@wairon/cli 5.1.1-dev.100 → 5.1.1-dev.102

package/dist/cli/index.js

@@ -65,7 +65,7 @@ var init_defaults = __esm({
       copilot: ".github/prompts",
       codex: ".codex/agents"
     };
-    WAIRON_VERSION = "5.1.1-dev.100";
+    WAIRON_VERSION = "5.1.1-dev.102";
     GITHUB_REPO = "SYW-Apps/Waffle-AIron";
     SUPPORTED_ALIASES = ["wai"];
     SCAN_EXCLUDE_DIRS = /* @__PURE__ */ new Set([
@@ -214,6 +214,7 @@ __export(fs_exports, {
   getRequestProjectRoot: () => getRequestProjectRoot,
   getWriteReach: () => getWriteReach,
   isOutsideRoot: () => isOutsideRoot,
+  lineEndingFor: () => lineEndingFor,
   listFiles: () => listFiles,
   listFilesRecursive: () => listFilesRecursive,
   pathExists: () => pathExists,
@@ -222,6 +223,7 @@ __export(fs_exports, {
   runWithProjectBinding: () => runWithProjectBinding,
   runWithProjectRoot: () => runWithProjectRoot,
   setProjectRoot: () => setProjectRoot,
+  withLineEndings: () => withLineEndings,
   writeFile: () => writeFile,
   writeFileIfChanged: () => writeFileIfChanged,
   writeReachDenials: () => writeReachDenials,
@@ -232,17 +234,118 @@ function ensureDir(dirPath) {
 }
 function writeFile(filePath, content) {
   ensureDir(path2.dirname(filePath));
-  fs.writeFileSync(filePath, content, "utf-8");
+  fs.writeFileSync(filePath, withLineEndings(filePath, content), "utf-8");
 }
 function writeFileIfChanged(filePath, content) {
+  const text3 = withLineEndings(filePath, content);
   if (fs.existsSync(filePath)) {
     const existing = fs.readFileSync(filePath, "utf-8");
-    if (existing === content) return false;
+    if (existing === text3) return false;
   }
   ensureDir(path2.dirname(filePath));
-  fs.writeFileSync(filePath, content, "utf-8");
+  fs.writeFileSync(filePath, text3, "utf-8");
   return true;
 }
+function endingsOf(text3) {
+  const crlf = text3.split("\r\n").length - 1;
+  const lf = text3.split("\n").length - 1 - crlf;
+  if (crlf === 0 && lf === 0) return null;
+  return crlf > lf ? "\r\n" : "\n";
+}
+function sampleOf(file) {
+  let fd;
+  try {
+    fd = fs.openSync(file, "r");
+    const buffer = Buffer.alloc(EOL_SAMPLE_BYTES);
+    const read2 = fs.readSync(fd, buffer, 0, EOL_SAMPLE_BYTES, 0);
+    return buffer.subarray(0, read2).toString("utf-8");
+  } catch {
+    return null;
+  } finally {
+    if (fd !== void 0) fs.closeSync(fd);
+  }
+}
+function attributeMatches(pattern, relative28) {
+  const glob = pattern.replace(/^\//, "");
+  const target = glob.includes("/") ? relative28 : path2.posix.basename(relative28);
+  const source = glob.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*\*\//g, "\0").replace(/\*/g, "[^/]*").replace(/\?/g, "[^/]").replace(/\u0000/g, "(?:.*/)?");
+  return new RegExp(`^${source}$`).test(target);
+}
+function attributeEol(attributesFile, file) {
+  const text3 = readFileOrNull(attributesFile);
+  if (text3 === null) return null;
+  const relative28 = path2.relative(path2.dirname(attributesFile), file).split(path2.sep).join("/");
+  let eol = null;
+  for (const raw of text3.split(/\r?\n/)) {
+    const line2 = raw.trim();
+    if (line2 === "" || line2.startsWith("#")) continue;
+    const [pattern, ...attrs] = line2.split(/\s+/);
+    if (!attributeMatches(pattern, relative28)) continue;
+    for (const attr of attrs) {
+      if (attr === "eol=crlf") eol = "\r\n";
+      else if (attr === "eol=lf") eol = "\n";
+      else if (attr === "-text" || attr === "binary") eol = null;
+    }
+  }
+  return eol;
+}
+function conventionFolders(dir) {
+  const folders = [];
+  let at = path2.resolve(dir);
+  for (let depth = 0; depth < 8; depth++) {
+    folders.push(at);
+    if (fs.existsSync(path2.join(at, ".git")) || fs.existsSync(path2.join(at, ".wai"))) return folders;
+    const parent = path2.dirname(at);
+    if (parent === at) break;
+    at = parent;
+  }
+  return folders.slice(0, 1);
+}
+function folderEndings(folder, ext, exclude) {
+  let names;
+  try {
+    names = fs.readdirSync(folder);
+  } catch {
+    return null;
+  }
+  const candidates = names.filter((n) => path2.join(folder, n) !== exclude && /\.(ya?ml|json|md|ts|js|txt)$/i.test(n)).sort((a, b) => Number(path2.extname(b) === ext) - Number(path2.extname(a) === ext)).slice(0, 24);
+  let crlf = 0;
+  let lf = 0;
+  for (const name of candidates) {
+    const full = path2.join(folder, name);
+    try {
+      if (!fs.statSync(full).isFile()) continue;
+    } catch {
+      continue;
+    }
+    const sample = sampleOf(full);
+    const endings = sample === null ? null : endingsOf(sample);
+    if (endings === "\r\n") crlf++;
+    else if (endings === "\n") lf++;
+  }
+  if (crlf === lf) return null;
+  return crlf > lf ? "\r\n" : "\n";
+}
+function lineEndingFor(filePath) {
+  const own = sampleOf(filePath);
+  const existing = own === null ? null : endingsOf(own);
+  if (existing) return existing;
+  const folders = conventionFolders(path2.dirname(filePath));
+  for (const folder of folders) {
+    const eol = attributeEol(path2.join(folder, ".gitattributes"), filePath);
+    if (eol) return eol;
+  }
+  const ext = path2.extname(filePath);
+  for (const folder of folders) {
+    const endings = folderEndings(folder, ext, path2.resolve(filePath));
+    if (endings) return endings;
+  }
+  return "\n";
+}
+function withLineEndings(filePath, content) {
+  const normalised = content.replace(/\r\n/g, "\n");
+  return lineEndingFor(filePath) === "\r\n" ? normalised.replace(/\n/g, "\r\n") : normalised;
+}
 function readFileOrNull(filePath) {
   try {
     return fs.readFileSync(filePath, "utf-8");
@@ -384,19 +487,154 @@ function aiDirAt(root, ...segments) {
   const base = !fs.existsSync(waiPath) && fs.existsSync(waironPath) ? waironPath : waiPath;
   return path2.join(base, ...segments);
 }
-var fs, path2, import_node_async_hooks, projectRootOverride, sameRoot, requestRootStore;
+var fs, path2, import_node_async_hooks, EOL_SAMPLE_BYTES, projectRootOverride, sameRoot, requestRootStore;
 var init_fs = __esm({
   "src/utils/fs.ts"() {
     "use strict";
     fs = __toESM(require("fs"));
     path2 = __toESM(require("path"));
     import_node_async_hooks = require("async_hooks");
+    EOL_SAMPLE_BYTES = 64 * 1024;
     projectRootOverride = null;
     sameRoot = (a, b) => path2.resolve(a) === path2.resolve(b);
     requestRootStore = new import_node_async_hooks.AsyncLocalStorage();
   }
 });
 
+// src/core/adapters/git-source.ts
+function osUserCache() {
+  if (process.platform === "win32") return process.env.LOCALAPPDATA ?? path3.join(os2.homedir(), "AppData", "Local");
+  if (process.platform === "darwin") return path3.join(os2.homedir(), "Library", "Caches");
+  return process.env.XDG_CACHE_HOME ?? path3.join(os2.homedir(), ".cache");
+}
+function cacheRoot() {
+  const setting = process.env.WAIRON_CACHE_DIR ?? "";
+  let root = cacheRoots.get(setting);
+  if (root === void 0) {
+    root = setting !== "" ? path3.resolve(setting) : path3.join(osUserCache(), "wairon");
+    cacheRoots.set(setting, root);
+  }
+  return root;
+}
+function git(args, cwd) {
+  return (0, import_child_process.execFileSync)("git", args, {
+    cwd,
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"],
+    env: { ...process.env, GIT_TERMINAL_PROMPT: "0", GIT_ASKPASS: "echo" }
+  });
+}
+function reasonOf(e) {
+  const stderr = e?.stderr;
+  const text3 = typeof stderr === "string" && stderr.trim() !== "" ? stderr : e instanceof Error ? e.message : String(e);
+  return text3.trim().split(/\r?\n/).filter((l) => l.trim() !== "").slice(-1)[0] ?? "git failed";
+}
+function cacheEntryOf(url, commit3) {
+  const repo = crypto.createHash("sha256").update(url).digest("hex");
+  return path3.join(cacheRoot(), "git", repo, commit3);
+}
+function within(entry, url, commit3, dir) {
+  const at = dir ? path3.join(entry, dir) : entry;
+  if (!fs2.existsSync(at)) {
+    throw new SourceUnavailable(`the commit ${commit3} of ${url} holds no "${dir}"`);
+  }
+  return at;
+}
+function fetchInto(tmp, url, commit3) {
+  git(["init", "-q"], tmp);
+  try {
+    git(["fetch", "-q", "--depth", "1", url, commit3], tmp);
+  } catch {
+    git(["fetch", "-q", url, "+refs/heads/*:refs/remotes/source/*", "+refs/tags/*:refs/tags/*"], tmp);
+  }
+  git(["-c", "advice.detachedHead=false", "checkout", "-q", commit3], tmp);
+  fs2.rmSync(path3.join(tmp, ".git"), { recursive: true, force: true });
+}
+function fetch2(url, commit3, dir) {
+  const entry = cacheEntryOf(url, commit3);
+  if (fs2.existsSync(entry)) return within(entry, url, commit3, dir);
+  fs2.mkdirSync(path3.dirname(entry), { recursive: true });
+  const tmp = `${entry}.tmp-${process.pid}-${crypto.randomBytes(4).toString("hex")}`;
+  fs2.mkdirSync(tmp, { recursive: true });
+  try {
+    fetchInto(tmp, url, commit3);
+    try {
+      fs2.renameSync(tmp, entry);
+    } catch (e) {
+      if (!fs2.existsSync(entry)) throw e;
+      fs2.rmSync(tmp, { recursive: true, force: true });
+    }
+  } catch (e) {
+    fs2.rmSync(tmp, { recursive: true, force: true });
+    if (fs2.readdirSync(path3.dirname(entry)).length === 0) fs2.rmdirSync(path3.dirname(entry));
+    throw e instanceof SourceUnavailable ? e : new SourceUnavailable(`cannot fetch ${commit3} of ${url}: ${reasonOf(e)}`);
+  }
+  return within(entry, url, commit3, dir);
+}
+function resolve3(url, ref) {
+  let listed;
+  try {
+    listed = git(["ls-remote", url, ref ?? "HEAD"]);
+  } catch (e) {
+    throw new SourceUnavailable(`cannot reach ${url}: ${reasonOf(e)}`);
+  }
+  const wanted = commitListed(listed, ref ?? "HEAD");
+  if (!wanted) throw new SourceUnavailable(`${url} lists no ref "${ref ?? "HEAD"}"`);
+  return wanted;
+}
+function commitListed(listed, ref) {
+  const lines = listed.split(/\r?\n/).filter((l) => l.trim() !== "").map((l) => l.split(/\s+/));
+  const names = [ref, `refs/heads/${ref}`, `refs/tags/${ref}^{}`, `refs/tags/${ref}`];
+  for (const name of names) {
+    const line2 = lines.find(([, listedName]) => listedName === name);
+    if (line2) return line2[0];
+  }
+  return void 0;
+}
+function trackedFiles(directory, pathspecs) {
+  if (pathspecs.length === 0) return [];
+  try {
+    return git(["ls-files", "-z", "--", ...pathspecs], directory).split("\0").filter((p) => p !== "");
+  } catch {
+    return null;
+  }
+}
+function head(directory) {
+  try {
+    return git(["rev-parse", "HEAD"], directory).trim() || null;
+  } catch {
+    return null;
+  }
+}
+function repositoryRoot(directory) {
+  let at = path3.resolve(directory);
+  for (; ; ) {
+    if (fs2.existsSync(path3.join(at, ".git"))) return at;
+    const up = path3.dirname(at);
+    if (up === at) return null;
+    at = up;
+  }
+}
+var import_child_process, crypto, fs2, os2, path3, SourceUnavailable, cacheRoots;
+var init_git_source = __esm({
+  "src/core/adapters/git-source.ts"() {
+    "use strict";
+    import_child_process = require("child_process");
+    crypto = __toESM(require("crypto"));
+    fs2 = __toESM(require("fs"));
+    os2 = __toESM(require("os"));
+    path3 = __toESM(require("path"));
+    init_errors();
+    SourceUnavailable = class extends WaironError {
+      constructor(message) {
+        super(message);
+        this.name = "SourceUnavailable";
+      }
+    };
+    cacheRoots = /* @__PURE__ */ new Map();
+  }
+});
+
 // src/utils/yaml.ts
 function parseYaml(content, sourcePath) {
   try {
@@ -720,7 +958,7 @@ function activeTargetTypes(config) {
 function declaredPackNames(config) {
   const selection = config.profileSelection;
   return [.../* @__PURE__ */ new Set([
-    ...(config.extensions?.packs ?? []).map((entry) => typeof entry === "string" ? path3.basename(entry).replace(PACK_EXT_RE, "") : entry.name),
+    ...(config.extensions?.packs ?? []).map((entry) => typeof entry === "string" ? path4.basename(entry).replace(PACK_EXT_RE, "") : entry.name),
     ...selection?.requiredPackNames ?? [],
     ...selection?.defaultPackNames ?? []
   ])];
@@ -999,11 +1237,11 @@ function declaredMembers(config) {
 function isPart(config) {
   return config?.partOf !== void 0;
 }
-var path3, import_zod3, BuiltinTargetConfigSchema, CustomTargetConfigSchema, TargetConfigSchema, NamingRuleConfigSchema, DocumentationRuleConfigSchema, ComplexityRuleConfigSchema, CarriedDebtKindSchema, CarriedFindingSchema, CarriedDebtSchema, ConformanceRuleConfigSchema, DesignDepthSchema, RulesConfigSchema, PathsConfigSchema, PackSelectionSchema, ProfileSelectionSubjectSchema, ProjectProfileSelectionSchema, ExternalSourceSchema, ExternalDeclarationSchema, MemberDeclarationSchema, PartOfSchema, plainString, PackRequirementSchema, CompositionConfigSchema, ProjectConfigSchema, PACK_EXT_RE, CONCRETE_RE, PARTIAL_RE, OPERATOR_RE, text, cv, PROJECT_ID_RE, EXTERNAL_ALIAS_RE, USE_ENTRY_RE, FULL_COMMIT_RE, GIT_URL_RE;
+var path4, import_zod3, BuiltinTargetConfigSchema, CustomTargetConfigSchema, TargetConfigSchema, NamingRuleConfigSchema, DocumentationRuleConfigSchema, ComplexityRuleConfigSchema, CarriedDebtKindSchema, CarriedFindingSchema, CarriedDebtSchema, ConformanceRuleConfigSchema, DesignDepthSchema, RulesConfigSchema, PathsConfigSchema, PackSelectionSchema, ProfileSelectionSubjectSchema, ProjectProfileSelectionSchema, ExternalSourceSchema, ExternalDeclarationSchema, MemberDeclarationSchema, PartOfSchema, plainString, PackRequirementSchema, CompositionConfigSchema, ProjectConfigSchema, PACK_EXT_RE, CONCRETE_RE, PARTIAL_RE, OPERATOR_RE, text, cv, PROJECT_ID_RE, EXTERNAL_ALIAS_RE, USE_ENTRY_RE, FULL_COMMIT_RE, GIT_URL_RE;
 var init_project = __esm({
   "src/models/project.ts"() {
     "use strict";
-    path3 = __toESM(require("path"));
+    path4 = __toESM(require("path"));
     import_zod3 = require("zod");
     init_agent();
     init_execution();
@@ -1335,7 +1573,7 @@ var init_project = __esm({
       /**
        * The producer's public names this project imports, so its specs may name
        * them bare: `['*']` imports every public name the producer exports to this
-       * project, `[waffler-error]` only those. Plain strings: a malformed entry is
+       * project, `[shared-error]` only those. Plain strings: a malformed entry is
        * REPORTED (the declaration's problem), never unreadable.
        */
       use: import_zod3.z.array(import_zod3.z.string()).optional(),
@@ -1546,13 +1784,13 @@ var init_project = __esm({
 
 // src/config/project-config.ts
 function waiDirAt(root) {
-  const wai = path4.join(root, ".wai");
-  const legacy = path4.join(root, ".wairon");
-  return !fs2.existsSync(wai) && fs2.existsSync(legacy) ? legacy : wai;
+  const wai = path5.join(root, ".wai");
+  const legacy = path5.join(root, ".wairon");
+  return !fs3.existsSync(wai) && fs3.existsSync(legacy) ? legacy : wai;
 }
 function projectConfigFsAdapterAt(rootDir) {
-  const root = path4.resolve(rootDir);
-  const file = () => path4.join(waiDirAt(root), "project.yaml");
+  const root = path5.resolve(rootDir);
+  const file = () => path5.join(waiDirAt(root), "project.yaml");
   return {
     readDocument() {
       return readYamlFile(file());
@@ -1566,7 +1804,7 @@ function projectConfigFsAdapterAt(rootDir) {
       writeFile(file(), editDocumentText(text3, document, root));
     },
     documentExists() {
-      return fs2.existsSync(file());
+      return fs3.existsSync(file());
     },
     readText() {
       return readFileOrNull(file());
@@ -1588,8 +1826,9 @@ function storeOver(adapter, root) {
       if (!checked.success) {
         throw new WaironError(`Refusing to write an invalid .wai/project.yaml at ${root}: ${checked.error.message}`);
       }
-      const document = config.partOf !== void 0 ? { schemaVersion: config.schemaVersion, partOf: config.partOf } : config;
-      adapter.writeDocument(overlayKnownFields(ProjectConfigSchema, document, currentDocument()));
+      const onDisk = currentDocument();
+      const document = config.partOf !== void 0 ? { schemaVersion: config.schemaVersion, partOf: config.partOf } : withoutDefaultedMaterialization(config, onDisk);
+      adapter.writeDocument(overlayKnownFields(ProjectConfigSchema, document, onDisk));
     },
     exists() {
       return adapter.documentExists();
@@ -1846,9 +2085,67 @@ function asReadable(document) {
   if (!isPlainObject(document) || document.partOf === void 0) return document;
   return { name: "", createdAt: PART_EPOCH, updatedAt: PART_EPOCH, ...document };
 }
+function holdsMaterializedAgentFiles(document, root) {
+  const dirs = new Set(Object.values(DEFAULT_TARGET_DIRS));
+  for (const target of Array.isArray(document.targets) ? document.targets : []) {
+    const outputDir = isPlainObject(target) ? target.outputDir : void 0;
+    if (typeof outputDir === "string") dirs.add(outputDir);
+  }
+  const base = path5.resolve(root);
+  const inside = [];
+  for (const dir of dirs) {
+    const rel2 = path5.relative(base, path5.resolve(base, dir));
+    if (rel2.startsWith("..") || path5.isAbsolute(rel2)) continue;
+    let present = false;
+    try {
+      present = fs3.statSync(path5.join(base, rel2)).isDirectory();
+    } catch {
+      present = false;
+    }
+    if (present) inside.push(rel2 === "" ? "." : rel2.split(path5.sep).join("/"));
+  }
+  if (inside.length === 0) return false;
+  const tracked = trackedFiles(base, inside);
+  const candidates = [];
+  if (tracked === null) {
+    for (const dir of inside) {
+      let names;
+      try {
+        names = fs3.readdirSync(path5.join(base, dir));
+      } catch {
+        continue;
+      }
+      for (const name of names) candidates.push(path5.posix.join(dir, name));
+    }
+  } else {
+    const folders = new Set(inside.map((dir) => path5.posix.normalize(dir)));
+    for (const file of tracked) if (folders.has(path5.posix.dirname(file))) candidates.push(file);
+  }
+  for (const file of candidates) {
+    const head2 = readFileOrNull(path5.join(base, file));
+    if (head2 === null) continue;
+    if (MANAGED_AGENT_NAME.test(path5.posix.basename(file))) return true;
+    if (head2.slice(0, 4096).includes(MANAGED_AGENT_MARKER)) return true;
+  }
+  return false;
+}
+function withInferredMaterialization(document, root) {
+  if (!isPlainObject(document) || document.partOf !== void 0) return document;
+  const rules = isPlainObject(document.rules) ? document.rules : void 0;
+  if (rules !== void 0 && hasOwn(rules, "materializeAgentFiles")) return document;
+  if (!holdsMaterializedAgentFiles(document, root)) return document;
+  return { ...document, rules: { ...rules ?? {}, materializeAgentFiles: true } };
+}
+function withoutDefaultedMaterialization(config, onDisk) {
+  if (!isPlainObject(onDisk) || config.rules?.materializeAgentFiles !== false) return config;
+  const stated = isPlainObject(onDisk.rules) && hasOwn(onDisk.rules, "materializeAgentFiles");
+  if (stated) return config;
+  const { materializeAgentFiles: _defaulted, ...rules } = config.rules;
+  return { ...config, rules };
+}
 function parseConfig(document, root) {
   try {
-    return ProjectConfigSchema.parse(asReadable(document));
+    return ProjectConfigSchema.parse(asReadable(withInferredMaterialization(document, root)));
   } catch (e) {
     throw new WaironError(
       `Invalid .wai/project.yaml: ${e instanceof Error ? e.message : String(e)}
@@ -2287,15 +2584,15 @@ function indexOver(store, root) {
     specsDir() {
       try {
         const declared = store.readField("paths.specsDir");
-        if (declared) return path4.resolve(root, declared);
+        if (declared) return path5.resolve(root, declared);
       } catch {
       }
-      return path4.join(waiDirAt(root), "specs");
+      return path5.join(waiDirAt(root), "specs");
     }
   };
 }
 function projectConfigRepositoryOver(adapter, rootDir) {
-  const root = path4.resolve(rootDir);
+  const root = path5.resolve(rootDir);
   const store = storeOver(adapter, root);
   const index = indexOver(store, root);
   const registry = registryOver(store, root);
@@ -2389,15 +2686,17 @@ function projectConfigRepositoryOver(adapter, rootDir) {
 function projectConfigRepositoryAt(rootDir) {
   return projectConfigRepositoryOver(projectConfigFsAdapterAt(rootDir), rootDir);
 }
-var fs2, path4, YAML, import_zod4, KEY_RE, FRESH_TEXT_OPTIONS, PARSE_OPTIONS, DocumentReconciler, PART_EPOCH, USE_GLOBAL_PACKS_DEFAULT, PROJECT_FIELDS, bound, projectConfigRepository;
+var fs3, path5, YAML, import_zod4, KEY_RE, FRESH_TEXT_OPTIONS, PARSE_OPTIONS, DocumentReconciler, PART_EPOCH, MANAGED_AGENT_MARKER, MANAGED_AGENT_NAME, USE_GLOBAL_PACKS_DEFAULT, PROJECT_FIELDS, bound, projectConfigRepository;
 var init_project_config = __esm({
   "src/config/project-config.ts"() {
     "use strict";
-    fs2 = __toESM(require("fs"));
-    path4 = __toESM(require("path"));
+    fs3 = __toESM(require("fs"));
+    path5 = __toESM(require("path"));
     YAML = __toESM(require("yaml"));
     import_zod4 = require("zod");
     init_fs();
+    init_defaults();
+    init_git_source();
     init_yaml();
     init_fs();
     init_errors();
@@ -2546,6 +2845,8 @@ var init_project_config = __esm({
       }
     };
     PART_EPOCH = "1970-01-01T00:00:00.000Z";
+    MANAGED_AGENT_MARKER = "wairon:managed";
+    MANAGED_AGENT_NAME = /-(owner|implementer|architect)\.(md|ya?ml)$/;
     USE_GLOBAL_PACKS_DEFAULT = ProjectConfigSchema.shape.extensions.unwrap().parse({}).useGlobalPacks;
     PROJECT_FIELDS = ["id", "members", "externals", "composition", "rules", "extensions", "targets"];
     bound = () => {
@@ -2643,12 +2944,12 @@ var init_project_config = __esm({
 
 // src/config/paths.ts
 function aiPathsAt(rootDir) {
-  const resolvedRoot = path5.resolve(rootDir);
+  const resolvedRoot = path6.resolve(rootDir);
   const aiDirAt2 = (...segments) => {
-    const waiPath = path5.join(resolvedRoot, ".wai");
-    const waironPath = path5.join(resolvedRoot, ".wairon");
-    const base = !fs3.existsSync(waiPath) && fs3.existsSync(waironPath) ? waironPath : waiPath;
-    return path5.join(base, ...segments);
+    const waiPath = path6.join(resolvedRoot, ".wai");
+    const waironPath = path6.join(resolvedRoot, ".wairon");
+    const base = !fs4.existsSync(waiPath) && fs4.existsSync(waironPath) ? waironPath : waiPath;
+    return path6.join(base, ...segments);
   };
   const specsDir = () => projectConfigRepositoryAt(resolvedRoot).specsDir();
   return {
@@ -2665,12 +2966,12 @@ function aiPathsAt(rootDir) {
     contextDomainsMd: () => aiDirAt2("context", "domains.md"),
     contextWaironGuideMd: () => aiDirAt2("context", "wairon-guide.md"),
     specsDir,
-    specsSystem: () => path5.join(specsDir(), ".index.yaml"),
-    specsSubsystemsDir: () => path5.join(specsDir(), "subsystems"),
-    specsComponentsDir: () => path5.join(specsDir(), "components"),
-    specsInterfacesDir: () => path5.join(specsDir(), "interfaces"),
-    specsImplementationsDir: () => path5.join(specsDir(), "implementations"),
-    specsTypesDir: () => path5.join(specsDir(), "types")
+    specsSystem: () => path6.join(specsDir(), ".index.yaml"),
+    specsSubsystemsDir: () => path6.join(specsDir(), "subsystems"),
+    specsComponentsDir: () => path6.join(specsDir(), "components"),
+    specsInterfacesDir: () => path6.join(specsDir(), "interfaces"),
+    specsImplementationsDir: () => path6.join(specsDir(), "implementations"),
+    specsTypesDir: () => path6.join(specsDir(), "types")
   };
 }
 function isProjectInitialized() {
@@ -2681,12 +2982,12 @@ function assertProjectInitialized() {
     throw new ProjectNotInitializedError();
   }
 }
-var fs3, path5, AI_PATHS;
+var fs4, path6, AI_PATHS;
 var init_paths = __esm({
   "src/config/paths.ts"() {
     "use strict";
-    fs3 = __toESM(require("fs"));
-    path5 = __toESM(require("path"));
+    fs4 = __toESM(require("fs"));
+    path6 = __toESM(require("path"));
     init_fs();
     init_errors();
     init_project_config();
@@ -2755,7 +3056,7 @@ function digestTree(keep, asStored = (impl) => impl) {
     implementations: kind(loadImplementationSpecs().map(asStored)),
     types: kind(loadTypeSpecs())
   };
-  const digest3 = crypto.createHash("sha256").update(canonicalize(tree)).digest("hex");
+  const digest3 = crypto2.createHash("sha256").update(canonicalize(tree)).digest("hex");
   return { algorithm: CONTENT_ALGORITHM, digest: digest3 };
 }
 function computeStateId() {
@@ -2775,11 +3076,11 @@ function computeOwnStateId() {
   return digestTree((id) => (owners.get(id) ?? "") === "", asStored);
 }
 function isInside(dir, file) {
-  const rel2 = path6.relative(dir, file);
-  return rel2 !== "" && !rel2.startsWith("..") && !path6.isAbsolute(rel2);
+  const rel2 = path7.relative(dir, file);
+  return rel2 !== "" && !rel2.startsWith("..") && !path7.isAbsolute(rel2);
 }
 function fromPartRoot(impl, root, partDir) {
-  const from = (p) => path6.isAbsolute(p) ? p : path6.relative(partDir, path6.resolve(root, p)).split(path6.sep).join("/");
+  const from = (p) => path7.isAbsolute(p) ? p : path7.relative(partDir, path7.resolve(root, p)).split(path7.sep).join("/");
   return {
     ...impl,
     ...impl.sourcePath ? { sourcePath: from(impl.sourcePath) } : {},
@@ -2790,13 +3091,13 @@ function fromPartRoot(impl, root, partDir) {
 function stateIdEquals(a, b) {
   return !!a && !!b && a.algorithm === b.algorithm && a.digest === b.digest;
 }
-var crypto, path6, CONTENT_ALGORITHM;
+var crypto2, path7, CONTENT_ALGORITHM;
 var init_statehash = __esm({
   "src/core/statehash.ts"() {
     "use strict";
-    crypto = __toESM(require("crypto"));
+    crypto2 = __toESM(require("crypto"));
     init_specs2();
-    path6 = __toESM(require("path"));
+    path7 = __toESM(require("path"));
     init_fs();
     init_canonical_json();
     CONTENT_ALGORITHM = "sha256";
@@ -2817,14 +3118,14 @@ function normalizeApprover(value) {
 }
 function readLockRecord() {
   try {
-    return normalizeRecord(JSON.parse(fs4.readFileSync(lockPath(), "utf8")));
+    return normalizeRecord(JSON.parse(fs5.readFileSync(lockPath(), "utf8")));
   } catch {
     return null;
   }
 }
 function readLockRecordAt(root) {
   try {
-    return normalizeRecord(JSON.parse(fs4.readFileSync(aiDirAt(root, "lock.json"), "utf8")));
+    return normalizeRecord(JSON.parse(fs5.readFileSync(aiDirAt(root, "lock.json"), "utf8")));
   } catch {
     return null;
   }
@@ -2835,10 +3136,10 @@ function normalizeRecord(raw) {
 }
 function writeLockRecord(record2) {
   const p = lockPath();
-  fs4.mkdirSync(path7.dirname(p), { recursive: true });
+  fs5.mkdirSync(path8.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
-  fs4.writeFileSync(tmp, JSON.stringify(withSortedMaps(record2), null, 2) + "\n");
-  fs4.renameSync(tmp, p);
+  fs5.writeFileSync(tmp, withLineEndings(p, JSON.stringify(withSortedMaps(record2), null, 2) + "\n"));
+  fs5.renameSync(tmp, p);
 }
 function withSortedMaps(record2) {
   const sorted = (m) => {
@@ -2856,12 +3157,12 @@ function withSortedMaps(record2) {
     ...members ? { members } : {}
   };
 }
-var fs4, path7;
+var fs5, path8;
 var init_lockfile = __esm({
   "src/core/lockfile.ts"() {
     "use strict";
-    fs4 = __toESM(require("fs"));
-    path7 = __toESM(require("path"));
+    fs5 = __toESM(require("fs"));
+    path8 = __toESM(require("path"));
     init_fs();
   }
 });
@@ -2877,157 +3178,31 @@ function listSpecFiles(specsDir) {
   return listFilesRecursive(specsDir, SPEC_FILE_EXTENSION);
 }
 function removeSpecFile(specPath, specsRoot) {
-  if (!fs5.existsSync(specPath)) return false;
-  fs5.unlinkSync(specPath);
-  pruneEmptyDirs(path8.dirname(specPath), path8.resolve(specsRoot));
+  if (!fs6.existsSync(specPath)) return false;
+  fs6.unlinkSync(specPath);
+  pruneEmptyDirs(path9.dirname(specPath), path9.resolve(specsRoot));
   return true;
 }
 function pruneEmptyDirs(dir, specsRoot) {
   let at = dir;
   while (at !== specsRoot && at.startsWith(specsRoot)) {
-    if (!fs5.existsSync(at) || fs5.readdirSync(at).length > 0) return;
-    fs5.rmdirSync(at);
-    at = path8.dirname(at);
+    if (!fs6.existsSync(at) || fs6.readdirSync(at).length > 0) return;
+    fs6.rmdirSync(at);
+    at = path9.dirname(at);
   }
 }
-var fs5, path8, SPEC_FILE_EXTENSION;
+var fs6, path9, SPEC_FILE_EXTENSION;
 var init_spec_files = __esm({
   "src/core/spec-files.ts"() {
     "use strict";
-    fs5 = __toESM(require("fs"));
-    path8 = __toESM(require("path"));
+    fs6 = __toESM(require("fs"));
+    path9 = __toESM(require("path"));
     init_fs();
     init_yaml();
     SPEC_FILE_EXTENSION = ".yaml";
   }
 });
 
-// src/core/adapters/git-source.ts
-function osUserCache() {
-  if (process.platform === "win32") return process.env.LOCALAPPDATA ?? path9.join(os2.homedir(), "AppData", "Local");
-  if (process.platform === "darwin") return path9.join(os2.homedir(), "Library", "Caches");
-  return process.env.XDG_CACHE_HOME ?? path9.join(os2.homedir(), ".cache");
-}
-function cacheRoot() {
-  const setting = process.env.WAIRON_CACHE_DIR ?? "";
-  let root = cacheRoots.get(setting);
-  if (root === void 0) {
-    root = setting !== "" ? path9.resolve(setting) : path9.join(osUserCache(), "wairon");
-    cacheRoots.set(setting, root);
-  }
-  return root;
-}
-function git(args, cwd) {
-  return (0, import_child_process.execFileSync)("git", args, {
-    cwd,
-    encoding: "utf8",
-    stdio: ["ignore", "pipe", "pipe"],
-    env: { ...process.env, GIT_TERMINAL_PROMPT: "0", GIT_ASKPASS: "echo" }
-  });
-}
-function reasonOf(e) {
-  const stderr = e?.stderr;
-  const text3 = typeof stderr === "string" && stderr.trim() !== "" ? stderr : e instanceof Error ? e.message : String(e);
-  return text3.trim().split(/\r?\n/).filter((l) => l.trim() !== "").slice(-1)[0] ?? "git failed";
-}
-function cacheEntryOf(url, commit3) {
-  const repo = crypto2.createHash("sha256").update(url).digest("hex");
-  return path9.join(cacheRoot(), "git", repo, commit3);
-}
-function within(entry, url, commit3, dir) {
-  const at = dir ? path9.join(entry, dir) : entry;
-  if (!fs6.existsSync(at)) {
-    throw new SourceUnavailable(`the commit ${commit3} of ${url} holds no "${dir}"`);
-  }
-  return at;
-}
-function fetchInto(tmp, url, commit3) {
-  git(["init", "-q"], tmp);
-  try {
-    git(["fetch", "-q", "--depth", "1", url, commit3], tmp);
-  } catch {
-    git(["fetch", "-q", url, "+refs/heads/*:refs/remotes/source/*", "+refs/tags/*:refs/tags/*"], tmp);
-  }
-  git(["-c", "advice.detachedHead=false", "checkout", "-q", commit3], tmp);
-  fs6.rmSync(path9.join(tmp, ".git"), { recursive: true, force: true });
-}
-function fetch2(url, commit3, dir) {
-  const entry = cacheEntryOf(url, commit3);
-  if (fs6.existsSync(entry)) return within(entry, url, commit3, dir);
-  fs6.mkdirSync(path9.dirname(entry), { recursive: true });
-  const tmp = `${entry}.tmp-${process.pid}-${crypto2.randomBytes(4).toString("hex")}`;
-  fs6.mkdirSync(tmp, { recursive: true });
-  try {
-    fetchInto(tmp, url, commit3);
-    try {
-      fs6.renameSync(tmp, entry);
-    } catch (e) {
-      if (!fs6.existsSync(entry)) throw e;
-      fs6.rmSync(tmp, { recursive: true, force: true });
-    }
-  } catch (e) {
-    fs6.rmSync(tmp, { recursive: true, force: true });
-    if (fs6.readdirSync(path9.dirname(entry)).length === 0) fs6.rmdirSync(path9.dirname(entry));
-    throw e instanceof SourceUnavailable ? e : new SourceUnavailable(`cannot fetch ${commit3} of ${url}: ${reasonOf(e)}`);
-  }
-  return within(entry, url, commit3, dir);
-}
-function resolve7(url, ref) {
-  let listed;
-  try {
-    listed = git(["ls-remote", url, ref ?? "HEAD"]);
-  } catch (e) {
-    throw new SourceUnavailable(`cannot reach ${url}: ${reasonOf(e)}`);
-  }
-  const wanted = commitListed(listed, ref ?? "HEAD");
-  if (!wanted) throw new SourceUnavailable(`${url} lists no ref "${ref ?? "HEAD"}"`);
-  return wanted;
-}
-function commitListed(listed, ref) {
-  const lines = listed.split(/\r?\n/).filter((l) => l.trim() !== "").map((l) => l.split(/\s+/));
-  const names = [ref, `refs/heads/${ref}`, `refs/tags/${ref}^{}`, `refs/tags/${ref}`];
-  for (const name of names) {
-    const line2 = lines.find(([, listedName]) => listedName === name);
-    if (line2) return line2[0];
-  }
-  return void 0;
-}
-function head(directory) {
-  try {
-    return git(["rev-parse", "HEAD"], directory).trim() || null;
-  } catch {
-    return null;
-  }
-}
-function repositoryRoot(directory) {
-  let at = path9.resolve(directory);
-  for (; ; ) {
-    if (fs6.existsSync(path9.join(at, ".git"))) return at;
-    const up = path9.dirname(at);
-    if (up === at) return null;
-    at = up;
-  }
-}
-var import_child_process, crypto2, fs6, os2, path9, SourceUnavailable, cacheRoots;
-var init_git_source = __esm({
-  "src/core/adapters/git-source.ts"() {
-    "use strict";
-    import_child_process = require("child_process");
-    crypto2 = __toESM(require("crypto"));
-    fs6 = __toESM(require("fs"));
-    os2 = __toESM(require("os"));
-    path9 = __toESM(require("path"));
-    init_errors();
-    SourceUnavailable = class extends WaironError {
-      constructor(message) {
-        super(message);
-        this.name = "SourceUnavailable";
-      }
-    };
-    cacheRoots = /* @__PURE__ */ new Map();
-  }
-});
-
 // src/models/domain.ts
 function createEmptyTopologyConfig() {
   return { schemaVersion: "1.0.0", domains: [] };
@@ -4459,7 +4634,7 @@ function optionalOf(inner2) {
   return { form: "optional", args: [inner2] };
 }
 function inner(ctx) {
-  return { ...ctx, top: false, voidAllowed: false, omittable: false };
+  return { ...ctx, top: false, voidAllowed: false, resultAllowed: false, omittable: false };
 }
 function normalise(node, ctx, notes) {
   switch (node.k) {
@@ -4493,9 +4668,21 @@ function asyncOf(innerNode, ctx, notes, spelled) {
   if (!ctx.top || !RETURNS_POSITIONS.has(ctx.position)) {
     throw new TypeProblemError("TYPE_POSITION_INVALID", `${spelled} may stand only at the top of a returns, not in a ${ctx.position}`);
   }
-  const read2 = normalise(innerNode, { ...inner(ctx), voidAllowed: true }, notes);
+  const read2 = normalise(innerNode, { ...inner(ctx), voidAllowed: true, resultAllowed: true }, notes);
   return { form: "async", args: [read2] };
 }
+function resultOf(args, ctx, notes, spelled) {
+  if (!ctx.resultAllowed) {
+    throw new TypeProblemError(
+      "TYPE_POSITION_INVALID",
+      `${spelled} may stand only as a whole returns (or under its async), not in a ${ctx.top ? ctx.position : "collection, union, optional or argument"}`,
+      "the success type here (a failure belongs to a method's returns)"
+    );
+  }
+  const ok = normalise(args[0], { ...inner(ctx), voidAllowed: true }, notes);
+  const err = normalise(args[1], inner(ctx), notes);
+  return { form: "result", args: [ok, err] };
+}
 function bareName(name, ctx, notes) {
   const lower = name.toLowerCase();
   if (NONES.has(name)) {
@@ -4533,6 +4720,7 @@ function appliedName(name, args, ctx, notes) {
       throw new TypeProblemError("TYPE_EXPRESSION_INVALID", `"${name}" takes ${alias.arity} type argument${alias.arity === 1 ? "" : "s"}, ${args.length} given`);
     }
     if (alias.form === "async") return asyncOf(args[0], ctx, notes, `${name}<...>`);
+    if (alias.form === "result") return resultOf(args, ctx, notes, `${name}<...>`);
     if (alias.form === "optional") return optionalOf(normalise(args[0], inner(ctx), notes));
     const read2 = args.map((a) => normalise(a, inner(ctx), notes));
     if (alias.form === "map") assertMapKey(read2[0], args[0]);
@@ -4606,6 +4794,8 @@ function canonicalTypeText(expr) {
       return `${expr.form}<${canonicalTypeText(expr.args[0])}>`;
     case "map":
       return `map<${canonicalTypeText(expr.args[0])}, ${canonicalTypeText(expr.args[1])}>`;
+    case "result":
+      return `result<${canonicalTypeText(expr.args[0])}, ${canonicalTypeText(expr.args[1])}>`;
     case "optional": {
       const innerText = canonicalTypeText(expr.args[0]);
       return expr.args[0].form === "union" ? `(${innerText})?` : `${innerText}?`;
@@ -4625,11 +4815,12 @@ function typeNamedRefs(expr) {
 }
 function typeIsMany(expr) {
   if (expr.form === "list" || expr.form === "set" || expr.form === "map") return true;
-  if (expr.form === "optional" || expr.form === "async") return typeIsMany(expr.args[0]);
+  if (expr.form === "optional" || expr.form === "async" || expr.form === "result") return typeIsMany(expr.args[0]);
   return false;
 }
 function contextFor(position, omittable2, looseNumber = false) {
-  return { position, top: true, voidAllowed: RETURNS_POSITIONS.has(position), omittable: omittable2, looseNumber };
+  const returns = RETURNS_POSITIONS.has(position);
+  return { position, top: true, voidAllowed: returns, resultAllowed: returns, omittable: omittable2, looseNumber };
 }
 function parseTypePosition(text3, position, omittable2 = false) {
   let raw;
@@ -4754,6 +4945,47 @@ function typeProblemIntProposal(problem) {
   if (!parse.expression || parse.problem) return null;
   return { specId: problem.specId, kind: problem.kind, path: problem.path, written: problem.written, stored: parse.canonical };
 }
+function stringLiteralValue(text3) {
+  const quote = text3[0];
+  if (quote !== "'" && quote !== '"' && quote !== "`" || text3[text3.length - 1] !== quote) return null;
+  return text3.slice(1, -1).replace(/\\(.)/g, "$1");
+}
+function kebabOf(name) {
+  return name.replace(/([a-z0-9])([A-Z])/g, "$1-$2").replace(/[\s_.]+/g, "-").toLowerCase();
+}
+function typeProblemEnumProposal(problem) {
+  if (problem.code !== "TYPE_FORM_UNSUPPORTED") return null;
+  if (problem.specId === void 0 || problem.kind === void 0 || problem.path === void 0) return null;
+  let raw;
+  try {
+    raw = readRaw(problem.written);
+  } catch (e) {
+    if (e instanceof TypeSyntaxError) return null;
+    throw e;
+  }
+  const members = raw.k === "union" ? raw.members : [raw];
+  const values = [];
+  let optional = false;
+  for (const member of members) {
+    if (member.k === "name" && member.args === void 0 && NONES.has(member.name)) {
+      optional = true;
+      continue;
+    }
+    const value = member.k === "literal" ? stringLiteralValue(member.text) : null;
+    if (value === null) return null;
+    if (!values.includes(value)) values.push(value);
+  }
+  if (values.length === 0) return null;
+  return {
+    specId: problem.specId,
+    kind: problem.kind,
+    path: problem.path,
+    written: problem.written,
+    enumId: kebabOf(positionNameOf(problem.path)),
+    values,
+    optional
+  };
+}
 function emptyTypeSpellingFacts() {
   return { respellings: [], problems: [] };
 }
@@ -4812,7 +5044,11 @@ var init_type_grammar = __esm({
       ["HashMap", { form: "map", arity: 2 }],
       ["Option", { form: "optional", arity: 1 }],
       ["Optional", { form: "optional", arity: 1 }],
-      ["Promise", { form: "async", arity: 1 }]
+      ["Promise", { form: "async", arity: 1 }],
+      // The success-or-failure type the mainstream languages with typed failures
+      // share (Rust, Swift, Kotlin, F#); Rust's spelling is its alias.
+      ["result", { form: "result", arity: 2 }],
+      ["Result", { form: "result", arity: 2 }]
     ]);
     NOT_NEUTRAL = /* @__PURE__ */ new Map([
       ["uuid", "a named value-object holding a string (e.g. order_id)"],
@@ -4821,7 +5057,6 @@ var init_type_grammar = __esm({
       ["byte", "int, or bytes for binary data"],
       ["time", "datetime for an instant, or duration for an elapsed time"],
       ["tuple", "a named value-object"],
-      ["result", "the success type as the returns (failures as findings or throws), or a named value-object"],
       ["error", "a named value-object"],
       ["never", "void"],
       ["box", "the inner type (ownership is an implementation detail)"],
@@ -4964,9 +5199,9 @@ var init_type_grammar = __esm({
         }
         name += this.ident();
         while (this.isP("::") || this.isP(".")) {
-          const sep18 = this.peek().v;
+          const sep19 = this.peek().v;
           this.at++;
-          name += sep18 + this.ident();
+          name += sep19 + this.ident();
         }
         if (!this.isP("<")) return { k: "name", name };
         this.at++;
@@ -4993,6 +5228,10 @@ var init_type_grammar = __esm({
         const close2 = this.closingParen();
         const after = close2 === -1 ? void 0 : this.tokens[close2 + 1];
         if (!after || after.t !== "p" || after.v !== "=>") {
+          if (this.isP(")", 1)) {
+            this.at += 2;
+            return { k: "name", name: "void" };
+          }
           this.expect("(");
           const inner2 = this.type();
           this.expect(")");
@@ -5309,6 +5548,7 @@ function lastSegment(name) {
   return name.split(/::|\./).filter(Boolean).pop() ?? name;
 }
 function sameType(code, spec, codeNames) {
+  if (spec.form === "result" && code.form !== "result") return sameType(code, spec.args[0], codeNames);
   if (code.form === "primitive" && code.name === "number") return spec.form === "primitive" && (spec.name === "int" || spec.name === "float");
   if (code.form === "named" && (spec.form === "named" || spec.form === "applied")) {
     if (spec.form === "applied") return false;
@@ -5345,6 +5585,8 @@ function writeTypeScript(expr) {
       return expr.args.map(writeTypeScript).join(" | ");
     case "async":
       return `Promise<${writeTypeScript(expr.args[0])}>`;
+    case "result":
+      return writeTypeScript(expr.args[0]);
     case "applied":
       return `${expr.name}<${expr.args.map(writeTypeScript).join(", ")}>`;
   }
@@ -5395,6 +5637,7 @@ var init_type_dialects = __esm({
           "T? \u2192 T | null",
           "A | B \u2192 A | B",
           "async T \u2192 Promise<T>",
+          "result<T, E> \u2192 T, throwing E on failure (result<void, E> \u2192 void)",
           "an enum E \u2192 type E = 'a' | 'b' (a string-literal union alias)",
           "a named scalar E holding P \u2192 type E = P (an alias of the primitive)"
         ];
@@ -5725,8 +5968,14 @@ function languageOfSourcePath(sourcePath) {
 function dialectOf(facts) {
   return facts.language ? typeDialectFor(facts.language) : null;
 }
-function resolveImport(fromFile, specifier, knownPaths) {
-  if (!specifier.startsWith(".")) return void 0;
+function returnTypeOf(facts, fn) {
+  return ownEntry(facts.returnTypes, fn);
+}
+function resolveImport(fromFile, specifier, knownPaths, packages) {
+  if (!specifier.startsWith(".")) {
+    const mapped = ownEntry(packages, specifier);
+    return mapped !== void 0 && knownPaths.has(mapped) ? mapped : void 0;
+  }
   const joined = pathKey(path10.posix.normalize(path10.posix.join(path10.posix.dirname(fromFile), specifier)));
   const candidates = [
     joined,
@@ -6141,7 +6390,7 @@ var init_design_export = __esm({
     ExtSchema = import_zod9.z.record(import_zod9.z.unknown());
     TypeExpressionSchema = import_zod9.z.lazy(
       () => import_zod9.z.object({
-        form: import_zod9.z.enum(["primitive", "named", "list", "set", "map", "optional", "union", "async", "applied"]),
+        form: import_zod9.z.enum(["primitive", "named", "list", "set", "map", "optional", "union", "async", "applied", "result"]),
         name: import_zod9.z.string().optional(),
         args: import_zod9.z.array(TypeExpressionSchema)
       }).passthrough()
@@ -11609,7 +11858,7 @@ function snapshotPath(root, alias) {
 function writeAtomically(file, text3) {
   fs8.mkdirSync(path13.dirname(file), { recursive: true });
   const tmp = `${file}.${process.pid}.tmp`;
-  fs8.writeFileSync(tmp, text3);
+  fs8.writeFileSync(tmp, withLineEndings(file, text3));
   fs8.renameSync(tmp, file);
 }
 function sortedLock(lock) {
@@ -11784,6 +12033,8 @@ function schemaOfExpression(expr, closureIds) {
       return { oneOf: expr.args.map((member) => schemaOfExpression(member, closureIds)) };
     case "async":
       return schemaOfExpression(expr.args[0], closureIds);
+    case "result":
+      return schemaOfExpression(expr.args[0], closureIds);
   }
 }
 function schemaFor(typeRef2, closureIds) {
@@ -11793,7 +12044,8 @@ function schemaFor(typeRef2, closureIds) {
 }
 function returnsNothing(returns) {
   const expr = expressionOf(returns);
-  const inner2 = expr?.form === "async" ? expr.args[0] : expr;
+  const awaited = expr?.form === "async" ? expr.args[0] : expr;
+  const inner2 = awaited?.form === "result" ? awaited.args[0] : awaited;
   return inner2?.form === "primitive" && inner2.name === "void";
 }
 function enumDescription(values) {
@@ -13789,7 +14041,7 @@ function approvalFinding(entry, config) {
     return finding(
       config,
       "MEMBER_DRIFTED",
-      `The member ${named(entry.key)} was approved under an earlier gate identity \u2014 the gate identity gained inputs in stage 5 (members' composition subjects, \`composition\`; code conformance moved beside the claim), which says nothing about its design. Re-lock it once at its own root (\`wairon lock\`).`,
+      `The member ${named(entry.key)} was approved under an earlier gate identity \u2014 the gate identity gained inputs in this release (members' composition subjects, \`composition\`; code conformance moved beside the claim), which says nothing about its design. Re-lock it once at its own root (\`wairon lock\`).`,
       entry.key
     );
   }
@@ -14185,12 +14437,12 @@ function packFiles(dir, prefix = "") {
 function computePackDigest(packDir) {
   const hash = crypto3.createHash("sha256");
   const abs = path16.resolve(packDir);
-  let isFile = false;
+  let isFile2 = false;
   try {
-    isFile = fs11.statSync(abs).isFile();
+    isFile2 = fs11.statSync(abs).isFile();
   } catch {
   }
-  const entries = isFile ? [[path16.basename(abs), abs]] : packFiles(abs).map((rel2) => [rel2, path16.join(abs, rel2)]);
+  const entries = isFile2 ? [[path16.basename(abs), abs]] : packFiles(abs).map((rel2) => [rel2, path16.join(abs, rel2)]);
   for (const [rel2, full] of entries) {
     hash.update(rel2);
     hash.update("\0");
@@ -14683,6 +14935,16 @@ function verifyIntegrity(selection, packDir, where) {
     message: `Pack "${wanted}" resolved to content that does not match the pinned integrity: expected ${selection.integrity}, found ${actual} (${where}). The pack was modified after it was pinned \u2014 reinstall or re-bundle the pinned version, or update the pin with \`wairon pack use ${selection.name} --pin\` if the change is intended.`
   };
 }
+function bundlesSingleFile(bundleDir, storePath16) {
+  try {
+    if (!fs12.statSync(storePath16).isFile()) return false;
+    const entry = packDirEntry(bundleDir);
+    if (!entry || fs12.readdirSync(bundleDir).length !== 1) return false;
+    return fs12.readFileSync(entry).equals(fs12.readFileSync(storePath16));
+  } catch {
+    return false;
+  }
+}
 function detectBundleStoreDrift(selection, bundleDir) {
   const bundledVersion = path17.basename(bundleDir);
   const installed = resolveInstalledPack(selection.name, bundledVersion);
@@ -14690,6 +14952,7 @@ function detectBundleStoreDrift(selection, bundleDir) {
   const bundleDigest = computePackDigest(bundleDir);
   const storeDigest = computePackDigest(installed.path);
   if (bundleDigest === storeDigest) return void 0;
+  if (bundlesSingleFile(bundleDir, installed.path)) return void 0;
   return {
     code: "PACK_STORE_DRIFT",
     severity: "warning",
@@ -14911,6 +15174,7 @@ function appendUnique(map, key, value, same) {
   list2.push(value);
 }
 function buildCodeIndex(model) {
+  const packages = model.packages ?? {};
   const facts = /* @__PURE__ */ new Map();
   const paths = /* @__PURE__ */ new Set();
   const exactPaths = /* @__PURE__ */ new Set();
@@ -14943,7 +15207,7 @@ function buildCodeIndex(model) {
       const f = facts.get(from);
       if (f?.status !== "analyzed") continue;
       for (const specifier of f.reexports) {
-        const to = resolveImport(from, specifier, paths);
+        const to = resolveImport(from, specifier, paths, packages);
         if (to && !out.has(to)) {
           out.add(to);
           queue.push(to);
@@ -14955,7 +15219,7 @@ function buildCodeIndex(model) {
   };
   const NO_ORIGIN = /* @__PURE__ */ new Set();
   const landingFrom = (scope, specifier) => {
-    const to = resolveImport(scope, specifier, paths);
+    const to = resolveImport(scope, specifier, paths, packages);
     return to ? republishedFrom(to) : NO_ORIGIN;
   };
   const scopeOf3 = (site, from) => {
@@ -14985,7 +15249,7 @@ function buildCodeIndex(model) {
   };
   const possibleOriginsOf = (site, from) => {
     const proven = originOf2(site, from);
-    if (!site.field && !site.constructed && !site.via) return proven;
+    if (!site.field && !site.constructed && !site.via && !site.returnedBy && !site.enclosingClass) return proven;
     const resolved = scopeOf3(site, from);
     if (!resolved) return proven;
     const { path: scope, facts: f } = resolved;
@@ -14998,24 +15262,59 @@ function buildCodeIndex(model) {
     if (site.field) for (const typeName of fieldTypesOf(f, site.field)) widenThroughType(typeName);
     if (site.constructed) widenThrough(site.constructed, importBindingOf(f, site.constructed)?.from);
     if (site.via) for (const typeName of localTypesOf(f, site.via)) widenThroughType(typeName);
+    if (site.enclosingClass !== void 0 && holdsMemberBody(f, site.name, site.enclosingClass)) {
+      for (const candidate of republishedFrom(scope)) out.add(candidate);
+    }
+    if (site.returnedBy !== void 0) {
+      for (const fnFile of originOf2({ name: site.returnedBy, member: false }, scope)) {
+        const at = facts.get(fnFile);
+        if (at?.status !== "analyzed" || at.analysisGrade !== "exact") continue;
+        const typeName = returnTypeOf(at, site.returnedBy);
+        if (typeName === void 0) continue;
+        const specifier = typeBindingOf(at, typeName);
+        const landings = specifier !== void 0 ? landingFrom(fnFile, specifier) : declarationsAt(fnFile).has(typeName) ? republishedFrom(fnFile) : NO_ORIGIN;
+        for (const candidate of landings) {
+          const there = facts.get(candidate);
+          if (there && holdsMemberBody(there, site.name, typeName)) out.add(candidate);
+        }
+      }
+    }
     return out;
   };
+  const holdsMemberBody = (f, name, container) => f.status === "analyzed" && f.analysisGrade === "exact" && !!f.functionBodies && Object.prototype.hasOwnProperty.call(f.functionBodies, name) && f.functionBodies[name].some((b) => b.container === container);
   const declarationsAt = (path93) => namesAt(declarations, pathKey(path93), (f) => /* @__PURE__ */ new Set([...f.declaredNames, ...f.exportedNames]));
-  const forwardsOf = (start2, name) => {
+  const forwardsOf = (start2, name, container) => {
     const out = [];
+    const listed = /* @__PURE__ */ new Set();
     const seen = /* @__PURE__ */ new Set();
-    const queue = [{ file: pathKey(start2), name }];
+    const queue = [{ file: pathKey(start2), name, container }];
     while (queue.length) {
       const at = queue.shift();
-      const key = `${at.file}#${at.name}`;
+      const key = `${at.scope ? "s" : "p"}|${at.container ?? ""}|${at.file}#${at.name}`;
       if (seen.has(key)) continue;
       seen.add(key);
-      out.push(at);
-      for (const binding of facts.get(at.file)?.reexportBindings ?? []) {
+      if (!listed.has(`${at.file}#${at.name}`)) {
+        listed.add(`${at.file}#${at.name}`);
+        out.push({ file: at.file, name: at.name });
+      }
+      const f = facts.get(at.file);
+      if (at.scope) {
+        const binding = f ? importBindingOf(f, at.name) : void 0;
+        if (!binding || binding.namespace) continue;
+        const to = resolveImport(at.file, binding.from, paths, packages);
+        if (to) queue.push({ file: to, name: binding.imported ?? at.name });
+        continue;
+      }
+      for (const alias of f?.exportAliases ?? []) {
+        if (alias.exported !== at.name || alias.container !== at.container) continue;
+        queue.push({ file: at.file, name: alias.local, scope: true });
+      }
+      if (at.container !== void 0) continue;
+      for (const binding of f?.reexportBindings ?? []) {
         const star = binding.exported === "*";
         if (!star && binding.exported !== at.name) continue;
         if (star && at.name === "default") continue;
-        const to = resolveImport(at.file, binding.from, paths);
+        const to = resolveImport(at.file, binding.from, paths, packages);
         if (!to) continue;
         if (star && !facts.get(to)?.exportedNames.includes(at.name)) continue;
         queue.push({ file: to, name: star ? at.name : binding.local });
@@ -15026,6 +15325,7 @@ function buildCodeIndex(model) {
   return {
     paths,
     exactPaths,
+    packages,
     factsAt: (path93) => facts.get(pathKey(path93)),
     declarationsAt,
     anchorsAt: (path93) => namesAt(anchors, pathKey(path93), (f) => /* @__PURE__ */ new Set([...f.declaredNames, ...f.exportedNames, ...f.anchoredNames])),
@@ -15079,7 +15379,7 @@ function buildImportGraph(index, universe) {
   const traces = /* @__PURE__ */ new Map();
   const resolveAll = (from, specifiers, into) => {
     for (const specifier of specifiers) {
-      const to = resolveImport(from, specifier, universe);
+      const to = resolveImport(from, specifier, universe, index.packages);
       if (to && to !== from) into.add(to);
     }
   };
@@ -15406,7 +15706,7 @@ function judgeOwnIdentity(ctx, identity2) {
     ctx.addIssue(
       "notice",
       "PROJECT_ID_DEFAULTED",
-      `Project "${identity2.name}" declares no id in .wai/project.yaml, so it answers to "${identity2.id}", derived from its display name \u2014 renaming the project would move it. No save writes it for you; declare it with \`id: ${identity2.id}\` (stage 3 requires an explicit id).`
+      `Project "${identity2.name}" declares no id in .wai/project.yaml, so it answers to "${identity2.id}", derived from its display name \u2014 renaming the project would move it. No save writes it for you; declare it with \`id: ${identity2.id}\` (a project is keyed on an explicit id).`
     );
   }
   const ambiguous = problem("ambiguous");
@@ -15440,7 +15740,7 @@ var init_project_identity = __esm({
     projectIdentityRule = {
       name: "project-identity",
       judges: "design",
-      description: "The bound project is keyed on its id, so the id must be declared, well-formed, stable and its own: a project that declares none answers to its display name slugified until it writes one (PROJECT_ID_DEFAULTED), a project whose name yields no id or whose declared id breaks the grammar has nothing reliable to key on (PROJECT_ID_AMBIGUOUS), an id the rename migration moved from the one the lock approved is owed a re-lock and nothing more (PROJECT_ID_RENAMED: the approved id is one of the configuration's previousIds), and any other id that differs from the one the lock approved has moved under everything that keyed on it (PROJECT_ID_CHANGED). It judges the bound project's own identity only. The family half \u2014 a member with a defaulted id (named with its alias as the id to declare), a member with no id, and two members resolving to one id \u2014 is a family check since stage 4 (family_validator.checkMembers), which reads the family root's graph.",
+      description: "The bound project is keyed on its id, so the id must be declared, well-formed, stable and its own: a project that declares none answers to its display name slugified until it writes one (PROJECT_ID_DEFAULTED), a project whose name yields no id or whose declared id breaks the grammar has nothing reliable to key on (PROJECT_ID_AMBIGUOUS), an id the rename migration moved from the one the lock approved is owed a re-lock and nothing more (PROJECT_ID_RENAMED: the approved id is one of the configuration's previousIds), and any other id that differs from the one the lock approved has moved under everything that keyed on it (PROJECT_ID_CHANGED). It judges the bound project's own identity only. The family half \u2014 a member with a defaulted id (named with its alias as the id to declare), a member with no id, and two members resolving to one id \u2014 is a family check (family_validator.checkMembers), which reads the family root's graph.",
       codes: [
         { code: "PROJECT_ID_AMBIGUOUS", defaultSeverity: "warning", summary: "Project has no usable id: its name yields no slug, or its declared id breaks the grammar" },
         { code: "PROJECT_ID_CHANGED", defaultSeverity: "error", summary: "Project id differs from the id the lock approved" },
@@ -15866,10 +16166,10 @@ var init_type_expressions = __esm({
     typeExpressionsRule = {
       name: "type-expressions",
       judges: "design",
-      description: "Reports what the scan's type canonicalisation recorded (ctx.typeSpellingFacts), one finding per position, located by spec and path: a stored text that does not parse (TYPE_EXPRESSION_INVALID); one that breaks a position rule \u2014 void or async out of place, a map key that is not string, int or an enum, a named scalar's holds that is not one primitive other than void and any, `T??` (TYPE_POSITION_INVALID); one using a form the grammar leaves out \u2014 an inline object shape, an inline function type, a string-literal union, a union mixing in a primitive or a collection, an intersection, a utility type or a tuple (TYPE_FORM_UNSUPPORTED); one naming `number` or a legacy builtin with no neutral meaning (TYPE_NOT_NEUTRAL); and one that is an alias of its canonical spelling (TYPE_SPELLING_STALE, which any save or doctor --fix repairs). Every message names the replacement: `number` asks \"int or float?\" (and says when the doctor repair proposes int), a function type names a signature type, a literal union an enum, an inline object or a mixed union a named value-object. The writer refuses all but the stale spelling at write time; these findings are how a tree that held them before the grammar existed is told, while it still loads and its consumers read the position as opaque any \u2014 which is why only what no real tree holds (a text that does not parse, a broken position rule) is an error. No finding when the run carries no facts (a candidate run).",
+      description: "Reports what the scan's type canonicalisation recorded (ctx.typeSpellingFacts), one finding per position, located by spec and path: a stored text that does not parse (TYPE_EXPRESSION_INVALID); one that breaks a position rule \u2014 void, async or result out of place, a map key that is not string, int or an enum, a named scalar's holds that is not one primitive other than void and any, `T??` (TYPE_POSITION_INVALID); one using a form the grammar leaves out \u2014 an inline object shape, an inline function type, a string-literal union, a union mixing in a primitive or a collection, an intersection, a utility type or a tuple (TYPE_FORM_UNSUPPORTED); one naming `number` or a legacy builtin with no neutral meaning (TYPE_NOT_NEUTRAL); and one that is an alias of its canonical spelling (TYPE_SPELLING_STALE, which any save or doctor --fix repairs). Every message names the replacement: `number` asks \"int or float?\" (and says when the doctor repair proposes int), a function type names a signature type, a literal union an enum (which the doctor repair proposes), an inline object or a mixed union a named value-object. The writer refuses all but the stale spelling at write time; on load every one of them is a warning \u2014 these findings are how a tree that held them before the grammar existed is told, while it still loads, stays lockable with its debt in view, and its consumers read the position as opaque any, which never invents a shape. No finding when the run carries no facts (a candidate run).",
       codes: [
-        { code: "TYPE_EXPRESSION_INVALID", defaultSeverity: "error", summary: "A structured type position does not parse under the type grammar" },
-        { code: "TYPE_POSITION_INVALID", defaultSeverity: "error", summary: "A type position breaks a position rule: void or async out of place, a non-scalar map key, or T??" },
+        { code: "TYPE_EXPRESSION_INVALID", defaultSeverity: "warning", summary: "A structured type position does not parse under the type grammar" },
+        { code: "TYPE_POSITION_INVALID", defaultSeverity: "warning", summary: "A type position breaks a position rule: void, async or result out of place, a non-scalar map key, or T??" },
         { code: "TYPE_FORM_UNSUPPORTED", defaultSeverity: "warning", summary: "A type position uses a form the grammar leaves out \u2014 inline object, inline function type, string-literal union, union mixing in a primitive or collection, intersection, utility type or tuple \u2014 and the message names its named replacement" },
         { code: "TYPE_NOT_NEUTRAL", defaultSeverity: "warning", summary: "A type position names number (int or float?) or a legacy builtin with no neutral meaning, and the message names the replacement" },
         { code: "TYPE_SPELLING_STALE", defaultSeverity: "warning", summary: "A stored type position is an alias of its canonical spelling; any save or doctor --fix rewrites it" }
@@ -15879,9 +16179,8 @@ var init_type_expressions = __esm({
         if (!facts) return;
         for (const problem of facts.problems) {
           if (problem.specId === void 0 || !ctx.isSpecInScope(problem.specId)) continue;
-          const severity = problem.code === "TYPE_EXPRESSION_INVALID" || problem.code === "TYPE_POSITION_INVALID" ? "error" : "warning";
           ctx.addIssue(
-            severity,
+            "warning",
             problem.code,
             problemMessage(problem, problem.specId),
             problem.specId,
@@ -16270,7 +16569,7 @@ var init_export_tables = __esm({
     exportTablesRule = {
       name: "export-tables",
       judges: "design",
-      description: "Every level's export table must resolve the way a module resolver resolves `export \u2026 from`: one public name binds one target (EXPORT_ID_DUPLICATE when two wildcards \u2014 or two explicit entries \u2014 bind a name to different targets, or two public names share one nameKey, since a bare import could not tell them apart; the name is left out), no chain leads back to itself (EXPORT_CYCLE \u2014 an error for a named chain that never reaches a component or type, a warning for a wildcard cycle, which resolves to its union), every entry names a source and an item that exist, that the source exports and, for an own type, that the level owns \u2014 a subsystem-owned type at L1, a project-level type (no subsystem) for an L0 `{ typeDef }` without `from` \u2014 under a public name of [a-z0-9-_]+ (EXPORT_INVALID), every re-exported component can serve a boundary caller \u2014 a Portal, a gateway being a Portal variant, or an Observer for events (EXPORT_UNCONSUMABLE, at L0 and for L1 re-exports; an error since stage 4), and an L0 entry that re-exports a member's or an external's export never declares a wider audience than that export has (EXPORT_WIDENS_AUDIENCE): a re-export can narrow reach, never widen it. The rule judges the facts the export resolver recorded in the scan \u2014 for the bound root's table and every contained member's \u2014 and resolves nothing itself.",
+      description: "Every level's export table must resolve the way a module resolver resolves `export \u2026 from`: one public name binds one target (EXPORT_ID_DUPLICATE when two wildcards \u2014 or two explicit entries \u2014 bind a name to different targets, or two public names share one nameKey, since a bare import could not tell them apart; the name is left out), no chain leads back to itself (EXPORT_CYCLE \u2014 an error for a named chain that never reaches a component or type, a warning for a wildcard cycle, which resolves to its union), every entry names a source and an item that exist, that the source exports and, for an own type, that the level owns \u2014 a subsystem-owned type at L1, a project-level type (no subsystem) for an L0 `{ typeDef }` without `from` \u2014 under a public name of [a-z0-9-_]+ (EXPORT_INVALID), every re-exported component can serve a boundary caller \u2014 a Portal, a gateway being a Portal variant, or an Observer for events (EXPORT_UNCONSUMABLE, at L0 and for L1 re-exports), and an L0 entry that re-exports a member's or an external's export never declares a wider audience than that export has (EXPORT_WIDENS_AUDIENCE): a re-export can narrow reach, never widen it. The rule judges the facts the export resolver recorded in the scan \u2014 for the bound root's table and every contained member's \u2014 and resolves nothing itself.",
       codes: [
         { code: "EXPORT_ID_DUPLICATE", defaultSeverity: "error", summary: "One public name bound to different targets by two wildcard re-exports or two explicit entries" },
         { code: "EXPORT_CYCLE", defaultSeverity: "error", summary: "A re-export chain leads back to itself (a warning for a wildcard cycle, which resolves to its union)" },
@@ -16446,7 +16745,7 @@ var init_reference_forms = __esm({
     referenceFormsRule = {
       name: "reference-forms",
       judges: "design",
-      description: "A cross-project reference is `alias::name` (or a bare name a `use` imports): the alias is one of the referring project's members or externals, the name a public name of that project's L0 table. The older forms still bind for one release and are reported (DEPRECATED_REFERENCE_FORM), each naming the spec, where in it, the form as written and the text to write instead (the scan's rewrite: a bare local id, or `alias::publicName`): a leading `::`, which escapes to the root of whatever checkout loads it; `super::`, which climbs the containing projects \u2014 a place in one family, not a name; a member path (`desktop::shell` written inside desktop, `waffler_core::transpiler::x` written inside transpiler), a first segment the referring project does not declare, read from the bound root; and a self-prefix \u2014 the referring project's own id as the first segment, with `::` or `.` (`registry.advisory-channel` inside registry), which stage 3's migration did not rewrite and stage 4's positional step does. Wairon's own writer emits none of them. A form with no rewrite (its target is out of reach) is reported with the reason. It reads the project graph's authored references, which the scan records before binding erases the form.",
+      description: "A cross-project reference is `alias::name` (or a bare name a `use` imports): the alias is one of the referring project's members or externals, the name a public name of that project's L0 table. The older forms still bind for one release and are reported (DEPRECATED_REFERENCE_FORM), each naming the spec, where in it, the form as written and the text to write instead (the scan's rewrite: a bare local id, or `alias::publicName`): a leading `::`, which escapes to the root of whatever checkout loads it; `super::`, which climbs the containing projects \u2014 a place in one family, not a name; a member path (`desktop::shell` written inside desktop, `app_core::engine::x` written inside engine), a first segment the referring project does not declare, read from the bound root; and a self-prefix \u2014 the referring project's own id as the first segment, with `::` or `.` (`registry.advisory-channel` inside registry), which `wairon doctor --fix` rewrites to the bare local id. Wairon's own writer emits none of them. A form with no rewrite (its target is out of reach) is reported with the reason. It reads the project graph's authored references, which the scan records before binding erases the form.",
       codes: [
         { code: "DEPRECATED_REFERENCE_FORM", defaultSeverity: "notice", summary: "A reference written with a leading ::, super:: or a member path where a local id or alias::name belongs" }
       ],
@@ -16483,9 +16782,9 @@ var init_member_declarations = __esm({
     memberDeclarationsRule = {
       name: "member-declarations",
       judges: "design",
-      description: "A project declares its members in project.yaml `members`, each by one source in one grammar. A deprecated declaration form loads for one release and is reported (DEPRECATED_MOUNT_FORM, notice): the L1 form \u2014 a subsystem carrying projectPath \u2014 naming the mount, its path, the `members` entry that replaces it, and every field it carries that `doctor --fix` will move into the member (or stop on); a mount whose alias `members` also declares is reported as ignored; and (stage 8) the long-form `path` key, naming the `source` (or shorthand) `doctor --fix` rewrites it to. Since stage 8 it also judges what each member of the bound project IS against what is declared or written about it, from the scan's problems at the bound root (a member's own members are that member's gate's): what a member is follows from its content \u2014 an id, an L0 or a lock make it a project, anything else a part \u2014 and every contradiction is ONE finding, MEMBER_KIND_MISMATCH (error), naming the alias and the contradiction: an asserted `as` the content contradicts; a part whose configuration declares project fields (members, externals, rules, extensions, composition, targets) without the id that would make it a project (add the id, or move them to the parent); a non-contained part with no PartOf, or one naming another project (opened alone it could not say what it belongs to); a contained member declaring PartOf; a `use` on a member whose content is a part (its names are already this project's own). A part whose files could not be read \u2014 its directory absent, or its git commit not cached and not fetchable (offline, refused, unknown) \u2014 is PART_UNAVAILABLE (error): the project's own subsystems are missing, so its verdict cannot be a pass. The member findings name no spec: members live in configuration. It reads the project graph's nodes, their legacy mounts, the bound root's declared members and its problems.",
+      description: "A project declares its members in project.yaml `members`, each by one source in one grammar. A deprecated declaration form loads for one release and is reported (DEPRECATED_MOUNT_FORM, notice): the L1 form \u2014 a subsystem carrying projectPath \u2014 naming the mount, its path, the `members` entry that replaces it, and every field it carries that `doctor --fix` will move into the member (or stop on); a mount whose alias `members` also declares is reported as ignored; and the deprecated long-form `path` key, naming the `source` (or shorthand) `doctor --fix` rewrites it to. It also judges what each member of the bound project IS against what is declared or written about it, from the scan's problems at the bound root (a member's own members are that member's gate's): what a member is follows from its content \u2014 an id, an L0 or a lock make it a project, anything else a part \u2014 and every contradiction is ONE finding, MEMBER_KIND_MISMATCH (error), naming the alias and the contradiction: an asserted `as` the content contradicts; a part whose configuration declares project fields (members, externals, rules, extensions, composition, targets) without the id that would make it a project (add the id, or move them to the parent); a non-contained part with no PartOf, or one naming another project (opened alone it could not say what it belongs to); a contained member declaring PartOf; a `use` on a member whose content is a part (its names are already this project's own). A part whose files could not be read \u2014 its directory absent, or its git commit not cached and not fetchable (offline, refused, unknown) \u2014 is PART_UNAVAILABLE (error): the project's own subsystems are missing, so its verdict cannot be a pass. The member findings name no spec: members live in configuration. It reads the project graph's nodes, their legacy mounts, the bound root's declared members and its problems.",
       codes: [
-        { code: "DEPRECATED_MOUNT_FORM", defaultSeverity: "notice", summary: "A member declared in a deprecated form \u2014 an L1 subsystem carrying projectPath, or (stage 8) the long-form `path` key \u2014 which doctor --fix rewrites to a `members` entry with one `source`." },
+        { code: "DEPRECATED_MOUNT_FORM", defaultSeverity: "notice", summary: "A member declared in a deprecated form \u2014 an L1 subsystem carrying projectPath, or the long-form `path` key \u2014 which doctor --fix rewrites to a `members` entry with one `source`." },
         { code: "MEMBER_KIND_MISMATCH", defaultSeverity: "error", summary: "What a member's content makes it (an id, L0 or lock: a project; else a part) contradicts what is declared or written about it: an asserted `as`, project fields in a part, a missing or wrong PartOf, a `use` on a part." },
         { code: "PART_UNAVAILABLE", defaultSeverity: "error", summary: "A part's files could not be read (absent directory, unpinned or unfetchable git commit): the project's own subsystems are missing." }
       ],
@@ -16523,7 +16822,7 @@ var init_member_declarations = __esm({
           ctx.addIssue(
             "notice",
             "DEPRECATED_MOUNT_FORM",
-            `This project declares the member "${member.alias}" with the long-form \`path\` key, which stage 8 replaced by the one location key \`source\`. \`doctor --fix\` rewrites it to ${rest ? `\`source: ${written}\` in its long form` : `the shorthand \`${member.alias}: ${written}\``} \u2014 its meaning unchanged.`
+            `This project declares the member "${member.alias}" with the long-form \`path\` key, which the one location key replaced: \`source\`. \`doctor --fix\` rewrites it to ${rest ? `\`source: ${written}\` in its long form` : `the shorthand \`${member.alias}: ${written}\``} \u2014 its meaning unchanged.`
           );
         }
         for (const problem of family.problems) {
@@ -16567,7 +16866,7 @@ var init_project_boundaries = __esm({
     projectBoundariesRule = {
       name: "project-boundaries",
       judges: "design",
-      description: "The one judge of every cross-project reference the bound project writes (decision 9 \u2014 every project is a crate of its own, reached only through its L0 exports and only as a dependency it declared). It reads each of the project's own references from the project graph \u2014 `::` forms and bare names bound through `use` imports alike \u2014 takes its resolution from resolveCrossProject, decided before any severity from the project's own files alone, and reports every outcome but resolved once, carrying the resolution: forbidden is EXTERNAL_UNDECLARED (the reference reaches a project the referrer declares neither as a member nor as an external, or names a first segment that is none of its subsystems, aliases or foreign providers); missing is EXTERNAL_NOT_EXPORTED (the producer's table \u2014 a contained member's live one, or the external's pin \u2014 has no public name covering the referrer, or not the used method, or exports the type only inside a signature's closure); an ambiguous import is IMPORT_AMBIGUOUS (two imports supply one bare name: two explicit `use` names, or two `*` with no explicit one \u2014 name it `alias::name` or narrow a `use`); unavailable is EXTERNAL_CHECK_UNAVAILABLE (no pin, an unreadable pin, a member absent on disk, or a deprecated form naming no alias \u2014 never a pass). A bare name no import supplies is not this rule's: it is the unresolved-reference finding it always was, with rule_context.importHint appended. A trustedLinks entry naming a subsystem of another project (`alias::sub`) is TRUSTED_LINK_CROSSES_PROJECT: a sanctioned fast lane stays inside one project. Stage 4 makes the three stage-2 notices errors now that the owner's gate judges them exactly; a reference is never left to a parent's verdict.",
+      description: "The one judge of every cross-project reference the bound project writes (every project is a crate of its own, reached only through its L0 exports and only as a dependency it declared). It reads each of the project's own references from the project graph \u2014 `::` forms and bare names bound through `use` imports alike \u2014 takes its resolution from resolveCrossProject, decided before any severity from the project's own files alone, and reports every outcome but resolved once, carrying the resolution: forbidden is EXTERNAL_UNDECLARED (the reference reaches a project the referrer declares neither as a member nor as an external, or names a first segment that is none of its subsystems, aliases or foreign providers); missing is EXTERNAL_NOT_EXPORTED (the producer's table \u2014 a contained member's live one, or the external's pin \u2014 has no public name covering the referrer, or not the used method, or exports the type only inside a signature's closure); an ambiguous import is IMPORT_AMBIGUOUS (two imports supply one bare name: two explicit `use` names, or two `*` with no explicit one \u2014 name it `alias::name` or narrow a `use`); unavailable is EXTERNAL_CHECK_UNAVAILABLE (no pin, an unreadable pin, a member absent on disk, or a deprecated form naming no alias \u2014 never a pass). A bare name no import supplies is not this rule's: it is the unresolved-reference finding it always was, with rule_context.importHint appended. A trustedLinks entry naming a subsystem of another project (`alias::sub`) is TRUSTED_LINK_CROSSES_PROJECT: a sanctioned fast lane stays inside one project. An undeclared, unexported or ambiguous reference is an error, since the owner's gate judges it exactly; a reference is never left to a parent's verdict.",
       codes: [
         { code: "EXTERNAL_UNDECLARED", defaultSeverity: "error", summary: "A reference reaches another project the referring project declares neither as a member nor as an external, or names a first segment that is none of its subsystems, aliases or foreign providers" },
         { code: "EXTERNAL_NOT_EXPORTED", defaultSeverity: "error", summary: "A reference reaches another project at anything but a public name, or a member of one, whose audience covers the referrer" },
@@ -19420,7 +19719,7 @@ var init_pack_reproducibility = __esm({
             ctx.addIssue(
               "warning",
               "PACK_SOURCE_UNFETCHABLE",
-              `Pack selection "${selection.name}" records no source and is not bundled, so a fresh machine or CI runner cannot obtain it \u2014 \`wairon pack sync\` has nothing to fetch. Record a URL (\`wairon pack use ${selection.name} --source <url>\`) or commit a copy (\`wairon pack bundle ${selection.name}\`).`
+              `Pack selection "${selection.name}" records no source and is not bundled, so a fresh machine or CI runner cannot obtain it \u2014 \`wairon pack sync\` has nothing to fetch. Commit a copy the repository carries (\`wairon pack bundle ${selection.name}\`, or \`wairon pack bundle --all\` for every selection), or record a URL \`wairon pack sync\` fetches it from (\`wairon pack use ${selection.name} --source <url>\`). A selection \`wairon doctor --fix\` recorded from a pack installed from a local path has no URL to record: bundle it.`
             );
           }
         }
@@ -20522,6 +20821,18 @@ var init_invariant_backing = __esm({
 });
 
 // src/core/rules/wiring/invariant-references.ts
+function unknownInvariantMessage(where, ref, types, aliases) {
+  const parts = splitInvariantRef(ref);
+  const qualifier = parts ? parts.typeRef.lastIndexOf("::") : -1;
+  if (parts && qualifier > 0) {
+    const bare = `${parts.typeRef.slice(qualifier + 2)}.${parts.invariantId}`;
+    if (resolveInvariantRef(bare, types, aliases)) {
+      const prefix = parts.typeRef.slice(0, qualifier);
+      return `${where} asserts invariant "${ref}", whose qualifier "${prefix}::" names no project this one reaches the type through \u2014 the invariant is declared here, so write "${bare}" (a project's own alias, written from inside it, is not a qualifier it reads as its own; \`wairon doctor --fix\` rewrites it in a migrated family).`;
+    }
+  }
+  return `${where} asserts invariant "${ref}", but no entity declares it (expected "<type-id>.<invariant-id>" naming a declared entry in that entity's invariants).`;
+}
 var invariantReferencesRule;
 var init_invariant_references = __esm({
   "src/core/rules/wiring/invariant-references.ts"() {
@@ -20530,7 +20841,7 @@ var init_invariant_references = __esm({
     invariantReferencesRule = {
       name: "invariant-references",
       judges: "design",
-      description: "Every invariant a narrative step asserts (step.assertsInvariants) must resolve to a declared entity invariant: the reference splits at its last dot into a type reference and an invariant id, and some entity matching that type reference must declare that id. A reference nothing declares is an error \u2014 the step claims a property that exists nowhere.",
+      description: "Every invariant a narrative step asserts (step.assertsInvariants) must resolve to a declared entity invariant: the reference splits at its last dot into a type reference and an invariant id, and some entity matching that type reference must declare that id. A reference nothing declares is an error \u2014 the step claims a property that exists nowhere. The message says which: when the type reference carries a qualifier (`alias::type`) and the bare reference does resolve, the cause is the qualifier \u2014 typically the project's own alias written from inside it \u2014 and the message names it and the bare reference to write instead, never claiming that no entity declares the invariant.",
       codes: [
         { code: "UNKNOWN_INVARIANT_REF", defaultSeverity: "error", summary: "A narrative step asserts an invariant that no entity declares" }
       ],
@@ -20545,7 +20856,7 @@ var init_invariant_references = __esm({
                 ctx.addIssue(
                   "error",
                   "UNKNOWN_INVARIANT_REF",
-                  `Step ${step.stepNumber} of "${method2.name}" in implementation "${impl.id}" asserts invariant "${ref}", but no entity declares it (expected "<type-id>.<invariant-id>" naming a declared entry in that entity's invariants).`,
+                  unknownInvariantMessage(`Step ${step.stepNumber} of "${method2.name}" in implementation "${impl.id}"`, ref, ctx.types, aliases),
                   impl.id,
                   isDraftCtx
                 );
@@ -20918,13 +21229,13 @@ function invokedAs(code, site, file) {
   if (!site.member) {
     const binding = importBindingOf(facts, site.name);
     if (!binding || binding.namespace) return [];
-    const module3 = resolveImport(scope, binding.from, code.paths);
+    const module3 = resolveImport(scope, binding.from, code.paths, code.packages);
     return module3 ? code.forwardsOf(module3, binding.imported ?? site.name) : [];
   }
   if (!site.via) return [];
   const receiver = importBindingOf(facts, site.via);
   if (!receiver?.namespace) return [];
-  const module2 = resolveImport(scope, receiver.from, code.paths);
+  const module2 = resolveImport(scope, receiver.from, code.paths, code.packages);
   return module2 ? code.forwardsOf(module2, site.name) : [];
 }
 function claimsOf(implMethod) {
@@ -20944,6 +21255,8 @@ function describeSite(site) {
   if (site.via) return `${site.via}.${site.name}(\u2026)`;
   if (site.field) return `this.${site.field}.${site.name}(\u2026)`;
   if (site.constructed) return `new ${site.constructed}(\u2026).${site.name}(\u2026)`;
+  if (site.returnedBy) return `${site.returnedBy}(\u2026).${site.name}(\u2026)`;
+  if (site.enclosingClass) return `this.${site.name}(\u2026)`;
   return `<receiver>.${site.name}(\u2026)`;
 }
 function describeMiss(m) {
@@ -20964,7 +21277,7 @@ var init_call_conformance = __esm({
     callConformanceRule = {
       name: "call-conformance",
       judges: "code",
-      description: "Code\u2194spec Level 3: the CLAIMED call \u2194 realized call relation, judged both ways against the method's own source file (its sourcePath, else the implementation's), at exact analysis grade only. A method claims a call two ways and they face one check: a narrative `call` step, and an entry of the declared `calls` a narrative-less method reaches its collaborators through. They assert the same thing, and the step number is no part of the claim \u2014 this check never reads order, so it is only how a finding points at one. Forward: every claim must be realized by a call whose callee RESOLVES TO one of the target method's own source files \u2014 the target's contract name or a per-method `symbol` override, closed transitively over the named helpers the realized function calls, and resolved against every file the call CAN have reached: a `this.<field>.<method>()` receiver followed through the field's DECLARED TYPE, a `new Class(...).<method>()` receiver through the module its CLASS NAME came from, and a plain `<name>.<method>()` receiver through the type the file ANNOTATES that name with \u2014 a parameter's, or an annotated variable's, which is how a module that wires its collaborators as closures writes every one of its calls. A matching call whose origin a pure model cannot resolve is reported apart as CALL_ORIGIN_UNRESOLVED, which NAMES the shape it could not follow and asks for nothing \u2014 a coverage hole in the reader, reported for the reason CONFORMANCE_DEGRADED is: a silently degraded gate is worse than a degraded one. A finding names a landing only from the PROVEN tier so that widening what a call reached can accept a claim but never accuse one, and a target that names no file of its own falls back to name membership. Converse: a call that resolves to a modelled method of ANOTHER component in the SAME file crosses a component boundary while looking local, so the method must claim it \u2014 in a step or in `calls` (UNDECLARED_COLOCATED_CALL) \u2014 judged on the proven tier alone, and a same-file private helper is no modelled method and is never reported. A method that claims nothing at all is judged in neither direction: what it leaves unsaid is UNUSED_*'s subject. Order, arguments and conditions stay unverified, dispatch steps (runtime-table routed) are no claim about a call site, a malformed declared reference is MALFORMED_DECLARED_CALL's finding and names no target here, the conformance dial (off) skips, and weaker analysis grades never guess.",
+      description: "Code\u2194spec Level 3: the CLAIMED call \u2194 realized call relation, judged both ways against the method's own source file (its sourcePath, else the implementation's), at exact analysis grade only. A method claims a call two ways and they face one check: a narrative `call` step, and an entry of the declared `calls` a narrative-less method reaches its collaborators through. They assert the same thing, and the step number is no part of the claim \u2014 this check never reads order, so it is only how a finding points at one. Forward: every claim must be realized by a call whose callee RESOLVES TO one of the target method's own source files \u2014 the target's contract name or a per-method `symbol` override, closed transitively over the named helpers the realized function calls, and resolved against every file the call CAN have reached: a `this.<field>.<method>()` receiver followed through the field's DECLARED TYPE, a `new Class(...).<method>()` receiver through the module its CLASS NAME came from, a plain `<name>.<method>()` receiver through the type the file ANNOTATES that name with \u2014 a parameter's, or an annotated variable's, which is how a module that wires its collaborators as closures writes every one of its calls \u2014 a `fn(...).<method>()` receiver through the type fn RETURNS where the code settles it, and a `this.<method>()` receiver through the class whose own method it sits in; a package specifier naming a package of this repository resolves like a relative one, and an export alias (`export { a as b }`, an adapter object property `{ b: a }`) forwards by identity like a re-export. A matching call whose origin a pure model cannot resolve is reported apart as CALL_ORIGIN_UNRESOLVED, which NAMES the shape it could not follow and asks for nothing \u2014 a coverage hole in the reader, reported for the reason CONFORMANCE_DEGRADED is: a silently degraded gate is worse than a degraded one. A finding names a landing only from the PROVEN tier so that widening what a call reached can accept a claim but never accuse one, and a target that names no file of its own falls back to name membership. Converse: a call that resolves to a modelled method of ANOTHER component in the SAME file crosses a component boundary while looking local, so the method must claim it \u2014 in a step or in `calls` (UNDECLARED_COLOCATED_CALL) \u2014 judged on the proven tier alone, and a same-file private helper is no modelled method and is never reported; a function forwarding by identity to a modelled method written in another file IS that method, so what it calls is that method's subject. A method that claims nothing at all is judged in neither direction: what it leaves unsaid is UNUSED_*'s subject. Order, arguments and conditions stay unverified, dispatch steps (runtime-table routed) are no claim about a call site, a malformed declared reference is MALFORMED_DECLARED_CALL's finding and names no target here, the conformance dial (off) skips, and weaker analysis grades never guess.",
       codes: [
         { code: "CALL_STEP_UNREALIZED", defaultSeverity: "warning", summary: "Narrative call step or declared call realized by no call that resolves to the target method's own source file \u2014 the call is absent, or it lands in another module", carryable: true },
         { code: "CALL_ORIGIN_UNRESOLVED", defaultSeverity: "warning", summary: "Narrative call step or declared call whose target name IS called, but only from call sites written in a shape this analysis cannot resolve to a file \u2014 the claim was not checked, and is neither proven realized nor accused", carryable: true },
@@ -21007,7 +21320,7 @@ var init_call_conformance = __esm({
             if (!ctx.componentMap.has(claim.component)) continue;
             const target = resolveCallTarget(ctx, claim.component, claim.method);
             if (target.accepted.has(fnSymbol)) continue;
-            if (isTarget(code.forwardsOf(file, fnSymbol), target)) continue;
+            if (isTarget(code.forwardsOf(file, fnSymbol, implMethod.exportedVia), target)) continue;
             const matching = sites.filter((s) => target.accepted.has(s.name));
             const ref = `${claim.component}.${claim.method}`;
             if (target.files.size === 0) {
@@ -21050,7 +21363,7 @@ var init_call_conformance = __esm({
             ctx.addIssue(
               "warning",
               "CALL_ORIGIN_UNRESOLVED",
-              `Method "${implMethod.name}" in implementation "${impl.id}": ${unresolved.length} ${claimNoun(implMethod)} ARE called by name inside the function "${fnSymbol}" in "${file}", but every site calling them is written in a shape this analysis cannot resolve to a file \u2014 ${unresolved.map(describeMiss).join("; ")}. What resolves is a name bound to a module of THIS project: a bare or namespaced call through such an import binding, a \`this.<field>\` receiver whose declared type names one, a \`new Class(\u2026)\` receiver whose class does, and a receiver NAME the file annotates with a type that does. What does not: an import from a PACKAGE specifier, a receiver holding a value the module assembled, a receiver this model records no name for, and one the file annotates with nothing. This reports what was not checked, not what is wrong \u2014 the claim is neither proven realized nor accused of being missing, and no working call is asked to be rewritten to suit the reader.`,
+              `Method "${implMethod.name}" in implementation "${impl.id}": ${unresolved.length} ${claimNoun(implMethod)} ARE called by name inside the function "${fnSymbol}" in "${file}", but every site calling them is written in a shape this analysis cannot resolve to a file \u2014 ${unresolved.map(describeMiss).join("; ")}. What resolves is a name bound to a module of THIS project: a bare or namespaced call through such an import binding (a package of this repository included), a \`this.<field>\` receiver whose declared type names one, a \`new Class(\u2026)\` receiver whose class does, a receiver NAME the file annotates with a type that does, a \`fn(\u2026)\` receiver whose function's return the code settles on a type with that method's body, and \`this\` inside a class's own method that has it. What does not: an import from a third-party PACKAGE, a receiver holding a value the module assembled, a receiver this model records no name for, and one the file annotates with nothing. This reports what was not checked, not what is wrong \u2014 the claim is neither proven realized nor accused of being missing, and no working call is asked to be rewritten to suit the reader.`,
               impl.id,
               entry.draftContext,
               void 0,
@@ -21072,7 +21385,9 @@ var init_call_conformance = __esm({
             reached.set(site, owner);
             return owner !== void 0;
           };
-          for (const site of closedCallSites(code, file, fnSymbol, stopAtModelled, implMethod.exportedVia) ?? []) {
+          const forwardsToModelled = code.forwardsOf(file, fnSymbol, implMethod.exportedVia).some((p) => p.file !== here && modelledAt.get(p.file)?.byName.has(p.name));
+          const conversed = forwardsToModelled ? [] : closedCallSites(code, file, fnSymbol, stopAtModelled, implMethod.exportedVia) ?? [];
+          for (const site of conversed) {
             const owner = reached.get(site);
             if (!owner || owner.component === component.id) continue;
             const ref = `${owner.component}.${owner.method}`;
@@ -22363,7 +22678,7 @@ var init_export_conformance = __esm({
           const facts = code.factsAt(file);
           if (!facts || facts.status !== "analyzed" || facts.analysisGrade !== "exact") continue;
           for (const binding of facts.reexportBindings ?? []) {
-            const target = resolveImport(file, binding.from, code.paths);
+            const target = resolveImport(file, binding.from, code.paths, code.packages);
             const methods = target ? typeMethodsAt.get(target) : void 0;
             if (!methods) continue;
             if (binding.local === "*") {
@@ -22375,7 +22690,7 @@ var init_export_conformance = __esm({
         }
         const takenFrom = /* @__PURE__ */ new Map();
         const take = (consumer, writtenIn, specifier, names) => {
-          const target = resolveImport(writtenIn, specifier, code.paths);
+          const target = resolveImport(writtenIn, specifier, code.paths, code.packages);
           if (!target) return;
           let byName = takenFrom.get(target);
           if (!byName) takenFrom.set(target, byName = /* @__PURE__ */ new Map());
@@ -24203,6 +24518,9 @@ function walkExact(ts, sourceText, fileName) {
   const reexports = /* @__PURE__ */ new Set();
   const starExports = [];
   const namedReexports = [];
+  const exportAliases = [];
+  const propertyAliases = [];
+  const returnTypes = /* @__PURE__ */ new Map();
   const complexity = /* @__PURE__ */ new Map();
   const calls = /* @__PURE__ */ new Map();
   const bodies = /* @__PURE__ */ new Map();
@@ -24219,7 +24537,7 @@ function walkExact(ts, sourceText, fileName) {
   const mutableBindings = /* @__PURE__ */ new Set();
   const schemaConstants = /* @__PURE__ */ new Map();
   const derivedAliases = [];
-  const receiverKey = (site) => site.via ?? (site.field ? `this.${site.field}` : site.constructed ? `new ${site.constructed}` : "");
+  const receiverKey = (site) => site.via ?? (site.field ? `this.${site.field}` : site.constructed ? `new ${site.constructed}` : site.returnedBy ? `${site.returnedBy}()` : site.enclosingClass ? `this:${site.enclosingClass}` : "");
   const siteKey = (site) => `${site.member ? "m" : "b"}:${receiverKey(site)}:${site.name}`;
   const addBindingNames = (name) => {
     if (ts.isIdentifier(name)) declared.add(name.text);
@@ -24327,6 +24645,44 @@ function walkExact(ts, sourceText, fileName) {
     }
     return void 0;
   };
+  const enclosingClassOf = (node) => {
+    let at = node.parent;
+    while (at) {
+      if (ts.isFunctionExpression(at) || ts.isFunctionDeclaration(at) || ts.isClassExpression(at)) return void 0;
+      if ((ts.isMethodDeclaration(at) || ts.isGetAccessorDeclaration(at) || ts.isSetAccessorDeclaration(at)) && at.parent && ts.isObjectLiteralExpression(at.parent)) return void 0;
+      if (ts.isClassDeclaration(at)) {
+        return at.name && at.parent && ts.isSourceFile(at.parent) ? at.name.text : void 0;
+      }
+      at = at.parent;
+    }
+    return void 0;
+  };
+  const returnedTypeOf = (fn) => {
+    const annotated = fn.type;
+    if (annotated) {
+      if (!ts.isTypeReferenceNode(annotated)) return void 0;
+      if (ts.isIdentifier(annotated.typeName) && annotated.typeName.text === "Promise" && annotated.typeArguments?.length === 1) {
+        const inner2 = annotated.typeArguments[0];
+        return ts.isTypeReferenceNode(inner2) && !inner2.typeArguments ? typeReferenceName(inner2) : void 0;
+      }
+      return annotated.typeArguments ? void 0 : typeReferenceName(annotated);
+    }
+    const constructedClass = (expression) => {
+      let node = expression;
+      while (node && (ts.isParenthesizedExpression(node) || ts.isAsExpression(node) || ts.isSatisfiesExpression(node))) node = node.expression;
+      return node && ts.isNewExpression(node) && ts.isIdentifier(node.expression) ? node.expression.text : void 0;
+    };
+    if (!fn.body) return void 0;
+    if (!ts.isBlock(fn.body)) return constructedClass(fn.body);
+    const returns = [];
+    const collect2 = (node) => {
+      if (ts.isFunctionLike(node)) return;
+      if (ts.isReturnStatement(node)) returns.push(node);
+      ts.forEachChild(node, collect2);
+    };
+    ts.forEachChild(fn.body, collect2);
+    return returns.length === 1 ? constructedClass(returns[0].expression) : void 0;
+  };
   const isTopLevelVariable = (decl) => ts.isVariableDeclaration(decl) && ts.isIdentifier(decl.name) && !!decl.parent && ts.isVariableDeclarationList(decl.parent) && !!decl.parent.parent && ts.isVariableStatement(decl.parent.parent) && !!decl.parent.parent.parent && ts.isSourceFile(decl.parent.parent.parent);
   const containerOf = (owner) => {
     if (!owner) return void 0;
@@ -24388,6 +24744,11 @@ function walkExact(ts, sourceText, fileName) {
             addSite({ name, member: true, field: receiver.name.text });
           } else if (ts.isNewExpression(receiver) && ts.isIdentifier(receiver.expression)) {
             addSite({ name, member: true, constructed: receiver.expression.text });
+          } else if (ts.isCallExpression(receiver) && ts.isIdentifier(receiver.expression)) {
+            addSite({ name, member: true, returnedBy: receiver.expression.text });
+          } else if (receiver.kind === ts.SyntaxKind.ThisKeyword) {
+            const owner = enclosingClassOf(node);
+            addSite(owner !== void 0 ? { name, member: true, enclosingClass: owner } : { name, member: true });
           } else addSite({ name, member: true });
         }
       }
@@ -24514,6 +24875,8 @@ function walkExact(ts, sourceText, fileName) {
       signatures.push(declaredParameters(node));
       functionParams.set(fnName, signatures);
       if (completesLater(node)) asyncFunctions.push(fnName);
+      const returned = returnedTypeOf(node) ?? null;
+      returnTypes.set(fnName, returnTypes.has(fnName) && returnTypes.get(fnName) !== returned ? null : returned);
       const routes = collectRoutes(node);
       if (routes.size > 0) {
         const known = functionRoutes.get(fnName) ?? /* @__PURE__ */ new Map();
@@ -24550,6 +24913,23 @@ function walkExact(ts, sourceText, fileName) {
     if (ts.isVariableDeclaration(node) && ts.isIdentifier(node.name) && node.initializer && !schemaConstants.has(node.name.text)) {
       schemaConstants.set(node.name.text, node.initializer);
     }
+    if (isTopLevelVariable(node) && node.initializer) {
+      let literal = node.initializer;
+      while (ts.isAsExpression(literal) || ts.isSatisfiesExpression(literal) || ts.isParenthesizedExpression(literal)) {
+        literal = literal.expression;
+      }
+      if (ts.isObjectLiteralExpression(literal)) {
+        const container = node.name.text;
+        for (const property of literal.properties) {
+          if (ts.isShorthandPropertyAssignment(property)) {
+            propertyAliases.push({ exported: property.name.text, local: property.name.text, container });
+          } else if (ts.isPropertyAssignment(property) && ts.isIdentifier(property.initializer)) {
+            const key = propertyNameText(property.name);
+            if (key) propertyAliases.push({ exported: key, local: property.initializer.text, container });
+          }
+        }
+      }
+    }
     if (ts.isFunctionDeclaration(node) || ts.isClassDeclaration(node) || ts.isInterfaceDeclaration(node) || ts.isTypeAliasDeclaration(node) || ts.isEnumDeclaration(node) || ts.isModuleDeclaration(node)) {
       const name = node.name && ts.isIdentifier(node.name) ? node.name.text : void 0;
       if (name) {
@@ -24601,9 +24981,10 @@ function walkExact(ts, sourceText, fileName) {
         for (const el of node.exportClause.elements) {
           declared.add(el.name.text);
           exported.add(el.name.text);
-          if (spec && !node.isTypeOnly && !el.isTypeOnly) {
-            namedReexports.push({ exported: el.name.text, local: (el.propertyName ?? el.name).text, from: spec });
-          }
+          if (node.isTypeOnly || el.isTypeOnly) continue;
+          const local = (el.propertyName ?? el.name).text;
+          if (spec) namedReexports.push({ exported: el.name.text, local, from: spec });
+          else exportAliases.push({ exported: el.name.text, local });
         }
       } else if (!node.exportClause && spec) {
         starExports.push(spec);
@@ -24678,7 +25059,12 @@ function walkExact(ts, sourceText, fileName) {
     if (values && schemaConstants.has(alias.constant)) enumValues.set(alias.name, values);
   }
   const reexportOnly = sf.statements.length > 0 && sf.statements.every((st) => ts.isExportDeclaration(st) && !!st.moduleSpecifier);
-  return { declared, anchors, exported, imports, reexports, starExports, namedReexports, complexity, calls, bodies, importBindings, typeOnlyBindings, fieldTypes, localTypes, typeShapes, functionParams, functionRoutes, asyncFunctions, enumValues, aliasTypes, mutableBindings, reexportOnly };
+  for (const alias of propertyAliases) if (exported.has(alias.container)) exportAliases.push(alias);
+  return { declared, anchors, exported, imports, reexports, starExports, namedReexports, exportAliases, returnTypes, complexity, calls, bodies, importBindings, typeOnlyBindings, fieldTypes, localTypes, typeShapes, functionParams, functionRoutes, asyncFunctions, enumValues, aliasTypes, mutableBindings, reexportOnly };
+}
+function resolveModule(fromFile, specifier, packages) {
+  if (!specifier.startsWith(".")) return packages.get(specifier) ?? null;
+  return resolveRelativeModule(fromFile, specifier);
 }
 function resolveRelativeModule(fromFile, specifier) {
   if (!specifier.startsWith(".")) return null;
@@ -24701,8 +25087,8 @@ function resolveRelativeModule(fromFile, specifier) {
   }
   return null;
 }
-function reexportTarget(ts, filePath, specifier, projectRoot2, visited, exactCache) {
-  const target = resolveRelativeModule(filePath, specifier);
+function reexportTarget(ts, filePath, specifier, projectRoot2, visited, exactCache, packages) {
+  const target = resolveModule(filePath, specifier, packages);
   if (!target || path18.relative(projectRoot2, target).startsWith("..")) return null;
   let targetFacts = exactCache.get(target);
   if (targetFacts === void 0) {
@@ -24716,7 +25102,7 @@ function reexportTarget(ts, filePath, specifier, projectRoot2, visited, exactCac
   if (!targetFacts) return null;
   if (!visited.has(target)) {
     visited.add(target);
-    chaseReexports(ts, targetFacts, target, projectRoot2, visited, exactCache);
+    chaseReexports(ts, targetFacts, target, projectRoot2, visited, exactCache, packages);
   }
   return { path: target, facts: targetFacts };
 }
@@ -24739,13 +25125,33 @@ function carryBody(facts, target, targetPath, local, exported, projectRoot2) {
   }
   facts.bodies.set(exported, carried);
 }
-function chaseReexports(ts, facts, filePath, projectRoot2, visited, exactCache) {
+function carryAliasBody(facts, source, from, local, alias) {
+  const sourceBodies = source.bodies.get(local) ?? [];
+  if (!sourceBodies.length || sourceBodies.some((b) => b.nested)) return;
+  const moduleScope = sourceBodies.filter((b) => b.container === void 0);
+  if (!moduleScope.length) return;
+  const score = source.complexity.get(local);
+  if (score !== void 0) {
+    facts.complexity.set(alias.exported, Math.max(facts.complexity.get(alias.exported) ?? 0, score));
+  }
+  const relocate2 = (site) => from !== void 0 ? { ...site, from: site.from ?? from } : site;
+  const sites = facts.calls.get(alias.exported) ?? /* @__PURE__ */ new Map();
+  const carried = facts.bodies.get(alias.exported) ?? [];
+  for (const body of moduleScope) {
+    const moved = body.sites.map(relocate2);
+    for (const site of moved) sites.set(`${from ?? ""}|${alias.container ?? ""}|${JSON.stringify(site)}`, site);
+    carried.push(alias.container !== void 0 ? { container: alias.container, sites: moved } : { sites: moved });
+  }
+  facts.calls.set(alias.exported, sites);
+  facts.bodies.set(alias.exported, carried);
+}
+function chaseReexports(ts, facts, filePath, projectRoot2, visited, exactCache, packages = NO_PACKAGES) {
   for (const re of facts.namedReexports) {
-    const target = reexportTarget(ts, filePath, re.from, projectRoot2, visited, exactCache);
+    const target = reexportTarget(ts, filePath, re.from, projectRoot2, visited, exactCache, packages);
     if (target) carryBody(facts, target.facts, target.path, re.local, re.exported, projectRoot2);
   }
   for (const spec of facts.starExports) {
-    const target = reexportTarget(ts, filePath, spec, projectRoot2, visited, exactCache);
+    const target = reexportTarget(ts, filePath, spec, projectRoot2, visited, exactCache, packages);
     if (!target) continue;
     for (const name of target.facts.exported) {
       facts.exported.add(name);
@@ -24753,6 +25159,147 @@ function chaseReexports(ts, facts, filePath, projectRoot2, visited, exactCache)
       carryBody(facts, target.facts, target.path, name, name, projectRoot2);
     }
   }
+  for (const alias of facts.exportAliases) {
+    const binding = facts.importBindings.get(alias.local);
+    if (binding) {
+      if (binding.namespace) continue;
+      const target = reexportTarget(ts, filePath, binding.from, projectRoot2, visited, exactCache, packages);
+      if (!target) continue;
+      const from = pathKey(path18.relative(projectRoot2, target.path));
+      carryAliasBody(facts, target.facts, from, binding.imported ?? alias.local, alias);
+    } else if (alias.container !== void 0 || alias.local !== alias.exported) {
+      carryAliasBody(facts, facts, void 0, alias.local, alias);
+    }
+  }
+}
+function isOwnFile(projectRoot2, absolute) {
+  const rel2 = path18.relative(projectRoot2, absolute);
+  if (rel2.startsWith("..") || path18.isAbsolute(rel2)) return false;
+  return !pathKey(rel2).split("/").includes("node_modules");
+}
+function isFile(absolute) {
+  try {
+    return fs13.statSync(absolute).isFile();
+  } catch {
+    return false;
+  }
+}
+function readJsonFile(file, ts) {
+  let text3;
+  try {
+    text3 = fs13.readFileSync(file, "utf8");
+  } catch {
+    return void 0;
+  }
+  try {
+    return JSON.parse(text3);
+  } catch {
+    if (!ts) return void 0;
+    const parsed = ts.parseConfigFileTextToJson(file, text3);
+    return parsed.error ? void 0 : parsed.config;
+  }
+}
+function conditionTargets(value) {
+  if (typeof value === "string") return [value];
+  if (!value || typeof value !== "object" || Array.isArray(value)) return [];
+  const record2 = value;
+  const keys = [...ENTRY_CONDITIONS.filter((k) => k in record2), ...Object.keys(record2).filter((k) => !ENTRY_CONDITIONS.includes(k))];
+  return keys.flatMap((k) => conditionTargets(record2[k]));
+}
+function packageEntries(pkg) {
+  const entries = /* @__PURE__ */ new Map();
+  const exportsField = pkg.exports;
+  if (exportsField !== void 0 && exportsField !== null) {
+    const isSubpathMap = typeof exportsField === "object" && !Array.isArray(exportsField) && Object.keys(exportsField).some((k) => k.startsWith("."));
+    if (isSubpathMap) {
+      for (const [subpath, value] of Object.entries(exportsField)) {
+        if (!subpath.startsWith(".") || subpath.includes("*")) continue;
+        const targets = conditionTargets(value);
+        if (targets.length) entries.set(subpath, targets);
+      }
+    } else {
+      const targets = conditionTargets(exportsField);
+      if (targets.length) entries.set(".", targets);
+    }
+    return entries;
+  }
+  const fallbacks = ["module", "main", "types"].map((k) => pkg[k]).filter((v) => typeof v === "string");
+  if (fallbacks.length) entries.set(".", fallbacks);
+  return entries;
+}
+function entrySource(packageDir, target, compiler, projectRoot2) {
+  const absolute = path18.resolve(packageDir, target);
+  if (!isOwnFile(projectRoot2, absolute)) return null;
+  const isDeclaration = /\.d\.[cm]?ts$/.test(absolute);
+  if (!isDeclaration && languageOfSourcePath(absolute) && isFile(absolute) && !(compiler.outDir && !path18.relative(compiler.outDir, absolute).startsWith(".."))) {
+    return absolute;
+  }
+  if (!compiler.outDir || !compiler.rootDir) return null;
+  const inOut = path18.relative(compiler.outDir, absolute);
+  if (inOut.startsWith("..") || path18.isAbsolute(inOut)) return null;
+  const extension = BUILD_EXTENSIONS.find((ext) => inOut.endsWith(ext));
+  const stem2 = extension ? inOut.slice(0, -extension.length) : inOut;
+  for (const ext of SOURCE_EXTENSIONS) {
+    const candidate = path18.join(compiler.rootDir, stem2 + ext);
+    if (isOwnFile(projectRoot2, candidate) && isFile(candidate)) return candidate;
+  }
+  return null;
+}
+function readLocalPackages(projectRoot2) {
+  const out = /* @__PURE__ */ new Map();
+  const ts = resolveTypeScript(projectRoot2);
+  const root = readJsonFile(path18.join(projectRoot2, "package.json"), null);
+  if (!root || typeof root !== "object" || Array.isArray(root)) return out;
+  const rootPkg = root;
+  const declared = Array.isArray(rootPkg.workspaces) ? rootPkg.workspaces : rootPkg.workspaces && typeof rootPkg.workspaces === "object" && Array.isArray(rootPkg.workspaces.packages) ? rootPkg.workspaces.packages : [];
+  const dirs = [projectRoot2];
+  for (const entry of declared) {
+    if (typeof entry !== "string") continue;
+    const key = pathKey(entry).replace(/\/+$/, "");
+    if (!key || path18.isAbsolute(key)) continue;
+    if (key.endsWith("/*")) {
+      const base = path18.resolve(projectRoot2, key.slice(0, -2));
+      if (base.includes("*") || !isOwnFile(projectRoot2, base)) continue;
+      let children;
+      try {
+        children = fs13.readdirSync(base, { withFileTypes: true });
+      } catch {
+        continue;
+      }
+      for (const child of children.slice().sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0)) {
+        if (child.isDirectory() && child.name !== "node_modules" && !child.name.startsWith(".")) {
+          dirs.push(path18.join(base, child.name));
+        }
+      }
+    } else if (!key.includes("*")) {
+      const dir = path18.resolve(projectRoot2, key);
+      if (isOwnFile(projectRoot2, dir)) dirs.push(dir);
+    }
+  }
+  for (const dir of dirs) {
+    const pkg = dir === projectRoot2 ? rootPkg : readJsonFile(path18.join(dir, "package.json"), null);
+    if (!pkg || typeof pkg !== "object" || Array.isArray(pkg)) continue;
+    const name = pkg.name;
+    if (typeof name !== "string" || !name) continue;
+    const tsconfig = readJsonFile(path18.join(dir, "tsconfig.json"), ts);
+    const options = tsconfig?.compilerOptions ?? {};
+    const compiler = {
+      outDir: typeof options.outDir === "string" ? path18.resolve(dir, options.outDir) : void 0,
+      rootDir: typeof options.rootDir === "string" ? path18.resolve(dir, options.rootDir) : void 0
+    };
+    for (const [subpath, targets] of packageEntries(pkg)) {
+      const specifier = subpath === "." ? name : `${name}/${subpath.replace(/^\.\//, "")}`;
+      if (out.has(specifier)) continue;
+      for (const target of targets) {
+        const source = entrySource(dir, target, compiler, projectRoot2);
+        if (source) {
+          out.set(specifier, source);
+          break;
+        }
+      }
+    }
+  }
+  return out;
 }
 function looksBinary(buffer) {
   const probe2 = buffer.subarray(0, Math.min(buffer.length, 4096));
@@ -24810,6 +25357,9 @@ function buildCodeModel(implementations, types, projectRoot2, sourceRoots = [],
   const seen = /* @__PURE__ */ new Set();
   const exactCache = /* @__PURE__ */ new Map();
   const rootFiles = walkDeclaredRoots(sourceRoots, exclude, projectRoot2);
+  const localPackages = readLocalPackages(projectRoot2);
+  const packages = {};
+  for (const [specifier, absolute] of localPackages) packages[specifier] = pathKey(path18.relative(projectRoot2, absolute));
   const declaredPaths = [];
   for (const impl of implementations) {
     declaredPaths.push(...implementationSourceFiles(impl));
@@ -24855,7 +25405,7 @@ function buildCodeModel(implementations, types, projectRoot2, sourceRoots = [],
       if (ts) {
         try {
           const facts = walkExact(ts, text3, absolute);
-          chaseReexports(ts, facts, absolute, projectRoot2, /* @__PURE__ */ new Set([absolute]), exactCache);
+          chaseReexports(ts, facts, absolute, projectRoot2, /* @__PURE__ */ new Set([absolute]), exactCache, localPackages);
           analyzed = {
             analysisGrade: "exact",
             declaredNames: [...facts.declared],
@@ -24867,6 +25417,10 @@ function buildCodeModel(implementations, types, projectRoot2, sourceRoots = [],
               ...facts.namedReexports.map(({ exported, local, from }) => ({ exported, local, from })),
               ...facts.starExports.map((from) => ({ exported: "*", local: "*", from }))
             ],
+            exportAliases: facts.exportAliases.map((alias) => ({ ...alias })),
+            returnTypes: Object.fromEntries(
+              [...facts.returnTypes].filter((entry) => entry[1] !== null)
+            ),
             functionComplexity: Object.fromEntries(facts.complexity),
             functionCallSites: Object.fromEntries([...facts.calls].map(([k, v]) => [k, [...v.values()]])),
             functionBodies: Object.fromEntries(facts.bodies),
@@ -24896,7 +25450,7 @@ function buildCodeModel(implementations, types, projectRoot2, sourceRoots = [],
     }
     files.push({ path: sourcePath, status: "analyzed", language, ...analyzed });
   }
-  return { files, projectRoot: projectRoot2, rootFiles };
+  return { files, projectRoot: projectRoot2, rootFiles, packages };
 }
 function clauseBindings(clause, specifier) {
   const out = [];
@@ -25032,7 +25586,7 @@ function findTestsReferencing(methods, projectRoot2, testRoots) {
   }
   return found;
 }
-var fs13, path18, import_module2, C_FAMILY_COMMENTS, NAMED_IMPORT_BINDINGS_RE, JS_PATTERNS, LANGUAGE_PATTERNS, PATTERN_ANALYSIS_MAX_BYTES, IDENTIFIER_RE, STRING_RE, tsResolutionCache, TS_RESOLUTION_RETRY_MS, IMPORT_FROM_RE, DYNAMIC_IMPORT_RE, IDENTIFIER_ONLY_RE, NAMED_REEXPORT_RE, STAR_REEXPORT_RE;
+var fs13, path18, import_module2, C_FAMILY_COMMENTS, NAMED_IMPORT_BINDINGS_RE, JS_PATTERNS, LANGUAGE_PATTERNS, PATTERN_ANALYSIS_MAX_BYTES, IDENTIFIER_RE, STRING_RE, tsResolutionCache, TS_RESOLUTION_RETRY_MS, NO_PACKAGES, BUILD_EXTENSIONS, SOURCE_EXTENSIONS, ENTRY_CONDITIONS, IMPORT_FROM_RE, DYNAMIC_IMPORT_RE, IDENTIFIER_ONLY_RE, NAMED_REEXPORT_RE, STAR_REEXPORT_RE;
 var init_source_analysis = __esm({
   "src/core/source-analysis.ts"() {
     "use strict";
@@ -25141,6 +25695,10 @@ var init_source_analysis = __esm({
     STRING_RE = /'([^'\\\n]*(?:\\.[^'\\\n]*)*)'|"([^"\\\n]*(?:\\.[^"\\\n]*)*)"|`([^`\\]*(?:\\.[^`\\]*)*)`/g;
     tsResolutionCache = /* @__PURE__ */ new Map();
     TS_RESOLUTION_RETRY_MS = 3e4;
+    NO_PACKAGES = /* @__PURE__ */ new Map();
+    BUILD_EXTENSIONS = [".d.mts", ".d.cts", ".d.ts", ".mjs", ".cjs", ".jsx", ".js"];
+    SOURCE_EXTENSIONS = [".ts", ".tsx", ".mts", ".cts", ".js", ".jsx", ".mjs", ".cjs"];
+    ENTRY_CONDITIONS = ["types", "import", "require", "default"];
     IMPORT_FROM_RE = /(?:^|;)[ \t]*import\s+(?!\()([^'";]*?)\s*from\s*['"]([^'"]+)['"]/gm;
     DYNAMIC_IMPORT_RE = /\{([^{}]*)\}\s*=\s*await\s+import\(\s*['"]([^'"]+)['"]\s*\)/g;
     IDENTIFIER_ONLY_RE = /^[A-Za-z_$][\w$]*$/;
@@ -27006,8 +27564,8 @@ function generateSequenceDiagram(componentId, methodName, options) {
     const steps = [...methodImpl.narrative].sort((a, b) => a.stepNumber - b.stepNumber);
     for (const step of steps) {
       for (const par of parallelArms) {
-        const sep18 = par.sepByStep.get(step.stepNumber);
-        if (sep18 !== void 0) lines.push(`  and ${escapeLabel(sep18)}`);
+        const sep19 = par.sepByStep.get(step.stepNumber);
+        if (sep19 !== void 0) lines.push(`  and ${escapeLabel(sep19)}`);
       }
       switch (step.type) {
         case "local":
@@ -27785,6 +28343,15 @@ function classifySource(world, sourceId, label7, sources) {
     detail: `"${label7}" re-exports from "${sourceId}", which is neither a subsystem of this project, a member nor a declared external the scan read \u2014 a project re-exports only from its subsystems, members and externals of its family`
   };
 }
+function duplicateDetail(entries, index) {
+  const e = entries[index];
+  if (e.from !== void 0 || e.component !== void 0 || e.interface !== void 0 || e.typeDef !== void 0) return null;
+  const name = e.as ?? e.id;
+  if (name === void 0) return null;
+  const other = entries.findIndex((x, i) => i !== index && (x.as ?? x.id) === name);
+  if (other === -1) return null;
+  return `has a duplicate entry "${name}": entry #${index + 1} names no source and no item, while entry #${other + 1} declares the same id \u2014 delete the copy (entry #${index + 1}), or give it a source and an item under an id of its own`;
+}
 function bindOwnType(world, owner, e, problems) {
   const type = (world.types.get(e.typeDef) ?? []).find((t) => !t.subsystem);
   if (!type) {
@@ -27856,7 +28423,8 @@ function resolveProjectTable(system, subsystems, components, interfaces, types,
   const owner = sources.namespace ? sources.namespace : system.name;
   const problems = [];
   const candidates = [];
-  (system.publicInterfaces ?? []).forEach((e, index) => {
+  const entries = system.publicInterfaces ?? [];
+  entries.forEach((e, index) => {
     const label7 = e.as ?? e.id ?? e.interface ?? e.component ?? e.typeDef ?? `#${index + 1}`;
     const source = classifySource(world, sourceOf(world, e), label7, sources);
     switch (source.kind) {
@@ -27882,7 +28450,7 @@ function resolveProjectTable(system, subsystems, components, interfaces, types,
         return;
       }
       default:
-        problems.push({ kind: "invalid", owner, publicName: label7, detail: source.detail });
+        problems.push({ kind: "invalid", owner, publicName: label7, detail: duplicateDetail(entries, index) ?? source.detail });
     }
   });
   return settle(owner, "project", candidates, problems);
@@ -28479,6 +29047,16 @@ function qualifiedTypeNames(typeStr) {
   }
   return out;
 }
+function invariantTypeRef(ref) {
+  const at = ref.lastIndexOf(".");
+  return at > 0 && at < ref.length - 1 ? ref.slice(0, at) : void 0;
+}
+function mapInvariantRef(ref, map) {
+  const typeRef2 = invariantTypeRef(ref);
+  if (typeRef2 === void 0 || !typeRef2.includes("::")) return ref;
+  const next = map("type", typeRef2);
+  return next === typeRef2 ? ref : `${next}${ref.slice(typeRef2.length)}`;
+}
 function rawReferences(kind, spec) {
   const out = [];
   const add2 = (position, value) => {
@@ -28501,6 +29079,7 @@ function rawReferences(kind, spec) {
         for (const step of m.narrative) {
           const source = step.auth?.from;
           if (typeof source === "string" && source.startsWith(COMPONENT_AUTH_SOURCE)) add2("auth", source.slice(COMPONENT_AUTH_SOURCE.length));
+          for (const ref of step.assertsInvariants ?? []) add2("type", invariantTypeRef(ref));
         }
       }
       break;
@@ -28619,6 +29198,9 @@ function respellStoredReferences(kind, doc, map) {
       for (const m of list2(doc.methods)) {
         for (const step of list2(m.narrative)) {
           at(step, "targetComponent", "narrative");
+          if (Array.isArray(step.assertsInvariants)) {
+            step.assertsInvariants = step.assertsInvariants.map((ref) => typeof ref === "string" ? mapInvariantRef(ref, map) : ref);
+          }
           const auth = step.auth;
           if (auth && typeof auth.from === "string" && auth.from.startsWith(COMPONENT_AUTH_SOURCE)) {
             auth.from = `${COMPONENT_AUTH_SOURCE}${map("auth", auth.from.slice(COMPONENT_AUTH_SOURCE.length))}`;
@@ -28678,7 +29260,8 @@ function mapRawReferences(kind, spec, map) {
               return call && next !== call.compId ? `${next}.${call.methodName}` : entry;
             })
           } : {},
-          narrative: m.narrative.map((step) => {
+          narrative: m.narrative.map((authored) => {
+            const step = authored.assertsInvariants ? { ...authored, assertsInvariants: authored.assertsInvariants.map((ref) => mapInvariantRef(ref, map)) } : authored;
             const source = step.auth?.from;
             if (typeof source !== "string" || !source.startsWith(COMPONENT_AUTH_SOURCE)) return step;
             const auth = step.auth;
@@ -28779,7 +29362,7 @@ function resolveFamilyTables(raws) {
   const byKey3 = new Map(raws.map((r) => [r.record.namespace, r]));
   const done = /* @__PURE__ */ new Set();
   const resolving = /* @__PURE__ */ new Set();
-  const resolve55 = (raw) => {
+  const resolve56 = (raw) => {
     const key = raw.record.namespace;
     if (done.has(key)) return raw.record.exports;
     if (resolving.has(key)) return null;
@@ -28794,7 +29377,7 @@ function resolveFamilyTables(raws) {
         const producerKey = source !== void 0 ? raw.record.aliases.get(source) : void 0;
         if (producerKey === void 0 || producerTables.has(producerKey)) continue;
         const producer = byKey3.get(producerKey);
-        producerTables.set(producerKey, producer ? resolve55(producer) : null);
+        producerTables.set(producerKey, producer ? resolve56(producer) : null);
         audienceOf.set(producerKey, "project");
       }
       raw.record.subsystemExports = subsystemTables;
@@ -28810,7 +29393,7 @@ function resolveFamilyTables(raws) {
       resolving.delete(key);
     }
   };
-  raws.forEach((raw) => resolve55(raw));
+  raws.forEach((raw) => resolve56(raw));
 }
 function bindAuthored(raw, raws, readables, authored) {
   const key = raw.record.namespace;
@@ -31245,12 +31828,12 @@ var init_specs2 = __esm({
         return this.relativizeSpec("interface", stored);
       }
       prepareImplementationForWrite(spec, carry = true) {
-        const relative26 = this.relativizeSpec("implementation", spec, carry);
+        const relative28 = this.relativizeSpec("implementation", spec, carry);
         const member = this.getSubprojectPrefix(spec.id);
         const memberRoot = member ? this.resolveSubprojectForNamespace(member) : null;
-        if (memberRoot) return childRelativeFilePaths(relative26, this.rootDir, memberRoot);
+        if (memberRoot) return childRelativeFilePaths(relative28, this.rootDir, memberRoot);
         const partDir = this.partHolding(this.getImplementationPath(spec.id, spec.contract))?.part.directory;
-        return partDir ? partRelativeFilePaths(relative26, this.rootDir, partDir) : relative26;
+        return partDir ? partRelativeFilePaths(relative28, this.rootDir, partDir) : relative28;
       }
       /**
        * A type written in its stored form — every type position canonical (one
@@ -33407,7 +33990,7 @@ function resolveGit(external, config) {
   const declared = gitDeclarationOf(config, external);
   if (!declared) return { ...external, problem: "git producer unavailable: its declaration names no repository" };
   try {
-    const commit3 = external.role === "member" && declared.commit ? declared.commit : resolve7(declared.url, declared.ref);
+    const commit3 = external.role === "member" && declared.commit ? declared.commit : resolve3(declared.url, declared.ref);
     const directory = fetch2(declared.url, commit3, declared.dir);
     return { ...external, directory: path23.resolve(directory), commit: commit3, problem: void 0 };
   } catch (e) {
@@ -33858,7 +34441,7 @@ function scaffoldPart(alias, memberDir, contained) {
 }
 function createGitMember(alias, source, description, as) {
   const url = source.git;
-  const commit3 = source.commit ?? resolve7(url, source.ref);
+  const commit3 = source.commit ?? resolve3(url, source.ref);
   const dir = fetch2(url, commit3, source.dir);
   const kind = holdsProjectContent(dir) ? "project" : "part";
   if (as !== void 0 && as !== kind) {
@@ -34800,7 +35383,7 @@ function advanceMember(alias, ref, commit3, dryRun) {
   const url = member.source.git;
   const from = member.source.commit ?? "";
   const followed = commit3 === void 0 ? ref ?? member.source.ref : void 0;
-  const to = commit3 ?? resolve7(url, followed);
+  const to = commit3 ?? resolve3(url, followed);
   const after = specContents(fetch2(url, to, member.source.dir));
   const before = specContents(from !== "" ? fetch2(url, from, member.source.dir) : null);
   const added = [...after.keys()].filter((f) => !before.has(f)).sort();
@@ -36409,17 +36992,17 @@ function memberHop(agentId) {
   const alias = agentId.slice(0, at);
   const member = graph().nodes.find((n) => n.parent === "" && n.mountAlias === alias);
   if (!member) return null;
-  const relative26 = path29.relative(getProjectRoot(), member.directory).split(path29.sep).join("/");
-  return { alias, rest: agentId.slice(at + 2), directory: member.directory, relative: relative26 };
+  const relative28 = path29.relative(getProjectRoot(), member.directory).split(path29.sep).join("/");
+  return { alias, rest: agentId.slice(at + 2), directory: member.directory, relative: relative28 };
 }
-function throughMount(brief, alias, relative26) {
-  const under = (p) => path29.posix.join(relative26, p);
+function throughMount(brief, alias, relative28) {
+  const under = (p) => path29.posix.join(relative28, p);
   return {
     ...brief,
     agentId: `${alias}::${brief.agentId}`,
     ownedPaths: brief.ownedPaths.map(under),
     ...brief.readPaths ? { readPaths: brief.readPaths.map(under) } : {},
-    root: brief.root ? under(brief.root) : relative26
+    root: brief.root ? under(brief.root) : relative28
   };
 }
 function loadRegistry() {
@@ -39810,8 +40393,8 @@ var require_dist = __commonJS({
           walkPackDir(root, path93.join(current2, entry.name), out);
         } else if (entry.isFile()) {
           const absolute = path93.join(current2, entry.name);
-          const relative26 = path93.relative(root, absolute).split(path93.sep).join("/");
-          out.push({ path: relative26, contents: fs69.readFileSync(absolute) });
+          const relative28 = path93.relative(root, absolute).split(path93.sep).join("/");
+          out.push({ path: relative28, contents: fs69.readFileSync(absolute) });
         }
       }
     }
@@ -40011,8 +40594,8 @@ var require_dist = __commonJS({
       return normalized === "." ? ".wai/" : `${normalized}/.wai/`;
     }
     function normalizeRootPath(relativePath) {
-      const posix6 = relativePath.split(path210.sep).join("/").replace(/^\.\//, "").replace(/\/+$/, "");
-      return posix6 === "" || posix6 === "." ? "." : posix6;
+      const posix8 = relativePath.split(path210.sep).join("/").replace(/^\.\//, "").replace(/\/+$/, "");
+      return posix8 === "" || posix8 === "." ? "." : posix8;
     }
     function slugify2(projectName) {
       const slug2 = projectName.trim().toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
@@ -40118,19 +40701,19 @@ function commitStagedTree(stagingDir, destDir, roots, backupExisting) {
   const backupDir = path34.join(root, BACKUP_DIR, timestampSlug());
   let backedUp = false;
   for (const rootRel of roots) {
-    const relative26 = rootRel === "." ? "" : rootRel;
-    const stagedSpecDir = path34.join(stagingDir, relative26, ".wai");
+    const relative28 = rootRel === "." ? "" : rootRel;
+    const stagedSpecDir = path34.join(stagingDir, relative28, ".wai");
     if (!fs20.existsSync(stagedSpecDir)) continue;
-    const liveSpecDir = liveSpecDirFor(path34.join(root, relative26));
+    const liveSpecDir = liveSpecDirFor(path34.join(root, relative28));
     if (backupExisting && liveSpecDir && fs20.existsSync(liveSpecDir)) {
-      const backupTarget = path34.join(backupDir, relative26, path34.basename(liveSpecDir));
+      const backupTarget = path34.join(backupDir, relative28, path34.basename(liveSpecDir));
       fs20.mkdirSync(path34.dirname(backupTarget), { recursive: true });
       fs20.renameSync(liveSpecDir, backupTarget);
       backedUp = true;
     } else if (liveSpecDir && fs20.existsSync(liveSpecDir)) {
       fs20.rmSync(liveSpecDir, { recursive: true, force: true });
     }
-    const target = path34.join(root, relative26, ".wai");
+    const target = path34.join(root, relative28, ".wai");
     fs20.mkdirSync(path34.dirname(target), { recursive: true });
     if (fs20.existsSync(target)) fs20.rmSync(target, { recursive: true, force: true });
     fs20.renameSync(stagedSpecDir, target);
@@ -40445,7 +41028,7 @@ function repairTypeSpellings(apply4) {
     const key = `${kind}:${specId}`;
     let repair = repairs.get(key);
     if (!repair) {
-      repair = { specId, kind, rewritten: [], proposals: [], authorNeeded: [] };
+      repair = { specId, kind, rewritten: [], proposals: [], enumProposals: [], authorNeeded: [] };
       repairs.set(key, repair);
     }
     return repair;
@@ -40460,7 +41043,9 @@ function repairTypeSpellings(apply4) {
     if (problem.specId === void 0 || problem.kind === void 0 || !own(problem.specId)) continue;
     const repair = repairOf(problem.specId, problem.kind);
     const proposal = typeProblemIntProposal(problem);
+    const enumProposal = proposal ? null : typeProblemEnumProposal(problem);
     if (proposal) repair.proposals.push(proposal);
+    else if (enumProposal) repair.enumProposals.push(enumProposal);
     else repair.authorNeeded.push(problem);
   }
   const planned = [...repairs.values()];
@@ -40670,7 +41255,7 @@ var init_approval = __esm({
     init_lockfile();
     init_lock();
     init_project_family();
-    GATE_UPGRADE_NOTE = "the gate identity gained inputs in stage 5 (members' composition subjects, `composition`; code conformance moved beside the claim)";
+    GATE_UPGRADE_NOTE = "the gate identity gained inputs in this release (members' composition subjects, `composition`; code conformance moved beside the claim)";
   }
 });
 
@@ -40849,16 +41434,16 @@ var init_ai_guide = __esm({
 If \`.wai/specs/\` exists, the wairon SDD workflow is active; otherwise ignore it. wairon does not orchestrate sessions \u2014 it equips yours.
 
 ### In SDD Projects:
-- **Source of Truth**: All architecture lives in the spec tree under \`.wai/specs/\` (L0 System \u2192 L1 Subsystem \u2192 L2 Component \u2192 L3 Interface \u2192 L4 Implementation \u2192 L5 Narrative). Do not edit generated agent config files under \`.claude/agents/\` (rebuilt via \`wairon generate\`).
+- **Source of Truth**: All architecture lives in the spec tree under \`.wai/specs/\` (L0 System \u2192 L1 Subsystem \u2192 L2 Component \u2192 L3 Interface \u2192 L4 Implementation \u2192 L5 Narrative). Agent files under \`.claude/agents/\` are an opt-in generated view (\`rules.materializeAgentFiles\`) \u2014 never edit them; agents are served as live briefs.
 - **Validation**: Conformance checks (stereotype rules, cycle checks, reference integrity) are run via the \`sdd_validate_tree\` MCP tool.
 - **Operating Rules**:
   1. **Skills**: Use \`sdd-architect\` to design (and \`sdd-implement\`, \`sdd-narrative\`, \`sdd-auditor\`). Refer to project's local guide file for detailed constraints.
   2. **MCP Tools Only**: Author/validate specs *only* via \`sdd_*\` tools (e.g. \`sdd_initialize_system\`, \`sdd_validate_tree\`).
   3. **No CLI Exec**: Do not run the \`wairon\` CLI (human tool). Use MCP tools \`sdd_validate_tree\` and \`sdd_get_status\` instead.
   4. **Delegation**: Delegate implementation via the \`sdd-delegate\` skill \u2014 live agent briefs (\`sdd_get_agent_brief\` MCP tool / \`wairon-agent://\` resource) are composed per call and always current; no session restart. Generated agent files are an optional materialized view of the same topology. User-owned per-agent guidance may live in \`.wai/agents/<agent-id>.md\` (folded into every brief; scaffold via \`wairon agent customize <id>\`).
-  5. **Design First**: Complete spec and pass \`sdd_validate_tree\` before writing code.
+  5. **Design First, then approval**: Complete the spec and pass \`sdd_validate_tree\`, then ask the human to approve it with \`wairon lock\` before writing code. Approval is the lock record (\`.wai/lock.json\`), not a spec's \`status\` \u2014 the lock does not rewrite statuses; \`sdd_get_status\` reports the approval state.
   6. **Consistency**: Code must match L3 interfaces and L5 narratives exactly. If the spec is wrong, stop and update the spec.
-  7. **Members & References**: A project may contain other wairon projects as **members**, declared in its \`.wai/project.yaml\` \`members\` (create one with \`sdd_add_member\`); each member has its own spec tree, designed from its own root. Reference what another project exports as \`alias::name\` (the alias is a member or a declared external, the name a public name of its L0 export table); an id without \`::\` is local. A leading \`::\`, \`super::\`, member paths and an L1 subsystem carrying \`projectPath\` are deprecated: they still resolve for one release, are reported, and \`wairon doctor --fix\` rewrites them.`;
+  7. **Members & References**: A project may declare **members** in its \`.wai/project.yaml\` \`members\` (create one with \`sdd_add_member\`). A **part** (the default) stores some of this project's subsystems in another folder or repository: local ids, this project's lock. A **project** member is an independent boundary with its own spec tree and lock, designed from its own root. Reference what another project exports as \`alias::name\` (the alias is a member or a declared external, the name a public name of its L0 export table); an id without \`::\` is local. A leading \`::\`, \`super::\`, member paths and an L1 subsystem carrying \`projectPath\` are deprecated: they still resolve for one release, are reported, and \`wairon doctor --fix\` rewrites them.`;
     LOCAL_GUIDE_BODY = `## Wairon \u2014 Spec-Driven Development (you are operating inside it)
 
 This project uses **wairon**. System specs live under \`.wai/specs/\` (L0 System \u2192 L1 Subsystem \u2192 L2 Component \u2192 L3 Interface \u2192 L4 Implementation \u2192 Narrative); agent topology and code are derived from it.
@@ -40875,7 +41460,8 @@ This project uses **wairon**. System specs live under \`.wai/specs/\` (L0 System
   - **\`alias::name\`**: An id without \`::\` is local to the project that writes it. Anything another project provides is referenced as \`alias::name\` \u2014 the alias is one of your members or declared \`externals\`, the name a public name in that project's L0 export table. A reference to something it does not export is reported (\`EXTERNAL_NOT_EXPORTED\`).
   - **Deprecated forms** (they still resolve for one release, are reported, and \`wairon doctor --fix\` rewrites them): a leading \`::\` (\`::shared::error-type\`), \`super::\` (\`super::sibling_comp\`), member paths (\`billing::invoice::invoice_portal\`), and an L1 subsystem carrying \`projectPath\` (\`DEPRECATED_MOUNT_FORM\`).
 - **Do not run the \`wairon\` CLI**: Use \`sdd_validate_tree\` and \`sdd_get_status\` instead of CLI commands.
-- **Handoff to implementation**: Once design is complete and validates cleanly, tell the human: *"The specs are complete and validate. Please run \`wairon lock\` to confirm and freeze them."* No session restart is needed after the lock \u2014 delegate implementation right away via the \`sdd-delegate\` skill.
+- **Handoff to implementation**: Once design is complete and validates cleanly, tell the human: *"The specs are complete and validate. Please run \`wairon lock\` to approve them, and commit \`.wai/lock.json\`."* The lock records the approval; it does not rewrite spec files or their \`status\`. No session restart is needed after the lock \u2014 delegate implementation right away via the \`sdd-delegate\` skill.
+- **Approval, not status**: a design is ready to implement when it is APPROVED \u2014 \`sdd_get_status\` reports the approval state (approved, or which specs changed since), and \`wairon lock-check\` gives the same verdict in CI. A spec's \`status\` (draft/design/complete) is authoring readiness only; never wait for it to become \`complete\`.
 - **To implement code**: Delegate via the \`sdd-delegate\` skill: fetch the component's live brief with the \`sdd_get_agent_brief\` MCP tool (or the \`wairon-agent://\` resource) and spawn a subagent from it. Briefs are composed per call from the current spec tree, so they are always current \u2014 never wait for a restart. Implementations must match L3 interfaces and L5 narratives exactly. Generated agent files under \`.claude/agents/\` are an optional materialized view of the same topology \u2014 the live briefs are canonical.
 
 ### Rules (enforced by \`sdd_validate_tree\`)
@@ -41255,7 +41841,7 @@ function getStatusReport(options = {}, decor) {
   }
   const own = options.approvals?.find((a) => a.key === "");
   const hasMembers = (options.approvals ?? []).some((a) => a.key !== "" && a.as !== "part");
-  if (own && (own.state !== "never" || hasMembers)) output += `${mark.layer("system", "Approval:")} this project is ${own.state}${own.upgraded ? " (locked under the pre-stage-5 gate identity \u2014 re-lock once)" : ""}
+  if (own && (own.state !== "never" || hasMembers)) output += `${mark.layer("system", "Approval:")} this project is ${own.state}${own.upgraded ? " (locked under an earlier gate identity \u2014 re-lock once)" : ""}
 `;
   return { text: output, failed: false };
 }
@@ -42921,7 +43507,7 @@ var init_position_migration = __esm({
       auth: ["implementation"],
       subsystem: ["component", "type"],
       group: ["type"],
-      type: ["interface", "type"]
+      type: ["interface", "type", "implementation"]
     };
     BOUND = /* @__PURE__ */ new Set(["publicInterfaces", "lifecycle", "subsystem", "owns", "dependsOn", "dispatch", "mounts", "contract", "narrative", "group"]);
     compare2 = (a, b) => a < b ? -1 : a > b ? 1 : 0;
@@ -43882,7 +44468,7 @@ function attachEdits(plan7, family, bound2, dir, alias, bindingConfig) {
     edit(plan7, key, "id", `id: ${id} (declared${approved !== void 0 ? ", the id its lock approved" : ""})`, { root: dir, call: "setId", args: [id] });
   }
   if (!attached) plan7.notes.push(`${dir} has no project.yaml of its own \u2014 \`wairon doctor --fix\` writes one declaring "${alias}" as its id`);
-  const relPath = posix3(path45.relative(familyNode(family, bound2).directory, dir));
+  const relPath = posix5(path45.relative(familyNode(family, bound2).directory, dir));
   const declaration2 = { path: relPath, ...plan7.request.description !== void 0 ? { description: plan7.request.description } : {} };
   edit(plan7, bound2, "member", `members: ${alias} \u2192 ${relPath} (an existing project, kept as it is)`, { root: familyNode(family, bound2).directory, call: "declareMember", args: [alias, declaration2] });
   for (const requirement of requiredPolicies(bindingConfig)) {
@@ -43929,8 +44515,8 @@ function planDetach(family, bound2, request) {
   if (plan7.request.widen) planWidening(plan7, member, narrow);
   if (plan7.refusals.length > 0) return plan7;
   const boundDir = familyNode(family, bound2).directory;
-  const held = memberDeclarationOf(configAt3(boundDir)?.members?.[alias] ?? posix3(path45.relative(boundDir, member.directory)));
-  const declared = { ...held, path: memberLocationOf(held) ?? posix3(path45.relative(boundDir, member.directory)) };
+  const held = memberDeclarationOf(configAt3(boundDir)?.members?.[alias] ?? posix5(path45.relative(boundDir, member.directory)));
+  const declared = { ...held, path: memberLocationOf(held) ?? posix5(path45.relative(boundDir, member.directory)) };
   detachEdits(plan7, family, bound2, member, alias, declared, consumers, outward);
   return plan7;
 }
@@ -43970,7 +44556,7 @@ function planWidening(plan7, member, narrow) {
 function detachEdits(plan7, family, bound2, member, alias, declared, consumers, outward) {
   const boundDir = familyNode(family, bound2).directory;
   const relocation = plan7.request.relocation;
-  const sourceTo = (from, producer) => relocation ? { hosted: producer.id ?? producer.mountAlias ?? producer.namespace } : { path: posix3(path45.relative(from, producer.directory)) };
+  const sourceTo = (from, producer) => relocation ? { hosted: producer.id ?? producer.mountAlias ?? producer.namespace } : { path: posix5(path45.relative(from, producer.directory)) };
   const where = (source) => source.hosted !== void 0 ? `hosted record ${source.hosted}` : source.path;
   edit(plan7, bound2, "member", `members: ${alias} removed (${declared.path} ${relocation ? `moves to ${relocation.to}` : "stays as it is"})`, { root: boundDir, call: "removeMember", args: [alias] });
   const boundSource = relocation ? sourceTo(boundDir, member) : { path: declared.path };
@@ -44044,7 +44630,7 @@ function adoptEdits(plan7, family, bound2, alias, external, dir, at = dir) {
   edit(plan7, bound2, "pin", `pin ${alias} removed (the family supplies it now)`, { root: boundDir, call: "unpin", args: [alias] });
   edit(plan7, bound2, "external", `externals: ${alias} removed`, { root: boundDir, call: "removeExternal", args: [alias] });
   const declaration2 = {
-    path: posix3(path45.relative(boundDir, at)),
+    path: posix5(path45.relative(boundDir, at)),
     ...external.description !== void 0 ? { description: external.description } : {},
     ...external.use && external.use.length > 0 ? { use: external.use } : {}
   };
@@ -44117,7 +44703,7 @@ function writeOne(rehearsal, w) {
     }
   });
 }
-var fs26, path45, posix3, refuse, edit, label4;
+var fs26, path45, posix5, refuse, edit, label4;
 var init_membership = __esm({
   "src/migrations/membership.ts"() {
     "use strict";
@@ -44132,7 +44718,7 @@ var init_membership = __esm({
     init_project_family();
     init_specs();
     init_types2();
-    posix3 = (p) => p.split(path45.sep).join("/");
+    posix5 = (p) => p.split(path45.sep).join("/");
     refuse = (plan7, code, project2, detail) => {
       plan7.refusals.push({ code, project: project2, detail });
     };
@@ -44380,7 +44966,7 @@ var init_identity = __esm({
       auth: ["implementation"],
       subsystem: ["component", "type"],
       group: ["type"],
-      type: ["interface", "type"]
+      type: ["interface", "type", "implementation"]
     };
     PHASES = ["rewriteReferences", "renameAlias", "repointExternal", "renameId", "renamePin"];
   }
@@ -44578,7 +45164,7 @@ function respellConsumer(plan7, family, c, own) {
 function repointConsumer(plan7, c, boundNode2) {
   const declared = configAt5(c.node.directory)?.externals?.[c.alias];
   const project2 = boundNode2.id !== void 0 && boundNode2.id !== c.alias ? boundNode2.id : null;
-  const source = declared?.source ? { path: posix4(path47.relative(c.node.directory, boundNode2.directory)) } : null;
+  const source = declared?.source ? { path: posix6(path47.relative(c.node.directory, boundNode2.directory)) } : null;
   edit3(plan7, c.node.namespace, "external", `externals: ${c.alias} names ${boundNode2.id ?? "the top project"}${source ? ` at ${source.path}` : ""}`, { root: c.node.directory, call: "repointExternal", args: [c.alias, project2, source] });
   plan7.notes.push(`${label6(c.node.namespace)}'s pin of "${c.alias}" is taken again against ${boundNode2.id ?? "the top project"}: the producer changed, so its lock reads drifted until it is re-locked.`);
   return c;
@@ -44614,8 +45200,8 @@ function planExternalize(family, bound2, request) {
       plan7,
       bound2,
       "move",
-      `externalize ${id}: its specs into ${joined ? `the part "${joined.alias}"` : `a part at ${posix4(path47.relative(node.directory, dir))}, declared as "${id}"`} \u2014 a storage move; no reference, export or pin changes`,
-      { root: node.directory, call: "externalizeSubsystem", args: [id, posix4(path47.relative(node.directory, dir))] }
+      `externalize ${id}: its specs into ${joined ? `the part "${joined.alias}"` : `a part at ${posix6(path47.relative(node.directory, dir))}, declared as "${id}"`} \u2014 a storage move; no reference, export or pin changes`,
+      { root: node.directory, call: "externalizeSubsystem", args: [id, posix6(path47.relative(node.directory, dir))] }
     );
     plan7.notes.push("Source code is not moved: move the subsystem's code yourself if it should live beside its specs.");
     return plan7;
@@ -44624,7 +45210,7 @@ function planExternalize(family, bound2, request) {
   crossingsBack(plan7, family, bound2, subKey);
   checkSiblings(plan7, family, bound2, id, subKey, table);
   if (plan7.refusals.length > 0) return plan7;
-  edit3(plan7, bound2, "move", `externalize ${id} as a project: its specs into a member at ${posix4(path47.relative(node.directory, dir))}, declared as "${id}", then promoted`, { root: node.directory, call: "externalizeSubsystem", args: [id, posix4(path47.relative(node.directory, dir)), "project"] });
+  edit3(plan7, bound2, "move", `externalize ${id} as a project: its specs into a member at ${posix6(path47.relative(node.directory, dir))}, declared as "${id}", then promoted`, { root: node.directory, call: "externalizeSubsystem", args: [id, posix6(path47.relative(node.directory, dir)), "project"] });
   edit3(plan7, id, "pin", `pin the new member's externals (its external for ${node.id ?? "this project"}, when its specs reference it)`, { root: dir, call: "pinExternals", args: [[]] });
   plan7.notes.push("Source code is not moved: move the subsystem's code into the member yourself.");
   return plan7;
@@ -44869,7 +45455,7 @@ function writeOne3(rehearsal, w) {
     }
   });
 }
-var path47, posix4, label6, refuse3, edit3, KINDS_AT3;
+var path47, posix6, label6, refuse3, edit3, KINDS_AT3;
 var init_boundary = __esm({
   "src/migrations/boundary.ts"() {
     "use strict";
@@ -44881,7 +45467,7 @@ var init_boundary = __esm({
     init_project();
     init_project_family();
     init_types2();
-    posix4 = (p) => p.split(path47.sep).join("/");
+    posix6 = (p) => p.split(path47.sep).join("/");
     label6 = (key) => key === "" ? "the top project" : `"${key}"`;
     refuse3 = (plan7, code, project2, detail) => {
       plan7.refusals.push({ code, project: project2, detail });
@@ -44903,7 +45489,7 @@ var init_boundary = __esm({
       auth: ["implementation"],
       subsystem: ["component", "type"],
       group: ["type"],
-      type: ["interface", "type"]
+      type: ["interface", "type", "implementation"]
     };
   }
 });
@@ -45932,6 +46518,18 @@ function renderChangeReport(report4) {
   lines.push(...renderTestsToRevisit(report4.testsToRevisit));
   return lines.join("\n");
 }
+function specKindsHolding(id) {
+  const system = loadSystemSpec();
+  const held = {
+    system: !!system && (id === "system" || id === system.name),
+    subsystem: !!loadSubsystemSpec(id),
+    component: !!loadComponentSpec(id),
+    interface: !!loadInterfaceSpec(id),
+    implementation: !!loadImplementationSpec(id),
+    type: !!loadTypeSpec(id)
+  };
+  return SPEC_KINDS.filter((k) => held[k]);
+}
 function renderTestsToRevisit(entries) {
   if (!entries.length) return [];
   const lines = ["", "TESTS TO REVISIT:"];
@@ -46516,7 +47114,7 @@ ${renderChangeReport(report4)}`,
     server,
     "sdd_add_member",
     {
-      description: "Create a member of the bound project at `source`, in the one members grammar: `services/scheduler` (contained), `../admin` (a sibling checkout), `git@host:acme/payments.git` (a git repository, pinned at its default branch head unless `#<commit>` is given). By default a PART (stage 8): a piece of this project stored in another folder or repository, whose subsystems are this project's own (local ids, the ordinary subsystem rules, this project's lock); it gets only a specs folder, plus a configuration naming this project when it is not contained. With `as: project` an independent PROJECT instead: its project content is created \u2014 a project.yaml declaring the alias as its id, its L0, and the bound project's required packs (composition.requirePolicies) once \u2014 and it is reached only as `alias::name` through its L0 exports. What a member is follows from that content. A git member is not scaffolded; the repository's content decides what it is. Boundaries are earned: create a part unless the piece needs its own team, release, approval or public surface; sdd_promote_member makes one later. Idempotent \u2014 the same call again writes nothing; a different member under the alias is refused.",
+      description: "Create a member of the bound project at `source`, in the one members grammar: `services/scheduler` (contained), `../admin` (a sibling checkout), `git@host:acme/payments.git` (a git repository, pinned at its default branch head unless `#<commit>` is given). By default a PART: a piece of this project stored in another folder or repository, whose subsystems are this project's own (local ids, the ordinary subsystem rules, this project's lock); it gets only a specs folder, plus a configuration naming this project when it is not contained. With `as: project` an independent PROJECT instead: its project content is created \u2014 a project.yaml declaring the alias as its id, its L0, and the bound project's required packs (composition.requirePolicies) once \u2014 and it is reached only as `alias::name` through its L0 exports. What a member is follows from that content. A git member is not scaffolded; the repository's content decides what it is. Boundaries are earned: create a part unless the piece needs its own team, release, approval or public surface; sdd_promote_member makes one later. Idempotent \u2014 the same call again writes nothing; a different member under the alias is refused.",
       inputSchema: {
         alias: import_zod12.z.string().describe("The member's alias ([a-z0-9-_]+); a project's new id"),
         source: import_zod12.z.string().describe("A contained path, a `../` sibling path, or a git URL (optionally `#<commit>`)"),
@@ -46586,7 +47184,7 @@ ${renderChangeReport(report4)}`,
     server,
     "sdd_externalize_subsystem",
     {
-      description: "Move an internal subsystem out to the path. By default (stage 8) into a PART \u2014 a storage move: the subsystem's specs move to that directory (a new part, or the existing part there), and nothing else changes: no reference, export, external or lock entry, the same verdict. With `as: project`, into a member PROJECT instead, family-wide and all-or-nothing \u2014 the move followed by a promote: what crosses the new boundary exported and imported, references respelled `alias::name`, the new member's external for this project pinned, and every other family project's references checked to still resolve (a reference that would need a component made public refuses the plan). Source code is not moved. dryRun answers the plan and writes nothing; run it first and show the plan. Never locks: the answer names the projects to re-lock.",
+      description: "Move an internal subsystem out to the path. By default into a PART \u2014 a storage move: the subsystem's specs move to that directory (a new part, or the existing part there), and nothing else changes: no reference, export, external or lock entry, the same verdict. With `as: project`, into a member PROJECT instead, family-wide and all-or-nothing \u2014 the move followed by a promote: what crosses the new boundary exported and imported, references respelled `alias::name`, the new member's external for this project pinned, and every other family project's references checked to still resolve (a reference that would need a component made public refuses the plan). Source code is not moved. dryRun answers the plan and writes nothing; run it first and show the plan. Never locks: the answer names the projects to re-lock.",
       inputSchema: {
         subsystem: import_zod12.z.string().describe("The subsystem to move out"),
         path: import_zod12.z.string().describe("The part's root, relative to the bound project (a new directory, or an existing part's)"),
@@ -46600,7 +47198,7 @@ ${renderChangeReport(report4)}`,
     server,
     "sdd_promote_member",
     {
-      description: "Promote a part of the bound project to an independent project in place (stage 8) \u2014 its files stay where they are; it gets an id, an L0 exporting exactly what the rest of the project uses of it, its references across the new boundary respelled `alias::name`, the parent declared as its external, and pins on both sides. Refused (each reason listed) for a part fetched from git, a trusted link that would cross the new boundary, a used component its subsystem does not publish, or an id already taken. All-or-nothing; dryRun answers the plan and writes nothing \u2014 run it first and show the plan. Never locks: the answer names the project to re-lock and the new one to lock.",
+      description: "Promote a part of the bound project to an independent project in place \u2014 its files stay where they are; it gets an id, an L0 exporting exactly what the rest of the project uses of it, its references across the new boundary respelled `alias::name`, the parent declared as its external, and pins on both sides. Refused (each reason listed) for a part fetched from git, a trusted link that would cross the new boundary, a used component its subsystem does not publish, or an id already taken. All-or-nothing; dryRun answers the plan and writes nothing \u2014 run it first and show the plan. Never locks: the answer names the project to re-lock and the new one to lock.",
       inputSchema: {
         alias: import_zod12.z.string().describe("The part's alias"),
         id: import_zod12.z.string().optional().describe("The new project's id (default: the alias)"),
@@ -46613,7 +47211,7 @@ ${renderChangeReport(report4)}`,
     server,
     "sdd_demote_member",
     {
-      description: "Demote a project member of the bound project to a part in place (stage 8) \u2014 sdd_promote_member's inverse: its files stay where they are; its own metadata goes to the homes the destination names (as sdd_internalize_member sends it), its L0, lock and pins end, its references across the old boundary become local ids, and its configuration is reduced to naming its parent. Refused while another family project consumes it (a part has no exports \u2014 each consumer listed), for a member fetched from git, or for internalize's reasons. All-or-nothing; dryRun answers the plan and writes nothing \u2014 run it first and show the plan. Never locks.",
+      description: "Demote a project member of the bound project to a part in place \u2014 sdd_promote_member's inverse: its files stay where they are; its own metadata goes to the homes the destination names (as sdd_internalize_member sends it), its L0, lock and pins end, its references across the old boundary become local ids, and its configuration is reduced to naming its parent. Refused while another family project consumes it (a part has no exports \u2014 each consumer listed), for a member fetched from git, or for internalize's reasons. All-or-nothing; dryRun answers the plan and writes nothing \u2014 run it first and show the plan. Never locks.",
       inputSchema: {
         alias: import_zod12.z.string().describe("The project member's alias"),
         destination: import_zod12.z.object({
@@ -46956,7 +47554,7 @@ ${renderChangeReport(report4)}`,
         interface: import_zod12.z.string().describe('The L3 interface ID (e.g. "ibilling-gateway")'),
         endpoints: import_zod12.z.array(import_zod12.z.object({
           method: import_zod12.z.string().describe("The NAME of the interface method to bind (not the HTTP verb)"),
-          transport: import_zod12.z.enum(["HTTP", "gRPC", "GraphQL", "MessageBus", "NamedPipe", "IPC", "CLI", "Custom"]).describe("Wire protocol; must match the Portal's portalType"),
+          transport: import_zod12.z.enum(["HTTP", "HTTP_API", "gRPC", "GraphQL", "MessageBus", "NamedPipe", "IPC", "CLI", "Custom"]).describe("Wire protocol; must be the one the Portal's portalType implies. Either vocabulary is accepted: the endpoint's (HTTP) or the portalType's (HTTP_API), stored as HTTP; any other transport is refused, naming the one the portalType implies"),
           httpMethod: import_zod12.z.enum(["GET", "POST", "PUT", "DELETE", "PATCH", "OPTIONS", "HEAD"]).optional().describe("HTTP: verb"),
           path: import_zod12.z.string().optional().describe('HTTP: route path, e.g. "/v1/checkout"'),
           service: import_zod12.z.string().optional().describe("gRPC: service name"),
@@ -46979,8 +47577,10 @@ ${renderChangeReport(report4)}`,
       try {
         const intf = loadInterfaceSpec(interfaceId);
         if (!intf) return errText(`Interface "${interfaceId}" does not exist.`);
-        const buildRaw = (e) => {
-          switch (e.transport) {
+        const owner = intf.component ? loadComponentSpec(intf.component) : null;
+        const implied = owner?.componentType === "Portal" && owner.portalType ? PORTAL_TYPE_TRANSPORT[owner.portalType] : void 0;
+        const buildRaw = (e, transport) => {
+          switch (transport) {
             case "HTTP":
               return { transport: "HTTP", method: e.httpMethod, path: e.path };
             case "gRPC":
@@ -47004,13 +47604,19 @@ ${renderChangeReport(report4)}`,
         for (const e of endpoints) {
           const m = intf.methods.find((x) => x.name === e.method);
           if (!m) return errText(`Method "${e.method}" not found on interface "${interfaceId}". Define it via sdd_define_interface first.`);
-          const parsed = EndpointSchema.safeParse(buildRaw(e));
+          const transport = e.transport === "HTTP_API" ? "HTTP" : e.transport;
+          if (implied && transport !== implied) {
+            return errText(
+              `Method "${e.method}": transport "${e.transport}" does not match ${owner.id}'s portalType ${owner.portalType}, which implies transport "${implied}". Bind it as "${implied}", or change the Portal's portalType.`
+            );
+          }
+          const parsed = EndpointSchema.safeParse(buildRaw(e, transport));
           if (!parsed.success) {
             const detail = parsed.error.issues.map((i) => `${i.path.join(".") || "(root)"}: ${i.message}`).join("; ");
-            return errText(`Invalid ${e.transport} endpoint for method "${e.method}": ${detail}`);
+            return errText(`Invalid ${transport} endpoint for method "${e.method}": ${detail}`);
           }
           methods.push({ name: e.method, endpoint: parsed.data });
-          bound2.push(`${e.method}\u2192${e.transport}`);
+          bound2.push(`${e.method}\u2192${transport}`);
         }
         const report4 = updateSpecGated("interface", interfaceId, { methods });
         return structured(
@@ -47271,14 +47877,24 @@ ${renderChangeReport(report4)}`,
     {
       description: `Get/read the parsed JSON contents of a specific spec from the spec tree. Returns structural contents without file system path searching. Pass "methods" to read only the named methods of a contract, an implementation or a type \u2014 a 45-method spec fetched whole to look at one of them is the read side of the same waste a restatement is on the write side; the answer then carries a "partialResult" marker naming what was left out, and must never be re-authored from. For a variant-tagged COMPONENT the result also carries a derived, read-only "variantGuidance" (the variant's base, its implementation guidance, and the same-variant sibling components to implement alike) \u2014 it is resolved from the variant registry, not part of the spec, so never write it back. A contract's methods come back in their STORED form \u2014 a method that takes its signature from a source carries its signatureFrom, not the params the loader resolves into it \u2014 so the answer can be re-authored from as it is; the resolved params, returns and text of each such method come back as a derived, read-only "resolvedSignatures" marker. The structured content carries the same answer with the derived markers KEPT SEPARATE from the stored spec ({kind, id, spec, partialResult?, variantGuidance?, resolvedSignatures?}), so nothing derived can be mistaken for something stored; the text block folds them in as it always has.`,
       inputSchema: {
-        kind: import_zod12.z.enum(["system", "subsystem", "component", "interface", "implementation", "type"]).describe("The kind of specification"),
+        kind: import_zod12.z.enum(["system", "subsystem", "component", "interface", "implementation", "type"]).optional().describe("The kind of specification. Omit it to infer the kind from the id: the read is refused, naming the candidate kinds, when the id names specs at more than one level (an interface and an implementation sharing an id, say), or at none"),
         id: import_zod12.z.string().describe('The identifier of the spec to fetch (the L0 system spec is a singleton \u2014 pass the system name or "system")'),
         methods: import_zod12.z.array(import_zod12.z.string().min(1)).optional().describe("Return only these methods by name; every other field of the spec comes back unchanged. Only an interface, an implementation or a type declares methods \u2014 asking for one elsewhere is refused, as is a name the spec does not declare (the answer names the ones it does). Omit it for the whole spec.")
       },
       outputSchema: getSpecOutput
     },
-    ({ kind, id, methods }) => {
+    ({ kind: askedKind, id, methods }) => {
       try {
+        let kind;
+        if (askedKind) {
+          kind = askedKind;
+        } else {
+          const holders = specKindsHolding(id);
+          if (holders.length !== 1) {
+            return errText(holders.length === 0 ? `No spec of any kind has the ID "${id}".` : `The ID "${id}" names specs of more than one kind (${holders.join(", ")}). Pass "kind" to choose one.`);
+          }
+          kind = holders[0];
+        }
         let result = null;
         let partial2 = null;
         switch (kind) {
@@ -47637,7 +48253,7 @@ async function startMcpServer() {
   } catch {
   }
 }
-var import_mcp, import_stdio, import_zod12, import_types12, fs29, path50, import_url, crypto10, TYPE_REF_GRAMMAR, staleServerOutput, externalPinsOutput, externalStatusesOutput, SPEC_KINDS, STATUS_VALUES, testsToRevisitOutput, typeRespellingOutput, specWriteReceiptOutput, specDeletionOutput, specChangeOutput, specChangeReportOutput, validationIssueOutput, memberCreationOutput, doctrineChangeOutput, impactTotalsOutput, packImpactOutput, validateTreeOutput, getSpecOutput, FINGERPRINT_VERSION, runningFingerprint, RECONNECT, assessedAsChanged, serverBuildStamps, SERVER_BUILD_STAMP, SPEC_WRITE_TOOLS, listChangedEmitters, statusInput, SKILL_RESOURCE_MIME, AGENT_BRIEF_SCHEME;
+var import_mcp, import_stdio, import_zod12, import_types12, fs29, path50, import_url, crypto10, TYPE_REF_GRAMMAR, staleServerOutput, externalPinsOutput, externalStatusesOutput, SPEC_KINDS, PORTAL_TYPE_TRANSPORT, STATUS_VALUES, testsToRevisitOutput, typeRespellingOutput, specWriteReceiptOutput, specDeletionOutput, specChangeOutput, specChangeReportOutput, validationIssueOutput, memberCreationOutput, doctrineChangeOutput, impactTotalsOutput, packImpactOutput, validateTreeOutput, getSpecOutput, FINGERPRINT_VERSION, runningFingerprint, RECONNECT, assessedAsChanged, serverBuildStamps, SERVER_BUILD_STAMP, SPEC_WRITE_TOOLS, listChangedEmitters, statusInput, SKILL_RESOURCE_MIME, AGENT_BRIEF_SCHEME;
 var init_server = __esm({
   "src/mcp/server.ts"() {
     "use strict";
@@ -47666,7 +48282,7 @@ var init_server = __esm({
     init_project();
     init_validation_options();
     init_migrations3();
-    TYPE_REF_GRAMMAR = (what) => `${what}, in the neutral type grammar: a primitive (string, int, float, bool, bytes, date, datetime, duration, any; void only as a whole returns), a defined type id ("billing.Invoice", "alias::name"), list<T>, set<T>, map<K, V> (K is string, int or an enum), T? (T or no value), a union of NAMED types ("Invoice | Receipt"), and on a returns only, async T ("async void"). Every named type must resolve. TypeScript spellings are accepted and respelled \u2014 "Invoice[]" \u2192 list<Invoice>, "Invoice | null" \u2192 Invoice?, boolean \u2192 bool, Record<string, V> \u2192 map<string, V>, Promise<T> \u2192 async T \u2014 and the answer lists each respelling. Refused, naming the replacement: number ("int or float?"), inline object or function types (name a value-object or a signature type), string-literal unions (name an enum), and unions mixing in a primitive or a collection.`;
+    TYPE_REF_GRAMMAR = (what) => `${what}, in the neutral type grammar: a primitive (string, int, float, bool, bytes, date, datetime, duration, any; void only as a whole returns), a defined type id ("billing.Invoice", "alias::name"), list<T>, set<T>, map<K, V> (K is string, int or an enum), T? (T or no value), a union of NAMED types ("Invoice | Receipt"), and on a returns only, async T ("async void") and result<T, E> (completes with T or fails with E; "async result<void, E>"). Every named type must resolve. TypeScript and Rust spellings are accepted and respelled \u2014 "Invoice[]" \u2192 list<Invoice>, "Invoice | null" \u2192 Invoice?, boolean \u2192 bool, Record<string, V> \u2192 map<string, V>, Promise<T> \u2192 async T, Result<(), E> \u2192 result<void, E> \u2014 and the answer lists each respelling. Refused, naming the replacement: number ("int or float?"), inline object or function types (name a value-object or a signature type), string-literal unions (name an enum), and unions mixing in a primitive or a collection.`;
     staleServerOutput = {
       staleServer: import_zod12.z.boolean().optional().describe(
         "True when the wairon build on disk changed after this server started \u2014 the structured twin of the text answer's STALE SERVER banner. When the rebuild left the spec and tool schemas alone, writes still go through; reconnect to run the new code."
@@ -47706,6 +48322,16 @@ var init_server = __esm({
       ...staleServerOutput
     };
     SPEC_KINDS = ["system", "subsystem", "component", "interface", "implementation", "type"];
+    PORTAL_TYPE_TRANSPORT = {
+      HTTP_API: "HTTP",
+      gRPC: "gRPC",
+      GraphQL: "GraphQL",
+      MessageBus: "MessageBus",
+      NamedPipe: "NamedPipe",
+      IPC: "IPC",
+      CLI: "CLI",
+      Custom: void 0
+    };
     STATUS_VALUES = ["draft", "design", "complete"];
     testsToRevisitOutput = import_zod12.z.array(import_zod12.z.object({
       method: import_zod12.z.string().describe("The contract method this write changed or deleted."),
@@ -47820,7 +48446,7 @@ var init_server = __esm({
         profile: import_zod12.z.string().optional()
       })).describe("Requirements no installed version satisfies: nothing was written for them, and the next family run reports each as POLICY_NOT_ADOPTED."),
       projectType: import_zod12.z.string().optional().describe("The profile written as the new member's projectType, when exactly one adopted requirement names one."),
-      as: import_zod12.z.string().describe("part | project: what was created (stage 8; a part by default)."),
+      as: import_zod12.z.string().describe("part | project: what was created (a part by default)."),
       storage: import_zod12.z.string().describe("contained | path | git: where its files live."),
       commit: import_zod12.z.string().optional().describe("git: the commit the member was pinned at."),
       ...staleServerOutput
@@ -48149,8 +48775,7 @@ function resolveInstallTargets(options) {
     const isPackaged = typeof process.pkg !== "undefined";
     const scriptPath = process.argv[1] ? path51.resolve(process.argv[1]).replace(/\\/g, "/") : null;
     const useDirectNode = !isPackaged && scriptPath && (scriptPath.endsWith(".js") || scriptPath.endsWith(".ts"));
-    const env = useGlobal ? {} : { WAIRON_PROJECT_DIR: process.cwd().replace(/\\/g, "/") };
-    const desiredEntry = options.hostedUrl ? hostedMcpEntry(options) : useDirectNode ? { command: "node", args: [scriptPath, "mcp", "serve"], env } : { command: "wairon", args: ["mcp", "serve"], env };
+    const desiredEntry = options.hostedUrl ? hostedMcpEntry(options) : useGlobal ? machineEntry(useDirectNode ? scriptPath : null) : projectEntry(root, useDirectNode ? scriptPath : null);
     const existingEntry = mcpServers["wairon"];
     return {
       backend,
@@ -48165,6 +48790,16 @@ function resolveInstallTargets(options) {
     };
   });
 }
+function machineEntry(scriptPath) {
+  return scriptPath ? { command: "node", args: [scriptPath, "mcp", "serve"], env: {} } : { command: "wairon", args: ["mcp", "serve"], env: {} };
+}
+function projectEntry(root, scriptPath) {
+  if (scriptPath && !isOutsideRoot(root, scriptPath)) {
+    const relative28 = path51.relative(root, scriptPath).replace(/\\/g, "/");
+    return { command: "node", args: [`./${relative28}`, "mcp", "serve"] };
+  }
+  return { command: "wairon", args: ["mcp", "serve"] };
+}
 function planMcpInstall(options) {
   return resolveInstallTargets(options).map(({ backend, path: file, outsideProject, before, after, upToDate }) => ({
     backend,
@@ -48200,10 +48835,8 @@ function reportInstalled(target, agentLabel) {
   const wasStale = target.before !== void 0;
   logger.success(`wairon MCP server ${wasStale ? "updated (was stale)" : "registered"} for ${agentLabel} in ${import_chalk3.default.cyan(target.path)}.`);
   logger.blank();
-  logger.info("AI tools using this config will have access to these wairon tools:");
-  logger.info("  listAgents \xB7 getAgent \xB7 listDomains \xB7 validateTopology \xB7 getProjectConfig");
-  logger.info("  sdd_initialize_system \xB7 sdd_add_subsystem \xB7 sdd_add_component \xB7 sdd_define_interface");
-  logger.info("  sdd_write_narrative \xB7 sdd_validate_tree \xB7 sdd_get_status");
+  logger.info("AI tools using this config get the wairon MCP server: the sdd_* spec-authoring, validation, member and");
+  logger.info('rename tools, plus live agent briefs (sdd_get_agent_brief). The full list is in docs/cli.md ("MCP tools").');
   logger.blank();
   const restartApp = target.backend === "gemini" ? "Antigravity CLI (agy)" : "claude";
   logger.info(`Restart ${import_chalk3.default.bold(restartApp)} (or reload MCP servers) to activate.`);
@@ -48336,7 +48969,8 @@ init_skills_portal();
 init_base();
 init_fs();
 init_project();
-var WAIRON_AGENT_FILE = /-(owner|implementer|architect)\.md$/;
+var AGENT_FILE_EXTENSION = /\.(md|ya?ml)$/;
+var WAIRON_AGENT_FILE = /-(owner|implementer|architect)\.(md|ya?ml)$/;
 function pruneStaleAgents(expectedPaths, scanDirs, reach2) {
   const dirs = new Set(scanDirs ?? [...expectedPaths].map((p) => path39.dirname(p)));
   let pruned = 0;
@@ -48350,7 +48984,7 @@ function pruneStaleAgents(expectedPaths, scanDirs, reach2) {
       continue;
     }
     for (const name of entries) {
-      if (!name.endsWith(".md")) continue;
+      if (!AGENT_FILE_EXTENSION.test(name)) continue;
       const full = path39.resolve(dir, name);
       if (expectedPaths.has(full)) continue;
       let owned = WAIRON_AGENT_FILE.test(name);
@@ -48392,6 +49026,18 @@ function announceOutsideTargets(projectConfig, reach2) {
   }
   return outside.map((t) => t.type);
 }
+function configuredTargetTypes(projectConfig) {
+  const targets = projectConfig.targets;
+  return [...new Set(targets.map((t) => typeof t === "string" ? t : t.type))];
+}
+var UnknownTargetError = class extends WaironError {
+  constructor(target, known) {
+    super(
+      `Unknown target "${target}". This project configures: ${known.length ? known.join(", ") : "(none)"}. Pass one of those, or add a target to .wai/project.yaml (\`targets\`).`
+    );
+    this.name = "UnknownTargetError";
+  }
+};
 async function runGenerate(options = {}) {
   await generateLayer(options);
   const scoped = options.root || options.domain || options.domains;
@@ -48410,6 +49056,10 @@ async function generateLayer(options = {}) {
   assertProjectInitialized();
   const projectConfig = loadProjectConfig();
   if (!projectConfig) throw new ProjectNotInitializedError();
+  if (options.target !== void 0) {
+    const known = configuredTargetTypes(projectConfig);
+    if (!known.includes(options.target)) throw new UnknownTargetError(options.target, known);
+  }
   const agents = resolveAgentTopology();
   if (agents.length === 0) {
     logger.warn("No agents resolved from the spec tree. Define subsystems and components first \u2014 see `wairon status`.");
@@ -48426,6 +49076,8 @@ async function generateLayer(options = {}) {
     const removed = pruneStaleAgents(/* @__PURE__ */ new Set(), candidateDirs, reach2);
     if (removed > 0) {
       logger.info(`Removed ${removed} previously materialized agent file(s) \u2014 agents are served as live briefs (sdd_get_agent_brief); opt back in with rules.materializeAgentFiles: true.`);
+    } else {
+      logger.info("Agent files: off (rules.materializeAgentFiles) \u2014 agents are served as live briefs (sdd_get_agent_brief); no agent files written.");
     }
   }
   if (options.dryRun) return;
@@ -48444,6 +49096,7 @@ async function generateLayer(options = {}) {
   try {
     reinjectLocalGuides(getProjectRoot(), activeTargetTypes(projectConfig));
     logger.verbose("Local AI guides re-injected.");
+    logger.info(`Guides, skills and context reconciled for: ${activeTargetTypes(projectConfig).join(", ") || "(no active targets)"}.`);
   } catch (err) {
     logger.warn(`Failed to re-inject AI guides: ${String(err)}`);
   }
@@ -48553,7 +49206,7 @@ function checkApproval(strict) {
       return {
         state: "stale",
         approved: false,
-        message: `The design, or something it was approved under (doctrine, declared inputs, \`composition\`, a direct member's approval), changed after it was approved (the approval on record is ${record2.lockedAt} by ${describeApprover(record2.lockedBy)}). Nothing says a human has seen what is about to merge. Fix: run \`wairon lock\` on this branch and commit the updated .wai/lock.json.`
+        message: `The design, or something it was approved under, changed after it was approved (the approval on record is ${record2.lockedAt} by ${describeApprover(record2.lockedBy)}). ${whatMoved(record2)} Nothing says a human has seen what is about to merge. Fix: run \`wairon lock\` on this branch and commit the updated .wai/lock.json.`
       };
     default:
       return {
@@ -48563,13 +49216,34 @@ function checkApproval(strict) {
       };
   }
 }
+function whatMoved(record2) {
+  const diff3 = diffAgainstApproval();
+  const own = diff3 ? diffSize(diff3) : null;
+  const members = familyApprovals(1).filter((a) => a.parent === "" && a.as !== "part");
+  const named2 = [];
+  for (const m of members) {
+    const name = m.alias ?? m.key;
+    if (m.pinned === "unpinned") named2.push(`${name} (added since the approval)`);
+    else if (m.pinned === "moved") named2.push(`${name} (its approval moved since this one was taken${m.state === "approved" ? "" : `; now ${m.state}`})`);
+    else if (m.state !== "approved") named2.push(`${name} (${m.state} at its own root)`);
+  }
+  const current2 = new Set(members.map((m) => m.alias ?? m.key));
+  for (const alias of Object.keys(record2.members ?? {})) {
+    if (!current2.has(alias)) named2.push(`${alias} (removed since the approval)`);
+  }
+  const parts = [];
+  if (own !== null && own > 0) parts.push(`${own} own spec file(s) changed since the approval`);
+  if (named2.length > 0) parts.push(`direct member(s): ${named2.join(", ")}`);
+  if (parts.length > 0) return `What moved: ${parts.join("; ")}.`;
+  return own === null ? "This approval predates per-spec digests, so which spec moved cannot be said." : "No own spec file and no direct member's approval moved, so what changed is the doctrine, a declared input or `composition`.";
+}
 function upgradedCheck(record2) {
   const diff3 = diffAgainstApproval();
   const specs = !diff3 ? "This approval predates per-spec digests, so whether a spec file moved since cannot be said." : diffSize(diff3) === 0 ? "No own spec file has changed since the approval." : `${diffSize(diff3)} own spec file(s) changed since the approval.`;
   return {
     state: "stale",
     approved: false,
-    message: `The approval on record (${record2.lockedAt} by ${describeApprover(record2.lockedBy)}) was taken under an earlier gate identity \u2014 the gate identity gained inputs in stage 5: members' composition subjects, \`composition\`; code conformance moved beside the claim. ${specs} Fix: re-lock once (\`wairon lock\`) and commit the updated .wai/lock.json.`
+    message: `The approval on record (${record2.lockedAt} by ${describeApprover(record2.lockedBy)}) was taken under an earlier gate identity (written by wairon ${record2.validatorVersion}). Since wairon 6.0.0 the gate identity also covers members' composition subjects and \`composition\`, and code conformance is recorded beside the claim. ${specs} Fix: re-lock once (\`wairon lock\`) and commit the updated .wai/lock.json.`
   };
 }
 var LockRefusedError = class extends WaironError {
@@ -48579,7 +49253,7 @@ var LockRefusedError = class extends WaironError {
   }
 };
 function describeMemberState(entry) {
-  return `${entry.alias ?? entry.key} (${entry.state}${entry.upgraded ? " \u2014 approved under the pre-stage-5 identity, re-lock it once" : ""})`;
+  return `${entry.alias ?? entry.key} (${entry.state}${entry.upgraded ? " \u2014 approved under an earlier gate identity, re-lock it once" : ""})`;
 }
 function codeLine(code) {
   if (!code) return "code: no code analysis recorded";
@@ -48588,9 +49262,14 @@ function codeLine(code) {
 function summarize3(gate, members) {
   const diff3 = diffAgainstApproval();
   if (!diff3) {
-    logger.info("First approval of this tree \u2014 the whole spec tree becomes the approved baseline.");
+    const previous = readLockRecord();
+    if (previous) {
+      logger.info(`Replacing the approval on record (${previous.lockedAt} by ${describeApprover(previous.lockedBy)}, wairon ${previous.validatorVersion ?? "unknown"}). It records no per-spec digests, so the whole spec tree becomes the approved baseline.`);
+    } else {
+      logger.info("First approval of this tree \u2014 the whole spec tree becomes the approved baseline.");
+    }
   } else if (diffSize(diff3) === 0) {
-    logger.info("Nothing has changed since the last approval \u2014 this will re-validate and regenerate the agent topology.");
+    logger.info("Nothing has changed since the last approval \u2014 this re-records the approval and refreshes the generated outputs of this project (guides, skills, and agent files when materialized).");
   } else {
     logger.info(`${diffSize(diff3)} spec(s) changed since the last approval:`);
     for (const p of diff3.changed) logger.info(`  ~ ${p}`);
@@ -48604,7 +49283,7 @@ function summarize3(gate, members) {
       continue;
     }
     const pin2 = m.pinned === "moved" ? " \u2014 its pin moved since the last approval" : "";
-    logger.info(`  member ${m.alias ?? m.key}: ${m.state}${m.upgraded ? " (pre-stage-5 lock, re-lock once)" : ""}${pin2}`);
+    logger.info(`  member ${m.alias ?? m.key}: ${m.state}${m.upgraded ? " (approved under an earlier gate identity, re-lock once)" : ""}${pin2}`);
   }
 }
 async function runLock(options, gate, captured) {
@@ -48618,7 +49297,7 @@ async function runLock(options, gate, captured) {
     );
   }
   logger.blank();
-  logger.warn("This records the current design as approved and (re)generates the agent topology.");
+  logger.warn("This records the current design as approved in .wai/lock.json (no spec file is rewritten) and refreshes the generated outputs of this project.");
   if (!options.yes) {
     if (!process.stdin.isTTY) {
       logger.error("Non-interactive shell \u2014 re-run with --yes to confirm the lock.");
@@ -48628,7 +49307,7 @@ async function runLock(options, gate, captured) {
       {
         type: "confirm",
         name: "confirmed",
-        message: "Approve this design and generate the agent topology?",
+        message: "Approve this design?",
         default: false
       }
     ]);
@@ -48652,7 +49331,7 @@ async function runLock(options, gate, captured) {
   const design = designOnly(gate);
   const count = (severity) => design.issues.filter((i) => i.severity === severity).length;
   const record2 = {
-    // The record format: 2 from stage 5 on (members, code, no children).
+    // The record format: 2 since wairon 6.0.0 (members, code, no children).
     format: 2,
     stateId: captured,
     lockedAt: (/* @__PURE__ */ new Date()).toISOString(),
@@ -48727,12 +49406,12 @@ function projectLabel(key, result) {
   const root = result.projects?.find((p) => p.key === "");
   return `${root?.id ?? "bound project"} (bound)`;
 }
-function renderSpecFindings(result) {
+function renderSpecFindings(result, all = false) {
   const tally = { errors: false, fatalWarnings: false, waived: 0, notices: 0 };
   if (result.issues.length === 0) {
     logger.success("Spec tree is valid and component type boundaries are enforced.");
   }
-  const MAX_PRINT = 100;
+  const MAX_PRINT = all ? Number.POSITIVE_INFINITY : 100;
   const printed = { error: 0, warning: 0, notice: 0 };
   const skipped = { error: 0, warning: 0, notice: 0 };
   for (const issue2 of result.issues) {
@@ -48752,10 +49431,11 @@ function renderSpecFindings(result) {
     else if (issue2.severity === "notice") logger.notice(line2);
     else logger.warn(line2);
   }
-  const more = (n, what) => `... and ${n} more ${what}(s) omitted. Use '--subsystem <id>' to validate a specific subsystem.`;
+  const more = (n, what) => `... and ${n} more ${what}(s) not shown (${printed[what]} of ${printed[what] + n} printed). Run with --all to print every finding.`;
   if (skipped.error > 0) logger.error(more(skipped.error, "error"));
   if (skipped.warning > 0) logger.warn(more(skipped.warning, "warning"));
   if (skipped.notice > 0) logger.notice(more(skipped.notice, "notice"));
+  if (skipped.error + skipped.warning + skipped.notice > 0 || all && result.issues.length > 100) renderCodeTotals(result);
   if (result.projects) {
     logger.blank();
     logger.info("Per project (each its own gate):");
@@ -48767,6 +49447,20 @@ function renderSpecFindings(result) {
   if (result.hint) logger.info(result.hint);
   return tally;
 }
+function renderCodeTotals(result) {
+  const counts = /* @__PURE__ */ new Map();
+  for (const issue2 of result.issues) {
+    const key = `${issue2.severity} ${issue2.code}`;
+    const entry = counts.get(key) ?? { severity: issue2.severity, code: issue2.code, n: 0 };
+    entry.n++;
+    counts.set(key, entry);
+  }
+  const rank = { error: 0, warning: 1, notice: 2 };
+  const rows = [...counts.values()].sort((a, b) => (rank[a.severity] ?? 3) - (rank[b.severity] ?? 3) || b.n - a.n || a.code.localeCompare(b.code));
+  logger.blank();
+  logger.info("Findings by code:");
+  for (const r of rows) logger.info(`  ${String(r.n).padStart(6)}  ${r.severity.padEnd(7)}  ${r.code}`);
+}
 async function runValidate(options = {}) {
   assertProjectInitialized();
   const projectConfig = loadProjectConfig();
@@ -48838,7 +49532,7 @@ async function runValidate(options = {}) {
     };
     const family = selectsFamily(sddOptions, declaredMembers(projectConfig).length > 0);
     const sddResult = family ? validateFamily2(sddOptions) : validateProject2(sddOptions);
-    const tally = renderSpecFindings(sddResult);
+    const tally = renderSpecFindings(sddResult, options.all === true);
     hasErrors ||= tally.errors;
     hasFatalWarnings ||= tally.fatalWarnings;
     waivedWarnings += tally.waived;
@@ -48946,6 +49640,9 @@ async function runStatus(options = {}) {
     logger.blank();
     if (lock.drifted) logger.warn(lock.text.trim());
     else logger.info(lock.text.trim());
+    logger.info(import_chalk4.default.gray(
+      "The percentages measure authoring readiness (each spec's draft/design/complete status), not approval: approval is the lock record above (.wai/lock.json), and `wairon lock` does not change any spec's status."
+    ));
   }
   logger.blank();
 }
@@ -49080,14 +49777,14 @@ var http = __toESM(require("http"));
 var https = __toESM(require("https"));
 init_defaults();
 function downloadFile(url, dest) {
-  return new Promise((resolve55, reject) => {
+  return new Promise((resolve56, reject) => {
     const file = fs31.createWriteStream(dest);
     const get4 = url.startsWith("https://") ? https.get : http.get;
     get4(url, { headers: { "User-Agent": `wairon/${WAIRON_VERSION}` }, agent: false }, (res) => {
       if (res.statusCode === 301 || res.statusCode === 302) {
         file.close();
         res.destroy();
-        downloadFile(res.headers.location, dest).then(resolve55).catch(reject);
+        downloadFile(res.headers.location, dest).then(resolve56).catch(reject);
         return;
       }
       if (res.statusCode !== 200) {
@@ -49099,7 +49796,7 @@ function downloadFile(url, dest) {
       res.pipe(file);
       file.on("finish", () => {
         res.destroy();
-        file.close(() => resolve55());
+        file.close(() => resolve56());
       });
       file.on("error", (err) => {
         res.destroy();
@@ -49593,7 +50290,12 @@ function writeBundle(root, resolved) {
   const dest = path52.join(root, ".wai", "packs", resolved.name, resolved.version);
   fs32.rmSync(dest, { recursive: true, force: true });
   fs32.mkdirSync(path52.dirname(dest), { recursive: true });
-  fs32.cpSync(resolved.path, dest, { recursive: true });
+  if (fs32.statSync(resolved.path).isFile()) {
+    fs32.mkdirSync(dest, { recursive: true });
+    fs32.copyFileSync(resolved.path, path52.join(dest, `pack${path52.extname(resolved.path).toLowerCase()}`));
+  } else {
+    fs32.cpSync(resolved.path, dest, { recursive: true });
+  }
   return dest;
 }
 function bundlePack(name, options = {}) {
@@ -50375,7 +51077,7 @@ async function runLock2(options) {
       }
     }
     if (skippedErrors > 0) {
-      logger.error(`... and ${skippedErrors} more error(s) omitted.`);
+      logger.error(`... and ${skippedErrors} more error(s) not shown (${errorCount} of ${errors.length} printed). Run \`wairon validate --all\` to see every finding (it judges draft specs leniently; the lock judges them as complete).`);
     }
     logger.blank();
     logger.info("Fix the errors above, then run `wairon lock` again. Nothing was changed.");
@@ -50427,7 +51129,7 @@ async function validateCommand(opts) {
   for (const t of recover3(getProjectRoot(), false)) {
     logger.notice(`[TRANSACTION_PENDING] an unfinished family migration (${t.verb}, transaction ${t.id}, coordinator phase ${t.phase}) \u2014 run \`wairon doctor --fix\` to roll it back`);
   }
-  await runValidate({ ci: opts.ci, subsystem: opts.subsystem, recursive: opts.recursive, family: opts.family });
+  await runValidate({ ci: opts.ci, subsystem: opts.subsystem, recursive: opts.recursive, family: opts.family, all: opts.all });
 }
 async function statusCommand(opts) {
   const target = resolveTarget(getProjectRoot(), {});
@@ -50874,6 +51576,10 @@ var SCREENFUL = 20;
 function shownDir(dir) {
   return nodePath3.relative(process.cwd(), dir) || ".";
 }
+function relockLabel(dir) {
+  const shown2 = shownDir(dir);
+  return shown2 === "." ? "this project (.)" : shown2;
+}
 function printPlan(planned) {
   logger.header(`wairon family migration: ${planned.request.verb}`);
   logger.info(`Family root: ${shownDir(planned.familyRoot)}${planned.whole ? "" : " (not the whole family: the reach stops below its top)"}`);
@@ -50884,7 +51590,7 @@ function printPlan(planned) {
   for (const r of planned.refusals) logger.error(`[${r.code}]${r.project ? ` ${ownerLabel(r.project)}:` : ""} ${r.detail}`);
   for (const note of planned.notes) logger.warn(`NOTE: ${note}`);
   printFiles(planned);
-  if (planned.relock.length > 0) logger.info(`To re-lock once applied: ${planned.relock.map(shownDir).join(", ")}`);
+  if (planned.relock.length > 0) logger.info(`To re-lock once applied: ${planned.relock.map(relockLabel).join(", ")}`);
 }
 function printFiles(planned) {
   if (planned.changes.length === 0) return;
@@ -50913,7 +51619,7 @@ function printOutcome(report4) {
   const verb = report4.plan.request.verb;
   if (report4.applied) {
     logger.success(`Applied the ${verb} migration: ${report4.plan.changes.length} file(s) across ${new Set(report4.plan.changes.map((c) => c.project)).size} project(s).`);
-    for (const dir of report4.relock) logger.info(`Re-lock ${shownDir(dir)}: run \`wairon lock\` there.`);
+    for (const dir of report4.relock) logger.info(`Re-lock ${relockLabel(dir)}: run \`wairon lock\` ${shownDir(dir) === "." ? "here" : "there"}.`);
     return;
   }
   process.exitCode = 1;
@@ -50980,9 +51686,14 @@ async function runInit(options = {}) {
   const ancestorRoot = findSystemRoot(cwd);
   if (ancestorRoot && path58.resolve(ancestorRoot) === path58.resolve(cwd)) {
     logger.info("Project already initialized.");
-    logger.info("Design your spec tree with the SDD architect skill, then run `wairon generate`.");
+    logger.info("Design your spec tree with the SDD architect skill, validate it, then run `wairon lock` to approve it.");
     return;
   }
+  if (!options.yes && !process.stdin.isTTY) {
+    throw new WaironError(
+      "Non-interactive shell: `wairon init` asks questions and there is no terminal to ask them on. Re-run with --yes (-y) to use the defaults (project name from the directory, profile backend, targets claude and agy). Nothing was written."
+    );
+  }
   if (ancestorRoot) {
     await runInitAsMember(ancestorRoot, cwd, options);
     return;
@@ -51251,13 +51962,17 @@ async function executeInit(projectName, projectConfig, guidePlan) {
       logger.warn(`Failed to automatically register MCP server for Claude: ${err}`);
     }
   }
-  if (targetTypes.includes("gemini") || targetTypes.includes("agy")) {
+  if (targetTypes.includes("gemini")) {
     try {
       const { runMcpInstall: runMcpInstall2 } = (init_mcp(), __toCommonJS(mcp_exports));
       runMcpInstall2({ backend: "gemini", global: false });
     } catch (err) {
-      logger.warn(`Failed to automatically register MCP server for Antigravity: ${err}`);
+      logger.warn(`Failed to automatically register MCP server for the Gemini CLI: ${err}`);
     }
+  } else if (targetTypes.includes("agy")) {
+    logger.info(
+      `Antigravity (agy) reads MCP servers only from its machine-wide ~/.gemini/antigravity-cli/mcp_config.json, which init does not write. To give it the wairon tools: ${import_chalk11.default.bold("wairon mcp install --backend gemini --global")}`
+    );
   }
   syncContextFiles();
   logger.verbose("Context files seeded in .wai/context/");
@@ -51281,9 +51996,10 @@ async function executeInit(projectName, projectConfig, guidePlan) {
   logger.blank();
   logger.info("Next steps:");
   logger.info("  Edit .wai/context/project.md \u2014 describe the project concept and stack details for the AI");
-  logger.info("  wairon status               \u2014 view the architecture completeness dashboard");
-  logger.info("  wairon validate             \u2014 check the spec tree & component boundaries");
   logger.info("  Design your spec tree with the SDD architect skill or the wairon MCP sdd_* tools");
+  logger.info("  wairon status               \u2014 view the spec tree, its authoring readiness and approval state");
+  logger.info("  wairon validate             \u2014 check the spec tree & component boundaries");
+  logger.info("  wairon lock                 \u2014 approve the validated design (commit .wai/lock.json); `wairon lock-check` gates CI on it");
   logger.blank();
 }
 function buildProjectConfig(name, targets, now, projectType) {
@@ -51366,11 +52082,13 @@ Define the non-negotiable architectural guardrails here. The AI agent must follo
 
 *   [ ] **Primary Language & Runtime:** Node.js (TypeScript) / Python / etc.
 *   [ ] **Architectural Style:** Clean Architecture / Hexagonal / Domain-Driven Design (DDD).
-*   [ ] **Data Persistence Rules:** E.g. No raw SQL in controllers; all DB operations must use a \`Store\` / \`Repository\`.
-*   [ ] **Stereotype Dependencies:**
-    *   \`Store\` components can only call other \`Stores\` or \`Registries\`.
-    *   \`Adapter\` components cannot depend on \`Orchestrators\` or \`Stores\` directly.
-    *   Only \`Portal\` components can accept external traffic.
+*   [ ] **Data Persistence Rules:** E.g. No raw SQL in controllers; held state lives in a data component \u2014 the recommended \`Repository\` (owning its \`Store\`, \`Registry\`, \`Index\`es and \`Query\`s), or a deliberately standalone \`Store\` for genuinely simple state.
+*   [ ] **Stereotype Dependencies** (enforced by \`sdd_validate_tree\`):
+    *   Only \`Portal\` components accept external traffic; a gateway is a \`Portal\` with the \`gateway\` variant.
+    *   A \`Portal\` never depends on a \`Store\`, \`Registry\` or \`Adapter\`. Its reads may go through a \`Repository\` / \`Index\` facade; every write routes through an \`Orchestrator\`.
+    *   State never lives as fields inside an \`Orchestrator\`; logic is an \`Orchestrator\` (\`dependencyClass: pure | read\` bounds what it may depend on).
+    *   A \`Registry\` and an \`Index\` depend on the \`Store\` they read; a \`Store\` may use an \`Adapter\` as its backend.
+    *   Outbound calls to third parties go through an \`Adapter\`.
 
 ---
 
@@ -51383,15 +52101,16 @@ Define the non-negotiable architectural guardrails here. The AI agent must follo
 
 ---
 
-## Stage 3: Ingress/Egress Portals (Level 2 & Level 3)
+## Stage 3: Ingress Portals & Outbound Adapters (Level 2 & Level 3)
 
-Portals are the boundaries of your subsystems. Define how requests enter and leave.
+Portals are where requests enter a subsystem; Adapters are where calls leave it.
 
 *   [ ] **Define Ingress Portals (REST / gRPC / MessageBus):**
     *   *AI Action:* Create L2 Portal components with \`status: draft\` and map their L3 interfaces.
-    *   *Design check:* Ensure HTTP endpoints (method, path) or gRPC names are correctly declared in the method bindings.
-*   [ ] **Define Egress Portals (Clients / Publishers):**
-    *   *AI Action:* Declare any external event publishing or client communication Portals.
+    *   *Design check:* Bind each method's wire endpoint with \`sdd_set_endpoints\`, and give every HTTP Portal its \`mounts\` (or a listener) \u2014 otherwise \`UNMOUNTED_PORTAL\`.
+    *   *Design check:* A subsystem another subsystem calls lists those callers in its \`publicInterfaces[].consumers\`.
+*   [ ] **Define Outbound Adapters (third-party clients / publishers):**
+    *   *AI Action:* Declare an \`Adapter\` for each external API, database driver or event publisher the subsystem calls.
 
 ---
 
@@ -51416,13 +52135,13 @@ Map the behavior step-by-step.
 
 ---
 
-## Stage 6: Sandbox Implementation
+## Stage 6: Approval & Implementation
 
-Once the specs are clean and compiled, mark the components as \`status: complete\` to lock them, then generate the agents and write code!
+Once the specs validate cleanly, the human approves the design with \`wairon lock\`; implementation starts from the approved design.
 
 *   [ ] **Validation Check (AI):** Call the \`sdd_validate_tree\` MCP tool (must return 0 errors).
-*   [ ] **Agent Generation (human):** The developer runs \`wairon generate\` from their terminal to instantiate agent sandboxes \u2014 the AI does not run this.
-*   [ ] **Code Implementation:** Let the agent implement the component code matching the narrative.
+*   [ ] **Approval (human):** The developer runs \`wairon lock\` from their terminal and commits \`.wai/lock.json\` \u2014 the AI does not run this. The lock records the approval; it does not rewrite spec files or their \`status\`. \`wairon lock-check\` gates merges on it in CI.
+*   [ ] **Code Implementation (AI):** Confirm \`sdd_get_status\` reports the design approved, then delegate each component via the \`sdd-delegate\` skill (live briefs from \`sdd_get_agent_brief\`); code must match the L3 interfaces and L5 narratives.
 `;
   writeFile(fromProjectRoot(".wai", "phased_design.md"), content);
 }
@@ -51723,7 +52442,7 @@ function releaseChannelLabel(tag) {
   return version.slice(dash + 1).replace(/\.\d+$/, "") || "stable";
 }
 function fetchReleases(repo) {
-  return new Promise((resolve55, reject) => {
+  return new Promise((resolve56, reject) => {
     const url = `https://api.github.com/repos/${repo}/releases?per_page=100`;
     const options = {
       headers: {
@@ -51743,7 +52462,7 @@ function fetchReleases(repo) {
           return;
         }
         try {
-          resolve55(JSON.parse(data));
+          resolve56(JSON.parse(data));
         } catch {
           reject(new Error("Failed to parse GitHub API response"));
         }
@@ -51915,7 +52634,7 @@ async function filteredCheckbox(config) {
     32,
     Math.max(...items.map((i) => i.label.length))
   );
-  return new Promise((resolve55) => {
+  return new Promise((resolve56) => {
     const checked = /* @__PURE__ */ new Set();
     let cursor = 0;
     let filterIdx = 0;
@@ -51982,7 +52701,7 @@ async function filteredCheckbox(config) {
       );
       teardown();
       const result = items.filter((_, idx) => checked.has(idx)).map((i) => i.value);
-      resolve55(result);
+      resolve56(result);
     }
     function abort() {
       process.stdout.write("\n");
@@ -52446,7 +53165,7 @@ function mcpEntryHealth(settingsPath) {
   if (!entry) return { mark: "warn", note: "not registered" };
   if (entry.command === "node" && Array.isArray(entry.args) && typeof entry.args[0] === "string") {
     const scriptPath = entry.args[0];
-    if (!fs38.existsSync(scriptPath)) {
+    if (!fs38.existsSync(path61.resolve(getProjectRoot(), scriptPath))) {
       return { mark: "error", note: `registered but the server path is missing \u2014 ${scriptPath}` };
     }
   }
@@ -52512,15 +53231,26 @@ async function runDoctor(options = {}) {
     try {
       const cfg = loadProjectConfig();
       if (!cfg) throw new ProjectNotInitializedError();
-      const result = validateProject2({ rules: cfg.rules, projectType: cfg.projectType });
-      const errs = result.issues.filter((i) => i.severity === "error").length;
-      const warns = result.issues.filter((i) => i.severity === "warning").length;
-      const notes = result.issues.filter((i) => i.severity === "notice").length;
+      const result = validateFamily2({ rules: cfg.rules, projectType: cfg.projectType });
+      const counts = severityCounts(result.issues);
+      const { errs, warns, notes } = counts;
       const noted = notes > 0 ? `, ${notes} notice(s)` : "";
       if (errs > 0) line(tally, "error", `Conformance: ${errs} error(s), ${warns} warning(s)${noted} \u2014 see \`wairon validate\` (you: \`sdd_validate_tree\`)`);
       else if (warns > 0) line(tally, "warn", `Conformance: ${warns} warning(s)${noted} \u2014 see \`wairon validate\` (you: \`sdd_validate_tree\`)`);
       else if (notes > 0) line(tally, "ok", `Conformance: 0 errors, 0 warnings, ${notes} notice(s) \u2014 see \`wairon validate\` (you: \`sdd_validate_tree\`)`);
       else line(tally, "ok", "Conformance: 0 errors, 0 warnings");
+      const byProject = /* @__PURE__ */ new Map();
+      for (const issue2 of result.issues) {
+        const key = issue2.project ?? "";
+        byProject.set(key, [...byProject.get(key) ?? [], issue2]);
+      }
+      if (byProject.size > 1 || byProject.size === 1 && !byProject.has("")) {
+        for (const [key, issues] of [...byProject].sort(([a], [b]) => a.localeCompare(b))) {
+          const own = severityCounts(issues);
+          if (own.errs === 0 && own.warns === 0 && own.notes === 0) continue;
+          console.log(`      ${key === "" ? "this project" : `member ${key}`}: ${own.errs} error(s), ${own.warns} warning(s), ${own.notes} notice(s)`);
+        }
+      }
     } catch (e) {
       line(tally, "warn", `Could not run conformance check: ${e instanceof Error ? e.message : String(e)}`);
     }
@@ -52590,6 +53320,11 @@ async function runDoctor(options = {}) {
           line(tally, "warn", `${proposal.kind} ${proposal.specId} ${proposal.path}: "${proposal.written}" \u2192 ${proposal.stored} (proposed)`);
         }
       }
+      const enumProposals = spellings.flatMap((repair) => repair.enumProposals);
+      if (enumProposals.length > 0) {
+        console.log(`  ${import_chalk17.default.gray("enum proposed \u2014 never written: define the enum, then write its id here")}`);
+        for (const proposal of enumProposals) line(tally, "warn", describeEnumProposal(proposal));
+      }
       if (authorNeeded.length > 0) {
         console.log(`  ${import_chalk17.default.gray("needs an author \u2014 no rewrite can settle these")}`);
         for (const problem of authorNeeded) {
@@ -52600,6 +53335,11 @@ async function runDoctor(options = {}) {
     } catch (e) {
       line(tally, "warn", `Could not plan the type-spelling repair: ${e instanceof Error ? e.message : String(e)}`);
     }
+    try {
+      reportMemberRepairs(tally);
+    } catch (e) {
+      line(tally, "warn", `Could not plan the members' repairs: ${e instanceof Error ? e.message : String(e)}`);
+    }
     try {
       const planned = plan5({ verb: "chaining", rehearse: false });
       const pending4 = planned.chaining;
@@ -52668,7 +53408,7 @@ async function runDoctor(options = {}) {
         line(
           tally,
           "warn",
-          `stale \u2014 the lock of ${lock.record.lockedAt} was taken under an earlier gate identity: the gate identity gained inputs in stage 5 (members' composition subjects, \`composition\`; code conformance moved beside the claim). Re-lock once (\`wairon lock\`).`
+          `stale \u2014 the lock of ${lock.record.lockedAt} was taken under an earlier gate identity: the gate identity gained inputs in this release (members' composition subjects, \`composition\`; code conformance moved beside the claim). Re-lock once (\`wairon lock\`).`
         );
       } else if (lock.state === "stale") {
         console.log(import_chalk17.default.bold("Lock"));
@@ -52733,9 +53473,13 @@ async function runDoctor(options = {}) {
     line(tally, h.mark, `Claude (project .mcp.json): ${h.note}${h.mark === "ok" ? "" : " \u2014 run `wairon mcp install --backend claude`"}`);
   }
   if (wantGemini) {
-    const globalCfg = path61.join(os13.homedir(), ".gemini", "antigravity-cli", "mcp_config.json");
-    const hg = mcpEntryHealth(globalCfg);
-    line(tally, hg.mark, `Antigravity (global mcp_config.json): ${hg.note}${hg.mark === "ok" ? "" : " \u2014 run `wairon mcp install --backend gemini --global`"}`);
+    const agyHome = path61.join(os13.homedir(), ".gemini", "antigravity-cli");
+    if (!fs38.existsSync(agyHome)) {
+      line(tally, "ok", `Antigravity: not installed on this machine (no ${agyHome}) \u2014 nothing to register. Once it is: \`wairon mcp install --backend gemini --global\``);
+    } else {
+      const hg = mcpEntryHealth(path61.join(agyHome, "mcp_config.json"));
+      line(tally, hg.mark, `Antigravity (global mcp_config.json): ${hg.note}${hg.mark === "ok" ? "" : " \u2014 run `wairon mcp install --backend gemini --global`"}`);
+    }
     const projPath = fromProjectRoot(".gemini", "settings.json");
     if (fs38.existsSync(projPath)) {
       const hp = mcpEntryHealth(projPath);
@@ -52771,14 +53515,7 @@ async function applyFixes(options, tally) {
   } catch (e) {
     console.log(`  ${icon("error")} Regeneration failed: ${e instanceof Error ? e.message : String(e)}`);
   }
-  try {
-    const pinned = pinInstalledPacksAsSelections();
-    if (pinned.length > 0) {
-      console.log(`  ${icon("ok")} Recorded ${pinned.length} installed pack(s) as explicit selections: ${pinned.join(", ")}.`);
-    }
-  } catch (e) {
-    console.log(`  ${icon("error")} Could not record pack selections: ${e instanceof Error ? e.message : String(e)}`);
-  }
+  pinPackSelections("");
   try {
     const legacySpecs = findLegacySpecFiles();
     if (legacySpecs.length > 0) {
@@ -52798,63 +53535,157 @@ async function applyFixes(options, tally) {
   } catch (e) {
     console.log(`  ${icon("error")} Chained-subproject backfill failed: ${e instanceof Error ? e.message : String(e)}`);
   }
+  repairProjectSpecs("");
+  await migrateChaining(options, tally);
+  repairMembers();
+  await repairMcpRegistration(options, targets);
+  logger.blank();
+}
+function whoPrefix(who) {
+  return who === "" ? "" : `[${who}] `;
+}
+function severityCounts(issues) {
+  return {
+    errs: issues.filter((i) => i.severity === "error").length,
+    warns: issues.filter((i) => i.severity === "warning").length,
+    notes: issues.filter((i) => i.severity === "notice").length
+  };
+}
+function describeEnumProposal(p) {
+  return `${p.kind} ${p.specId} ${p.path}: "${p.written}" \u2192 enum ${p.enumId} (${p.values.join(", ")}), written as ${p.enumId}${p.optional ? "?" : ""} (proposed)`;
+}
+function pinPackSelections(who) {
+  try {
+    const pinned = pinInstalledPacksAsSelections();
+    if (pinned.length === 0) return;
+    console.log(`  ${icon("ok")} ${whoPrefix(who)}Recorded ${pinned.length} installed pack(s) as explicit selections: ${pinned.join(", ")}.`);
+    const pinnedNames = new Set(pinned.map((label7) => label7.replace(/@[^@]*$/, "")));
+    const unobtainable = (loadProjectConfig()?.extensions?.packs ?? []).filter((e) => typeof e !== "string").filter((e) => pinnedNames.has(e.name) && !e.source && !e.bundle).map((e) => e.name);
+    if (unobtainable.length > 0) {
+      console.log(`  ${icon("warn")} ${whoPrefix(who)}${unobtainable.length} of them record no fetchable source (installed from a local path), so CI and a fresh clone cannot obtain them: ${unobtainable.join(", ")}. Run \`wairon pack bundle --all\` to commit a copy the repository carries, or \`wairon pack use <name> --source <url>\` to record where \`wairon pack sync\` fetches each.`);
+    }
+  } catch (e) {
+    console.log(`  ${icon("error")} ${whoPrefix(who)}Could not record pack selections: ${e instanceof Error ? e.message : String(e)}`);
+  }
+}
+function repairProjectSpecs(who) {
+  const at = whoPrefix(who);
   try {
     const retirement = retireSpecialists(true);
     if (retirement.retyped.length > 0) {
-      console.log(`  ${icon("ok")} Retired ${retirement.retyped.length} Specialist(s) to Orchestrator.`);
+      console.log(`  ${icon("ok")} ${at}Retired ${retirement.retyped.length} Specialist(s) to Orchestrator.`);
     }
     if (retirement.rebasedVariants.length > 0) {
-      console.log(`  ${icon("ok")} Rebased ${retirement.rebasedVariants.length} variant(s) from Specialist to Orchestrator: ${retirement.rebasedVariants.join(", ")}.`);
+      console.log(`  ${icon("ok")} ${at}Rebased ${retirement.rebasedVariants.length} variant(s) from Specialist to Orchestrator: ${retirement.rebasedVariants.join(", ")}.`);
     }
   } catch (e) {
-    console.log(`  ${icon("error")} Specialist retirement failed: ${e instanceof Error ? e.message : String(e)}`);
+    console.log(`  ${icon("error")} ${at}Specialist retirement failed: ${e instanceof Error ? e.message : String(e)}`);
   }
   try {
     const repairs = repairForeignStepFields(true);
     if (repairs.length > 0) {
-      console.log(`  ${icon("ok")} Dropped foreign fields from ${repairs.length} narrative step(s):`);
+      console.log(`  ${icon("ok")} ${at}Dropped foreign fields from ${repairs.length} narrative step(s):`);
       for (const repair of repairs) {
         console.log(`      ${repair.implementation}.${repair.method} step ${repair.stepNumber} (${repair.stepType}): ${repair.fields.join(", ")}`);
       }
     }
   } catch (e) {
-    console.log(`  ${icon("error")} Narrative-step repair failed: ${e instanceof Error ? e.message : String(e)}`);
+    console.log(`  ${icon("error")} ${at}Narrative-step repair failed: ${e instanceof Error ? e.message : String(e)}`);
   }
   try {
     const signatures = repairSignatures(true);
     if (signatures.length > 0) {
-      console.log(`  ${icon("ok")} Rewrote ${signatures.length} spec(s) into their stored signature form:`);
+      console.log(`  ${icon("ok")} ${at}Rewrote ${signatures.length} spec(s) into their stored signature form:`);
       for (const repair of signatures) {
         console.log(`      ${repair.kind} ${repair.specId}: ${describeSignatureRepair(repair)}`);
       }
     }
   } catch (e) {
-    console.log(`  ${icon("error")} Signature repair failed: ${e instanceof Error ? e.message : String(e)}`);
+    console.log(`  ${icon("error")} ${at}Signature repair failed: ${e instanceof Error ? e.message : String(e)}`);
   }
   try {
     const spellings = repairTypeSpellings(true);
     const rewritten = spellings.filter((repair) => repair.rewritten.length > 0);
     if (rewritten.length > 0) {
       const positions = rewritten.reduce((n, repair) => n + repair.rewritten.length, 0);
-      console.log(`  ${icon("ok")} Rewrote ${positions} type position(s) in ${rewritten.length} spec(s) into their canonical spelling.`);
+      console.log(`  ${icon("ok")} ${at}Rewrote ${positions} type position(s) in ${rewritten.length} spec(s) into their canonical spelling.`);
     }
     const proposals = spellings.flatMap((repair) => repair.proposals);
     if (proposals.length > 0) {
-      console.log(`  ${icon("warn")} ${proposals.length} number position(s) with int proposed \u2014 not written; confirm by writing int, or write float:`);
+      console.log(`  ${icon("warn")} ${at}${proposals.length} number position(s) with int proposed \u2014 not written; confirm by writing int, or write float:`);
       for (const proposal of proposals) console.log(`      ${proposal.kind} ${proposal.specId} ${proposal.path}: "${proposal.written}" \u2192 ${proposal.stored} (proposed)`);
     }
+    const enumProposals = spellings.flatMap((repair) => repair.enumProposals);
+    if (enumProposals.length > 0) {
+      console.log(`  ${icon("warn")} ${at}${enumProposals.length} string-literal union(s) with an enum proposed \u2014 not written; define the enum (sdd_add_type kind enum), then write its id:`);
+      for (const proposal of enumProposals) console.log(`      ${describeEnumProposal(proposal)}`);
+    }
     const authorNeeded = spellings.flatMap((repair) => repair.authorNeeded);
     if (authorNeeded.length > 0) {
-      console.log(`  ${icon("warn")} ${authorNeeded.length} type position(s) need an author \u2014 no rewrite can settle them:`);
+      console.log(`  ${icon("warn")} ${at}${authorNeeded.length} type position(s) need an author \u2014 no rewrite can settle them:`);
       for (const problem of authorNeeded) {
         console.log(`      ${problem.kind} ${problem.specId} ${problem.path ?? ""}: "${problem.written}" \u2014 ${problem.replacement ? `write ${problem.replacement}` : problem.detail}`);
       }
     }
   } catch (e) {
-    console.log(`  ${icon("error")} Type-spelling repair failed: ${e instanceof Error ? e.message : String(e)}`);
+    console.log(`  ${icon("error")} ${at}Type-spelling repair failed: ${e instanceof Error ? e.message : String(e)}`);
   }
-  await migrateChaining(options, tally);
-  await repairMcpRegistration(options, targets);
+}
+function memberProjects() {
+  const root = getProjectRoot();
+  return graph().nodes.filter((node) => node.namespace !== "" && node.directory && pathExists(node.directory)).map((node) => ({ alias: node.mountAlias ?? node.namespace, directory: node.directory, inside: !isOutsideRoot(root, node.directory) }));
+}
+function repairMembers() {
+  let members;
+  try {
+    members = memberProjects();
+  } catch (e) {
+    console.log(`  ${icon("error")} Could not read the family's members: ${e instanceof Error ? e.message : String(e)}`);
+    return;
+  }
+  for (const member of members) {
+    if (!member.inside) {
+      console.log(`  ${icon("warn")} [${member.alias}] lies outside this project (${member.directory}): run \`wairon doctor --fix\` there to upgrade it.`);
+      continue;
+    }
+    runWithProjectRoot(member.directory, () => {
+      if (!projectConfigExists()) return;
+      pinPackSelections(member.alias);
+      repairProjectSpecs(member.alias);
+    });
+  }
+}
+function reportMemberRepairs(tally) {
+  const pending4 = [];
+  for (const member of memberProjects()) {
+    const counts = runWithProjectRoot(member.directory, () => {
+      if (!projectConfigExists()) return null;
+      const spellings = repairTypeSpellings(false);
+      return {
+        specialists: retireSpecialists(false).retyped.length,
+        stepFields: repairForeignStepFields(false).length,
+        signatures: repairSignatures(false).length,
+        respell: spellings.reduce((n, r) => n + r.rewritten.length, 0),
+        proposals: spellings.reduce((n, r) => n + r.proposals.length + r.enumProposals.length, 0),
+        authorNeeded: spellings.reduce((n, r) => n + r.authorNeeded.length, 0)
+      };
+    });
+    if (!counts) continue;
+    const parts = [
+      counts.specialists ? `${counts.specialists} Specialist(s)` : "",
+      counts.stepFields ? `${counts.stepFields} step(s) with foreign fields` : "",
+      counts.signatures ? `${counts.signatures} spec(s) with stale signatures` : "",
+      counts.respell ? `${counts.respell} type position(s) to respell` : "",
+      counts.proposals ? `${counts.proposals} proposal(s)` : "",
+      counts.authorNeeded ? `${counts.authorNeeded} position(s) needing an author` : ""
+    ].filter(Boolean);
+    if (parts.length === 0) continue;
+    const where = member.inside ? "`wairon doctor --fix` here cascades into it" : `run \`wairon doctor --fix\` in ${member.directory}`;
+    pending4.push(`member ${member.alias}: ${parts.join(", ")} \u2014 ${where}`);
+  }
+  if (pending4.length === 0) return;
+  console.log(import_chalk17.default.bold("Members"));
+  for (const text3 of pending4) line(tally, "warn", text3);
   logger.blank();
 }
 async function repairMcpRegistration(options, targets) {
@@ -52949,11 +53780,11 @@ function reportLabel(key) {
   return key === "" ? "(this project)" : key;
 }
 function printUpgradeReport(report4) {
-  console.log(import_chalk17.default.bold("Composed validation: what stage 4 changed"));
+  console.log(import_chalk17.default.bold("Composed validation: what it changed since each lock"));
   console.log(import_chalk17.default.gray("  A lock records totals only (errors, warnings, notices) and the validator version that took it \u2014 nothing per code \u2014 so this is not a per-code diff. Today's findings are classed by a reason computed now."));
   for (const p of report4.projects) {
     const locked = p.lockedTotals ? `locked by v${p.lockedBy}: ${p.lockedTotals}` : "never locked";
-    const attribution = p.lockedTotals ? p.predatesStage4 ? " \u2014 the lock predates stage 4, so a difference is the upgrade's" : " \u2014 the lock was taken by a stage-4 validator, so a difference is not the upgrade's" : "";
+    const attribution = p.lockedTotals ? p.predatesStage4 ? " \u2014 the lock predates composed validation, so a difference is the upgrade's" : " \u2014 the lock was taken under composed validation, so a difference is not the upgrade's" : "";
     console.log(`  ${reportLabel(p.key)}: ${locked}; today (as-complete): ${p.currentTotals}${attribution}`);
   }
   const byCode = /* @__PURE__ */ new Map();
@@ -52962,12 +53793,12 @@ function printUpgradeReport(report4) {
     console.log(`  ${import_chalk17.default.bold(code)} (${entries.length})`);
     for (const e of entries) {
       const where = `${reportLabel(e.project)}${e.specId ? ` ${e.specId}` : ""}`;
-      const reason = e.reason === "escalated" ? "escalated: a stage-2 notice that is an error since stage 4" : e.reason === "pinned" ? "pinned: judged against the project's own pin, no longer through the parent's live tree" : `positional: the family's top matches it${e.resolvedAs ? ` to ${e.resolvedAs}` : ""} by position, which is how it passed before${e.rewrite ? ` \u2014 the migration writes ${e.rewrite}` : ""}`;
+      const reason = e.reason === "escalated" ? "escalated: once a notice, an error under composed validation" : e.reason === "pinned" ? "pinned: judged against the project's own pin, no longer through the parent's live tree" : `positional: the family's top matches it${e.resolvedAs ? ` to ${e.resolvedAs}` : ""} by position, which is how it passed before${e.rewrite ? ` \u2014 the migration writes ${e.rewrite}` : ""}`;
       console.log(`    ${e.severity} ${where}: ${reason}`);
     }
   }
-  if (report4.entries.length === 0) console.log("  No finding is new for a reason stage 4 introduced.");
-  console.log(`  ${report4.unclassified} finding(s) could not be attributed to stage 4.`);
+  if (report4.entries.length === 0) console.log("  No finding is new for a reason composed validation introduced.");
+  console.log(`  ${report4.unclassified} finding(s) could not be attributed to composed validation.`);
   if (report4.unmatched.length > 0) {
     console.log(`  ${import_chalk17.default.bold("Positional matches no rule decides")} (${report4.unmatched.length}) \u2014 counted above; a person picks:`);
     for (const m of report4.unmatched) {
@@ -53131,7 +53962,7 @@ function printProjectMigration(p) {
     console.log(`    will be removed from its stored L0 by the first write (the schema does not know them): ${p.droppedKeys.join("; ")}`);
   }
   for (const x of p.externals) {
-    const why = x.reason === "legacy-pin" ? "replaces the stage-1 family pin of" : "its references cross into";
+    const why = x.reason === "legacy-pin" ? "replaces the legacy family pin of" : "its references cross into";
     console.log(`    external: ${x.alias}: {} \u2014 ${why} ${projectLabel2(x.producer)}`);
   }
   for (const i of p.imports) {
@@ -53147,10 +53978,10 @@ function printProjectMigration(p) {
     if (m.retired.length > 0) console.log(`      retires with the mount: ${m.retired.join("; ")}`);
   }
   if (p.supersededPins.length > 0) {
-    console.log(`    superseded family pins: ${p.supersededPins.length} \u2014 deleted once the externals that replace them are pinned; nothing reads them since stage 3`);
+    console.log(`    superseded family pins: ${p.supersededPins.length} \u2014 deleted once the externals that replace them are pinned; nothing reads them any more`);
   }
   for (const alias of p.locations) {
-    console.log(`    member: ${alias}: the deprecated long-form \`path\` rewritten to \`source\` (stage 8) \u2014 its meaning unchanged`);
+    console.log(`    member: ${alias}: the deprecated long-form \`path\` rewritten to \`source\` \u2014 its meaning unchanged`);
   }
 }
 function describeEntry(e) {
@@ -53220,13 +54051,13 @@ function writeArtifact(dest, content) {
   fs39.writeFileSync(dest, content, "utf-8");
 }
 function parseSequenceRef(ref) {
-  const sep18 = ref.includes(":") ? ref.lastIndexOf(":") : ref.lastIndexOf(".");
-  if (sep18 <= 0 || sep18 === ref.length - 1) {
+  const sep19 = ref.includes(":") ? ref.lastIndexOf(":") : ref.lastIndexOf(".");
+  if (sep19 <= 0 || sep19 === ref.length - 1) {
     throw new WaironError(
       `Invalid --sequence reference "${ref}". Use <componentId>:<methodName> (e.g. billing-portal:authorize).`
     );
   }
-  return { component: ref.slice(0, sep18), method: ref.slice(sep18 + 1) };
+  return { component: ref.slice(0, sep19), method: ref.slice(sep19 + 1) };
 }
 function canvasRelations(options) {
   if (options.health === false) return void 0;
@@ -53378,8 +54209,8 @@ function withoutRoot(record2) {
   return rest;
 }
 function normalizeMemberPath(p) {
-  const posix6 = path64.posix.normalize(p.replace(/\\/g, "/"));
-  return posix6.replace(/^\.\/+/, "").replace(/\/+$/, "");
+  const posix8 = path64.posix.normalize(p.replace(/\\/g, "/"));
+  return posix8.replace(/^\.\/+/, "").replace(/\/+$/, "");
 }
 function projectRoot(dataDir, id) {
   return path64.join(dataDir, "projects", id);
@@ -57084,12 +57915,13 @@ function mintKey(cfg, credential, project2, role) {
       "instance-wide super-admin (*:*) keys cannot be minted \u2014 the built-in admin account (WAIRON_ADMIN_USER) is the only super-admin"
     );
   }
+  const narrowed2 = assertMintableNarrowingEntry(cfg.dataDir, project2);
   const token = "wk_" + crypto17.randomBytes(24).toString("hex");
   const record2 = {
     id: crypto17.randomBytes(6).toString("hex"),
     keyHash: hashToken(token),
     role,
-    projects: project2 === "*" ? ["*"] : [project2],
+    projects: [narrowed2],
     createdAt: (/* @__PURE__ */ new Date()).toISOString()
   };
   createCredential(cfg.dataDir, record2);
@@ -57182,7 +58014,7 @@ function refuseDesignErrors(gate) {
 function refuseUnapprovedMembers(required, members) {
   const unapproved = members.filter((m) => m.as !== "part" && m.state !== "approved");
   if (!required || unapproved.length === 0) return;
-  const named2 = unapproved.map((m) => `${m.alias ?? m.key} (${m.state}${m.upgraded ? " \u2014 approved under the pre-stage-5 identity, re-lock it once" : ""})`);
+  const named2 = unapproved.map((m) => `${m.alias ?? m.key} (${m.state}${m.upgraded ? " \u2014 approved under an earlier gate identity, re-lock it once" : ""})`);
   throw new LockRefusedError2(
     `composition.requireApprovedMembers: direct member(s) not approved \u2014 ${named2.join(", ")}. Lock each at its own root first; a parent never approves below itself. Nothing was written.`
   );
@@ -61364,7 +62196,7 @@ async function awaitApproval(cfg, credential, requestId, timeoutSeconds) {
   let current2 = req;
   while (current2.status === "pending" && Date.now() < deadline) {
     const remaining = deadline - Date.now();
-    await new Promise((resolve55) => setTimeout(resolve55, Math.min(AWAIT_POLL_INTERVAL_MS, remaining)));
+    await new Promise((resolve56) => setTimeout(resolve56, Math.min(AWAIT_POLL_INTERVAL_MS, remaining)));
     expirePendingApprovals(cfg.dataDir, (/* @__PURE__ */ new Date()).toISOString());
     current2 = getApprovalRequestById(cfg.dataDir, requestId) ?? current2;
   }
@@ -66963,8 +67795,9 @@ function stop() {
 var DEV_UNIT_ID = "local";
 function bootstrapInstance(config) {
   ensureInstanceIdentity(config.dataDir);
-  if (config.devMode && !getOrganizationUnit(config.dataDir, DEV_UNIT_ID)) {
-    const system = { userId: "system", kind: "service", issuer: "local" };
+  if (!config.devMode) return;
+  const system = { userId: "system", kind: "service", issuer: "local" };
+  if (!getOrganizationUnit(config.dataDir, DEV_UNIT_ID)) {
     createUnit(config.dataDir, {
       id: DEV_UNIT_ID,
       name: "Local Development",
@@ -66976,6 +67809,18 @@ function bootstrapInstance(config) {
       createdBy: system
     });
   }
+  const placed = new Set(listProjectPlacements(config.dataDir).map((p) => p.projectId));
+  for (const record2 of listProjectRecords(config.dataDir)) {
+    if (placed.has(record2.id) || record2.parentProjectId !== void 0) continue;
+    placeProject(config.dataDir, {
+      id: "",
+      projectId: record2.id,
+      unitId: DEV_UNIT_ID,
+      role: "owner",
+      createdAt: "",
+      createdBy: system
+    });
+  }
 }
 
 // src/server/identity-portal.ts
@@ -68312,11 +69157,11 @@ async function runServe(options = {}) {
   logger.info(`  data dir:    ${import_chalk18.default.gray(cfg.dataDir)}`);
   logger.blank();
   logger.info("Press Ctrl+C to stop.");
-  await new Promise((resolve55) => {
+  await new Promise((resolve56) => {
     const shutdown = () => {
       logger.info("Shutting down\u2026");
       handle.close();
-      resolve55();
+      resolve56();
     };
     process.on("SIGINT", shutdown);
     process.on("SIGTERM", shutdown);
@@ -68381,11 +69226,11 @@ async function runDev(options = {}) {
   logger.blank();
   logger.info("An agent edits specs; refresh the page to see the live graph. Press Ctrl+C to stop.");
   if (options.open) openBrowser(url);
-  await new Promise((resolve55) => {
+  await new Promise((resolve56) => {
     const shutdown = () => {
       logger.info("Shutting down\u2026");
       handle.close();
-      resolve55();
+      resolve56();
     };
     process.on("SIGINT", shutdown);
     process.on("SIGTERM", shutdown);
@@ -68491,7 +69336,9 @@ async function runHostUnit(action, options = {}) {
           id: qualifiedId2,
           name: options.name ?? options.slug,
           slug: options.slug,
-          kind: options.kind ?? "team",
+          // A top-level unit must be a business_entity (the org-unit hierarchy's
+          // root kind), so that is the default without --parent; under a parent, team.
+          kind: options.kind ?? (options.parent ? "team" : "business_entity"),
           ...options.parent ? { parentId: options.parent } : {},
           status: "active",
           createdAt: "",
@@ -68580,6 +69427,21 @@ function resolveScopeOptions(options) {
   if (options.unit) return { kind: "unit", id: options.unit };
   return { kind: "instance" };
 }
+function warnIfUnreadable(cfg, cred, userId, scope, why) {
+  const target = scope.kind === "subsystem" ? { kind: "project", id: (scope.id ?? "").split("/")[0] } : scope;
+  let read2;
+  try {
+    read2 = explain3(cfg, cred, userId, "project:read", target.kind, target.id ?? "").value;
+  } catch {
+    return;
+  }
+  if (read2 === "yes") return;
+  const where = target.kind === "instance" ? "the instance" : `${target.kind} ${target.id}`;
+  const flag = target.kind === "instance" ? "--instance" : `--${target.kind} ${target.id}`;
+  logger.warn(
+    `project:read for "${userId}" at ${where} resolves to ${read2} \u2014 ${why}. Grant it with \`wairon host permission set --user ${userId} --capability project:read ${flag}\`.`
+  );
+}
 async function runHostPermission(action, options = {}) {
   const cfg = resolveHostConfig(options);
   const cred = masterCredential();
@@ -68608,6 +69470,9 @@ async function runHostPermission(action, options = {}) {
         logger.success(
           `Assignment ${stored.id}: ${options.user} ${options.capability}=${value} @ ${scope.kind}${scope.id ? ` ${scope.id}` : ""}`
         );
+        if (options.capability === "project:write" && (value === "yes" || value === "approval")) {
+          warnIfUnreadable(cfg, cred, options.user, scope, `${options.user} can write here but cannot read it`);
+        }
         break;
       }
       case "list": {
@@ -68661,7 +69526,16 @@ async function runHostKey(action, options = {}) {
           console.log(`  ${import_chalk18.default.bold(minted.token)}`);
           logger.blank();
           for (const line2 of minted.mapped) {
-            logger.warn(`Narrowing ${line2}: a member is a record of its own since stage 7, so the token names it by its id (qualified entries are deprecated).`);
+            logger.warn(`Narrowing ${line2}: a member is a record of its own, so the token names it by its id (qualified entries are deprecated).`);
+          }
+          if (options.project !== "*") {
+            warnIfUnreadable(
+              cfg,
+              cred,
+              options.owner,
+              { kind: "project", id: options.project },
+              `the token acts as "${options.owner}"'s live permission, so it cannot read the project either`
+            );
           }
           break;
         }
@@ -69065,14 +69939,23 @@ async function runExport(out) {
   }
   const approval = verdict.state;
   const design = exportDesign3(out, approval);
+  const members = memberNote(design);
   if (out) {
     logger.success(
       `Design export of "${design.project.name}" written to ${path92.resolve(out)} (${design.components.length} component(s), ${design.types.length} type(s); approval: ${design.source.approval}).`
     );
+    if (members) logger.info(members);
     return;
   }
   process.stdout.write(`${JSON.stringify(design, null, 2)}
 `);
+  if (members && design.components.length === 0 && design.types.length === 0) process.stderr.write(`${members}
+`);
+}
+function memberNote(design) {
+  const members = design.dependencies.filter((d) => d.role === "member").map((d) => d.alias);
+  if (members.length === 0) return null;
+  return `${members.length} member project(s) are listed under \`dependencies\`, not inlined (${members.join(", ")}): run \`wairon export\` in a member's own root for its design.`;
 }
 
 // src/commands/externals.ts
@@ -69295,16 +70178,16 @@ program.command("generate").description("Generate agent output files from the sp
     dryRun: opts.dryRun
   });
 });
-program.command("lock-check").description("Merge gate: is the design in this working tree the design that was approved? Compares the tree's gate identity against the committed .wai/lock.json. Exits 1 when the design moved past its approval; passes with a notice when the project never locked, unless --strict.").option("--strict", "also fail when nothing was ever approved, or when there is no spec tree at all").action(async (opts) => {
+program.command("lock-check").description("Merge gate: is the design in this working tree the design that was approved? Compares the tree's gate identity against .wai/lock.json as it is in the working tree (in CI, the file committed in the checked-out revision; locally, an uncommitted record counts too). Exits 1 when the design moved past its approval; passes with a notice when the project never locked, unless --strict.").option("--strict", "also fail when nothing was ever approved, or when there is no spec tree at all").action(async (opts) => {
   await lockCheckCommand(opts);
 });
-program.command("lock").description("Final check before implementation: validate the spec tree as complete, freeze all specs to complete, and (re)generate the agent topology \u2014 only if it validates. In an attached checkout, locks the hosted project instead.").option("-y, --yes", "skip the confirmation prompt (for scripts / CI)").option("--subsystem <id>", "only lock specs in the specified subsystem").option("--no-recursive", "do not recursively validate subprojects").action(async (opts) => {
+program.command("lock").description("Record human approval of the design: validate the spec tree as complete, write the approval to .wai/lock.json (one digest per spec; spec files are not rewritten), and refresh this project's generated outputs \u2014 only if the design validates. Commit .wai/lock.json; `wairon lock-check` gates on it. In an attached checkout, locks the hosted project instead.").option("-y, --yes", "skip the confirmation prompt (for scripts / CI)").option("--subsystem <id>", "only lock specs in the specified subsystem").option("--no-recursive", "accepted for one release and ignored: a lock approves this project only; each member locks at its own root").action(async (opts) => {
   await lockCommand(opts);
 });
-program.command("validate").description("Validate the project configuration and the SDD Spec Tree").option("--ci", "treat warnings as errors for CI pipelines (notices are printed and counted, never fatal)").option("--subsystem <id>", "only validate the specified subsystem (granular)").option("--no-recursive", "at a project that declares members: run the owner's gate alone instead of the family run").option("--family", "run the family run from here: every member's own gate, and this project's externals composed against their live producers").action(async (opts) => {
+program.command("validate").description("Validate the project configuration and the SDD Spec Tree").option("--ci", "treat warnings as errors for CI pipelines (notices are printed and counted, never fatal)").option("--subsystem <id>", "only validate the specified subsystem (granular)").option("--no-recursive", "at a project that declares members: run the owner's gate alone instead of the family run").option("--family", "run the family run from here: every member's own gate, and this project's externals composed against their live producers").option("--all", "print every finding (by default the first 100 per severity are printed, followed by per-code totals)").action(async (opts) => {
   await validateCommand(opts);
 });
-program.command("status").description("Show a hierarchical completeness graph of the SDD Spec Tree").option("--subsystem <id>", "only show status for the specified subsystem").option("--no-recursive", "do not recursively show status for subprojects").action(async (opts) => {
+program.command("status").description("Show the spec tree with its authoring readiness (how far each spec is written out, from its draft/design/complete status) and, separately, its approval state from .wai/lock.json").option("--subsystem <id>", "only show status for the specified subsystem").option("--no-recursive", "show this project only, without its members").action(async (opts) => {
   await statusCommand(opts);
 });
 program.command("doctor").description("Health check: flags stale generated guides/skills, an unregistered MCP server, spec-tree issues and the chaining migration still pending").option("--fix", "regenerate stale in-project guides/context/skills, register the MCP server, then apply the chaining migration once confirmed").option("--report <section>", "print one section's report and nothing else, writing nothing (chaining | composed-validation); never combines with --fix").option("-y, --yes", "answer the chaining migration's confirmation (for a non-interactive --fix); a write outside the project root also needs --global").option("--global", "consent to the --fix writes outside the project root (a machine-wide MCP config, the legacy global plugin); with --yes it answers their confirmation, and each replaced file is backed up beside itself").action(async (opts) => {
@@ -69484,7 +70367,7 @@ hostCmd.command("project <action>").description("create | list | destroy a hoste
 hostCmd.command("demo").description("provision a project seeded with a rich example spec tree, so the canvas has content to render").option("--id <id>", "project id", "demo").option("--unit <unitId>", "owner unit id (created if absent)", "demo").option("--force", "destroy and reseed the project if it already exists").option("--data-dir <path>", "data root (default WAIRON_DATA_DIR or ~/.wairon/data)").action(async (opts) => {
   await runHostDemo({ id: opts.id, unit: opts.unit, force: opts.force, dataDir: opts.dataDir });
 });
-hostCmd.command("unit <action>").description("create an organization unit (projects are placed into units at creation)").option("--slug <slug>", "unit slug (REQUIRED for create; a root unit's id IS its slug)").option("--name <name>", "display name (defaults to the slug)").option("--kind <kind>", "unit kind (business_entity | department | team | \u2026)", "team").option("--parent <unitId>", "qualified id of the parent unit (omit for a root unit)").option("--data-dir <path>", "data root").action(async (action, opts) => {
+hostCmd.command("unit <action>").description("create an organization unit (projects are placed into units at creation)").option("--slug <slug>", "unit slug (REQUIRED for create; a root unit's id IS its slug)").option("--name <name>", "display name (defaults to the slug)").option("--kind <kind>", "unit kind (business_entity | department | team | \u2026); default business_entity for a top-level unit, team under --parent").option("--parent <unitId>", "qualified id of the parent unit (omit for a root unit)").option("--data-dir <path>", "data root").action(async (action, opts) => {
   await runHostUnit(action, { slug: opts.slug, name: opts.name, kind: opts.kind, parent: opts.parent, dataDir: opts.dataDir });
 });
 hostCmd.command("doctor").description("migrate a hosted data dir to the permission model (grants \u2192 assignments, owners, unit ids, placements); dry-run without --fix").option("--fix", "apply the migration (REQUIRED at rollout \u2014 legacy users/tokens otherwise resolve to zero permissions)").option("--data-dir <path>", "data root").action(async (opts) => {