@wairon/cli 5.0.2-dev.8 → 5.1.0

package/dist/cli/index.js

@@ -65,7 +65,7 @@ var init_defaults = __esm({
       copilot: ".github/prompts",
       codex: ".codex/agents"
     };
-    WAIRON_VERSION = "5.0.2-dev.8";
+    WAIRON_VERSION = "5.1.0";
     GITHUB_REPO = "SYW-Apps/Waffle-AIron";
     ARCHITECT_AGENT_ID = "agent-architect";
     ARCHITECT_TEMPLATE_ID = "architect";
@@ -458,7 +458,7 @@ var init_domain = __esm({
 });
 
 // src/models/project.ts
-var import_zod3, BuiltinTargetConfigSchema, CustomTargetConfigSchema, TargetConfigSchema, NamingRuleConfigSchema, DocumentationRuleConfigSchema, ComplexityRuleConfigSchema, DesignDepthSchema, RulesConfigSchema, PathsConfigSchema, ProjectConfigSchema;
+var import_zod3, BuiltinTargetConfigSchema, CustomTargetConfigSchema, TargetConfigSchema, NamingRuleConfigSchema, DocumentationRuleConfigSchema, ComplexityRuleConfigSchema, DesignDepthSchema, RulesConfigSchema, PathsConfigSchema, ProfileSelectionSubjectSchema, ProjectProfileSelectionSchema, ProjectConfigSchema;
 var init_project = __esm({
   "src/models/project.ts"() {
     "use strict";
@@ -582,6 +582,24 @@ var init_project = __esm({
       /** Base directory containing SDD specification files, relative to project root */
       specsDir: import_zod3.z.string().default(".wai/specs")
     });
+    ProfileSelectionSubjectSchema = import_zod3.z.object({
+      userId: import_zod3.z.string(),
+      kind: import_zod3.z.string(),
+      issuer: import_zod3.z.string(),
+      externalSubject: import_zod3.z.string().optional(),
+      displayName: import_zod3.z.string().optional(),
+      email: import_zod3.z.string().optional()
+    });
+    ProjectProfileSelectionSchema = import_zod3.z.object({
+      /** Selected architectural profile ids. The first resolvable one is applied as projectType. */
+      profileIds: import_zod3.z.array(import_zod3.z.string()).default([]),
+      /** Pack names the governing policy requires for this project. */
+      requiredPackNames: import_zod3.z.array(import_zod3.z.string()).default([]),
+      /** Pack names applied by default unless explicitly overridden. */
+      defaultPackNames: import_zod3.z.array(import_zod3.z.string()).optional(),
+      selectedBy: ProfileSelectionSubjectSchema.optional(),
+      selectedAt: import_zod3.z.string()
+    });
     ProjectConfigSchema = import_zod3.z.object({
       /**
        * Schema version — used to detect incompatible config formats in future
@@ -622,6 +640,13 @@ var init_project = __esm({
         useGlobalPacks: import_zod3.z.boolean().default(true)
       }).optional(),
       paths: PathsConfigSchema.default({}),
+      /**
+       * The profile/pack selection a hosted policy workflow applied to this project.
+       * The RECORD of what was chosen; `projectType` above is what actually governs
+       * validation. Modeled so the parse/write round trip preserves it (see
+       * ProjectProfileSelectionSchema).
+       */
+      profileSelection: ProjectProfileSelectionSchema.optional(),
       /**
        * Path to a directory containing org/user-level default templates.
        * Resolved before built-in templates but after project-local templates.
@@ -1095,6 +1120,18 @@ var init_specs = __esm({
       // Required if type is 'call', references Method name on target interface
       capability: import_zod6.z.string().optional(),
       // Required if type is 'dispatch': the capability routed through the target Portal's dispatch table
+      /**
+       * call/dispatch only: the credential this step presents to an authed callee
+       * Portal, and WHERE it is loaded from (`from`). Two forms: an OPAQUE source
+       * (`env:API_KEY`, a config key, `vault:path`, a free note) — a design note
+       * wairon never resolves; or a MODELED reference `component:<id>` pointing at
+       * the Adapter/Store that provides the secret — validated to resolve, be an
+       * Adapter/Store, and be wired to the presenter (a checked graph edge). The
+       * actual secret is never stored here. Absence on a call into a Portal whose
+       * `auth ≠ none` warns (PORTAL_AUTH_UNMET), so credential loading is never
+       * overlooked.
+       */
+      auth: import_zod6.z.object({ from: import_zod6.z.string(), note: import_zod6.z.string().optional() }).optional(),
       assertsGuarantees: import_zod6.z.array(GuaranteeSchema).optional(),
       /**
        * Declared entity invariants this step upholds, as "<type-id>.<invariant-id>"
@@ -1902,6 +1939,47 @@ var init_loader = __esm({
   }
 });
 
+// src/core/statehash.ts
+function computeStateId() {
+  const tree = {
+    system: loadSystemSpec(),
+    subsystems: loadSubsystemSpecs(),
+    components: loadComponentSpecs(),
+    interfaces: loadInterfaceSpecs(),
+    implementations: loadImplementationSpecs(),
+    types: loadTypeSpecs()
+  };
+  const digest = crypto.createHash("sha256").update(canonicalize(tree)).digest("hex");
+  return { algorithm: "sha256", digest };
+}
+function stateIdEquals(a, b) {
+  return !!a && !!b && a.algorithm === b.algorithm && a.digest === b.digest;
+}
+function canonicalize(value) {
+  return JSON.stringify(sortKeys(value));
+}
+function sortKeys(v) {
+  if (Array.isArray(v)) return v.map(sortKeys);
+  if (v && typeof v === "object") {
+    const src = v;
+    const out = {};
+    for (const k of Object.keys(src).sort()) {
+      if (k === "createdAt" || k === "updatedAt") continue;
+      out[k] = sortKeys(src[k]);
+    }
+    return out;
+  }
+  return v;
+}
+var crypto;
+var init_statehash = __esm({
+  "src/core/statehash.ts"() {
+    "use strict";
+    crypto = __toESM(require("crypto"));
+    init_specs2();
+  }
+});
+
 // src/core/narrative-labels.ts
 function resolveNarrativeLabels(methodName, steps) {
   const errors = [];
@@ -2987,6 +3065,16 @@ header input[type="search"]::placeholder { color:var(--dim); }
 #moreMenu .dropdown { display:block; width:100%; }
 #moreMenu .dropdown > .tbtn, #moreMenu > .tbtn { display:block; width:100%; text-align:left; border:none; background:transparent; margin:2px 0; }
 #moreMenu .dropdown > .tbtn:hover, #moreMenu > .tbtn:hover { background:var(--hover-bg); }
+/* Staged header compaction (responsive only, never persisted): compact
+   stand-ins for the search input, the mode tabs, and the ancestor crumbs.
+   All hidden at full width, so a roomy header renders exactly as before. */
+#searchBtn { position:relative; }
+#searchBtn.hasq::after { content:''; position:absolute; top:3px; right:3px; width:7px; height:7px; border-radius:50%; background:var(--accent); }
+.search-menu { min-width:210px; padding:8px; }
+.search-menu input[type="search"] { width:100%; }
+#modeMenu button.active { background:var(--accent); color:#fff; font-weight:700; }
+#crumbs .dropdown { display:inline-flex; }
+#crumbs .crumbmore { font-weight:700; }
 
 /* Settings panel \u2014 toggle switches */
 .settings-menu { min-width:266px; }
@@ -3110,9 +3198,17 @@ body.presentation #exitPresent, body.presentation #presentDetails { display:bloc
     <button data-vm="types">Types</button>
     <button data-vm="databases">Databases</button>
   </div>
+  <div class="dropdown" id="modeDd" style="display:none">
+    <button class="tbtn" id="modeBtn" title="Switch between the component architecture, the type ERD, or the database schemas">Components \u25BE</button>
+    <div class="menu" id="modeMenu"></div>
+  </div>
   <nav id="crumbs"></nav>
   <span class="divider"></span>
   <input id="search" type="search" placeholder="Search this view\u2026">
+  <div class="dropdown" id="searchDd" style="display:none">
+    <button class="tbtn" id="searchBtn" title="Search this view">\u{1F50D}</button>
+    <div class="menu search-menu" id="searchMenu"></div>
+  </div>
   <div class="seg" id="typesDetailSeg" style="display:none" title="ERD detail level">
     <button data-td="full">Full</button>
     <button data-td="fields">Fields</button>
@@ -3629,13 +3725,300 @@ var MODEL = __MODEL_JSON__;
   var BOX_W = 200, BOX_H = 56, SUBBOX_W = 230, SUBBOX_H = 84, GAP_X = 110, GAP_Y = 34;
   var INNER_W = 130, INNER_H = 36, INNER_GAPX = 26, INNER_GAPY = 12, HEAD_H = 34, PADI = 14;
 
+  // ---- deep expansion (opt-in via subsystem.deepInternals) -------------------
+  // When Internals is on and a subsystem record carries deepInternals:true, its
+  // box renders its WHOLE subtree instead of one layer: deep-flagged child
+  // subsystems become NESTED boundary boxes (recursing, defensively capped),
+  // every other child renders as a fixed leaf tile that is never expanded
+  // further. Sizes are computed bottom-up (a nested container tile takes its
+  // recursive {w,h}); positions are emitted top-down by accumulating parent
+  // top-left offsets. Relations between concrete visible endpoints are drawn
+  // as ONE direct line each by buildDeepContext \u2014 crossing nested boundaries
+  // on purpose (the full org overview of project relations); only relations
+  // that cannot resolve to two concrete endpoints keep today's port machinery,
+  // and ONLY at the outermost box. Without the flag this whole path is inert
+  // and the classic one-layer innerLayout runs unchanged.
+  var DEEP_MAX_DEPTH = 6;
+  function isDeepId(subId) {
+    var s = subById[subId];
+    return !!(s && s.deepInternals);
+  }
+  // The DEEPEST visible tile representing compId inside the deep-expanded box
+  // rooted at rootSubId: descend deep-flagged containers (the same expansion
+  // rule as deepContainerLayout) until the containing child is a leaf tile.
+  // Returns the child entry { kind, id } (its node id is IN(kind, id)).
+  function deepLeafFor(compId, rootSubId) {
+    var subId = rootSubId, depth = 1;
+    for (;;) {
+      var child = childOfScopeContaining(compId, { kind: 'subsystem', id: subId });
+      if (!child) return null;
+      if (child.kind === 'subsystem' && isDeepId(child.id) && depth < DEEP_MAX_DEPTH) {
+        subId = child.id; depth += 1;
+        continue;
+      }
+      return child;
+    }
+  }
+  // One deep container's DIRECT children, placed with PER-TILE sizes (nested
+  // containers take their recursive size; leaves stay INNER_W x INNER_H). The
+  // placement mirrors innerLayout's strategy switch, generalised to variable
+  // tile sizes. Tiles are centres relative to THIS container's top-left corner
+  // (content sits right of PADI, below the HEAD_H label band); nested tiles
+  // are relative to their own container, so emission accumulates offsets.
+  function deepContainerLayout(subId, depth) {
+    var kids = childrenOf({ kind: 'subsystem', id: subId });
+    if (!kids.length) {
+      // An EMPTY deep subsystem still shows as a (min-size) boundary box.
+      return { tiles: [], w: INNER_W + 2 * PADI, h: HEAD_H + PADI };
+    }
+    var scope = { kind: 'subsystem', id: subId };
+    var kidKey = function (k) { return k.kind + ':' + k.id; };
+    var size = {};
+    kids.forEach(function (k) {
+      if (k.kind === 'subsystem' && isDeepId(k.id) && depth < DEEP_MAX_DEPTH) {
+        var nested = deepContainerLayout(k.id, depth + 1);
+        size[kidKey(k)] = { w: nested.w, h: nested.h, sub: nested };
+      } else {
+        size[kidKey(k)] = { w: INNER_W, h: INNER_H, sub: null };
+      }
+    });
+    // Intra-container edges lifted to DIRECT children \u2014 for LAYOUT ONLY (the
+    // drawn lines come from buildDeepContext's direct pass, never per level).
+    var intra = {};
+    MODEL.edges.forEach(function (edge) {
+      var a = childOfScopeContaining(edge.from, scope);
+      var b = childOfScopeContaining(edge.to, scope);
+      if (!a || !b) return;
+      var ak = a.kind + ':' + a.id, bk = b.kind + ':' + b.id;
+      if (!size[ak] || !size[bk] || ak === bk) return;
+      intra[ak + '=>' + bk] = 1;
+    });
+    var layer = {};
+    function calc(k, stack) {
+      var key = kidKey(k);
+      if (layer[key] !== undefined) return layer[key];
+      if (stack[key]) return 0;
+      stack[key] = 1;
+      var l = 0;
+      if (k.kind === 'component') {
+        var c = compById[k.id];
+        if (c && (c.componentType === 'Portal' || c.componentType === 'Observer')) { layer[key] = 0; delete stack[key]; return 0; }
+      }
+      Object.keys(intra).forEach(function (ek) {
+        var cut = ek.indexOf('=>');
+        if (ek.slice(cut + 2) !== key) return;
+        var srcKid = kids.filter(function (x) { return kidKey(x) === ek.slice(0, cut); })[0];
+        if (srcKid) l = Math.max(l, calc(srcKid, stack) + 1);
+      });
+      delete stack[key];
+      layer[key] = l;
+      return l;
+    }
+    kids.forEach(function (k) { calc(k, {}); });
+    var tiles = [], contentW = 0, contentH = 0;
+    if (state.layout === 'grid') {
+      // Row packing by ACTUAL tile size (the fixed per-column grid assumed
+      // uniform tiles); the target row width follows the tile count, widened
+      // to at least the widest single tile.
+      var gsorted = kids.slice().sort(function (a, b) { return a.id < b.id ? -1 : 1; });
+      var target = Math.max(1, Math.ceil(Math.sqrt(kids.length))) * (INNER_W + INNER_GAPX);
+      kids.forEach(function (k) { var s0 = size[kidKey(k)]; if (s0.w > target) target = s0.w; });
+      var gx = 0, gy = 0, rowH = 0;
+      gsorted.forEach(function (k) {
+        var s = size[kidKey(k)];
+        if (gx > 0 && gx + s.w > target) { gx = 0; gy += rowH + INNER_GAPY; rowH = 0; }
+        tiles.push({ kid: k, x: gx + s.w / 2, y: gy + s.h / 2, w: s.w, h: s.h, sub: s.sub });
+        gx += s.w + INNER_GAPX;
+        if (s.h > rowH) rowH = s.h;
+        if (gx - INNER_GAPX > contentW) contentW = gx - INNER_GAPX;
+        if (gy + rowH > contentH) contentH = gy + rowH;
+      });
+    } else if (state.layout === 'concentric' || state.layout === 'force') {
+      var ideg = {};
+      kids.forEach(function (k) { ideg[kidKey(k)] = 0; });
+      Object.keys(intra).forEach(function (ek) {
+        var cut2 = ek.indexOf('=>');
+        var sk = ek.slice(0, cut2), tk = ek.slice(cut2 + 2);
+        if (ideg[sk] !== undefined) ideg[sk]++;
+        if (ideg[tk] !== undefined) ideg[tk]++;
+      });
+      var rel = concentricPositions(
+        kids.map(kidKey),
+        function (key) { return ideg[key] || 0; },
+        function (key) { return { w: size[key].w, h: size[key].h }; }
+      );
+      // Normalise by the tiles' BOUNDING BOX (not just the centres) so a wide
+      // nested container on the rim still clears the container's left/top pad.
+      var minL = Infinity, minT = Infinity;
+      kids.forEach(function (k) {
+        var s1 = size[kidKey(k)], p1 = rel[kidKey(k)] || { x: 0, y: 0 };
+        if (p1.x - s1.w / 2 < minL) minL = p1.x - s1.w / 2;
+        if (p1.y - s1.h / 2 < minT) minT = p1.y - s1.h / 2;
+      });
+      if (minL === Infinity) { minL = 0; minT = 0; }
+      kids.forEach(function (k) {
+        var s2 = size[kidKey(k)], p2 = rel[kidKey(k)] || { x: 0, y: 0 };
+        var cx = p2.x - minL, cyy = p2.y - minT;
+        tiles.push({ kid: k, x: cx, y: cyy, w: s2.w, h: s2.h, sub: s2.sub });
+        if (cx + s2.w / 2 > contentW) contentW = cx + s2.w / 2;
+        if (cyy + s2.h / 2 > contentH) contentH = cyy + s2.h / 2;
+      });
+    } else {
+      // Layered dependency columns: the column is as wide as its widest tile,
+      // and each tile advances by ITS OWN height.
+      var cols = {};
+      kids.forEach(function (k) { var l = layer[kidKey(k)] || 0; (cols[l] = cols[l] || []).push(k); });
+      var colKeys = Object.keys(cols).map(Number).sort(function (a, b) { return a - b; });
+      var x = 0;
+      colKeys.forEach(function (ck) {
+        var col = cols[ck].sort(function (a, b) { return a.id < b.id ? -1 : 1; });
+        var colW = 0, y = 0;
+        col.forEach(function (k) { var s3 = size[kidKey(k)]; if (s3.w > colW) colW = s3.w; });
+        col.forEach(function (k) {
+          var s = size[kidKey(k)];
+          tiles.push({ kid: k, x: x + colW / 2, y: y + s.h / 2, w: s.w, h: s.h, sub: s.sub });
+          y += s.h + INNER_GAPY;
+        });
+        if (y - INNER_GAPY > contentH) contentH = y - INNER_GAPY;
+        x += colW + INNER_GAPX;
+      });
+      contentW = x - INNER_GAPX;
+    }
+    tiles.forEach(function (t) { t.x += PADI; t.y += HEAD_H; });
+    return { tiles: tiles, w: contentW + 2 * PADI, h: HEAD_H + contentH + PADI };
+  }
+  // Top-level deep box: the recursive interior plus today's port machinery at
+  // the OUTERMOST box only (buildDeepContext supplies which relations still
+  // need ports; stubs run port <-> the DEEPEST visible leaf tile). Returns the
+  // same shape as innerLayout, plus deep:true so emission recurses.
+  function deepLayout(entry, portRec) {
+    var box = deepContainerLayout(entry.id, 1);
+    var parentId = anchorNodeId(entry);
+    var pBaseIn = 'p~in~' + parentId + '~', pBaseOut = 'p~out~' + parentId + '~';
+    var extIn = portRec ? portRec.extIn : {}, extOut = portRec ? portRec.extOut : {};
+    var inIds = Object.keys(extIn).sort(), outIds = Object.keys(extOut).sort();
+    var hasIn = inIds.length > 0, hasOut = outIds.length > 0;
+    var PROXY_W = 22, PROXY_H = 22, PROXY_GAP = 8;
+    var shift = hasIn ? PROXY_W + INNER_GAPX : 0;
+    var tiles = box.tiles;
+    if (shift) tiles.forEach(function (t) { t.x += shift; });
+    var w = box.w + shift + (hasOut ? PROXY_W + INNER_GAPX : 0);
+    if (w < SUBBOX_W) w = SUBBOX_W;
+    var stackMax = Math.max(inIds.length, outIds.length);
+    var h = Math.max(box.h, HEAD_H + stackMax * PROXY_H + Math.max(0, stackMax - 1) * PROXY_GAP + PADI);
+    var midY = HEAD_H + Math.max(0, (h - HEAD_H - PADI) / 2);
+    function stackPorts(ids, recs, base, cx, dir) {
+      var total = ids.length * PROXY_H + Math.max(0, ids.length - 1) * PROXY_GAP;
+      var y0 = Math.max(HEAD_H + PROXY_H / 2, midY - total / 2 + PROXY_H / 2);
+      return ids.map(function (eid, i) {
+        var km = recs[eid].kids, klist = [];
+        Object.keys(km).forEach(function (key) { klist.push(km[key]); });
+        return { id: base + eid, extId: eid, dir: dir, kids: klist, raws: Object.keys(recs[eid].raws), x: cx, y: y0 + i * (PROXY_H + PROXY_GAP), w: PROXY_W, h: PROXY_H };
+      });
+    }
+    return {
+      deep: true,
+      tiles: tiles,
+      edges: portRec ? Object.keys(portRec.stubs).map(function (k) { return portRec.stubs[k]; }) : [],
+      proxies: stackPorts(inIds, extIn, pBaseIn, PADI + PROXY_W / 2, 'in')
+        .concat(stackPorts(outIds, extOut, pBaseOut, w - PADI - PROXY_W / 2, 'out')),
+      w: w,
+      h: h,
+    };
+  }
+  // View-level deep context (null unless Internals is on AND at least one
+  // in-view entry is deep-flagged \u2014 the classic path never sees it): which
+  // top-level entries are deep-expanded; every relation drawn as a DIRECT
+  // concrete line (deduped per src=>tgt pair); the per-top-pair count used to
+  // suppress aggregated edges whose constituents are ALL drawn directly; and
+  // the port records for relations that keep today's port semantics.
+  function buildDeepContext(scope, entries) {
+    if (!state.internals) return null;
+    var deepByAnchor = {}, any = false;
+    entries.forEach(function (e) {
+      if (e.kind === 'subsystem' && isDeepId(e.id)) { deepByAnchor[anchorNodeId(e)] = e; any = true; }
+    });
+    if (!any) return null;
+    var entryByAnchor = {};
+    entries.forEach(function (e) { entryByAnchor[e.kind + ':' + e.id] = e; });
+    // A relation endpoint's DIRECT-line node in this view: the deepest leaf
+    // tile inside a deep-expanded entry, or a top-level component box ITSELF.
+    // null = this endpoint keeps aggregated/port semantics (interiors of
+    // non-deep entries, out-of-scope counterparts).
+    function directEnd(compId) {
+      var child = childOfScopeContaining(compId, scope);
+      var entry = child && entryByAnchor[child.kind + ':' + child.id];
+      if (!entry) return null;
+      var aid = anchorNodeId(entry);
+      if (deepByAnchor[aid]) {
+        var leaf = deepLeafFor(compId, entry.id);
+        return leaf ? { node: IN(leaf.kind, leaf.id), top: aid, deep: true } : null;
+      }
+      if (entry.kind === 'component' && entry.id === compId) return { node: aid, top: aid, deep: false };
+      return null;
+    }
+    var direct = {}, directTopCount = {}, ports = {};
+    function portRec(aid) { return ports[aid] = ports[aid] || { extIn: {}, extOut: {}, stubs: {} }; }
+    MODEL.edges.forEach(function (edge) {
+      var a = directEnd(edge.from), b = directEnd(edge.to);
+      if (a && b && (a.deep || b.deep) && a.node !== b.node) {
+        // Drawn as ONE direct line \u2014 never ALSO as ports/stubs (dedupe rule).
+        var key = a.node + '=>' + b.node;
+        if (!direct[key]) direct[key] = { src: a.node, tgt: b.node, cross: false, aTop: a.top, bTop: b.top };
+        if (edge.cross) direct[key].cross = true;
+        if (a.top !== b.top) {
+          var tk = a.top + '=>' + b.top;
+          directTopCount[tk] = (directTopCount[tk] || 0) + 1;
+        }
+        return;
+      }
+      // Not a direct line: keep today's port semantics on any deep box with
+      // exactly one endpoint inside its subtree, stubbed to the deepest leaf.
+      var ac = childOfScopeContaining(edge.from, scope);
+      var bc = childOfScopeContaining(edge.to, scope);
+      var aEnt = ac && entryByAnchor[ac.kind + ':' + ac.id];
+      var bEnt = bc && entryByAnchor[bc.kind + ':' + bc.id];
+      var aAid = aEnt ? anchorNodeId(aEnt) : null;
+      var bAid = bEnt ? anchorNodeId(bEnt) : null;
+      if (aAid === bAid) return; // internal to one entry, or neither in scope
+      if (aAid && deepByAnchor[aAid]) {
+        var leafA = deepLeafFor(edge.from, aEnt.id);
+        if (leafA) {
+          var recA = portRec(aAid);
+          var ro = recA.extOut[edge.to] = recA.extOut[edge.to] || { kids: {}, raws: {} };
+          ro.kids[leafA.kind + ':' + leafA.id] = leafA;
+          ro.raws[edge.from] = 1;
+          var poId = 'p~out~' + aAid + '~' + edge.to;
+          recA.stubs[IN(leafA.kind, leafA.id) + '=>' + poId] = { src: IN(leafA.kind, leafA.id), tgt: poId, stub: true };
+        }
+      }
+      if (bAid && deepByAnchor[bAid]) {
+        var leafB = deepLeafFor(edge.to, bEnt.id);
+        if (leafB) {
+          var recB = portRec(bAid);
+          var ri = recB.extIn[edge.from] = recB.extIn[edge.from] || { kids: {}, raws: {} };
+          ri.kids[leafB.kind + ':' + leafB.id] = leafB;
+          ri.raws[edge.to] = 1;
+          var piId = 'p~in~' + bAid + '~' + edge.from;
+          recB.stubs[piId + '=>' + IN(leafB.kind, leafB.id)] = { src: piId, tgt: IN(leafB.kind, leafB.id), stub: true };
+        }
+      }
+    });
+    return { deepByAnchor: deepByAnchor, direct: direct, directTopCount: directTopCount, ports: ports };
+  }
+
   // Micro-layout for a container's direct children when Internals is on:
   // layered mini columns + intra-container edges. Each external relation gets
   // its own small PORT node INSIDE the container (one per external
   // counterpart; incoming left, outgoing right). Children connect to ports
   // with short edges that never leave the box \u2014 the real cross-boundary line
   // is only revealed on hover, or pinned while the port is selected.
-  function innerLayout(entry) {
+  function innerLayout(entry, deepCtx) {
+    // Deep-flagged subsystems take the recursive path (deepCtx exists only
+    // when Internals is on and the view has deep entries \u2014 see buildElements).
+    if (deepCtx && entry.kind === 'subsystem' && deepCtx.deepByAnchor[anchorNodeId(entry)]) {
+      return deepLayout(entry, deepCtx.ports[anchorNodeId(entry)]);
+    }
     var kids = state.internals && entry.hasKids ? childrenOf({ kind: entry.kind, id: entry.id }) : [];
     if (!kids.length) return null;
     var scope = { kind: entry.kind, id: entry.id };
@@ -4207,12 +4590,42 @@ var MODEL = __MODEL_JSON__;
     if (scope.kind === 'types' || scope.kind === 'databases') return buildTypeElements();
     var entries = childrenOf(scope);
     var eles = [];
+    var deepCtx = buildDeepContext(scope, entries);
     var ve = viewEdges(scope, entries);
     // Data-coupling overlay: same scoping pipeline, a different edge source.
     var vd = state.dataCoupling ? viewEdges(scope, entries, MODEL.dataEdges) : { agg: {}, ghosts: {} };
     Object.keys(vd.ghosts).forEach(function (g) { if (!ve.ghosts[g]) ve.ghosts[g] = vd.ghosts[g]; });
     var inners = {};
-    entries.forEach(function (e) { inners[anchorNodeId(e)] = innerLayout(e); });
+    entries.forEach(function (e) { inners[anchorNodeId(e)] = innerLayout(e, deepCtx); });
+
+    // Deep-mode recursive tile emission: a nested container becomes a cytoscape
+    // compound parent (no explicit position \u2014 a compound derives its bounds
+    // from its children); leaves and EMPTY containers are plain positioned
+    // nodes. ox/oy = the emitting container's absolute top-left; tile.x/y are
+    // centres relative to it, so offsets accumulate top-down. Search dimming
+    // propagates the TOP entry's dim to the whole subtree.
+    function emitDeepTiles(tiles, parentNodeId, ox, oy, dimCls) {
+      tiles.forEach(function (tile) {
+        var ax = ox + tile.x, ay = oy + tile.y;
+        if (tile.sub) {
+          var nid = SN(tile.kid.id);
+          var selCls = state.selectedKind === 'subsystem' && state.selected === tile.kid.id ? ' sel' : '';
+          var nested = {
+            data: { id: nid, parent: parentNodeId, label: nameOf(tile.kid), w: tile.w, h: tile.h, tw: tile.w - 16 },
+            classes: 'subsysBox' + (tile.sub.tiles.length ? ' drillable' : '') + dimCls + selCls,
+          };
+          if (!tile.sub.tiles.length) nested.position = { x: ax, y: ay };
+          eles.push(nested);
+          emitDeepTiles(tile.sub.tiles, nid, ax - tile.w / 2, ay - tile.h / 2, dimCls);
+        } else {
+          eles.push({
+            data: { id: IN(tile.kid.kind, tile.kid.id), parent: parentNodeId, label: nameOf(tile.kid), w: INNER_W, h: INNER_H, tw: INNER_W - 10 },
+            position: { x: ax, y: ay },
+            classes: 'inner' + dimCls,
+          });
+        }
+      });
+    }
 
     // Resolve a port's reveal target(s) in THIS view. Preference order: the
     // MATCHING PORT inside the counterpart's container (a port-to-port line
@@ -4344,17 +4757,25 @@ var MODEL = __MODEL_JSON__;
         + (state.showIssues && issuesBySpec[e.id] ? ' hasIssue' : '')
         + (state.selectedKind === e.kind && state.selected === e.id ? ' sel' : '');
       if (inner) {
-        eles.push({ data: { id: aid, label: e.kind === 'subsystem' ? nameOf(e) : nameOf(e), w: p.w, h: p.h, tw: p.w - 16 }, classes: classes });
-        inner.tiles.forEach(function (tile) {
-          eles.push({
-            data: {
-              id: IN(tile.kid.kind, tile.kid.id), parent: aid,
-              label: nameOf(tile.kid), w: INNER_W, h: INNER_H, tw: INNER_W - 10,
-            },
-            position: { x: p.x - p.w / 2 + tile.x, y: p.y - p.h / 2 + tile.y },
-            classes: 'inner' + (dim ? ' dimmed' : ''),
+        var boxNode = { data: { id: aid, label: e.kind === 'subsystem' ? nameOf(e) : nameOf(e), w: p.w, h: p.h, tw: p.w - 16 }, classes: classes };
+        // An EMPTY deep boundary box has no children, so it is NOT a compound
+        // parent \u2014 it needs (and honours) an explicit position and size.
+        if (inner.deep && !inner.tiles.length && !(inner.proxies && inner.proxies.length)) boxNode.position = { x: p.x, y: p.y };
+        eles.push(boxNode);
+        if (inner.deep) {
+          emitDeepTiles(inner.tiles, aid, p.x - p.w / 2, p.y - p.h / 2, dim ? ' dimmed' : '');
+        } else {
+          inner.tiles.forEach(function (tile) {
+            eles.push({
+              data: {
+                id: IN(tile.kid.kind, tile.kid.id), parent: aid,
+                label: nameOf(tile.kid), w: INNER_W, h: INNER_H, tw: INNER_W - 10,
+              },
+              position: { x: p.x - p.w / 2 + tile.x, y: p.y - p.h / 2 + tile.y },
+              classes: 'inner' + (dim ? ' dimmed' : ''),
+            });
           });
-        });
+        }
         (inner.proxies || []).forEach(function (px) {
           eles.push({
             data: {
@@ -4507,9 +4928,28 @@ var MODEL = __MODEL_JSON__;
 
     var dimmedAnchors = {};
     entries.forEach(function (e) { if (state.query && !matches(e)) dimmedAnchors[anchorNodeId(e)] = true; });
+
+    // Deep mode: ONE direct line per related pair of concrete visible nodes \u2014
+    // leaf tiles at any depth and/or top-level component boxes (deduped by
+    // buildDeepContext). These lines cross nested boundaries on purpose.
+    if (deepCtx) {
+      var ddi = 0;
+      Object.keys(deepCtx.direct).sort().forEach(function (key) {
+        var d = deepCtx.direct[key];
+        var ddim = state.query && (dimmedAnchors[d.aTop] || dimmedAnchors[d.bTop]);
+        eles.push({
+          data: { id: 'dd' + (ddi++), source: d.src, target: d.tgt, lbl: '' },
+          classes: 'inneredge' + (d.cross ? ' cross' : '') + (ddim ? ' dimmed' : ''),
+        });
+      });
+    }
+
     var i = 0;
     Object.keys(ve.agg).forEach(function (key) {
       var e = ve.agg[key];
+      // Prefer the leaf lines: drop an aggregated container edge whose
+      // constituent relations were ALL drawn as direct deep lines above.
+      if (deepCtx && deepCtx.directTopCount[key] >= e.n) return;
       var bundle = e.n > 1;
       var dim = state.query && (dimmedAnchors[e.src] || dimmedAnchors[e.tgt]);
       var route = routeData(e.src, e.tgt, key);
@@ -4768,22 +5208,58 @@ var MODEL = __MODEL_JSON__;
     }
     return path;
   }
+  // Crumb compaction (compaction stage 5) is a RENDER MODE, not marker-based
+  // reparenting: renderCrumbs rebuilds #crumbs' innerHTML on every navigation,
+  // so nodes physically moved elsewhere would be destroyed by the next render.
+  // The header-compaction stage toggles crumbsCompact and re-renders; compact
+  // keeps the CURRENT scope visible and folds the ancestors into an ordered
+  // "\\u2026" dropdown (document order, root first) whose entries navigate
+  // exactly like the crumbs they replace.
+  var crumbsCompact = false;
+  var lastCrumbsHtml; // no initializer: the boot render at cy-init time precedes this line
+  // Set by the header-compaction IIFE: crumb re-renders change the header's
+  // CONTENT width without resizing #hdr itself (it is edge-anchored), so the
+  // ResizeObserver never fires for them \u2014 renderCrumbs nudges a reflow here.
+  var headerReflowHook = null;
+  function crumbBtnHtml(p, cur) {
+    return '<button class="crumb' + (cur ? ' cur' : '') + '" data-ck="' + p.kind + '" data-ci="' + (p.id || '') + '">' + p.label + '</button>';
+  }
   function renderCrumbs() {
     var el = document.getElementById('crumbs');
     var path = crumbPath();
-    el.innerHTML = path.map(function (p, i) {
-      var cur = i === path.length - 1;
-      return '<button class="crumb' + (cur ? ' cur' : '') + '" data-ck="' + p.kind + '" data-ci="' + (p.id || '') + '">' + p.label + '</button>'
-        + (cur ? '' : '<span class="sep">\\u203A</span>');
-    }).join('');
+    var html;
+    if (crumbsCompact && path.length > 1) {
+      html = '<span class="dropdown" id="crumbDd">'
+        + '<button class="crumb crumbmore" id="crumbMoreBtn" title="Show the collapsed ancestor path">\\u2026</button>'
+        + '<span class="menu" id="crumbMenu">'
+        + path.slice(0, path.length - 1).map(function (p) {
+          return '<button data-ck="' + p.kind + '" data-ci="' + (p.id || '') + '">' + p.label + '</button>';
+        }).join('')
+        + '</span></span>'
+        + '<span class="sep">\\u203A</span>'
+        + crumbBtnHtml(path[path.length - 1], true);
+    } else {
+      html = path.map(function (p, i) {
+        var cur = i === path.length - 1;
+        return crumbBtnHtml(p, cur) + (cur ? '' : '<span class="sep">\\u203A</span>');
+      }).join('');
+    }
+    // No-op renders keep the already-wired nodes (and an open "\\u2026" menu)
+    // intact \u2014 and don't churn the reflow scheduler while a search query types.
+    if (html === lastCrumbsHtml) return;
+    lastCrumbsHtml = html;
+    el.innerHTML = html;
     var btns = el.querySelectorAll('button');
     for (var i = 0; i < btns.length; i++) {
       (function (b) {
+        if (!b.getAttribute('data-ck')) return; // the "\\u2026" trigger toggles, never navigates
         b.addEventListener('click', function () {
           navigateTo(b.getAttribute('data-ck'), b.getAttribute('data-ci') || null);
         });
       })(btns[i]);
     }
+    if (crumbsCompact && path.length > 1) wireDropdown('crumbDd', 'crumbMoreBtn');
+    if (headerReflowHook) headerReflowHook();
   }
   function renderViewHint() {
     if (state.view.kind === 'types' || state.view.kind === 'databases') {
@@ -5050,7 +5526,16 @@ var MODEL = __MODEL_JSON__;
     return c ? { kind: 'subsystem', id: c.subsystem } : { kind: 'system', id: null };
   }
 
-  document.getElementById('search').addEventListener('input', function (ev) { state.query = ev.target.value.trim(); rebuild(false); });
+  // While the search input is compacted behind the magnifier icon (compaction
+  // stage 3), a non-empty query must stay discoverable \u2014 mark the icon with an
+  // accent dot. The class is kept in sync on every query edit; the dot is only
+  // ever visible while the compact icon itself is.
+  function updateSearchBadge() {
+    var b = document.getElementById('searchBtn');
+    if (b && b.classList) b.classList[state.query ? 'add' : 'remove']('hasq');
+  }
+  document.getElementById('search').addEventListener('input', function (ev) { state.query = ev.target.value.trim(); updateSearchBadge(); rebuild(false); });
+  updateSearchBadge();
   // Sync each View toggle's checkbox from the (possibly persisted) state, then
   // persist on change so the choices survive a refresh (see persist()/saved).
   document.getElementById('internalsToggle').checked = state.internals;
@@ -5104,9 +5589,24 @@ var MODEL = __MODEL_JSON__;
       })(btns[i]);
     }
   })();
+  // Compaction stage 4 replaces the mode tabs with one dropdown trigger; its
+  // label must follow the CURRENT mode. updateHeaderSegs runs on every rebuild,
+  // so a mode change made while compact re-labels the trigger immediately.
+  function updateModeBtn() {
+    var b = document.getElementById('modeBtn');
+    if (!b) return;
+    var lbl = state.view.kind === 'types' ? 'Types' : state.view.kind === 'databases' ? 'Databases' : 'Components';
+    b.textContent = lbl + ' \\u25BE';
+  }
   function updateHeaderSegs() {
     var seg = document.getElementById('modeSeg');
     var btns = seg.querySelectorAll('button');
+    if (!btns.length) {
+      // Compaction stage 4 moved the real tab buttons into the mode dropdown \u2014
+      // keep driving THEIR active classes there (they move back node-identical).
+      var mm = document.getElementById('modeMenu');
+      if (mm && mm.querySelectorAll) btns = mm.querySelectorAll('button');
+    }
     for (var i = 0; i < btns.length; i++) {
       var vm = btns[i].getAttribute('data-vm');
       var active = vm === 'components'
@@ -5114,6 +5614,7 @@ var MODEL = __MODEL_JSON__;
         : vm === state.view.kind;
       if (btns[i].classList) btns[i].classList[active ? 'add' : 'remove']('active');
     }
+    updateModeBtn();
     var td = document.getElementById('typesDetailSeg');
     td.style.display = (state.view.kind === 'types' || state.view.kind === 'databases') ? '' : 'none';
     var tbs = td.querySelectorAll('button');
@@ -5177,7 +5678,13 @@ var MODEL = __MODEL_JSON__;
     var r = btn.getBoundingClientRect();
     menu.style.top = (r.bottom + 6) + 'px';
     menu.style.left = 'auto';
-    menu.style.right = Math.max(6, window.innerWidth - r.right) + 'px';
+    // Right-aligned to the trigger, but never pushed off the LEFT edge \u2014 the
+    // compact search / crumb triggers (header compaction) sit on the header's
+    // left side, where a 200px menu right-aligned to a narrow button would clip.
+    var right = Math.max(6, window.innerWidth - r.right);
+    var mw = menu.getBoundingClientRect ? menu.getBoundingClientRect().width : 0;
+    if (mw && window.innerWidth - right - mw < 6) right = Math.max(6, window.innerWidth - mw - 6);
+    menu.style.right = right + 'px';
   }
   function wireDropdown(ddId, btnId) {
     var dd = document.getElementById(ddId);
@@ -5196,11 +5703,29 @@ var MODEL = __MODEL_JSON__;
   var ldd = wireDropdown('layoutDd', 'layoutBtn');
   var sdd = wireDropdown('settingsDd', 'settingsBtn');
   var mdd = wireDropdown('moreDd', 'moreBtn');
+  // Compact stand-ins (header compaction stages 3-4): the search panel and the
+  // mode-tab dropdown are ordinary dropdowns; their triggers stay hidden until
+  // their compaction stage shows them, so wiring them here is inert at full width.
+  var qdd = wireDropdown('searchDd', 'searchBtn');
+  var vdd = wireDropdown('modeDd', 'modeBtn');
+  // Opening the compact search panel focuses the REAL input (stage 3 moves the
+  // node, never clones it, so its input listener keeps driving state.query).
+  // Registered after wireDropdown's toggle, so 'open' reflects the new state.
+  document.getElementById('searchBtn').addEventListener('click', function () {
+    if (String(qdd.className || '').indexOf('open') >= 0) {
+      var inp = document.getElementById('search');
+      if (inp && inp.focus) inp.focus();
+    }
+  });
   // Keep the settings panel open while flipping switches (clicks inside it don't
   // bubble to the document-level close handler).
   (function () {
     var m = document.getElementById('settingsMenu');
     if (m && m.addEventListener) m.addEventListener('click', function (ev) { if (ev && ev.stopPropagation) ev.stopPropagation(); });
+    // Same for the floating search panel: clicking into the input must not
+    // bubble to the document-level close handler and shut the panel mid-typing.
+    var sm = document.getElementById('searchMenu');
+    if (sm && sm.addEventListener) sm.addEventListener('click', function (ev) { if (ev && ev.stopPropagation) ev.stopPropagation(); });
   })();
 
   // Layout picker: choose the auto-layout algorithm. Components use cytoscape's
@@ -5224,6 +5749,12 @@ var MODEL = __MODEL_JSON__;
   });
   updateLayoutBtn();
 
+  // The compact crumb dropdown (compaction stage 5) is re-created by every
+  // compact crumb render, so it is looked up per close instead of captured.
+  function closeCrumbDd() {
+    var cdd = document.getElementById('crumbDd');
+    if (cdd && cdd.classList) cdd.classList.remove('open');
+  }
   if (document.addEventListener) {
     document.addEventListener('click', function () {
       if (dd.classList) dd.classList.remove('open');
@@ -5231,6 +5762,9 @@ var MODEL = __MODEL_JSON__;
       if (ldd.classList) ldd.classList.remove('open');
       if (sdd.classList) sdd.classList.remove('open');
       if (mdd && mdd.classList) mdd.classList.remove('open');
+      if (qdd && qdd.classList) qdd.classList.remove('open');
+      if (vdd && vdd.classList) vdd.classList.remove('open');
+      closeCrumbDd();
     });
     document.addEventListener('keydown', function (ev) {
       if (ev.key === 'Escape') {
@@ -5238,16 +5772,27 @@ var MODEL = __MODEL_JSON__;
         if (modal.classList && String(modal.className).indexOf('open') >= 0) { closeFlow(); return; }
         setPresentation(false);
         if (dd.classList) dd.classList.remove('open');
+        if (qdd && qdd.classList) qdd.classList.remove('open');
+        if (vdd && vdd.classList) vdd.classList.remove('open');
+        closeCrumbDd();
       }
     });
   }
 
-  // \u2500\u2500 Responsive header overflow \u2192 "\u22EF" dropdown \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
-  // When the floating header no longer fits its controls, trailing items
-  // COLLAPSE into the More menu instead of relying on horizontal scroll \u2014
-  // every control stays one click away. Whole items move (listeners survive
-  // reparenting); a hidden placeholder pins each item's original position so
-  // restoring keeps the exact order. Collapse order = least-used first.
+  // \u2500\u2500 Responsive header compaction \u2192 ordered stages \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+  // When the floating header no longer fits its controls, standard reusable
+  // COMPACTION BEHAVIORS apply progressively \u2014 each stage only while the row
+  // still overflows \u2014 and restore in REVERSE order when space returns:
+  //   1. trailing buttons fold into the "\u22EF" menu (least-used first, one by one)
+  //   2. the View dropdown folds in after them
+  //   3. the search input compacts to a \u{1F50D} icon + floating panel
+  //   4. the mode tabs compact to one current-mode dropdown
+  //   5. ancestor crumbs compact into an ordered "\u2026" dropdown
+  // Stages 1-2 move whole items (listeners survive reparenting) with a hidden
+  // placeholder pinning each item's original spot for restore; stage 5 is a
+  // render mode (renderCrumbs rebuilds its innerHTML, so reparenting would not
+  // survive navigation). Nothing here is persisted \u2014 compaction is purely
+  // responsive to the available width.
   (function () {
     if (typeof window === 'undefined') return;
     var hdr = document.getElementById('hdr');
@@ -5275,7 +5820,122 @@ var MODEL = __MODEL_JSON__;
       }
       return markers[id];
     }
-    var collapsed = [];
+    // Fold stage (the classic behavior): move items into the "\u22EF" menu ONE per
+    // apply() call \u2014 the reflow loop keeps a stage active until it reports no
+    // further progress, preserving the original per-button granularity.
+    function foldStage(ids) {
+      var folded = [];
+      return {
+        apply: function () {
+          while (folded.length < ids.length) {
+            var id = ids[folded.length];
+            var el = movableFor(id);
+            if (!el || el === moreDd || el.parentNode === moreMenu) { folded.push({ el: null, marker: null }); continue; }
+            var m = markerFor(id, el);
+            // A dropdown moved while open would strand its fixed-positioned menu.
+            if (el.classList) el.classList.remove('open');
+            moreDd.style.display = '';
+            moreMenu.appendChild(el);
+            folded.push({ el: el, marker: m });
+            return true;
+          }
+          return false;
+        },
+        restore: function () {
+          for (var i = folded.length - 1; i >= 0; i--) {
+            var it = folded[i];
+            if (it.el && it.marker && it.marker.parentNode) it.marker.parentNode.insertBefore(it.el, it.marker);
+          }
+          folded = [];
+        },
+      };
+    }
+    // Stage 3: the search input compacts behind a \u{1F50D} icon; the REAL input node
+    // MOVES into the floating panel (fixed-positioned by the same helper as
+    // every dropdown menu), so its input listener keeps driving state.query.
+    function searchStage() {
+      var on = false;
+      return {
+        apply: function () {
+          if (on) return false;
+          var inp = document.getElementById('search');
+          var ddw = document.getElementById('searchDd');
+          var menu = document.getElementById('searchMenu');
+          if (!inp || !ddw || !menu) return false;
+          menu.appendChild(inp);
+          ddw.style.display = '';
+          on = true;
+          return true;
+        },
+        restore: function () {
+          if (!on) return;
+          on = false;
+          var inp = document.getElementById('search');
+          var ddw = document.getElementById('searchDd');
+          if (inp && ddw && ddw.parentNode) ddw.parentNode.insertBefore(inp, ddw);
+          if (ddw) { ddw.style.display = 'none'; if (ddw.classList) ddw.classList.remove('open'); }
+        },
+      };
+    }
+    // Stage 4: the mode tabs collapse into ONE dropdown labelled with the
+    // current mode. The REAL tab buttons move into its menu (listeners and
+    // active styling survive); updateHeaderSegs keeps the trigger label in
+    // sync when the mode changes while compact.
+    function modeStage() {
+      var moved = [];
+      return {
+        apply: function () {
+          if (moved.length) return false;
+          var seg = document.getElementById('modeSeg');
+          var ddw = document.getElementById('modeDd');
+          var menu = document.getElementById('modeMenu');
+          if (!seg || !ddw || !menu) return false;
+          var btns = seg.querySelectorAll('button');
+          if (!btns.length) return false;
+          for (var i = 0; i < btns.length; i++) moved.push(btns[i]);
+          for (var j = 0; j < moved.length; j++) menu.appendChild(moved[j]);
+          seg.style.display = 'none';
+          ddw.style.display = '';
+          updateModeBtn();
+          return true;
+        },
+        restore: function () {
+          if (!moved.length) return;
+          var seg = document.getElementById('modeSeg');
+          var ddw = document.getElementById('modeDd');
+          for (var i = 0; i < moved.length; i++) seg.appendChild(moved[i]);
+          moved = [];
+          seg.style.display = '';
+          if (ddw) { ddw.style.display = 'none'; if (ddw.classList) ddw.classList.remove('open'); }
+        },
+      };
+    }
+    // Stage 5: crumb compaction is a render-mode toggle consulted by
+    // renderCrumbs itself \u2014 see crumbsCompact there. Never reparenting.
+    function crumbStage() {
+      return {
+        apply: function () {
+          if (crumbsCompact) return false;
+          crumbsCompact = true;
+          renderCrumbs();
+          return true;
+        },
+        restore: function () {
+          if (!crumbsCompact) return;
+          crumbsCompact = false;
+          renderCrumbs();
+        },
+      };
+    }
+    // Ordered compaction stages: applied first-to-last only while the header
+    // overflows, restored last-to-first when space returns.
+    var STAGES = [
+      foldStage(COLLAPSE),        // 1: trailing buttons \u2192 "\u22EF" menu
+      foldStage(['settingsBtn']), // 2: the View dropdown folds in too
+      searchStage(),              // 3: search input \u2192 \u{1F50D} + floating panel
+      modeStage(),                // 4: mode tabs \u2192 current-mode dropdown
+      crumbStage(),               // 5: ancestor crumbs \u2192 "\u2026" dropdown
+    ];
     // Signed fit measure in px: positive = overflowing, negative = headroom.
     // The header is a flex row whose ONLY flex:1 child is the .spacer, so the
     // spacer's rendered width IS the free space -- it grows to absorb all slack
@@ -5291,33 +5951,54 @@ var MODEL = __MODEL_JSON__;
       var slack = spacer ? spacer.getBoundingClientRect().width : 0;
       return (hdr.scrollWidth - hdr.clientWidth) - slack;
     }
+    var inReflow = false;
     function reflow() {
       // Not laid out (hidden tab, non-browser DOM) \u2014 measuring would misfire.
       var box = hdr.getBoundingClientRect();
       if (!box || box.width <= 0) return;
-      // Restore everything, then collapse until the row fits (idempotent).
-      for (var i = collapsed.length - 1; i >= 0; i--) {
-        var it = collapsed[i];
-        if (it.el && it.marker && it.marker.parentNode) it.marker.parentNode.insertBefore(it.el, it.marker);
-      }
-      collapsed = [];
-      moreDd.style.display = 'none';
-      hdr.scrollLeft = 0;
-      var guard = 0;
-      // Demand a few px of headroom, not a bare fit \u2014 the marginal-fit widths
-      // are exactly where the phantom scrollbar appeared.
-      while (overflowPx() > -8 && guard < COLLAPSE.length) {
-        var id = COLLAPSE[guard++];
-        var el = movableFor(id);
-        if (!el || el === moreDd || el.parentNode === moreMenu) continue;
-        var m = markerFor(id, el);
-        // A dropdown moved while open would strand its fixed-positioned menu.
-        if (el.classList) el.classList.remove('open');
-        moreDd.style.display = '';
-        moreMenu.appendChild(el);
-        collapsed.push({ el: el, marker: m });
-      }
-      if (collapsed.length === 0) moreDd.style.display = 'none';
+      inReflow = true;
+      try {
+        // The floating search panel must survive a reflow cycle: restore-all
+        // would close it (and reparenting blurs the input), so capture its
+        // open/focus state up front and reinstate it after the stage walk.
+        var ddw = document.getElementById('searchDd');
+        var inp = document.getElementById('search');
+        var searchOpen = !!(ddw && String(ddw.className || '').indexOf('open') >= 0);
+        var searchFocus = false;
+        try {
+          var ae = (typeof ROOT !== 'undefined' && ROOT ? ROOT : document).activeElement;
+          searchFocus = !!(ae && inp && ae === inp);
+        } catch (e) { /* stubbed DOM */ }
+        // Restore every stage in REVERSE order, then re-apply progressively
+        // while the row still overflows (idempotent).
+        for (var i = STAGES.length - 1; i >= 0; i--) STAGES[i].restore();
+        moreDd.style.display = 'none';
+        hdr.scrollLeft = 0;
+        // Demand a few px of headroom, not a bare fit \u2014 the marginal-fit widths
+        // are exactly where the phantom scrollbar appeared. Every apply()
+        // changes the very widths being measured, but restore-all + a strictly
+        // forward stage walk make the outcome a pure function of the current
+        // width, and reflow never reschedules itself (renderCrumbs' nudge is
+        // suppressed via inReflow, and #hdr's own box never changes here), so
+        // boundary widths settle in ONE pass instead of oscillating.
+        var si = 0;
+        var guard = 0;
+        var bound = COLLAPSE.length + STAGES.length + 8;
+        while (overflowPx() > -8 && si < STAGES.length && guard < bound) {
+          guard++;
+          if (!STAGES[si].apply()) si++;
+        }
+        if (searchOpen || searchFocus) {
+          var compactNow = ddw && ddw.style && ddw.style.display !== 'none';
+          if (compactNow && searchOpen) {
+            if (ddw.classList) ddw.classList.add('open');
+            positionDropdownMenu(ddw, document.getElementById('searchBtn'));
+          }
+          if (searchFocus && inp && inp.focus) inp.focus();
+        }
+      } finally {
+        inReflow = false;
+      }
     }
     var raf = null;
     var defer = window.requestAnimationFrame
@@ -5327,6 +6008,9 @@ var MODEL = __MODEL_JSON__;
       if (raf !== null) return;
       raf = defer(function () { raf = null; reflow(); });
     }
+    // Crumb re-renders change the header's content width without resizing #hdr
+    // itself \u2014 renderCrumbs nudges a reflow through this hook (no-op mid-reflow).
+    headerReflowHook = function () { if (!inReflow) schedule(); };
     if (typeof ResizeObserver !== 'undefined') {
       new ResizeObserver(schedule).observe(hdr);
     } else if (window.addEventListener) {
@@ -6654,7 +7338,7 @@ var init_extensions = __esm({
 });
 
 // src/core/rules/types.ts
-var BUILTIN_PROFILES;
+var BUILTIN_PROFILES, PROJECT_KINDS;
 var init_types = __esm({
   "src/core/rules/types.ts"() {
     "use strict";
@@ -6667,6 +7351,7 @@ var init_types = __esm({
       "realtime-embedded",
       "plc-cyclic"
     ];
+    PROJECT_KINDS = ["fullstack", "system-of-systems", "monorepo"];
   }
 });
 
@@ -6847,44 +7532,13 @@ var init_type_references = __esm({
   }
 });
 
-// src/core/statehash.ts
-function computeStateId() {
-  const tree = {
-    system: loadSystemSpec(),
-    subsystems: loadSubsystemSpecs(),
-    components: loadComponentSpecs(),
-    interfaces: loadInterfaceSpecs(),
-    implementations: loadImplementationSpecs(),
-    types: loadTypeSpecs()
-  };
-  const digest = crypto.createHash("sha256").update(canonicalize(tree)).digest("hex");
-  return { algorithm: "sha256", digest };
-}
-function stateIdEquals(a, b) {
-  return !!a && !!b && a.algorithm === b.algorithm && a.digest === b.digest;
-}
-function canonicalize(value) {
-  return JSON.stringify(sortKeys(value));
+// src/utils/filenames.ts
+function safeFilenamePart(value) {
+  return value.replace(/[^a-zA-Z0-9._-]/g, "-");
 }
-function sortKeys(v) {
-  if (Array.isArray(v)) return v.map(sortKeys);
-  if (v && typeof v === "object") {
-    const src = v;
-    const out = {};
-    for (const k of Object.keys(src).sort()) {
-      if (k === "createdAt" || k === "updatedAt") continue;
-      out[k] = sortKeys(src[k]);
-    }
-    return out;
-  }
-  return v;
-}
-var crypto;
-var init_statehash = __esm({
-  "src/core/statehash.ts"() {
+var init_filenames = __esm({
+  "src/utils/filenames.ts"() {
     "use strict";
-    crypto = __toESM(require("crypto"));
-    init_specs2();
   }
 });
 
@@ -7341,6 +7995,66 @@ function projectOwnSurface(maxAudience) {
 function projectChildSurface() {
   return projectOwnSurface("project");
 }
+function localName(id) {
+  return id.split("::").pop();
+}
+function projectSubsystemSurface(subsystemId) {
+  const system = loadSystemSpec();
+  if (!system) {
+    throw new Error("Cannot project a subsystem surface: the L0 system spec is missing.");
+  }
+  const subsystems = loadSubsystemSpecs();
+  const target = subsystems.find((s) => s.id === subsystemId);
+  if (!target) {
+    throw new Error(`Cannot project a subsystem surface: subsystem "${subsystemId}" does not exist.`);
+  }
+  const components = loadComponentSpecs();
+  const interfaces = loadInterfaceSpecs();
+  const types = loadTypeSpecs();
+  const entries = [];
+  const unprojectable = [];
+  for (const pub of target.publicInterfaces ?? []) {
+    if (!pub.component) continue;
+    const comp = components.find((c) => c.id === pub.component || c.id === `${subsystemId}::${pub.component}`);
+    if (!comp) continue;
+    if (!CROSS_BOUNDARY_TARGETS.has(comp.componentType)) {
+      unprojectable.push({ component: pub.component, componentType: comp.componentType });
+      continue;
+    }
+    const compInterfaces = interfaces.filter((i) => i.component === comp.id && (!pub.interface || i.id === pub.interface || i.id === `${subsystemId}::${pub.interface}`));
+    const methods = compInterfaces.flatMap((i) => i.methods);
+    entries.push({
+      id: localName(pub.interface ?? comp.id),
+      name: comp.name,
+      // Family ceiling: a sibling surface is consumable by the system family only.
+      audience: "project",
+      type: pub.type ?? "Custom",
+      // The snapshot carries the LOCAL portal name — consumers resolve cross-tree
+      // refs by their final segment.
+      component: localName(comp.id),
+      methods,
+      ...comp.dispatch && comp.dispatch.length ? { dispatch: comp.dispatch } : {},
+      // Project the backing component's auth + basePath so the codec can emit
+      // OpenAPI security + per-portal servers self-contained from the snapshot.
+      ...comp.auth && comp.auth.scheme !== "none" ? { auth: comp.auth } : {},
+      ...comp.basePath ? { basePath: comp.basePath } : {},
+      details: pub.details ?? ""
+    });
+  }
+  for (const skipped of unprojectable) {
+    console.error(
+      `[surfaces] skipped "${subsystemId}::${skipped.component}": a published ${skipped.componentType} can never serve a cross-boundary caller, so it stays out of every chained child's sibling surface \u2014 publish this surface through a Portal, a Gateway, or an Observer (for events).`
+    );
+  }
+  return SurfaceSnapshotSchema.parse({
+    projectName: `${system.name}::${subsystemId}`,
+    origin: "generated",
+    stateId: stateIdString(),
+    generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    interfaces: entries,
+    types: computeTypeClosure(entries, types)
+  });
+}
 function listSnapshots(rootDir = getProjectRoot()) {
   const dir = surfacesDir(rootDir);
   if (!fs9.existsSync(dir)) return [];
@@ -7357,39 +8071,66 @@ function listSnapshots(rootDir = getProjectRoot()) {
 function getSnapshot(projectName, rootDir = getProjectRoot()) {
   return listSnapshots(rootDir).find((s) => s.projectName === projectName) ?? null;
 }
+function snapshotFilename(projectName) {
+  return `${safeFilenamePart(projectName)}.yaml`;
+}
 function saveSnapshot(snapshot, rootDir = getProjectRoot()) {
   const dir = surfacesDir(rootDir);
   fs9.mkdirSync(dir, { recursive: true });
-  const p = path10.join(dir, `${snapshot.projectName}.yaml`);
+  const p = path10.join(dir, snapshotFilename(snapshot.projectName));
   writeYamlFile(p, SurfaceSnapshotSchema.parse(snapshot));
   return p;
 }
 function loadSurfaceSnapshots() {
   return listSnapshots();
 }
-function renderOpenApiForms(snapshot) {
-  const renderedSet = toOpenApiSet(snapshot);
-  return { renderedSet, ...renderedSet.length === 1 ? { rendered: renderedSet[0].document } : {} };
+function selectPortalSpec(renderedSet, portalId) {
+  const hit = renderedSet.find((spec) => spec.portalId === portalId);
+  if (!hit) {
+    const known = renderedSet.map((s) => s.portalId).join(", ");
+    throw new Error(`Unknown portal "${portalId}" \u2014 this surface renders: ${known || "(no portals)"}.`);
+  }
+  return [hit];
+}
+function perPortalPath(resolvedOut, portalId) {
+  const ext = path10.extname(resolvedOut);
+  const stem2 = ext ? resolvedOut.slice(0, -ext.length) : resolvedOut;
+  return `${stem2}.${safeFilenamePart(portalId)}${ext}`;
 }
-function writeSurfaceFile(outPath, body, snapshot) {
+function writeSurfaceFile(outPath, snapshot, renderedSet) {
   const resolved = path10.resolve(outPath);
   fs9.mkdirSync(path10.dirname(resolved), { recursive: true });
-  if (body !== void 0) fs9.writeFileSync(resolved, body);
-  else writeYamlFile(resolved, snapshot);
-  return resolved;
+  if (!renderedSet || renderedSet.length === 0) {
+    writeYamlFile(resolved, snapshot);
+    return [resolved];
+  }
+  if (renderedSet.length === 1) {
+    fs9.writeFileSync(resolved, renderedSet[0].document);
+    return [resolved];
+  }
+  return renderedSet.map((spec) => {
+    const target = perPortalPath(resolved, spec.portalId);
+    fs9.writeFileSync(target, spec.document);
+    return target;
+  });
 }
-function exportSurface(maxAudience, format, outPath) {
-  const snapshot = projectOwnSurface(maxAudience);
-  const openapi = format === "openapi" ? renderOpenApiForms(snapshot) : void 0;
-  const body = openapi?.rendered ?? openapi?.renderedSet[0]?.document;
-  const writtenTo = outPath ? writeSurfaceFile(outPath, body, snapshot) : void 0;
+function exportResult(snapshot, renderedSet, writtenPaths) {
+  const rendered = renderedSet?.length === 1 ? renderedSet[0].document : void 0;
   return {
     snapshot,
-    ...openapi?.rendered !== void 0 ? { rendered: openapi.rendered } : {},
-    ...openapi ? { renderedSet: openapi.renderedSet } : {},
-    ...writtenTo ? { writtenTo } : {}
+    ...rendered !== void 0 ? { rendered } : {},
+    ...renderedSet ? { renderedSet } : {},
+    ...writtenPaths.length === 1 ? { writtenTo: writtenPaths[0] } : {},
+    ...writtenPaths.length ? { writtenPaths } : {}
   };
 }
+function exportSurface(maxAudience, format, outPath, portalId) {
+  const snapshot = projectOwnSurface(maxAudience);
+  let renderedSet = format === "openapi" ? toOpenApiSet(snapshot) : void 0;
+  if (renderedSet && portalId) renderedSet = selectPortalSpec(renderedSet, portalId);
+  const writtenPaths = outPath ? writeSurfaceFile(outPath, snapshot, renderedSet) : [];
+  return exportResult(snapshot, renderedSet, writtenPaths);
+}
 function importSurface(sourcePath, origin) {
   const resolved = path10.resolve(sourcePath);
   if (!fs9.existsSync(resolved)) {
@@ -7409,17 +8150,54 @@ function importSurface(sourcePath, origin) {
   return snapshot;
 }
 function generateChildSnapshots(rootDir = getProjectRoot()) {
-  const children = loadSubsystemSpecs().filter((s) => s.projectPath && !s.id.includes("::"));
+  const topLevel = loadSubsystemSpecs().filter((s) => !s.id.includes("::"));
+  const children = topLevel.filter((s) => s.projectPath);
   if (!children.length) return [];
-  const snapshot = projectChildSurface();
+  const familySnapshot = projectChildSurface();
+  const siblingSnapshots = /* @__PURE__ */ new Map();
+  const siblingSurface = (subsystemId) => {
+    let snap = siblingSnapshots.get(subsystemId);
+    if (!snap) {
+      snap = projectSubsystemSurface(subsystemId);
+      siblingSnapshots.set(subsystemId, snap);
+    }
+    return snap;
+  };
   const written = [];
   for (const child of children) {
     const childDir = path10.resolve(rootDir, child.projectPath);
     if (!fs9.existsSync(childDir)) continue;
-    written.push(saveSnapshot(snapshot, childDir));
+    written.push(saveSnapshot(familySnapshot, childDir));
+    for (const sibling of topLevel) {
+      if (sibling.id === child.id) continue;
+      written.push(saveSnapshot(siblingSurface(sibling.id), childDir));
+    }
   }
   return written;
 }
+function computeParentStateId(parentRoot) {
+  return computeStateIdAt(parentRoot);
+}
+function listExternalInterfaces() {
+  const snapshots = listSnapshots();
+  const chainingParent = resolveChainingParent();
+  const parentStateId = chainingParent ? computeParentStateId(chainingParent.parentRoot) : null;
+  return snapshots.map((snapshot) => {
+    const generated = snapshot.origin === "generated";
+    const sourceKind = !generated ? "foreign" : snapshot.projectName.includes("::") ? "sibling" : "parent";
+    const freshness = generated && parentStateId ? snapshot.stateId === parentStateId ? "fresh" : "stale" : "unverifiable";
+    return {
+      projectName: snapshot.projectName,
+      origin: snapshot.origin,
+      sourceKind,
+      generatedAt: snapshot.generatedAt,
+      ...snapshot.stateId ? { stateId: snapshot.stateId } : {},
+      ...snapshot.version ? { version: snapshot.version } : {},
+      freshness,
+      interfaceIds: snapshot.interfaces.map((e) => e.id)
+    };
+  });
+}
 function surfaceContentKey(snapshot) {
   const { stateId, generatedAt, origin, ...content } = snapshot;
   return JSON.stringify(content);
@@ -7446,7 +8224,7 @@ function checkChildSurfaceFreshness(rootDir = getProjectRoot()) {
   }
   return issues;
 }
-var fs9, path10, SURFACES_DIRNAME;
+var fs9, path10, SURFACES_DIRNAME, CROSS_BOUNDARY_TARGETS;
 var init_surfaces = __esm({
   "src/core/surfaces.ts"() {
     "use strict";
@@ -7454,12 +8232,14 @@ var init_surfaces = __esm({
     path10 = __toESM(require("path"));
     init_fs();
     init_yaml();
+    init_filenames();
     init_models();
     init_specs2();
     init_statehash();
     init_type_analysis();
     init_openapi();
     SURFACES_DIRNAME = "surfaces";
+    CROSS_BOUNDARY_TARGETS = /* @__PURE__ */ new Set(["Portal", "Gateway", "Observer"]);
   }
 });
 
@@ -7627,7 +8407,8 @@ var init_contracts = __esm({
                           "SURFACE_REF_NOT_EXPOSED",
                           `Method "${implMethod.name}" in implementation "${impl.id}" dispatches capability "${step.capability}" through cross-tree portal "${step.targetComponent}" (step ${step.stepNumber}), but the surface snapshot of "${resolved.snapshot.projectName}" does not serve that capability on "${resolved.entry.id}".`,
                           impl.id,
-                          isDraftCtx
+                          isDraftCtx,
+                          true
                         );
                       }
                       continue;
@@ -7684,7 +8465,8 @@ var init_contracts = __esm({
                         "SURFACE_REF_NOT_EXPOSED",
                         `Method "${implMethod.name}" in implementation "${impl.id}" calls "${step.targetMethod}" on cross-tree component "${step.targetComponent}" (step ${step.stepNumber}), but the surface snapshot of "${resolved.snapshot.projectName}" does not expose that method on "${resolved.entry.id}".`,
                         impl.id,
-                        isDraftCtx
+                        isDraftCtx,
+                        true
                       );
                     } else if (step.assertsGuarantees) {
                       const declared = new Set(surfaceMethod.guarantees ?? []);
@@ -7695,7 +8477,8 @@ var init_contracts = __esm({
                             "NARRATIVE_SEMANTIC_UNBACKED",
                             `Step ${step.stepNumber} of "${implMethod.name}" in implementation "${impl.id}" asserts guarantee "${g}", but the surface snapshot of "${resolved.snapshot.projectName}" does not declare it on "${resolved.entry.id}.${step.targetMethod}".`,
                             impl.id,
-                            isDraftCtx
+                            isDraftCtx,
+                            true
                           );
                         }
                       }
@@ -9046,13 +9829,14 @@ var init_portals = __esm({
     };
     portalsRule = {
       name: "portal-endpoints",
-      description: "A Portal declares its portalType and binds every interface method to a concrete endpoint of the matching transport. Non-Portal components carry no portalType, basePath, or endpoints.",
+      description: "A Portal declares its portalType and binds every interface method to a concrete endpoint of the matching transport. Non-Portal components carry no portalType, basePath, endpoints, or auth (auth is inbound transport auth \u2014 a Gateway carries it on the Portal it owns).",
       codes: [
         { code: "MISSING_PORTAL_TYPE", defaultSeverity: "error", summary: "Portal without a portalType" },
         { code: "MISSING_ENDPOINT", defaultSeverity: "error", summary: "Portal method without a wire endpoint binding" },
         { code: "ENDPOINT_TRANSPORT_MISMATCH", defaultSeverity: "error", summary: "Endpoint transport does not match the Portal portalType" },
         { code: "UNEXPECTED_PORTAL_FIELD", defaultSeverity: "error", summary: "Non-Portal component with portalType/basePath" },
-        { code: "ARCHITECTURE_VIOLATION_NON_PORTAL_ENDPOINT", defaultSeverity: "error", summary: "Non-Portal component method declaring an endpoint" }
+        { code: "ARCHITECTURE_VIOLATION_NON_PORTAL_ENDPOINT", defaultSeverity: "error", summary: "Non-Portal component method declaring an endpoint" },
+        { code: "AUTH_ON_NON_PORTAL", defaultSeverity: "warning", summary: "Non-Portal component declaring auth (auth is inbound transport auth, only meaningful on a Portal)" }
       ],
       check(ctx) {
         for (const comp of ctx.components) {
@@ -9104,6 +9888,15 @@ var init_portals = __esm({
                 isDraftCtx
               );
             }
+            if (comp.auth !== void 0) {
+              ctx.addIssue(
+                "warning",
+                "AUTH_ON_NON_PORTAL",
+                `Component "${comp.id}" is a ${comp.componentType}, not a Portal, but declares "auth". Auth is inbound transport auth and is only meaningful on a Portal (a Gateway carries it on the Portal it owns). Move it to the exposed Portal, or remove it.`,
+                comp.id,
+                isDraftCtx
+              );
+            }
             const compInterfaces = ctx.interfaces.filter((i) => i.component === comp.id);
             for (const intf of compInterfaces) {
               for (const m of intf.methods) {
@@ -9173,7 +9966,8 @@ var init_stereotype_deps = __esm({
                       "CROSS_SUBSYSTEM_NON_ADAPTER",
                       `Boundary violation: ${comp.componentType} "${comp.id}" depends directly on "${depId}", a surface of project "${resolved.snapshot.projectName}". Only a local client Adapter may cross a project boundary \u2014 route this hop through an Adapter.`,
                       comp.id,
-                      isDraftCtx
+                      isDraftCtx,
+                      true
                     );
                   }
                   continue;
@@ -9751,14 +10545,14 @@ var init_declarative_assertions = __esm({
 });
 
 // src/core/rules/profiles.ts
-var BACKEND_LIKE, FRONTEND_LIKE, PROJECT_KINDS, profilesRule;
+var BACKEND_LIKE, FRONTEND_LIKE, PROJECT_KINDS2, profilesRule;
 var init_profiles = __esm({
   "src/core/rules/profiles.ts"() {
     "use strict";
     init_types();
     BACKEND_LIKE = /* @__PURE__ */ new Set(["backend", "lowlevel-os", "game-ecs", "realtime-embedded", "plc-cyclic"]);
     FRONTEND_LIKE = /* @__PURE__ */ new Set(["frontend-reactive", "frontend-controller"]);
-    PROJECT_KINDS = /* @__PURE__ */ new Set(["fullstack", "system-of-systems", "monorepo"]);
+    PROJECT_KINDS2 = new Set(PROJECT_KINDS);
     profilesRule = {
       name: "architectural-profiles",
       description: "Per-profile stereotype constraints: View/FeatureComponent/RouterComponent only in frontend profiles; Actor/Supervisor forbidden in plc-cyclic (single scan cycle); Actor/Supervisor in frontend profiles warned. Extension packs may register custom profiles (family + forbidden/discouraged stereotype lists); unknown profile names are flagged.",
@@ -9782,7 +10576,7 @@ var init_profiles = __esm({
             );
           }
         }
-        if (!registered.has(ctx.projectType) && !PROJECT_KINDS.has(ctx.projectType)) {
+        if (!registered.has(ctx.projectType) && !PROJECT_KINDS2.has(ctx.projectType)) {
           ctx.addIssue(
             "warning",
             "UNKNOWN_PROFILE",
@@ -11036,11 +11830,11 @@ var init_narrative_antipatterns = __esm({
           const memberEdges = keys.flatMap((k) => (adjacency.get(k) ?? []).filter((e) => inScc.has(e.toKey)));
           if (memberEdges.length === 0) continue;
           const anchor = [...memberEdges].sort((a, b) => a.fromKey.localeCompare(b.fromKey))[0];
-          const path62 = [...keys].sort().join(" \u2192 ");
+          const path61 = [...keys].sort().join(" \u2192 ");
           ctx.addIssue(
             "warning",
             "UNCONDITIONAL_CALL_CYCLE",
-            `Call cycle with no guard: ${path62} \u2014 every call edge in this cycle is unavoidable on all paths of its narrative (e.g. step ${anchor.stepNumber} of "${anchor.methodName}" in "${anchor.impl.id}" always calls ${anchor.toLabel}). This recurses without a base case, by construction. Guard at least one edge with a branch/return before the call, or lint.allow with the termination argument.`,
+            `Call cycle with no guard: ${path61} \u2014 every call edge in this cycle is unavoidable on all paths of its narrative (e.g. step ${anchor.stepNumber} of "${anchor.methodName}" in "${anchor.impl.id}" always calls ${anchor.toLabel}). This recurses without a base case, by construction. Guard at least one edge with a branch/return before the call, or lint.allow with the termination argument.`,
             anchor.impl.id,
             memberEdges.some((e) => ctx.isImplementationDraft(e.impl))
           );
@@ -12187,6 +12981,95 @@ var init_lint_allows = __esm({
   }
 });
 
+// src/core/rules/portal-call-auth.ts
+var COMPONENT_REF_PREFIX, portalCallAuthRule;
+var init_portal_call_auth = __esm({
+  "src/core/rules/portal-call-auth.ts"() {
+    "use strict";
+    COMPONENT_REF_PREFIX = "component:";
+    portalCallAuthRule = {
+      name: "portal-call-auth",
+      description: "Hardens authenticated cross-service calls. An OUTBOUND narrative `call` into ANOTHER component's Portal whose auth is not `none` must (a) be made by an Adapter \u2014 the only block that does external I/O \u2014 and (b) declare the credential source it presents via the step's `auth.from`. Absence of a source warns PORTAL_AUTH_UNMET; a non-Adapter presenter warns AUTH_PRESENTER_NOT_ADAPTER. When `auth.from` is a modeled reference (`component:<id>`) it must resolve to an Adapter/Store the presenter is wired to (UNKNOWN_AUTH_SOURCE / AUTH_SOURCE_NOT_PROVIDER / AUTH_SOURCE_UNWIRED). The actual secret is never stored in the spec. Dispatch steps (a portal's OWN inbound routing) and self-calls are not cross-service calls and are excluded.",
+      codes: [
+        { code: "PORTAL_AUTH_UNMET", defaultSeverity: "warning", summary: "A narrative call into another component's authed Portal does not declare where its credential loads from" },
+        { code: "AUTH_PRESENTER_NOT_ADAPTER", defaultSeverity: "warning", summary: "A non-Adapter component authenticates an outbound call to a portal (external I/O must go through an Adapter)" },
+        { code: "UNKNOWN_AUTH_SOURCE", defaultSeverity: "warning", summary: "auth.from references a component: source that does not exist" },
+        { code: "AUTH_SOURCE_NOT_PROVIDER", defaultSeverity: "warning", summary: "auth.from references a component that is not an Adapter or Store" },
+        { code: "AUTH_SOURCE_UNWIRED", defaultSeverity: "warning", summary: "The presenter declares a component: credential source it does not depend on or own" }
+      ],
+      check(ctx) {
+        for (const impl of ctx.implementations) {
+          const ownComponent = ctx.interfaceMap.get(impl.contract)?.component;
+          const presenter = ownComponent ? ctx.componentMap.get(ownComponent) : void 0;
+          const draft = ctx.isImplementationDraft(impl);
+          for (const method2 of impl.methods ?? []) {
+            for (const step of method2.narrative ?? []) {
+              if (step.type !== "call") continue;
+              if (!step.targetComponent || step.targetComponent === ownComponent) continue;
+              const target = ctx.componentMap.get(step.targetComponent);
+              if (!target || target.componentType !== "Portal") continue;
+              if (!target.auth || target.auth.scheme === "none") continue;
+              if (presenter && presenter.componentType !== "Adapter") {
+                ctx.addIssue(
+                  "warning",
+                  "AUTH_PRESENTER_NOT_ADAPTER",
+                  `Narrative step ${step.stepNumber} of "${method2.name}" in "${impl.id}": "${presenter.id}" (${presenter.componentType}) authenticates an outbound call to portal "${target.id}". An authenticated cross-service call is external I/O and must be made by an Adapter (the only block that does external I/O) \u2014 route it through a client Adapter.`,
+                  impl.id,
+                  draft
+                );
+              }
+              const from = step.auth?.from;
+              if (!from) {
+                ctx.addIssue(
+                  "warning",
+                  "PORTAL_AUTH_UNMET",
+                  `Narrative step ${step.stepNumber} of "${method2.name}" in "${impl.id}" calls the authenticated portal "${target.id}" (auth scheme: ${target.auth.scheme}) but does not declare where its credential is loaded from. Add the credential source (the step's auth.from \u2014 a secret-store component, env var, config key, or vault ref), or drop the portal's auth if it needs none.`,
+                  impl.id,
+                  draft
+                );
+                continue;
+              }
+              if (from.startsWith(COMPONENT_REF_PREFIX)) {
+                const srcId = from.slice(COMPONENT_REF_PREFIX.length);
+                const src = ctx.componentMap.get(srcId);
+                if (!src) {
+                  ctx.addIssue(
+                    "warning",
+                    "UNKNOWN_AUTH_SOURCE",
+                    `Narrative step ${step.stepNumber} of "${method2.name}" in "${impl.id}": auth.from references component "${srcId}", which does not exist.`,
+                    impl.id,
+                    draft
+                  );
+                } else {
+                  if (src.componentType !== "Adapter" && src.componentType !== "Store") {
+                    ctx.addIssue(
+                      "warning",
+                      "AUTH_SOURCE_NOT_PROVIDER",
+                      `Narrative step ${step.stepNumber} of "${method2.name}" in "${impl.id}": auth.from references "${srcId}" (${src.componentType}); a credential source must be an Adapter (loads the secret via external I/O) or a Store (holds it).`,
+                      impl.id,
+                      draft
+                    );
+                  }
+                  const wired = (presenter?.dependsOn ?? []).includes(srcId) || (presenter?.owns ?? []).includes(srcId);
+                  if (presenter && !wired) {
+                    ctx.addIssue(
+                      "warning",
+                      "AUTH_SOURCE_UNWIRED",
+                      `Narrative step ${step.stepNumber} of "${method2.name}" in "${impl.id}": "${presenter.id}" loads its credential from "${srcId}" but neither depends on nor owns it \u2014 declare the dependsOn edge so the credential wiring is real.`,
+                      impl.id,
+                      draft
+                    );
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+    };
+  }
+});
+
 // src/core/rules/index.ts
 function makeScopeFilter(opts) {
   const { components, interfaces, implementations, types, scopeSubsystem } = opts;
@@ -12338,9 +13221,15 @@ function buildRuleContext(opts) {
     ...[...SDD_RULES, ...extensions.rules].flatMap((r) => r.codes.map((c) => c.code)),
     // Declarative assertions bring their own namespaced codes — lint.allow
     // and severity overrides treat them exactly like builtins.
-    ...extensions.assertions.map((a) => a.fullCode)
+    ...extensions.assertions.map((a) => a.fullCode),
+    // Entry-point emitted codes: validateSddTree's chained-subproject pass
+    // raises these AFTER the rule run (it post-processes the aggregated issue
+    // list), so no registered rule declares them — but lint.allow validation
+    // must still recognize them as real codes.
+    "CHAINED_SUBPROJECT_CONTEXT",
+    "UNVERIFIED_EXTERNAL_REF"
   ]);
-  const addIssue = (defaultSeverity, code, message, specId, isDraftContext) => {
+  const addIssue = (defaultSeverity, code, message, specId, isDraftContext, surfaceResolved) => {
     if (scopeSubsystem && specId && !isSpecInScope(specId)) {
       return;
     }
@@ -12358,7 +13247,14 @@ function buildRuleContext(opts) {
         if (severity === "warning") return;
       }
     }
-    issues.push({ severity, code, message, specId, ...isDraftContext ? { draftContext: true } : {} });
+    issues.push({
+      severity,
+      code,
+      message,
+      specId,
+      ...isDraftContext ? { draftContext: true } : {},
+      ...surfaceResolved ? { surfaceResolved: true } : {}
+    });
   };
   return {
     system,
@@ -12432,6 +13328,7 @@ var init_rules = __esm({
     init_hidden_state();
     init_dependency_conformance();
     init_lint_allows();
+    init_portal_call_auth();
     init_source_analysis();
     init_types();
     init_type_analysis();
@@ -12453,6 +13350,9 @@ var init_rules = __esm({
       narrativeAntipatternsRule,
       narrativeDetailRule,
       portalsRule,
+      // Cross-call auth: a narrative call into an authed Portal must name its
+      // credential source (rides with the portal family).
+      portalCallAuthRule,
       stereotypeDepsRule,
       patternsRule,
       // Facade shape rides with pattern ownership: same §7 doctrine, narrative side.
@@ -12515,6 +13415,7 @@ var init_rules = __esm({
       // L4 expectations: implementations and their code linkage.
       MISSING_IMPLEMENTATION_METHOD: "implementations",
       MISSING_SOURCE_PATH: "implementations",
+      PORTAL_AUTH_UNMET: "implementations",
       MISSING_SOURCE_FILE: "implementations",
       SOURCE_PATH_ESCAPES_ROOT: "implementations",
       UNREALIZED_METHOD: "implementations",
@@ -12778,24 +13679,54 @@ function validateSddTree(rulesOrOptions, projectType = "backend") {
     for (const rule of ruleSequence()) {
       rule.check(ctx);
     }
-    const hasCrossTreeSuspects = issues.some((i) => SUBPROJECT_LENIENT_CODES.has(i.code));
+    const hasCrossTreeSuspects = issues.some(
+      (i) => SUBPROJECT_REFERENCE_CODES.has(i.code) || SUBPROJECT_CONFORMANCE_CODES.has(i.code)
+    );
     const chainingParent = hasCrossTreeSuspects ? findChainingParent(getProjectRoot()) : null;
     if (chainingParent) {
+      let unverified = 0;
       let downgraded = 0;
-      for (const iss of issues) {
-        if (!SUBPROJECT_LENIENT_CODES.has(iss.code)) continue;
-        if (iss.severity === "error") {
-          iss.severity = "warning";
-          downgraded++;
+      for (let at = 0; at < issues.length; at++) {
+        const iss = issues[at];
+        if (SUBPROJECT_REFERENCE_CODES.has(iss.code) && !iss.surfaceResolved) {
+          issues[at] = {
+            severity: "warning",
+            code: "UNVERIFIED_EXTERNAL_REF",
+            crossTreeContext: true,
+            // --ci waives it (parent root is authoritative)
+            specId: iss.specId,
+            ...iss.agentId ? { agentId: iss.agentId } : {},
+            ...iss.draftContext ? { draftContext: true } : {},
+            message: `Unverified external reference (${iss.code}): ${iss.message} No vendored surface snapshot covers this reference, so it cannot be verified from this chained subproject standalone \u2014 re-lock the parent so fresh family/sibling snapshots ship, or inspect what this project can consume via \`wairon surface externals\` / sdd_list_external_interfaces.`
+          };
+          unverified++;
+          continue;
+        }
+        if (SUBPROJECT_CONFORMANCE_CODES.has(iss.code)) {
+          if (iss.severity === "error") {
+            iss.severity = "warning";
+            downgraded++;
+          }
+          iss.crossTreeContext = true;
         }
-        iss.crossTreeContext = true;
       }
-      if (downgraded > 0) {
+      if (unverified > 0 || downgraded > 0) {
+        const notes = [];
+        if (unverified > 0) {
+          notes.push(
+            `${unverified} cross-tree reference(s) have no vendored surface snapshot covering them and were reported as UNVERIFIED_EXTERNAL_REF warnings \u2014 re-lock the parent so fresh family/sibling snapshots ship, or inspect via \`wairon surface externals\` / sdd_list_external_interfaces.`
+          );
+        }
+        if (downgraded > 0) {
+          notes.push(
+            `${downgraded} code\u2194spec conformance finding(s) (parent-root-relative source paths) were downgraded to warnings.`
+          );
+        }
         issues.unshift({
           severity: "warning",
           code: "CHAINED_SUBPROJECT_CONTEXT",
           crossTreeContext: true,
-          message: `This project is a chained subproject ("${chainingParent.subsystemId}") of the parent project at "${chainingParent.parentRoot}". ${downgraded} reference(s) resolve only in the parent tree (shared types, sibling subsystems, or cross-tree components that live above this root) and were downgraded to warnings \u2014 validating a subproject standalone cannot verify them. Run validation from the parent root for full cross-tree verification.`
+          message: `This project is a chained subproject ("${chainingParent.subsystemId}") of the parent project at "${chainingParent.parentRoot}". ${notes.join(" ")} Full cross-tree verification runs from the parent root.`
         });
       }
     }
@@ -12812,7 +13743,7 @@ function validateSddTree(rulesOrOptions, projectType = "backend") {
 function validateAsComplete(options) {
   return validateSddTree({ ...options ?? {}, treatAllAsComplete: true });
 }
-var SUBPROJECT_LENIENT_CODES;
+var SUBPROJECT_REFERENCE_CODES, SUBPROJECT_CONFORMANCE_CODES;
 var init_validation = __esm({
   "src/core/validation.ts"() {
     "use strict";
@@ -12825,8 +13756,7 @@ var init_validation = __esm({
     init_source_analysis();
     init_specs2();
     init_fs();
-    SUBPROJECT_LENIENT_CODES = /* @__PURE__ */ new Set([
-      // reference resolution
+    SUBPROJECT_REFERENCE_CODES = /* @__PURE__ */ new Set([
       "UNDEFINED_TYPE_REFERENCE",
       "INVALID_DEPENDENCY_REFERENCE",
       "INVALID_TARGET_COMPONENT_REFERENCE",
@@ -12834,8 +13764,9 @@ var init_validation = __esm({
       "UNDECLARED_DEPENDENCY_CALL",
       "INVALID_TRUSTED_LINK",
       "CROSS_SUBSYSTEM_NON_ADAPTER",
-      "CROSS_TREE_REF_UNRESOLVED",
-      // code↔spec conformance (root-relative sourcePaths / import graph)
+      "CROSS_TREE_REF_UNRESOLVED"
+    ]);
+    SUBPROJECT_CONFORMANCE_CODES = /* @__PURE__ */ new Set([
       "MISSING_SOURCE_FILE",
       "SOURCE_PATH_ESCAPES_ROOT",
       "MISSING_SOURCE_PATH",
@@ -13377,6 +14308,7 @@ __export(specs_exports, {
   buildProjectGraph: () => buildProjectGraph,
   clearLoaderIssues: () => clearLoaderIssues,
   collectPromotableSpecs: () => collectPromotableSpecs,
+  computeStateIdAt: () => computeStateIdAt,
   deleteComponentSpec: () => deleteComponentSpec,
   deleteGroupSpec: () => deleteGroupSpec,
   deleteImplementationSpec: () => deleteImplementationSpec,
@@ -13409,6 +14341,7 @@ __export(specs_exports, {
   loadTypeSpec: () => loadTypeSpec,
   loadTypeSpecs: () => loadTypeSpecs,
   normalizeComponentLayout: () => normalizeComponentLayout,
+  resolveChainingParent: () => resolveChainingParent,
   resolveSubprojectForNamespace: () => resolveSubprojectForNamespace,
   restoreSpecFiles: () => restoreSpecFiles,
   saveComponentSpec: () => saveComponentSpec,
@@ -13813,6 +14746,19 @@ function dryRunSerializeSpecs(include) {
 function buildProjectGraph(level) {
   return buildGraphModel(level);
 }
+function resolveChainingParent() {
+  return findChainingParent(getProjectRoot());
+}
+function computeStateIdAt(root) {
+  const resolved = path14.resolve(root);
+  return runWithProjectRoot(resolved, () => {
+    workspaceFor(resolved).invalidate();
+    const system = loadSystemSpec();
+    if (!system) return null;
+    const s = computeStateId();
+    return `${s.algorithm}:${s.digest}`;
+  });
+}
 function deleteTypeSpec(id) {
   return current().deleteTypeSpec(id);
 }
@@ -13856,6 +14802,7 @@ var init_specs2 = __esm({
     path14 = __toESM(require("path"));
     init_loader();
     init_fs();
+    init_statehash();
     init_yaml();
     init_models();
     init_narrative_labels();
@@ -16449,6 +17396,9 @@ function requireSpecs() {
 function requireProvision() {
   return init_provision(), __toCommonJS(provision_exports);
 }
+function listExternalInterfaces2() {
+  return listExternalInterfaces();
+}
 function text(content) {
   return { content: [{ type: "text", text: content }] };
 }
@@ -17078,6 +18028,7 @@ NOTICE:
     type: import_zod9.z.enum(["local", "call", "dispatch", "branch", "switch", "loop", "try", "parallel", "jump", "return", "throw"]),
     targetComponent: import_zod9.z.string().optional().describe("call/dispatch: L2 component id (for dispatch, the Portal routed through)"),
     targetMethod: import_zod9.z.string().optional().describe("call: method name on the target"),
+    auth: import_zod9.z.object({ from: import_zod9.z.string(), note: import_zod9.z.string().optional() }).optional().describe("call/dispatch: the credential this step presents to an AUTHED callee Portal and WHERE it loads from (`from`). Opaque form (env:API_KEY, a config key, vault:path) = a design note wairon never resolves; modeled form `component:<id>` references the Adapter/Store that provides the secret and is validated (must resolve, be an Adapter/Store, and be wired to the presenter). Absence on a call into a Portal whose auth \u2260 none warns (PORTAL_AUTH_UNMET). The authenticated call itself should be made by an Adapter (AUTH_PRESENTER_NOT_ADAPTER)."),
     detach: import_zod9.z.boolean().optional().describe("call/dispatch: fire-and-forget \u2014 issue the call and continue without awaiting the result (no later step consumes it)"),
     capability: import_zod9.z.string().optional().describe("dispatch: the capability routed through the target Portal's dispatch table (validated against it \u2014 UNSERVED_CAPABILITY)"),
     assertsGuarantees: import_zod9.z.array(import_zod9.z.string().min(1)).optional().describe("Semantic guarantees this step relies on \u2014 each must be declared in the called method's L3 guarantees (NARRATIVE_SEMANTIC_UNBACKED otherwise). Builtin tokens: idempotent | atomic | transactional | exactly-once; extension packs may declare more (any other token is UNKNOWN_GUARANTEE)"),
@@ -17414,7 +18365,36 @@ NOTICE:
       }
     }
   );
+  reg(
+    server,
+    "sdd_list_external_interfaces",
+    {
+      description: "List the bound project's consumable external surfaces (parent family, siblings, foreign imports) as discovery entries with origin, provenance, and freshness \u2014 the tool an agent inside a subproject uses to SEE its outward world instead of discovering it by failed reference resolution. Full contracts stay in the vendored snapshots (.wai/surfaces/); each entry summarizes the interface ids it exposes."
+    },
+    () => {
+      try {
+        return json(listExternalInterfaces2());
+      } catch (e) {
+        return errText(String(e));
+      }
+    }
+  );
   registerSkillResources(server);
+  try {
+    const chainingParent = resolveChainingParent();
+    if (chainingParent) {
+      let externalSurfaceCount = 0;
+      try {
+        externalSurfaceCount = listExternalInterfaces2().length;
+      } catch {
+      }
+      process.stderr.write(
+        `[wairon mcp] chained subproject: this root is mounted as subsystem "${chainingParent.subsystemId}" of the parent project at ${chainingParent.parentRoot} \u2014 ${externalSurfaceCount} vendored external surface(s) discoverable via sdd_list_external_interfaces
+`
+      );
+    }
+  } catch {
+  }
   if (options.hostedTools) {
     const hostedStub = () => errText("This hosted tool is dispatched by the hosting data plane before reaching the MCP server; it is unavailable outside a hosted request.");
     reg(server, "sdd_host_lock_project", {
@@ -17550,6 +18530,8 @@ var init_server = __esm({
     init_narrative_labels();
     init_specs();
     init_skills();
+    init_specs2();
+    init_surfaces();
     SERVER_BUILD_STAMP = captureBuildStamp(__filename);
     STALE_SERVER_WARNING = "\n\n\u26A0 STALE SERVER: the wairon build on disk changed after this MCP server started. Restart the MCP session (e.g. /mcp reconnect) before further spec edits \u2014 writes through a stale server can silently drop fields introduced by newer schemas.";
     SKILL_RESOURCE_MIME = "text/markdown";
@@ -20623,7 +21605,7 @@ var require_dist = __commonJS({
       return name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
     }
     var fs51 = __toESM2(require("fs"));
-    var path62 = __toESM2(require("path"));
+    var path61 = __toESM2(require("path"));
     var import_fflate = require_node();
     var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git", ".hg", ".svn"]);
     function listEntries(archive) {
@@ -20661,8 +21643,8 @@ var require_dist = __commonJS({
     }
     function writeTree(destDir, files) {
       for (const file of files) {
-        const absolute = path62.join(destDir, file.path);
-        fs51.mkdirSync(path62.dirname(absolute), { recursive: true });
+        const absolute = path61.join(destDir, file.path);
+        fs51.mkdirSync(path61.dirname(absolute), { recursive: true });
         fs51.writeFileSync(absolute, file.contents);
       }
     }
@@ -20675,10 +21657,10 @@ var require_dist = __commonJS({
       for (const entry of fs51.readdirSync(current2, { withFileTypes: true })) {
         if (entry.isDirectory()) {
           if (SKIP_DIRS.has(entry.name)) continue;
-          walkPackDir(root, path62.join(current2, entry.name), out);
+          walkPackDir(root, path61.join(current2, entry.name), out);
         } else if (entry.isFile()) {
-          const absolute = path62.join(current2, entry.name);
-          const relative22 = path62.relative(root, absolute).split(path62.sep).join("/");
+          const absolute = path61.join(current2, entry.name);
+          const relative22 = path61.relative(root, absolute).split(path61.sep).join("/");
           out.push({ path: relative22, contents: fs51.readFileSync(absolute) });
         }
       }
@@ -22089,86 +23071,216 @@ async function generateLayer(options = {}) {
 }
 
 // src/commands/lock.ts
+var os7 = __toESM(require("os"));
 var import_inquirer2 = __toESM(require("inquirer"));
 init_logger();
-init_loader();
-init_fs();
-init_validation();
-init_specs2();
-async function runLock(options = {}) {
-  assertProjectInitialized();
-  if (!pathExists(AI_PATHS.specsSystem())) {
-    logger.error("No SDD spec tree found (.wai/specs). Nothing to lock.");
-    process.exit(1);
+init_defaults();
+
+// src/core/detection.ts
+var fs18 = __toESM(require("fs"));
+var path27 = __toESM(require("path"));
+init_defaults();
+var PACKAGE_MARKERS = [
+  "package.json",
+  "pyproject.toml",
+  "Cargo.toml",
+  "go.mod",
+  "build.gradle",
+  "build.gradle.kts",
+  "pom.xml"
+];
+var MAX_SCAN_DEPTH = 5;
+function detectDomainCandidates(projectRoot2, alreadyTrackedPaths = /* @__PURE__ */ new Set(), alreadyTrackedIds = /* @__PURE__ */ new Set()) {
+  const candidates = /* @__PURE__ */ new Map();
+  for (const c of detectGitSubmodules(projectRoot2)) {
+    candidates.set(c.path, { ...c, alreadyTracked: alreadyTrackedPaths.has(c.path) });
   }
-  const projectConfig = loadProjectConfig();
-  logger.info("Analyzing and validating specifications in-memory...");
-  const index = scanAllSpecs({ recursive: options.recursive ?? true });
-  const promotable = collectPromotableSpecs(options.subsystem);
-  const originalStatuses = /* @__PURE__ */ new Map();
-  const isSpecInSubsystemScope = (specSubsystem) => {
-    if (!options.subsystem) return true;
-    if (!specSubsystem) return false;
-    return specSubsystem === options.subsystem || specSubsystem.startsWith(`${options.subsystem}::`);
-  };
-  for (const s of index.subsystems) {
-    if (!options.subsystem || s.id === options.subsystem || s.id.startsWith(`${options.subsystem}::`)) {
-      originalStatuses.set(s, s.status);
-      s.status = "complete";
+  for (const c of detectNestedGitRepos(projectRoot2)) {
+    if (!candidates.has(c.path)) {
+      candidates.set(c.path, { ...c, alreadyTracked: alreadyTrackedPaths.has(c.path) });
     }
   }
-  for (const c of index.components) {
-    if (isSpecInSubsystemScope(c.subsystem)) {
-      originalStatuses.set(c, c.status);
-      c.status = "complete";
-    }
+  const gitPaths = new Set(
+    Array.from(candidates.values()).filter((c) => c.type === "git-submodule" || c.type === "git-repo").map((c) => c.path)
+  );
+  for (const c of detectPackageRoots(projectRoot2)) {
+    if (candidates.has(c.path)) continue;
+    const insideGit = Array.from(gitPaths).some(
+      (gp) => c.path === gp || c.path.startsWith(gp + "/")
+    );
+    if (insideGit) continue;
+    candidates.set(c.path, { ...c, alreadyTracked: alreadyTrackedPaths.has(c.path) });
   }
-  for (const i of index.interfaces) {
-    const comp = index.components.find((c) => c.id === i.component);
-    if (comp && isSpecInSubsystemScope(comp.subsystem)) {
-      originalStatuses.set(i, i.status);
-      i.status = "complete";
-    }
+  const sorted = Array.from(candidates.values()).sort((a, b) => a.path.localeCompare(b.path));
+  return deduplicateIds(sorted, alreadyTrackedIds);
+}
+function deduplicateIds(candidates, existingIds = /* @__PURE__ */ new Set()) {
+  const idCount = /* @__PURE__ */ new Map();
+  for (const id of existingIds) {
+    idCount.set(id, (idCount.get(id) ?? 0) + 1);
   }
-  for (const m of index.implementations) {
-    const intf = index.interfaces.find((i) => i.id === m.contract);
-    const comp = intf ? index.components.find((c) => c.id === intf.component) : null;
-    if (comp && isSpecInSubsystemScope(comp.subsystem)) {
-      originalStatuses.set(m, m.status);
-      m.status = "complete";
-    }
+  for (const c of candidates) {
+    idCount.set(c.suggestedId, (idCount.get(c.suggestedId) ?? 0) + 1);
   }
-  const dry = validateSddTree({
-    rules: projectConfig.rules,
-    projectType: projectConfig.projectType,
-    scopeSubsystem: options.subsystem,
-    recursive: options.recursive ?? true
+  return candidates.map((c) => {
+    if ((idCount.get(c.suggestedId) ?? 0) <= 1) return c;
+    const parts = c.path.split("/");
+    const qualifiedId2 = parts.length >= 2 ? pathToId(`${parts[parts.length - 2]}-${parts[parts.length - 1]}`) : c.suggestedId;
+    return { ...c, suggestedId: qualifiedId2 };
   });
-  for (const [spec, status2] of originalStatuses.entries()) {
-    spec.status = status2;
+}
+function parseGitmodules(filePath) {
+  const content = fs18.readFileSync(filePath, "utf-8");
+  const entries = [];
+  let current2 = {};
+  for (const line2 of content.split("\n")) {
+    const trimmed = line2.trim();
+    const headerMatch = trimmed.match(/^\[submodule "(.+)"\]$/);
+    if (headerMatch) {
+      if (current2.path) entries.push(current2);
+      current2 = { name: headerMatch[1] };
+      continue;
+    }
+    const keyVal = trimmed.match(/^(\w+)\s*=\s*(.+)$/);
+    if (keyVal) {
+      const [, key, value] = keyVal;
+      if (key === "path") current2.path = value.trim();
+      if (key === "url") current2.url = value.trim();
+    }
   }
-  const errors = dry.issues.filter((i) => i.severity === "error");
-  if (errors.length > 0) {
-    logger.header("Cannot lock \u2014 the spec tree does not validate as complete");
-    let errorCount = 0;
-    const MAX_PRINT = 100;
-    let skippedErrors = 0;
-    for (const i of errors) {
-      if (errorCount < MAX_PRINT) {
-        logger.error(`${i.specId ? `[${i.specId}] ` : ""}[${i.code}] ${i.message}`);
-        errorCount++;
-      } else {
-        skippedErrors++;
-      }
+  if (current2.path) entries.push(current2);
+  return entries;
+}
+function detectGitSubmodules(projectRoot2) {
+  const gitmodulesPath = path27.join(projectRoot2, ".gitmodules");
+  if (!fs18.existsSync(gitmodulesPath)) return [];
+  return parseGitmodules(gitmodulesPath).map((entry) => ({
+    suggestedId: pathToId(entry.path),
+    suggestedName: pathToName(entry.path),
+    path: normalizePath3(entry.path),
+    type: "git-submodule",
+    alreadyTracked: false
+  }));
+}
+function detectNestedGitRepos(projectRoot2) {
+  const results = [];
+  walkForGit(projectRoot2, projectRoot2, 0, results);
+  return results;
+}
+function walkForGit(projectRoot2, currentDir, depth, results) {
+  if (depth > MAX_SCAN_DEPTH) return;
+  let entries;
+  try {
+    entries = fs18.readdirSync(currentDir, { withFileTypes: true });
+  } catch {
+    return;
+  }
+  for (const entry of entries) {
+    if (!entry.isDirectory()) continue;
+    if (SCAN_EXCLUDE_DIRS.has(entry.name)) continue;
+    const fullPath = path27.join(currentDir, entry.name);
+    const relPath = normalizePath3(path27.relative(projectRoot2, fullPath));
+    if (relPath === "" || relPath === ".") continue;
+    const gitPath = path27.join(fullPath, ".git");
+    if (fs18.existsSync(gitPath)) {
+      results.push({
+        suggestedId: pathToId(relPath),
+        suggestedName: pathToName(relPath),
+        path: relPath,
+        type: "git-repo",
+        alreadyTracked: false
+      });
+      continue;
     }
-    if (skippedErrors > 0) {
-      logger.error(`... and ${skippedErrors} more error(s) omitted.`);
+    walkForGit(projectRoot2, fullPath, depth + 1, results);
+  }
+}
+function detectPackageRoots(projectRoot2) {
+  const results = [];
+  walkForPackages(projectRoot2, projectRoot2, 0, results);
+  return results;
+}
+function walkForPackages(projectRoot2, currentDir, depth, results) {
+  if (depth > MAX_SCAN_DEPTH) return;
+  let entries;
+  try {
+    entries = fs18.readdirSync(currentDir, { withFileTypes: true });
+  } catch {
+    return;
+  }
+  for (const entry of entries) {
+    if (!entry.isDirectory()) continue;
+    if (SCAN_EXCLUDE_DIRS.has(entry.name)) continue;
+    const fullPath = path27.join(currentDir, entry.name);
+    const relPath = normalizePath3(path27.relative(projectRoot2, fullPath));
+    if (relPath === "" || relPath === ".") continue;
+    const hasMarker = PACKAGE_MARKERS.some((m) => fs18.existsSync(path27.join(fullPath, m)));
+    if (hasMarker) {
+      results.push({
+        suggestedId: pathToId(relPath),
+        suggestedName: pathToName(relPath),
+        path: relPath,
+        type: "package-root",
+        alreadyTracked: false
+      });
     }
-    logger.blank();
-    logger.info("Fix the errors above, then run `wairon lock` again. Nothing was changed.");
-    process.exit(1);
+    walkForPackages(projectRoot2, fullPath, depth + 1, results);
   }
-  logger.header("Lock SDD specs");
+}
+function pathToId(relPath) {
+  const basename11 = path27.basename(relPath);
+  return basename11.toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
+}
+function pathToName(relPath) {
+  const id = pathToId(relPath);
+  return id.split("-").map((w) => w.charAt(0).toUpperCase() + w.slice(1)).join(" ");
+}
+function normalizePath3(p) {
+  return p.replace(/\\/g, "/");
+}
+
+// src/core/index.ts
+init_domains();
+init_validation();
+init_extensions();
+init_variants();
+init_rules();
+init_specs2();
+init_provision();
+init_diagram();
+
+// src/core/lockfile.ts
+var fs19 = __toESM(require("fs"));
+var path28 = __toESM(require("path"));
+init_fs();
+function lockPath() {
+  return aiDir("lock.json");
+}
+function readLockRecord() {
+  try {
+    return JSON.parse(fs19.readFileSync(lockPath(), "utf8"));
+  } catch {
+    return null;
+  }
+}
+function writeLockRecord(record2) {
+  const p = lockPath();
+  fs19.mkdirSync(path28.dirname(p), { recursive: true });
+  const tmp = `${p}.tmp`;
+  fs19.writeFileSync(tmp, JSON.stringify(record2, null, 2) + "\n");
+  fs19.renameSync(tmp, p);
+}
+
+// src/core/index.ts
+init_statehash();
+init_agent_resolver();
+init_skills();
+init_surfaces();
+init_openapi();
+
+// src/commands/lock.ts
+async function runLock(options = {}, gate) {
+  const promotable = collectPromotableSpecs(options.subsystem);
   if (promotable.length === 0) {
     logger.info("All specs are already complete \u2014 this will re-validate and regenerate the agent topology.");
   } else {
@@ -22192,23 +23304,36 @@ async function runLock(options = {}) {
         default: false
       }
     ]);
-    if (!confirmed) {
-      logger.info("Cancelled. Nothing was changed.");
-      return;
-    }
+    if (!confirmed) return null;
+  }
+  if (options.subsystem) {
+    for (const p of promotable) applySpecStatus(p.kind, p.id, "complete");
+    invalidateSpecCache();
+  } else {
+    promoteAllComplete();
   }
-  for (const p of promotable) applySpecStatus(p.kind, p.id, "complete");
-  invalidateSpecCache();
   if (promotable.length > 0) {
     logger.success(`Locked ${promotable.length} spec(s) as complete.`);
   }
-  logger.blank();
-  await runGenerate({ domain: options.subsystem });
-  logger.blank();
-  logger.success("Specs locked and agent topology generated.");
-  logger.warn(
-    "Restart any running AI agent sessions (Claude Code / Antigravity / Codex) so the newly generated implementer agents load \u2014 they are not picked up mid-session."
-  );
+  let lockedBy = "local";
+  try {
+    lockedBy = `local:${os7.userInfo().username}`;
+  } catch {
+  }
+  const record2 = {
+    stateId: computeStateId(),
+    lockedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    lockedBy,
+    validatorVersion: WAIRON_VERSION,
+    validationResult: {
+      valid: true,
+      errors: 0,
+      warnings: gate ? gate.issues.filter((i) => i.severity === "warning").length : 0
+    },
+    status: "ready"
+  };
+  writeLockRecord(record2);
+  return record2;
 }
 
 // src/commands/validate.ts
@@ -22347,6 +23472,10 @@ async function runValidate(options = {}) {
   }
 }
 
+// src/cli/index.ts
+init_loader();
+init_fs();
+
 // src/commands/list.ts
 var import_chalk7 = __toESM(require("chalk"));
 init_logger();
@@ -22461,9 +23590,9 @@ init_mcp();
 // src/commands/update.ts
 var https = __toESM(require("https"));
 var http = __toESM(require("http"));
-var fs18 = __toESM(require("fs"));
-var path27 = __toESM(require("path"));
-var os7 = __toESM(require("os"));
+var fs20 = __toESM(require("fs"));
+var path29 = __toESM(require("path"));
+var os8 = __toESM(require("os"));
 var crypto2 = __toESM(require("crypto"));
 var import_child_process2 = require("child_process");
 init_logger();
@@ -22526,8 +23655,8 @@ async function runUpdate(options = {}) {
     logger.info(`Download manually from: ${release.html_url}`);
     process.exit(1);
   }
-  const tmpDir = os7.tmpdir();
-  const tmpFile = path27.join(tmpDir, assetName);
+  const tmpDir = os8.tmpdir();
+  const tmpFile = path29.join(tmpDir, assetName);
   logger.info(`Downloading ${assetName}...`);
   try {
     await downloadFile(asset.browser_download_url, tmpFile);
@@ -22544,16 +23673,16 @@ async function runUpdate(options = {}) {
   const checksumAssetName = assetName + ".sha256";
   const checksumAsset = release.assets.find((a) => a.name === checksumAssetName);
   if (checksumAsset) {
-    const tmpChecksum = path27.join(tmpDir, checksumAssetName);
+    const tmpChecksum = path29.join(tmpDir, checksumAssetName);
     logger.info(`Verifying checksum...`);
     try {
       await downloadFile(checksumAsset.browser_download_url, tmpChecksum);
       verifyChecksum(tmpFile, tmpChecksum, assetName);
-      fs18.unlinkSync(tmpChecksum);
+      fs20.unlinkSync(tmpChecksum);
     } catch (err) {
       logger.error(`Checksum verification failed: ${err.message}`);
       try {
-        fs18.unlinkSync(tmpFile);
+        fs20.unlinkSync(tmpFile);
       } catch {
       }
       process.exit(1);
@@ -22619,7 +23748,7 @@ function fetchReleases(repo) {
 }
 function downloadFile(url, dest) {
   return new Promise((resolve24, reject) => {
-    const file = fs18.createWriteStream(dest);
+    const file = fs20.createWriteStream(dest);
     const get3 = url.startsWith("https://") ? https.get : http.get;
     get3(url, { headers: { "User-Agent": `wairon/${WAIRON_VERSION}` }, agent: false }, (res) => {
       if (res.statusCode === 301 || res.statusCode === 302) {
@@ -22641,21 +23770,21 @@ function downloadFile(url, dest) {
       });
       file.on("error", (err) => {
         res.destroy();
-        fs18.unlink(dest, () => {
+        fs20.unlink(dest, () => {
         });
         reject(err);
       });
     }).on("error", (err) => {
-      fs18.unlink(dest, () => {
+      fs20.unlink(dest, () => {
       });
       reject(err);
     });
   });
 }
 function verifyChecksum(filePath, checksumFile, expectedFilename) {
-  const checksumContent = fs18.readFileSync(checksumFile, "utf-8").trim();
+  const checksumContent = fs20.readFileSync(checksumFile, "utf-8").trim();
   const expectedHash = checksumContent.split(/\s+/)[0].toLowerCase();
-  const fileBuffer = fs18.readFileSync(filePath);
+  const fileBuffer = fs20.readFileSync(filePath);
   const actualHash = crypto2.createHash("sha256").update(fileBuffer).digest("hex").toLowerCase();
   if (actualHash !== expectedHash) {
     throw new Error(
@@ -22686,9 +23815,9 @@ function isPkgBinary2() {
 function installBinary(tmpFile, destPath) {
   const platform = process.platform;
   const isZip = tmpFile.endsWith(".zip");
-  const extractDir = path27.join(os7.tmpdir(), "wairon-extract");
-  if (fs18.existsSync(extractDir)) fs18.rmSync(extractDir, { recursive: true });
-  fs18.mkdirSync(extractDir, { recursive: true });
+  const extractDir = path29.join(os8.tmpdir(), "wairon-extract");
+  if (fs20.existsSync(extractDir)) fs20.rmSync(extractDir, { recursive: true });
+  fs20.mkdirSync(extractDir, { recursive: true });
   if (isZip) {
     (0, import_child_process2.execSync)(
       `powershell -NoProfile -NonInteractive -Command "Expand-Archive -Path '${tmpFile}' -DestinationPath '${extractDir}' -Force"`,
@@ -22698,18 +23827,18 @@ function installBinary(tmpFile, destPath) {
     (0, import_child_process2.execSync)(`tar -xzf "${tmpFile}" -C "${extractDir}"`, { stdio: ["ignore", "pipe", "pipe"] });
   }
   const binaryName = platform === "win32" ? "wairon.exe" : "wairon";
-  const extractedBinary = path27.join(extractDir, binaryName);
-  if (!fs18.existsSync(extractedBinary)) {
+  const extractedBinary = path29.join(extractDir, binaryName);
+  if (!fs20.existsSync(extractedBinary)) {
     throw new Error(`Extracted binary not found at ${extractedBinary}`);
   }
   if (platform === "win32") {
     const oldPath = destPath + ".old";
     try {
       cleanStaleBinary(oldPath);
-      fs18.renameSync(destPath, oldPath);
-      fs18.copyFileSync(extractedBinary, destPath);
+      fs20.renameSync(destPath, oldPath);
+      fs20.copyFileSync(extractedBinary, destPath);
       try {
-        fs18.unlinkSync(oldPath);
+        fs20.unlinkSync(oldPath);
       } catch {
       }
     } catch (err) {
@@ -22723,25 +23852,25 @@ function installBinary(tmpFile, destPath) {
     }
   } else {
     const tmpDest = destPath + ".new";
-    fs18.copyFileSync(extractedBinary, tmpDest);
-    fs18.chmodSync(tmpDest, 493);
-    fs18.renameSync(tmpDest, destPath);
+    fs20.copyFileSync(extractedBinary, tmpDest);
+    fs20.chmodSync(tmpDest, 493);
+    fs20.renameSync(tmpDest, destPath);
   }
   try {
-    fs18.unlinkSync(tmpFile);
+    fs20.unlinkSync(tmpFile);
   } catch {
   }
   try {
-    fs18.rmSync(extractDir, { recursive: true });
+    fs20.rmSync(extractDir, { recursive: true });
   } catch {
   }
 }
 function cleanStaleBinary(oldPath) {
   const target = oldPath ?? (isPkgBinary2() ? process.execPath + ".old" : null);
   if (!target) return;
-  if (fs18.existsSync(target)) {
+  if (fs20.existsSync(target)) {
     try {
-      fs18.unlinkSync(target);
+      fs20.unlinkSync(target);
     } catch {
     }
   }
@@ -22987,171 +24116,6 @@ async function filteredCheckbox(config) {
 
 // src/commands/domains.ts
 init_loader();
-
-// src/core/detection.ts
-var fs19 = __toESM(require("fs"));
-var path28 = __toESM(require("path"));
-init_defaults();
-var PACKAGE_MARKERS = [
-  "package.json",
-  "pyproject.toml",
-  "Cargo.toml",
-  "go.mod",
-  "build.gradle",
-  "build.gradle.kts",
-  "pom.xml"
-];
-var MAX_SCAN_DEPTH = 5;
-function detectDomainCandidates(projectRoot2, alreadyTrackedPaths = /* @__PURE__ */ new Set(), alreadyTrackedIds = /* @__PURE__ */ new Set()) {
-  const candidates = /* @__PURE__ */ new Map();
-  for (const c of detectGitSubmodules(projectRoot2)) {
-    candidates.set(c.path, { ...c, alreadyTracked: alreadyTrackedPaths.has(c.path) });
-  }
-  for (const c of detectNestedGitRepos(projectRoot2)) {
-    if (!candidates.has(c.path)) {
-      candidates.set(c.path, { ...c, alreadyTracked: alreadyTrackedPaths.has(c.path) });
-    }
-  }
-  const gitPaths = new Set(
-    Array.from(candidates.values()).filter((c) => c.type === "git-submodule" || c.type === "git-repo").map((c) => c.path)
-  );
-  for (const c of detectPackageRoots(projectRoot2)) {
-    if (candidates.has(c.path)) continue;
-    const insideGit = Array.from(gitPaths).some(
-      (gp) => c.path === gp || c.path.startsWith(gp + "/")
-    );
-    if (insideGit) continue;
-    candidates.set(c.path, { ...c, alreadyTracked: alreadyTrackedPaths.has(c.path) });
-  }
-  const sorted = Array.from(candidates.values()).sort((a, b) => a.path.localeCompare(b.path));
-  return deduplicateIds(sorted, alreadyTrackedIds);
-}
-function deduplicateIds(candidates, existingIds = /* @__PURE__ */ new Set()) {
-  const idCount = /* @__PURE__ */ new Map();
-  for (const id of existingIds) {
-    idCount.set(id, (idCount.get(id) ?? 0) + 1);
-  }
-  for (const c of candidates) {
-    idCount.set(c.suggestedId, (idCount.get(c.suggestedId) ?? 0) + 1);
-  }
-  return candidates.map((c) => {
-    if ((idCount.get(c.suggestedId) ?? 0) <= 1) return c;
-    const parts = c.path.split("/");
-    const qualifiedId2 = parts.length >= 2 ? pathToId(`${parts[parts.length - 2]}-${parts[parts.length - 1]}`) : c.suggestedId;
-    return { ...c, suggestedId: qualifiedId2 };
-  });
-}
-function parseGitmodules(filePath) {
-  const content = fs19.readFileSync(filePath, "utf-8");
-  const entries = [];
-  let current2 = {};
-  for (const line2 of content.split("\n")) {
-    const trimmed = line2.trim();
-    const headerMatch = trimmed.match(/^\[submodule "(.+)"\]$/);
-    if (headerMatch) {
-      if (current2.path) entries.push(current2);
-      current2 = { name: headerMatch[1] };
-      continue;
-    }
-    const keyVal = trimmed.match(/^(\w+)\s*=\s*(.+)$/);
-    if (keyVal) {
-      const [, key, value] = keyVal;
-      if (key === "path") current2.path = value.trim();
-      if (key === "url") current2.url = value.trim();
-    }
-  }
-  if (current2.path) entries.push(current2);
-  return entries;
-}
-function detectGitSubmodules(projectRoot2) {
-  const gitmodulesPath = path28.join(projectRoot2, ".gitmodules");
-  if (!fs19.existsSync(gitmodulesPath)) return [];
-  return parseGitmodules(gitmodulesPath).map((entry) => ({
-    suggestedId: pathToId(entry.path),
-    suggestedName: pathToName(entry.path),
-    path: normalizePath3(entry.path),
-    type: "git-submodule",
-    alreadyTracked: false
-  }));
-}
-function detectNestedGitRepos(projectRoot2) {
-  const results = [];
-  walkForGit(projectRoot2, projectRoot2, 0, results);
-  return results;
-}
-function walkForGit(projectRoot2, currentDir, depth, results) {
-  if (depth > MAX_SCAN_DEPTH) return;
-  let entries;
-  try {
-    entries = fs19.readdirSync(currentDir, { withFileTypes: true });
-  } catch {
-    return;
-  }
-  for (const entry of entries) {
-    if (!entry.isDirectory()) continue;
-    if (SCAN_EXCLUDE_DIRS.has(entry.name)) continue;
-    const fullPath = path28.join(currentDir, entry.name);
-    const relPath = normalizePath3(path28.relative(projectRoot2, fullPath));
-    if (relPath === "" || relPath === ".") continue;
-    const gitPath = path28.join(fullPath, ".git");
-    if (fs19.existsSync(gitPath)) {
-      results.push({
-        suggestedId: pathToId(relPath),
-        suggestedName: pathToName(relPath),
-        path: relPath,
-        type: "git-repo",
-        alreadyTracked: false
-      });
-      continue;
-    }
-    walkForGit(projectRoot2, fullPath, depth + 1, results);
-  }
-}
-function detectPackageRoots(projectRoot2) {
-  const results = [];
-  walkForPackages(projectRoot2, projectRoot2, 0, results);
-  return results;
-}
-function walkForPackages(projectRoot2, currentDir, depth, results) {
-  if (depth > MAX_SCAN_DEPTH) return;
-  let entries;
-  try {
-    entries = fs19.readdirSync(currentDir, { withFileTypes: true });
-  } catch {
-    return;
-  }
-  for (const entry of entries) {
-    if (!entry.isDirectory()) continue;
-    if (SCAN_EXCLUDE_DIRS.has(entry.name)) continue;
-    const fullPath = path28.join(currentDir, entry.name);
-    const relPath = normalizePath3(path28.relative(projectRoot2, fullPath));
-    if (relPath === "" || relPath === ".") continue;
-    const hasMarker = PACKAGE_MARKERS.some((m) => fs19.existsSync(path28.join(fullPath, m)));
-    if (hasMarker) {
-      results.push({
-        suggestedId: pathToId(relPath),
-        suggestedName: pathToName(relPath),
-        path: relPath,
-        type: "package-root",
-        alreadyTracked: false
-      });
-    }
-    walkForPackages(projectRoot2, fullPath, depth + 1, results);
-  }
-}
-function pathToId(relPath) {
-  const basename12 = path28.basename(relPath);
-  return basename12.toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
-}
-function pathToName(relPath) {
-  const id = pathToId(relPath);
-  return id.split("-").map((w) => w.charAt(0).toUpperCase() + w.slice(1)).join(" ");
-}
-function normalizePath3(p) {
-  return p.replace(/\\/g, "/");
-}
-
-// src/commands/domains.ts
 init_domains();
 init_domain();
 async function runDomainsList() {
@@ -23341,9 +24305,9 @@ async function runSkillsInstall() {
 }
 
 // src/commands/doctor.ts
-var fs20 = __toESM(require("fs"));
-var os8 = __toESM(require("os"));
-var path29 = __toESM(require("path"));
+var fs21 = __toESM(require("fs"));
+var os9 = __toESM(require("os"));
+var path30 = __toESM(require("path"));
 var import_chalk12 = __toESM(require("chalk"));
 init_logger();
 init_defaults();
@@ -23373,10 +24337,10 @@ function stampVerdict(content) {
   return { mark: "warn", note: `v${v} \u2014 stale, installed is v${WAIRON_VERSION}` };
 }
 function mcpEntryHealth(settingsPath) {
-  if (!fs20.existsSync(settingsPath)) return { mark: "warn", note: "not registered" };
+  if (!fs21.existsSync(settingsPath)) return { mark: "warn", note: "not registered" };
   let entry;
   try {
-    const s = JSON.parse(fs20.readFileSync(settingsPath, "utf8"));
+    const s = JSON.parse(fs21.readFileSync(settingsPath, "utf8"));
     entry = s.mcpServers?.["wairon"];
   } catch {
     return { mark: "error", note: "parse error" };
@@ -23384,7 +24348,7 @@ function mcpEntryHealth(settingsPath) {
   if (!entry) return { mark: "warn", note: "not registered" };
   if (entry.command === "node" && Array.isArray(entry.args) && typeof entry.args[0] === "string") {
     const scriptPath = entry.args[0];
-    if (!fs20.existsSync(scriptPath)) {
+    if (!fs21.existsSync(scriptPath)) {
       return { mark: "error", note: `registered but the server path is missing \u2014 ${scriptPath}` };
     }
   }
@@ -23436,7 +24400,7 @@ async function runDoctor(options = {}) {
     const { findChainingSubprojectsMissingConfig: findChainingSubprojectsMissingConfig2 } = (init_provision(), __toCommonJS(provision_exports));
     const missing = findChainingSubprojectsMissingConfig2(getProjectRoot());
     if (missing.length > 0) {
-      line(tally, "warn", `${missing.length} chained subproject(s) have specs but no project.yaml (un-runnable standalone): ${missing.map((d) => path29.relative(getProjectRoot(), d) || ".").join(", ")}. Run \`wairon doctor --fix\` to initialize them.`);
+      line(tally, "warn", `${missing.length} chained subproject(s) have specs but no project.yaml (un-runnable standalone): ${missing.map((d) => path30.relative(getProjectRoot(), d) || ".").join(", ")}. Run \`wairon doctor --fix\` to initialize them.`);
     }
   } catch {
   }
@@ -23474,7 +24438,7 @@ async function runDoctor(options = {}) {
     const gp = localGuideFilePath(process.cwd(), t);
     if (!gp || seenGuides.has(gp)) continue;
     seenGuides.add(gp);
-    const rel2 = path29.relative(process.cwd(), gp).replace(/\\/g, "/");
+    const rel2 = path30.relative(process.cwd(), gp).replace(/\\/g, "/");
     if (!pathExists(gp)) {
       line(tally, "warn", `${rel2} guide \u2014 not injected (run \`wairon generate\`)`);
       continue;
@@ -23508,17 +24472,17 @@ async function runDoctor(options = {}) {
     line(tally, h.mark, `Claude (project .mcp.json): ${h.note}${h.mark === "ok" ? "" : " \u2014 run `wairon mcp install --backend claude`"}`);
   }
   if (wantGemini) {
-    const globalCfg = path29.join(os8.homedir(), ".gemini", "antigravity-cli", "mcp_config.json");
+    const globalCfg = path30.join(os9.homedir(), ".gemini", "antigravity-cli", "mcp_config.json");
     const hg = mcpEntryHealth(globalCfg);
     line(tally, hg.mark, `Antigravity (global mcp_config.json): ${hg.note}${hg.mark === "ok" ? "" : " \u2014 run `wairon mcp install --backend gemini --global`"}`);
     const projPath = fromProjectRoot(".gemini", "settings.json");
-    if (fs20.existsSync(projPath)) {
+    if (fs21.existsSync(projPath)) {
       const hp = mcpEntryHealth(projPath);
       line(tally, hp.mark === "error" ? "error" : "ok", `Gemini CLI (project): ${hp.note} ${import_chalk12.default.gray("(Antigravity ignores this file)")}`);
     }
   }
-  const pluginDir = path29.join(os8.homedir(), ".gemini", "config", "plugins", "wairon");
-  if (fs20.existsSync(pluginDir)) {
+  const pluginDir = path30.join(os9.homedir(), ".gemini", "config", "plugins", "wairon");
+  if (fs21.existsSync(pluginDir)) {
     line(tally, "warn", `Legacy Antigravity plugin present (${pluginDir}) \u2014 it collides with the wairon MCP server. Remove it with \`wairon doctor --fix\`.`);
   }
   logger.blank();
@@ -23549,7 +24513,7 @@ async function applyFixes() {
     const legacySpecs = findLegacySpecFiles();
     if (legacySpecs.length > 0) {
       for (const { path: oldPath, expected: newPath } of legacySpecs) {
-        fs20.renameSync(oldPath, newPath);
+        fs21.renameSync(oldPath, newPath);
       }
       console.log(`  ${icon("ok")} Migrated ${legacySpecs.length} legacy spec file(s) to the new dot-prefixed unified schema.`);
     }
@@ -23603,8 +24567,8 @@ function printSummary(tally) {
 }
 
 // src/commands/diagram.ts
-var fs21 = __toESM(require("fs"));
-var path30 = __toESM(require("path"));
+var fs22 = __toESM(require("fs"));
+var path31 = __toESM(require("path"));
 init_logger();
 init_loader();
 init_fs();
@@ -23639,8 +24603,8 @@ function collectIssues() {
 }
 function writeCanvas(dest) {
   const model = buildCanvasModel(collectIssues());
-  ensureDir(path30.dirname(path30.resolve(dest)));
-  fs21.writeFileSync(dest, renderCanvasHtml(model), "utf-8");
+  ensureDir(path31.dirname(path31.resolve(dest)));
+  fs22.writeFileSync(dest, renderCanvasHtml(model), "utf-8");
 }
 function parseSequenceRef(ref) {
   const sep6 = ref.includes(":") ? ref.lastIndexOf(":") : ref.lastIndexOf(".");
@@ -23655,55 +24619,55 @@ async function runDiagram(rawOptions = {}) {
   assertProjectInitialized();
   const options = applyFormat(rawOptions);
   if (options.canvas && !options.all) {
-    const dest2 = options.out ?? path30.join(AI_PATHS.docsDir(), "diagrams", "canvas.html");
+    const dest2 = options.out ?? path31.join(AI_PATHS.docsDir(), "diagrams", "canvas.html");
     writeCanvas(dest2);
     logger.success(`Interactive canvas written to ${dest2}`);
     logger.info("Open it in a browser \u2014 fully self-contained (works offline).");
     return;
   }
   if (options.drawio && !options.all) {
-    const dest2 = options.out ?? path30.join(AI_PATHS.docsDir(), "diagrams", "architecture.drawio");
-    ensureDir(path30.dirname(path30.resolve(dest2)));
-    fs21.writeFileSync(dest2, generateDrawioXml(buildCanvasModel()), "utf-8");
+    const dest2 = options.out ?? path31.join(AI_PATHS.docsDir(), "diagrams", "architecture.drawio");
+    ensureDir(path31.dirname(path31.resolve(dest2)));
+    fs22.writeFileSync(dest2, generateDrawioXml(buildCanvasModel()), "utf-8");
     logger.success(`draw.io diagram written to ${dest2}`);
     logger.info("Open with draw.io / diagrams.net (or import into tools that accept the format).");
     return;
   }
   if (options.excalidraw && !options.all) {
-    const dest2 = options.out ?? path30.join(AI_PATHS.docsDir(), "diagrams", "architecture.excalidraw");
-    ensureDir(path30.dirname(path30.resolve(dest2)));
-    fs21.writeFileSync(dest2, generateExcalidrawScene(buildCanvasModel()), "utf-8");
+    const dest2 = options.out ?? path31.join(AI_PATHS.docsDir(), "diagrams", "architecture.excalidraw");
+    ensureDir(path31.dirname(path31.resolve(dest2)));
+    fs22.writeFileSync(dest2, generateExcalidrawScene(buildCanvasModel()), "utf-8");
     logger.success(`Excalidraw scene written to ${dest2}`);
     logger.info("Open with excalidraw.com or the VS Code extension.");
     return;
   }
   const wantsMermaid = options.format?.toLowerCase().startsWith("mermaid") || !!options.subsystem || !!options.sequence;
   if (!options.all && !options.sequence && !wantsMermaid) {
-    const dest2 = options.out ?? path30.join(AI_PATHS.docsDir(), "diagrams", "canvas.html");
+    const dest2 = options.out ?? path31.join(AI_PATHS.docsDir(), "diagrams", "canvas.html");
     writeCanvas(dest2);
     logger.success(`Interactive canvas written to ${dest2}`);
     logger.info("Open it in a browser \u2014 fully self-contained (works offline). Other formats: --format mermaid|drawio|excalidraw.");
     return;
   }
   if (options.all) {
-    const outDir = options.out ?? path30.join(AI_PATHS.docsDir(), "diagrams");
+    const outDir = options.out ?? path31.join(AI_PATHS.docsDir(), "diagrams");
     const files = generateDiagramSet();
     if (files.length === 0) {
       logger.warn("No diagrams to generate \u2014 the spec tree has no components yet.");
       return;
     }
     for (const file of files) {
-      const dest2 = path30.join(outDir, file.relPath);
-      ensureDir(path30.dirname(dest2));
-      fs21.writeFileSync(dest2, toMarkdown(file), "utf-8");
+      const dest2 = path31.join(outDir, file.relPath);
+      ensureDir(path31.dirname(dest2));
+      fs22.writeFileSync(dest2, toMarkdown(file), "utf-8");
     }
-    writeCanvas(path30.join(outDir, "canvas.html"));
+    writeCanvas(path31.join(outDir, "canvas.html"));
     const exportModel = buildCanvasModel();
-    fs21.writeFileSync(path30.join(outDir, "architecture.drawio"), generateDrawioXml(exportModel), "utf-8");
-    fs21.writeFileSync(path30.join(outDir, "architecture.excalidraw"), generateExcalidrawScene(exportModel), "utf-8");
+    fs22.writeFileSync(path31.join(outDir, "architecture.drawio"), generateDrawioXml(exportModel), "utf-8");
+    fs22.writeFileSync(path31.join(outDir, "architecture.excalidraw"), generateExcalidrawScene(exportModel), "utf-8");
     const graph = loadSpecGraph();
-    const indexPath = path30.join(outDir, "README.md");
-    fs21.writeFileSync(indexPath, diagramSetIndex(files, graph.systemName), "utf-8");
+    const indexPath = path31.join(outDir, "README.md");
+    fs22.writeFileSync(indexPath, diagramSetIndex(files, graph.systemName), "utf-8");
     logger.success(`Generated ${files.length} diagram(s) + interactive canvas.html + index into ${outDir}`);
     for (const file of files.slice(0, 12)) {
       logger.info(`  ${file.relPath}`);
@@ -23714,26 +24678,26 @@ async function runDiagram(rawOptions = {}) {
   let mermaid;
   let title;
   let defaultDest;
-  const diagramsDir = path30.join(AI_PATHS.docsDir(), "diagrams");
+  const diagramsDir = path31.join(AI_PATHS.docsDir(), "diagrams");
   if (options.sequence) {
     const { component, method: method2 } = parseSequenceRef(options.sequence);
     mermaid = generateSequenceDiagram(component, method2, { depth: options.depth });
     title = `${component}.${method2} \u2014 narrative sequence`;
-    defaultDest = path30.join(diagramsDir, "sequences", `${component.replace(/::/g, "--")}.${method2}.md`);
+    defaultDest = path31.join(diagramsDir, "sequences", `${component.replace(/::/g, "--")}.${method2}.md`);
   } else if (options.subsystem) {
     mermaid = generateComponentDiagram({ subsystem: options.subsystem });
     title = `${options.subsystem} \u2014 components`;
-    defaultDest = path30.join(diagramsDir, "subsystems", `${options.subsystem.replace(/::/g, "--")}.md`);
+    defaultDest = path31.join(diagramsDir, "subsystems", `${options.subsystem.replace(/::/g, "--")}.md`);
   } else {
     mermaid = generateComponentDiagram();
     title = "Component architecture";
-    defaultDest = path30.join(diagramsDir, "system.md");
+    defaultDest = path31.join(diagramsDir, "system.md");
   }
   const dest = options.out ?? defaultDest;
-  ensureDir(path30.dirname(path30.resolve(dest)));
+  ensureDir(path31.dirname(path31.resolve(dest)));
   const content = dest.endsWith(".mmd") ? `${mermaid}
 ` : toMarkdown({ relPath: dest, title, mermaid });
-  fs21.writeFileSync(dest, content, "utf-8");
+  fs22.writeFileSync(dest, content, "utf-8");
   logger.success(`Mermaid diagram written to ${dest}`);
   logger.info("Renders on GitHub/IDE previews; use a .mmd --out path for raw Mermaid.");
 }
@@ -23842,8 +24806,8 @@ Component variants (${variants.length})
 }
 
 // src/commands/packs.ts
-var fs22 = __toESM(require("fs"));
-var path31 = __toESM(require("path"));
+var fs23 = __toESM(require("fs"));
+var path32 = __toESM(require("path"));
 var import_chalk16 = __toESM(require("chalk"));
 var import_sdk = __toESM(require_dist());
 init_logger();
@@ -23869,11 +24833,11 @@ function describe(probe2) {
   return parts.join(", ");
 }
 function resolveSourceUnit(source) {
-  const abs = path31.resolve(source);
-  if (!fs22.existsSync(abs)) {
+  const abs = path32.resolve(source);
+  if (!fs23.existsSync(abs)) {
     throw new Error(`Pack source "${source}" does not exist.`);
   }
-  const isDir = fs22.statSync(abs).isDirectory();
+  const isDir = fs23.statSync(abs).isDirectory();
   if (isDir && !packDirEntry(abs)) {
     throw new Error(`"${source}" is a directory without a pack entry file (pack.yaml | pack.cjs | index.cjs | ...).`);
   }
@@ -23889,7 +24853,7 @@ async function addPack(source, options = {}) {
   }
   const { abs } = resolveSourceUnit(source);
   const scope = options.global ? "global" : "project";
-  const probe2 = probePack(abs, path31.dirname(abs), scope);
+  const probe2 = probePack(abs, path32.dirname(abs), scope);
   if (probe2.error) {
     logger.error(probe2.error);
     process.exitCode = 1;
@@ -23897,10 +24861,10 @@ async function addPack(source, options = {}) {
   }
   if (options.global) {
     const destDir = globalPacksDir();
-    const dest2 = path31.join(destDir, path31.basename(abs));
-    if (path31.resolve(dest2) !== abs) {
-      fs22.mkdirSync(destDir, { recursive: true });
-      fs22.cpSync(abs, dest2, { recursive: true, force: true });
+    const dest2 = path32.join(destDir, path32.basename(abs));
+    if (path32.resolve(dest2) !== abs) {
+      fs23.mkdirSync(destDir, { recursive: true });
+      fs23.cpSync(abs, dest2, { recursive: true, force: true });
     }
     logger.success(`Installed pack "${probe2.name}" globally: ${dest2}`);
     logger.info(`${describe(probe2)} \u2014 auto-loaded for every project on this machine (WAIRON_PACKS_DIR / ~/.wairon/packs).`);
@@ -23913,11 +24877,11 @@ async function addPack(source, options = {}) {
     return;
   }
   const root = getProjectRoot();
-  const relRef = `.wai/packs/${path31.basename(abs)}`;
-  const dest = path31.join(root, ".wai", "packs", path31.basename(abs));
-  if (path31.resolve(dest) !== abs) {
-    fs22.mkdirSync(path31.dirname(dest), { recursive: true });
-    fs22.cpSync(abs, dest, { recursive: true, force: true });
+  const relRef = `.wai/packs/${path32.basename(abs)}`;
+  const dest = path32.join(root, ".wai", "packs", path32.basename(abs));
+  if (path32.resolve(dest) !== abs) {
+    fs23.mkdirSync(path32.dirname(dest), { recursive: true });
+    fs23.cpSync(abs, dest, { recursive: true, force: true });
   }
   const config = loadProjectConfig();
   const packs = config.extensions?.packs ?? [];
@@ -23926,14 +24890,14 @@ async function addPack(source, options = {}) {
     saveProjectConfig(config);
     logger.success(`Vendored pack "${probe2.name}" into ${relRef} and registered it in .wai/project.yaml.`);
   } else {
-    fs22.cpSync(abs, dest, { recursive: true, force: true });
+    fs23.cpSync(abs, dest, { recursive: true, force: true });
     logger.success(`Pack "${probe2.name}" already registered \u2014 refreshed ${relRef} from the source.`);
   }
   logger.info(`${describe(probe2)} \u2014 commit .wai/ so CI and every clone enforce it.`);
 }
 async function addPackFromArchive(source, options) {
-  const abs = path31.resolve(source);
-  if (!fs22.existsSync(abs) || !fs22.statSync(abs).isFile()) {
+  const abs = path32.resolve(source);
+  if (!fs23.existsSync(abs) || !fs23.statSync(abs).isFile()) {
     logger.error(`Pack archive "${source}" does not exist.`);
     process.exitCode = 1;
     return;
@@ -23948,27 +24912,27 @@ async function addPackFromArchive(source, options) {
       process.exitCode = 1;
       return;
     }
-    baseDir = path31.join(getProjectRoot(), ".wai", "packs");
+    baseDir = path32.join(getProjectRoot(), ".wai", "packs");
   }
-  const bytes = fs22.readFileSync(abs);
-  fs22.mkdirSync(baseDir, { recursive: true });
-  const staging = fs22.mkdtempSync(path31.join(baseDir, ".wpack-staging-"));
+  const bytes = fs23.readFileSync(abs);
+  fs23.mkdirSync(baseDir, { recursive: true });
+  const staging = fs23.mkdtempSync(path32.join(baseDir, ".wpack-staging-"));
   let result;
   try {
     result = (0, import_sdk.extractPack)(bytes, staging);
   } catch (err) {
-    fs22.rmSync(staging, { recursive: true, force: true });
-    logger.error(`Failed to extract pack archive "${path31.basename(abs)}": ${err instanceof Error ? err.message : String(err)}`);
+    fs23.rmSync(staging, { recursive: true, force: true });
+    logger.error(`Failed to extract pack archive "${path32.basename(abs)}": ${err instanceof Error ? err.message : String(err)}`);
     process.exitCode = 1;
     return;
   }
   const name = result.name;
-  const destDir = path31.join(baseDir, name);
-  if (fs22.existsSync(destDir)) fs22.rmSync(destDir, { recursive: true, force: true });
-  fs22.renameSync(staging, destDir);
-  const probe2 = probePack(destDir, path31.dirname(destDir), scope);
+  const destDir = path32.join(baseDir, name);
+  if (fs23.existsSync(destDir)) fs23.rmSync(destDir, { recursive: true, force: true });
+  fs23.renameSync(staging, destDir);
+  const probe2 = probePack(destDir, path32.dirname(destDir), scope);
   if (probe2.error) {
-    fs22.rmSync(destDir, { recursive: true, force: true });
+    fs23.rmSync(destDir, { recursive: true, force: true });
     logger.error(probe2.error);
     process.exitCode = 1;
     return;
@@ -23986,7 +24950,7 @@ async function addPackFromArchive(source, options) {
     saveProjectConfig(config);
     logger.success(`Installed pack "${probe2.name ?? name}" into ${relRef} and registered it in .wai/project.yaml.`);
   } else {
-    logger.success(`Pack "${probe2.name ?? name}" already registered \u2014 refreshed ${relRef} from ${path31.basename(abs)}.`);
+    logger.success(`Pack "${probe2.name ?? name}" already registered \u2014 refreshed ${relRef} from ${path32.basename(abs)}.`);
   }
   logger.info(`${describe(probe2)} \u2014 commit .wai/ so CI and every clone enforce it.`);
 }
@@ -24007,7 +24971,7 @@ async function buildPack(source, options = {}) {
   const sourceDir = source && source.length > 0 ? source : ".";
   const result = (0, import_sdk.buildPack)(sourceDir);
   const outPath = options.out ?? result.suggestedFileName;
-  fs22.writeFileSync(outPath, result.archive);
+  fs23.writeFileSync(outPath, result.archive);
   logger.success(`Built pack "${result.info.name}" v${result.info.version} \u2192 ${outPath} (${result.archive.byteLength} bytes)`);
   logger.info(`Install it with \`wairon pack add ${outPath}\`, or upload it to a hosted instance.`);
 }
@@ -24021,9 +24985,9 @@ async function listPacks() {
   console.log(import_chalk16.default.bold.cyan(`\u25A0 Global (${globalPacksDir()})${useGlobal ? "" : import_chalk16.default.yellow("  [disabled: extensions.useGlobalPacks: false]")}`));
   if (globalRefs.length === 0) console.log(import_chalk16.default.dim("  (none)"));
   for (const ref of globalRefs) {
-    const probe2 = probePack(ref, path31.dirname(ref), "global");
-    if (probe2.error) console.log(`  ${import_chalk16.default.red("\u2716")} ${path31.basename(ref)} \u2014 ${import_chalk16.default.red(probe2.error)}`);
-    else console.log(`  ${import_chalk16.default.green("\u25CF")} ${import_chalk16.default.bold(probe2.name ?? path31.basename(ref))}  ${import_chalk16.default.dim(describe(probe2))}`);
+    const probe2 = probePack(ref, path32.dirname(ref), "global");
+    if (probe2.error) console.log(`  ${import_chalk16.default.red("\u2716")} ${path32.basename(ref)} \u2014 ${import_chalk16.default.red(probe2.error)}`);
+    else console.log(`  ${import_chalk16.default.green("\u25CF")} ${import_chalk16.default.bold(probe2.name ?? path32.basename(ref))}  ${import_chalk16.default.dim(describe(probe2))}`);
   }
   console.log("");
   if (!inProject) {
@@ -24044,9 +25008,9 @@ async function listPacks() {
 async function removePack(name, options = {}) {
   if (options.global) {
     for (const ref of discoverPacks(globalPacksDir())) {
-      const probe2 = probePack(ref, path31.dirname(ref), "global");
-      if (probe2.name === name || path31.basename(ref) === name) {
-        fs22.rmSync(ref, { recursive: true, force: true });
+      const probe2 = probePack(ref, path32.dirname(ref), "global");
+      if (probe2.name === name || path32.basename(ref) === name) {
+        fs23.rmSync(ref, { recursive: true, force: true });
         logger.success(`Removed global pack "${probe2.name ?? name}" (${ref}).`);
         return;
       }
@@ -24065,16 +25029,16 @@ async function removePack(name, options = {}) {
   const packs = config.extensions?.packs ?? [];
   for (const ref of packs) {
     const probe2 = probePack(ref, root, "project");
-    if (probe2.name === name || ref === name || path31.basename(ref) === name) {
+    if (probe2.name === name || ref === name || path32.basename(ref) === name) {
       config.extensions = {
         packs: packs.filter((p) => p !== ref),
         useGlobalPacks: config.extensions?.useGlobalPacks ?? true
       };
       saveProjectConfig(config);
-      const resolved = path31.resolve(root, ref);
-      const vendorDir = path31.resolve(root, ".wai", "packs");
-      if (resolved.startsWith(vendorDir + path31.sep)) {
-        fs22.rmSync(resolved, { recursive: true, force: true });
+      const resolved = path32.resolve(root, ref);
+      const vendorDir = path32.resolve(root, ".wai", "packs");
+      if (resolved.startsWith(vendorDir + path32.sep)) {
+        fs23.rmSync(resolved, { recursive: true, force: true });
         logger.success(`Deregistered pack "${probe2.name ?? name}" and deleted ${ref}.`);
       } else {
         logger.success(`Deregistered pack "${probe2.name ?? name}" (files at ${ref} left in place).`);
@@ -24088,8 +25052,8 @@ async function removePack(name, options = {}) {
 
 // src/commands/host.ts
 var fs50 = __toESM(require("fs"));
-var path60 = __toESM(require("path"));
-var os9 = __toESM(require("os"));
+var path59 = __toESM(require("path"));
+var os10 = __toESM(require("os"));
 var crypto20 = __toESM(require("crypto"));
 var import_child_process5 = require("child_process");
 var import_chalk17 = __toESM(require("chalk"));
@@ -24116,29 +25080,29 @@ var UNAUTHENTICATED = {
 var WEB_SESSION_PREFIX = "ws_";
 
 // src/server/credentials.ts
-var fs23 = __toESM(require("fs"));
-var path32 = __toESM(require("path"));
+var fs24 = __toESM(require("fs"));
+var path33 = __toESM(require("path"));
 var crypto3 = __toESM(require("crypto"));
 var HASH_NS = "wairon:token:v1";
 function hashToken(token) {
   return crypto3.createHash("sha256").update(`${HASH_NS}:${token}`).digest("hex");
 }
 function storePath(dataDir) {
-  return path32.join(dataDir, "auth", "credentials.json");
+  return path33.join(dataDir, "auth", "credentials.json");
 }
 function load3(dataDir) {
   try {
-    return JSON.parse(fs23.readFileSync(storePath(dataDir), "utf8"));
+    return JSON.parse(fs24.readFileSync(storePath(dataDir), "utf8"));
   } catch {
     return [];
   }
 }
 function save(dataDir, records) {
   const p = storePath(dataDir);
-  fs23.mkdirSync(path32.dirname(p), { recursive: true });
+  fs24.mkdirSync(path33.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
-  fs23.writeFileSync(tmp, JSON.stringify(records, null, 2) + "\n");
-  fs23.renameSync(tmp, p);
+  fs24.writeFileSync(tmp, JSON.stringify(records, null, 2) + "\n");
+  fs24.renameSync(tmp, p);
 }
 function digestEquals(a, b) {
   const ab = Buffer.from(a, "hex");
@@ -24183,17 +25147,17 @@ function listByOwner(dataDir, ownerUserId) {
 }
 
 // src/server/websessions.ts
-var fs24 = __toESM(require("fs"));
-var path33 = __toESM(require("path"));
+var fs25 = __toESM(require("fs"));
+var path34 = __toESM(require("path"));
 var crypto4 = __toESM(require("crypto"));
 function storePath2(dataDir) {
-  return path33.join(dataDir, "web-sessions.json");
+  return path34.join(dataDir, "web-sessions.json");
 }
 function readSessions(dataDir) {
   const p = storePath2(dataDir);
   let raw;
   try {
-    raw = fs24.readFileSync(p, "utf8");
+    raw = fs25.readFileSync(p, "utf8");
   } catch (e) {
     if (e.code === "ENOENT") return [];
     throw new Error(`Failed to read web session store at ${p}: ${e.message}`);
@@ -24208,10 +25172,10 @@ function readSessions(dataDir) {
 }
 function persistSessions(dataDir, sessions) {
   const p = storePath2(dataDir);
-  fs24.mkdirSync(path33.dirname(p), { recursive: true });
+  fs25.mkdirSync(path34.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
-  fs24.writeFileSync(tmp, JSON.stringify(sessions, null, 2) + "\n");
-  fs24.renameSync(tmp, p);
+  fs25.writeFileSync(tmp, JSON.stringify(sessions, null, 2) + "\n");
+  fs25.renameSync(tmp, p);
 }
 function mintSessionId() {
   return `${WEB_SESSION_PREFIX}${crypto4.randomBytes(24).toString("hex")}`;
@@ -24372,17 +25336,17 @@ function listWebSessionsBySubject(dataDir, userId) {
 }
 
 // src/server/users.ts
-var fs25 = __toESM(require("fs"));
-var path34 = __toESM(require("path"));
+var fs26 = __toESM(require("fs"));
+var path35 = __toESM(require("path"));
 var VALID_STATUSES = ["active", "inactive", "suspended", "deactivated", "disabled"];
 function storePath3(dataDir) {
-  return path34.join(dataDir, "users.json");
+  return path35.join(dataDir, "users.json");
 }
 function loadStore(dataDir) {
   const p = storePath3(dataDir);
   let raw;
   try {
-    raw = fs25.readFileSync(p, "utf8");
+    raw = fs26.readFileSync(p, "utf8");
   } catch (err) {
     if (err.code === "ENOENT") return [];
     throw new Error(`Cannot read hosted-user store at ${p}: ${err.message}`);
@@ -24400,10 +25364,10 @@ function loadStore(dataDir) {
 }
 function replaceAll(dataDir, records) {
   const p = storePath3(dataDir);
-  fs25.mkdirSync(path34.dirname(p), { recursive: true });
+  fs26.mkdirSync(path35.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
-  fs25.writeFileSync(tmp, JSON.stringify(records, null, 2) + "\n");
-  fs25.renameSync(tmp, p);
+  fs26.writeFileSync(tmp, JSON.stringify(records, null, 2) + "\n");
+  fs26.renameSync(tmp, p);
 }
 function registryUpsert(dataDir, record2) {
   const records = loadStore(dataDir);
@@ -24505,11 +25469,11 @@ function remapUnitReferences(dataDir, remap, removedScopeIds) {
 }
 
 // src/server/instance.ts
-var fs26 = __toESM(require("fs"));
-var path35 = __toESM(require("path"));
+var fs27 = __toESM(require("fs"));
+var path36 = __toESM(require("path"));
 var import_crypto = require("crypto");
 function storePath4(dataDir) {
-  return path35.join(dataDir, "instance.json");
+  return path36.join(dataDir, "instance.json");
 }
 var InstanceIdentityStore = class {
   constructor(dataDir) {
@@ -24526,7 +25490,7 @@ var InstanceIdentityStore = class {
     const p = storePath4(this.dataDir);
     let raw;
     try {
-      raw = fs26.readFileSync(p, "utf8");
+      raw = fs27.readFileSync(p, "utf8");
     } catch (err) {
       if (err.code === "ENOENT") return null;
       throw new Error(`Cannot read instance identity at ${p}: ${err.message}`);
@@ -24549,10 +25513,10 @@ var InstanceIdentityStore = class {
    *  never truncates the file. Only called by the registry's create-once seed. */
   replace(identity) {
     const p = storePath4(this.dataDir);
-    fs26.mkdirSync(path35.dirname(p), { recursive: true });
+    fs27.mkdirSync(path36.dirname(p), { recursive: true });
     const tmp = `${p}.tmp`;
-    fs26.writeFileSync(tmp, JSON.stringify(identity, null, 2) + "\n");
-    fs26.renameSync(tmp, p);
+    fs27.writeFileSync(tmp, JSON.stringify(identity, null, 2) + "\n");
+    fs27.renameSync(tmp, p);
   }
 };
 var InstanceIdentityRegistry = class {
@@ -24608,8 +25572,8 @@ function getInstanceIdentity(dataDir) {
 }
 
 // src/utils/secrets.ts
-var fs27 = __toESM(require("fs"));
-var path36 = __toESM(require("path"));
+var fs28 = __toESM(require("fs"));
+var path37 = __toESM(require("path"));
 var ENV_FALLBACK = {
   "git-token": ["WAIRON_GIT_TOKEN"],
   "notion-token": ["WAIRON_NOTION_TOKEN"],
@@ -24618,13 +25582,13 @@ var ENV_FALLBACK = {
 };
 function storePath5() {
   const dataDir = process.env["WAIRON_DATA_DIR"];
-  return dataDir ? path36.join(dataDir, "auth", "secrets.json") : null;
+  return dataDir ? path37.join(dataDir, "auth", "secrets.json") : null;
 }
 function readStore() {
   const p = storePath5();
   if (!p) return {};
   try {
-    return JSON.parse(fs27.readFileSync(p, "utf8"));
+    return JSON.parse(fs28.readFileSync(p, "utf8"));
   } catch {
     return {};
   }
@@ -24649,10 +25613,10 @@ function setSecret(key, value) {
   if (!p) throw new Error("WAIRON_DATA_DIR is not set \u2014 a running server needs it to store secrets.");
   const store = readStore();
   store[key] = value;
-  fs27.mkdirSync(path36.dirname(p), { recursive: true });
+  fs28.mkdirSync(path37.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
-  fs27.writeFileSync(tmp, JSON.stringify(store, null, 2) + "\n");
-  fs27.renameSync(tmp, p);
+  fs28.writeFileSync(tmp, JSON.stringify(store, null, 2) + "\n");
+  fs28.renameSync(tmp, p);
 }
 function listSecretKeys() {
   return Object.keys(readStore());
@@ -24860,17 +25824,17 @@ function verifySsoState(state) {
 }
 
 // src/server/organization.ts
-var fs28 = __toESM(require("fs"));
-var path37 = __toESM(require("path"));
+var fs29 = __toESM(require("fs"));
+var path38 = __toESM(require("path"));
 var crypto6 = __toESM(require("crypto"));
 function storePath6(dataDir) {
-  return path37.join(dataDir, "organization.json");
+  return path38.join(dataDir, "organization.json");
 }
 function readState(dataDir) {
   const p = storePath6(dataDir);
   let raw;
   try {
-    raw = fs28.readFileSync(p, "utf8");
+    raw = fs29.readFileSync(p, "utf8");
   } catch (e) {
     if (e.code === "ENOENT") return { units: [], placements: [] };
     throw new Error(`Failed to read organization store at ${p}: ${e.message}`);
@@ -24887,10 +25851,10 @@ function readState(dataDir) {
 }
 function persistState(dataDir, state) {
   const p = storePath6(dataDir);
-  fs28.mkdirSync(path37.dirname(p), { recursive: true });
+  fs29.mkdirSync(path38.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
-  fs28.writeFileSync(tmp, JSON.stringify(state, null, 2) + "\n");
-  fs28.renameSync(tmp, p);
+  fs29.writeFileSync(tmp, JSON.stringify(state, null, 2) + "\n");
+  fs29.renameSync(tmp, p);
 }
 var SLUG_PATTERN = /^[a-z0-9-]+$/;
 var UNIT_KINDS = ["business_entity", "department", "team", "group"];
@@ -25259,11 +26223,11 @@ function getOrganizationUnit(dataDir, id) {
 }
 
 // src/server/permissions.ts
-var fs29 = __toESM(require("fs"));
-var path38 = __toESM(require("path"));
+var fs30 = __toESM(require("fs"));
+var path39 = __toESM(require("path"));
 var import_crypto2 = require("crypto");
 function storePath7(dataDir) {
-  return path38.join(dataDir, "permissions.json");
+  return path39.join(dataDir, "permissions.json");
 }
 function assignmentKey(a) {
   return [a.subjectKind, a.subjectId ?? "", a.scopeKind, a.scopeId ?? "", a.capability].join("|");
@@ -25272,7 +26236,7 @@ function load4(dataDir) {
   const p = storePath7(dataDir);
   let raw;
   try {
-    raw = fs29.readFileSync(p, "utf8");
+    raw = fs30.readFileSync(p, "utf8");
   } catch (err) {
     if (err.code === "ENOENT") return [];
     throw new Error(`Cannot read permission store at ${p}: ${err.message}`);
@@ -25290,10 +26254,10 @@ function load4(dataDir) {
 }
 function replaceAll2(dataDir, assignments) {
   const p = storePath7(dataDir);
-  fs29.mkdirSync(path38.dirname(p), { recursive: true });
+  fs30.mkdirSync(path39.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
-  fs29.writeFileSync(tmp, JSON.stringify(assignments, null, 2) + "\n");
-  fs29.renameSync(tmp, p);
+  fs30.writeFileSync(tmp, JSON.stringify(assignments, null, 2) + "\n");
+  fs30.renameSync(tmp, p);
 }
 function registrySet(dataDir, assignment) {
   const assignments = load4(dataDir);
@@ -25379,8 +26343,8 @@ function getAssignment(dataDir, assignmentId) {
 }
 
 // src/server/roles.ts
-var fs30 = __toESM(require("fs"));
-var path39 = __toESM(require("path"));
+var fs31 = __toESM(require("fs"));
+var path40 = __toESM(require("path"));
 var BUILTIN_ROLES = [
   {
     id: SSO_ADMIN_ROLE_ID,
@@ -25398,13 +26362,13 @@ function isBuiltinRoleId(roleId) {
   return BUILTIN_ROLE_IDS.has(roleId);
 }
 function storePath8(dataDir) {
-  return path39.join(dataDir, "roles.json");
+  return path40.join(dataDir, "roles.json");
 }
 function load5(dataDir) {
   const p = storePath8(dataDir);
   let raw;
   try {
-    raw = fs30.readFileSync(p, "utf8");
+    raw = fs31.readFileSync(p, "utf8");
   } catch (err) {
     if (err.code === "ENOENT") return [];
     throw new Error(`Cannot read role store at ${p}: ${err.message}`);
@@ -25422,10 +26386,10 @@ function load5(dataDir) {
 }
 function replaceAll3(dataDir, roles) {
   const p = storePath8(dataDir);
-  fs30.mkdirSync(path39.dirname(p), { recursive: true });
+  fs31.mkdirSync(path40.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
-  fs30.writeFileSync(tmp, JSON.stringify(roles, null, 2) + "\n");
-  fs30.renameSync(tmp, p);
+  fs31.writeFileSync(tmp, JSON.stringify(roles, null, 2) + "\n");
+  fs31.renameSync(tmp, p);
 }
 function registryCreate(dataDir, role) {
   if (isBuiltinRoleId(role.id)) {
@@ -25659,131 +26623,14 @@ function actionableUnitIds(scopes) {
 }
 
 // src/server/projects.ts
-var fs31 = __toESM(require("fs"));
-var path40 = __toESM(require("path"));
-var ID_RE = /^[a-z0-9][a-z0-9-]{0,63}$/;
-function isValidProjectId(id) {
-  return typeof id === "string" && ID_RE.test(id);
-}
-function registryPath(dataDir) {
-  return path40.join(dataDir, "projects.json");
-}
-function load6(dataDir) {
-  try {
-    return JSON.parse(fs31.readFileSync(registryPath(dataDir), "utf8"));
-  } catch {
-    return [];
-  }
-}
-function save2(dataDir, records) {
-  const p = registryPath(dataDir);
-  fs31.mkdirSync(path40.dirname(p), { recursive: true });
-  const tmp = `${p}.tmp`;
-  fs31.writeFileSync(tmp, JSON.stringify(records, null, 2) + "\n");
-  fs31.renameSync(tmp, p);
-}
-function projectRoot(dataDir, id) {
-  return path40.join(dataDir, "projects", id);
-}
-function existingProjectRoot(dataDir, id) {
-  if (!isValidProjectId(id)) return null;
-  const rec = load6(dataDir).find((r) => r.id === id);
-  return rec ? rec.rootPath : null;
-}
-function createProjectRecord(dataDir, id) {
-  if (!isValidProjectId(id)) {
-    throw new Error(`Invalid project id "${id}" (allowed: lowercase letters, digits, hyphen).`);
-  }
-  const records = load6(dataDir);
-  if (records.some((r) => r.id === id)) {
-    throw new Error(`Project "${id}" already exists.`);
-  }
-  const root = projectRoot(dataDir, id);
-  fs31.mkdirSync(root, { recursive: true });
-  const record2 = {
-    id,
-    rootPath: root,
-    status: "active",
-    createdAt: (/* @__PURE__ */ new Date()).toISOString()
-  };
-  records.push(record2);
-  save2(dataDir, records);
-  return record2;
-}
-function registerLocalDevProject(dataDir, id, rootPath) {
-  if (!isValidProjectId(id)) {
-    throw new Error(`Invalid project id "${id}" (allowed: lowercase letters, digits, hyphen).`);
-  }
-  const records = load6(dataDir);
-  const existing = records.find((r) => r.id === id);
-  const record2 = {
-    id,
-    rootPath,
-    status: "active",
-    createdAt: existing?.createdAt ?? (/* @__PURE__ */ new Date()).toISOString()
-  };
-  const next = existing ? records.map((r) => r.id === id ? record2 : r) : [...records, record2];
-  save2(dataDir, next);
-  return record2;
-}
-function listProjectRecords(dataDir) {
-  return load6(dataDir);
-}
-function removeProjectRecord(dataDir, id) {
-  const records = load6(dataDir);
-  const rec = records.find((r) => r.id === id);
-  if (rec) {
-    try {
-      fs31.rmSync(rec.rootPath, { recursive: true, force: true });
-    } catch {
-    }
-  }
-  save2(dataDir, records.filter((r) => r.id !== id));
-}
-function resolveProjectRoot(dataDir, principal, selector) {
-  const authorized = principal.projects;
-  const wildcard = authorized.includes("*");
-  let target;
-  if (selector) {
-    if (!wildcard && !authorized.includes(selector)) return null;
-    target = selector;
-  } else if (!wildcard && authorized.length === 1) {
-    target = authorized[0];
-  } else {
-    return null;
-  }
-  if (!isValidProjectId(target)) return null;
-  const rec = load6(dataDir).find((r) => r.id === target);
-  if (!rec || rec.status !== "active") return null;
-  return rec.rootPath;
-}
-
-// src/server/adapters.ts
-init_statehash();
-
-// src/core/lockfile.ts
-var fs32 = __toESM(require("fs"));
-var path41 = __toESM(require("path"));
+var fs35 = __toESM(require("fs"));
+var path44 = __toESM(require("path"));
+init_loader();
+init_yaml();
 init_fs();
-function lockPath() {
-  return aiDir("lock.json");
-}
-function readLockRecord() {
-  try {
-    return JSON.parse(fs32.readFileSync(lockPath(), "utf8"));
-  } catch {
-    return null;
-  }
-}
-function writeLockRecord(record2) {
-  const p = lockPath();
-  fs32.mkdirSync(path41.dirname(p), { recursive: true });
-  const tmp = `${p}.tmp`;
-  fs32.writeFileSync(tmp, JSON.stringify(record2, null, 2) + "\n");
-  fs32.renameSync(tmp, p);
-}
 
 // src/server/adapters.ts
+init_statehash();
 init_specs2();
 init_provision();
 init_validation();
@@ -25794,37 +26641,37 @@ init_types();
 init_server();
 
 // src/git/config.ts
-var fs33 = __toESM(require("fs"));
-var path42 = __toESM(require("path"));
+var fs32 = __toESM(require("fs"));
+var path41 = __toESM(require("path"));
 init_fs();
 function configPath() {
   return aiDir("git.json");
 }
 function readGitConfig() {
   try {
-    return JSON.parse(fs33.readFileSync(configPath(), "utf8"));
+    return JSON.parse(fs32.readFileSync(configPath(), "utf8"));
   } catch {
     return null;
   }
 }
 function writeGitConfig(config) {
   const p = configPath();
-  fs33.mkdirSync(path42.dirname(p), { recursive: true });
+  fs32.mkdirSync(path41.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
-  fs33.writeFileSync(tmp, JSON.stringify(config, null, 2) + "\n");
-  fs33.renameSync(tmp, p);
+  fs32.writeFileSync(tmp, JSON.stringify(config, null, 2) + "\n");
+  fs32.renameSync(tmp, p);
 }
 function clearGitConfig() {
   try {
-    fs33.rmSync(configPath(), { force: true });
+    fs32.rmSync(configPath(), { force: true });
   } catch {
   }
 }
 
 // src/git/adapter.ts
 var import_child_process3 = require("child_process");
-var fs34 = __toESM(require("fs"));
-var path43 = __toESM(require("path"));
+var fs33 = __toESM(require("fs"));
+var path42 = __toESM(require("path"));
 init_fs();
 function git(args, cwd) {
   return (0, import_child_process3.execFileSync)("git", args, {
@@ -25876,10 +26723,10 @@ function compareUrl(remote, defaultBranch, workingBranch) {
   return `${web}/compare/${encodeURIComponent(defaultBranch)}...${encodeURIComponent(workingBranch)}`;
 }
 function excludeLocalFiles() {
-  const excludePath = path43.join(getProjectRoot(), ".git", "info", "exclude");
+  const excludePath = path42.join(getProjectRoot(), ".git", "info", "exclude");
   try {
-    fs34.mkdirSync(path43.dirname(excludePath), { recursive: true });
-    fs34.appendFileSync(excludePath, "\n.wai/lock.json\n.wai/git.json\n");
+    fs33.mkdirSync(path42.dirname(excludePath), { recursive: true });
+    fs33.appendFileSync(excludePath, "\n.wai/lock.json\n.wai/git.json\n");
   } catch {
   }
 }
@@ -25944,39 +26791,39 @@ function configureSync(periodicSyncMinutes, skipIfClean) {
 }
 
 // src/producers/config.ts
-var fs35 = __toESM(require("fs"));
-var path44 = __toESM(require("path"));
+var fs34 = __toESM(require("fs"));
+var path43 = __toESM(require("path"));
 init_fs();
 function configPath2() {
   return aiDir("producers.json");
 }
-function load7() {
+function load6() {
   try {
-    return JSON.parse(fs35.readFileSync(configPath2(), "utf8"));
+    return JSON.parse(fs34.readFileSync(configPath2(), "utf8"));
   } catch {
     return [];
   }
 }
-function save3(configs) {
+function save2(configs) {
   const p = configPath2();
-  fs35.mkdirSync(path44.dirname(p), { recursive: true });
+  fs34.mkdirSync(path43.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
-  fs35.writeFileSync(tmp, JSON.stringify(configs, null, 2) + "\n");
-  fs35.renameSync(tmp, p);
+  fs34.writeFileSync(tmp, JSON.stringify(configs, null, 2) + "\n");
+  fs34.renameSync(tmp, p);
 }
 function readProducerConfig(target) {
-  return load7().find((c) => c.target === target) ?? null;
+  return load6().find((c) => c.target === target) ?? null;
 }
 function writeProducerConfig(config) {
-  const configs = load7().filter((c) => c.target !== config.target);
+  const configs = load6().filter((c) => c.target !== config.target);
   configs.push(config);
-  save3(configs);
+  save2(configs);
 }
 function clearProducerConfig(target) {
-  save3(load7().filter((c) => c.target !== target));
+  save2(load6().filter((c) => c.target !== target));
 }
 function listProducerConfigs() {
-  return load7();
+  return load6();
 }
 
 // src/producers/core-adapter.ts
@@ -26315,8 +27162,19 @@ var hostCore = {
   /** The ids of wairon's built-in architectural profiles, read from the core rules
    *  registry's built-in profile set (BUILTIN_PROFILES) — a pure, side-effect-free
    *  read of a bundled constant. */
-  builtinProfileIds: () => [...BUILTIN_PROFILES]
+  builtinProfileIds: () => [...BUILTIN_PROFILES],
+  /** The ids of wairon's built-in COMPOSITE PROJECT KINDS, read from the core
+   *  rules registry's bundled constant (PROJECT_KINDS) — a pure, side-effect-free
+   *  read. The counterpart of builtinProfileIds: legal projectType values that
+   *  are not architectural profiles and carry no profile doctrine of their own,
+   *  so the hosted profile-application path recognizes a project kind as
+   *  resolvable-as-is (no contributing pack to adopt) instead of refusing it as
+   *  an unknown profile. */
+  builtinProjectKinds: () => [...PROJECT_KINDS]
 };
+function resolveContainedProjectPath(projectRoot2, projectPath) {
+  return assertContainedProjectPath(projectRoot2, projectPath);
+}
 function validateProjectAsComplete() {
   const config = loadProjectConfig();
   return validateAsComplete({ rules: config.rules, projectType: config.projectType });
@@ -26348,6 +27206,180 @@ var hostSdk = {
   extractArchive: (archive, destDir, limits) => sdkPortal.extractPack(archive, destDir, limits)
 };
 
+// src/server/projects.ts
+var ID_RE = /^[a-z0-9][a-z0-9-]{0,63}$/;
+function isValidProjectId(id) {
+  return typeof id === "string" && ID_RE.test(id);
+}
+function registryPath(dataDir) {
+  return path44.join(dataDir, "projects.json");
+}
+function load7(dataDir) {
+  try {
+    return JSON.parse(fs35.readFileSync(registryPath(dataDir), "utf8"));
+  } catch {
+    return [];
+  }
+}
+function save3(dataDir, records) {
+  const p = registryPath(dataDir);
+  fs35.mkdirSync(path44.dirname(p), { recursive: true });
+  const tmp = `${p}.tmp`;
+  fs35.writeFileSync(tmp, JSON.stringify(records, null, 2) + "\n");
+  fs35.renameSync(tmp, p);
+}
+function projectRoot(dataDir, id) {
+  return path44.join(dataDir, "projects", id);
+}
+function existingProjectRoot(dataDir, id) {
+  if (!isValidProjectId(id)) return null;
+  const rec = load7(dataDir).find((r) => r.id === id);
+  return rec ? rec.rootPath : null;
+}
+function createProjectRecord(dataDir, id) {
+  if (!isValidProjectId(id)) {
+    throw new Error(`Invalid project id "${id}" (allowed: lowercase letters, digits, hyphen).`);
+  }
+  const records = load7(dataDir);
+  if (records.some((r) => r.id === id)) {
+    throw new Error(`Project "${id}" already exists.`);
+  }
+  const root = projectRoot(dataDir, id);
+  fs35.mkdirSync(root, { recursive: true });
+  const record2 = {
+    id,
+    rootPath: root,
+    status: "active",
+    createdAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  records.push(record2);
+  save3(dataDir, records);
+  return record2;
+}
+function registerLocalDevProject(dataDir, id, rootPath) {
+  if (!isValidProjectId(id)) {
+    throw new Error(`Invalid project id "${id}" (allowed: lowercase letters, digits, hyphen).`);
+  }
+  const records = load7(dataDir);
+  const existing = records.find((r) => r.id === id);
+  const record2 = {
+    id,
+    rootPath,
+    status: "active",
+    createdAt: existing?.createdAt ?? (/* @__PURE__ */ new Date()).toISOString()
+  };
+  const next = existing ? records.map((r) => r.id === id ? record2 : r) : [...records, record2];
+  save3(dataDir, next);
+  return record2;
+}
+function listProjectRecords(dataDir) {
+  return load7(dataDir);
+}
+function removeProjectRecord(dataDir, id) {
+  const records = load7(dataDir);
+  const rec = records.find((r) => r.id === id);
+  if (rec) {
+    try {
+      fs35.rmSync(rec.rootPath, { recursive: true, force: true });
+    } catch {
+    }
+  }
+  save3(dataDir, records.filter((r) => r.id !== id));
+}
+var SUBPROJECT_SEPARATOR = "::";
+function parseQualifiedSelector(value) {
+  if (typeof value !== "string" || value.length === 0) return null;
+  const [projectId, ...mounts] = value.split(SUBPROJECT_SEPARATOR);
+  if (!isValidProjectId(projectId)) return null;
+  if (mounts.some((m) => m.trim() === "")) return null;
+  return { projectId, mounts };
+}
+function findSubsystemSpec(root, subsystemId) {
+  const specsDir = aiPathsAt(root).specsDir();
+  if (!fs35.existsSync(specsDir)) return null;
+  for (const file of listFilesRecursive(specsDir, ".yaml")) {
+    let raw;
+    try {
+      raw = readYamlFile(file);
+    } catch {
+      continue;
+    }
+    if (!raw || typeof raw !== "object" || !("parentSystem" in raw)) continue;
+    if (raw.id !== subsystemId) continue;
+    const pp = raw.projectPath;
+    return typeof pp === "string" && pp.trim() !== "" ? { projectPath: pp } : {};
+  }
+  return null;
+}
+function resolveSubprojectMounts(projectId, projectRoot2, mounts) {
+  let root = projectRoot2;
+  let at = projectId;
+  for (const mount of mounts) {
+    const sub = findSubsystemSpec(root, mount);
+    if (!sub) {
+      throw new Error(
+        `unknown subproject mount "${mount}" on "${at}" \u2014 no subsystem with that id exists in its spec tree`
+      );
+    }
+    if (!sub.projectPath) {
+      throw new Error(
+        `subsystem "${mount}" on "${at}" is not a chained subproject (it carries no projectPath) \u2014 only a subsystem mounted via projectPath can be bound as a subproject`
+      );
+    }
+    root = resolveContainedProjectPath(root, sub.projectPath);
+    at = `${at}${SUBPROJECT_SEPARATOR}${mount}`;
+  }
+  return root;
+}
+function assertMintableNarrowingEntry(dataDir, entry) {
+  if (entry === "*") return;
+  const parsed = parseQualifiedSelector(entry);
+  if (!parsed) {
+    throw new Error(
+      `invalid project narrowing entry "${entry}" (expected a project id, optionally subproject-qualified as projectId::subsystemId)`
+    );
+  }
+  const rec = load7(dataDir).find((r) => r.id === parsed.projectId);
+  if (!rec) throw new Error(`unknown project "${parsed.projectId}"`);
+  if (parsed.mounts.length > 0) {
+    resolveSubprojectMounts(parsed.projectId, rec.rootPath, parsed.mounts);
+  }
+}
+function narrowingCovers(entry, target) {
+  return target === entry || target.startsWith(entry + SUBPROJECT_SEPARATOR);
+}
+function resolveProjectBinding(dataDir, principal, selector) {
+  const authorized = principal.projects;
+  const wildcard = authorized.includes("*");
+  let target;
+  if (selector) {
+    if (!wildcard && !authorized.some((e) => e !== "*" && narrowingCovers(e, selector))) return null;
+    target = selector;
+  } else if (!wildcard && authorized.length === 1) {
+    target = authorized[0];
+  } else {
+    return null;
+  }
+  const parsed = parseQualifiedSelector(target);
+  if (!parsed) return null;
+  const rec = load7(dataDir).find((r) => r.id === parsed.projectId);
+  if (!rec || rec.status !== "active") return null;
+  let rootPath = rec.rootPath;
+  if (parsed.mounts.length > 0) {
+    try {
+      rootPath = resolveSubprojectMounts(parsed.projectId, rec.rootPath, parsed.mounts);
+    } catch {
+      return null;
+    }
+  }
+  const binding = { rootPath, projectId: parsed.projectId };
+  if (parsed.mounts.length > 0) binding.subproject = parsed.mounts.join(SUBPROJECT_SEPARATOR);
+  return binding;
+}
+function resolveProjectRoot(dataDir, principal, selector) {
+  return resolveProjectBinding(dataDir, principal, selector)?.rootPath ?? null;
+}
+
 // src/server/errors.ts
 var UnauthenticatedError = class extends Error {
   constructor() {
@@ -26468,9 +27500,14 @@ function lockProject(cfg, credential, project2) {
   }
   return executeApprovedLock(cfg, project2);
 }
-function executeApprovedLock(cfg, projectId) {
+function boundLifecycleRoot(cfg, projectId, subproject) {
   const root = existingProjectRoot(cfg.dataDir, projectId);
   if (!root) throw new Error(`Unknown project "${projectId}".`);
+  if (!subproject) return root;
+  return resolveSubprojectMounts(projectId, root, subproject.split(SUBPROJECT_SEPARATOR));
+}
+function executeApprovedLock(cfg, projectId, subproject) {
+  const root = boundLifecycleRoot(cfg, projectId, subproject);
   return runWithProjectRoot(root, () => {
     hostGit.sync();
     const result = validateProjectAsComplete();
@@ -26642,9 +27679,8 @@ function promoteProject(cfg, credential, project2) {
   }
   return executeApprovedPromote(cfg, project2);
 }
-function executeApprovedPromote(cfg, projectId) {
-  const root = existingProjectRoot(cfg.dataDir, projectId);
-  if (!root) throw new Error(`Unknown project "${projectId}".`);
+function executeApprovedPromote(cfg, projectId, subproject) {
+  const root = boundLifecycleRoot(cfg, projectId, subproject);
   return runWithProjectRoot(root, () => {
     const lock = hostCore.readLockRecord();
     if (!lock) {
@@ -26759,6 +27795,35 @@ function storeListGlobalPacks() {
   );
   return [...instance, ...image];
 }
+function scanGlobalPackProfiles() {
+  const out = [];
+  for (const dir of [hostCore.globalPacksDir(), imagePacksDir()]) {
+    for (const full of hostCore.discoverPacks(dir)) {
+      try {
+        const loaded = hostCore.loadExtensionPacks([{ ref: full, scope: "global" }], path45.dirname(full));
+        if (loaded.errors.length) continue;
+        const source = loaded.packNames[0] ?? path45.basename(full);
+        for (const [id, def] of Object.entries(loaded.profiles)) out.push({ id, source, family: def.family });
+      } catch {
+      }
+    }
+  }
+  return out;
+}
+function scanProjectPackProfiles() {
+  const root = getProjectRoot();
+  const out = [];
+  for (const ref of loadProjectConfig().extensions?.packs ?? []) {
+    try {
+      const loaded = hostCore.loadExtensionPacks([{ ref, scope: "project" }], root);
+      if (loaded.errors.length) continue;
+      const source = loaded.packNames[0] ?? stem(ref);
+      for (const [id, def] of Object.entries(loaded.profiles)) out.push({ id, source, family: def.family });
+    } catch {
+    }
+  }
+  return out;
+}
 function storeListAvailableProfiles() {
   const out = [];
   const seen = /* @__PURE__ */ new Set();
@@ -26769,19 +27834,21 @@ function storeListAvailableProfiles() {
     out.push(family ? { id, source, family } : { id, source });
   };
   for (const id of hostCore.builtinProfileIds()) emit(id, "builtin");
-  const scanTier = (dir) => {
-    for (const full of hostCore.discoverPacks(dir)) {
-      try {
-        const loaded = hostCore.loadExtensionPacks([{ ref: full, scope: "global" }], path45.dirname(full));
-        if (loaded.errors.length) continue;
-        const source = loaded.packNames[0] ?? path45.basename(full);
-        for (const [id, def] of Object.entries(loaded.profiles)) emit(id, source, def.family);
-      } catch {
-      }
-    }
+  for (const c of scanGlobalPackProfiles()) emit(c.id, c.source, c.family);
+  return out;
+}
+function storeListProjectProfiles() {
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  const emit = (id, source, installed, family) => {
+    const key = JSON.stringify([id, source]);
+    if (seen.has(key)) return;
+    seen.add(key);
+    out.push({ id, source, ...family ? { family } : {}, installed });
   };
-  scanTier(hostCore.globalPacksDir());
-  scanTier(imagePacksDir());
+  for (const id of hostCore.builtinProfileIds()) emit(id, "builtin", true);
+  for (const c of scanProjectPackProfiles()) emit(c.id, c.source, true, c.family);
+  for (const c of scanGlobalPackProfiles()) emit(c.id, c.source, false, c.family);
   return out;
 }
 function readPackContent(full) {
@@ -26974,6 +28041,10 @@ function listAvailableProfiles(cfg, credential) {
   requirePrincipal2(cfg, credential);
   return storeListAvailableProfiles();
 }
+function listProjectProfiles(cfg, credential, project2) {
+  requireCap(cfg, credential, "project:read", "project", project2, "Forbidden \u2014 listing a project's selectable profiles requires project:read over the project");
+  return executeApprovedListProjectProfiles(cfg, project2);
+}
 function listAdoptableProjectPacks(cfg, credential, project2) {
   requireCap(cfg, credential, "project:read", "project", project2, "Forbidden \u2014 listing adoptable packs requires project:read over the project");
   return storeListGlobalPacks();
@@ -26996,6 +28067,26 @@ function executeApprovedInstallProjectPack(cfg, project2, name, content) {
 function executeApprovedResolveGlobalPacks(names) {
   return storeResolveGlobalPacks(names);
 }
+function executeApprovedListProjectProfiles(cfg, project2) {
+  return runWithProjectRoot(boundProject2(cfg, project2), () => storeListProjectProfiles());
+}
+function executeApprovedEnsureProfileInstalled(cfg, project2, profileId) {
+  if (hostCore.builtinProjectKinds().includes(profileId) || hostCore.builtinProfileIds().includes(profileId)) {
+    return { profileId, source: "builtin" };
+  }
+  const contributors = executeApprovedListProjectProfiles(cfg, project2).filter((p) => p.id === profileId);
+  const installed = contributors.find((p) => p.installed);
+  if (installed) return { profileId, source: installed.source };
+  const adoptable = contributors[0];
+  const resolved = adoptable ? executeApprovedResolveGlobalPacks([adoptable.source]).resolved[0] : void 0;
+  if (!resolved) {
+    throw new Error(
+      `Unknown profile "${profileId}" \u2014 no built-in profile or project kind carries it, no pack registered in project "${project2}" contributes it, and no server-global pack (mutable instance tier or immutable image tier) contributes it. Writing an unresolvable id as the projectType would silently disable the whole profile doctrine (UNKNOWN_PROFILE), so it is refused instead of applied.`
+    );
+  }
+  executeApprovedInstallProjectPack(cfg, project2, resolved.name, resolved.content);
+  return { profileId, source: resolved.name, adoptedPackName: resolved.name };
+}
 function removeProjectPack(cfg, credential, project2, name) {
   requireCap(cfg, credential, "project:admin", "project", project2, "Forbidden \u2014 removing a project pack requires project:admin over the project");
   runWithProjectRoot(boundProject2(cfg, project2), () => storeRemoveProjectPack(name));
@@ -27990,6 +29081,40 @@ function requestPackNames(request) {
   if (!sel) return [];
   return [.../* @__PURE__ */ new Set([...sel.requiredPackNames ?? [], ...sel.defaultPackNames ?? []])];
 }
+function classifyProfile(projectType, catalog) {
+  if (hostCore.builtinProfileIds().includes(projectType) || hostCore.builtinProjectKinds().includes(projectType)) {
+    return { source: "builtin", resolvable: true };
+  }
+  const installed = catalog.find((p) => p.id === projectType && p.installed);
+  if (installed) return { source: installed.source, resolvable: true };
+  return { resolvable: false };
+}
+function firstApplicableProfileId(candidates, catalog) {
+  const kinds = hostCore.builtinProjectKinds();
+  const catalogIds = new Set(catalog.map((p) => p.id));
+  return candidates.find((id) => kinds.includes(id) || catalogIds.has(id));
+}
+function unappliedIds(selectedProfileIds, governingProfileId) {
+  return selectedProfileIds.filter((id) => id !== governingProfileId);
+}
+function foldAppliedProfile(root, profileId, actor) {
+  const recorded = readProjectProfileSelection(root);
+  const folded = {
+    profileIds: [profileId, ...unappliedIds(recorded?.profileIds ?? [], profileId)],
+    requiredPackNames: recorded?.requiredPackNames ?? [],
+    selectedBy: actor,
+    selectedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  if (recorded?.defaultPackNames) folded.defaultPackNames = recorded.defaultPackNames;
+  recordProjectProfileSelection(root, folded);
+  return folded;
+}
+function overridingSubsystemIds(root) {
+  return runWithProjectRoot(
+    root,
+    () => hostCore.loadSubsystemSpecs().filter((s) => !!s.profile).map((s) => s.id)
+  );
+}
 function resolvedSelection(request, policy, selectedBy) {
   const sel = request.profileSelection;
   const selection = {
@@ -28008,7 +29133,8 @@ function buildEvaluation(input) {
     selectedProfileIds,
     hasSelection,
     countMissingPacksAsViolation,
-    requiredDefaultResolution
+    requiredDefaultResolution,
+    governingProfileId
   } = input;
   const present = new Set(presentPackNames);
   let missingPackNames;
@@ -28029,6 +29155,7 @@ function buildEvaluation(input) {
   const allowed = policy.allowedProfileIds;
   const disallowedProfileIds = allowed && allowed.length > 0 ? selectedProfileIds.filter((id) => !allowed.includes(id)) : [];
   const selectionRequiredUnmet = policy.requireProfileSelection && !hasSelection;
+  const unappliedProfileIds = governingProfileId ? unappliedIds(selectedProfileIds, governingProfileId) : [];
   const messages = [];
   if (selectionRequiredUnmet) {
     messages.push("Profile selection is required by policy but none was provided.");
@@ -28040,16 +29167,24 @@ function buildEvaluation(input) {
   for (const n of blockedPackNames) messages.push(`Pack "${n}" is blocked by policy.`);
   for (const id of missingProfileIds) messages.push(`Required profile "${id}" is not selected.`);
   for (const id of disallowedProfileIds) messages.push(`Profile "${id}" is not permitted by policy.`);
+  for (const id of unappliedProfileIds) {
+    messages.push(
+      `Selected profile "${id}" is recorded but does not govern the project (projectType is "${governingProfileId}") \u2014 a project has exactly one governing profile.`
+    );
+  }
   const violation = selectionRequiredUnmet || blockedPackNames.length > 0 || missingProfileIds.length > 0 || disallowedProfileIds.length > 0 || countMissingPacksAsViolation && (missingPackNames.length > 0 || unresolvedPacks.length > 0);
-  return {
+  const result = {
     compliant: !violation,
     mode: policy.enforcementMode,
     missingPackNames,
     blockedPackNames,
     missingProfileIds,
     unresolvedPacks,
+    unappliedProfileIds,
     messages
   };
+  if (governingProfileId) result.governingProfileId = governingProfileId;
+  return result;
 }
 function performInit(cfg, request, principal) {
   const policy = effectivePolicy(cfg.dataDir);
@@ -28069,17 +29204,24 @@ function performInit(cfg, request, principal) {
     request.ownerUnitId,
     principal ? principalSubject3(principal) : void 0
   );
-  installResolvedPacks(
-    cfg,
-    record2.id,
-    executeApprovedResolveGlobalPacks([
-      ...policy.requiredGlobalPacks,
-      ...policy.defaultProjectPacks,
-      ...requestPackNames(request)
-    ])
-  );
+  const packResolution = executeApprovedResolveGlobalPacks([
+    ...policy.requiredGlobalPacks,
+    ...policy.defaultProjectPacks,
+    ...requestPackNames(request)
+  ]);
+  installResolvedPacks(cfg, record2.id, packResolution);
   const selectedBy = principal ? principalSubject3(principal) : void 0;
-  recordProjectProfileSelection(record2.rootPath, resolvedSelection(request, policy, selectedBy));
+  const selection = resolvedSelection(request, policy, selectedBy);
+  recordProjectProfileSelection(record2.rootPath, selection);
+  const catalog = executeApprovedListProjectProfiles(cfg, record2.id);
+  const appliedProfileId = firstApplicableProfileId(selection.profileIds, catalog);
+  let appliedSource;
+  if (appliedProfileId) {
+    const application = executeApprovedEnsureProfileInstalled(cfg, record2.id, appliedProfileId);
+    writeProjectType(record2.rootPath, application.profileId);
+    appliedSource = application.source;
+  }
+  const unapplied = appliedProfileId ? unappliedIds(selection.profileIds, appliedProfileId) : [...selection.profileIds];
   const actor = principal ? principalSubject3(principal) : SYSTEM_SUBJECT;
   tryAppendAudit2(
     cfg,
@@ -28088,7 +29230,18 @@ function performInit(cfg, request, principal) {
       "project.init.policy",
       "info",
       "project",
-      { target: record2.id, projectId: record2.id },
+      {
+        target: record2.id,
+        projectId: record2.id,
+        metadata: JSON.stringify({
+          ...appliedProfileId ? { appliedProfileId, profileSource: appliedSource } : {
+            appliedProfileId: null,
+            profileNotApplied: selection.profileIds.length === 0 ? "no profile was selected \u2014 the default projectType stands" : "no selected profile is resolvable on this instance \u2014 the default projectType stands"
+          },
+          ...unapplied.length > 0 ? { unappliedProfileIds: unapplied } : {},
+          ...packResolution.unresolved.length > 0 ? { unresolvedPacks: packResolution.unresolved } : {}
+        })
+      },
       principal?.tokenId
     )
   );
@@ -28129,6 +29282,7 @@ function evaluateProjectPolicy(cfg, credential, projectId) {
   const root = resolveProjectRoot(cfg.dataDir, principal, projectId);
   if (!root) throw new Error(`Unknown project "${projectId}".`);
   const policy = effectivePolicy(cfg.dataDir);
+  const governingProfileId = readProjectType(root);
   const selection = readProjectProfileSelection(root);
   return buildEvaluation({
     policy,
@@ -28136,7 +29290,8 @@ function evaluateProjectPolicy(cfg, credential, projectId) {
     selectedProfileIds: selection?.profileIds ?? [],
     hasSelection: !!selection,
     countMissingPacksAsViolation: true,
-    requiredDefaultResolution: executeApprovedResolveGlobalPacks(requiredDefaultNames(policy))
+    requiredDefaultResolution: executeApprovedResolveGlobalPacks(requiredDefaultNames(policy)),
+    governingProfileId
   });
 }
 function reconcileProjectPolicy(cfg, credential, projectId) {
@@ -28151,20 +29306,41 @@ function reconcileProjectPolicy(cfg, credential, projectId) {
   const policy = effectivePolicy(cfg.dataDir);
   const selection = readProjectProfileSelection(root);
   const resolution = executeApprovedResolveGlobalPacks(requiredDefaultNames(policy));
-  let installed = installedPackNames(cfg, projectId);
-  const installedSet = new Set(installed);
+  const installedSet = new Set(installedPackNames(cfg, projectId));
   const toApply = resolution.resolved.filter((p) => !installedSet.has(p.name));
+  const appliedPackNames = toApply.map((p) => p.name);
   if (toApply.length > 0) {
     installResolvedPacks(cfg, projectId, { resolved: toApply, unresolved: [] });
-    installed = installedPackNames(cfg, projectId);
+  }
+  const catalog = executeApprovedListProjectProfiles(cfg, projectId);
+  const previousProfileId = readProjectType(root);
+  let governingProfileId = previousProfileId;
+  const requiredProfileIds = policy.requiredProfileIds ?? [];
+  const policyUnsatisfied = requiredProfileIds.length > 0 && !requiredProfileIds.includes(governingProfileId);
+  const governingUnresolvable = !classifyProfile(governingProfileId, catalog).resolvable;
+  let repairedProfileId;
+  let selectedProfileIds = selection?.profileIds ?? [];
+  if (policyUnsatisfied || governingUnresolvable) {
+    const target = firstApplicableProfileId(
+      [...requiredProfileIds, ...selection?.profileIds ?? []],
+      catalog
+    );
+    if (target) {
+      const application = executeApprovedEnsureProfileInstalled(cfg, projectId, target);
+      writeProjectType(root, application.profileId);
+      governingProfileId = application.profileId;
+      repairedProfileId = application.profileId;
+      selectedProfileIds = foldAppliedProfile(root, application.profileId, principalSubject3(principal)).profileIds;
+    }
   }
   const result = buildEvaluation({
     policy,
-    presentPackNames: installed,
-    selectedProfileIds: selection?.profileIds ?? [],
+    presentPackNames: installedPackNames(cfg, projectId),
+    selectedProfileIds,
     hasSelection: !!selection,
     countMissingPacksAsViolation: true,
-    requiredDefaultResolution: resolution
+    requiredDefaultResolution: resolution,
+    governingProfileId
   });
   tryAppendAudit2(
     cfg,
@@ -28173,7 +29349,15 @@ function reconcileProjectPolicy(cfg, credential, projectId) {
       "policy.reconcile",
       "info",
       "policy",
-      { target: projectId, projectId },
+      {
+        target: projectId,
+        projectId,
+        metadata: JSON.stringify({
+          ...appliedPackNames.length > 0 ? { appliedPackNames } : {},
+          ...repairedProfileId ? { repairedProfileId, previousProfileId } : {},
+          ...resolution.unresolved.length > 0 ? { unresolvedPacks: resolution.unresolved } : {}
+        })
+      },
       principal.tokenId
     )
   );
@@ -28189,8 +29373,19 @@ function getProjectConfig(cfg, credential, projectId) {
   const root = resolveProjectRoot(cfg.dataDir, principal, projectId);
   if (!root) throw new Error(`Unknown project "${projectId}".`);
   const projectType = readProjectType(root);
+  const selection = readProjectProfileSelection(root);
+  const classified = classifyProfile(projectType, executeApprovedListProjectProfiles(cfg, projectId));
   const locked = runWithProjectRoot(root, () => hostCore.readLockRecord() !== null);
-  return { projectType, locked };
+  const overriding = overridingSubsystemIds(root);
+  const view = {
+    projectType,
+    locked,
+    profileResolvable: classified.resolvable,
+    unappliedProfileIds: unappliedIds(selection?.profileIds ?? [], projectType),
+    overridingSubsystemIds: overriding
+  };
+  if (classified.source) view.profileSource = classified.source;
+  return view;
 }
 function setProjectType(cfg, credential, projectId, projectType) {
   const principal = requirePrincipal4(cfg, credential);
@@ -28201,9 +29396,23 @@ function setProjectType(cfg, credential, projectId, projectType) {
   }
   const root = resolveProjectRoot(cfg.dataDir, principal, projectId);
   if (!root) throw new Error(`Unknown project "${projectId}".`);
-  writeProjectType(root, projectType);
+  const application = executeApprovedEnsureProfileInstalled(cfg, projectId, projectType);
+  writeProjectType(root, application.profileId);
+  const folded = foldAppliedProfile(root, application.profileId, principalSubject3(principal));
+  const remainder = folded.profileIds.slice(1);
   const locked = runWithProjectRoot(root, () => hostCore.readLockRecord() !== null);
-  return { projectType, locked };
+  const overriding = overridingSubsystemIds(root);
+  const view = {
+    projectType: application.profileId,
+    locked,
+    profileSource: application.source,
+    // The write path guarantees resolvability — the ensure seam refused anything else.
+    profileResolvable: true,
+    unappliedProfileIds: remainder,
+    overridingSubsystemIds: overriding
+  };
+  if (application.adoptedPackName) view.adoptedPackName = application.adoptedPackName;
+  return view;
 }
 function getPackPolicy(cfg, credential) {
   requirePrincipal4(cfg, credential);
@@ -28373,11 +29582,8 @@ function mintToken(cfg, credential, request) {
   }
   assertNotReservedSubjectId(cfg, [request.ownerUserId]);
   const projects = request.projects?.length ? request.projects : ["*"];
-  const knownProjects = new Set(listProjectRecords(cfg.dataDir).map((p) => p.id));
   for (const p of projects) {
-    if (p !== "*" && !knownProjects.has(p)) {
-      throw new Error(`unknown project "${p}"`);
-    }
+    assertMintableNarrowingEntry(cfg.dataDir, p);
   }
   const owner = findUserByRecordOrSubjectId(cfg.dataDir, request.ownerUserId);
   if (owner && owner.status !== "active") {
@@ -28414,12 +29620,21 @@ function revokeToken(cfg, credential, tokenId) {
 }
 function mintSelfToken(cfg, credential, projectId, write) {
   const principal = requirePrincipal5(cfg, credential);
-  if (authorize(cfg.dataDir, principal, PROJECT_READ_CAPABILITY2, "project", projectId).value !== "yes") {
+  const parsed = parseQualifiedSelector(projectId);
+  if (!parsed) {
+    throw new Error(
+      `invalid project id "${projectId}" (expected a project id, optionally subproject-qualified as projectId::subsystemId)`
+    );
+  }
+  if (authorize(cfg.dataDir, principal, PROJECT_READ_CAPABILITY2, "project", parsed.projectId).value !== "yes") {
     throw new ForbiddenError("caller lacks project:read on the requested project");
   }
-  if (write && authorize(cfg.dataDir, principal, PROJECT_WRITE_CAPABILITY2, "project", projectId).value !== "yes") {
+  if (write && authorize(cfg.dataDir, principal, PROJECT_WRITE_CAPABILITY2, "project", parsed.projectId).value !== "yes") {
     throw new ForbiddenError("caller lacks project:write on the requested project");
   }
+  if (parsed.mounts.length > 0) {
+    assertMintableNarrowingEntry(cfg.dataDir, projectId);
+  }
   const token = "wk_" + crypto10.randomBytes(24).toString("hex");
   const owner = auditActor(principal);
   const record2 = {
@@ -29031,12 +30246,12 @@ function resolveVisibility(observerProjectId, units, placements) {
   const best = /* @__PURE__ */ new Map();
   for (const placement of placements) {
     if (placement.projectId === observerProjectId) continue;
-    const path62 = chainOf(placement.unitId, unitById);
-    if (!path62.length) continue;
-    const closedOk = path62.every((u) => effectivePosture(u, unitById) !== "closed" || observerInside(u.id) || grantedTo(u));
+    const path61 = chainOf(placement.unitId, unitById);
+    if (!path61.length) continue;
+    const closedOk = path61.every((u) => effectivePosture(u, unitById) !== "closed" || observerInside(u.id) || grantedTo(u));
     if (!closedOk) continue;
-    const crossTenant = !tenantRoots.has(path62[path62.length - 1].id);
-    if (crossTenant && !path62.some(grantedTo)) continue;
+    const crossTenant = !tenantRoots.has(path61[path61.length - 1].id);
+    if (crossTenant && !path61.some(grantedTo)) continue;
     if (crossTenant && directUnits.length === 0) continue;
     const distance = crossTenant ? "partner" : sameBranch(placement.unitId) ? "department" : "instance";
     const existing = best.get(placement.projectId);
@@ -29059,6 +30274,17 @@ function audienceDistance(resolution, targetProjectId) {
 
 // src/server/landscape.ts
 var yamlLib = __toESM(require("js-yaml"));
+init_filenames();
+
+// src/server/openapiindex.ts
+function buildOpenApiSpecIndex(specs) {
+  return { openapiIndex: true, specs: specs.map((s) => ({ portalId: s.portalId, name: s.name })) };
+}
+function openApiIndexDocument(specs) {
+  return JSON.stringify(buildOpenApiSpecIndex(specs), null, 2);
+}
+
+// src/server/landscape.ts
 var PROJECT_ADMIN_CAPABILITY3 = "project:admin";
 var PROJECT_READ_CAPABILITY3 = "project:read";
 var PROJECT_WRITE_CAPABILITY3 = "project:write";
@@ -29545,7 +30771,7 @@ function getProjectSurfaceForMcp(cfg, credential, currentProjectId, targetProjec
   const result = runWithProjectRoot(record2.rootPath, () => hostSurfaces.exportBoundSurface(maxAudience, "native"));
   return { ...result.snapshot, origin: "exchanged" };
 }
-function exportProjectSurface(cfg, credential, projectId, format, maxAudience) {
+function exportProjectSurface(cfg, credential, projectId, format, maxAudience, portalId) {
   const principal = requirePrincipal6(cfg, credential);
   if (!permitsCap(cfg, principal, PROJECT_ADMIN_CAPABILITY3, "project", projectId)) {
     throw new ForbiddenError(
@@ -29559,16 +30785,37 @@ function exportProjectSurface(cfg, credential, projectId, format, maxAudience) {
   if (!root) throw new Error(`Unknown project "${projectId}".`);
   const result = runWithProjectRoot(root, () => hostSurfaces.exportBoundSurface(maxAudience, format));
   if (format === "openapi") {
+    const specs = result.renderedSet ?? [];
+    if (portalId) {
+      const hit = specs.find((s) => s.portalId === portalId);
+      if (!hit) {
+        throw new Error(
+          `Unknown portal "${portalId}" in project "${projectId}" (published: ${specs.map((s) => s.portalId).join(", ") || "none"}).`
+        );
+      }
+      return {
+        body: hit.document,
+        contentType: "application/json",
+        filename: `${safeFilenamePart(projectId)}-${safeFilenamePart(portalId)}-surface.openapi.json`
+      };
+    }
+    if (specs.length === 1) {
+      return {
+        body: specs[0].document,
+        contentType: "application/json",
+        filename: `${safeFilenamePart(projectId)}-surface.openapi.json`
+      };
+    }
     return {
-      body: result.rendered ?? "{}",
+      body: openApiIndexDocument(specs),
       contentType: "application/json",
-      filename: `${projectId}-surface.openapi.json`
+      filename: `${safeFilenamePart(projectId)}-surface.openapi.index.json`
     };
   }
   return {
     body: yamlLib.dump(result.snapshot),
     contentType: "application/yaml",
-    filename: `${projectId}-surface.yaml`
+    filename: `${safeFilenamePart(projectId)}-surface.yaml`
   };
 }
 function removeRelation(cfg, credential, id) {
@@ -29612,7 +30859,8 @@ function handleLandscapeRequest(cfg, credential, req, res, body, url) {
           credential,
           parts[2],
           url.searchParams.get("format") ?? "native",
-          url.searchParams.get("audience") ?? "instance"
+          url.searchParams.get("audience") ?? "instance",
+          url.searchParams.get("spec") ?? void 0
         );
         res.writeHead(200, {
           "content-type": artifact.contentType,
@@ -29942,10 +31190,9 @@ function migratePermissionModel(dataDir, apply) {
 // src/server/http.ts
 var http2 = __toESM(require("http"));
 var fs49 = __toESM(require("fs"));
-var path59 = __toESM(require("path"));
+var path58 = __toESM(require("path"));
 
 // src/server/request.ts
-var path58 = __toESM(require("path"));
 var import_streamableHttp = require("@modelcontextprotocol/sdk/server/streamableHttp.js");
 init_fs();
 
@@ -30318,38 +31565,58 @@ function initializeProject(cfg, credential, request) {
     }
   }
 }
-function lockProject2(cfg, credential, projectId) {
+function lockProject2(cfg, credential, projectId, subproject) {
   return lifecycleAction(cfg, credential, projectId, {
     action: "project:lock",
     verb: "Lock",
     noun: "lock",
+    subproject,
     execute: () => {
-      const lock = executeApprovedLock(cfg, projectId);
+      const lock = executeApprovedLock(cfg, projectId, subproject);
       return {
         status: "completed",
         action: "project:lock",
-        summary: `Locked project "${projectId}" (status: ${lock.status}).`,
+        summary: `Locked project "${projectId}"${subprojectSuffix(subproject)} (status: ${lock.status}).`,
         lock
       };
     }
   });
 }
-function promoteProject2(cfg, credential, projectId) {
+function promoteProject2(cfg, credential, projectId, subproject) {
   return lifecycleAction(cfg, credential, projectId, {
     action: "project:promote",
     verb: "Promote",
     noun: "promotion",
+    subproject,
     execute: () => {
-      const promo = executeApprovedPromote(cfg, projectId);
+      const promo = executeApprovedPromote(cfg, projectId, subproject);
       return {
         status: "completed",
         action: "project:promote",
-        summary: `Promotion of project "${projectId}": ${promo.status} \u2014 ${promo.message}`,
+        summary: `Promotion of project "${projectId}"${subprojectSuffix(subproject)}: ${promo.status} \u2014 ${promo.message}`,
         promote: promo
       };
     }
   });
 }
+function subprojectSuffix(subproject) {
+  return subproject ? ` subproject "${subproject}"` : "";
+}
+var SUBPROJECT_SCOPE_PAYLOAD = "SubprojectScope";
+function subprojectScopePayload(subproject) {
+  if (!subproject) return {};
+  return { payloadType: SUBPROJECT_SCOPE_PAYLOAD, payload: JSON.stringify({ subproject }) };
+}
+function readSubprojectScope(req) {
+  if (req.payloadType !== SUBPROJECT_SCOPE_PAYLOAD || !req.payload) return void 0;
+  const parsed = JSON.parse(req.payload);
+  if (typeof parsed.subproject !== "string" || !parsed.subproject) {
+    throw new Error(
+      `Approved ${req.kind} request "${req.id}" carries a ${SUBPROJECT_SCOPE_PAYLOAD} payload with no usable subproject qualifier \u2014 refusing to execute, because falling back to the whole project would widen the scope the requester was confined to.`
+    );
+  }
+  return parsed.subproject;
+}
 function lifecycleAction(cfg, credential, projectId, opts) {
   const principal = requirePrincipal7(cfg, credential);
   const effective = authorize(cfg.dataDir, principal, PROJECT_WRITE_CAPABILITY4, "project", projectId);
@@ -30375,8 +31642,9 @@ function lifecycleAction(cfg, credential, projectId, opts) {
       const pending = buildPendingRequest(
         principal,
         opts.action,
-        `${opts.verb} project ${projectId}`,
-        projectId
+        `${opts.verb} project ${projectId}${subprojectSuffix(opts.subproject)}`,
+        projectId,
+        subprojectScopePayload(opts.subproject)
       );
       return createPendingOutcome(cfg, principal, pending, opts.action);
     }
@@ -30450,12 +31718,14 @@ function executeApproved(cfg, req) {
       return `Initialized project "${rec.id}" under the active pack policy.`;
     }
     case "project:lock": {
-      const lock = executeApprovedLock(cfg, req.projectId ?? "");
-      return `Locked project "${req.projectId}" (status: ${lock.status}).`;
+      const scope = readSubprojectScope(req);
+      const lock = executeApprovedLock(cfg, req.projectId ?? "", scope);
+      return `Locked project "${req.projectId}"${subprojectSuffix(scope)} (status: ${lock.status}).`;
     }
     case "project:promote": {
-      const promo = executeApprovedPromote(cfg, req.projectId ?? "");
-      return `Promotion of project "${req.projectId}": ${promo.status} \u2014 ${promo.message}`;
+      const scope = readSubprojectScope(req);
+      const promo = executeApprovedPromote(cfg, req.projectId ?? "", scope);
+      return `Promotion of project "${req.projectId}"${subprojectSuffix(scope)}: ${promo.status} \u2014 ${promo.message}`;
     }
     default:
       throw new Error(`Unsupported approval kind "${req.kind}".`);
@@ -31159,6 +32429,9 @@ function getProjectConfig2(cfg, credential, projectId) {
 function setProjectType2(cfg, credential, projectId, projectType) {
   return setProjectType(cfg, credential, projectId, projectType);
 }
+function listProjectProfiles2(cfg, credential, project2) {
+  return listProjectProfiles(cfg, credential, project2);
+}
 function listProducers2(cfg, credential, project2) {
   return listProducers(cfg, credential, project2);
 }
@@ -31687,6 +32960,19 @@ var ShareSnapshotRegistry = class {
     return stored;
   }
 };
+function selectCapturedOpenApi(snap, portalId) {
+  const specs = snap.openapiSet;
+  if (!specs || specs.length === 0) {
+    if (portalId) return null;
+    return snap.openapi ?? null;
+  }
+  if (portalId) {
+    const hit = specs.find((s) => s.portalId === portalId);
+    return hit ? hit.document : null;
+  }
+  if (specs.length === 1) return specs[0].document;
+  return openApiIndexDocument(specs);
+}
 var ShareSnapshotIndex = class {
   constructor(store) {
     this.store = store;
@@ -31694,12 +32980,12 @@ var ShareSnapshotIndex = class {
   get(snapshotId) {
     return this.store.read(snapshotId);
   }
-  getArtifact(snapshotId, kind) {
+  getArtifact(snapshotId, kind, portalId) {
     const snap = this.store.read(snapshotId);
     if (!snap) return null;
     if (kind === "canvas") return snap.canvasModel ?? null;
     if (kind === "html") return snap.html ?? null;
-    if (kind === "openapi") return snap.openapi ?? null;
+    if (kind === "openapi") return selectCapturedOpenApi(snap, portalId);
     return null;
   }
 };
@@ -31709,8 +32995,8 @@ function putSnapshot(dataDir, snapshot) {
 function getSnapshot2(dataDir, snapshotId) {
   return new ShareSnapshotIndex(new ShareSnapshotStore(dataDir)).get(snapshotId);
 }
-function getSnapshotArtifact(dataDir, snapshotId, kind) {
-  return new ShareSnapshotIndex(new ShareSnapshotStore(dataDir)).getArtifact(snapshotId, kind);
+function getSnapshotArtifact(dataDir, snapshotId, kind, portalId) {
+  return new ShareSnapshotIndex(new ShareSnapshotStore(dataDir)).getArtifact(snapshotId, kind, portalId);
 }
 function captureSnapshot(dataDir, principal, projectId, view, artifacts) {
   const root = resolveProjectRoot(dataDir, principal, projectId);
@@ -31729,7 +33015,11 @@ function captureSnapshot(dataDir, principal, projectId, view, artifacts) {
     }
     if (artifacts.includes("openapi")) {
       const result = hostSurfaces.exportBoundSurface("project", "openapi");
-      snapshot.openapi = result.rendered ?? "{}";
+      const specs = result.renderedSet ?? [];
+      if (specs.length) {
+        snapshot.openapiSet = specs;
+        if (specs.length === 1) snapshot.openapi = specs[0].document;
+      }
     }
     return snapshot;
   });
@@ -32290,10 +33580,10 @@ function getWebProjectOpenApi(cfg, sessionId, projectId, portalId) {
   if (!root) throw new ForbiddenError("project not authorized or unknown");
   const result = runWithProjectRoot(root, () => hostSurfaces.exportBoundSurface("project", "openapi"));
   const specs = result.renderedSet ?? (result.rendered ? [{ portalId: "", name: projectId, document: result.rendered }] : []);
-  if (specs.length === 0) return swaggerUiPage("{}", projectId);
+  if (specs.length === 0) return openApiIndexPage(projectId, []);
   if (portalId) {
-    const sel = specs.find((s) => s.portalId === portalId) ?? specs[0];
-    return swaggerUiPage(sel.document, sel.name);
+    const sel = specs.find((s) => s.portalId === portalId);
+    return sel ? swaggerUiPage(sel.document, sel.name) : openApiIndexPage(projectId, specs);
   }
   if (specs.length === 1) return swaggerUiPage(specs[0].document, specs[0].name);
   return openApiIndexPage(projectId, specs);
@@ -32301,7 +33591,7 @@ function getWebProjectOpenApi(cfg, sessionId, projectId, portalId) {
 function openApiIndexPage(projectId, specs) {
   const esc2 = (s) => s.replace(/[&<>"]/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;" })[c]);
   const items = specs.map((s) => `<li><a href="/web/openapi?projectId=${encodeURIComponent(projectId)}&spec=${encodeURIComponent(s.portalId)}">${esc2(s.name)}</a> <code>${esc2(s.portalId)}</code></li>`).join("");
-  return `<!doctype html><html><head><meta charset="utf-8"><title>${esc2(projectId)} \u2014 API specs</title><style>body{font-family:system-ui,sans-serif;max-width:680px;margin:48px auto;padding:0 20px;color:#e6e6e6;background:#161616}h1{font-size:20px}a{color:#6ea8fe;text-decoration:none}a:hover{text-decoration:underline}li{margin:10px 0}code{color:#8a94a6;font-size:12px;margin-left:8px}</style></head><body><h1>${esc2(projectId)} \u2014 API specs</h1><p>This project exposes ${specs.length} separate public APIs, each with its own OpenAPI document and auth:</p><ul>${items}</ul></body></html>`;
+  return `<!doctype html><html><head><meta charset="utf-8"><title>${esc2(projectId)} \u2014 API specs</title><style>body{font-family:system-ui,sans-serif;max-width:680px;margin:48px auto;padding:0 20px;color:#e6e6e6;background:#161616}h1{font-size:20px}a{color:#6ea8fe;text-decoration:none}a:hover{text-decoration:underline}li{margin:10px 0}code{color:#8a94a6;font-size:12px;margin-left:8px}</style></head><body><h1>${esc2(projectId)} \u2014 API specs</h1>` + (specs.length ? `<p>This project exposes ${specs.length} separate public APIs, each with its own OpenAPI document and auth:</p><ul>${items}</ul>` : `<p>This project publishes no HTTP API \u2014 no public portal exposes one.</p>`) + `</body></html>`;
 }
 function reshapeLandscapeGraph(model, level) {
   const unitNodeIds = new Set(model.nodes.filter((n) => n.nodeKind === "orgUnit").map((n) => n.id));
@@ -32335,7 +33625,31 @@ function reshapeLandscapeGraph(model, level) {
   }
   const kept = nodes.filter((n) => n.level <= level);
   const keptIds = new Set(kept.map((n) => n.id));
-  const edges = model.edges.filter((e) => keptIds.has(e.from) && keptIds.has(e.to));
+  const projectNodeIdByProject = /* @__PURE__ */ new Map();
+  const interfaceOwnerProject = /* @__PURE__ */ new Map();
+  for (const n of model.nodes) {
+    if (n.projectId === void 0) continue;
+    if (n.nodeKind === "project") projectNodeIdByProject.set(n.projectId, n.id);
+    else if (n.nodeKind === "publicInterface") interfaceOwnerProject.set(n.id, n.projectId);
+  }
+  const retarget = (endpoint) => {
+    if (keptIds.has(endpoint)) return endpoint;
+    const owner = interfaceOwnerProject.get(endpoint);
+    const projectNode = owner === void 0 ? void 0 : projectNodeIdByProject.get(owner);
+    return projectNode !== void 0 && keptIds.has(projectNode) ? projectNode : void 0;
+  };
+  const edges = [];
+  for (const e of model.edges) {
+    if (keptIds.has(e.from) && keptIds.has(e.to)) {
+      edges.push(e);
+      continue;
+    }
+    if (e.relationId === void 0) continue;
+    const from = retarget(e.from);
+    const to = retarget(e.to);
+    if (from === void 0 || to === void 0 || from === to) continue;
+    edges.push({ ...e, from, to });
+  }
   return {
     tier: "landscape",
     nodes: kept,
@@ -34479,6 +35793,9 @@ function opsGetProjectConfig(cfg, sessionId, url, res) {
 function opsSetProjectConfig(cfg, sessionId, body, res) {
   sendJson(res, 200, setProjectType2(cfg, sessionId, String(body?.projectId ?? ""), String(body?.projectType ?? "")));
 }
+function opsListProjectProfiles(cfg, sessionId, url, res) {
+  sendJson(res, 200, { profiles: listProjectProfiles2(cfg, sessionId, q(url, "projectId") ?? "") });
+}
 function opsListProducers(cfg, sessionId, url, res) {
   sendJson(res, 200, { producers: listProducers2(cfg, sessionId, q(url, "projectId") ?? "") });
 }
@@ -34718,6 +36035,9 @@ async function handleWebRequest(cfg, req, res, body, url, ctx) {
       if (req.method === "POST" && parts.length === 3 && parts[2] === "config") {
         return opsSetProjectConfig(cfg, sessionId, body, res);
       }
+      if (req.method === "GET" && parts.length === 3 && parts[2] === "profiles") {
+        return opsListProjectProfiles(cfg, sessionId, url, res);
+      }
       if (req.method === "GET" && parts.length === 3 && parts[2] === "policy") {
         return opsPolicyEvaluate(cfg, sessionId, url, res);
       }
@@ -34942,8 +36262,8 @@ var RealtimeHub = class {
    *  complete the handshake, and register the connection. A bad path or session
    *  destroys the socket. */
   handleUpgrade(cfg, req, socket) {
-    const path62 = (req.url ?? "/").split("?")[0];
-    if (path62 !== REALTIME_PATH || !isWebSocketUpgrade(req)) {
+    const path61 = (req.url ?? "/").split("?")[0];
+    if (path61 !== REALTIME_PATH || !isWebSocketUpgrade(req)) {
       socket.destroy();
       return;
     }
@@ -35088,7 +36408,7 @@ function deriveMcpOutcome(response) {
   if (r.result && typeof r.result === "object" && r.result.isError) return "failed";
   return "success";
 }
-function auditToolCall(dataDir, principal, projectId, body, outcome) {
+function auditToolCall(dataDir, principal, projectId, body, outcome, subproject) {
   const target = mcpToolTarget(body);
   if (!target) return;
   const actor = principal.subject ?? {
@@ -35106,7 +36426,8 @@ function auditToolCall(dataDir, principal, projectId, body, outcome) {
     actor,
     tokenId: principal.tokenId,
     projectId,
-    target
+    target,
+    ...subproject ? { metadata: JSON.stringify({ subproject }) } : {}
   };
   try {
     appendAuditEvent(dataDir, event, DEFAULT_AUDIT_POLICY);
@@ -35137,6 +36458,12 @@ var PROJECT_OPS_TOOLS = /* @__PURE__ */ new Set([
   "sdd_host_produce",
   "sdd_host_commit_project"
 ]);
+var PROJECT_RECORD_TOOLS = /* @__PURE__ */ new Set([
+  "sdd_host_initialize_project",
+  "sdd_host_get_approval_status",
+  "sdd_host_await_approval",
+  ...PROJECT_OPS_TOOLS
+]);
 function jsonRpcRequests(body) {
   const arr = Array.isArray(body) ? body : [body];
   return arr.filter((m) => !!m && typeof m === "object" && "method" in m);
@@ -35202,7 +36529,27 @@ function dataPlanePermissionError(cfg, principal, projectId, body) {
     }
   };
 }
-async function dispatchProjectLifecycleTool(cfg, credential, projectId, body) {
+function subprojectConfinementError(projectId, subproject, body) {
+  if (!subproject) return void 0;
+  const msg = jsonRpcRequest(body);
+  if (!msg || msg.method !== "tools/call") return void 0;
+  const name = msg.params?.name;
+  if (typeof name !== "string" || !PROJECT_RECORD_TOOLS.has(name)) return void 0;
+  return {
+    jsonrpc: "2.0",
+    id: msg.id ?? null,
+    result: {
+      content: [
+        {
+          type: "text",
+          text: `Refused \u2014 ${name} acts on the whole project "${projectId}", but this credential is bound to subproject "${projectId}${SUBPROJECT_SEPARATOR}${subproject}". An unqualified credential for "${projectId}" is required to call ${name}.`
+        }
+      ],
+      isError: true
+    }
+  };
+}
+async function dispatchProjectLifecycleTool(cfg, credential, projectId, body, subproject) {
   const msg = jsonRpcRequest(body);
   if (!msg || msg.method !== "tools/call") return void 0;
   const name = msg.params?.name;
@@ -35219,10 +36566,10 @@ async function dispatchProjectLifecycleTool(cfg, credential, projectId, body) {
         value = initializeProject(cfg, credential, args);
         break;
       case "sdd_host_lock_project":
-        value = lockProject2(cfg, credential, projectId);
+        value = lockProject2(cfg, credential, projectId, subproject);
         break;
       case "sdd_host_promote_project":
-        value = promoteProject2(cfg, credential, projectId);
+        value = promoteProject2(cfg, credential, projectId, subproject);
         break;
       case "sdd_host_await_approval":
         value = await awaitApproval(
@@ -35310,8 +36657,8 @@ async function handleMcpRequest(cfg, req, res, body, credential) {
       permissionSubject: { subjectId: "anonymous", roleBindings: [], instanceAdmin: true }
     };
   }
-  const root = resolveProjectRoot(cfg.dataDir, principal, projectSelector(req));
-  if (!root) {
+  const binding = resolveProjectBinding(cfg.dataDir, principal, projectSelector(req));
+  if (!binding) {
     sendJson(res, 403, { error: "project not authorized, unknown, or not specified" });
     return;
   }
@@ -35326,19 +36673,26 @@ async function handleMcpRequest(cfg, req, res, body, credential) {
     });
     return;
   }
-  await runWithProjectRoot(root, async () => {
-    const projectId = path58.basename(root);
-    const dispatchedResponse = await dispatchProjectLifecycleTool(cfg, cred, projectId, body);
+  await runWithProjectRoot(binding.rootPath, async () => {
+    const projectId = binding.projectId;
+    const subproject = binding.subproject;
+    const confinementError = subprojectConfinementError(projectId, subproject, body);
+    if (confinementError !== void 0) {
+      sendJson(res, 200, confinementError);
+      auditToolCall(cfg.dataDir, principal, projectId, body, deriveMcpOutcome(confinementError), subproject);
+      return;
+    }
+    const dispatchedResponse = await dispatchProjectLifecycleTool(cfg, cred, projectId, body, subproject);
     if (dispatchedResponse !== void 0) {
       sendJson(res, 200, dispatchedResponse);
-      auditToolCall(cfg.dataDir, principal, projectId, body, deriveMcpOutcome(dispatchedResponse));
+      auditToolCall(cfg.dataDir, principal, projectId, body, deriveMcpOutcome(dispatchedResponse), subproject);
       for (const ch of mcpChangeChannels(body, projectId, dispatchedResponse)) publishChange(ch);
       return;
     }
     const permissionError = dataPlanePermissionError(cfg, principal, projectId, body);
     if (permissionError !== void 0) {
       sendJson(res, 200, permissionError);
-      auditToolCall(cfg.dataDir, principal, projectId, body, deriveMcpOutcome(permissionError));
+      auditToolCall(cfg.dataDir, principal, projectId, body, deriveMcpOutcome(permissionError), subproject);
       return;
     }
     const server = createScopedServer();
@@ -35359,7 +36713,7 @@ async function handleMcpRequest(cfg, req, res, body, credential) {
     };
     await server.connect(transport);
     await transport.handleRequest(req, res, body);
-    auditToolCall(cfg.dataDir, principal, projectId, body, deriveMcpOutcome(response));
+    auditToolCall(cfg.dataDir, principal, projectId, body, deriveMcpOutcome(response), subproject);
     for (const ch of mcpChangeChannels(body, projectId, response)) publishChange(ch);
   });
 }
@@ -35427,7 +36781,7 @@ var CONTENT_TYPE = {
   openapi: "application/json",
   canvas: "application/json"
 };
-function downloadArtifact(cfg, token, kind, meta) {
+function downloadArtifact(cfg, token, kind, meta, portalId) {
   const link = linkByTokenHash(cfg.dataDir, hashToken(token));
   const check = usable(link);
   if ("outcome" in check) {
@@ -35439,7 +36793,7 @@ function downloadArtifact(cfg, token, kind, meta) {
     record(cfg.dataDir, check.link.id, meta, "denied-download");
     return { found: false, outcome: "denied-download" };
   }
-  const content = getSnapshotArtifact(cfg.dataDir, check.link.snapshotId, kind);
+  const content = getSnapshotArtifact(cfg.dataDir, check.link.snapshotId, kind, portalId);
   if (content === null) {
     record(cfg.dataDir, check.link.id, meta, "not-found");
     return { found: false, outcome: "not-found" };
@@ -35449,6 +36803,35 @@ function downloadArtifact(cfg, token, kind, meta) {
 }
 
 // src/server/sharehttp.ts
+init_filenames();
+function specParam(req) {
+  const url = req.url ?? "";
+  const q2 = url.indexOf("?");
+  if (q2 < 0) return void 0;
+  return new URLSearchParams(url.slice(q2 + 1)).get("spec") || void 0;
+}
+function asOpenApiIndex(payload) {
+  try {
+    const parsed = JSON.parse(payload);
+    return parsed && parsed.openapiIndex === true && Array.isArray(parsed.specs) ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+function escapeHtml2(s) {
+  return s.replace(/[&<>"]/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;" })[c]);
+}
+function sharedOpenApiIndexPage(index) {
+  const items = index.specs.map(
+    (s) => `<li><a href="?spec=${encodeURIComponent(s.portalId)}">${escapeHtml2(s.name)}</a><code>${escapeHtml2(s.portalId)}</code></li>`
+  ).join("");
+  return `<!doctype html><html><head><meta charset="utf-8"><title>Shared APIs</title><meta name="viewport" content="width=device-width, initial-scale=1"><style>body{font:15px/1.6 system-ui,sans-serif;max-width:680px;margin:48px auto;padding:0 20px;background:#0b1120;color:#e8e8f0}h1{font-size:20px}a{color:#6ea8fe;text-decoration:none}a:hover{text-decoration:underline}li{margin:10px 0}code{color:#9a9aab;font-size:12px;margin-left:8px}p{color:#9a9aab}</style></head><body><h1>Shared APIs</h1><p>This share exposes ${index.specs.length} separate APIs, each with its own OpenAPI document and auth:</p><ul>${items}</ul></body></html>`;
+}
+function downloadFilename(kind, portalId, payload) {
+  if (kind !== "openapi") return `shared-canvas.${safeFilenamePart(kind)}`;
+  if (portalId) return `shared-canvas.${safeFilenamePart(portalId)}.openapi.json`;
+  return asOpenApiIndex(payload) ? "shared-canvas.openapi.index.json" : "shared-canvas.openapi.json";
+}
 function shareRequestMeta(req) {
   const fwd = req.headers["x-forwarded-for"];
   const ip = (Array.isArray(fwd) ? fwd[0] : fwd)?.split(",")[0].trim() || req.socket?.remoteAddress || "unknown";
@@ -35500,14 +36883,16 @@ function serveSharedModel(cfg, token, req, res) {
   );
 }
 function serveSharedOpenApi(cfg, token, req, res) {
-  const result = downloadArtifact(cfg, token, "openapi", shareRequestMeta(req));
+  const result = downloadArtifact(cfg, token, "openapi", shareRequestMeta(req), specParam(req));
   if (!result.found || result.content === void 0) return notFoundPage(res);
+  const index = asOpenApiIndex(result.content);
   harden(res, void 0, "text/html; charset=utf-8");
   res.statusCode = 200;
-  res.end(swaggerUiPage(result.content, "Shared API"));
+  res.end(index ? sharedOpenApiIndexPage(index) : swaggerUiPage(result.content, "Shared API"));
 }
 function serveSharedDownload(cfg, token, kind, req, res) {
-  const result = downloadArtifact(cfg, token, kind, shareRequestMeta(req));
+  const portalId = specParam(req);
+  const result = downloadArtifact(cfg, token, kind, shareRequestMeta(req), portalId);
   if (!result.found || result.content === void 0) {
     if (result.outcome === "denied-download") {
       harden(res, void 0, "text/plain");
@@ -35517,9 +36902,11 @@ function serveSharedDownload(cfg, token, kind, req, res) {
     }
     return notFoundPage(res);
   }
-  const ext = kind === "html" ? "html" : kind === "openapi" ? "openapi.json" : kind;
   harden(res, void 0, result.contentType ?? "application/octet-stream");
-  res.setHeader("content-disposition", `attachment; filename="shared-canvas.${ext}"`);
+  res.setHeader(
+    "content-disposition",
+    `attachment; filename="${downloadFilename(kind, portalId, result.content)}"`
+  );
   res.statusCode = 200;
   res.end(result.content);
 }
@@ -35761,7 +37148,7 @@ function routeData(cfg, req, res) {
 }
 function readExposurePolicyFile(dataDir) {
   try {
-    const raw = fs49.readFileSync(path59.join(dataDir, "exposure-policy.json"), "utf8");
+    const raw = fs49.readFileSync(path58.join(dataDir, "exposure-policy.json"), "utf8");
     const parsed = JSON.parse(raw);
     return parsed && typeof parsed === "object" ? parsed : void 0;
   } catch {
@@ -36446,9 +37833,9 @@ function seedDemoTree() {
 
 // src/commands/host.ts
 function resolveHostConfig(options) {
-  const dataDir = options.dataDir || process.env["WAIRON_DATA_DIR"] || path60.join(os9.homedir(), ".wairon", "data");
+  const dataDir = options.dataDir || process.env["WAIRON_DATA_DIR"] || path59.join(os10.homedir(), ".wairon", "data");
   if (!process.env["WAIRON_PACKS_DIR"]) {
-    process.env["WAIRON_PACKS_DIR"] = path60.join(dataDir, "packs");
+    process.env["WAIRON_PACKS_DIR"] = path59.join(dataDir, "packs");
   }
   const cfg = {
     host: options.host || "0.0.0.0",
@@ -36573,13 +37960,13 @@ function openBrowser(url) {
 }
 async function runDev(options = {}) {
   const cwd = process.cwd();
-  if (!fs50.existsSync(path60.join(cwd, ".wai"))) {
+  if (!fs50.existsSync(path59.join(cwd, ".wai"))) {
     throw new WaironError(
       "No .wai/ found in the current directory. Run `wairon dev` from a wairon project root (or run `wairon init` first)."
     );
   }
   const hash = crypto20.createHash("sha256").update(cwd).digest("hex").slice(0, 16);
-  const dataDir = path60.join(os9.tmpdir(), "wairon-dev", hash);
+  const dataDir = path59.join(os10.tmpdir(), "wairon-dev", hash);
   fs50.mkdirSync(dataDir, { recursive: true });
   registerLocalDevProject(dataDir, "local", cwd);
   const port = options.port ? Number(options.port) : 8080;
@@ -36988,8 +38375,8 @@ async function runHostPacks(action, options = {}) {
       }
       case "install": {
         if (!options.file) throw new WaironError("`--file <path>` (a declarative pack YAML) is required for install.");
-        const name = options.name ?? path60.basename(options.file).replace(/\.(ya?ml)$/i, "");
-        const content = fs50.readFileSync(path60.resolve(options.file), "utf8");
+        const name = options.name ?? path59.basename(options.file).replace(/\.(ya?ml)$/i, "");
+        const content = fs50.readFileSync(path59.resolve(options.file), "utf8");
         const desc = project2 ? installProjectPack(cfg, cred, project2, name, content) : installGlobalPack(cfg, cred, name, content);
         logger.success(`Installed ${scope} pack "${desc.name}" (${desc.profiles} profile(s), ${desc.languages} language(s)).`);
         if (project2) logger.info("Committed with the project \u2014 every clone and CI will enforce it.");
@@ -37129,15 +38516,29 @@ async function runSurface(action, options = {}) {
       if (format !== "native" && format !== "openapi") {
         throw new WaironError(`Unknown format "${format}" (supported: native, openapi).`);
       }
-      const result = exportSurface(audience, format, options.out);
+      if (options.portal && format !== "openapi") {
+        throw new WaironError("`--portal` selects one OpenAPI document and only applies to `--format openapi`.");
+      }
+      const result = exportSurface(audience, format, options.out, options.portal);
       logger.success(
         `Projected surface of "${result.snapshot.projectName}": ${result.snapshot.interfaces.length} interface(s), ${result.snapshot.types.length} type(s) at audience \u2265 ${audience}.`
       );
-      if (result.writtenTo) {
-        logger.info(`Written to ${result.writtenTo}`);
+      const written = result.writtenPaths ?? (result.writtenTo ? [result.writtenTo] : []);
+      if (written.length === 1) {
+        logger.info(`Written to ${written[0]}`);
+      } else if (written.length > 1) {
+        logger.info(`Written ${written.length} document(s) \u2014 one per portal:`);
+        for (const p of written) logger.info(`  ${p}`);
       } else if (result.rendered) {
         process.stdout.write(`${result.rendered}
 `);
+      } else if (result.renderedSet && result.renderedSet.length > 1) {
+        logger.info(
+          `This project publishes ${result.renderedSet.length} portals \u2014 pick one with \`--portal <id>\` (or use --out to write them all):`
+        );
+        for (const spec of result.renderedSet) {
+          logger.info(`  ${import_chalk19.default.cyan(spec.portalId)} \u2014 ${spec.name}`);
+        }
       } else {
         for (const entry of result.snapshot.interfaces) {
           logger.info(`  ${import_chalk19.default.cyan(entry.id)} (${entry.type}, ${entry.audience}) \u2014 ${entry.methods.length} method(s)`);
@@ -37181,13 +38582,27 @@ async function runSurface(action, options = {}) {
       for (const p of written) logger.info(`  ${p}`);
       return;
     }
+    case "externals": {
+      const entries = listExternalInterfaces();
+      if (!entries.length) {
+        logger.info("No external surfaces available (.wai/surfaces/ holds no snapshots).");
+        return;
+      }
+      const freshness = (f) => f === "fresh" ? import_chalk19.default.green(f) : f === "stale" ? import_chalk19.default.yellow(f) : import_chalk19.default.gray(f);
+      for (const e of entries) {
+        logger.info(
+          `${e.sourceKind.padEnd(8)} ${import_chalk19.default.cyan(e.projectName)} [${e.origin}] ${freshness(e.freshness)} \u2014 ${e.interfaceIds.length ? e.interfaceIds.join(", ") : "(no interfaces)"}`
+        );
+      }
+      return;
+    }
     default:
-      throw new WaironError(`Unknown surface action "${action}" (supported: export, import, list, generate-children).`);
+      throw new WaironError(`Unknown surface action "${action}" (supported: export, import, list, generate-children, externals).`);
   }
 }
 
 // src/commands/subsystem.ts
-var path61 = __toESM(require("path"));
+var path60 = __toESM(require("path"));
 init_logger();
 init_errors();
 init_fs();
@@ -37223,9 +38638,9 @@ async function runSubsystemAdd(id, options = {}) {
     updatedAt: now
   };
   createChainedSubsystem(subsystem, displayName);
-  const childDir = path61.resolve(getProjectRoot(), options.projectPath);
+  const childDir = path60.resolve(getProjectRoot(), options.projectPath);
   logger.success(`Added external subsystem "${id}" \u2192 ${options.projectPath}`);
-  logger.info(`Scaffolded child project at ${path61.relative(process.cwd(), childDir) || "."}`);
+  logger.info(`Scaffolded child project at ${path60.relative(process.cwd(), childDir) || "."}`);
   logger.info(`Design its spec tree from this parent using namespaced ids (e.g. ${id}::<component>).`);
 }
 async function runSubsystemMove(id, options = {}) {
@@ -37248,9 +38663,9 @@ async function runSubsystemExternalize(id, options = {}) {
     throw new WaironError("--project-path (the subproject destination) is required.");
   }
   externalizeSubsystem(id, options.projectPath);
-  const childDir = path61.resolve(getProjectRoot(), options.projectPath);
+  const childDir = path60.resolve(getProjectRoot(), options.projectPath);
   logger.success(`Externalized subsystem "${id}" \u2192 ${options.projectPath}`);
-  logger.info(`Moved its specs into ${path61.relative(process.cwd(), childDir) || "."} (now a standalone subproject).`);
+  logger.info(`Moved its specs into ${path60.relative(process.cwd(), childDir) || "."} (now a standalone subproject).`);
   logger.info("Move the source code there yourself, then run `wairon validate` to confirm the tree.");
 }
 async function runSubsystemInternalize(id) {
@@ -37289,8 +38704,64 @@ program.command("generate").description("Generate agent output files from the sp
     dryRun: opts.dryRun
   });
 });
+async function runLock2(options) {
+  assertProjectInitialized();
+  if (!pathExists(AI_PATHS.specsSystem())) {
+    logger.error("No SDD spec tree found (.wai/specs). Nothing to lock.");
+    process.exit(1);
+  }
+  const projectConfig = loadProjectConfig();
+  logger.info("Analyzing and validating specifications in-memory...");
+  const dry = validateAsComplete({
+    rules: projectConfig.rules,
+    projectType: projectConfig.projectType,
+    scopeSubsystem: options.subsystem,
+    recursive: options.recursive ?? true
+  });
+  const errors = dry.issues.filter((i) => i.severity === "error");
+  if (errors.length > 0) {
+    logger.header("Cannot lock \u2014 the spec tree does not validate as complete");
+    let errorCount = 0;
+    const MAX_PRINT = 100;
+    let skippedErrors = 0;
+    for (const i of errors) {
+      if (errorCount < MAX_PRINT) {
+        logger.error(`${i.specId ? `[${i.specId}] ` : ""}[${i.code}] ${i.message}`);
+        errorCount++;
+      } else {
+        skippedErrors++;
+      }
+    }
+    if (skippedErrors > 0) {
+      logger.error(`... and ${skippedErrors} more error(s) omitted.`);
+    }
+    logger.blank();
+    logger.info("Fix the errors above, then run `wairon lock` again. Nothing was changed.");
+    process.exit(1);
+  }
+  logger.header("Lock SDD specs");
+  const record2 = await runLock(options, dry);
+  if (!record2) {
+    logger.info("Cancelled. Nothing was changed.");
+    return;
+  }
+  const childPaths = generateChildSnapshots();
+  if (childPaths.length > 0) {
+    logger.blank();
+    logger.success(`Regenerated the family/sibling surfaces into ${childPaths.length} chained child snapshot(s):`);
+    for (const p of childPaths) logger.info(`  ${p}`);
+  }
+  logger.blank();
+  await runGenerate({ domain: options.subsystem });
+  logger.blank();
+  logger.success("Specs locked and agent topology generated.");
+  logger.info(`Lock record written (.wai/lock.json): stateId ${record2.stateId.algorithm}:${record2.stateId.digest} \u2014 status ${record2.status}.`);
+  logger.warn(
+    "Restart any running AI agent sessions (Claude Code / Antigravity / Codex) so the newly generated implementer agents load \u2014 they are not picked up mid-session."
+  );
+}
 program.command("lock").description("Final check before implementation: validate the spec tree as complete, freeze all specs to complete, and (re)generate the agent topology \u2014 only if it validates").option("-y, --yes", "skip the confirmation prompt (for scripts / CI)").option("--subsystem <id>", "only lock specs in the specified subsystem").option("--no-recursive", "do not recursively validate subprojects").action(async (opts) => {
-  await runLock({ yes: opts.yes, subsystem: opts.subsystem, recursive: opts.recursive });
+  await runLock2({ yes: opts.yes, subsystem: opts.subsystem, recursive: opts.recursive });
 });
 program.command("validate").description("Validate the project configuration and the SDD Spec Tree").option("--ci", "treat warnings as errors for CI pipelines").option("--subsystem <id>", "only validate the specified subsystem (granular)").option("--no-recursive", "do not recursively validate subprojects").action(async (opts) => {
   await runValidate({ ci: opts.ci, subsystem: opts.subsystem, recursive: opts.recursive });
@@ -37406,13 +38877,14 @@ mcpCmd.command("status").description("Show whether the wairon MCP server is regi
 program.command("produce <target>").description("project the local project's specs to a producer target (notion | miro)").option("--page <id>", "parent page/board id in the target").option("--token <token>", "integration token (else env, else interactive prompt)").action(async (target, opts) => {
   await runProduce(target, { page: opts.page, token: opts.token });
 });
-program.command("surface <action>").description("public surface exchange: export | import | list | generate-children").option("--audience <level>", "export ceiling: project | department | instance | partner | external (default instance)").option("--format <fmt>", "export format: native | openapi (default native)").option("--out <path>", "export output path (else print)").option("--source <path>", "import: the surface document (native snapshot YAML or OpenAPI)").option("--origin <origin>", "import provenance: exchanged | authored (default authored)").action(async (action, opts) => {
+program.command("surface <action>").description("public surface exchange: export | import | list | generate-children | externals").option("--audience <level>", "export ceiling: project | department | instance | partner | external (default instance)").option("--format <fmt>", "export format: native | openapi (default native)").option("--out <path>", "export output path (else print)").option("--portal <id>", "export: select one portal's OpenAPI spec (a multi-portal project renders one document per portal)").option("--source <path>", "import: the surface document (native snapshot YAML or OpenAPI)").option("--origin <origin>", "import provenance: exchanged | authored (default authored)").action(async (action, opts) => {
   await runSurface(action, {
     audience: opts.audience,
     format: opts.format,
     out: opts.out,
     source: opts.source,
-    origin: opts.origin
+    origin: opts.origin,
+    portal: opts.portal
   });
 });
 program.command("serve").description("Run the wairon hosting server: HTTP MCP for many isolated projects + admin API").option("--host <host>", "data-plane bind host (default 0.0.0.0)").option("--port <port>", "data-plane port (default 8080)").option("--admin-host <host>", "admin-plane bind host (default 127.0.0.1)").option("--admin-port <port>", "admin-plane port (default 8081)").option("--data-dir <path>", "data root holding projects/ and auth/ (default WAIRON_DATA_DIR or ~/.wairon/data)").option("--no-auth", "disable data-plane auth (trusted networks only)").action(async (opts) => {