-        if (s.pick === undefined)
-          report("error", file, `${at}.pick is REQUIRED — how many the director keeps${itemed ? " PER ITEM" : ""}; the engine has no default count (§9e rule 9)`);
-        else if (typeof s.pick !== "number" || s.pick < 1)
-          report("error", file, `${at}.pick is a NUMBER — how many the director keeps${itemed ? " per item" : ""}, a cap the machine enforces (§9e rule 9)`);
-        // `type` is OPTIONAL since the question derives (rule 10d): authored it stands;
-        // absent, a contract subject searches as intent and the guest's ask as discovery.
-        if (s.type !== undefined && s.type !== "discovery" && s.type !== "intent")
-          report("error", file, `${at}.type is "discovery" (what lives around a topic) or "intent" (a named need) — or omitted, and the derivation decides (§9e rule 10d)`);
-      } else {
-        // A DELIVERY BAND.
-        for (const k of Object.keys(d))
-          if (!DELIVERY_KEYS.includes(k))
-            report("error", file, `a delivery band has no "${k}". It reads ${DELIVERY_KEYS.map((x) => `"${x}"`).join(", ")} (§9b; a place that names a component is a search place)`);
-        if (d.pick !== undefined && (typeof d.pick !== "number" || d.pick < 1))
-          report("error", file, `director.pick is a NUMBER — how many the director keeps, a cap the machine enforces (§9e rule 9)`);
-        // NOTHING READS `rules`: the director's model was removed (UNOVERSE_SCREEN.md §2.7).
-        if (d.rules !== undefined)
-          report("warn", file, `director.rules is ignored: no model reads it any more. A band holds what arrives in search rank, up to pick. Remove it`);
-        if (d.preview !== undefined && (!Array.isArray(d.preview) || d.preview.some((c) => typeof c !== "string")))
-          report("error", file, `director.preview is an array of component names — Studio's stand-ins until a real run exists (§9b rule 6)`);
-        else if (Array.isArray(d.preview)) {
-          const comps = componentNamesForFile(file);
-          for (const c of d.preview)
-            if (comps && !comps.has(String(c).toLowerCase()))
-              report("error", file, `director.preview names unknown component "${c}". No match in the design system or this org's components (lookup is case-insensitive)`);
-        }
-        // A PLACE NEEDS NO NAME (§9d): the compiler addresses delivery bands by
-        // position; an AUTHORED state: still stands (the flat-email pin), so two bands
-        // pinned to the SAME face remains the one genuine ambiguity.
-        const seen = directorsSeen.get(file) ?? [];
-        const face = typeof d?.state === "string" ? d.state : null;
-        if (face && seen.includes(face))
-          report("error", file, `two directed bands claim the face "${face}". A face has exactly one surface, or the active one is ambiguous (§9b rule 3, the reaction contract)`);
-        directorsSeen.set(file, [...seen, face]);
-      }
-    } else if (typeof node[word] !== "string") {
-      report("error", file, `"${word}:" links a component by PATH (${word}: components/<part>) — that is what makes it a known part (§9b rule 1)`);
-    } else {
-      const path = node[word];
-      if (!defPath(root, path) && !existsSync(join(root, path)))
-        report("error", file, `${word} "${path}" does not resolve under ${relative(process.cwd(), root)}/ (§9b rule 1)`);
-    }
-    // Everything else on the line rides through to the slot it compiles into. The select
-    // is SYNTHESIZED here exactly as the compiler builds it (a linked part claims its own
-    // face, limit 1; the director's claim is its `state:` pin) so the rest of the walk
-    // sees what will actually be served — and an authored one is the ceremony §9b rule 9
-    // exists to abolish.
+  // RETIRED: the section words. A stale layout fails here with the fix in the message.
+  const retired = RETIRED_WORDS.find((w) => node[w] !== undefined);
+  if (retired) {
+    report("error", file, `"${retired}:" is retired. Place the part with type: Ref and ref: components/<name>, and mark each of its props input: true (an Agent fills it) or input: false (drawn from its default) (UNOVERSE_AUTHORING "input decides")`);
+    return;
+  }
+
+  // A PLACED PART (UNOVERSE_TEMPLATE_MODEL §9b): in a template's layout, a `Ref` into the
+  // template's own `components/` folder. It compiles to a ComponentSlot at serve time,
+  // claiming the part's own face (its basename) at limit 1, so the linter checks the part
+  // resolves and hands the rest of the node to the ordinary walk as the slot it becomes.
+  if (node.type === "Ref" && typeof node.ref === "string" && node.ref.startsWith(PART_PREFIX) && isTemplatePath(file) && !isTemplatePart(file)) {
+    const path = node.ref;
+    if (!defPath(root, path) && !existsSync(join(root, path)))
+      report("error", file, `part "${path}" does not resolve under ${relative(process.cwd(), root)}/. A layout places the template's own parts: components/<name> (§9b)`);
+    if (node.props !== undefined || node.with !== undefined)
+      report("error", file, `a placed part takes no "props" or "with": its props are its own, filled by an Agent where marked input: true and drawn from their defaults where input: false (§9b)`);
+    // An authored select is the ceremony §9b rule 9 abolishes: the claim is synthesized.
     if (node.select !== undefined)
-      report("error", file, `a template part never authors "select" — the three words compile to the wire primitives at serve time (§9b rule 9)`);
-    const { static: _s, copywriter: _c, director: _d, query: _q, select: _sel, ...rest } = node;
-    // An unpinned director claims the OWNING STATE's name (arrivals keep their own state
-    // and the template's states react by name — the free grid↔page dance), so the face
-    // comes from whichever state in the envelope declares this layout.
-    const owningState = () => {
-      const env = defPath(root, basename(root));
-      const states = env ? readDef(env)?.states : undefined;
-      if (!states || typeof states !== "object") return undefined;
-      const here = defName(basename(file));
-      return Object.keys(states).find((s) => {
-        const l = states[s]?.layout;
-        return typeof l === "string" && basename(l).toLowerCase() === here.toLowerCase();
-      });
-    };
-    // A QUERIED place links its component under `component:`, and claims that part's own
-    // face at limit 1 exactly as a linked part does — its `limit:` counts ROWS inside the
-    // part, not instances of it, so it never reaches the slot (§9e).
-    const linkedPath = word === "query" ? node.query?.component : node[word];
-    const face =
-      word === "director" ? (node.director?.state ?? owningState()) : typeof linkedPath === "string" ? linkedPath.split("/").pop() : undefined;
-    const limit = word === "director" ? node.director?.limit : 1;
-    const select = { from: "all", ...(face ? { where: { field: "state", eq: face } } : {}), ...(typeof limit === "number" ? { limit } : {}) };
-    return walkNode({ type: "ComponentSlot", select, ...rest }, file, root, widthCap);
+      report("error", file, `a placed part never authors "select". It claims its own face at serve time (§9b rule 9)`);
+    const { type: _t, ref: _r, props: _p, with: _w, select: _sel, ...rest } = node;
+    const face = path.split("/").pop();
+    return walkNode({ type: "ComponentSlot", select: { from: "all", where: { field: "state", eq: face }, limit: 1 }, ...rest }, file, root, widthCap);
   }
 
   const t = node.type;

package/vendor/base/src/manifests/executor/context.ts

@@ -5,7 +5,7 @@
  * calls execute, so {{signal.x}} and {{prompt.y}} an author wrote in a config field are
  * plain text by the time they reach here.
  *
- * `executionContext.auth.accessToken` — the CALLER'S JWT (AUTH_TOKEN_FLOW.md) — is
+ * `executionContext.auth.accessToken` — the CALLER'S JWT (docs/auth-security/IDENTITY.md) — is
  * DELIBERATELY WITHHELD, and must stay that way. A code node may reach it because a code
  * node is bounded by provenance; a manifest is data that can arrive by paste or database
  * row. The blast radii are not comparable: a third-party API key reaches that vendor
@@ -56,7 +56,7 @@ export function contextFor(node: ComposedNode, inputs: any, config: any, executi
     //
     // `conversationId` and `chatId` are here because the AUDIO LANE is keyed by conversation.
     // Their absence was a silent, total failure of the voice node: `runDuplexSession` fell back
-    // to the node TYPE as its key, so `setAudioDataHandler` compared the client's real session id
+    // to the node TYPE as its key, so the audio lane compared the client's real session id
     // against the string "OpenAIRealtimeVoice", dropped every microphone frame, and sent the
     // model's audio to a conversation nobody was listening on. No error anywhere — just silence.
     //