@wairon/cli 5.1.1-dev.112 → 5.1.1-dev.113

package/dist/index.js

@@ -3115,8 +3115,8 @@ var require_dist = __commonJS({
           walkPackDir(root, path52.join(current2, entry.name), out);
         } else if (entry.isFile()) {
           const absolute = path52.join(current2, entry.name);
-          const relative25 = path52.relative(root, absolute).split(path52.sep).join("/");
-          out.push({ path: relative25, contents: fs33.readFileSync(absolute) });
+          const relative27 = path52.relative(root, absolute).split(path52.sep).join("/");
+          out.push({ path: relative27, contents: fs33.readFileSync(absolute) });
         }
       }
     }
@@ -3640,6 +3640,7 @@ __export(src_exports, {
   createEmptyTopologyConfig: () => createEmptyTopologyConfig,
   createMember: () => createMember,
   createProjectConfig: () => createProjectConfig,
+  crossProjectWriteRefusal: () => crossProjectWriteRefusal,
   currentRootBinding: () => currentRootBinding,
   declareExternal: () => declareExternal,
   declareMember: () => declareMember,
@@ -3809,6 +3810,7 @@ __export(src_exports, {
   moveMember: () => moveMember,
   moveMethods: () => moveMethods,
   moveMountToMembers: () => moveMountToMembers,
+  moveSpec: () => moveSpec,
   nameKey: () => nameKey,
   namesAnInteger: () => namesAnInteger,
   narrativeStepForeignFields: () => narrativeStepForeignFields,
@@ -3838,6 +3840,7 @@ __export(src_exports, {
   projectIdentity: () => projectIdentity,
   promoteMember: () => promoteMember,
   provisionProject: () => provisionProject,
+  publishedUsesOf: () => publishedUsesOf,
   qualifiedTypeId: () => qualifiedTypeId,
   rangeProblem: () => rangeProblem,
   readCodeAnnotation: () => readCodeAnnotation,
@@ -3867,6 +3870,7 @@ __export(src_exports, {
   renameId: () => renameProjectId,
   renameMethod: () => renameMethod,
   renameParam: () => renameParam,
+  renameSpecId: () => renameSpecId,
   renameType: () => renameType,
   renderDiagram: () => renderDiagram2,
   repairForeignStepFields: () => repairForeignStepFields,
@@ -3896,6 +3900,7 @@ __export(src_exports, {
   retiredReachFacts: () => retiredReachFacts,
   returnTypeOf: () => returnTypeOf,
   rewriteReferences: () => rewriteReferences2,
+  routerLinkage: () => routerLinkage,
   runWithHostedLookup: () => runWithHostedLookup,
   runWithProjectBinding: () => runWithProjectBinding,
   runWithProjectRoot: () => runWithProjectRoot,
@@ -3916,6 +3921,7 @@ __export(src_exports, {
   settledSpecPaths: () => settledSpecPaths,
   signatureFacts: () => signatureFacts,
   signatureTypeRefs: () => signatureTypeRefs,
+  specIndexMethodReferences: () => specIndexMethodReferences,
   specIndexReferencesTo: () => specIndexReferencesTo,
   specIndexRetiredBy: () => specIndexRetiredBy,
   specIndexSubtreeOf: () => specIndexSubtreeOf,
@@ -4022,22 +4028,22 @@ function sampleOf(file) {
     if (fd !== void 0) fs.closeSync(fd);
   }
 }
-function attributeMatches(pattern, relative25) {
+function attributeMatches(pattern, relative27) {
   const glob = pattern.replace(/^\//, "");
-  const target = glob.includes("/") ? relative25 : path.posix.basename(relative25);
+  const target = glob.includes("/") ? relative27 : path.posix.basename(relative27);
   const source = glob.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*\*\//g, "\0").replace(/\*/g, "[^/]*").replace(/\?/g, "[^/]").replace(/\u0000/g, "(?:.*/)?");
   return new RegExp(`^${source}$`).test(target);
 }
 function attributeEol(attributesFile, file) {
   const text3 = readFileOrNull(attributesFile);
   if (text3 === null) return null;
-  const relative25 = path.relative(path.dirname(attributesFile), file).split(path.sep).join("/");
+  const relative27 = path.relative(path.dirname(attributesFile), file).split(path.sep).join("/");
   let eol = null;
   for (const raw of text3.split(/\r?\n/)) {
     const line = raw.trim();
     if (line === "" || line.startsWith("#")) continue;
     const [pattern, ...attrs] = line.split(/\s+/);
-    if (!attributeMatches(pattern, relative25)) continue;
+    if (!attributeMatches(pattern, relative27)) continue;
     for (const attr of attrs) {
       if (attr === "eol=crlf") eol = "\r\n";
       else if (attr === "eol=lf") eol = "\n";
@@ -4318,7 +4324,7 @@ function defaultTargetConfig(type) {
     enabled: true
   };
 }
-var WAIRON_VERSION = "5.1.1-dev.112";
+var WAIRON_VERSION = "5.1.1-dev.113";
 var GITHUB_REPO = "SYW-Apps/Waffle-AIron";
 var ARCHITECT_AGENT_ID = "agent-architect";
 var ARCHITECT_TEMPLATE_ID = "architect";
@@ -7489,9 +7495,9 @@ var RawParser = class {
     }
     name += this.ident();
     while (this.isP("::") || this.isP(".")) {
-      const sep17 = this.peek().v;
+      const sep18 = this.peek().v;
       this.at++;
-      name += sep17 + this.ident();
+      name += sep18 + this.ident();
     }
     if (!this.isP("<")) return { k: "name", name };
     this.at++;
@@ -8690,7 +8696,10 @@ function conceptNoun(component) {
 }
 var HttpMethodSchema = import_zod5.z.enum(["GET", "POST", "PUT", "DELETE", "PATCH", "OPTIONS", "HEAD"]);
 var EndpointSchema = import_zod5.z.discriminatedUnion("transport", [
-  import_zod5.z.object({ transport: import_zod5.z.literal("HTTP"), method: HttpMethodSchema, path: import_zod5.z.string() }),
+  // `status`: the success code the operation answers with when it is not the
+  // verb's convention (202 Accepted, a 3xx redirect, a 201 for a workflow verb
+  // that files something) — the design's own word, which the OpenAPI export uses.
+  import_zod5.z.object({ transport: import_zod5.z.literal("HTTP"), method: HttpMethodSchema, path: import_zod5.z.string(), status: import_zod5.z.number().int().min(200).max(399).optional() }),
   import_zod5.z.object({ transport: import_zod5.z.literal("gRPC"), service: import_zod5.z.string(), method: import_zod5.z.string() }),
   import_zod5.z.object({ transport: import_zod5.z.literal("GraphQL"), operation: import_zod5.z.enum(["query", "mutation", "subscription"]), field: import_zod5.z.string() }),
   import_zod5.z.object({ transport: import_zod5.z.literal("MessageBus"), topic: import_zod5.z.string(), event: import_zod5.z.string(), queue: import_zod5.z.string().optional(), direction: import_zod5.z.enum(["subscribe", "publish"]).default("subscribe") }),
@@ -10033,6 +10042,49 @@ function specIndexReferencesTo(index, targets, system) {
   }
   return out;
 }
+function specIndexMethodReferences(index, component, methods) {
+  const named2 = new Set(methods);
+  const contracts = index.interfaces.filter((i) => i.component === component);
+  const target = (method2) => {
+    const holder = contracts.find((i) => i.methods.some((m) => m.name === method2));
+    return holder ? { kind: "interface", id: holder.id } : { kind: "component", id: component };
+  };
+  const hits = (comp, method2) => comp === component && method2 !== void 0 && named2.has(method2);
+  const out = [];
+  for (const sub of index.subsystems) {
+    for (const entry of sub.lifecycle ?? []) {
+      if (hits(entry.component, entry.method)) out.push({ kind: "subsystem", id: sub.id, position: "lifecycle", target: target(entry.method) });
+    }
+  }
+  for (const comp of index.components) {
+    for (const binding of comp.dispatch ?? []) {
+      if (hits(binding.component, binding.method)) out.push({ kind: "component", id: comp.id, position: "dispatch", target: target(binding.method) });
+    }
+  }
+  for (const intf of index.interfaces) {
+    for (const method2 of intf.methods) {
+      const source = method2.signatureFrom;
+      const cut = source?.lastIndexOf(".") ?? -1;
+      if (source === void 0 || cut <= 0) continue;
+      const name = source.slice(cut + 1);
+      if (hits(source.slice(0, cut), name)) out.push({ kind: "interface", id: intf.id, position: `methods.${method2.name}.signatureFrom`, target: target(name) });
+    }
+  }
+  for (const impl of index.implementations) {
+    for (const method2 of impl.methods) {
+      for (const step of method2.narrative ?? []) {
+        if (hits(step.targetComponent, step.targetMethod)) {
+          out.push({ kind: "implementation", id: impl.id, position: `methods.${method2.name}.narrative.step ${step.stepNumber}`, target: target(step.targetMethod) });
+        }
+      }
+      for (const entry of method2.calls ?? []) {
+        const call = parseDeclaredCall(entry);
+        if (call && hits(call.compId, call.methodName)) out.push({ kind: "implementation", id: impl.id, position: `methods.${method2.name}.calls`, target: target(call.methodName) });
+      }
+    }
+  }
+  return out;
+}
 
 // src/utils/canonical-json.ts
 function canonicalize(value) {
@@ -10184,6 +10236,10 @@ function parseLockRecord(text3, file) {
   } catch (e) {
     throw new LockRecordUnreadableError(file, `it is not valid JSON (${e.message})`);
   }
+  const duplicate = firstDuplicateKey(body);
+  if (duplicate !== null) {
+    throw new LockRecordUnreadableError(file, `it names the key "${duplicate}" twice (a conflict resolved by hand leaves this), so which of the two is the record cannot be told`);
+  }
   if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
     const what = raw === null ? "null" : Array.isArray(raw) ? "an array" : `a ${typeof raw}`;
     throw new LockRecordUnreadableError(file, `it holds ${what}, not a lock record object`);
@@ -10204,6 +10260,37 @@ function parseLockRecord(text3, file) {
   }
   return normalizeRecord(record);
 }
+function firstDuplicateKey(text3) {
+  const stack = [];
+  const pathOf = (frame, key2) => frame && frame.path ? `${frame.path}.${key2}` : key2;
+  for (let i = 0; i < text3.length; i++) {
+    const c = text3[i];
+    if (c === '"') {
+      let j = i + 1;
+      while (j < text3.length && text3[j] !== '"') j += text3[j] === "\\" ? 2 : 1;
+      const top = stack[stack.length - 1];
+      if (top && top.keys && top.expectKey) {
+        const key2 = JSON.parse(text3.slice(i, j + 1));
+        if (top.keys.has(key2)) return pathOf(top, key2);
+        top.keys.add(key2);
+        top.lastKey = key2;
+        top.expectKey = false;
+      }
+      i = j;
+    } else if (c === "{" || c === "[") {
+      const top = stack[stack.length - 1];
+      const segment = top ? top.keys ? top.lastKey ?? "" : "[]" : "";
+      const path52 = top && segment ? pathOf(top, segment) : top?.path ?? "";
+      stack.push({ keys: c === "{" ? /* @__PURE__ */ new Set() : null, expectKey: c === "{", path: path52 });
+    } else if (c === "}" || c === "]") {
+      stack.pop();
+    } else if (c === ",") {
+      const top = stack[stack.length - 1];
+      if (top && top.keys) top.expectKey = true;
+    }
+  }
+  return null;
+}
 function displayPath2(file) {
   const rel2 = path9.relative(process.cwd(), file);
   const shown2 = rel2 && !rel2.startsWith("..") && !path9.isAbsolute(rel2) ? rel2 : file;
@@ -10859,6 +10946,12 @@ var EXTENSION_LANGUAGE = {
   ".kt": "kotlin",
   ".swift": "swift"
 };
+function routerLinkage(router) {
+  const hash = router.lastIndexOf("#");
+  if (hash > 0) return { file: router.slice(0, hash), ...hash < router.length - 1 ? { name: router.slice(hash + 1) } : {} };
+  if (router.includes("/") || EXTENSION_LANGUAGE[path11.extname(router).toLowerCase()] !== void 0) return { file: router };
+  return { name: router };
+}
 function languageOfSourcePath(sourcePath) {
   return EXTENSION_LANGUAGE[path11.extname(sourcePath).toLowerCase()];
 }
@@ -11109,6 +11202,12 @@ function fieldRenamesSince(pinned, live, publicName, member, pinnedDigest) {
   const back = { ...live, types: live.types.map((d) => undone.get(d.id) ?? d) };
   return { renames, renameOnly: memberDigest(back, publicName, member) === pinnedDigest };
 }
+function shownEndpoint(endpoint) {
+  if (!endpoint) return "none";
+  if (endpoint.transport === "HTTP") return `${endpoint.method} ${endpoint.path}${endpoint.status !== void 0 ? ` (answers ${endpoint.status})` : ""}`;
+  const { transport, ...address } = endpoint;
+  return `${String(transport)} ${Object.entries(address).filter(([, v]) => v !== void 0).map(([k, v]) => `${k}=${String(v)}`).join(" ")}`;
+}
 function shownFact(value) {
   return value === void 0 || value === null || value === "" ? "none" : typeof value === "string" ? value : canonicalize(value);
 }
@@ -11278,6 +11377,7 @@ function surfaceChanges(newer, older) {
     }
     const oldMethods = new Map(before.methods.map((m) => [m.name, m]));
     const usedOld = /* @__PURE__ */ new Set();
+    const embeddedBy = /* @__PURE__ */ new Map();
     entry.methods.forEach((method2, methodIndex) => {
       let was = oldMethods.get(method2.name);
       if (!was) {
@@ -11301,7 +11401,10 @@ function surfaceChanges(newer, older) {
       } else if (a !== b) {
         const exported = new Set((newer.exportedTypes ?? []).map((t) => t.type));
         const embedded = renamesIn(closureIds(newer, method2).filter((id) => !exported.has(id)), notes);
-        if (embedded.length > 0) out.push({ kind: "changed", name: entry.id, member: method2.name, detail: `signature reads the same, but it names renamed types: ${embedded.join("; ")}` });
+        if (embedded.length > 0) {
+          const key2 = embedded.join("; ");
+          embeddedBy.set(key2, [...embeddedBy.get(key2) ?? [], method2.name]);
+        }
       }
       for (const r of paramRenames(was, method2)) {
         out.push({ kind: "renamed", name: entry.id, member: method2.name, from: r.from, detail: `parameter "${r.from}" renamed to "${r.to}"` });
@@ -11309,7 +11412,13 @@ function surfaceChanges(newer, older) {
       if (factValue(was.effect) !== factValue(method2.effect)) {
         out.push({ kind: "changed", name: entry.id, member: method2.name, detail: `effect ${shownEffect(was.effect)} \u2192 ${shownEffect(method2.effect)}` });
       }
+      if (factValue(was.endpoint) !== factValue(method2.endpoint)) {
+        out.push({ kind: "changed", name: entry.id, member: method2.name, detail: `endpoint ${shownEndpoint(was.endpoint)} \u2192 ${shownEndpoint(method2.endpoint)}` });
+      }
     });
+    for (const [renames, methods] of embeddedBy) {
+      out.push(methods.length === 1 ? { kind: "changed", name: entry.id, member: methods[0], detail: `signature reads the same, but it names renamed types: ${renames}` } : { kind: "changed", name: entry.id, detail: `${methods.length} methods (${methods.join(", ")}): signatures read the same, but they name renamed types: ${renames}` });
+    }
     for (const m of before.methods) {
       if (!usedOld.has(m.name)) out.push({ kind: "removed", name: entry.id, member: m.name, detail: `method removed: ${shownSignature(m)}` });
     }
@@ -11354,7 +11463,14 @@ function surfaceChanges(newer, older) {
   for (const t of older.exportedTypes ?? []) {
     if (!(newer.exportedTypes ?? []).some((x) => x.id === t.id) && !consumed.has(t.id)) out.push({ kind: "removed", name: t.id, detail: "type removed" });
   }
-  return out.sort((x, y) => x.name === y.name ? (x.member ?? "") < (y.member ?? "") ? -1 : (x.member ?? "") > (y.member ?? "") ? 1 : 0 : x.name < y.name ? -1 : 1);
+  const seen = /* @__PURE__ */ new Set();
+  const unique2 = out.filter((c) => {
+    const key2 = JSON.stringify([c.kind, c.name, c.member ?? "", c.from ?? "", c.detail]);
+    if (seen.has(key2)) return false;
+    seen.add(key2);
+    return true;
+  });
+  return unique2.sort((x, y) => x.name === y.name ? (x.member ?? "") < (y.member ?? "") ? -1 : (x.member ?? "") > (y.member ?? "") ? 1 : 0 : x.name < y.name ? -1 : 1);
 }
 
 // src/models/exports.ts
@@ -11392,6 +11508,14 @@ function narrowedToUses(consumer, published) {
         }
       }
     }
+    if (use.kind === "component") {
+      for (const name of names) {
+        for (const u of consumer.uses ?? []) {
+          if (u.publicName !== name || u.members.length > 0) continue;
+          add2({ publicName: name, kind: u.kind, members: [...use.members].sort(), ...u.specs ? { specs: [...u.specs] } : {} });
+        }
+      }
+    }
     for (const former of use.formerNames ?? []) {
       if ((consumer.broken ?? []).includes(former) && !merged.has(former)) add2({ publicName: former, kind: use.kind, members: use.kind === "type" ? ["type"] : [] });
     }
@@ -12317,12 +12441,15 @@ function generateExcalidrawScene(model) {
 // src/core/canvas.ts
 function memberProjectNodes() {
   const family = graph();
+  const top = family.nodes.find((n) => n.namespace === "")?.directory;
+  const sibling = (dir) => top !== void 0 && path13.relative(top, dir).startsWith("..");
   const contained = family.nodes.filter((n) => n.namespace !== "").map((n) => ({
     id: n.namespace,
     name: n.mountAlias ?? n.namespace,
     description: n.memberDescription ?? n.name ?? "",
     trustedLinks: [],
-    project: true
+    project: true,
+    ...sibling(n.directory) ? { storage: storageBadge("path", n.directory, void 0) } : {}
   }));
   const rootExternals = family.nodes.find((n) => n.namespace === "")?.externals ?? [];
   const referenced = rootExternals.filter((e) => e.role === "member").map((e) => ({ id: e.alias, name: e.alias, description: "", trustedLinks: [], project: true, storage: storageBadge(e.sourceKind === "family" ? "contained" : e.sourceKind, e.directory, e.commit) }));
@@ -17225,40 +17352,64 @@ function idHit(name, ids) {
   const local = name.split(/::|\./).pop().toLowerCase().replace(/[^a-z0-9_-]/g, "");
   return [...ids].find((id) => id.toLowerCase() === local);
 }
-function schemaScope(ownDefs, externals, reached, alias) {
+function componentKey(name) {
+  return name.replace(/::/g, ".").replace(/[^A-Za-z0-9._-]/g, "_");
+}
+function projectIdentity2(surface) {
+  return surface.projectId ?? surface.projectName;
+}
+function schemaScope(ownDefs, externals, registry, alias) {
   const ownIds = ownDefs.map((t) => t.id);
   const externalId = (pinned, name) => {
     const exported = (pinned.exportedTypes ?? []).find((t) => t.id === name || t.id.toLowerCase() === name.toLowerCase());
-    return exported && pinned.types.some((t) => t.id === exported.type) ? exported.type : idHit(name, pinned.types.map((t) => t.id));
+    if (exported && pinned.types.some((t) => t.id === exported.type)) return exported.type;
+    if (pinned.types.some((t) => t.id === name)) return name;
+    return idHit(name, pinned.types.map((t) => t.id));
+  };
+  const aliasOf = (identity2) => [...externals].find(([, s]) => projectIdentity2(s) === identity2)?.[0] ?? identity2;
+  const record = (identity2, id, preferred, reached) => {
+    const identityKey = `${identity2}\0${id}`;
+    const held = registry.keyOf.get(identityKey);
+    if (held !== void 0) return held;
+    let key2 = componentKey(preferred);
+    for (let n = 2; registry.reached.has(key2); n++) key2 = componentKey(`${preferred}_${n}`);
+    registry.keyOf.set(identityKey, key2);
+    registry.reached.set(key2, reached);
+    return key2;
   };
   const external = (from, name) => {
     const pinned = externals.get(from);
     const id = pinned ? externalId(pinned, name) : void 0;
     if (!pinned || id === void 0) return void 0;
-    const key2 = `${from}.${id}`;
-    if (!reached.has(key2)) reached.set(key2, { alias: from, def: pinned.types.find((t) => t.id === id) });
-    return key2;
+    const identity2 = projectIdentity2(pinned);
+    const keyAlias = aliasOf(identity2);
+    const surface = externals.get(keyAlias) ?? pinned;
+    const def = surface.types.find((t) => t.id === id) ?? pinned.types.find((t) => t.id === id);
+    return record(identity2, id, `${keyAlias}.${id}`, { alias: externals.has(keyAlias) ? keyAlias : from, def });
   };
+  const own2 = (id) => record("", id, id, { def: ownDefs.find((t) => t.id === id) });
   return {
     componentOf(name) {
-      const sep17 = name.indexOf("::");
-      if (sep17 > 0 && externals.has(name.slice(0, sep17))) return external(name.slice(0, sep17), name.slice(sep17 + 2));
+      const sep18 = name.indexOf("::");
+      if (sep18 > 0 && externals.has(name.slice(0, sep18))) return external(name.slice(0, sep18), name.slice(sep18 + 2));
+      if (alias === void 0 && ownIds.includes(name)) return own2(name);
       if (alias !== void 0) return external(alias, name);
-      return idHit(name, ownIds);
+      const hit = idHit(name, ownIds);
+      return hit !== void 0 ? own2(hit) : void 0;
     },
     isObject(typeRef2) {
       const expr = expressionOf(typeRef2);
       if (!expr || expr.form !== "named" && expr.form !== "applied") return false;
       const name = expr.name ?? "";
-      const sep17 = name.indexOf("::");
-      const from = sep17 > 0 && externals.has(name.slice(0, sep17)) ? name.slice(0, sep17) : alias;
+      const sep18 = name.indexOf("::");
+      const from = sep18 > 0 && externals.has(name.slice(0, sep18)) ? name.slice(0, sep18) : alias;
       const pinned = from !== void 0 ? externals.get(from) : void 0;
-      const local = sep17 > 0 ? name.slice(sep17 + 2) : name;
-      const def = pinned ? pinned.types.find((t) => t.id === externalId(pinned, local)) : ownDefs.find((t) => t.id === idHit(name, ownIds));
+      const local = sep18 > 0 && from !== alias ? name.slice(sep18 + 2) : name;
+      const def = pinned ? pinned.types.find((t) => t.id === externalId(pinned, local)) : ownDefs.find((t) => t.id === (ownIds.includes(name) ? name : idHit(name, ownIds)));
       return !!def && def.kind !== "enum" && def.kind !== "signature" && def.holds === void 0;
     },
     within(next) {
-      return schemaScope(ownDefs, externals, reached, next);
+      return schemaScope(ownDefs, externals, registry, next);
     }
   };
 }
@@ -17317,14 +17468,30 @@ function creates(method2) {
   if (method2.effect === "none" || method2.effect === "read") return false;
   return CREATING_NAME.test(method2.name);
 }
+var STATUS_TEXT = { "200": "Success", "201": "Created", "202": "Accepted", "203": "Success", "204": "Success", "206": "Partial content" };
+function conventionalStatus(method2, httpVerb) {
+  const returns = method2.returns ?? "";
+  if (!returns || returnsNothing(returns)) return 204;
+  return httpVerb === "post" && creates(method2) ? 201 : 200;
+}
+function admitsNoValue(typeRef2) {
+  return expressionOf(typeRef2)?.form === "optional";
+}
+function described(schema, description) {
+  return description && schema.description === void 0 ? { ...schema, description } : schema;
+}
 function responsesFor(method2, httpVerb, scope) {
   const returns = method2.returns ?? "";
   const nothing = !returns || returnsNothing(returns);
-  const code = nothing ? "204" : httpVerb === "post" && creates(method2) ? "201" : "200";
+  const stated = method2.endpoint?.transport === "HTTP" ? method2.endpoint.status : void 0;
+  const code = String(stated ?? conventionalStatus(method2, httpVerb));
+  const redirect = /^3/.test(code);
+  const bodyless = nothing || redirect || code === "204";
   const responses = {
     [code]: {
-      description: nothing ? "Success, with no content" : `Success: ${returns}`,
-      ...nothing ? {} : { content: { "application/json": { schema: schemaFor(returns, scope) } } }
+      description: redirect ? `Redirect${returns && !nothing ? `: the Location header is the ${returns} the method answers` : ""}` : nothing ? `${STATUS_TEXT[code] ?? "Success"}, with no content` : `${STATUS_TEXT[code] ?? "Success"}: ${returns}`,
+      ...redirect ? { headers: { Location: { description: "Where the client is sent", schema: { type: "string" } } } } : {},
+      ...bodyless ? {} : { content: { "application/json": { schema: schemaFor(returns, scope) } } }
     }
   };
   const failure = failureOf(returns);
@@ -17340,14 +17507,14 @@ function enumDescription(values) {
   return ["Values:", ...values.map((v) => `- \`${v.name}\`${v.description ? `: ${v.description}` : ""}`)].join("\n");
 }
 function enumValuesFrom(schema) {
-  const described = /* @__PURE__ */ new Map();
+  const described2 = /* @__PURE__ */ new Map();
   if (typeof schema.description === "string") {
     for (const line of schema.description.split("\n")) {
       const m = /^- `([^`]+)`: (.+)$/.exec(line.trim());
-      if (m) described.set(m[1], m[2]);
+      if (m) described2.set(m[1], m[2]);
     }
   }
-  return schema.enum.filter((v) => typeof v === "string" && v.length > 0).map((name) => ({ name, ...described.has(name) ? { description: described.get(name) } : {} }));
+  return schema.enum.filter((v) => typeof v === "string" && v.length > 0).map((name) => ({ name, ...described2.has(name) ? { description: described2.get(name) } : {} }));
 }
 function openApiPath(basePath, endpointPath) {
   const join31 = (a, b) => `${a.replace(/\/+$/, "")}/${b.replace(/^\/+/, "")}`;
@@ -17404,7 +17571,7 @@ function operationFor(method2, scope, entry) {
   const parameter = (p, where) => ({
     name: p.name,
     in: where,
-    required: where === "path" ? true : !p.optional,
+    required: where === "path" ? true : !p.optional && !admitsNoValue(p.type),
     ...p.description ? { description: p.description } : {},
     schema: schemaFor(p.type, scope)
   });
@@ -17413,7 +17580,7 @@ function operationFor(method2, scope, entry) {
     const bodyParam = rest.length === 1 ? rest[0] : void 0;
     if (bodyVerbs.has(httpVerb) && bodyParam && scope.isObject(bodyParam.type)) {
       op.requestBody = {
-        required: !bodyParam.optional,
+        required: !bodyParam.optional && !admitsNoValue(bodyParam.type),
         ...bodyParam.description ? { description: bodyParam.description } : {},
         content: { "application/json": { schema: schemaFor(bodyParam.type, scope) } }
       };
@@ -17425,8 +17592,8 @@ function operationFor(method2, scope, entry) {
           "application/json": {
             schema: {
               type: "object",
-              properties: Object.fromEntries(rest.map((p) => [p.name, schemaFor(p.type, scope)])),
-              required: rest.filter((p) => !p.optional).map((p) => p.name)
+              properties: Object.fromEntries(rest.map((p) => [p.name, described(schemaFor(p.type, scope), p.description)])),
+              required: rest.filter((p) => !p.optional && !admitsNoValue(p.type)).map((p) => p.name)
             }
           }
         }
@@ -17448,8 +17615,9 @@ function typeComponent(t, scope) {
   return {
     type: "object",
     title: t.name,
-    properties: Object.fromEntries(t.fields.map((f) => [f.name, schemaFor(f.type, scope)])),
-    required: t.fields.filter((f) => !f.optional).map((f) => f.name)
+    // A field's description travels on its property; a `T?` field may be left out, like an optional one.
+    properties: Object.fromEntries(t.fields.map((f) => [f.name, described(schemaFor(f.type, scope), f.description)])),
+    required: t.fields.filter((f) => !f.optional && !admitsNoValue(f.type)).map((f) => f.name)
   };
 }
 var SIGNATURE_EXTENSION = "x-wairon-signature";
@@ -17554,8 +17722,8 @@ var OpenApiRouteCollisionError = class extends Error {
 };
 function renderDoc(snapshot, entries, context, opts = {}) {
   const { schemes, securityByEntry } = buildSecurity(entries);
-  const reached = /* @__PURE__ */ new Map();
-  const scope = schemaScope(snapshot.types, context.externals ?? /* @__PURE__ */ new Map(), reached);
+  const registry = { reached: /* @__PURE__ */ new Map(), keyOf: /* @__PURE__ */ new Map() };
+  const scope = schemaScope(snapshot.types, context.externals ?? /* @__PURE__ */ new Map(), registry);
   const paths = {};
   const taken = /* @__PURE__ */ new Map();
   for (const entry of entries) {
@@ -17577,15 +17745,12 @@ function renderDoc(snapshot, entries, context, opts = {}) {
     }
   }
   const schemas = {};
-  for (const t of snapshot.types) schemas[t.id] = typeComponent(t, scope);
-  const rendered = /* @__PURE__ */ new Set();
   for (let more = true; more; ) {
     more = false;
-    for (const [key2, { alias, def }] of [...reached]) {
-      if (rendered.has(key2)) continue;
-      rendered.add(key2);
+    for (const [key2, { alias, def }] of [...registry.reached]) {
+      if (key2 in schemas) continue;
       more = true;
-      schemas[key2] = typeComponent(def, scope.within(alias));
+      schemas[key2] = typeComponent(def, alias !== void 0 ? scope.within(alias) : scope);
     }
   }
   const components = {};
@@ -17699,6 +17864,13 @@ function describedWith(description, note) {
   const text3 = [description, note].filter((x) => !!x).join(" ");
   return text3 ? { description: text3 } : {};
 }
+function leftOut(required, type) {
+  return required || type.endsWith("?") ? {} : { optional: true };
+}
+function statedStatus(code, method2, verb) {
+  if (code === void 0 || !/^[23]\d\d$/.test(code)) return {};
+  return Number(code) === conventionalStatus(method2, verb) ? {} : { status: Number(code) };
+}
 function authFromSecurityScheme(scheme) {
   const desc = typeof scheme.description === "string" ? { description: scheme.description } : {};
   if (scheme.type === "apiKey") {
@@ -17757,10 +17929,11 @@ function fromOpenApi(document, projectName) {
       for (const p of op.parameters ?? []) {
         if (typeof p.name !== "string") continue;
         const schema = p.schema;
+        const type = typeRefFromSchema(schema);
         params.push({
           name: p.name,
-          type: typeRefFromSchema(schema),
-          ...p.required === true ? {} : { optional: true },
+          type,
+          ...leftOut(p.required === true, type),
           ...describedWith(typeof p.description === "string" ? p.description : void 0, inlineEnumNote(schema))
         });
       }
@@ -17779,10 +17952,11 @@ function fromOpenApi(document, projectName) {
         const required = new Set(bodySchema.required ?? []);
         if (Object.keys(props).length) {
           for (const [pname, pschema] of Object.entries(props)) {
+            const type = typeRefFromSchema(pschema);
             params.push({
               name: pname,
-              type: typeRefFromSchema(pschema),
-              ...required.has(pname) ? {} : { optional: true },
+              type,
+              ...leftOut(required.has(pname), type),
               ...describedWith(typeof pschema.description === "string" ? pschema.description : void 0, inlineEnumNote(pschema))
             });
           }
@@ -17792,7 +17966,7 @@ function fromOpenApi(document, projectName) {
       }
       const responses = op.responses ?? {};
       const jsonSchema = (r) => r?.content?.["application/json"]?.schema;
-      const successCode = Object.keys(responses).filter((c) => /^2\d\d$/.test(c)).sort()[0];
+      const successCode = Object.keys(responses).filter((c) => /^2\d\d$/.test(c)).sort()[0] ?? Object.keys(responses).filter((c) => /^3\d\d$/.test(c)).sort()[0];
       const responseSchema = successCode !== void 0 ? jsonSchema(responses[successCode]) : void 0;
       const failureCode = ["default", ...Object.keys(responses).filter((c) => /^[45](\d\d|XX)$/i.test(c)).sort()].find((c) => jsonSchema(responses[c]) !== void 0);
       const success = responseSchema ? typeRefFromSchema(responseSchema) : "void";
@@ -17809,7 +17983,7 @@ function fromOpenApi(document, projectName) {
         signature: `${name}(${params.map((p) => `${p.name}: ${p.type}`).join(", ")}): ${returns}`,
         returns,
         params,
-        endpoint: { transport: "HTTP", method: verb.toUpperCase(), path: rawPath },
+        endpoint: { transport: "HTTP", method: verb.toUpperCase(), path: rawPath, ...statedStatus(successCode, { name, returns, ...effect ? { effect } : {} }, verb) },
         ...guarantees.length ? { guarantees } : {},
         ...effect ? { effect } : {},
         ...ext ? { ext } : {}
@@ -17838,11 +18012,15 @@ function fromOpenApi(document, projectName) {
       id,
       name: typeof schema.title === "string" ? schema.title : id,
       kind: "value-object",
-      fields: Object.entries(props).map(([fname, fschema]) => ({
-        name: fname,
-        type: typeRefFromSchema(fschema),
-        ...required.has(fname) ? {} : { optional: true }
-      }))
+      fields: Object.entries(props).map(([fname, fschema]) => {
+        const type = typeRefFromSchema(fschema);
+        return {
+          name: fname,
+          type,
+          ...leftOut(required.has(fname), type),
+          ...typeof fschema.description === "string" ? { description: fschema.description } : {}
+        };
+      })
     });
   }
   const securitySchemes = parsed.components?.securitySchemes ?? {};
@@ -18596,7 +18774,7 @@ function listPinnedExternals() {
     const config = loadProjectConfig();
     declared = config ? [
       ...declaredExternals(config),
-      ...declaredMembers(config).filter((m) => !m.problem && m.storage !== "contained").map((m) => ({ alias: m.alias, project: m.alias }))
+      ...declaredMembers(config).filter((m) => !m.problem && m.storage !== "contained" && m.storage !== "path").map((m) => ({ alias: m.alias, project: m.alias }))
     ] : [];
   } catch {
     return [];
@@ -18715,7 +18893,7 @@ function foreignSurfaces() {
   }
   const root = getProjectRoot();
   for (const m of members) {
-    if (m.problem || m.storage !== "contained" || m.path === void 0 || out.has(m.alias)) continue;
+    if (m.problem || m.storage !== "contained" && m.storage !== "path" || m.path === void 0 || out.has(m.alias)) continue;
     try {
       const surface = runWithProjectRoot(path15.resolve(root, m.path), () => projectOwnSurface("project"));
       out.set(m.alias, surface);
@@ -18730,7 +18908,7 @@ function withForeignTypes(snapshot, foreign) {
   const have = new Set(types.map((t) => t.id));
   const queue = [];
   const scan2 = (text3) => {
-    for (const token of (text3 ?? "").match(/[A-Za-z0-9_-]+::[A-Za-z0-9_-]+/g) ?? []) queue.push(token);
+    for (const token of (text3 ?? "").match(/[A-Za-z0-9_-]+(?:::[A-Za-z0-9_-]+)+/g) ?? []) queue.push(token);
   };
   for (const e of snapshot.interfaces) for (const m of e.methods) {
     for (const p of m.params ?? []) scan2(p.type);
@@ -18749,12 +18927,14 @@ function withForeignTypes(snapshot, foreign) {
     const name = ref.slice(cut + 2);
     const pin2 = foreign.get(alias);
     if (!pin2) continue;
-    const defId = (pin2.exportedTypes ?? []).find((t) => t.id === name)?.type ?? name;
+    const segment = (id) => id.includes("::") ? id.slice(id.lastIndexOf("::") + 2) : id;
+    const shared = (id) => pin2.types.filter((d) => segment(d.id) === segment(id)).length > 1;
+    const local = new Map(pin2.types.map((d) => [d.id, `${alias}::${(pin2.exportedTypes ?? []).find((t) => t.type === d.id)?.id ?? (shared(d.id) ? d.id : segment(d.id))}`]));
+    const defId = (pin2.exportedTypes ?? []).find((t) => t.id === name)?.type ?? (pin2.types.some((d) => d.id === name) ? name : [...local].find(([, spelled]) => spelled === ref)?.[0]);
     const def = pin2.types.find((d) => d.id === defId);
     if (!def) continue;
-    const local = new Map(pin2.types.map((d) => [d.id, `${alias}::${(pin2.exportedTypes ?? []).find((t) => t.type === d.id)?.id ?? d.id}`]));
     local.set(def.id, ref);
-    const respell = (text3) => text3?.replace(/[A-Za-z0-9_][A-Za-z0-9_-]*/g, (token) => local.get(token) ?? token);
+    const respell = (text3) => text3?.replace(/[A-Za-z0-9_][A-Za-z0-9_-]*(?:::[A-Za-z0-9_][A-Za-z0-9_-]*)*/g, (token) => local.get(token) ?? token);
     const expanded = {
       ...def,
       id: ref,
@@ -19016,6 +19196,10 @@ function pinExternals(aliases) {
   const declared = bindings.map((b) => b.external.alias);
   const named2 = aliases && aliases.length > 0 ? aliases : void 0;
   const unknown = (named2 ?? []).filter((a) => !declared.includes(a));
+  const live = unknown.filter((a) => declaredMembers(loadProjectConfig() ?? {}).some((m) => m.alias === a && !m.problem && (m.storage === "contained" || m.storage === "path")));
+  if (live.length > 0 && live.length === unknown.length) {
+    throw new WaironError(`${live.map((a) => `"${a}"`).join(", ")} ${live.length === 1 ? "is a member" : "are members"} of this project, read live where ${live.length === 1 ? "it is" : "they are"} stored (inside it, or a \`../\` sibling checkout) and composed in the family run like any contained member \u2014 a member is never pinned. Pin only an external (\`externals add\`), or a git or hosted member. Nothing was written.`);
+  }
   if (unknown.length) throw new UnknownExternalAliasError(unknown, declared);
   const kept = named2 ? bindings.filter((b) => named2.includes(b.external.alias)) : bindings;
   const lock = externalsRepository.readLock() ?? { externals: {} };
@@ -19323,7 +19507,23 @@ function listExternals() {
   return [...declared, ...orphans];
 }
 function listConsumers2(search) {
-  return listConsumers(search);
+  const consumers = listConsumers(search);
+  if (consumers.length === 0) return consumers;
+  let own2;
+  try {
+    own2 = projectOwnSurface("project");
+  } catch {
+    return consumers;
+  }
+  const held = new Map(own2.interfaces.map((e) => [e.id, new Set(e.methods.map((m) => m.name))]));
+  return consumers.map((c) => {
+    const gone = (c.uses ?? []).flatMap((u) => {
+      const methods = held.get(u.publicName);
+      return methods ? u.members.filter((m) => m !== "type" && !m.startsWith("capability:") && !methods.has(m)).map((m) => `${u.publicName}.${m}`) : [];
+    });
+    if (gone.length === 0) return c;
+    return { ...c, broken: [.../* @__PURE__ */ new Set([...c.broken ?? [], ...gone])].sort() };
+  });
 }
 function diff(against) {
   const saved = against !== void 0 && fs9.existsSync(against) && fs9.statSync(against).isFile();
@@ -19819,6 +20019,7 @@ function readMembers(body, mode) {
     if (seg.startsWith("[") || seg.startsWith("(") || seg.startsWith("<") || seg.startsWith("...") || /^new\b/.test(seg)) continue;
     const name = IDENT.exec(seg)?.[0];
     if (name === void 0 || name === "constructor") continue;
+    if (mode !== "type" && name.startsWith("_")) continue;
     let i = name.length;
     while (seg[i] === "?" || seg[i] === "!") i++;
     if (accessor) {
@@ -19881,7 +20082,7 @@ function tagBefore(clean, docs, start) {
 function lineAt(clean, index) {
   return clean.slice(0, index).split("\n").length;
 }
-function commonJsDeclaration(value, base) {
+function commonJsDeclaration(value, base, clean = "", docs = []) {
   const t = value.trim();
   if (t.startsWith("{")) return { ...base, kind: "object", members: readMembers(t.slice(1, closeOf(t, 0) - 1), "object") };
   const params = functionValueParams(t);
@@ -19891,25 +20092,68 @@ function commonJsDeclaration(value, base) {
     const open = cls[0].length - 1;
     return { ...base, kind: "class", members: readMembers(t.slice(open + 1, closeOf(t, open) - 1), "class") };
   }
+  const ident = /^([A-Za-z_$][\w$]*)\s*$/.exec(t);
+  if (ident && clean) {
+    const local = localDeclaration(clean, docs, ident[1]);
+    const tag = base.tag ?? local?.tag;
+    if (local) return { ...local, name: base.name, ...tag ? { tag } : {} };
+  }
+  return null;
+}
+function localDeclaration(clean, docs, name) {
+  const escaped = name.replace(/\$/g, "\\$");
+  const re = new RegExp(`(?<![\\w$.])(?:declare\\s+)?(?:(?:abstract\\s+)?(class)|(?:async\\s+)?(function)\\s*\\*?|(interface)|(?:const|let|var))\\s+${escaped}(?![\\w$])`, "g");
+  for (const match2 of clean.matchAll(re)) {
+    const start = match2.index ?? 0;
+    const tag = tagBefore(clean, docs, start);
+    const base = { name, line: lineAt(clean, start), ...tag ? { tag } : {} };
+    let i = start + match2[0].length;
+    if (match2[1] || match2[3]) {
+      const open = clean.indexOf("{", i);
+      if (open < 0) continue;
+      return { ...base, kind: match2[1] ? "class" : "interface", members: readMembers(clean.slice(open + 1, closeOf(clean, open) - 1), match2[1] ? "class" : "type") };
+    }
+    if (match2[2]) {
+      i = skipTypeParams(clean, i);
+      i = skipSpace(clean, i);
+      return { ...base, kind: "function", params: clean[i] === "(" ? paramNames(clean.slice(i + 1, closeOf(clean, i) - 1)) : [], members: [] };
+    }
+    const eq = clean.indexOf("=", i);
+    if (eq < 0) continue;
+    const decl = commonJsDeclaration(valueAt2(clean, eq + 1), base);
+    if (decl) return decl;
+  }
   return null;
 }
 var CJS_NAMED_RE = /(?<![\w$.])(?:module\.)?exports\.([A-Za-z_$][\w$]*)\s*=(?!=)/g;
-var CJS_WHOLE_RE = /(?<![\w$.])module\.exports\s*=(?!=)/g;
+var CJS_WHOLE_RE = /(?<![\w$.])(?:module\.exports|export)\s*=(?![=>])/g;
 function valueAt2(clean, from) {
   return splitTop(clean.slice(from), ";")[0] ?? "";
 }
+function wholeExportName(value) {
+  const named2 = /^(?:class|(?:async\s+)?function\s*\*?)\s+([A-Za-z_$][\w$]*)/.exec(value)?.[1] ?? /^([A-Za-z_$][\w$]*)\s*$/.exec(value)?.[1];
+  return named2 === "require" ? void 0 : named2;
+}
 function readCommonJs(clean, docs) {
   const out = [];
   for (const match2 of clean.matchAll(CJS_NAMED_RE)) {
     const start = match2.index ?? 0;
     const tag = tagBefore(clean, docs, start);
-    const decl = commonJsDeclaration(valueAt2(clean, start + match2[0].length), { name: match2[1], line: lineAt(clean, start), ...tag ? { tag } : {} });
+    const decl = commonJsDeclaration(valueAt2(clean, start + match2[0].length), { name: match2[1], line: lineAt(clean, start), ...tag ? { tag } : {} }, clean, docs);
     if (decl) out.push(decl);
   }
   for (const match2 of clean.matchAll(CJS_WHOLE_RE)) {
     const start = match2.index ?? 0;
     const open = skipSpace(clean, start + match2[0].length);
-    if (clean[open] !== "{") continue;
+    const wholeTag = tagBefore(clean, docs, start);
+    if (clean[open] !== "{") {
+      const value = valueAt2(clean, open).trim();
+      const named2 = wholeExportName(value);
+      if (named2 === void 0) continue;
+      const decl = commonJsDeclaration(value, { name: named2, line: lineAt(clean, start), ...wholeTag ? { tag: wholeTag } : {} }, clean, docs);
+      if (decl) out.push(decl);
+      continue;
+    }
     const body = clean.slice(open + 1, closeOf(clean, open) - 1);
     let offset = open + 1;
     for (const raw of splitTop(body, ",")) {
@@ -19918,31 +20162,60 @@ function readCommonJs(clean, docs) {
       if (found >= 0) offset = found + raw.length;
       const seg = raw.replace(/^async\s+/, "");
       const name = IDENT.exec(seg)?.[0];
-      if (name === void 0) continue;
-      const tag = tagBefore(clean, docs, at);
+      if (name === void 0 || name.startsWith("_")) continue;
+      const own2 = tagBefore(clean, docs, at);
+      const tag = own2 ?? wholeTag;
       const base = { name, line: lineAt(clean, at), ...tag ? { tag } : {} };
       const rest = seg.slice(name.length).trimStart();
       if (rest.startsWith("(")) {
         out.push({ ...base, kind: "function", params: paramNames(rest.slice(1, closeOf(rest, 0) - 1)), members: [] });
       } else if (rest.startsWith(":")) {
-        const decl = commonJsDeclaration(rest.slice(1), base);
+        const decl = commonJsDeclaration(rest.slice(1), base, clean, docs);
         if (decl) out.push(decl);
+      } else if (rest === "") {
+        const local = localDeclaration(clean, docs, name);
+        const localTag = own2 ?? local?.tag ?? wholeTag;
+        if (local) out.push({ ...local, ...localTag ? { tag: localTag } : {} });
       }
     }
   }
   return out;
 }
+function readTypedefs(text3, clean) {
+  const out = [];
+  for (const comment of text3.matchAll(/\/\*\*[\s\S]*?\*\//g)) {
+    const body = comment[0];
+    const typedef = /@typedef\s+(?:\{[^}]*\}\s*)?([A-Za-z_$][\w$]*)/.exec(body);
+    if (!typedef) continue;
+    const members = [];
+    for (const prop of body.matchAll(/@prop(?:erty)?\s+(?:\{([^}]*)\}\s*)?\[?([A-Za-z_$][\w$]*)/g)) {
+      members.push(prop[1] ? { name: prop[2], type: prop[1].trim() } : { name: prop[2] });
+    }
+    const tag = TAG_RE.exec(body);
+    out.push({
+      name: typedef[1],
+      kind: members.length > 0 ? "type" : "alias",
+      members,
+      line: lineAt(clean, (comment.index ?? 0) + body.indexOf("@typedef")),
+      ...tag ? { tag: `${tag[1]}::${tag[2]}` } : {}
+    });
+  }
+  return out;
+}
 function readUnreadForms(text3) {
-  const { clean } = scan(text3);
+  const { clean, docs } = scan(text3);
   const forms = /* @__PURE__ */ new Set();
   const shown2 = (value) => /^require\s*\(/.test(value) ? "require(\u2026)" : `${IDENT.exec(value)?.[0] ?? "\u2026"}${/^[A-Za-z_$][\w$.]*\s*\(/.test(value) ? "(\u2026)" : ""}`;
   for (const match2 of clean.matchAll(CJS_WHOLE_RE)) {
     const value = valueAt2(clean, (match2.index ?? 0) + match2[0].length).trim();
-    if (!value.startsWith("{")) forms.add(`module.exports = ${shown2(value)}`);
+    if (value.startsWith("{")) continue;
+    const named2 = wholeExportName(value);
+    if (named2 !== void 0 && commonJsDeclaration(value, { name: named2, line: 0 }, clean, docs) !== null) continue;
+    forms.add(`${match2[0].startsWith("export") ? "export" : "module.exports"} = ${shown2(value)}`);
   }
   for (const match2 of clean.matchAll(CJS_NAMED_RE)) {
     const value = valueAt2(clean, (match2.index ?? 0) + match2[0].length).trim();
-    if (commonJsDeclaration(value, { name: match2[1], line: 0 }) === null) forms.add(`exports.${match2[1]} = ${shown2(value)}`);
+    if (commonJsDeclaration(value, { name: match2[1], line: 0 }, clean, docs) === null) forms.add(`exports.${match2[1]} = ${shown2(value)}`);
   }
   return [...forms];
 }
@@ -19984,7 +20257,7 @@ function readDeclarations(text3) {
     }
   }
   const seen = new Set(out.map((d) => d.name));
-  for (const decl of readCommonJs(clean, docs)) {
+  for (const decl of [...readCommonJs(clean, docs), ...readTypedefs(text3, clean)]) {
     if (!seen.has(decl.name)) out.push(decl);
     seen.add(decl.name);
   }
@@ -20115,6 +20388,13 @@ function releaseStampAgainst(record, running) {
   if (isNewerVersion(running, stamp)) return "newer";
   return isNewerVersion(stamp, running) ? "older" : "same";
 }
+function releaseStampProblem(record, running) {
+  const reading = releaseStampAgainst(record, running);
+  if (reading === "older" || reading === "same") return null;
+  const stamp = record.validatorVersion;
+  if (reading === "newer") return `its release stamp says wairon ${String(stamp)} took it, a newer release than this one (${running})`;
+  return typeof stamp === "string" && stamp !== "" ? `its release stamp "${stamp}" is no wairon version` : "it carries no release stamp";
+}
 function stampRecordsGateParts(stamp) {
   return stamp === GATE_PARTS_SINCE || isNewerVersion(GATE_PARTS_SINCE, stamp);
 }
@@ -20872,6 +21152,18 @@ function specsUsing(family, alias, publicName) {
   const specs = family.authoredReferences.filter((r) => (family.owners.get(r.specId) ?? "") === "" && (r.authored.startsWith(`${alias}::`) || (r.importedVia ?? "").split(", ").includes(alias)) && (publicName === void 0 || (r.publicName ?? r.authored.split("::")[r.form === "import" ? 0 : 1]) === publicName)).map((r) => r.specId);
   return [...new Set(specs)].sort();
 }
+function bindingModulesOf(specs) {
+  if (specs.length === 0) return [];
+  const named2 = new Set(specs);
+  const componentOf = new Map(loadInterfaceSpecs().map((i) => [i.id, i.component]));
+  const out = /* @__PURE__ */ new Set();
+  for (const impl of loadImplementationSpecs()) {
+    if (impl.id.includes("::") || !impl.bindings?.length) continue;
+    if (!named2.has(impl.id) && !named2.has(impl.contract) && !named2.has(componentOf.get(impl.contract) ?? "")) continue;
+    for (const b of impl.bindings) out.add(b.replace(/\\/g, "/"));
+  }
+  return [...out].sort();
+}
 function movedUse(use) {
   return `${useName(use)} ${howMoved(use).replace(/^was renamed/, "renamed").replace(/^is gone/, "gone")}`;
 }
@@ -20892,10 +21184,11 @@ function adviseOn(status, family, config) {
       const broken = status.uses.filter(isBroken);
       const users = [...new Set(broken.flatMap((u) => specsUsing(family, status.alias, u.publicName)))].sort();
       const renamed2 = broken.some((u) => u.state === "renamed" || u.detail?.includes("follow the rename"));
+      const bindings = bindingModulesOf(users);
       return advisory(
         config,
         "EXTERNAL_LIVE_INCOMPATIBLE",
-        `${who} moved in its live producer since it was pinned: ${broken.map(movedUse).join("; ")}. Used by ${users.length ? users.map((s) => `"${s}"`).join(", ") : "this project's references"}. Adapt the uses${renamed2 ? " (follow the rename)" : ""}, then re-pin with ${repin(status.alias)}. Advisory: the pin still gates.`
+        `${who} moved in its live producer since it was pinned: ${broken.map(movedUse).join("; ")}. Used by ${users.length ? users.map((s) => `"${s}"`).join(", ") : "this project's references"}. ` + (bindings.length ? `Binding module(s) declared there: ${bindings.map((b) => `"${b}"`).join(", ")} \u2014 compared with the pin, not the live producer, so ${bindings.length === 1 ? "it draws" : "they draw"} BINDING_DRIFT once the re-pin lands; follow the move there too. ` : "") + `Adapt the uses${renamed2 ? " (follow the rename)" : ""}, then re-pin with ${repin(status.alias)}. Advisory: the pin still gates.`
       );
     }
     case "drifted":
@@ -21146,10 +21439,13 @@ function approvalAt(node, ceiling) {
     if (!record) return base;
     const same = (id) => !!id && record.stateId.algorithm === id.algorithm && record.stateId.digest === id.digest;
     const matches = same(current2) || same(current2.asRecorded);
-    const partsIgnored = gatePartsProblem(record, current2) ?? void 0;
+    const partsIgnored = gatePartsProblem(record, current2) ?? (matches && record.gateParts === void 0 && current2.parts ? `the record carries none, though every record wairon ${GATE_PARTS_SINCE} and later writes carries them` : void 0);
     const parts = usableGateParts(record, current2);
     const moved = matches || !parts ? null : movedGateParts({ gateParts: parts }, current2.parts);
     const release = matches ? void 0 : releaseVerdict(record, current2);
+    const stampClause = releaseStampProblem(record, WAIRON_VERSION);
+    const stampNamed = release?.reason !== void 0 && release.reason.includes(String(record.validatorVersion ?? "no release stamp"));
+    const stampProblem = stampClause !== null && !stampNamed ? stampClause : void 0;
     const owed = owedBy(record);
     const covered = (matches || release?.carried === true) && owed === void 0;
     return {
@@ -21160,7 +21456,8 @@ function approvalAt(node, ceiling) {
       ...release ? { release } : {},
       ...moved && moved.length > 0 && !release ? { inputsMoved: moved } : {},
       ...owed !== void 0 ? { owed } : {},
-      ...partsIgnored !== void 0 ? { partsIgnored } : {}
+      ...partsIgnored !== void 0 ? { partsIgnored } : {},
+      ...stampProblem !== void 0 ? { stampProblem } : {}
     };
   });
 }
@@ -21251,8 +21548,23 @@ function owedBy(record) {
   for (const [alias, uses] of Object.entries(unrecorded())) {
     reasons.push(`external "${alias}" is used beyond its pin: ${uses.join(", ")} (used now, but not in the lock)`);
   }
+  const unloadable = unloadablePacks();
+  if (unloadable.length > 0) reasons.push(`extension pack(s) selected in .wai/project.yaml cannot load \u2014 ${unloadable.join("; ")}`);
   return reasons.length > 0 ? reasons.join("; ") : void 0;
 }
+function unloadablePacks() {
+  let loaded;
+  try {
+    loaded = loadProjectExtensions();
+  } catch {
+    return [];
+  }
+  return [
+    ...loaded.errors,
+    // A selection that resolved with a warning (unpinned, unfetchable origin) still loaded.
+    ...(loaded.selectionFailures ?? []).filter((f) => f.severity === "error").map((f) => f.message)
+  ];
+}
 function pinOf(parent, alias, subject) {
   if (!parent) return "unpinned";
   const recorded = parent.members ? ownHas(parent.members, alias) ? ownGet(parent.members, alias).subject ?? "never" : void 0 : ownGet(parent.children, alias);
@@ -23425,9 +23737,9 @@ function draftContext(ctx, interfaceId, component) {
   const intf = ctx.interfaceMap.get(interfaceId);
   return ctx.isComponentDraft(component) || intf?.status === "draft" || intf?.status === "design";
 }
-function projectOf(componentKey) {
-  const at = componentKey.lastIndexOf("::");
-  return at < 0 ? "" : componentKey.slice(0, at);
+function projectOf(componentKey2) {
+  const at = componentKey2.lastIndexOf("::");
+  return at < 0 ? "" : componentKey2.slice(0, at);
 }
 function targetComponent(target) {
   return target.slice(0, target.lastIndexOf("."));
@@ -28604,7 +28916,7 @@ function writeCandidates(ctx) {
         }
       }
     };
-    const receiving = (call.receivers ?? []).flatMap((r) => realization.componentsAt(r.path));
+    const receiving = (call.receivers ?? []).flatMap((r) => realization.componentsAt(r.path)).filter((c) => c.id !== caller.id);
     if (receiving.length > 0) {
       for (const callee of receiving) take(callee);
       return out;
@@ -28711,12 +29023,13 @@ function describeMiss(m) {
 var callConformanceRule = {
   name: "call-conformance",
   judges: "code",
-  description: "Code\u2194spec Level 3: the CLAIMED call \u2194 realized call relation, judged both ways against the method's own source file (its sourcePath, else the implementation's), at exact analysis grade only. A method claims a call two ways and they face one check: a narrative `call` step, and an entry of the declared `calls` a narrative-less method reaches its collaborators through. They assert the same thing, and the step number is no part of the claim \u2014 this check never reads order, so it is only how a finding points at one. Forward: every claim must be realized by a call whose callee RESOLVES TO one of the target method's own source files \u2014 the target's contract name or a per-method `symbol` override, closed transitively over the named helpers the realized function calls, and resolved against every file the call CAN have reached: a `this.<field>.<method>()` receiver followed through the field's DECLARED TYPE, a `new Class(...).<method>()` receiver through the module its CLASS NAME came from, a plain `<name>.<method>()` receiver through the type the file ANNOTATES that name with \u2014 a parameter's, or an annotated variable's, which is how a module that wires its collaborators as closures writes every one of its calls \u2014 a `fn(...).<method>()` receiver through the type fn RETURNS where the code settles it, and a `this.<method>()` receiver through the class whose own method it sits in, and a receiver CHAIN (`this.<field>.<property>.<method>()`, `<name>.<property>.<method>()`) link by link through each link's declared type \u2014 a declared type read through a member-preserving utility (Pick, Omit, Partial, Required, Readonly) and one alias hop; a package specifier naming a package of this repository resolves like a relative one, and an export alias (`export { a as b }`, an adapter object property `{ b: a }`) forwards by identity like a re-export. A matching call whose origin a pure model cannot resolve is reported apart as CALL_ORIGIN_UNRESOLVED, which NAMES the shape it could not follow and asks for nothing \u2014 a coverage hole in the reader, reported for the reason CONFORMANCE_DEGRADED is: a silently degraded gate is worse than a degraded one. Where that claim's target has no code yet \u2014 no file any of its implementations names exists, the normal state after the first component of a service is implemented from its brief through a port to a collaborator still planned \u2014 the call is planned rather than unresolved (CALL_TARGET_PLANNED, a notice, as SOURCE_FILE_PLANNED is), and it is judged like any other claim once the target's realization begins. A finding names a landing only from the PROVEN tier so that widening what a call reached can accept a claim but never accuse one, and a target that names no file of its own falls back to name membership. Where a type checker read the file, a claim is also realized by any call or reference in the bodies the function reaches \u2014 and in the unowned code they call \u2014 that the checker lands on the target: its file under a name it is realized by, a class realizing the port the call was typed by, or what the target forwards to by identity \u2014 whatever the receiver's spelling (a type-only or `export *` barrel, a port declared in a shared module, a dependency bag typed inline); a claim it does not land keeps the shape tier's answer, since the checker's landing on a declaration says what a receiver is TYPED as, never where the call went instead. N:1 identity \u2014 a caller that IS the target \u2014 is judged on the body, the same anchor in the same file, never on a shared name: a Portal method forwarding to a same-named Orchestrator method elsewhere must make that call. Converse: a call that resolves to a modelled method of ANOTHER component in the SAME file crosses a component boundary while looking local, so the method must claim it \u2014 in a step or in `calls` (UNDECLARED_COLOCATED_CALL) \u2014 judged on the proven tier alone, and a same-file private helper is no modelled method and is never reported; a function forwarding by identity to a modelled method written in another file IS that method, so what it calls is that method's subject. And a call \u2014 or a reference the code takes as a value \u2014 that the TypeScript type checker resolves into ANOTHER file, onto a write- or lifecycle-effect contract method of another component, or, from a Portal method whose body is its own, onto a verb of an Orchestrator, Supervisor or Actor whose effect is a write \u2014 declared (write, lifecycle or io), or, where its contract declares none, read off the verb's own narrative transitively: a call step or declared call reaching a method that changes state makes it a write, only reads or none a read, and a verb that settles nothing (no narrative and no declared calls, a dispatch step, a target outside this tree, a non-workflow method declaring no effect) is reported as an unnarrated call whose effect is undeclared, never as a write (a Portal changes state only by dispatching to such a verb, so its narrative is the list of those it may reach), that the method claims nowhere is a mutation the design says the method never makes (UNDECLARED_WRITE_CALL): narrate it, declare it in `calls`, or remove it \u2014 judged in the bodies the method's function reaches and in the UNOWNED code they call (a function in a file no component realizes, or one that is none of its file's components' modelled methods, read as if inlined at the call site, transitively to a bounded depth, the finding naming the hops \u2014 but a member of the CLASS a workflow component (Orchestrator, Supervisor, Actor) is realized by, one of the classes holding its modelled methods, is that component's code even where its contract does not declare it, so the walk stops there: a claim the function answers by calling such a member in place of the claimed method is CALL_STEP_UNREALIZED naming the method the code calls instead, the shape a rename made in the code alone leaves, and a Portal's call to one no missed claim names is an unnarrated call to a method whose effect no narrative settles, never read through its body as the Portal's own write), never for a Portal's call into a data component (PORTAL_WRITE_SHORTCUT_IN_CODE's subject), and only where a type checker was loaded. A call there the checker cannot follow \u2014 its receiver typed any or unknown, cast to either or to an index signature, typed by an index signature naming no member of that name, or its member picked by a computed key \u2014 under the name of such a write the method claims nowhere (where the checker recorded the receiver's original type \u2014 every cast, non-null mark and parenthesis taken off, an `await (x)` written outside an async function read as the x it means, nullability set aside so an optional field is the class it holds, a name bound once by a const read through its initializer, and an interface or shape no class realizes landing on the file declaring it \u2014 a write of the component that type lands on, any of its writes when a computed key names none; else a write of that name in the method's own subsystem or one its component depends into) fails closed as CALL_ORIGIN_UNRESOLVED: neither proven an unnarrated write nor cleared. A member picked by a key that names no single member, on a receiver that was one of this project's classes before any cast, is such a call however the receiver or the key is cast and whether it is invoked on the spot or taken as a value and invoked later (`const f = store[k]; f.call(store, \u2026)`); a key the checker types as one literal names its member by that literal's value, never by the variable holding it. A method that claims nothing at all is judged in neither direction: what it leaves unsaid is UNUSED_*'s subject. Order, arguments and conditions stay unverified, dispatch steps (runtime-table routed) are no claim about a call site, a malformed declared reference is MALFORMED_DECLARED_CALL's finding and names no target here, the conformance dial (off) skips, and weaker analysis grades never guess.",
+  description: "Code\u2194spec Level 3: the CLAIMED call \u2194 realized call relation, judged both ways against the method's own source file (its sourcePath, else the implementation's), at exact analysis grade only. A method claims a call two ways and they face one check: a narrative `call` step, and an entry of the declared `calls` a narrative-less method reaches its collaborators through. They assert the same thing, and the step number is no part of the claim \u2014 this check never reads order, so it is only how a finding points at one. Forward: every claim must be realized by a call whose callee RESOLVES TO one of the target method's own source files \u2014 the target's contract name or a per-method `symbol` override, closed transitively over the named helpers the realized function calls, and resolved against every file the call CAN have reached: a `this.<field>.<method>()` receiver followed through the field's DECLARED TYPE, a `new Class(...).<method>()` receiver through the module its CLASS NAME came from, a plain `<name>.<method>()` receiver through the type the file ANNOTATES that name with \u2014 a parameter's, or an annotated variable's, which is how a module that wires its collaborators as closures writes every one of its calls \u2014 a `fn(...).<method>()` receiver through the type fn RETURNS where the code settles it, and a `this.<method>()` receiver through the class whose own method it sits in, and a receiver CHAIN (`this.<field>.<property>.<method>()`, `<name>.<property>.<method>()`) link by link through each link's declared type \u2014 a declared type read through a member-preserving utility (Pick, Omit, Partial, Required, Readonly) and one alias hop; a package specifier naming a package of this repository resolves like a relative one, and an export alias (`export { a as b }`, an adapter object property `{ b: a }`) forwards by identity like a re-export. A matching call whose origin a pure model cannot resolve is reported apart as CALL_ORIGIN_UNRESOLVED, which NAMES the shape it could not follow and asks for nothing \u2014 a coverage hole in the reader, reported for the reason CONFORMANCE_DEGRADED is: a silently degraded gate is worse than a degraded one. Where that claim's target has no code yet \u2014 no file any of its implementations names exists, the normal state after the first component of a service is implemented from its brief through a port to a collaborator still planned \u2014 the call is planned rather than unresolved (CALL_TARGET_PLANNED, a notice, as SOURCE_FILE_PLANNED is), and it is judged like any other claim once the target's realization begins. A finding names a landing only from the PROVEN tier so that widening what a call reached can accept a claim but never accuse one, and a target that names no file of its own falls back to name membership. Where a type checker read the file, a claim is also realized by any call or reference in the bodies the function reaches \u2014 and in the unowned code they call \u2014 that the checker lands on the target: its file under a name it is realized by, a class realizing the port the call was typed by, or what the target forwards to by identity \u2014 whatever the receiver's spelling (a type-only or `export *` barrel, a port declared in a shared module, a dependency bag typed inline); a claim it does not land keeps the shape tier's answer, since the checker's landing on a declaration says what a receiver is TYPED as, never where the call went instead. N:1 identity \u2014 a caller that IS the target \u2014 is judged on the body, the same anchor in the same file, never on a shared name: a Portal method forwarding to a same-named Orchestrator method elsewhere must make that call. Converse: a call that resolves to a modelled method of ANOTHER component in the SAME file crosses a component boundary while looking local, so the method must claim it \u2014 in a step or in `calls` (UNDECLARED_COLOCATED_CALL) \u2014 judged on the proven tier alone, and a same-file private helper is no modelled method and is never reported; a function forwarding by identity to a modelled method written in another file IS that method, so what it calls is that method's subject. And a call \u2014 or a reference the code takes as a value \u2014 that the TypeScript type checker resolves into ANOTHER file, onto a write- or lifecycle-effect contract method of another component, or, from a Portal method whose body is its own, onto a verb of an Orchestrator, Supervisor or Actor whose effect is a write \u2014 declared (write, lifecycle or io), or, where its contract declares none, read off the verb's own narrative transitively: a call step or declared call reaching a method that changes state makes it a write, only reads or none a read, and a verb that settles nothing (no narrative and no declared calls, a dispatch step, a target outside this tree, a non-workflow method declaring no effect) is reported as an unnarrated call whose effect is undeclared, never as a write (a Portal changes state only by dispatching to such a verb, so its narrative is the list of those it may reach), that the method claims nowhere is a mutation the design says the method never makes (UNDECLARED_WRITE_CALL): narrate it, declare it in `calls`, or remove it \u2014 judged in the bodies the method's function reaches and in the UNOWNED code they call (a function in a file no component realizes, or one that is none of its file's components' modelled methods, read as if inlined at the call site, transitively to a bounded depth, the finding naming the hops \u2014 but a member of the CLASS a workflow component (Orchestrator, Supervisor, Actor) is realized by, one of the classes holding its modelled methods, is that component's code even where its contract does not declare it, so the walk stops there: a claim the function answers by calling such a member in place of the claimed method is CALL_STEP_UNREALIZED naming the method the code calls instead, the shape a rename made in the code alone leaves, and a Portal's call to one no missed claim names is an unnarrated call to a method whose effect no narrative settles, never read through its body as the Portal's own write), never for a Portal's call into a data component (PORTAL_WRITE_SHORTCUT_IN_CODE's subject), and only where a type checker was loaded. A call there the checker cannot follow, or a member read by name off such a receiver and taken as a value (`const f = (store as any).save; f(x)`) \u2014 its receiver typed any or unknown however it came to be (a cast, an untyped or any-typed parameter of a closure, a function result typed any), cast to either or to an index signature, typed by an index signature naming no member of that name, or its member picked by a computed key \u2014 under the name of such a write the method claims nowhere (where the checker recorded the receiver's original type \u2014 every cast, non-null mark and parenthesis taken off, an `await (x)` written outside an async function read as the x it means, nullability set aside so an optional field is the class it holds, a name bound once by a const read through its initializer, and an interface or shape no class realizes landing on the file declaring it \u2014 a write of the component that type lands on, any of its writes when a computed key names none; else a write of that name in the method's own subsystem or one its component depends into \u2014 the design's write set, which a data component whose code is still planned has too; a receiver landing only on the caller's own file, a port it declares for itself, leaves it to that name as well) fails closed as CALL_ORIGIN_UNRESOLVED: neither proven an unnarrated write nor cleared. A member picked by a key that names no single member, on a receiver that was one of this project's classes before any cast, is such a call however the receiver or the key is cast and whether it is invoked on the spot or taken as a value and invoked later (`const f = store[k]; f.call(store, \u2026)`); a key the checker types as one literal names its member by that literal's value, never by the variable holding it. A method that claims nothing at all is judged in neither direction: what it leaves unsaid is UNUSED_*'s subject. Order, arguments and conditions stay unverified, dispatch steps (runtime-table routed) are no claim about a call site, a malformed declared reference is MALFORMED_DECLARED_CALL's finding and names no target here, the conformance dial set off skips the forward direction \u2014 whether the claims are found in the code \u2014 but never the converse, so off is no way past an unnarrated write or a call the analysis cannot follow; a claim whose target's code is in ANOTHER language than the caller's file (every file the target's implementations name is in a language a TypeScript call graph does not read, or, naming none, the member or project it belongs to declares such a target language) is not judged by this call graph at all, and the language boundary is said once per project and language (CALL_ACROSS_LANGUAGE, a notice) \u2014 never as an unrealized call no code could ever clear, since what crosses that boundary is the binding; and weaker analysis grades never guess.",
   codes: [
     { code: "CALL_STEP_UNREALIZED", defaultSeverity: "warning", summary: "Narrative call step or declared call realized by no call that resolves to the target method's own source file \u2014 the call is absent, or it lands in another module", carryable: true },
     { code: "CALL_ORIGIN_UNRESOLVED", defaultSeverity: "warning", summary: "Narrative call step or declared call whose target name IS called, but only from call sites written in a shape this analysis cannot resolve to a file \u2014 the claim was not checked, and is neither proven realized nor accused; or, the fail-closed half of UNDECLARED_WRITE_CALL, a call through a receiver the analysis cannot follow (typed any or unknown, cast to either or to an index signature, a computed key) under the name of a write the method claims nowhere. Where a type checker read the file, whatever the checker resolves; without one, what resolves is a name bound to a module of THIS project: a bare or namespaced call through such an import binding, a this.<field> receiver whose declared type names one, a receiver chain (this.<field>.<property>, <name>.<property>) each of whose links the code declares a type for, a new Class(\u2026) receiver whose class does, a receiver name the file annotates with such a type, a fn(\u2026) receiver whose return the code settles, and this inside a class's own method \u2014 a declared type read through Pick/Omit/Partial/Required/Readonly and one alias hop. What does not: a third-party package import, a value the module assembled, and a receiver the file declares nothing for", carryable: true },
     { code: "UNDECLARED_COLOCATED_CALL", defaultSeverity: "warning", summary: "The realized function calls a modelled method of another component living in the same source file, and neither a narrative step nor a declared call names it", carryable: true },
     { code: "UNDECLARED_WRITE_CALL", defaultSeverity: "warning", summary: "The realized function, or unowned code it calls, calls or takes as a value a write- or lifecycle-effect method of another component in another file \u2014 or, from a Portal, a workflow verb whose effect, declared or read off its own narrative, is a write, or that nothing settles (said as an unnarrated call whose effect is undeclared), or a method of a workflow component's class its contract does not declare \u2014 as the type checker resolves it, and neither a narrative step nor a declared call names it \u2014 an unnarrated mutation", carryable: true },
+    { code: "CALL_ACROSS_LANGUAGE", defaultSeverity: "notice", summary: "Claimed calls from TypeScript or JavaScript code reach a component whose code is in another language (a member or project written in Rust, say): the call graph cannot resolve into it, so the claims are not judged by it, and the boundary is said once per project and language" },
     { code: "CALL_TARGET_PLANNED", defaultSeverity: "notice", summary: "A narrative call step or declared call written by name through a receiver nothing realizes yet, whose target component has no code yet (no file its implementations name exists) \u2014 planned, not unresolved; judged like any other claim once the target's realization begins" }
   ],
   check(ctx) {
@@ -28815,10 +29128,26 @@ var callConformanceRule = {
       for (const claim of claimsOf(entry.method)) refs.add(`${claim.component}.${claim.method}`);
       claimsByBody.set(key2, refs);
     }
+    const script = (language) => language === "typescript" || language === "javascript";
+    const foreignLanguageOf = (callerFile, target, componentId) => {
+      if (!script(languageOfSourcePath(callerFile))) return void 0;
+      const sep18 = componentId.indexOf("::");
+      const project3 = sep18 > 0 ? componentId.slice(0, sep18) : "this project";
+      if (target.files.size > 0) {
+        const languages = new Set([...target.files].map((f) => languageOfSourcePath(f)));
+        if ([...languages].some((l) => l === void 0 || script(l))) return void 0;
+        return { project: project3, language: [...languages].sort().join(" and ") };
+      }
+      if (sep18 <= 0) return void 0;
+      const node = (ctx.projectFamily?.nodes ?? []).find((n) => n.namespace === project3 || n.mountAlias === project3 || n.id === project3);
+      const declared = node?.targetLanguage?.toLowerCase();
+      if (!node || !declared || /typescript|javascript/.test(declared)) return void 0;
+      return { project: project3, language: node.targetLanguage };
+    };
+    const boundaries = /* @__PURE__ */ new Map();
     for (const entry of methods) {
       const { implementation: impl, method: implMethod, component, sourceFile: file } = entry;
-      const tier = implMethod.conformance ?? impl.conformance ?? defaultConformanceTier(component);
-      if (tier === "off") continue;
+      const off = (implMethod.conformance ?? impl.conformance ?? defaultConformanceTier(component)) === "off";
       if (!implMethod.narrative.length && !implMethod.calls?.length) continue;
       if (!file) continue;
       const facts = code.factsAt(file);
@@ -28848,10 +29177,18 @@ var callConformanceRule = {
       const missed = [];
       const plannedClaims = [];
       const hinted = /* @__PURE__ */ new Set();
-      for (const claim of claimsOf(implMethod)) {
+      for (const claim of off ? [] : claimsOf(implMethod)) {
         if (!ctx.componentMap.has(claim.component)) continue;
         if (isRemoteLink(component, ctx.componentMap.get(claim.component))) continue;
         const target = resolveCallTarget(ctx, claim.component, claim.method);
+        const foreign = foreignLanguageOf(file, target, claim.component);
+        if (foreign) {
+          const key2 = `${foreign.project}|${foreign.language}`;
+          const boundary = boundaries.get(key2) ?? { ...foreign, from: languageOfSourcePath(file) ?? "unknown", anchor: impl.id, draft: entry.draftContext, units: [] };
+          boundary.units.push(`${impl.id}.${implMethod.name} \u2192 ${claim.component}.${claim.method}`);
+          boundaries.set(key2, boundary);
+          continue;
+        }
         if (target.bodies.has(bodyKey(here, fnSymbol, implMethod.exportedVia))) continue;
         const sharedBody = targetForwards(code, target);
         if (code.forwardsOf(file, fnSymbol, implMethod.exportedVia).some((p) => p.file !== here && sharedBody.has(`${p.file}#${p.name}`))) continue;
@@ -29032,7 +29369,7 @@ var callConformanceRule = {
           if (call.unresolved) {
             for (const ref of unresolvedCandidates(call, component)) {
               if (!unclaimed(ref) || unresolvedWrites.has(ref)) continue;
-              unresolvedWrites.set(ref, `\`${call.written}(\u2026)\`${throughText(through)}`);
+              unresolvedWrites.set(ref, `${call.reference ? `\`${call.written}\` (taken as a value)` : `\`${call.written}(\u2026)\``}${throughText(through)}`);
             }
           }
         }
@@ -29071,6 +29408,18 @@ var callConformanceRule = {
         }
       }
     }
+    for (const boundary of boundaries.values()) {
+      const where = boundary.project === "this project" ? "components of this project" : `the project "${boundary.project}"`;
+      ctx.addIssue(
+        "notice",
+        "CALL_ACROSS_LANGUAGE",
+        `${boundary.units.length} claimed call(s) from ${boundary.from} code reach ${where}, whose code is ${boundary.language} \u2014 ${boundary.units.join("; ")}. A ${boundary.from} call graph never resolves into a ${boundary.language} file, so these claims are not judged by it, and calling them unrealized would be a finding no code could ever clear. What crosses the boundary is the binding: declare the module that carries it in the implementation's \`bindings\`, which is compared with what the other side exports.`,
+        boundary.anchor,
+        boundary.draft,
+        void 0,
+        { at: boundary.project, covers: boundary.units }
+      );
+    }
   }
 };
 
@@ -29136,13 +29485,14 @@ var UNOWNED_IMPORT_DEPTH = 8;
 var dependencyConformanceRule = {
   name: "dependency-conformance",
   judges: "code",
-  description: "Code\u2194spec Level 2: runtime import edges between component-mapped source files (a component maps to every file its implementations and their methods name) must be justified by declared relations \u2014 a direct dependsOn/owns pair, a shared component, membership in a depended-on pattern, or (across subsystems) a declared edge to the target subsystem's published surface (UNDECLARED_DEPENDENCY). A type-only import alone never accuses \u2014 type coupling is allowed \u2014 but a CALL of a modelled contract method through a collaborator whose declared type comes from another component's file is runtime collaboration whatever the import's form, and the same justification is owed (UNDECLARED_DEPENDENCY on that edge). Conversely, a declared dependsOn/owns edge between components realized in different files should be visible as an import between any file of the source and any file of the target, or \u2014 where the type checker read a file of the source \u2014 as a call or reference the checker lands in a file of the target, through every barrel, port declaration, dependency bag and unowned helper (UNREALIZED_DEPENDENCY \u2014 DI indirection can defeat the import reading, hence warning); a type-only import realizes it, since `import type` is what dependency injection writes down. An Adapter's edge to a Portal reached over an out-of-process transport (HTTP, gRPC, a bus, a CLI\u2026) is the link the design models: the Adapter's transport client realizes it, never an import, so it is never UNREALIZED_DEPENDENCY \u2014 and nothing asks for an import across that boundary, which would couple two deployables' builds. Two twins of design rules are judged on the same code: a Portal file calling a write- or lifecycle-effect contract method of a Repository, Index, Store or Registry is the persistence shortcut the design rule PORTAL_WRITE_SHORTCUT refuses, unless the Portal's own narrative already claims that call (the design rule's finding then) (PORTAL_WRITE_SHORTCUT_IN_CODE). A Portal's calls are resolved by the TypeScript type checker: every call written in a file realizing only Portals \u2014 in a file shared with other components, every call in a body the Portal's own methods reach \u2014 and every reference there to a function or method the code takes as a value (passed as an argument, assigned, returned, bound, handed to Reflect.apply), together with every call the UNOWNED code they reach makes (a function in a file no component realizes, or one that is none of its file's components' modelled methods, read as if inlined at the call site, transitively to a bounded depth, the finding naming the hops), lands on the declaration its signature resolves to, whatever the receiver's spelling, and a declaration in an interface or type shape, a port the Portal declares for itself included, lands on each class of the project that realizes it (the classes whose implements clause names it when any does, else every class the checker finds assignable to it); such a landing on a component the file neither imports at runtime nor is justified to reach is UNDECLARED_DEPENDENCY on that edge. Where no type checker could be loaded, the receiver is followed through the shape facts instead: a non-null assertion, parentheses, `satisfies`, a cast to a named type and a local alias or destructuring of a field exactly as through the field itself. A call in a Portal's own code the analysis cannot resolve at all \u2014 its receiver typed any or unknown, cast to either or to an index signature, its member picked by a computed key, or typed nothing \u2014 under the name of a write- or lifecycle-effect method of a data component, or reading a member by a key that names no single member off a receiver that was a data component before any cast \u2014 invoked on the spot or taken as a value, however the receiver or the key is cast (where the checker recorded the receiver's ORIGINAL type, before any cast \u2014 an `await (x)` written outside an async function read as the x it means, nullability set aside, a name bound once by a const read through its initializer, an interface no class realizes landing on the file declaring it \u2014 a write of the data component that type lands on \u2014 any of its writes when a computed key names none; else one in the Portal's own subsystem or one it depends into), which the Portal does not already claim, fails closed: it is neither proven a shortcut nor cleared, and it is a warning, so a CI gate never passes what it could not read (PORTAL_CALL_UNRESOLVED). So does a call landing only on a PORT no written class realizes \u2014 a member of an interface or shape declared where no component's contract answers for it \u2014 under the name of such a write the Portal claims nowhere and no narrative of the Portal names on any component: the design says what that port will be before the code realizing it is written, and the finding says when the data component has no code yet. And an import, runtime or type-only, from ANOTHER project's source \u2014 a folder holding its own .wai/project.yaml that is not this project's root \u2014 that the type checker resolves to nothing, the module gone or the name no longer exported, is CROSS_PROJECT_IMPORT_UNRESOLVED: another project's code moves on its own release, and a type-only import of it is erased at run time, so only a compiler would notice. And a file importing a technology's package \u2014 itself, or through the UNOWNED modules it imports (a module no component realizes, read as if inlined in its importer, transitively to a bounded depth, the finding naming the hops; a module a component realizes is judged as its own) \u2014 while no component it realizes is that technology's home is the leak TECH_LEAKAGE refuses in the design (TECH_LEAKAGE_IN_CODE): a technology's packages are its declared tokens (its name, or its `matches`), the curated built-in table of the common packages its name is known by (postgres: pg, postgres, @neondatabase/serverless, @vercel/postgres; mysql: mysql2, mysql; redis: redis, ioredis; mongodb: mongodb, mongoose; sqlite: better-sqlite3, sqlite3; kafka: kafkajs; rabbitmq: amqplib \u2014 an HTTP client is never a technology leak), and the packages a loaded pack contributes for it, each compared exactly with an import's package name. A package of the built-in table or of a loaded pack whose technology NO implementation binds is reported too, since the design never says where that technology lives: bind it on the data-layer component that owns the vendor call. Only exact-grade analyzed files participate; chained subprojects validate standalone.",
+  description: "Code\u2194spec Level 2: runtime import edges between component-mapped source files (a component maps to every file its implementations and their methods name) must be justified by declared relations \u2014 a direct dependsOn/owns pair, a shared component, membership in a depended-on pattern, or (across subsystems) a declared edge to the target subsystem's published surface (UNDECLARED_DEPENDENCY). A type-only import alone never accuses \u2014 type coupling is allowed \u2014 but a CALL of a modelled contract method through a collaborator whose declared type comes from another component's file is runtime collaboration whatever the import's form, and the same justification is owed (UNDECLARED_DEPENDENCY on that edge). Conversely, a declared dependsOn/owns edge between components realized in different files should be visible as an import between any file of the source and any file of the target, or \u2014 where the type checker read a file of the source \u2014 as a call or reference the checker lands in a file of the target, through every barrel, port declaration, dependency bag and unowned helper (UNREALIZED_DEPENDENCY \u2014 DI indirection can defeat the import reading, hence warning); a type-only import realizes it, since `import type` is what dependency injection writes down. An Adapter's edge to a Portal reached over an out-of-process transport (HTTP, gRPC, a bus, a CLI\u2026) is the link the design models: the Adapter's transport client realizes it, never an import, so it is never UNREALIZED_DEPENDENCY \u2014 and nothing asks for an import across that boundary, which would couple two deployables' builds. Two twins of design rules are judged on the same code: a Portal file calling a write- or lifecycle-effect contract method of a Repository, Index, Store or Registry is the persistence shortcut the design rule PORTAL_WRITE_SHORTCUT refuses, unless the Portal's own narrative already claims that call (the design rule's finding then) (PORTAL_WRITE_SHORTCUT_IN_CODE). A Portal's calls are resolved by the TypeScript type checker: every call written in a file realizing only Portals \u2014 in a file shared with other components, every call in a body the Portal's own methods reach \u2014 and every reference there to a function or method the code takes as a value (passed as an argument, assigned, returned, bound, handed to Reflect.apply), together with every call the UNOWNED code they reach makes (a function in a file no component realizes, or one that is none of its file's components' modelled methods, read as if inlined at the call site, transitively to a bounded depth, the finding naming the hops), lands on the declaration its signature resolves to, whatever the receiver's spelling, and a declaration in an interface or type shape, a port the Portal declares for itself included, lands on each class of the project that realizes it (the classes whose implements clause names it when any does, else every class the checker finds assignable to it); such a landing on a component the file neither imports at runtime nor is justified to reach is UNDECLARED_DEPENDENCY on that edge. Where no type checker could be loaded, the receiver is followed through the shape facts instead: a non-null assertion, parentheses, `satisfies`, a cast to a named type and a local alias or destructuring of a field exactly as through the field itself. A call in a Portal's own code the analysis cannot resolve at all \u2014 its receiver typed any or unknown however it came to be (a cast, an untyped or any-typed parameter of a closure, a local typed any, a function result typed any), cast to either or to an index signature, its member picked by a computed key, or typed nothing \u2014 under the name of a write- or lifecycle-effect method of a data component, or reading a member by a key that names no single member off a receiver that was a data component before any cast \u2014 invoked on the spot or taken as a value, however the receiver or the key is cast (where the checker recorded the receiver's ORIGINAL type, before any cast \u2014 an `await (x)` written outside an async function read as the x it means, nullability set aside, a name bound once by a const read through its initializer, an interface no class realizes landing on the file declaring it \u2014 a write of the data component that type lands on \u2014 any of its writes when a computed key names none; else one in the Portal's own subsystem or one it depends into \u2014 the design's write set, which a data component whose code is still planned has too, and what a receiver landing only on the Portal's own file, a port it declares for itself, is judged by), which the Portal does not already claim, fails closed \u2014 one finding per site and per function it is written in, so one shortcut never hides another of the same name: it is neither proven a shortcut nor cleared, and it is a warning, so a CI gate never passes what it could not read (PORTAL_CALL_UNRESOLVED). So does a call landing only on a PORT no written class realizes \u2014 a member of an interface or shape declared where no component's contract answers for it \u2014 under the name of such a write the Portal claims nowhere and no narrative of the Portal names on any component: the design says what that port will be before the code realizing it is written, and the finding says when the data component has no code yet. And an import, runtime or type-only, from ANOTHER project's source \u2014 a folder holding its own .wai/project.yaml that is not this project's root \u2014 that the type checker resolves to nothing, the module gone or the name no longer exported, is CROSS_PROJECT_IMPORT_UNRESOLVED: another project's code moves on its own release, and a type-only import of it is erased at run time, so only a compiler would notice. One that DOES resolve is judged like any other edge, because it is one: a name it imports that the other project does not publish \u2014 not in its L0 export table as a member exports it now, nor in the pinned snapshot of the external it is (an exported type by its id or code name, an exported component by its contract methods and their code symbols; a project that is neither publishes nothing to this one) \u2014 is code reaching into that project's internals past its surface, which no pin and no binding compares (CROSS_PROJECT_SOURCE_IMPORT, a warning; the finding says when the module it lands in realizes a data component of that project, since a write through it is the persistence shortcut past the other project's surface). A binding module an implementation declares is the sanctioned place for exactly that reach, compared by binding conformance, so an import written in one is never reported here. And a file importing a technology's package \u2014 itself, or through the UNOWNED modules it imports (a module no component realizes, read as if inlined in its importer, transitively to a bounded depth, the finding naming the hops; a module a component realizes is judged as its own) \u2014 while no component it realizes is that technology's home is the leak TECH_LEAKAGE refuses in the design (TECH_LEAKAGE_IN_CODE): a technology's packages are its declared tokens (its name, or its `matches`), the curated built-in table of the common packages its name is known by (postgres: pg, postgres, @neondatabase/serverless, @vercel/postgres; mysql: mysql2, mysql; redis: redis, ioredis; mongodb: mongodb, mongoose; sqlite: better-sqlite3, sqlite3; kafka: kafkajs; rabbitmq: amqplib \u2014 an HTTP client is never a technology leak), and the packages a loaded pack contributes for it, each compared exactly with an import's package name. A package of the built-in table or of a loaded pack whose technology NO implementation binds is reported too, since the design never says where that technology lives: bind it on the data-layer component that owns the vendor call. Only exact-grade analyzed files participate; chained subprojects validate standalone.",
   codes: [
     { code: "UNDECLARED_DEPENDENCY", defaultSeverity: "warning", summary: "A runtime import, a call through a type-only-imported collaborator, or a Portal's call the type checker resolves into another component's file, between component-mapped files has no declared dependsOn/owns (or published-surface) justification" },
     { code: "PORTAL_WRITE_SHORTCUT_IN_CODE", defaultSeverity: "error", summary: "A Portal's code calls, or takes as a value, a write- or lifecycle-effect method of a data component (Repository, Index, Store, Registry) \u2014 directly or through unowned code it calls \u2014 the code twin of PORTAL_WRITE_SHORTCUT: mutations route through an Orchestrator" },
     { code: "TECH_LEAKAGE_IN_CODE", defaultSeverity: "warning", summary: "A source file imports a technology's package although no component it realizes binds that technology \u2014 the code twin of TECH_LEAKAGE" },
     { code: "UNREALIZED_DEPENDENCY", defaultSeverity: "warning", summary: "A declared dependsOn/owns edge between components in different files is realized by no import between any of their files, nor by any call the type checker lands across it" },
     { code: "PORTAL_CALL_UNRESOLVED", defaultSeverity: "warning", summary: "A call in a Portal's own code, under the name of a data component's write- or lifecycle-effect method \u2014 or with its member picked by a computed key on a receiver that was a data component before a cast \u2014 goes through a receiver the analysis cannot resolve (typed any or unknown, cast to either or to an index signature, or typed nothing), or lands only on a port no written class realizes \u2014 neither proven a shortcut nor cleared, so it fails closed until the receiver carries its type" },
+    { code: "CROSS_PROJECT_SOURCE_IMPORT", defaultSeverity: "warning", summary: "A source file imports a name from ANOTHER project's source that the project does not export \u2014 code reaching into its internals past its surface, which no pin and no binding compares (a write into its Store through it included); a declared binding module is the sanctioned place for that reach", carryable: true },
     { code: "CROSS_PROJECT_IMPORT_UNRESOLVED", defaultSeverity: "warning", summary: "A source file imports from ANOTHER project's source \u2014 a folder holding its own .wai/project.yaml \u2014 a module that is gone or a name it no longer exports: a type-only import is erased at run time, so only a compiler would notice, and the gate reads the file with one", carryable: true }
   ],
   check(ctx) {
@@ -29437,8 +29787,8 @@ var dependencyConformanceRule = {
             const near = /* @__PURE__ */ new Set([portal.subsystem, ...portal.dependsOn.map((d) => ctx.componentMap.get(d)?.subsystem)]);
             const candidates = (call.call ? candidatesOf(call.call, portal, (callee) => DATA_COMPONENTS2.has(callee.componentType)) : (dataWrites.get(call.name) ?? []).filter((w) => near.has(ctx.componentMap.get(w.component)?.subsystem))).filter((w) => !claims(portal.id, w.component, w.method));
             const at = `${fromPath} -> ${call.name || candidates.map((w) => `${w.component}.${w.method}`).join(", ")}`;
-            if (candidates.length > 0 && !reportedUnresolved.has(at)) {
-              reportedUnresolved.add(at);
+            if (candidates.length > 0 && !reportedUnresolved.has(`${at}|${call.where}`)) {
+              reportedUnresolved.add(`${at}|${call.where}`);
               ctx.addIssue(
                 "warning",
                 "PORTAL_CALL_UNRESOLVED",
@@ -29610,6 +29960,7 @@ var dependencyConformanceRule = {
     }
     for (const facts of ctx.codeModel.files) {
       for (const broken of facts.crossProjectImports ?? []) {
+        if (broken.resolved) continue;
         const file = pathKey(facts.path);
         const what = broken.name !== void 0 ? `"${broken.name}" from "${broken.specifier}"` : `"${broken.specifier}"`;
         ctx.addIssue(
@@ -29623,8 +29974,97 @@ var dependencyConformanceRule = {
         );
       }
     }
+    const bindingFiles = new Set(ctx.implementations.flatMap((impl) => impl.bindings ?? []).map(pathKey));
+    const surfaces = /* @__PURE__ */ new Map();
+    const surfaceOf = (project3) => {
+      if (surfaces.has(project3)) return surfaces.get(project3);
+      const answer = projectSurface(ctx, project3);
+      surfaces.set(project3, answer);
+      return answer;
+    };
+    for (const facts of ctx.codeModel.files) {
+      const file = pathKey(facts.path);
+      if (bindingFiles.has(file)) continue;
+      const reaches = (facts.crossProjectImports ?? []).filter((fact) => fact.resolved);
+      const bySpecifier = /* @__PURE__ */ new Map();
+      for (const reach3 of reaches) bySpecifier.set(reach3.specifier, [...bySpecifier.get(reach3.specifier) ?? [], reach3]);
+      for (const [specifier, list] of bySpecifier) {
+        const first = list[0];
+        const surface = surfaceOf(first.project);
+        const internal = list.filter((reach3) => !(surface && reach3.name !== void 0 && reach3.name !== "*" && surface.names.has(nameKey2(reach3.name))));
+        if (internal.length === 0) continue;
+        const names = internal.map((reach3) => reach3.name === void 0 ? "the module itself" : reach3.name === "*" ? "the whole module" : `"${reach3.name}"`);
+        const owner = first.module !== void 0 ? surface?.data.get(first.module) : void 0;
+        const writes = owner !== void 0 ? ` "${first.module}" realizes ${owner} of that project: a write through it is the persistence shortcut past the other project's surface, and at least as serious as an undeclared dependency.` : "";
+        const label7 = surface?.label ?? `"${first.project}"`;
+        ctx.addIssue(
+          "warning",
+          "CROSS_PROJECT_SOURCE_IMPORT",
+          `"${file}" imports ${names.join(", ")} from "${specifier}" (line ${first.line}), the SOURCE of another project, ${label7}, which ${surface ? "does not export that name" : "exports nothing this project can reach"} \u2014 code reaching into that project's internals past its surface, which no pin and no binding compares.${writes} Reach what the project exports (its L0 export table: declare it there, then use it through the member alias or a pinned external), or carry the reach in a binding module the implementation declares (\`bindings\`), which is compared with what the project exports.`,
+          realization.implementationsAt(file)[0]?.id,
+          draftAt(file),
+          void 0,
+          { at: `${file} -> ${specifier}`, covers: internal.map((reach3) => reach3.name ?? "<module>") }
+        );
+      }
+    }
   }
 };
+var nameKey2 = (name) => name.toLowerCase().replace(/[^a-z0-9]/g, "");
+function projectSurface(ctx, project3) {
+  const root = import_path.posix.normalize(ctx.codeModel.projectRoot.replace(/\\/g, "/"));
+  const directory = import_path.posix.normalize(import_path.posix.join(root, project3));
+  const same = (dir) => !!dir && import_path.posix.normalize(dir.replace(/\\/g, "/")).toLowerCase() === directory.toLowerCase();
+  const names = /* @__PURE__ */ new Set();
+  const data = /* @__PURE__ */ new Map();
+  const DATA = /* @__PURE__ */ new Set(["Repository", "Index", "Store", "Registry"]);
+  const family = ctx.projectFamily?.nodes ?? [];
+  const member = family.find((node) => node.namespace !== "" && same(node.directory));
+  if (member) {
+    const ns = member.namespace;
+    const table = (ctx.exportTables ?? []).find((t) => t.level === "project" && t.owner === ns);
+    const local = (id) => id.slice(id.lastIndexOf(":") + 1).replace(/^.*\./, "");
+    for (const entry of table?.entries ?? []) {
+      names.add(nameKey2(entry.publicName));
+      if (entry.kind === "type" && entry.typeDef) {
+        const type = ctx.types.find((t) => t.id === entry.typeDef || local(t.id) === local(entry.typeDef));
+        if (type) {
+          names.add(nameKey2(type.name));
+          names.add(nameKey2(type.symbol ?? type.name));
+          names.add(nameKey2(local(type.id)));
+        }
+      } else if (entry.component) {
+        for (const contract of ctx.interfacesByComponent.get(entry.component) ?? []) {
+          for (const method2 of contract.methods) names.add(nameKey2(method2.name));
+        }
+        for (const impl of ctx.implementations) {
+          if (ctx.interfaceMap.get(impl.contract)?.component !== entry.component) continue;
+          for (const method2 of impl.methods) if (method2.symbol) names.add(nameKey2(method2.symbol));
+        }
+      }
+    }
+    for (const impl of ctx.implementations) {
+      const component = ctx.componentMap.get(ctx.interfaceMap.get(impl.contract)?.component ?? "");
+      if (!component || !component.id.startsWith(`${ns}::`) || !DATA.has(component.componentType)) continue;
+      for (const file of implementationSourceFiles(impl)) data.set(pathKey(file), `${component.id} (a ${component.componentType})`);
+    }
+    return { label: `the member "${member.mountAlias ?? ns}"`, names, data };
+  }
+  const bound2 = family.find((node) => node.namespace === "");
+  const external = bound2?.externals.find((e) => same(e.directory));
+  const pin2 = external ? ctx.pinnedExternals.find((p) => p.alias === external.alias) : void 0;
+  if (!external || !pin2?.snapshot) return null;
+  for (const type of pin2.snapshot.types) {
+    names.add(nameKey2(type.id));
+    names.add(nameKey2(type.name));
+  }
+  for (const exported of pin2.snapshot.exportedTypes ?? []) names.add(nameKey2(exported.id));
+  for (const entry of pin2.snapshot.interfaces) {
+    names.add(nameKey2(entry.id));
+    for (const method2 of entry.methods) names.add(nameKey2(method2.name));
+  }
+  return { label: `the external "${external.alias}"`, names, data };
+}
 
 // src/core/rules/conformance/portal-imports.ts
 var portalImportsRule = {
@@ -30201,8 +30641,17 @@ function bare(name) {
   return name.replace(/^_+/, "") || name;
 }
 var HANDLE_NAMES = /* @__PURE__ */ new Set(["req", "request", "res", "response", "reply", "url", "ctx", "context", "next", "event", "socket"]);
+var TRANSPORT_HANDLES = /* @__PURE__ */ new Set(["req", "res", "ctx", "request", "response", "next", "reply"]);
+var REQUEST_HANDLES = /* @__PURE__ */ new Set(["req", "request", "ctx", "context", "event"]);
 var PRIMITIVE_KINDS = /* @__PURE__ */ new Set(["string", "number", "boolean"]);
 var aKind = (kind) => kind === "object" ? "an object" : `a ${kind}`;
+var fieldKey = (name) => name.toLowerCase().replace(/[_-]/g, "");
+function structural(fields, realized) {
+  if (!fields || fields.length === 0 || realized.kind !== "object" || !realized.fields || realized.fields.length === 0) return void 0;
+  const has = new Set(realized.fields.map(fieldKey));
+  const present = fields.filter((f) => has.has(fieldKey(f))).length;
+  return present === 0 ? "none" : present === fields.length ? "all" : "some";
+}
 var PAIRING_BUDGET = 5e3;
 function* subsets(n, k) {
   const pick = [];
@@ -30242,28 +30691,37 @@ function pairUp(declared, realized, score) {
   }
   return align(best);
 }
-function judge2(declared, realized, injected, typeAgrees, kindOf4) {
-  let wiring = 0;
-  while (wiring < realized.length && realized[wiring].name !== void 0 && injected.has(realized[wiring].name)) wiring++;
-  let taken = realized.map((param, at) => ({ param, at })).slice(wiring);
+function judge2(declared, realized, injected, typeAgrees, expected) {
   const declaredNames = new Set(declared.map((param) => bare(param.name)));
+  const isInjected = (param) => param.name !== void 0 && injected.has(bare(param.name));
+  let lead = 0;
+  while (lead < realized.length && isInjected(realized[lead])) lead++;
+  let end = realized.length;
+  while (end > lead && isInjected(realized[end - 1]) && !declaredNames.has(bare(realized[end - 1].name))) end--;
+  let taken = realized.map((param, at) => ({ param, at })).slice(lead, end);
   taken = taken.filter(({ param }) => !(param.name !== void 0 && param.name.startsWith("_") && param.unused === true && !declaredNames.has(bare(param.name))));
   const score = (d, r) => {
     let total = 0;
     if (r.name !== void 0 && bare(r.name) === bare(d.name)) total += 4;
     if (typeAgrees(d, r)) total += 2;
-    const want = kindOf4(d);
-    if (want && r.type && r.kind) total += want === r.kind ? 1 : -2;
+    const want = expected(d);
+    if (want?.kinds && r.type && r.kind) total += want.kinds.has(r.kind) ? 1 : -2;
+    const shape = structural(want?.fields, r);
+    if (shape === "all") total += 2;
+    else if (shape === "none") total -= 2;
     return total;
   };
   const pairs = pairUp(declared, taken.map((entry) => entry.param), score);
+  const wiringParams = [...realized.slice(0, lead), ...realized.slice(end)];
   const found = {
     unrealized: /* @__PURE__ */ new Map(),
     undeclared: /* @__PURE__ */ new Map(),
     renamed: /* @__PURE__ */ new Map(),
     optionality: /* @__PURE__ */ new Map(),
     transport: /* @__PURE__ */ new Map(),
-    wiring: realized.slice(0, wiring).map((param) => param.name)
+    wiring: realized.slice(0, lead).map((param) => param.name),
+    trailing: realized.slice(end).map((param) => param.name),
+    carried: /* @__PURE__ */ new Map()
   };
   const pairedDeclared = new Set(pairs.map(([d]) => d));
   const pairedTaken = new Set(pairs.map(([, r]) => r));
@@ -30272,21 +30730,34 @@ function judge2(declared, realized, injected, typeAgrees, kindOf4) {
     const param = declared[d];
     const { param: at, at: position2 } = taken[r];
     const sameName = at.name !== void 0 && bare(at.name) === bare(param.name);
-    const want = kindOf4(param);
-    if (!sameName && want && at.type && at.kind && want !== at.kind && !typeAgrees(param, at)) {
+    const want = expected(param);
+    const agrees = typeAgrees(param, at);
+    const shape = structural(want?.fields, at);
+    const handleName = at.name !== void 0 && TRANSPORT_HANDLES.has(bare(at.name).toLowerCase()) && !TRANSPORT_HANDLES.has(bare(param.name).toLowerCase());
+    let instead;
+    if (!agrees) {
+      if (!sameName && want?.kinds && at.type && at.kind && !want.kinds.has(at.kind)) instead = aKind(at.kind);
+      else if (at.transport && want?.fields) instead = "a transport handle";
+      else if (shape === "none") instead = `an object sharing none of its fields (${(want?.fields ?? []).join(", ")})`;
+      else if (handleName && (!at.kind || at.transport)) instead = "a transport handle";
+    }
+    if (instead !== void 0) {
       substituted.add(r);
+      const declares2 = want?.told ?? "an argument of its own";
       found.unrealized.set(param.name, {
         unit: param.name,
-        told: `"${param.name}" (the code takes ${at.name ? `"${at.name}"` : `parameter #${position2 + 1}`}, ${aKind(at.kind)}, where the contract declares ${aKind(want)})`
+        told: `"${param.name}" (the code takes ${at.name ? `"${at.name}"` : `parameter #${position2 + 1}`}, ${instead}, where the contract declares ${declares2})`
       });
       const unit = unitOf2(at, position2);
-      found.undeclared.set(unit, { unit, told: `"${unit}" (${aKind(at.kind)} in the place of the contract's "${param.name}", ${aKind(want)})` });
+      found.undeclared.set(unit, { unit, told: `"${unit}" (${instead} in the place of the contract's "${param.name}", ${declares2})` });
       continue;
     }
-    if (at.name !== void 0 && !sameName && (typeAgrees(param, at) || !!want && !!at.type && want === at.kind && PRIMITIVE_KINDS.has(want))) {
+    const sameKind = !!want?.kinds && !!at.type && !!at.kind && want.kinds.has(at.kind) && (PRIMITIVE_KINDS.has(at.kind) || !!want.loose);
+    if (at.name !== void 0 && !sameName && (agrees || sameKind || shape === "all")) {
+      const former = (param.previousNames ?? []).some((name) => bare(name) === bare(at.name));
       found.renamed.set(`${param.name}\u2192${at.name}`, {
         unit: param.name,
-        told: `"${param.name}" (the code calls it "${at.name}")`
+        told: `"${param.name}" (the code calls it "${at.name}"${former ? ", the name the contract retired" : ""})`
       });
     }
     if (!!param.optional !== at.optional) {
@@ -30296,8 +30767,14 @@ function judge2(declared, realized, injected, typeAgrees, kindOf4) {
       });
     }
   }
+  const requestReads = new Set(wiringParams.filter((param) => param.name !== void 0 && REQUEST_HANDLES.has(bare(param.name).toLowerCase())).flatMap((param) => (param.reads ?? []).map(bare)));
   declared.forEach((param, d) => {
-    if (!pairedDeclared.has(d)) found.unrealized.set(param.name, { unit: param.name, told: `"${param.name}"` });
+    if (pairedDeclared.has(d)) return;
+    if (requestReads.has(bare(param.name))) {
+      found.carried.set(param.name, { unit: param.name, told: param.name });
+      return;
+    }
+    found.unrealized.set(param.name, { unit: param.name, told: `"${param.name}"` });
   });
   const firstPaired = Math.min(...pairs.filter(([, r]) => !substituted.has(r)).map(([, r]) => r), taken.length);
   taken.forEach(({ param, at }, r) => {
@@ -30358,7 +30835,7 @@ function typeKind(type) {
 var paramConformanceRule = {
   name: "param-conformance",
   judges: "code",
-  description: "Code-to-contract for the SIGNATURE, the last of the three readings a spec-driven gate never made: a contract declares `params`, and nothing ever compared them to the parameters of the function that realizes the method. A contract could promise an argument the code does not take, take one the contract never mentions \u2014 including a secret \u2014 or name the same argument two different things, and the brief handed to an implementer would carry the contract's version. What a realization takes BEFORE the contract's own parameters is wiring, declared on the implementation as `injectedParams` rather than inferred, because an inferred prefix cannot be told from a renamed first argument; only a leading run of the names it declares is dropped. A parameter whose name starts with an underscore means UNUSED, and it is set aside only where the analysis proves it is \u2014 named, with no identifier of that name in the body or in another parameter's default value and no read of `arguments`, as the request and URL a transport hands a handler that never reads them: a used `_secret` is judged like any parameter, and a name compared for a rename is read without its leading underscores. The rest are PAIRED in order, since a caller passes arguments in order: among the order-keeping pairings, the one where the most names agree, then the most declared types, then the most kinds of value, and on a tie the one aligned against the TAIL of the realization's list \u2014 so an inserted first argument is the one named undeclared, never the declared one it pushed along. The declared type is what tells a rename from a substitution. Types agree when the code's annotation, read through the dialect of the language the file was analyzed as (type_dialect.agrees), is the contract's canonical type \u2014 so `string[]` agrees with `list<string>`, TypeScript's `number` with int and float alike, and an annotation the dialect cannot read agrees with nothing; a named type agrees through its code-level name, an EXTERNAL one (`alias::name`) through the name its pinned snapshot gives it, else its public name's last segment in the code's type casing. Where a type checker read the file, each parameter the code annotates also carries the KIND of value it takes (string, number, boolean, list, object or function; a platform class the checker's fixed library leaves out \u2014 a URL, a Request, node:http's IncomingMessage \u2014 is an object), compared with the kind the contract's type is (a primitive's, a list, a map or set as an object, an enum as a string, a named scalar as what it holds, a record type as an object, a signature as a function; a date, bytes and anything unsettled compare with nothing). A paired parameter whose name differs and whose type agrees \u2014 or whose kind is the same primitive \u2014 is a rename; one whose name differs and whose kind of value differs is a SUBSTITUTION, a different argument in the declared one's place, so the declared parameter is unrealized and the code's undeclared: `getRoute(params: Record<string, string>)` realizing `getRoute(id: string)` is never a silent pairing. Where neither side settles a type, nothing is said about the name. A parameter standing ahead of every kept pair under a name transports give their handles (req, request, res, response, reply, url, ctx, context, next, event, socket) is how a transport handle arrives, and the finding names the one green path for it: the handle in `injectedParams`, the contract's own parameters after it in order, the router unpacking the request into them. A name with several bodies is judged on what they all agree on, and a method the named file only CALLS is left to `methodRealization`, which already reports that the body is not here.",
+  description: "Code-to-contract for the SIGNATURE, the last of the three readings a spec-driven gate never made: a contract declares `params`, and nothing ever compared them to the parameters of the function that realizes the method. A contract could promise an argument the code does not take, take one the contract never mentions \u2014 including a secret \u2014 or name the same argument two different things, and the brief handed to an implementer would carry the contract's version. What a realization takes besides the contract's own parameters, at either end of its list, is wiring, declared on the implementation as `injectedParams` rather than inferred, because an inferred prefix cannot be told from a renamed first argument; a leading run and a trailing run of the names it declares are dropped, each name matching with or without its leading underscore, and a trailing one only where the contract declares no parameter of that name. A parameter whose name starts with an underscore means UNUSED, and it is set aside only where the analysis proves it is \u2014 named, with no identifier of that name in the body or in another parameter's default value and no read of `arguments`, as the request and URL a transport hands a handler that never reads them: a used `_secret` is judged like any parameter, and a name compared for a rename is read without its leading underscores. The rest are PAIRED in order, since a caller passes arguments in order: among the order-keeping pairings, the one where the most names agree, then the most declared types, then the most kinds of value, and on a tie the one aligned against the TAIL of the realization's list \u2014 so an inserted first argument is the one named undeclared, never the declared one it pushed along. The declared type is what tells a rename from a substitution. Types agree when the code's annotation, read through the dialect of the language the file was analyzed as (type_dialect.agrees), is the contract's canonical type \u2014 so `string[]` agrees with `list<string>`, TypeScript's `number` with int and float alike, and an annotation the dialect cannot read agrees with nothing; a named type agrees through its code-level name, an EXTERNAL one (`alias::name`) through the name its pinned snapshot gives it, else its public name's last segment in the code's type casing. Where a type checker read the file, each parameter the code annotates also carries the KIND of value it takes (string, number, boolean, list, object or function; a platform class the checker's fixed library leaves out \u2014 a URL, a Request, node:http's IncomingMessage \u2014 is an object), compared with the kind the contract's type is (a primitive's, a list, a map or set as an object, an enum as a string, a named scalar as what it holds, a record type as an object, a signature as a function; a date or a datetime as a string or an object, a duration as a number or a string, bytes as an object, a list or a string; anything unsettled compares with nothing). A paired parameter whose name differs and whose type agrees \u2014 or whose kind is the same primitive, or one of the kinds a date or bytes is written as \u2014 is a rename, said with the contract's former name when the code still uses it; one whose name differs and whose kind of value differs is a SUBSTITUTION, a different argument in the declared one's place, so the declared parameter is unrealized and the code's undeclared: `getRoute(params: Record<string, string>)` realizing `getRoute(id: string)` is never a silent pairing. Where the contract's type is a record, an object is compared STRUCTURALLY, by the property names the checker gives its type: one holding every field of the record is a rename, one sharing none of them a substitution whatever either side calls it, and a platform transport class (node:http's IncomingMessage, a fetch Request or Response, a URL, a socket) where a record is declared is a substitution too \u2014 so `planRoute(req: IncomingMessage)` and `planRoute(session: { user: string })` realizing `planRoute(request: plan_request)` are never silent pairings. Where the code settles no kind \u2014 unannotated JavaScript, a parameter typed any \u2014 a paired parameter named as a transport handle (req, res, ctx, request, response, next, reply) standing where the contract declares an argument of its own is a substitution: `cancelOrder(req, res)` realizing `cancelOrder(orderId, customerId)` is a handler's shape, not the contract's. Where neither side settles a type and no handle name speaks, nothing is said about the name. A parameter standing ahead of every kept pair under a name transports give their handles (req, request, res, response, reply, url, ctx, context, next, event, socket) is how a transport handle arrives, and the finding names the one green path for it: the handle in `injectedParams`, the contract's own parameters after it in order, the router unpacking the request into them \u2014 or, where the framework hands the function the handles alone, the contract's parameters read off the injected request by their own names: a contract parameter the code does not take but reads off an injected request handle (req, request, ctx, context, event) by its own name \u2014 `req.params.code`, `req.query['limit']`, a destructuring of such a read \u2014 is realized through that handle. An injected name none of the implementation's realizing functions read in this run takes is stale linkage (UNUSED_INJECTED_PARAM): it would wave through the next parameter of that name unread. A name with several bodies is judged on what they all agree on, and a method the named file only CALLS is left to `methodRealization`, which already reports that the body is not here; a method whose conformance dial is off (its own, else its implementation's) is not judged.",
   codes: [
     {
       code: "UNREALIZED_PARAM",
@@ -30380,6 +30857,12 @@ var paramConformanceRule = {
       summary: "A contract parameter and the one realizing it agree on position and type but not on name \u2014 the contract, the ERD and every brief say one word while the code says another",
       carryable: true
     },
+    {
+      code: "UNUSED_INJECTED_PARAM",
+      defaultSeverity: "warning",
+      summary: "An implementation declares an injected parameter that none of its realizing functions takes \u2014 stale linkage that would wave through the next parameter of that name, wherever it appears",
+      carryable: true
+    },
     {
       code: "PARAM_OPTIONALITY",
       defaultSeverity: "warning",
@@ -30426,11 +30909,34 @@ var paramConformanceRule = {
       }
       return dialect.agrees(realized.type, stated.expression, names);
     };
-    const kindOf4 = (declared) => expressionKind(parseTypePosition(declared.type, "param", !!declared.optional).expression, (name) => typeKind(typeNamed.get(name)));
-    for (const { implementation, method: method2, sourceFile, draftContext: draftContext4 } of ctx.implementationMethods()) {
+    const expected = (declared) => {
+      let expression = parseTypePosition(declared.type, "param", !!declared.optional).expression;
+      while (expression && (expression.form === "optional" || expression.form === "result")) expression = expression.args[0];
+      if (!expression) return void 0;
+      if (expression.form === "primitive") {
+        const loose = {
+          date: ["string", "object"],
+          datetime: ["string", "object"],
+          duration: ["number", "string"],
+          bytes: ["object", "list", "string"]
+        };
+        if (expression.name && loose[expression.name]) return { kinds: new Set(loose[expression.name]), loose: true, told: `a ${expression.name}` };
+      }
+      const kind = expressionKind(expression, (name) => typeKind(typeNamed.get(name)));
+      if (expression.form === "named" && expression.name) {
+        const type = typeNamed.get(expression.name);
+        const fields = (type?.fields ?? []).map((field) => field && typeof field === "object" ? field.name : void 0).filter((name) => typeof name === "string");
+        if (fields.length > 0 && kind === "object") return { kinds: /* @__PURE__ */ new Set(["object"]), fields, told: `the record "${expression.name}"` };
+      }
+      return kind ? { kinds: /* @__PURE__ */ new Set([kind]), told: aKind(kind) } : void 0;
+    };
+    const takenBy = /* @__PURE__ */ new Map();
+    for (const { implementation, method: method2, component, sourceFile, draftContext: draftContext4 } of ctx.implementationMethods()) {
+      const tier = method2.conformance ?? implementation.conformance ?? defaultConformanceTier(component);
+      if (tier === "off") continue;
       const contract = ctx.interfaceMap.get(implementation.contract);
+      if (!sourceFile) continue;
       const declared = contract?.methods.find((m) => m.name === method2.name)?.params ?? [];
-      if (declared.length === 0 || !sourceFile) continue;
       const file = pathKey(sourceFile);
       const facts = code.factsAt(file);
       if (!facts || facts.status !== "analyzed" || facts.analysisGrade !== "exact") continue;
@@ -30439,14 +30945,19 @@ var paramConformanceRule = {
       if (!signatures || !Object.prototype.hasOwnProperty.call(signatures, symbol)) continue;
       const candidates = publishedBodies(signatures[symbol], facts.functionBodies?.[symbol], new Set(facts.exportedNames), new Set(Object.keys(facts.typeShapes ?? {})));
       if (candidates.length === 0) continue;
-      const injected = new Set(implementation.injectedParams ?? []);
+      const taken = takenBy.get(implementation.id) ?? /* @__PURE__ */ new Set();
+      for (const candidate of candidates) for (const param of candidate) if (param.name !== void 0) taken.add(bare(param.name));
+      takenBy.set(implementation.id, taken);
+      if (declared.length === 0) continue;
+      const injected = new Set((implementation.injectedParams ?? []).map(bare));
       const typeAgrees = typeAgreesIn(dialectOf(facts));
-      const judgements = candidates.map((realized) => judge2(declared, realized, injected, typeAgrees, kindOf4));
+      const judgements = candidates.map((realized) => judge2(declared, realized, injected, typeAgrees, expected));
       const subject = candidates.length > 1 ? `every function called "${symbol}" in "${file}"` : `the function "${symbol}" in "${file}"`;
       const opening = subject.charAt(0).toUpperCase() + subject.slice(1);
       const transport = agreed(judgements, "transport").map((found) => found.told);
       const wiring = judgements[0].wiring;
-      const greenPath = transport.length > 0 ? ` If ${transport.map((name) => `"${name}"`).join(" and ")} ${transport.length === 1 ? "is a handle" : "are handles"} whatever serves this method hands it (a request, a URL, a response) rather than an argument of the contract's caller, the one green path is: name ${transport.length === 1 ? "it" : "them"} in the implementation's \`injectedParams\` \u2014 [${[...wiring, ...transport].join(", ")}] \u2014 and take the contract's own parameters after ${transport.length === 1 ? "it" : "them"}, in order: ${symbol}(${[...wiring, ...transport, ...declared.map((param) => `${param.name}${param.optional ? "?" : ""}`)].join(", ")}), the router unpacking the path, query and body into them. A handle the function never reads may carry a leading underscore instead.` : "";
+      const trailing = judgements[0].trailing;
+      const greenPath = transport.length > 0 ? ` If ${transport.map((name) => `"${name}"`).join(" and ")} ${transport.length === 1 ? "is a handle" : "are handles"} whatever serves this method hands it (a request, a URL, a response) rather than an argument of the contract's caller, the one green path is: name ${transport.length === 1 ? "it" : "them"} in the implementation's \`injectedParams\` \u2014 [${[...wiring, ...transport].join(", ")}] \u2014 and take the contract's own parameters after ${transport.length === 1 ? "it" : "them"}, in order: ${symbol}(${[...wiring, ...transport, ...declared.map((param) => `${param.name}${param.optional ? "?" : ""}`), ...trailing].join(", ")}), the router unpacking the path, query and body into them \u2014 or, where the framework hands the function the handles alone, read each of the contract's parameters off the injected request by its own name (\`${transport[0]}.params.${declared[0]?.name ?? "id"}\`), which realizes it through the handle. An injected name matches with or without its leading underscore, and a handle the function never reads may carry one instead.` : "";
       const unrealized = agreed(judgements, "unrealized");
       if (unrealized.length > 0) {
         ctx.addIssue(
@@ -30464,7 +30975,7 @@ var paramConformanceRule = {
         ctx.addIssue(
           "warning",
           "UNDECLARED_PARAM",
-          `${opening} realizing method "${method2.name}" of contract "${implementation.contract}" takes ${undeclared.length} parameter(s) the contract does not declare and no declared injection accounts for \u2014 ${undeclared.map((found) => found.told).join(", ")}. An argument a caller must supply that the design never mentions is how a credential ends up in a signature nobody has read against its contract. Declare it on the contract, name it in the implementation's \`injectedParams\` when whatever wires this component up supplies it (a LEADING run only), or take it out of the signature.` + greenPath,
+          `${opening} realizing method "${method2.name}" of contract "${implementation.contract}" takes ${undeclared.length} parameter(s) the contract does not declare and no declared injection accounts for \u2014 ${undeclared.map((found) => found.told).join(", ")}. An argument a caller must supply that the design never mentions is how a credential ends up in a signature nobody has read against its contract. Declare it on the contract, name it in the implementation's \`injectedParams\` when whatever wires this component up supplies it (a leading or trailing run, with or without its underscore), or take it out of the signature.` + greenPath,
           implementation.id,
           draftContext4,
           void 0,
@@ -30496,6 +31007,22 @@ var paramConformanceRule = {
         );
       }
     }
+    for (const implementation of ctx.implementations) {
+      const injected = implementation.injectedParams ?? [];
+      const taken = takenBy.get(implementation.id);
+      if (injected.length === 0 || !taken) continue;
+      const stale = injected.filter((name) => !taken.has(bare(name)));
+      if (stale.length === 0) continue;
+      ctx.addIssue(
+        "warning",
+        "UNUSED_INJECTED_PARAM",
+        `Implementation "${implementation.id}" declares ${stale.length} injected parameter(s) none of its realizing functions takes \u2014 ${stale.map((name) => `"${name}"`).join(", ")}. An injection is wiring the parameter check sets aside wherever it stands at either end of a signature, so one that no function takes waves through the next parameter of that name unread \u2014 a credential included. Drop it from injectedParams, or take it in the handler that is handed it.`,
+        implementation.id,
+        ctx.isImplementationDraft(implementation),
+        void 0,
+        { at: "injectedParams", covers: stale }
+      );
+    }
   }
 };
 
@@ -30503,7 +31030,7 @@ var paramConformanceRule = {
 var asyncConformanceRule = {
   name: "async-conformance",
   judges: "code",
-  description: "Code-to-contract for ASYNC: a contract method whose returns is `async T` is realized by a function that completes later, and one whose returns is not, by one that completes now \u2014 every caller in every language with async/await is shaped by the difference, so a contract that hides it misleads every implementer and translation built from it. Compared with source_file_facts.asyncFunctions for the method's realizing function (under its `symbol`), at exact grade only; where a name has several bodies only what they all agree on is reported, as param-conformance does. A method whose file only calls the function is methodRealization's finding.",
+  description: "Code-to-contract for ASYNC: a contract method whose returns is `async T` is realized by a function that completes later, and one whose returns is not, by one that completes now \u2014 every caller in every language with async/await is shaped by the difference, so a contract that hides it misleads every implementer and translation built from it. Compared with source_file_facts.asyncFunctions for the method's realizing function (under its `symbol`), at exact grade only; where a name has several bodies only what they all agree on is reported, as param-conformance does. A method whose file only calls the function is methodRealization's finding, and a method whose conformance dial is off (its own, else its implementation's) is not judged.",
   codes: [
     {
       code: "ASYNC_MISMATCH",
@@ -30514,7 +31041,8 @@ var asyncConformanceRule = {
   ],
   check(ctx) {
     const code = ctx.codeIndex();
-    for (const { implementation, method: method2, sourceFile, draftContext: draftContext4 } of ctx.implementationMethods()) {
+    for (const { implementation, method: method2, component, sourceFile, draftContext: draftContext4 } of ctx.implementationMethods()) {
+      if ((method2.conformance ?? implementation.conformance ?? defaultConformanceTier(component)) === "off") continue;
       const contractMethod2 = ctx.interfaceMap.get(implementation.contract)?.methods.find((m) => m.name === method2.name);
       if (!contractMethod2 || typeof contractMethod2.returns !== "string" || !sourceFile) continue;
       const file = pathKey(sourceFile);
@@ -30599,19 +31127,27 @@ function memberSurface(ctx, node, alias) {
       for (const f of type.fields ?? []) pending3.push(...extractTypeIdentifiers(f.type));
     }
   }
-  const seen = new Set(types.map((t) => nameKey(t.def.id)));
+  const seen = new Set(types.map((t) => `${t.alias}::${nameKey(t.def.id)}`));
   while (pending3.length > 0) {
     const ref = pending3.pop();
     const type = memberType(ref);
     if (!type) continue;
     const id = lastSegment4(type.id.replace(/::/g, "."));
-    if (seen.has(nameKey(id))) continue;
-    seen.add(nameKey(id));
-    types.push({ alias, def: asDef(type, id) });
+    const owner = type.id.includes("::") ? type.id.slice(0, type.id.indexOf("::")) : ns;
+    const ownerAlias = owner === ns ? alias : ownerAliasOf(ctx, owner);
+    const key2 = `${ownerAlias}::${nameKey(id)}`;
+    if (seen.has(key2)) continue;
+    seen.add(key2);
+    types.push({ alias: ownerAlias, def: asDef(type, id) });
     for (const f of type.fields ?? []) pending3.push(...extractTypeIdentifiers(f.type));
   }
   return { entries, types };
 }
+function ownerAliasOf(ctx, namespace) {
+  const node = (ctx.projectFamily?.nodes ?? []).find((n) => n.namespace === namespace);
+  const declared = [...boundRoot(ctx)?.aliases.entries() ?? []].find(([, key2]) => key2 === namespace)?.[0];
+  return node?.mountAlias ?? declared ?? node?.id ?? namespace;
+}
 function stem(name) {
   return nameKey(name).replace(/(?:api|port|client)$/, "") || nameKey(name);
 }
@@ -30726,10 +31262,12 @@ function matchOf(decl, entries, types, tagAlias) {
     const name = rawName.split(".")[0];
     const entry = entries.find((e) => e.alias === alias && (nameKey(e.entry.id) === nameKey(name) || nameKey(e.entry.name) === nameKey(name)));
     if (entry) return { entry };
-    const type = types.find((t) => t.alias === alias && (nameKey(t.def.id) === nameKey(name) || nameKey(t.def.name) === nameKey(name)));
-    if (type) return { type };
+    const byId = types.find((t) => t.alias === alias && nameKey(t.def.id) === nameKey(name));
+    if (byId) return { type: byId };
     const renamed2 = types.find((t) => t.alias === alias && (t.def.formerly ?? []).some((f) => nameKey(f) === nameKey(name)));
     if (renamed2) return { renamedType: renamed2 };
+    const byName2 = types.find((t) => t.alias === alias && nameKey(t.def.name) === nameKey(name));
+    if (byName2) return { type: byName2 };
   }
   const methods = decl.members.filter((m) => m.params !== void 0);
   const byName = stem(decl.name);
@@ -30774,7 +31312,8 @@ function declarationDrift(decl, entries, types, tagAlias) {
   const type = match2.type ?? match2.renamedType;
   if (type) {
     const renamedFrom = formerType(decl.name, [type]) ?? (match2.renamedType ? type : void 0);
-    const named2 = renamedFrom ? [`the type "${decl.name}" was renamed to "${type.def.name}" (${type.alias}::${type.def.id}) \u2014 follow the rename`] : [];
+    const now = nameKey(type.def.name) === nameKey(decl.name) ? type.def.id : type.def.name;
+    const named2 = renamedFrom ? [`the type "${decl.name}" was renamed to "${now}" (${type.alias}::${type.def.id}) \u2014 follow the rename`] : [];
     const drift = decl.kind === "alias" || decl.kind === "enum" ? named2 : [...named2, ...fieldDrift(decl.members, type, types)];
     return { against: `${type.alias}::${type.def.id}`, drift };
   }
@@ -30831,7 +31370,7 @@ function unreadReason(module2, reach2) {
 var bindingModulesRule = {
   name: "binding-modules",
   judges: "code",
-  description: "Code-to-pin for a consumer's hand-written binding module (implementation_spec.bindings): the one file where the consumer's code spells another project's names is compared with what the projects the implementation's component reaches publish, so a re-pin (or a member's edit) that renamed, removed or reshaped a name the binding still declares is reported instead of surviving tsc and the tests on the binding's own stale declarations. A component reaches a project through every `alias::name` its specs write: a dependsOn, owns, narrative or declared call, an implements, and every named type its contract's params and returns write, directly or through the bound project's own types they name (so a binding to a types-only contracts library is reached by the types a contract names). A pinned external is compared with its pinned snapshot. A contained MEMBER project (an alias the bound root declares under `members` \u2014 named by that alias or by the member's project id \u2014 read live and never pinned) is compared the same way against what its L0 export table exports now: each exported contract's methods with their params and rename traces, each exported type's fields with theirs, so a parameter, field or method rename in a member reaches a member consumer at validate time, with the rename to follow. Each binding declaration is matched to a reached interface or type by the `alias::name` its doc comment names, else by name (nameKey of the interface's id or name, a type's id or name, with an Api/Port/Client suffix ignored), else \u2014 for an interface with methods \u2014 by the reached interface most of its member names belong to (a trace in `formerly` counts); an exported function is matched by name against the methods of every reached interface, or, when its doc comment names `alias::name` (or `alias::name.method`), against that interface alone. A matched member that is a former name is reported with the rename to follow; a member of a matched interface it does not hold, a function its tagged interface no longer holds, and a function or member a pinned entry's `retired` list names (a method the producer removed since an earlier pin) are reported removed; a parameter list whose arity or names differ from the method's (a param's previousNames giving the rename) is reported; a type declaration is compared field by field \u2014 a field the matched type does not declare (a field's `formerly` giving the rename), a field it declares that the binding lacks, a declaration still named by the type's former name, and a field whose declared type names a type the producer renamed are each reported with the new name. Names compare by nameKey, so snake_case and camelCase spellings of one name agree. A declaration nothing matches is the binding's own plumbing and is never judged. A binding that cannot be read, is not TypeScript or JavaScript, declares nothing the reader compares (naming each export form it met but cannot see into, such as a CommonJS `module.exports = require(\u2026)`), or whose component reaches neither a pinned external nor a member project is reported once as unread \u2014 a member is named as a member (one that exports nothing is told to export there), and pinning is suggested only for a declared external, never for a member \u2014 a notice, so a planned binding passes a design-only gate.",
+  description: "Code-to-pin for a consumer's hand-written binding module (implementation_spec.bindings): the one file where the consumer's code spells another project's names is compared with what the projects the implementation's component reaches publish, so a re-pin (or a member's edit) that renamed, removed or reshaped a name the binding still declares is reported instead of surviving tsc and the tests on the binding's own stale declarations. A component reaches a project through every `alias::name` its specs write: a dependsOn, owns, narrative or declared call, an implements, and every named type its contract's params and returns write, directly or through the bound project's own types they name (so a binding to a types-only contracts library is reached by the types a contract names). A pinned external is compared with its pinned snapshot. A contained MEMBER project (an alias the bound root declares under `members` \u2014 named by that alias or by the member's project id \u2014 read live and never pinned) is compared the same way against what its L0 export table exports now: each exported contract's methods with their params and rename traces, each exported type's fields with theirs (a type its exports name that another project owns is that project's, compared and named under the alias the bound root reaches it by, never the member's), so a parameter, field or method rename in a member reaches a member consumer at validate time, with the rename to follow. Each binding declaration is matched to a reached interface or type by the `alias::name` its doc comment names (a public name or type id, never a display name: a tag naming a type's former id is that type under its retired name), else by name (nameKey of the interface's id or name, a type's id or name, with an Api/Port/Client suffix ignored), else \u2014 for an interface with methods \u2014 by the reached interface most of its member names belong to (a trace in `formerly` counts); an exported function is matched by name against the methods of every reached interface, or, when its doc comment names `alias::name` (or `alias::name.method`), against that interface alone. A matched member that is a former name is reported with the rename to follow; a member of a matched interface it does not hold, a function its tagged interface no longer holds, and a function or member a pinned entry's `retired` list names (a method the producer removed since an earlier pin) are reported removed; a parameter list whose arity or names differ from the method's (a param's previousNames giving the rename) is reported; a type declaration is compared field by field \u2014 a field the matched type does not declare (a field's `formerly` giving the rename), a field it declares that the binding lacks, a declaration still named by the type's former name, and a field whose declared type names a type the producer renamed are each reported with the new name. Names compare by nameKey, so snake_case and camelCase spellings of one name agree. A declaration nothing matches is the binding's own plumbing and is never judged. A binding that cannot be read, is not TypeScript or JavaScript, declares nothing the reader compares (naming each export form it met but cannot see into, such as a CommonJS `module.exports = require(\u2026)`), or whose component reaches neither a pinned external nor a member project is reported once as unread \u2014 a member is named as a member (one that exports nothing is told to export there), and pinning is suggested only for a declared external, never for a member \u2014 a notice, so a planned binding passes a design-only gate.",
   codes: [
     { code: "BINDING_DRIFT", defaultSeverity: "warning", summary: "A binding module declares a producer name its pin (or a member project's live export) renamed (with the rename to follow) or removed, a parameter list that differs from the method's, or a type whose name or fields differ from the producer's type \u2014 code calling into another project through a shape the producer no longer has" },
     { code: "BINDING_UNREAD", defaultSeverity: "notice", summary: "A binding module an implementation names could not be compared: it is not on disk yet, escapes the root, cannot be read, is in a language the reader does not read, declares nothing the reader compares (naming the export forms it cannot see into), or its component reaches neither a pinned external nor a member project that exports something" }
@@ -30867,7 +31406,7 @@ var bindingModulesRule = {
         ...reach2.pins.flatMap((p) => p.snapshot.types.map((def) => ({ alias: p.alias, def }))),
         ...reach2.members.flatMap((m) => m.surface.types)
       ];
-      const live = new Set(reach2.members.map((m) => m.alias));
+      const live = new Set(reach2.members.flatMap((m) => [m.alias, ...m.surface.types.map((t) => t.alias)]));
       const tagAlias = (alias) => {
         if (reach2.pins.some((p) => p.alias === alias)) return alias;
         return reach2.members.find((m) => m.alias === alias || m.node.namespace === alias || m.node.id === alias)?.alias ?? alias;
@@ -30912,7 +31451,7 @@ function answers(route2, endpoint) {
 var routeCoverageRule = {
   name: "route-coverage",
   judges: "code",
-  description: "Code-to-contract for the ROUTES: does every route a router actually answers have a contract endpoint, and does every contract endpoint have a route that answers it? A portal's endpoints are what its contract promises; the router is what the code serves; nothing compared the two, so a route with no contract (including a write) could run for months without a single rule noticing. The Portal's own implementation names its router entry (`router`, code linkage), and the routes are read out of that function and the functions of its file it calls by name. Two idioms are read: guards (a method comparison with comparisons on the path's split segments), where a prefix the router strips before splitting the path is folded in front; and a route table the router names (an array of objects pairing a method with a `/a/:b` template or an anchored regular expression, or an object keyed `VERB /path`), read only when every entry settles. Every compared value is a literal or one the code's constants, concatenations and template literals settle \u2014 through the type checker, any module's constant and any expression it types as one string literal \u2014 and never a guess. A route that states the whole path is read under the Portal's basePath, which the contract's endpoint paths are written beneath; a leading path segment a guard router never checks is completed from the first segments of the Portal's own HTTP endpoint paths, the segments whatever serves the Portal routes on. Which process serves which Portal is implementation, so no listener is consulted. A router that yields no route in either idiom is reported as unread, never passed: a check that cannot see a router must say so rather than stay quiet.",
+  description: "Code-to-contract for the ROUTES: does every route a router actually answers have a contract endpoint, and does every contract endpoint have a route that answers it? A portal's endpoints are what its contract promises; the router is what the code serves; nothing compared the two, so a route with no contract (including a write) could run for months without a single rule noticing. The Portal's own implementation names its router (`router`, code linkage): an entry its own files export, an entry or route table another module exports (`<module>#<name>`, a central routes.ts), or a module alone, every route-bearing export of which is read as one router; the routes are read out of that entry and the functions of its file it calls by name. A router several Portals name is read once against them all: a route is declared when any of them declares it, and an endpoint is unrouted per Portal. Two idioms are read: guards (a method comparison with comparisons on the path's split segments), where a prefix the router strips before splitting the path is folded in front; and a route table \u2014 a const the router names, one it returns or states in place unnamed, or the table the linkage names itself \u2014 (an array of objects pairing a method with a `/a/:b` template or an anchored regular expression, or an object keyed `VERB /path`, a key written as a template literal or a concatenation over constants settling like any other value), read only when every entry settles. A table is written under the ONE prefix its router strips off the path before matching it (`path.slice(BASE.length)`, `.replace(BASE, '')`), which is folded in front of every entry that does not already state it, so a stripped prefix that is not the Portal's basePath is read as the different URL it is, and the finding names both. Every compared value is a literal or one the code's constants, concatenations and template literals settle \u2014 through the type checker, any module's constant and any expression it types as one string literal \u2014 and never a guess. A route that states the whole path is read under the Portal's basePath, which the contract's endpoint paths are written beneath; a leading path segment a guard router never checks is completed from the first segments of the Portal's own HTTP endpoint paths, the segments whatever serves the Portal routes on. Which process serves which Portal is implementation, so no listener is consulted. A router that yields no route in either idiom is reported as unread, never passed: a check that cannot see a router must say so rather than stay quiet.",
   codes: [
     {
       code: "UNDECLARED_ROUTE",
@@ -30938,40 +31477,42 @@ var routeCoverageRule = {
   check(ctx) {
     const code = ctx.codeIndex();
     const realization = ctx.realizationIndex();
+    const groups = /* @__PURE__ */ new Map();
     for (const portal of ctx.components) {
       if (portal.componentType !== "Portal") continue;
       for (const impl of realization.implementationsOf(portal.id)) {
         const via = impl.router;
         if (!via) continue;
-        const anchor = impl.id;
-        const holders = realization.filesOf(portal.id).map(pathKey).filter((file) => {
+        const linkage = routerLinkage(via);
+        const files = linkage.file ? [pathKey(linkage.file)] : realization.filesOf(portal.id).map(pathKey);
+        const exact = files.filter((file) => {
           const facts = code.factsAt(file);
-          return !!facts && facts.status === "analyzed" && facts.analysisGrade === "exact" && !!facts.functionParams && Object.prototype.hasOwnProperty.call(facts.functionParams, via);
+          return !!facts && facts.status === "analyzed" && facts.analysisGrade === "exact";
         });
+        const holds = (file, name) => {
+          const facts = code.factsAt(file);
+          return !!facts.functionParams && Object.prototype.hasOwnProperty.call(facts.functionParams, name) || !!facts.functionRoutes && Object.prototype.hasOwnProperty.call(facts.functionRoutes, name);
+        };
+        const holders = linkage.name !== void 0 ? exact.filter((file) => holds(file, linkage.name)) : exact;
         if (holders.length === 0) continue;
+        const prefixes = /* @__PURE__ */ new Set();
         const read2 = holders.flatMap((file) => {
-          const routes = code.factsAt(file).functionRoutes;
+          const facts = code.factsAt(file);
+          const routes = facts.functionRoutes;
           if (!routes) return [];
-          const names = /* @__PURE__ */ new Set([via]);
-          for (const site of closedCallSites(code, file, via) ?? []) {
-            if (!site.member && pathKey(site.from ?? file) === file) names.add(site.name);
+          const entries = linkage.name !== void 0 ? [linkage.name] : facts.exportedNames.filter((name) => Object.prototype.hasOwnProperty.call(routes, name));
+          const names = new Set(entries);
+          for (const entry of entries) {
+            for (const site of closedCallSites(code, file, entry) ?? []) {
+              if (!site.member && pathKey(site.from ?? file) === file) names.add(site.name);
+            }
+          }
+          for (const name of names) {
+            const stripped = facts.routePrefixes?.[name];
+            if (stripped !== void 0 && Object.prototype.hasOwnProperty.call(facts.routePrefixes, name)) prefixes.add(stripped);
           }
           return [...names].flatMap((name) => Object.prototype.hasOwnProperty.call(routes, name) ? routes[name] : []);
         });
-        const draftContext4 = ctx.isComponentDraft(portal.id) || ctx.isImplementationDraft(impl);
-        const where = holders.map((file) => `"${file}"`).join(", ");
-        if (read2.length === 0) {
-          ctx.addIssue(
-            "warning",
-            "UNREADABLE_ROUTER",
-            `Portal "${portal.id}" names its router "${via}" (in ${where}), but no branch of "${via}" reads as a route \u2014 so none of its routes were checked against the contract at all. Only two idioms are read, in the entry and in the functions of its file it calls by name: an \`if\` whose conditions, together with those of every enclosing \`if\`, compare \`<request>.method\` with a string and \`parts[i]\` / \`parts.length\` with values the code spells out or its constants settle; and a route table it names \u2014 an array of objects pairing a method with a path pattern (a \`/a/:b\` template or an anchored regular expression), or an object keyed \`VERB /path\` \u2014 every entry of which settles. Silence here would read as a clean router; it is only one this analysis cannot see. Write the router in one of those idioms, or carry this finding with the reason it cannot be.`,
-            anchor,
-            draftContext4,
-            void 0,
-            { at: via }
-          );
-          continue;
-        }
         const endpoints = ctx.interfaceMethodsOf(portal.id).flatMap((method2) => {
           const endpoint = method2.endpoint;
           if (endpoint?.transport !== "HTTP") return [];
@@ -30982,32 +31523,83 @@ var routeCoverageRule = {
           }];
         });
         const heads = [...new Set(endpoints.map((endpoint) => endpoint.segments[0]).filter((head2) => !!head2 && head2 !== "*"))].sort();
-        const base = (portal.basePath ?? "").split("/").filter(Boolean);
-        const served = read2.map((route2) => completed(route2, heads, base));
-        const undeclared = [...new Set(served.filter((variants) => !variants.some((route2) => endpoints.some((endpoint) => answers(route2, endpoint)))).flatMap((variants) => variants.map((route2) => route2.key)))].sort();
-        if (undeclared.length > 0) {
-          ctx.addIssue(
-            "warning",
-            "UNDECLARED_ROUTE",
-            `Portal "${portal.id}"'s router "${via}" (${where}) answers ${undeclared.length} route(s) no contract endpoint of "${portal.id}" declares \u2014 ${undeclared.map((key2) => `"${key2}"`).join(", ")}. A surface the code serves and the design never promised is how a write runs with no contract: no brief, no auth review, no rule reading it. Declare each as a contract method with its endpoint, or take the route out of the router.`,
-            anchor,
-            draftContext4,
-            void 0,
-            { at: via, covers: undeclared }
-          );
-        }
-        const unrouted = [...new Set(endpoints.filter((endpoint) => !served.some((variants) => variants.some((route2) => answers(route2, endpoint)))).map((endpoint) => endpoint.key))].sort();
-        if (unrouted.length > 0) {
+        const router = {
+          portal,
+          impl,
+          via,
+          holders,
+          read: read2,
+          endpoints,
+          heads,
+          base: (portal.basePath ?? "").split("/").filter(Boolean),
+          draftContext: ctx.isComponentDraft(portal.id) || ctx.isImplementationDraft(impl),
+          ...prefixes.size === 1 ? { prefix: [...prefixes][0] } : {}
+        };
+        const key2 = linkage.file ? `${pathKey(linkage.file)}#${linkage.name ?? "*"}` : `${impl.id}#${via}`;
+        groups.set(key2, [...groups.get(key2) ?? [], router]);
+      }
+    }
+    for (const routers of groups.values()) {
+      const [first] = routers;
+      const where = first.holders.map((file) => `"${file}"`).join(", ");
+      const via = first.via;
+      if (first.read.length === 0) {
+        for (const router of routers) {
           ctx.addIssue(
             "warning",
-            "UNROUTED_ENDPOINT",
-            `Portal "${portal.id}" binds ${unrouted.length} HTTP endpoint(s) that no route of its router "${via}" (${where}) answers \u2014 ${unrouted.map((key2) => `"${key2}"`).join(", ")}. The contract promises a route no request can reach. Route it in the router, or drop the endpoint from the contract.`,
-            anchor,
-            draftContext4,
+            "UNREADABLE_ROUTER",
+            `Portal "${router.portal.id}" names its router "${via}" (in ${where}), but no branch of "${via}" reads as a route \u2014 so none of its routes were checked against the contract at all. Only two idioms are read, in the entry and in the functions of its file it calls by name: an \`if\` whose conditions, together with those of every enclosing \`if\`, compare \`<request>.method\` with a string and \`parts[i]\` / \`parts.length\` with values the code spells out or its constants settle; and a route table \u2014 an array of objects pairing a method with a path pattern (a \`/a/:b\` template or an anchored regular expression), or an object keyed \`VERB /path\` (a key may be a template literal over constants), every entry of which settles \u2014 whether a const names it, the function returns it in place, or the router linkage names the table itself (\`<module>#<table>\`, or a module whose exports are its tables). Silence here would read as a clean router; it is only one this analysis cannot see. Write the router in one of those idioms, or carry this finding with the reason it cannot be.`,
+            router.impl.id,
+            router.draftContext,
             void 0,
-            { at: via, covers: unrouted }
+            { at: via }
           );
         }
+        continue;
+      }
+      const prefixSegments = first.prefix !== void 0 ? first.prefix.split("/").filter(Boolean) : [];
+      const routes = first.read.map((route2) => {
+        if (!route2.table || prefixSegments.length === 0) return route2;
+        const already = prefixSegments.every((segment, index) => route2.segments[index] === segment);
+        return already ? route2 : { ...route2, segments: [...prefixSegments, ...route2.segments], fullPath: true };
+      });
+      const servedBy = (router) => routes.map((route2) => completed(route2, router.heads, router.base));
+      const strip = (router) => {
+        if (first.prefix === void 0 || !first.read.some((route2) => route2.table)) return "";
+        const basePath = `/${router.base.join("/")}`;
+        if (router.base.length === prefixSegments.length && router.base.every((segment, index) => segment === prefixSegments[index])) return "";
+        return ` The router strips "${first.prefix}" off the path before reading its table, where the Portal's basePath is "${basePath}" \u2014 so every table route is served under "${first.prefix}", which is not where the contract puts it.`;
+      };
+      const portals = routers.map((router) => `"${router.portal.id}"`).join(", ");
+      const declaredBySome = (index) => routers.some((router) => {
+        const variants = servedBy(router)[index];
+        return variants.some((route2) => router.endpoints.some((endpoint) => answers(route2, endpoint)));
+      });
+      const undeclared = [...new Set(routes.map((_, index) => index).filter((index) => !declaredBySome(index)).flatMap((index) => servedBy(first)[index].map((route2) => route2.key)))].sort();
+      if (undeclared.length > 0) {
+        ctx.addIssue(
+          "warning",
+          "UNDECLARED_ROUTE",
+          `Portal "${first.portal.id}"'s router "${via}" (${where}) answers ${undeclared.length} route(s) no contract endpoint of ${routers.length > 1 ? `the Portals reading it (${portals})` : `"${first.portal.id}"`} declares \u2014 ${undeclared.map((key2) => `"${key2}"`).join(", ")}. A surface the code serves and the design never promised is how a write runs with no contract: no brief, no auth review, no rule reading it. Declare each as a contract method with its endpoint, or take the route out of the router.${strip(first)}`,
+          first.impl.id,
+          first.draftContext,
+          void 0,
+          { at: via, covers: undeclared }
+        );
+      }
+      for (const router of routers) {
+        const served = servedBy(router);
+        const unrouted = [...new Set(router.endpoints.filter((endpoint) => !served.some((variants) => variants.some((route2) => answers(route2, endpoint)))).map((endpoint) => endpoint.key))].sort();
+        if (unrouted.length === 0) continue;
+        ctx.addIssue(
+          "warning",
+          "UNROUTED_ENDPOINT",
+          `Portal "${router.portal.id}" binds ${unrouted.length} HTTP endpoint(s) that no route of its router "${via}" (${where}) answers \u2014 ${unrouted.map((key2) => `"${key2}"`).join(", ")}. The contract promises a route no request can reach. Route it in the router, or drop the endpoint from the contract.${strip(router)}`,
+          router.impl.id,
+          router.draftContext,
+          void 0,
+          { at: via, covers: unrouted }
+        );
       }
     }
   }
@@ -31017,7 +31609,7 @@ var routeCoverageRule = {
 var unclaimedSourceRule = {
   name: "unclaimed-source",
   judges: "code",
-  description: "Code\u2194spec Level 1, asked the other way round: every source file under the project's declared source roots must be named by some spec \u2014 an implementation's sourcePath, a method's, a simPath, a binding module an implementation declares in `bindings`, or a type's \u2014 or be carried in the frozen `rules.conformance.unclaimed` list. A pure re-export barrel declares nothing of its own and only republishes other modules, so it has no code to claim and is exempt (exact grade only: a weaker grade cannot tell a barrel from a file it failed to parse). Declaring no source roots leaves the check silent, which is what makes it opt-in; the unclaimed list is a one-way debt register, so an entry the walk no longer finds unclaimed must be deleted and the list can only shrink.",
+  description: "Code\u2194spec Level 1, asked the other way round: every source file under the project's declared source roots must be named by some spec \u2014 an implementation's sourcePath, a method's, a simPath, a binding module an implementation declares in `bindings`, the module a Portal's router linkage names (`<module>#<name>`, or the module alone), or a type's \u2014 or be carried in the frozen `rules.conformance.unclaimed` list. A pure re-export barrel declares nothing of its own and only republishes other modules, so it has no code to claim and is exempt (exact grade only: a weaker grade cannot tell a barrel from a file it failed to parse). Declaring no source roots leaves the check silent, which is what makes it opt-in; the unclaimed list is a one-way debt register, so an entry the walk no longer finds unclaimed must be deleted and the list can only shrink.",
   codes: [
     { code: "UNCLAIMED_SOURCE_FILE", defaultSeverity: "warning", summary: "A source file under a declared source root that no spec names and the frozen unclaimed list does not carry \u2014 code nobody designed" },
     { code: "STALE_UNCLAIMED_ENTRY", defaultSeverity: "warning", summary: "An entry of the frozen unclaimed list names a file that is now claimed, or that the source-root walk no longer finds \u2014 delete it, the list only shrinks" }
@@ -31031,6 +31623,8 @@ var unclaimedSourceRule = {
       for (const file of implementationSourceFiles(impl)) claimed.add(pathKey(file));
       if (impl.simPath) claimed.add(pathKey(impl.simPath));
       for (const file of impl.bindings ?? []) claimed.add(pathKey(file));
+      const routerFile = impl.router ? routerLinkage(impl.router).file : void 0;
+      if (routerFile) claimed.add(pathKey(routerFile));
     }
     for (const type of ctx.types) {
       for (const file of typeSourceFiles(type)) claimed.add(pathKey(file));
@@ -31066,7 +31660,7 @@ var NOTHING_PROMISED = /* @__PURE__ */ new Set();
 var exportConformanceRule = {
   name: "export-conformance",
   judges: "code",
-  description: "Code-to-contract for the SURFACE: does this file publish anything the components it realizes never promised, that another component then takes? The rest of the conformance set reads contract-to-code (it asks whether the code holds what a spec claims), so a file could export whatever it liked under a component's name and nothing looked. That is one half of the same hole as a contract promising a parameter it never passes. A method's `exportedVia` names the export a consumer imports to REACH it: the value that composes it, which `symbol` cannot name because `symbol` names the function inside. A Portal implementation's `router` names the entry whatever serves the Portal calls to hand it its requests. Both are declared publication, and a declared handle the file does not actually export is itself a finding, so naming one can never become a free-text suppression. Both questions are asked only of a file read at exact grade, and a taker counts only when its own import specifier resolves to the file it is accused of taking from: below that nothing separates an export from a mention, or a shared word from a shared module. A taker inside the owns fence is no crossing: a pattern constructs the blocks it owns, so the owner's file, or another member of the same pattern, importing a member's class is the owns relation made real.",
+  description: "Code-to-contract for the SURFACE: does this file publish anything the components it realizes never promised, that another component then takes? The rest of the conformance set reads contract-to-code (it asks whether the code holds what a spec claims), so a file could export whatever it liked under a component's name and nothing looked. That is one half of the same hole as a contract promising a parameter it never passes. A method's `exportedVia` names the export a consumer imports to REACH it: the value that composes it, which `symbol` cannot name because `symbol` names the function inside. A Portal implementation's `router` names the entry whatever serves the Portal calls to hand it its requests \u2014 in the Portal's own files, or, written `<module>#<name>`, in the module it names, which must export that name (a module named alone must be on disk). Both are declared publication, and a declared handle the file does not actually export is itself a finding, so naming one can never become a free-text suppression. Both questions are asked only of a file read at exact grade, and a taker counts only when its own import specifier resolves to the file it is accused of taking from: below that nothing separates an export from a mention, or a shared word from a shared module. A taker inside the owns fence is no crossing: a pattern constructs the blocks it owns, so the owner's file, or another member of the same pattern, importing a member's class is the owns relation made real.",
   codes: [
     {
       code: "UNDECLARED_EXPORT",
@@ -31132,6 +31726,22 @@ var exportConformanceRule = {
       const contract = ctx.interfaceMap.get(implementation.contract);
       const portal = contract ? ctx.componentMap.get(contract.component) : void 0;
       if (!portal || portal.componentType !== "Portal" || ctx.isInChainedSubproject(portal.subsystem)) continue;
+      const linkage = routerLinkage(handle);
+      if (linkage.file) {
+        const file = pathKey(linkage.file);
+        const facts = code.factsAt(file);
+        const missing = !facts || facts.status === "missing";
+        const exactHere = !!facts && facts.status === "analyzed" && facts.analysisGrade === "exact";
+        if (!missing && (!exactHere || linkage.name === void 0 || facts.exportedNames.includes(linkage.name))) continue;
+        ctx.addIssue(
+          "warning",
+          "UNREALIZED_EXPORT_HANDLE",
+          `Portal "${portal.id}" names its router "${handle}" (implementation "${implementation.id}"), but ` + (missing ? `"${file}" is not on disk.` : `"${file}" exports no "${linkage.name}".`) + " A `router` names the entry or the route table whatever serves the Portal hands its requests to, so one nobody can import promises a route nobody can reach, and it allows nothing either. Name an export the module actually has, or drop `router` if the Portal is served method by method.",
+          implementation.id,
+          ctx.isImplementationDraft(implementation) || ctx.isComponentDraft(portal.id)
+        );
+        continue;
+      }
       const files = realization.filesOf(portal.id).map(pathKey);
       const exact = files.filter((file) => {
         const facts = code.factsAt(file);
@@ -31388,14 +31998,14 @@ var methodCohesionRule = {
       if (calledBy.size < 2) continue;
       const groups = groupsSharingCollaborators(calledBy).filter((g) => g.length >= 2);
       if (groups.length < 2) continue;
-      const described = groups.map((g) => {
+      const described2 = groups.map((g) => {
         const collaborators = [...new Set(g.flatMap((m) => [...calledBy.get(m)]))].sort();
         return `${g.join(", ")} (calling ${collaborators.join(", ")})`;
       }).join("; ");
       ctx.addIssue(
         "warning",
         "INCOHESIVE_METHODS",
-        `Orchestrator "${component.id}" holds ${groups.length} groups of methods that share no called component: ${described}. Split it along those groups, move the logic out until every method is a single hand-off (a pure forwarder is exempt), or acknowledge a deliberate facade with a reasoned lint.allow for INCOHESIVE_METHODS.`,
+        `Orchestrator "${component.id}" holds ${groups.length} groups of methods that share no called component: ${described2}. Split it along those groups, move the logic out until every method is a single hand-off (a pure forwarder is exempt), or acknowledge a deliberate facade with a reasoned lint.allow for INCOHESIVE_METHODS.`,
         component.id,
         ctx.isComponentDraft(component.id)
       );
@@ -32963,6 +33573,7 @@ function compilerIdentity(projectRoot) {
 }
 var HTTP_VERBS = /* @__PURE__ */ new Set(["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"]);
 var METHOD_KEYS = /* @__PURE__ */ new Set(["method", "verb", "httpMethod"]);
+var ROUTER_TEXT = /[Mm][Ee][Tt][Hh][Oo][Dd]|[Vv][Ee][Rr][Bb]|\b(?:GET|POST|PUT|PATCH|DELETE)\b/;
 var PATH_KEYS = /* @__PURE__ */ new Set(["path", "pattern", "route", "url", "template"]);
 var SETTLE_DEPTH = 8;
 var LITERAL_SEGMENT = /^[\w.~@!$&'+,;=%-]+$/;
@@ -33142,7 +33753,7 @@ function tableEntry(ts, entry, initializerOf, literalOf) {
   }
   const verb = keyedVerb ?? (verbs.length === 1 ? verbs[0] : void 0);
   const route2 = keyedPath ?? (paths.length === 1 ? paths[0] : void 0);
-  return verb && route2 ? { verb, segments: route2.segments, exactLength: route2.exactLength, fullPath: true } : void 0;
+  return verb && route2 ? { verb, segments: route2.segments, exactLength: route2.exactLength, fullPath: true, table: true } : void 0;
 }
 function tableRoutes(ts, value, initializerOf, literalOf) {
   const at = bareExpression(ts, value);
@@ -33159,16 +33770,38 @@ function tableRoutes(ts, value, initializerOf, literalOf) {
   }
   if (ts.isObjectLiteralExpression(at)) {
     for (const property of at.properties) {
-      const key2 = property.name ? propertyKeyText(ts, property.name) : void 0;
+      const key2 = !property.name ? void 0 : ts.isComputedPropertyName(property.name) ? settleString(ts, property.name.expression, initializerOf, literalOf) : propertyKeyText(ts, property.name);
       const match2 = key2 ? /^([A-Za-z]+)\s+(\/\S*)$/.exec(key2) : null;
       if (!match2 || !HTTP_VERBS.has(match2[1].toUpperCase())) return [];
       const segments = templateSegments(match2[2]);
       if (!segments) return [];
-      out.push({ verb: match2[1].toUpperCase(), segments, exactLength: true, fullPath: true });
+      out.push({ verb: match2[1].toUpperCase(), segments, exactLength: true, fullPath: true, table: true });
     }
   }
   return out;
 }
+function strippedAnywhere(ts, body, initializerOf, literalOf) {
+  const UNSETTLED = "\0";
+  const prefixes = /* @__PURE__ */ new Set();
+  const strip = (node) => {
+    if (namedFunctionNameOf(ts, node) !== void 0 && node !== body) return;
+    if (ts.isCallExpression(node) && ts.isPropertyAccessExpression(node.expression)) {
+      const name = node.expression.name.text;
+      const [first, second] = node.arguments;
+      if ((name === "slice" || name === "substring" || name === "substr") && node.arguments.length === 1 && first && ts.isPropertyAccessExpression(first) && first.name.text === "length") {
+        prefixes.add(settleString(ts, first.expression, initializerOf, literalOf) ?? UNSETTLED);
+      } else if (name === "replace" && first && second && !ts.isRegularExpressionLiteral(first) && settleString(ts, second, initializerOf, literalOf) === "") {
+        prefixes.add(settleString(ts, first, initializerOf, literalOf) ?? UNSETTLED);
+      }
+    }
+    ts.forEachChild(node, strip);
+  };
+  strip(body);
+  if (prefixes.size !== 1) return void 0;
+  const [prefix] = [...prefixes];
+  if (!prefix.startsWith("/") || prefix.length < 2) return void 0;
+  return prefix.split("/").filter(Boolean).every((segment) => LITERAL_SEGMENT.test(segment)) ? prefix : void 0;
+}
 function strippedPrefix(ts, body, initializerOf, literalOf) {
   const sources = [];
   const find = (node) => {
@@ -33279,6 +33912,16 @@ function readRoutes(ts, fn, initializerOf, literalOf) {
     ts.forEachChild(node, names);
   };
   names(fn.body);
+  const inPlace = (value) => {
+    for (const route2 of tableRoutes(ts, value, initializerOf, literalOf)) routes.set(routeKey2(route2), route2);
+  };
+  if (!ts.isBlock(fn.body)) inPlace(fn.body);
+  const returns = (node) => {
+    if (namedFunctionNameOf(ts, node) !== void 0) return;
+    if (ts.isReturnStatement(node) && node.expression) inPlace(node.expression);
+    ts.forEachChild(node, returns);
+  };
+  returns(fn.body);
   return routes;
 }
 function walkExact(ts, sourceText, fileName) {
@@ -33577,6 +34220,47 @@ function walkExact(ts, sourceText, fileName) {
     const container = containerOf(owner);
     return container !== void 0 ? { container } : nested;
   };
+  const readsOff = (body, name) => {
+    const out = /* @__PURE__ */ new Set();
+    const visit2 = (node) => {
+      if (out.size >= 64) return;
+      if (ts.isIdentifier(node) && node.text === name) {
+        const parent = node.parent;
+        const memberName = !!parent && (ts.isPropertyAccessExpression(parent) && parent.name === node || ts.isPropertyAssignment(parent) && parent.name === node);
+        if (!memberName) {
+          let at = node;
+          for (; ; ) {
+            const up = at.parent;
+            if (!up) break;
+            if (ts.isParenthesizedExpression(up) || ts.isNonNullExpression(up) || ts.isAsExpression(up)) {
+              at = up;
+              continue;
+            }
+            if (ts.isPropertyAccessExpression(up) && up.expression === at) {
+              out.add(up.name.text);
+              at = up;
+              continue;
+            }
+            if (ts.isElementAccessExpression(up) && up.expression === at && ts.isStringLiteralLike(up.argumentExpression)) {
+              out.add(up.argumentExpression.text);
+              at = up;
+              continue;
+            }
+            if (ts.isVariableDeclaration(up) && up.initializer === at && ts.isObjectBindingPattern(up.name)) {
+              for (const element of up.name.elements) {
+                const key2 = element.propertyName ?? element.name;
+                if (ts.isIdentifier(key2) || ts.isStringLiteral(key2)) out.add(key2.text);
+              }
+            }
+            break;
+          }
+        }
+      }
+      ts.forEachChild(node, visit2);
+    };
+    visit2(body);
+    return [...out].sort();
+  };
   const declaredParameters = (fn) => {
     const parameters = fn.parameters ?? [];
     const used = /* @__PURE__ */ new Set();
@@ -33598,6 +34282,14 @@ function walkExact(ts, sourceText, fileName) {
       if (ts.isIdentifier(parameter.name)) {
         fact.name = parameter.name.text;
         if (!used.has(fact.name) && !used.has("arguments")) fact.unused = true;
+        else if (body) {
+          const read2 = readsOff(body, fact.name);
+          if (read2.length > 0) fact.reads = read2;
+        }
+      }
+      if (parameter.type && ts.isTypeReferenceNode(parameter.type)) {
+        const named2 = ts.isIdentifier(parameter.type.typeName) ? parameter.type.typeName.text : parameter.type.typeName.right.text;
+        if (TRANSPORT_TYPES.has(named2)) fact.transport = true;
       }
       if (parameter.type) fact.type = parameter.type.getText(sf).replace(/\s+/g, " ").trim();
       return fact;
@@ -33875,14 +34567,24 @@ function walkExact(ts, sourceText, fileName) {
     ts.forEachChild(node, visit);
   };
   visit(sf);
-  const fileValues = fileInitializer(ts, topLevelConstants(ts, sf));
+  const constants = topLevelConstants(ts, sf);
+  const fileValues = fileInitializer(ts, constants);
+  const routePrefixes = /* @__PURE__ */ new Map();
   for (const { name, node } of routeBodies) {
+    const body = node.body;
+    const prefix = body ? strippedAnywhere(ts, body, fileValues, void 0) : void 0;
+    if (prefix !== void 0) routePrefixes.set(name, prefix);
     const routes = readRoutes(ts, node, fileValues);
     if (routes.size === 0) continue;
     const known = functionRoutes.get(name) ?? /* @__PURE__ */ new Map();
     for (const [key2, route2] of routes) known.set(key2, route2);
     functionRoutes.set(name, known);
   }
+  for (const [name, initializer] of constants) {
+    if (functionRoutes.has(name)) continue;
+    const table = tableRoutes(ts, initializer, fileValues, void 0);
+    if (table.length > 0) functionRoutes.set(name, new Map(table.map((route2) => [routeKey2(route2), route2])));
+  }
   const composedMembers = (expression, seen) => {
     const extensions = [];
     const compose3 = (members) => {
@@ -33941,7 +34643,7 @@ function walkExact(ts, sourceText, fileName) {
     importBindings.set(name, fact);
   }
   for (const alias of propertyAliases) if (exported.has(alias.container)) exportAliases.push(alias);
-  return { declared, anchors, exported, imports, reexports, starExports, namedReexports, exportAliases, returnTypes, complexity, calls, bodies, importBindings, typeOnlyBindings, fieldTypes, localTypes, memberTypes, aliasTargets: aliasTargets2, implementsClauses, typeShapes, functionParams, paramSites, functionRoutes, asyncFunctions, enumValues, aliasTypes, mutableBindings, reexportOnly };
+  return { declared, anchors, exported, imports, reexports, starExports, namedReexports, exportAliases, returnTypes, complexity, calls, bodies, importBindings, typeOnlyBindings, fieldTypes, localTypes, memberTypes, aliasTargets: aliasTargets2, implementsClauses, typeShapes, functionParams, paramSites, functionRoutes, routePrefixes, asyncFunctions, enumValues, aliasTypes, mutableBindings, reexportOnly };
 }
 var NO_PACKAGES = /* @__PURE__ */ new Map();
 function resolveModule(fromFile, specifier, packages) {
@@ -34276,7 +34978,7 @@ function checkerOptions(ts, projectRoot) {
 }
 function resolveCalls(ts, files, projectRoot) {
   const out = /* @__PURE__ */ new Map();
-  if (files.size === 0) return { calls: out, imports: /* @__PURE__ */ new Map(), kinds: /* @__PURE__ */ new Map(), routes: /* @__PURE__ */ new Map(), crossProjectImports: /* @__PURE__ */ new Map() };
+  if (files.size === 0) return { calls: out, imports: /* @__PURE__ */ new Map(), kinds: /* @__PURE__ */ new Map(), routes: /* @__PURE__ */ new Map(), prefixes: /* @__PURE__ */ new Map(), crossProjectImports: /* @__PURE__ */ new Map() };
   const options = checkerOptions(ts, projectRoot);
   const settings = JSON.stringify(options);
   const host = ts.createCompilerHost(options, true);
@@ -34296,7 +34998,7 @@ function resolveCalls(ts, files, projectRoot) {
   try {
     program = ts.createProgram({ rootNames: [...files.keys()], options, host });
   } catch {
-    return { calls: out, imports: /* @__PURE__ */ new Map(), kinds: /* @__PURE__ */ new Map(), routes: /* @__PURE__ */ new Map(), crossProjectImports: /* @__PURE__ */ new Map() };
+    return { calls: out, imports: /* @__PURE__ */ new Map(), kinds: /* @__PURE__ */ new Map(), routes: /* @__PURE__ */ new Map(), prefixes: /* @__PURE__ */ new Map(), crossProjectImports: /* @__PURE__ */ new Map() };
   }
   const checker = program.getTypeChecker();
   const assignable = checker.isTypeAssignableTo;
@@ -34691,6 +35393,26 @@ function resolveCalls(ts, files, projectRoot) {
     if (where.container !== void 0) fact.enclosingContainer = where.container;
     return fact;
   };
+  const opaqueReferenceOf = (node) => {
+    if (!ts.isPropertyAccessExpression(node) || !isValuePosition(node)) return void 0;
+    const symbol = symbolOf(node.name);
+    if (symbol?.declarations?.length) return void 0;
+    const receiver = node.expression;
+    if (!(isOpaque(checker.getTypeAtLocation(receiver)) || rootOpaque(receiver))) return void 0;
+    const fact = {
+      name: node.name.text,
+      written: node.getText().replace(/\s+/g, " ").slice(0, 80),
+      targets: [],
+      reference: true,
+      unresolved: true
+    };
+    const receivers = receiversOf(receiver, node.name.text);
+    if (receivers.length > 0) fact.receivers = receivers;
+    const where = enclosingOf(node);
+    if (where.name !== void 0) fact.enclosing = where.name;
+    if (where.container !== void 0) fact.enclosingContainer = where.container;
+    return fact;
+  };
   const resolveFile = (sf) => {
     const calls = [];
     const visit = (node) => {
@@ -34699,7 +35421,7 @@ function resolveCalls(ts, files, projectRoot) {
           const fact = resolveOne2(node);
           if (fact) calls.push(fact);
         } else if (ts.isPropertyAccessExpression(node) || ts.isElementAccessExpression(node) || ts.isIdentifier(node)) {
-          const fact = referenceOf(node) ?? (ts.isElementAccessExpression(node) ? computedAccessOf(node) : void 0);
+          const fact = referenceOf(node) ?? (ts.isElementAccessExpression(node) ? computedAccessOf(node) : opaqueReferenceOf(node));
           if (fact) calls.push(fact);
         }
       } catch {
@@ -34768,6 +35490,7 @@ function resolveCalls(ts, files, projectRoot) {
   }
   const kinds = /* @__PURE__ */ new Map();
   const routes = /* @__PURE__ */ new Map();
+  const prefixes = /* @__PURE__ */ new Map();
   const crossProjectImports = /* @__PURE__ */ new Map();
   const literalOf = (node) => {
     const type = checker.getTypeAtLocation(node);
@@ -34798,24 +35521,42 @@ function resolveCalls(ts, files, projectRoot) {
     if (!sf) continue;
     const fileKinds = [];
     const fileRoutes = /* @__PURE__ */ new Map();
+    const filePrefixes = /* @__PURE__ */ new Map();
     const visit = (node) => {
       const name = namedFunctionNameOf(ts, node);
       const body = node.body;
       if (name !== void 0 && body) {
         fileKinds.push((node.parameters ?? []).map((parameter) => {
           try {
-            return kindOf4(checker.getTypeAtLocation(parameter)) ?? platformKind(parameter.type);
+            const type = checker.getTypeAtLocation(parameter);
+            const kind = kindOf4(type) ?? platformKind(parameter.type);
+            const reading = {};
+            if (kind) reading.kind = kind;
+            if (kind === "object") {
+              const props = checker.getPropertiesOfType(checker.getNonNullableType(type)).map((p) => p.getName());
+              if (props.length > 0) reading.fields = props.slice(0, 200);
+            }
+            return reading;
           } catch {
-            return void 0;
+            return {};
           }
         }));
-        if (/method|verb/i.test(body.getText(sf))) try {
+        if (ROUTER_TEXT.test(body.getText(sf))) try {
           const read2 = readRoutes(ts, node, initializerOf, literalOf);
           if (read2.size > 0) {
             const known = fileRoutes.get(name) ?? /* @__PURE__ */ new Map();
             for (const [routeKeyText, route2] of read2) known.set(routeKeyText, route2);
             fileRoutes.set(name, known);
           }
+          const prefix = strippedAnywhere(ts, body, initializerOf, literalOf);
+          if (prefix !== void 0) filePrefixes.set(name, prefix);
+        } catch {
+        }
+      }
+      if (ts.isVariableDeclaration(node) && ts.isIdentifier(node.name) && node.initializer && node.parent && ts.isVariableDeclarationList(node.parent) && node.parent.parent && ts.isVariableStatement(node.parent.parent) && node.parent.parent.parent === sf) {
+        try {
+          const table = tableRoutes(ts, node.initializer, initializerOf, literalOf);
+          if (table.length > 0) fileRoutes.set(node.name.text, new Map(table.map((route2) => [routeKey2(route2), route2])));
         } catch {
         }
       }
@@ -34824,6 +35565,7 @@ function resolveCalls(ts, files, projectRoot) {
     visit(sf);
     kinds.set(key2, fileKinds);
     routes.set(key2, new Map([...fileRoutes].map(([name, read2]) => [name, [...read2.values()]])));
+    if (filePrefixes.size > 0) prefixes.set(key2, filePrefixes);
     const broken = [];
     for (const statement of sf.statements) {
       if (!ts.isImportDeclaration(statement) || !ts.isStringLiteralLike(statement.moduleSpecifier)) continue;
@@ -34854,19 +35596,28 @@ function resolveCalls(ts, files, projectRoot) {
           return false;
         }
       };
-      if (clause?.name && unresolvedName(clause.name)) {
-        broken.push({ specifier, name: "default", project: project3, line, typeOnly: clause.isTypeOnly });
+      const module2 = pathKey(path20.relative(home, path20.resolve(resolved)));
+      const reached = (name, typeOnly) => {
+        broken.push({ specifier, ...name !== void 0 ? { name } : {}, project: project3, line, typeOnly, resolved: true, module: module2 });
+      };
+      if (clause?.name) {
+        if (unresolvedName(clause.name)) broken.push({ specifier, name: "default", project: project3, line, typeOnly: clause.isTypeOnly });
+        else reached(clause.name.text, clause.isTypeOnly);
       }
       if (clause?.namedBindings && ts.isNamedImports(clause.namedBindings)) {
         for (const element of clause.namedBindings.elements) {
-          if (!unresolvedName(element.name)) continue;
-          broken.push({ specifier, name: (element.propertyName ?? element.name).text, project: project3, line, typeOnly: clause.isTypeOnly || element.isTypeOnly });
+          const name = (element.propertyName ?? element.name).text;
+          if (unresolvedName(element.name)) broken.push({ specifier, name, project: project3, line, typeOnly: clause.isTypeOnly || element.isTypeOnly });
+          else reached(name, clause.isTypeOnly || element.isTypeOnly);
         }
+      } else if (clause?.namedBindings) {
+        reached("*", clause.isTypeOnly);
       }
+      if (!clause) reached(void 0, false);
     }
     if (broken.length > 0) crossProjectImports.set(key2, broken);
   }
-  return { calls: out, imports, kinds, routes, crossProjectImports };
+  return { calls: out, imports, kinds, routes, prefixes, crossProjectImports };
   function platformKind(annotation) {
     if (!annotation || !ts.isTypeReferenceNode(annotation)) return void 0;
     const name = ts.isIdentifier(annotation.typeName) ? annotation.typeName.text : annotation.typeName.right.text;
@@ -34915,6 +35666,22 @@ var PLATFORM_OBJECT_TYPES = /* @__PURE__ */ new Set([
   "Socket",
   "Buffer"
 ]);
+var TRANSPORT_TYPES = /* @__PURE__ */ new Set([
+  "URL",
+  "URLSearchParams",
+  "Request",
+  "Response",
+  "Headers",
+  "IncomingMessage",
+  "ServerResponse",
+  "Http2ServerRequest",
+  "Http2ServerResponse",
+  "Socket",
+  "FastifyRequest",
+  "FastifyReply",
+  "NextRequest",
+  "NextResponse"
+]);
 function buildCodeModel(implementations, types, projectRoot, sourceRoots = [], exclude = []) {
   const files = [];
   const seen = /* @__PURE__ */ new Set();
@@ -34930,6 +35697,8 @@ function buildCodeModel(implementations, types, projectRoot, sourceRoots = [], e
   for (const impl of implementations) {
     declaredPaths.push(...implementationSourceFiles(impl));
     if (impl.simPath) declaredPaths.push(impl.simPath);
+    const routerFile = impl.router ? routerLinkage(impl.router).file : void 0;
+    if (routerFile) declaredPaths.push(routerFile);
   }
   for (const type of types) declaredPaths.push(...typeSourceFiles(type));
   declaredPaths.push(...rootFiles);
@@ -34999,6 +35768,7 @@ function buildCodeModel(implementations, types, projectRoot, sourceRoots = [], e
             typeShapes: Object.fromEntries(facts.typeShapes),
             functionParams: Object.fromEntries(facts.functionParams),
             functionRoutes: Object.fromEntries([...facts.functionRoutes].map(([k, v]) => [k, [...v.values()]])),
+            ...facts.routePrefixes.size > 0 ? { routePrefixes: Object.fromEntries(facts.routePrefixes) } : {},
             asyncFunctions: [...facts.asyncFunctions],
             enumValues: Object.fromEntries(facts.enumValues),
             aliasTypes: Object.fromEntries(facts.aliasTypes),
@@ -35045,13 +35815,16 @@ function buildCodeModel(implementations, types, projectRoot, sourceRoots = [], e
         sites.forEach((site, index) => {
           if (settled[index].length !== site.params.length) return;
           site.params.forEach((param, at) => {
-            const kind = settled[index][at];
-            if (kind) param.kind = kind;
+            const reading2 = settled[index][at];
+            if (reading2.kind) param.kind = reading2.kind;
+            if (reading2.fields) param.fields = reading2.fields;
           });
         });
       }
       const read2 = reading.routes.get(facts.path);
       if (read2 && read2.size > 0) facts.functionRoutes = { ...facts.functionRoutes ?? {}, ...Object.fromEntries(read2) };
+      const stripped = reading.prefixes.get(facts.path);
+      if (stripped && stripped.size > 0) facts.routePrefixes = { ...facts.routePrefixes ?? {}, ...Object.fromEntries(stripped) };
       const broken = reading.crossProjectImports.get(facts.path);
       if (broken) facts.crossProjectImports = broken;
     }
@@ -35983,7 +36756,12 @@ var INTRODUCED_CODES = /* @__PURE__ */ new Set([
   "ARCHITECTURE_VIOLATION_QUERY_DEP",
   "ENDPOINT_ROUTE_DUPLICATE"
 ]);
-function introducedFindings(kind, candidate, opts = {}) {
+var BOUNDARY_CODES = /* @__PURE__ */ new Set([
+  "CROSS_SUBSYSTEM_NON_ADAPTER",
+  "CROSS_SUBSYSTEM_PRIVATE_ACCESS",
+  "CROSS_SUBSYSTEM_TARGET_NON_PORTAL"
+]);
+function introducedFindings(kind, candidate, opts = {}, others = []) {
   if (kind !== "component" && kind !== "interface") return { errors: [], warnings: [], notices: [] };
   const index = scanAllSpecs({ memberDepth: 0 });
   registerBuiltinRules();
@@ -36010,18 +36788,28 @@ function introducedFindings(kind, candidate, opts = {}) {
     });
     entrypointDepsRule.check(ctx);
     dataBlockDepsRule.check(ctx);
+    subsystemBoundaryDepsRule.check(ctx);
     portalsRule.check(ctx);
-    return issues.filter((i) => INTRODUCED_CODES.has(i.code));
+    return issues.filter((i) => INTRODUCED_CODES.has(i.code) || BOUNDARY_CODES.has(i.code));
   };
+  const changed = kind === "component" ? [candidate, ...others] : others;
+  const afterComponents = changed.reduce((list, spec) => swapped(list, spec), index.components);
   const before = run3(index.components, index.interfaces);
-  const after = kind === "component" ? run3(swapped(index.components, candidate), index.interfaces) : run3(index.components, swapped(index.interfaces, candidate));
+  const after = kind === "component" ? run3(afterComponents, index.interfaces) : run3(afterComponents, swapped(index.interfaces, candidate));
   const key2 = (i) => `${i.code}|${i.specId ?? ""}|${i.message}`;
   const held = new Set(before.map(key2));
   const added = after.filter((i) => !held.has(key2(i)));
+  const fixedEdges = afterComponents.flatMap((comp) => (comp.dependsOn ?? []).flatMap((ref) => {
+    const target = afterComponents.find((c) => c.id === ref);
+    return target && target.subsystem !== comp.subsystem && target.componentType !== "Portal" ? [{ from: comp.id, to: target.id }] : [];
+  }));
+  const fixed = (i) => !BOUNDARY_CODES.has(i.code) || fixedEdges.some((e) => e.from === i.specId && i.message.includes(`"${e.to}"`));
+  const curable = added.filter((i) => !fixed(i));
+  const decided = added.filter(fixed);
   return {
-    errors: added.filter((i) => i.severity === "error"),
-    warnings: added.filter((i) => i.severity === "warning"),
-    notices: added.filter((i) => i.severity === "notice")
+    errors: decided.filter((i) => i.severity === "error"),
+    warnings: [...decided.filter((i) => i.severity === "warning"), ...curable.filter((i) => i.severity !== "notice")],
+    notices: [...decided, ...curable].filter((i) => i.severity === "notice")
   };
 }
 
@@ -37203,8 +37991,8 @@ function generateSequenceDiagram(componentId, methodName, options) {
     const steps = [...methodImpl.narrative].sort((a, b) => a.stepNumber - b.stepNumber);
     for (const step of steps) {
       for (const par of parallelArms) {
-        const sep17 = par.sepByStep.get(step.stepNumber);
-        if (sep17 !== void 0) lines.push(`  and ${escapeLabel(sep17)}`);
+        const sep18 = par.sepByStep.get(step.stepNumber);
+        if (sep18 !== void 0) lines.push(`  and ${escapeLabel(sep18)}`);
       }
       switch (step.type) {
         case "local":
@@ -37459,6 +38247,7 @@ function bindReferencedMembers(node, root) {
   const out = [];
   for (const member of declaredMembers(root.config ?? {})) {
     if (member.problem || member.storage === "contained" || root.parts.some((p) => p.alias === member.alias)) continue;
+    if (member.storage === "path" && !root.referenced.some((r) => r.alias === member.alias)) continue;
     const base = { alias: member.alias, project: member.alias, audience: "instance", role: "member" };
     if (member.storage === "hosted") {
       out.push({ ...base, sourceKind: "hosted", hosted: member.source.hosted });
@@ -38552,6 +39341,9 @@ function headAcross(rootDir, dir) {
   if (ours !== null && key2(ours) === key2(theirs)) return void 0;
   return head(dir) ?? void 0;
 }
+function followsLive(decl) {
+  return decl.storage === "contained" || decl.storage === "path";
+}
 var PART_FORBIDDEN_FIELDS = ["members", "externals", "rules", "extensions", "composition", "targets", "network"];
 function whereToEdit(decl, dir) {
   if (decl.storage === "git") {
@@ -39525,11 +40317,11 @@ function rewriteSpecRefs(raw, remap) {
       changed = true;
     }
   };
-  const rewritePair = (holder, componentKey, methodKey2) => {
-    const component = holder?.[componentKey];
+  const rewritePair = (holder, componentKey2, methodKey2) => {
+    const component = holder?.[componentKey2];
     const method2 = holder?.[methodKey2];
     rewriteMethod(holder, methodKey2, component);
-    rewrite(holder, componentKey, "component", typeof method2 === "string" ? method2 : void 0);
+    rewrite(holder, componentKey2, "component", typeof method2 === "string" ? method2 : void 0);
   };
   const entries = (list) => Array.isArray(list) ? list : [];
   const rewriteEach = (list, position) => {
@@ -39976,7 +40768,7 @@ function carriesEditMarker(item) {
   const o = item;
   return o.action !== void 0 || o.remove !== void 0;
 }
-function ineffectiveDeltaPaths(delta, merged, stored) {
+function ineffectiveDeltaPaths(delta, merged, stored, respellings) {
   const out = [];
   const isPlain = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
   const same = (a, b) => JSON.stringify(a) === JSON.stringify(b);
@@ -39995,8 +40787,9 @@ function ineffectiveDeltaPaths(delta, merged, stored) {
       if (plain.length > 0) {
         const text3 = (v) => v && typeof v === "object" ? String(v.description ?? JSON.stringify(v)) : String(v);
         const holds = (list, x) => Array.isArray(list) && list.some((y) => text3(y) === String(x));
+        const order2 = (list) => Array.isArray(list) ? list.map(text3) : [];
         if (plain.some((x) => !holds(m, x))) say(path52, "the level does not keep this value, so the write dropped it");
-        else if (plain.every((x) => holds(s, x)) && d.every((x) => plain.includes(x))) say(path52, "the stored spec already held this value");
+        else if (plain.every((x) => holds(s, x)) && d.every((x) => plain.includes(x)) && same(order2(m), order2(s))) say(path52, "the stored spec already held this value");
         if (d.every((x) => plain.includes(x) || carriesEditMarker(x))) return;
       }
       for (const element of d) {
@@ -40026,8 +40819,9 @@ function ineffectiveDeltaPaths(delta, merged, stored) {
       walk2(d, m, s, path52, field);
       return;
     }
-    if (!same(m, d)) say(path52, "the write did not store it \u2014 the level's schema does not keep this value");
-    else if (same(s, d)) say(path52, "the stored spec already held this value");
+    const respelled2 = typeof d === "string" && typeof m === "string" && (respellings ?? []).some((r) => r.written === d && r.stored === m);
+    if (!same(m, d) && !respelled2) say(path52, "the write did not store it \u2014 the level's schema does not keep this value");
+    else if (same(s, d) || respelled2 && same(s, m)) say(path52, "the stored spec already held this value");
   };
   function walk2(d, m, s, path52, container) {
     for (const [key2, value] of Object.entries(d)) {
@@ -40234,7 +41028,8 @@ var SpecWorkspace = class {
     for (const decl of raw.members) this.readMemberKind(raw, decl);
     if (depth >= maxDepth) return;
     for (const decl of raw.members) {
-      if (decl.kind === "part" || decl.storage !== "contained") continue;
+      if (decl.kind === "part" || !followsLive(decl)) continue;
+      if (raw.record.referenced.some((r) => r.alias === decl.alias)) continue;
       const childDir = this.followableMember(raw, decl, ancestors);
       if (!childDir) continue;
       const before = raws.length;
@@ -40258,7 +41053,7 @@ var SpecWorkspace = class {
       return null;
     }
     const childDir = path23.resolve(raw.dir, decl.path);
-    if (projectPathEscapesRoot(raw.dir, decl.path, childDir)) {
+    if (decl.storage !== "path" && projectPathEscapesRoot(raw.dir, decl.path, childDir)) {
       this.loaderIssues.push({
         severity: "error",
         code: "PROJECTPATH_ESCAPE",
@@ -40349,7 +41144,7 @@ var SpecWorkspace = class {
       this.memberProblem(raw, "kind-mismatch", decl.alias, `the member "${decl.alias}" is asserted \`as: ${asserted}\`, but its content makes it a ${kind}: ${kind === "project" ? "its tree declares an id, holds an L0 or carries a lock \u2014 drop the `as`, or remove that content with `wairon member demote`" : "its tree declares no id, holds no L0 and carries no lock \u2014 drop the `as`, or create the project content with `wairon member promote`"}`);
     }
     if (kind === "part") this.readPart(raw, decl, located2.dir, located2.commit);
-    else if (decl.storage !== "contained") this.recordReferenced(raw, decl, located2.dir, located2.commit);
+    else if (!followsLive(decl)) this.recordReferenced(raw, decl, located2.dir, located2.commit);
   }
   /**
    * A referenced project member (stage 8): where its root is — the sibling
@@ -40854,9 +41649,9 @@ var SpecWorkspace = class {
     return { root: root.dir, project: root.project, subsystemId };
   }
   /** The local id of a component's subsystem, by the component's key; null when no such component is stored. */
-  componentSubsystem(componentKey) {
-    if (!componentKey) return null;
-    const subsystem = this.loadComponentSpec(componentKey)?.subsystem;
+  componentSubsystem(componentKey2) {
+    if (!componentKey2) return null;
+    const subsystem = this.loadComponentSpec(componentKey2)?.subsystem;
     return subsystem ? splitNamespace(subsystem).localId : null;
   }
   /**
@@ -41332,12 +42127,12 @@ var SpecWorkspace = class {
     return this.relativizeSpec("interface", stored);
   }
   prepareImplementationForWrite(spec, carry = true) {
-    const relative25 = this.relativizeSpec("implementation", spec, carry);
+    const relative27 = this.relativizeSpec("implementation", spec, carry);
     const member = this.getSubprojectPrefix(spec.id);
     const memberRoot = member ? this.resolveSubprojectForNamespace(member) : null;
-    if (memberRoot) return childRelativeFilePaths(relative25, this.rootDir, memberRoot);
+    if (memberRoot) return childRelativeFilePaths(relative27, this.rootDir, memberRoot);
     const partDir = this.partHolding(this.getImplementationPath(spec.id, spec.contract))?.part.directory;
-    return partDir ? partRelativeFilePaths(relative25, this.rootDir, partDir) : relative25;
+    return partDir ? partRelativeFilePaths(relative27, this.rootDir, partDir) : relative27;
   }
   /**
    * A type written in its stored form — every type position canonical (one
@@ -41347,9 +42142,9 @@ var SpecWorkspace = class {
   prepareTypeForWrite(spec) {
     const canonical3 = typeCanonicalTypes(spec).spec;
     const stored = { ...canonical3, methods: (canonical3.methods ?? []).map((m) => storedTypeMethod(m)) };
-    const relative25 = this.relativizeSpec("type", stored);
+    const relative27 = this.relativizeSpec("type", stored);
     const partDir = this.partHolding(this.getTypePath(spec.id, spec.subsystem, spec.group))?.part.directory;
-    return partDir ? partRelativeTypePaths(relative25, this.rootDir, partDir) : relative25;
+    return partDir ? partRelativeTypePaths(relative27, this.rootDir, partDir) : relative27;
   }
   prepareGroupForWrite(spec) {
     return this.relativizeSpec("group", spec);
@@ -41940,7 +42735,8 @@ var SpecWorkspace = class {
     const rawRewritten = refKind === "component" ? withUniqueTargets(rewritten) : rewritten;
     this.carryDisabled = true;
     try {
-      if (JSON.stringify(this.prepareForKind(refKind, rawRewritten)) === asStored) return false;
+      const prepared = this.prepareForKind(refKind, rawRewritten);
+      if (JSON.stringify(prepared) === asStored && !this.storedTextsStale(refKind, id, prepared)) return false;
       this.saveOfKind(refKind, rawRewritten, { preserveUpdatedAt: true });
     } finally {
       this.carryDisabled = false;
@@ -41985,10 +42781,25 @@ var SpecWorkspace = class {
       );
     }
     if (JSON.stringify(document) === JSON.stringify(stored)) return false;
+    if (kind === "interface" || kind === "type") deriveMergedTexts(kind, document);
     this.writeHome(file, document, kind);
     registryInvalidateCache();
     return true;
   }
+  /**
+   * Whether the stored file of one interface or type holds a method text its
+   * prepared form re-derives differently: the text a raw rewrite of its params
+   * left behind.
+   */
+  storedTextsStale(kind, id, prepared) {
+    if (kind !== "interface" && kind !== "type") return false;
+    const file = this.storedFileOf(kind, id);
+    if (!file || !pathExists(file)) return false;
+    const stored = readSpecFile(file);
+    const storedText = new Map((stored?.methods ?? []).filter((m) => m && typeof m === "object").map((m) => [m.name, m.signature]));
+    const methods = prepared.methods ?? [];
+    return methods.some((m) => m.signature !== void 0 && storedText.has(m.name) && storedText.get(m.name) !== m.signature);
+  }
   /** The file holding one stored spec, by its in-memory key from the bound root; a system by its project's key. */
   storedFileOf(kind, id) {
     const index = this.scanAll();
@@ -42339,8 +43150,8 @@ var SpecWorkspace = class {
     const renamedBy = {
       component: "rename it with sdd_rename_component, which moves its contract and implementation with it and rewrites every reference",
       type: "rename it with sdd_rename_type, which rewrites every reference",
-      interface: "a contract's id follows its component's: sdd_rename_component renames both; no tool renames a contract alone yet",
-      implementation: "an implementation's id follows its component's: sdd_rename_component renames both; no tool renames an implementation alone yet",
+      interface: "rename it with sdd_rename_spec (kind interface), which rewrites every implementation's contract and every export entry naming it",
+      implementation: "rename it with sdd_rename_spec (kind implementation), which moves its file and keys its findings to the new id",
       subsystem: "no tool renames a subsystem yet"
     };
     if (kind !== "system" && changes("id")) {
@@ -42351,8 +43162,8 @@ var SpecWorkspace = class {
     }
     if ((kind === "component" || kind === "type") && changes("subsystem")) {
       const owner = typeof stored.subsystem === "string" ? stored.subsystem : void 0;
-      if (owner !== void 0 && this.loadSubsystemSpec(owner) !== null) {
-        return `"subsystem" is where the ${kind} lives, not a field a delta edits \u2014 no tool moves a ${kind} to another subsystem with its references and published entries yet (owed), and a delta would move the file and leave them behind.`;
+      if (owner !== void 0 && this.loadSubsystemSpec(owner) !== null || kind === "type" && owner === void 0) {
+        return `"subsystem" is where the ${kind} lives, not a field a delta edits \u2014 a delta would rewrite the field and leave the file, its references and its published entries behind; move it with sdd_move_spec (kind ${kind}), which moves ${kind === "component" ? "the component with the members it owns, its contracts and implementations, and re-homes its export entries and lifecycle entrypoints" : "the type's file, its export entries and every reference qualified by its subsystem"}.`;
       }
     }
     if (kind === "interface" && changes("component")) {
@@ -42363,6 +43174,42 @@ var SpecWorkspace = class {
     }
     return void 0;
   }
+  /**
+   * core_orchestrator.crossProjectWriteRefusal — the sentence refusing a write
+   * any of whose targets lives in another project, or undefined when every one
+   * is the bound project's own. A target lives elsewhere when its key carries a
+   * member project's prefix (a stored spec read through this tree, or an
+   * `alias::name` the bound alias table binds to a member), or when its first
+   * segment is an external's alias. A legacy L1 mount keeps its old cross-tree
+   * writes. Reads only.
+   */
+  crossProjectWriteRefusal(targets, tool) {
+    const verb = tool.replace(/^sdd_/, "").split("_")[0] || "write";
+    for (const target of targets) {
+      if (target.kind === "system" || typeof target.id !== "string" || !target.id.includes("::")) continue;
+      const writable = ["subsystem", "component", "interface", "implementation", "type"].includes(target.kind);
+      const stored = writable ? this.load(target.kind, target.id)?.id : void 0;
+      const key2 = stored ?? this.bindReference("", target.id);
+      const alias = target.id.slice(0, target.id.indexOf("::"));
+      const aliased = this.cachedRawRoots[0]?.record.aliases.get(alias);
+      const member = this.getSubprojectPrefix(key2) ?? this.getSubprojectPrefix(target.id) ?? (aliased !== void 0 && this.rootCovering(aliased) !== null ? aliased : null);
+      if (member !== null) {
+        const root = this.rootCovering(member);
+        if (root?.legacyMount) continue;
+        const qualified = stored ?? target.id;
+        const local = qualified.includes("::") ? qualified.slice(qualified.lastIndexOf("::") + 2) : qualified;
+        const dir = this.resolveSubprojectForNamespace(member);
+        const folder = dir ? path23.relative(this.rootDir, dir).split(path23.sep).join("/") || "." : void 0;
+        return `chained-spec: "${qualified}" lives in another project; ${verb} it from that project's own root. It belongs to the member project "${member}"${folder ? ` at ${folder}` : ""}: open a session in that folder (its own guide and .mcp.json \u2014 run \`wairon generate\` and \`wairon mcp install --backend claude\` there first if it has none) and call ${tool} ${target.kind} ${local} there. Nothing was written.`;
+      }
+      const externals = this.cachedRawRoots[0]?.record.config?.externals ?? {};
+      if (Object.prototype.hasOwnProperty.call(externals, alias)) {
+        const producer = externals[alias]?.project ?? alias;
+        return `chained-spec: "${target.id}" names a spec of "${producer}", a project this one declares as the external "${alias}": a project's specs are written from its own root, and this project only reads them through its pin. Open a session in that project's folder and call ${tool} there. Nothing was written.`;
+      }
+    }
+    return void 0;
+  }
   updateSpec(kind, id, delta, hooks, dryRun = false) {
     const notices = [];
     const result = storedFormOf(kind, this.load(kind, id));
@@ -42370,16 +43217,8 @@ var SpecWorkspace = class {
       throw new Error(`Spec of kind "${kind}" with ID "${id}" does not exist. Define it first.`);
     }
     if (kind !== "system") {
-      const stored = String(result.id ?? id);
-      const member = this.getSubprojectPrefix(stored) ?? this.getSubprojectPrefix(id);
-      if (member !== null && this.rootCovering(member)?.legacyMount === null) {
-        const local = stored.startsWith(`${member}::`) ? stored.slice(member.length + 2) : stored;
-        const dir = this.resolveSubprojectForNamespace(member);
-        const folder = dir ? path23.relative(this.rootDir, dir).split(path23.sep).join("/") || "." : void 0;
-        throw new Error(
-          `chained-spec: "${stored}" lives in another project; update it from that project's own root. It belongs to the member project "${member}"${folder ? ` at ${folder}` : ""}: open a session in that folder (its own guide and .mcp.json \u2014 run \`wairon generate\` and \`wairon mcp install --backend claude\` there first if it has none) and call sdd_update_spec ${kind} ${local} there. Nothing was written.`
-        );
-      }
+      const refusal2 = this.crossProjectWriteRefusal([{ kind, id: String(result.id ?? id) }], "sdd_update_spec");
+      if (refusal2 !== void 0) throw new Error(refusal2);
     }
     if (kind === "system" && id && id !== "system" && id !== result.name) {
       throw new Error(
@@ -42984,7 +43823,8 @@ var SpecWorkspace = class {
     const ineffective = ineffectiveDeltaPaths(
       { ...qualifiedDelta, ...unsetFields.length ? { unset: unsetFields } : {} },
       canonicalMerged,
-      canonicalStored
+      canonicalStored,
+      respellings
     );
     if (changes.length === 0) {
       return {
@@ -43946,6 +44786,9 @@ function normalizeReferences(kind, id) {
 function rewriteReferences(kind, id, edits) {
   return current().respellReferences(kind, id, edits);
 }
+function crossProjectWriteRefusal(targets, tool) {
+  return current().crossProjectWriteRefusal(targets, tool);
+}
 function assertSpecsInReach(targets, what, projectRung = false) {
   if (!getWriteReach()) return;
   const ws = current();
@@ -44253,8 +45096,8 @@ function approvedRevision(against) {
   if (!commit2) {
     throw new Error(against !== void 0 ? `"${against}" names no commit of the repository at ${repo}` : "no approval of this project was ever committed (.wai/lock.json is in no commit) \u2014 lock and commit first, or name a revision (`--against <ref>`)");
   }
-  const relative25 = path25.relative(repo, bound2);
-  const directory = fetch(repo, commit2, relative25 === "" ? void 0 : relative25);
+  const relative27 = path25.relative(repo, bound2);
+  const directory = fetch(repo, commit2, relative27 === "" ? void 0 : relative27);
   return { directory, commit: commit2, label: against !== void 0 ? `${against} (${commit2.slice(0, 12)})` : `the last approval, committed at ${commit2.slice(0, 12)}` };
 }
 
@@ -45099,13 +45942,20 @@ function promoteMember(alias, id) {
   declareCrossingEntries(inside, outside, parentId || parentName, result);
   recordCrossingTopics(inside, outside, parentId || parentName, result);
   if (crossing.out.length > 0 || qualified.out.length > 0 || [...climbs.values()].some((t) => t.startsWith(`${parentId}::`))) runWithProjectRoot(dir, () => projectConfigRepository.declareExternal(parentId, {}));
+  declareSiblings(family, inside, dir, alias, result);
   for (const s of inside.filter((x) => x.kind === "subsystem")) restateReExports(s.id, alias);
   exportCrossings([...crossing.out, ...qualified.out], dir, alias, parentId, "out", result);
   exportCrossings([...crossing.in, ...qualified.in], dir, alias, parentId, "in", result);
   exportReExported(inside, dir, alias, result);
   invalidateSpecCache();
-  for (const spec of parentSide) if (spec.kind !== "system") normalizeReferences(spec.kind, spec.id);
   const memberKey = graph().nodes.find((n) => n.parent === "" && n.mountAlias === alias)?.namespace;
+  rederiveSignatures(new Set(result.respelled.map((r) => r.specId)), result.signaturesRederived);
+  runWithProjectRoot(dir, () => {
+    invalidateSpecCache();
+    rederiveSignatures(new Set(result.memberRespelled.map((r) => localIn(r.specId, memberKey ?? alias))), result.signaturesRederived);
+  });
+  invalidateSpecCache();
+  for (const spec of parentSide) if (spec.kind !== "system") normalizeReferences(spec.kind, spec.id);
   if (memberKey !== void 0) {
     for (const spec of memberSide) if (spec.kind !== "system") normalizeReferences(spec.kind, `${memberKey}::${spec.id}`);
   } else {
@@ -45122,14 +45972,52 @@ function promoteMember(alias, id) {
   }
   invalidateSpecCache();
   rebaseEscapingPaths(dir, getProjectRoot(), result);
-  rederiveSignatures(new Set(result.respelled.map((r) => r.specId)), result.signaturesRederived);
-  runWithProjectRoot(dir, () => {
-    invalidateSpecCache();
-    rederiveSignatures(new Set(result.memberRespelled.map((r) => localIn(r.specId, memberKey ?? alias))), result.signaturesRederived);
-  });
-  invalidateSpecCache();
   return result;
 }
+function declareSiblings(family, inside, dir, alias, result) {
+  const root = getProjectRoot();
+  const parent = projectConfigRepository.load() ?? {};
+  const ids = new Set(inside.map((s) => s.id));
+  const named2 = /* @__PURE__ */ new Map();
+  for (const ref of family.authoredReferences) {
+    if (!ids.has(ref.specId) || (family.owners.get(ref.specId) ?? "") !== "") continue;
+    const via = ref.form === "alias" ? ref.authored.split("::")[0] : ref.importedVia;
+    if (via === void 0 || via === alias || via.includes(",")) continue;
+    const names = named2.get(via) ?? /* @__PURE__ */ new Set();
+    if (ref.form !== "alias") names.add(ref.authored);
+    named2.set(via, names);
+  }
+  const own2 = runWithProjectRoot(dir, () => projectConfigRepository.load());
+  for (const [sibling, imported] of named2) {
+    if (ownGet(own2?.externals, sibling) !== void 0 || ownGet(own2?.members, sibling) !== void 0) continue;
+    const member = declaredMembers(parent).find((m) => m.alias === sibling && !m.problem);
+    const external = ownGet(parent.externals, sibling);
+    let declaration2;
+    if (member) {
+      const at = member.source.path !== void 0 ? path27.resolve(root, member.source.path) : void 0;
+      const id = at !== void 0 ? configAt2(at) : null;
+      const project3 = id ? effectiveProjectId(id) ?? void 0 : void 0;
+      declaration2 = {
+        ...project3 !== void 0 && project3 !== sibling ? { project: project3 } : {},
+        source: at !== void 0 ? { path: toPosixPath(path27.relative(dir, at)) || "." } : member.source
+      };
+    } else if (external !== void 0) {
+      const source = externalSourceOf(external);
+      declaration2 = {
+        ...external.project !== void 0 ? { project: external.project } : {},
+        ...source?.path !== void 0 && !path27.isAbsolute(source.path) ? { source: { path: toPosixPath(path27.relative(dir, path27.resolve(root, source.path))) } } : source ? { source } : {}
+      };
+    } else continue;
+    const use = [...imported].filter((n) => !n.includes("::")).sort();
+    runWithProjectRoot(dir, () => {
+      projectConfigRepository.declareExternal(sibling, declaration2);
+      if (use.length > 0) projectConfigRepository.importNames(sibling, use);
+    });
+    const written = typeof declaration2.source === "string" ? void 0 : declaration2.source;
+    const where = typeof declaration2.source === "string" ? declaration2.source : written?.path ?? written?.git ?? written?.hosted ?? "";
+    (result.externalsDeclared ??= []).push(`${sibling}${declaration2.project !== void 0 ? ` (project ${declaration2.project})` : ""}${where ? ` at ${where}` : ""}${use.length > 0 ? `, use ${use.join(", ")}` : ""}`);
+  }
+}
 function rebaseEscapingPaths(memberDir, familyRoot, result) {
   const shownMember = toPosixPath(path27.relative(familyRoot, memberDir)) || ".";
   for (const file of specFilesUnder(aiPathsAt(memberDir).specsDir())) {
@@ -45598,13 +46486,63 @@ var MEMBER_WAI_GROUPS = /* @__PURE__ */ new Map([
   ["generated", "derived outputs"],
   ["rules", "derived outputs"],
   ["templates", "derived outputs"],
-  ["topology.yaml", "derived outputs"]
+  ["topology.yaml", "derived outputs"],
+  ["mcp", "derived outputs"],
+  ["phased_design.md", "design workbook"],
+  ["git.json", "host and producer bindings"],
+  ["remote.json", "host and producer bindings"],
+  ["producers.json", "host and producer bindings"],
+  ["variants", "placed in this project"],
+  ["packs", "placed in this project"]
 ]);
+var PLACED_WAI_ENTRIES = /* @__PURE__ */ new Set(["variants", "packs"]);
+function placedWaiFiles(memberDir, homeRoot) {
+  const wai = path27.join(memberDir, ".wai");
+  const home = path27.join(homeRoot, ".wai");
+  return [...PLACED_WAI_ENTRIES].filter((entry) => fs19.existsSync(path27.join(wai, entry))).flatMap((entry) => listFilesRecursive(path27.join(wai, entry), "")).map((from) => {
+    const rel2 = toPosixPath(path27.relative(wai, from));
+    return { rel: rel2, from, to: path27.join(home, rel2) };
+  });
+}
+function waiRefusals(memberDir, homeRoot) {
+  const out = [];
+  const wai = path27.join(memberDir, ".wai");
+  for (const entry of fs19.existsSync(wai) ? fs19.readdirSync(wai) : []) {
+    if (entry === "specs" || entry === "transactions" || MEMBER_WAI_GROUPS.has(entry)) continue;
+    out.push(`its .wai holds "${entry}", which this write does not recognise \u2014 move or delete it by hand`);
+  }
+  for (const f of placedWaiFiles(memberDir, homeRoot)) {
+    if (fs19.existsSync(f.to) && !fs19.readFileSync(f.to).equals(fs19.readFileSync(f.from))) {
+      out.push(`its .wai/${f.rel} differs from this project's file of that name \u2014 reconcile the two by hand first`);
+    }
+  }
+  return out;
+}
+function placeWaiEntries(memberDir, homeRoot, result) {
+  for (const f of placedWaiFiles(memberDir, homeRoot)) {
+    if (fs19.existsSync(f.to)) continue;
+    fs19.mkdirSync(path27.dirname(f.to), { recursive: true });
+    fs19.copyFileSync(f.from, f.to);
+    result.placed.push(`.wai/${f.rel} \u2192 this project's .wai/${f.rel}`);
+  }
+  const workbook = path27.join(memberDir, ".wai", "phased_design.md");
+  if (!fs19.existsSync(workbook)) return;
+  const named2 = (dir, text3) => {
+    const name = configAt2(dir)?.name;
+    return (name ? text3.split(name).join("<project>") : text3).replace(/\r\n/g, "\n");
+  };
+  const homeWorkbook = path27.join(homeRoot, ".wai", "phased_design.md");
+  const theirs = named2(memberDir, fs19.readFileSync(workbook, "utf8"));
+  const ours = fs19.existsSync(homeWorkbook) ? named2(homeRoot, fs19.readFileSync(homeWorkbook, "utf8")) : null;
+  if (ours !== theirs) {
+    result.notCarried.push(".wai/phased_design.md: the member's design workbook differs from this project's \u2014 it is deleted with the boundary (the design itself is its specs, which move); copy what you want to keep from it first");
+  }
+}
 function internalizeMember(alias, destination) {
   const family = graph();
   const part = family.nodes.find((n) => n.namespace === "")?.parts.find((p) => p.alias === alias);
   if (part) return internalizePart(alias, part);
-  if (family.nodes.find((n) => n.namespace === "")?.externals.some((e) => e.role === "member" && e.sourceKind === "path" && e.alias === alias)) {
+  if (storedAsSibling(alias)) {
     const demoted = demoteMember(alias, destination);
     const nowPart = graph().nodes.find((n) => n.namespace === "")?.parts.find((p) => p.alias === alias);
     if (!nowPart) throw new WaironError(`cannot internalize "${alias}": demoted, it does not read as a part of this project.`);
@@ -45630,8 +46568,10 @@ function internalizeMember(alias, destination) {
   carryDeclarations(scan2, result);
   carryPacks(scan2, destination, result);
   projectConfigRepository.removeMember(alias);
+  placeWaiEntries(scan2.memberDir, getProjectRoot(), result);
   result.deleted = deleteMemberWai(scan2.memberDir);
   invalidateSpecCache();
+  rederiveSignatures(new Set(rewritten.map((s) => s.id)), result.signaturesRederived ??= []);
   for (const spec of rewritten) if (spec.kind !== "system") normalizeReferences(spec.kind, spec.id);
   invalidateSpecCache();
   return result;
@@ -45706,11 +46646,7 @@ function internalizeRefusals(scan2, destination) {
     const held = exported.get(name);
     if (held !== void 0 && held !== scan2.alias) out.push(`the export "${name}" is a public name this project already exports for ${held}`);
   }
-  const wai = path27.join(scan2.memberDir, ".wai");
-  for (const entry of fs19.existsSync(wai) ? fs19.readdirSync(wai) : []) {
-    if (entry === "specs" || entry === "transactions" || MEMBER_WAI_GROUPS.has(entry)) continue;
-    out.push(`its .wai holds "${entry}", which this write does not recognise \u2014 move or delete it by hand`);
-  }
+  out.push(...waiRefusals(scan2.memberDir, getProjectRoot()));
   return out;
 }
 function resolveSubsystemExportsOfProject() {
@@ -45929,11 +46865,14 @@ function deleteMemberWai(memberDir) {
   if (fs19.readdirSync(wai).length === 0) fs19.rmdirSync(wai);
   return deleted.sort();
 }
+function storedAsSibling(alias) {
+  return declaredMembers(projectConfigRepository.load() ?? {}).find((m) => m.alias === alias)?.storage === "path";
+}
 function memberToDemote(family, alias) {
   const bound2 = family.nodes.find((n) => n.namespace === "");
   if (bound2?.parts.some((p) => p.alias === alias)) throw new WaironError(`demote refused: "${alias}" is already a part of this project.`);
   const node = family.nodes.find((n) => n.parent === "" && n.mountAlias === alias);
-  if (node) return { dir: node.directory, contained: true, key: node.namespace };
+  if (node) return { dir: node.directory, contained: !storedAsSibling(alias), key: node.namespace };
   const referenced = bound2?.externals.find((e) => e.role === "member" && e.alias === alias);
   if (referenced?.sourceKind === "git") {
     throw new WaironError(`demote refused: the member "${alias}" is fetched from git \u2014 its files are the fetch cache's. Demote it from a checkout of its repository.`);
@@ -45970,11 +46909,7 @@ function demoteRefusals(scan2, destination, memberIds, family) {
     const held = exported.get(name);
     if (held !== void 0 && held !== scan2.alias) out.push(`the export "${name}" is a public name this project already exports for ${held}`);
   }
-  const wai = path27.join(scan2.memberDir, ".wai");
-  for (const entry of fs19.existsSync(wai) ? fs19.readdirSync(wai) : []) {
-    if (entry === "specs" || entry === "transactions" || MEMBER_WAI_GROUPS.has(entry)) continue;
-    out.push(`its .wai holds "${entry}", which this write does not recognise \u2014 move or delete it by hand`);
-  }
+  out.push(...waiRefusals(scan2.memberDir, getProjectRoot()));
   return out;
 }
 function demoteMember(alias, destination) {
@@ -46026,6 +46961,7 @@ function demoteMember(alias, destination) {
       patchKeepingStamp(s.file, (raw) => raw.parentSystem === parentName ? false : (raw.parentSystem = parentName, true));
     }
   }
+  placeWaiEntries(dir, root, result);
   result.deleted = deleteProjectContent(dir);
   if (!contained && parentId !== void 0) {
     runWithProjectRoot(dir, () => projectConfigRepository.setPartOf({ project: parentId, path: toPosixPath(path27.relative(dir, root)) || "." }));
@@ -46040,9 +46976,9 @@ function demoteMember(alias, destination) {
   carryPacks(scan2, destination, result);
   retireBoundaryExports(family, crossed, key2);
   invalidateSpecCache();
+  rederiveSignatures(new Set([...parentSide, ...memberSide].map((s) => s.id)), result.signaturesRederived ??= []);
   for (const spec of [...parentSide, ...memberSide]) if (spec.kind !== "system") normalizeReferences(spec.kind, spec.id);
   invalidateSpecCache();
-  rederiveSignatures(new Set([...parentSide, ...memberSide].map((s) => s.id)), result.signaturesRederived ??= []);
   return result;
 }
 function respellQualifiedBack(parentSide, memberSide, aliases, tables, crossed) {
@@ -46400,17 +47336,43 @@ function moveRenamedSpecs(componentId, newId, component, movingInterface, moving
     saveInterfaceSpec({ ...movedInterface, id: interfaceId, component: newId, previousIds: traced(movedInterface.previousIds, movedInterface.id) });
   }
   if (movedImplementation) {
-    const oldFile = getImplementationPath(movedImplementation.id);
-    if (path27.resolve(getImplementationPath(implementationId, movedImplementation.contract)) === path27.resolve(oldFile)) {
-      fs19.unlinkSync(oldFile);
+    const oldFile2 = getImplementationPath(movedImplementation.id);
+    if (path27.resolve(getImplementationPath(implementationId, movedImplementation.contract)) === path27.resolve(oldFile2)) {
+      fs19.unlinkSync(oldFile2);
     }
     saveImplementationSpec({ ...movedImplementation, id: implementationId, previousIds: traced(movedImplementation.previousIds, movedImplementation.id) });
   }
+  invalidateSpecCache();
+  const oldFile = path27.resolve(getComponentPath(componentId));
+  const oldDir = path27.basename(oldFile) === ".index.yaml" ? path27.dirname(oldFile) : null;
+  const moved = /* @__PURE__ */ new Set([interfaceId, implementationId, ...movingInterface ? [movingInterface.id] : [], ...movingImplementation ? [movingImplementation.id] : []]);
+  const staying = loadInterfaceSpecs().filter((i) => i.component === newId && !moved.has(i.id));
+  const contracts = /* @__PURE__ */ new Set([...staying.map((i) => i.id), interfaceId]);
+  const stayingImplementations = loadImplementationSpecs().filter((impl) => contracts.has(impl.contract) && !moved.has(impl.id));
+  if (oldDir !== null) {
+    for (const contract of staying) relocateSpec("interface", contract, getInterfacePath(contract.id), oldDir);
+    for (const impl of stayingImplementations) relocateSpec("implementation", impl, getImplementationPath(impl.id), oldDir);
+  }
   removeSpecFile2(getComponentPath(componentId), componentId);
   if (movingInterface) removeSpecFile2(getInterfacePath(movingInterface.id), movingInterface.id);
   if (movingImplementation) removeSpecFile2(getImplementationPath(movingImplementation.id), movingImplementation.id);
   invalidateSpecCache();
 }
+function relocateSpec(kind, spec, file, fromDir) {
+  if (!fs19.existsSync(file) || path27.dirname(path27.resolve(file)) !== fromDir) return;
+  const backup = fs19.readFileSync(file);
+  fs19.unlinkSync(file);
+  invalidateSpecCache();
+  try {
+    if (kind === "interface") saveInterfaceSpec(spec);
+    else saveImplementationSpec(spec);
+  } catch (e) {
+    fs19.writeFileSync(file, backup);
+    invalidateSpecCache();
+    throw e;
+  }
+  invalidateSpecCache();
+}
 function traced(trace, former) {
   const out = [...trace ?? []];
   if (!out.includes(former)) out.push(former);
@@ -46472,6 +47434,281 @@ function removeSpecFile2(file, id) {
     fs19.rmdirSync(dir);
   }
 }
+function renameSpecId(kind, id, newId, dryRun) {
+  if (kind !== "interface" && kind !== "implementation") {
+    const owner = kind === "component" ? "sdd_rename_component" : kind === "type" ? "sdd_rename_type" : "no tool yet";
+    throw new WaironError(`invalid-kind: sdd_rename_spec renames a contract (kind interface) or an implementation on its own; a ${kind} is renamed with ${owner}.`);
+  }
+  const spec = kind === "interface" ? loadInterfaceSpec(id) : loadImplementationSpec(id);
+  if (!spec) throw new WaironError(`spec-missing: no ${kind} has the id "${id}".`);
+  if (id.includes("::")) {
+    throw new WaironError(`chained-spec: "${id}" lives in another project; rename it from that project's own root. ${memberRootWay(id, `sdd_rename_spec ${kind} ${id.slice(id.lastIndexOf("::") + 2)} <new id>`)}`);
+  }
+  if (!SpecIdSchema.safeParse(newId).success || kind === "interface" && !/^i[a-z0-9-_]+$/.test(newId)) {
+    throw new WaironError(`invalid-id: "${newId}" is not a lowercase identifier with no namespace separator${kind === "interface" ? ' beginning with "i", as a contract id does' : ""}.`);
+  }
+  if (newId === id) throw new WaironError(`name-unchanged: ${kind} "${id}" already has that id \u2014 nothing to do.`);
+  const taken = kind === "interface" ? loadInterfaceSpecs().some((i) => i.id === newId) : loadImplementationSpecs().some((i) => i.id === newId);
+  if (taken) throw new WaironError(`id-taken: a ${kind} already has the id "${newId}".`);
+  refuseRetiredIds([{ kind, id: newId }]);
+  const rename = { specs: [{ from: id, to: newId }] };
+  const registerEdits = projectConfigRepository.rekeyCarried(rename, true);
+  const specsDir = aiPathsAt(getProjectRoot()).specsDir();
+  const remap = (ref, position) => kind === "interface" && position === "interface" && ref === id ? newId : ref;
+  const derivesName = (entry) => kind === "interface" && entry.interface === id;
+  const others = (specs) => [...new Set(specs.filter((s) => !(s.kind === kind && s.id === id)).map((s) => s.id))];
+  const keptDry = keepPublicNames(specsDir, derivesName, true);
+  const wouldRewrite = [...keptDry.specs, ...rewriteRefFields(specsDir, remap, void 0, true), ...rekeyLintAllows(specsDir, rename, true)];
+  assertSpecsInReach([{ kind, id }, ...wouldRewrite], `renaming ${kind} "${id}"`, registerEdits.length > 0);
+  const renamed2 = [{ kind, from: id, to: newId }];
+  if (dryRun) return { kind, renamed: renamed2, rewritten: others(wouldRewrite), carried: registerEdits, keptPublicNames: keptDry.names, dryRun: true };
+  const kept = keepPublicNames(specsDir, derivesName);
+  const rewritten = others([...kept.specs, ...rewriteRefFields(specsDir, remap), ...rekeyLintAllows(specsDir, rename)]);
+  invalidateSpecCache();
+  const oldFile = kind === "interface" ? getInterfacePath(id) : getImplementationPath(id);
+  if (kind === "interface") {
+    const current2 = loadInterfaceSpec(id) ?? spec;
+    const next = { ...current2, id: newId, previousIds: traced(current2.previousIds, id) };
+    if (path27.resolve(getInterfacePath(newId, current2.component)) === path27.resolve(oldFile)) fs19.unlinkSync(oldFile);
+    saveInterfaceSpec(next);
+  } else {
+    const current2 = loadImplementationSpec(id) ?? spec;
+    const next = { ...current2, id: newId, previousIds: traced(current2.previousIds, id) };
+    if (path27.resolve(getImplementationPath(newId, current2.contract)) === path27.resolve(oldFile)) fs19.unlinkSync(oldFile);
+    saveImplementationSpec(next);
+  }
+  invalidateSpecCache();
+  removeSpecFile2(oldFile, id);
+  const carried = projectConfigRepository.rekeyCarried(rename);
+  invalidateSpecCache();
+  return { kind, renamed: renamed2, rewritten, carried, keptPublicNames: kept.names };
+}
+function moveSpec(kind, id, subsystem, dryRun) {
+  if (kind !== "component" && kind !== "type") {
+    throw new WaironError(`invalid-kind: sdd_move_spec moves a component or a type to another subsystem; a ${kind} ${kind === "interface" || kind === "implementation" ? "follows its component (sdd_move_methods moves behaviour between components)" : "does not move"}.`);
+  }
+  const subsystems = loadSubsystemSpecs().filter((s) => !s.id.includes("::"));
+  const target = subsystem === void 0 || subsystem === "" ? void 0 : subsystem;
+  if (target !== void 0 && !subsystems.some((s) => s.id === target)) {
+    throw new WaironError(`subsystem-missing: this project has no subsystem "${target}"${target.includes("::") ? " \u2014 a spec never moves into another project" : ""}. Known subsystems: ${subsystems.map((s) => s.id).join(", ") || "none"}.`);
+  }
+  return kind === "component" ? moveComponentSpec(id, target, subsystems, dryRun === true) : moveTypeSpec(id, target, subsystems, dryRun === true);
+}
+function moveComponentSpec(id, target, subsystems, dryRun) {
+  const components = loadComponentSpecs();
+  const component = components.find((c) => c.id === id);
+  if (!component) throw new WaironError(`spec-missing: no component has the id "${id}".`);
+  if (id.includes("::")) {
+    throw new WaironError(`chained-spec: "${id}" lives in another project; move it from that project's own root. ${memberRootWay(id, `sdd_move_spec component ${id.slice(id.lastIndexOf("::") + 2)} <subsystem>`)}`);
+  }
+  if (target === void 0) throw new WaironError(`subsystem-missing: name the subsystem component "${id}" moves to \u2014 a component always lives in a subsystem.`);
+  if (component.subsystem === target) throw new WaironError(`same-subsystem: component "${id}" already lives in "${target}" \u2014 nothing to move.`);
+  const owner = components.find((c) => (c.owns ?? []).includes(id));
+  if (owner) {
+    throw new WaironError(`owned: "${id}" is a member owned by "${owner.id}", and a pattern's members live with it \u2014 move "${owner.id}", which takes "${id}" along.`);
+  }
+  const movingIds = [];
+  const visit = (cid) => {
+    if (movingIds.includes(cid)) return;
+    movingIds.push(cid);
+    for (const member of components.find((c) => c.id === cid)?.owns ?? []) visit(member);
+  };
+  visit(id);
+  const contracts = loadInterfaceSpecs().filter((i) => movingIds.includes(i.component));
+  const implementations = loadImplementationSpecs().filter((impl) => contracts.some((i) => i.id === impl.contract));
+  const moved = [
+    ...movingIds.map((cid) => ({ kind: "component", id: cid })),
+    ...contracts.map((i) => ({ kind: "interface", id: i.id })),
+    ...implementations.map((impl) => ({ kind: "implementation", id: impl.id }))
+  ];
+  const from = component.subsystem;
+  const fromSpec = subsystems.find((s) => s.id === from);
+  const toSpec = subsystems.find((s) => s.id === target);
+  const names = (ref) => ref !== void 0 && movingIds.includes(ref);
+  const exportsMoving = (fromSpec?.publicInterfaces ?? []).filter((e) => names(e.component));
+  const lifecycleMoving = (fromSpec?.lifecycle ?? []).filter((e) => names(e.component));
+  const system = loadSystemSpec();
+  const l0 = system?.publicInterfaces ?? [];
+  const repointed = l0.filter((e) => e.from === from && names(e.component));
+  const whole = l0.filter((e) => e.from === from && e.component === void 0 && e.typeDef === void 0 && e.interface === void 0);
+  const added = whole.length > 0 ? exportsMoving.map((e) => ({
+    from: target,
+    component: e.component,
+    ...e.interface ? { interface: e.interface } : {},
+    ...e.as ? { as: e.as } : {},
+    ...whole[0].audience ? { audience: whole[0].audience } : {}
+  })) : [];
+  const rewritten = [
+    ...exportsMoving.length + lifecycleMoving.length > 0 ? [from, target] : [],
+    ...repointed.length + added.length > 0 ? ["system"] : []
+  ];
+  assertSpecsInReach([...moved, ...rewritten.map((s) => s === "system" ? { kind: "system", id: "system" } : { kind: "subsystem", id: s })], `moving component "${id}"`);
+  const report3 = { kind: "component", id, from, to: target, moved, rewritten: [...new Set(rewritten)], notices: [] };
+  if (dryRun) return { ...report3, dryRun: true };
+  if (exportsMoving.length + lifecycleMoving.length > 0 && fromSpec) {
+    saveSpec("subsystem", {
+      ...fromSpec,
+      publicInterfaces: (fromSpec.publicInterfaces ?? []).filter((e) => !exportsMoving.includes(e)),
+      ...fromSpec.lifecycle ? { lifecycle: fromSpec.lifecycle.filter((e) => !lifecycleMoving.includes(e)) } : {}
+    });
+    saveSpec("subsystem", {
+      ...toSpec,
+      publicInterfaces: [...toSpec.publicInterfaces ?? [], ...exportsMoving],
+      ...lifecycleMoving.length > 0 || toSpec.lifecycle ? { lifecycle: [...toSpec.lifecycle ?? [], ...lifecycleMoving] } : {}
+    });
+  }
+  if (system && repointed.length + added.length > 0) {
+    saveSystemSpec({ ...system, publicInterfaces: [...l0.map((e) => repointed.includes(e) ? { ...e, from: target } : e), ...added] });
+  }
+  invalidateSpecCache();
+  for (const cid of movingIds) {
+    const current2 = loadComponentSpec(cid);
+    if (current2) saveComponentSpec({ ...current2, subsystem: target });
+    invalidateSpecCache();
+  }
+  invalidateSpecCache();
+  return report3;
+}
+function moveTypeSpec(id, target, subsystems, dryRun) {
+  const types = loadTypeSpecs();
+  const cut = id.lastIndexOf("::");
+  const qualifier = cut >= 0 ? id.slice(0, cut) : void 0;
+  if (qualifier !== void 0 && !subsystems.some((s) => s.id === qualifier)) {
+    throw new WaironError(`chained-spec: "${id}" lives in another project; move it from that project's own root. ${memberRootWay(id, `sdd_move_spec type ${id.slice(cut + 2)} <subsystem>`)}`);
+  }
+  const bare2 = cut >= 0 ? id.slice(cut + 2) : id;
+  const matching = types.filter((t) => t.id === bare2 && (qualifier === void 0 || t.subsystem === qualifier));
+  if (matching.length === 0) throw new WaironError(`spec-missing: no type has the id "${id}" (a type is addressed by its bare id, or as <subsystem>::<id>).`);
+  if (matching.length > 1) throw new WaironError(`ambiguous: ${matching.length} types have the id "${bare2}" \u2014 address it as <subsystem>::${bare2} (${matching.map((t) => qualifiedTypeId(t)).join(", ")}).`);
+  const type = matching[0];
+  const from = type.subsystem ?? "";
+  if ((target ?? "") === from) throw new WaironError(`same-subsystem: type "${id}" already lives ${from ? `in "${from}"` : "at system level"} \u2014 nothing to move.`);
+  if (types.some((t) => t !== type && t.id === bare2 && (t.subsystem ?? "") === (target ?? ""))) {
+    throw new WaironError(`id-taken: ${target ? `subsystem "${target}"` : "the system level"} already holds a type with the id "${bare2}".`);
+  }
+  const fromSpec = subsystems.find((s) => s.id === from);
+  const names = (ref) => ref !== void 0 && (ref === bare2 || ref === `${from}::${bare2}`);
+  const exportsMoving = (fromSpec?.publicInterfaces ?? []).filter((e) => e.component === void 0 && names(e.typeDef));
+  const system = loadSystemSpec();
+  const l0 = system?.publicInterfaces ?? [];
+  const repointed = l0.filter((e) => from !== "" && e.from === from && names(e.typeDef));
+  if (target === void 0 && exportsMoving.length + repointed.length > 0) {
+    throw new WaironError(`exported: subsystem "${from}" exports type "${bare2}" (${exportsMoving.length + repointed.length} entr${exportsMoving.length + repointed.length === 1 ? "y" : "ies"}), and a system-level type is published by the L0 alone \u2014 move its export entries to the L0 first, or move the type to another subsystem.`);
+  }
+  const oldToken = from ? `${from}::${bare2}` : void 0;
+  const newToken = target ? `${target}::${bare2}` : bare2;
+  const specsDir = aiPathsAt(getProjectRoot()).specsDir();
+  const rewriteAll2 = (write6) => {
+    if (oldToken === void 0) return [];
+    const out = [];
+    for (const file of listFilesRecursive(specsDir, ".yaml")) {
+      let raw;
+      try {
+        raw = readYamlFile(file);
+      } catch {
+        continue;
+      }
+      const kind = raw && typeof raw === "object" ? specKind(raw) : void 0;
+      if (!kind || !respellQualifiedType(raw, oldToken, newToken)) continue;
+      if (write6) writeYamlFile(file, raw);
+      out.push({ kind, id: kind === "system" ? "system" : String(raw.id) });
+    }
+    return out;
+  };
+  const would = rewriteAll2(false);
+  const rewritten = [.../* @__PURE__ */ new Set([
+    ...would.filter((s) => !(s.kind === "type" && s.id === bare2)).map((s) => s.id),
+    ...exportsMoving.length > 0 && target !== void 0 ? [from, target] : [],
+    ...repointed.length > 0 ? ["system"] : []
+  ])];
+  assertSpecsInReach([{ kind: "type", id: qualifiedTypeId(type) }, ...would], `moving type "${id}"`);
+  const report3 = { kind: "type", id: bare2, from, to: target ?? "", moved: [{ kind: "type", id: qualifiedTypeId(type) }], rewritten, notices: [] };
+  if (dryRun) return { ...report3, dryRun: true };
+  rewriteAll2(true);
+  invalidateSpecCache();
+  if (exportsMoving.length > 0 && fromSpec && target !== void 0) {
+    const stated = loadSubsystemSpecs().find((s) => s.id === from) ?? fromSpec;
+    saveSpec("subsystem", { ...stated, publicInterfaces: (stated.publicInterfaces ?? []).filter((e) => !(e.component === void 0 && names(e.typeDef))) });
+    invalidateSpecCache();
+    const toSpec = loadSubsystemSpecs().find((s) => s.id === target);
+    saveSpec("subsystem", { ...toSpec, publicInterfaces: [...toSpec.publicInterfaces ?? [], ...exportsMoving.map((e) => ({ ...e, typeDef: bare2 }))] });
+  }
+  if (system && repointed.length > 0) {
+    const stated = loadSystemSpec() ?? system;
+    const current3 = stated.publicInterfaces ?? [];
+    saveSystemSpec({ ...stated, publicInterfaces: current3.map((e) => e.from === from && names(e.typeDef) ? { ...e, from: target } : e) });
+  }
+  invalidateSpecCache();
+  const current2 = loadTypeSpecs().find((t) => t.id === bare2 && (t.subsystem ?? "") === from) ?? type;
+  const oldFile = typeFileOf(bare2, current2);
+  const backup = fs19.existsSync(oldFile) ? fs19.readFileSync(oldFile) : null;
+  if (backup) fs19.unlinkSync(oldFile);
+  invalidateSpecCache();
+  try {
+    const { subsystem: _old, ...rest } = current2;
+    saveSpec("type", target !== void 0 ? { ...rest, subsystem: target } : rest);
+  } catch (e) {
+    if (backup) fs19.writeFileSync(oldFile, backup);
+    invalidateSpecCache();
+    throw e;
+  }
+  invalidateSpecCache();
+  return report3;
+}
+var TYPE_POSITION_KEYS = /* @__PURE__ */ new Set(["type", "returns", "signature", "signatureFrom", "typeDef", "references", "linkedEntity", "holds"]);
+function respellQualifiedType(raw, oldToken, newToken) {
+  let changed = false;
+  const escaped = oldToken.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const walk2 = (node) => {
+    if (Array.isArray(node)) {
+      node.forEach(walk2);
+      return;
+    }
+    if (!node || typeof node !== "object") return;
+    for (const [key2, value] of Object.entries(node)) {
+      if (typeof value === "string" && TYPE_POSITION_KEYS.has(key2)) {
+        const next = value.replace(new RegExp(`(?<![A-Za-z0-9_:-])${escaped}(?![A-Za-z0-9_-])`, "g"), newToken);
+        if (next !== value) {
+          node[key2] = next;
+          changed = true;
+        }
+      } else if (value && typeof value === "object" && key2 !== "previousIds" && key2 !== "previousNames") {
+        walk2(value);
+      }
+    }
+  };
+  walk2(raw);
+  return changed;
+}
+function publishedUsesOf(removed, methods) {
+  const contracts = loadInterfaceSpecs();
+  const uses = [];
+  for (const ref of removed) {
+    if (ref.kind === "component") uses.push(...publishingUses(ref.id, contracts.filter((i) => i.component === ref.id), () => true));
+    if (ref.kind === "interface") {
+      const contract = contracts.find((i) => i.id === ref.id);
+      if (contract) uses.push(...publishingUses(contract.component, [contract], () => true));
+    }
+  }
+  const types = loadTypeSpecs();
+  for (const ref of removed.filter((r) => r.kind === "type")) {
+    const type = types.find((t) => t.id === ref.id || qualifiedTypeId(t) === ref.id);
+    if (type) uses.push(...publishedCarriers(type));
+  }
+  for (const entry of methods) {
+    const cut = entry.lastIndexOf(".");
+    const contract = cut > 0 ? contracts.find((i) => i.id === entry.slice(0, cut)) : void 0;
+    if (!contract) continue;
+    const name = entry.slice(cut + 1);
+    const source = `${contract.component}.${name}`;
+    const followers = contracts.filter((i) => i !== contract && i.methods.some((m) => followsSource(m.signatureFrom, source, i.component)));
+    uses.push(
+      ...publishingUses(contract.component, [contract], (m) => m.name === name),
+      ...followers.flatMap((i) => publishingUses(i.component, [i], (m) => followsSource(m.signatureFrom, source, i.component)))
+    );
+  }
+  return mergeUses(uses);
+}
 var METHOD_CASINGS = {
   camelCase: /^[a-z][a-zA-Z0-9]*$/,
   PascalCase: /^[A-Z][a-zA-Z0-9]*$/,
@@ -46816,12 +48053,14 @@ function renameType(typeId, newId, dryRun) {
     `renaming type "${typeId}"`,
     Array.isArray(registerEdits) && registerEdits.length > 0
   );
+  const publishedIn = publishedCarriers(type);
   if (dryRun) {
     return {
       from: qualifiedTypeId(type),
       to: qualifiedTypeId({ id: newId, subsystem: type.subsystem }),
       rewritten: [...new Set(wouldRewrite.filter((spec) => !(spec.kind === "type" && spec.id === oldId)).map((spec) => spec.id))],
       keptPublicNames: keptDry.names,
+      publishedIn,
       carried: Array.isArray(registerEdits) ? registerEdits : [],
       dryRun: true
     };
@@ -46843,6 +48082,7 @@ function renameType(typeId, newId, dryRun) {
     to: qualifiedTypeId({ id: newId, subsystem: type.subsystem }),
     rewritten,
     keptPublicNames: kept.names,
+    publishedIn,
     carried
   };
 }
@@ -48111,7 +49351,7 @@ ${typeMapping.map((line) => `- ${line}`).join("\n")}
   const externals = externalsUsedBy(record);
   let readPaths = record.readPaths;
   if (externals.length > 0) {
-    const bindings = bindingModulesOf(record);
+    const bindings = bindingModulesOf2(record);
     const bindingNote = bindings.length > 0 ? `
 The binding modules these implementations name are the one place the code spells the producer's names \u2014 keep them exactly as the pin has them (\`validate\` compares them with it and reports a stale name, parameter or field as BINDING_DRIFT, with the rename to follow): ${bindings.map((b) => `\`${b}\``).join(", ")}.
 ` : "\nWhen the code reaches a producer through a hand-written binding module (a typed binding to a native library, a client stub), name it on the implementation as `bindings` \u2014 code linkage, no re-lock \u2014 so `validate` compares it with the pin.\n";
@@ -48229,11 +49469,11 @@ function memberHop(agentId) {
   const alias = agentId.slice(0, at);
   const member = graph().nodes.find((n) => n.parent === "" && n.mountAlias === alias);
   if (!member) return null;
-  const relative25 = path31.relative(getProjectRoot(), member.directory).split(path31.sep).join("/");
-  return { alias, rest: agentId.slice(at + 2), directory: member.directory, relative: relative25 };
+  const relative27 = path31.relative(getProjectRoot(), member.directory).split(path31.sep).join("/");
+  return { alias, rest: agentId.slice(at + 2), directory: member.directory, relative: relative27 };
 }
-function throughMount(brief, alias, relative25) {
-  const under = (p) => path31.posix.join(relative25, p);
+function throughMount(brief, alias, relative27) {
+  const under = (p) => path31.posix.join(relative27, p);
   return {
     ...brief,
     agentId: `${alias}::${brief.agentId}`,
@@ -48241,7 +49481,7 @@ function throughMount(brief, alias, relative25) {
     ...brief.codeFence ? { codeFence: brief.codeFence.map(under) } : {},
     ...brief.sharedPaths ? { sharedPaths: brief.sharedPaths.map(under) } : {},
     ...brief.readPaths ? { readPaths: brief.readPaths.map(under) } : {},
-    root: brief.root ? under(brief.root) : relative25
+    root: brief.root ? under(brief.root) : relative27
   };
 }
 function loadRegistry() {
@@ -48402,7 +49642,7 @@ function externalsUsedBy(record) {
   }
   return out;
 }
-function bindingModulesOf(record) {
+function bindingModulesOf2(record) {
   const ids = new Set(implementedComponents(record).map((c) => c.id));
   const contracts = new Set(loadInterfaceSpecs().filter((i) => ids.has(i.component)).map((i) => i.id));
   return [...new Set(loadImplementationSpecs().filter((impl) => contracts.has(impl.contract)).flatMap((impl) => impl.bindings ?? []))];
@@ -48685,19 +49925,19 @@ function commitStagedTree(stagingDir, destDir, roots, backupExisting) {
   const backupDir = path36.join(root, BACKUP_DIR, timestampSlug());
   let backedUp = false;
   for (const rootRel of roots) {
-    const relative25 = rootRel === "." ? "" : rootRel;
-    const stagedSpecDir = path36.join(stagingDir, relative25, ".wai");
+    const relative27 = rootRel === "." ? "" : rootRel;
+    const stagedSpecDir = path36.join(stagingDir, relative27, ".wai");
     if (!fs23.existsSync(stagedSpecDir)) continue;
-    const liveSpecDir = liveSpecDirFor(path36.join(root, relative25));
+    const liveSpecDir = liveSpecDirFor(path36.join(root, relative27));
     if (backupExisting && liveSpecDir && fs23.existsSync(liveSpecDir)) {
-      const backupTarget = path36.join(backupDir, relative25, path36.basename(liveSpecDir));
+      const backupTarget = path36.join(backupDir, relative27, path36.basename(liveSpecDir));
       fs23.mkdirSync(path36.dirname(backupTarget), { recursive: true });
       fs23.renameSync(liveSpecDir, backupTarget);
       backedUp = true;
     } else if (liveSpecDir && fs23.existsSync(liveSpecDir)) {
       fs23.rmSync(liveSpecDir, { recursive: true, force: true });
     }
-    const target = path36.join(root, relative25, ".wai");
+    const target = path36.join(root, relative27, ".wai");
     fs23.mkdirSync(path36.dirname(target), { recursive: true });
     if (fs23.existsSync(target)) fs23.rmSync(target, { recursive: true, force: true });
     fs23.renameSync(stagedSpecDir, target);
@@ -49260,7 +50500,7 @@ function retireSpecialists(apply3) {
     if (dependency2 && DATA_FACADES.has(dependency2.componentType)) return "facade";
     return "neither";
   };
-  const described = (id) => {
+  const described2 = (id) => {
     const dependency2 = byId.get(id);
     const fit = fitOf(id);
     let what;
@@ -49273,14 +50513,14 @@ function retireSpecialists(apply3) {
   const reasonFor = (specialist, decision, settled2) => {
     const dependencies = specialist.dependsOn;
     if (decision === "pure") {
-      return dependencies.length === 0 ? "no dependencies" : `depends only on pure logic: ${dependencies.map(described).join(", ")}`;
+      return dependencies.length === 0 ? "no dependencies" : `depends only on pure logic: ${dependencies.map(described2).join(", ")}`;
     }
     if (decision === "read") {
       const deciding2 = dependencies.filter((id) => fitOf(id) !== "pure");
-      return `${settled2 ? "in or behind a dependency cycle; " : ""}depends on read logic or a data facade: ${deciding2.map(described).join(", ")}`;
+      return `${settled2 ? "in or behind a dependency cycle; " : ""}depends on read logic or a data facade: ${deciding2.map(described2).join(", ")}`;
     }
     const deciding = dependencies.filter((id) => fitOf(id) === "neither");
-    return `depends on ${deciding.map(described).join(", ")}, which neither pure nor read logic may depend on`;
+    return `depends on ${deciding.map(described2).join(", ")}, which neither pure nor read logic may depend on`;
   };
   let classifiedAny;
   do {
@@ -49976,12 +51216,12 @@ Approved: ${stamp} \u2014 this lock predates per-spec approval, so drift is only
     const carry = isContentReadingRecord(approval) && own2?.state === "approved" ? `
 ${REEXPRESS_HINT}` : "";
     if (diffSize(diff3) === 0) {
-      const owes = own2?.state === "drifted" && !own2.upgraded ? own2.owed !== void 0 ? ` But the approval does not cover this project: ${own2.owed}. \`wairon lock-check\` fails until it is cleared${/never pinned|beyond its pin/.test(own2.owed) ? " \u2014 pin first (`wairon externals pin`), then `wairon lock`" : " \u2014 `wairon lock` re-approves the unchanged design"}.` : own2.release && !own2.release.carried ? own2.release.reason ? ` But ${own2.release.reason}` : ` But it was approved under wairon ${own2.release.from}, and the new release (${own2.release.to}) finds ${own2.release.count ?? 0} issue(s) in the approved design: ${(own2.release.findings ?? []).join("; ")}. Resolve them, then \`wairon lock\`.` : pinDrift ? "" : own2.inputsMoved && own2.inputsMoved.length > 0 ? ` But what it was approved under did change: ${describeGateParts(own2.inputsMoved)}. \`wairon lock\` re-approves the unchanged design under it.` : " But what it was approved under did change: an input the gate identity covers \u2014 the doctrine, the network declaration, a consumed contract's pin, `composition` or a member's approval. `wairon lock` re-approves the unchanged design." : "";
+      const owes = own2?.state === "drifted" && !own2.upgraded ? own2.owed !== void 0 ? ` But the approval does not cover this project: ${own2.owed}. \`wairon lock-check\` fails until it is cleared${/never pinned|beyond its pin/.test(own2.owed) ? " \u2014 pin first (`wairon externals pin`), then `wairon lock`" : /extension pack\(s\) selected/.test(own2.owed) ? " \u2014 make the pack load (install or vendor it, or drop the selection), then `wairon lock`" : " \u2014 `wairon lock` re-approves the unchanged design"}.` : own2.release && !own2.release.carried ? own2.release.reason ? ` But ${own2.release.reason}` : ` But it was approved under wairon ${own2.release.from}, and the new release (${own2.release.to}) finds ${own2.release.count ?? 0} issue(s) in the approved design: ${(own2.release.findings ?? []).join("; ")}. Resolve them, then \`wairon lock\`.` : pinDrift ? "" : own2.inputsMoved && own2.inputsMoved.length > 0 ? ` But what it was approved under did change: ${describeGateParts(own2.inputsMoved)}. \`wairon lock\` re-approves the unchanged design under it.` : " But what it was approved under did change: an input the gate identity covers \u2014 the doctrine, the network declaration, a consumed contract's pin, `composition` or a member's approval. `wairon lock` re-approves the unchanged design." : "";
       const released = own2?.release?.carried ? ` Approved under wairon ${own2.release.from}, re-validated under ${own2.release.to}: still approved (\`wairon lock\` refreshes the record's release stamp without a re-approval).` : "";
       const ignored = own2?.partsIgnored !== void 0 ? ` Notice: the record's gate parts are ignored \u2014 ${own2.partsIgnored}; \`wairon lock\` rewrites them.` : "";
       return {
         text: `
-Approved: ${stamp} \u2014 no spec has changed since.${released}${owes}${ignored}${childNote}${carry}
+Approved: ${stamp} \u2014 no spec has changed since.${released}${owes}${ignored}${stampNotice(own2)}${childNote}${carry}
 `,
         drifted: pinDrift || own2?.state === "drifted"
       };
@@ -49990,7 +51230,7 @@ Approved: ${stamp} \u2014 no spec has changed since.${released}${owes}${ignored}
     if (diff3.changed.length) parts.push(`${diff3.changed.length} changed`);
     if (diff3.added.length) parts.push(`${diff3.added.length} added`);
     if (diff3.removed.length) parts.push(`${diff3.removed.length} removed`);
-    const named2 = [...diff3.changed, ...diff3.added, ...diff3.removed].slice(0, 5);
+    const named2 = [...diff3.changed, ...diff3.added, ...diff3.removed].slice(0, VERDICT_LIST_LIMIT);
     const rest = diffSize(diff3) - named2.length;
     const n = diffSize(diff3);
     const noun = `${n} spec${n === 1 ? "" : "s"}`;
@@ -49999,8 +51239,9 @@ Approved: ${stamp} \u2014 no spec has changed since.${released}${owes}${ignored}
       text: `
 ${headline} \u2014 approved ${stamp}:
 ` + named2.map((p) => `  ${p}`).join("\n") + (rest > 0 ? `
-  \u2026 and ${rest} more` : "") + (own2?.owed !== void 0 ? `
-The approval also owes: ${own2.owed}.` : "") + childNote + carry + "\n",
+  \u2026 and ${rest} more \u2014 \`wairon status --all\` lists every one` : "") + (own2?.owed !== void 0 ? `
+The approval also owes: ${own2.owed}.` : "") + (own2?.stampProblem !== void 0 ? `
+${stampNotice(own2).trim()}` : "") + childNote + carry + "\n",
       drifted: true,
       moved: [...diff3.changed.map((p) => `~ ${p}`), ...diff3.added.map((p) => `+ ${p}`), ...diff3.removed.map((p) => `- ${p}`)]
     };
@@ -50008,6 +51249,10 @@ The approval also owes: ${own2.owed}.` : "") + childNote + carry + "\n",
     return quiet;
   }
 }
+var VERDICT_LIST_LIMIT = 40;
+function stampNotice(own2) {
+  return own2?.stampProblem !== void 0 ? ` Notice: ${own2.stampProblem} \u2014 the identity alone decided this, and \`wairon lock\` replaces the stamp with this release.` : "";
+}
 function isContentReadingRecord(record) {
   return record.specsReading !== "design";
 }
@@ -50119,13 +51364,13 @@ This project uses **wairon**. System specs live under \`.wai/specs/\` (L0 System
 
 ### How you operate
 - **To design/modify specs**: Use **\`sdd-architect\`** skill (in \`.claude/skills/\` or \`.gemini/skills/\`).
-- **Manage specs via MCP tools only** (namespaced if needed; do not edit specs manually): author with \`sdd_initialize_system\`, \`sdd_add_subsystem\`, \`sdd_add_component\`, \`sdd_define_interface\`, \`sdd_set_endpoints\`, \`sdd_write_narrative\`, \`sdd_add_type\`, \`sdd_set_public_interfaces\`, \`sdd_update_spec\` (a granular delta, with \`dryRun\`) and \`sdd_delete_spec\`; rename and move with traces with \`sdd_rename_component\`, \`sdd_rename_method\` (with \`dryRun\`: it names the consumers a renamed verb breaks), \`sdd_rename_param\`, \`sdd_rename_type\`, \`sdd_rename_field\` and \`sdd_move_methods\`; read with \`sdd_get_status\`, \`sdd_get_spec\`, \`sdd_validate_tree\`, \`sdd_get_agent_brief\`, \`sdd_get_network_flows\` and \`sdd_explain_flow\` (the network), \`sdd_list_consumers\` and \`sdd_surface_diff\` (who uses this project's exports, method by method, and what its public surface changed since the last approval), \`sdd_get_externals_status\` and \`sdd_pack_impact\`; the network with \`sdd_set_network\`; externals with \`sdd_add_external\`, \`sdd_update_external\`, \`sdd_pin_externals\` and \`sdd_remove_external\`; the family's shape with the member tools below. The legacy topology tools \`getAgent\`, \`getProjectConfig\`, \`listAgents\`, \`listDomains\` and \`validateTopology\` read the generated agent registry only.
+- **Manage specs via MCP tools only** (namespaced if needed; do not edit specs manually): author with \`sdd_initialize_system\`, \`sdd_add_subsystem\`, \`sdd_add_component\`, \`sdd_define_interface\`, \`sdd_set_endpoints\`, \`sdd_write_narrative\`, \`sdd_add_type\`, \`sdd_set_public_interfaces\`, \`sdd_update_spec\` (a granular delta, with \`dryRun\`) and \`sdd_delete_spec\`; rename and move with traces with \`sdd_rename_component\`, \`sdd_rename_method\` (with \`dryRun\`: it names the consumers a renamed verb breaks), \`sdd_rename_param\`, \`sdd_rename_type\`, \`sdd_rename_field\`, \`sdd_rename_spec\` (a contract or an implementation on its own) and \`sdd_move_methods\`, and move a component or a type to another subsystem with \`sdd_move_spec\` (every one with \`dryRun\`; \`sdd_delete_spec\` and a contract method removed through \`sdd_update_spec\` name the consumers they break, as the renames do); read with \`sdd_get_status\`, \`sdd_get_spec\`, \`sdd_validate_tree\`, \`sdd_get_agent_brief\`, \`sdd_get_network_flows\` and \`sdd_explain_flow\` (the network), \`sdd_list_consumers\` and \`sdd_surface_diff\` (who uses this project's exports, method by method, and what its public surface changed since the last approval), \`sdd_get_externals_status\` and \`sdd_pack_impact\`; the network with \`sdd_set_network\`; externals with \`sdd_add_external\`, \`sdd_update_external\`, \`sdd_pin_externals\` and \`sdd_remove_external\`; the family's shape with the member tools below. The legacy topology tools \`getAgent\`, \`getProjectConfig\`, \`listAgents\`, \`listDomains\` and \`validateTopology\` read the generated agent registry only.
 - **Growing a system \u2014 subsystems \u2192 parts \u2192 projects**: boundaries are earned. Start with subsystems in one folder. A piece that needs its own folder or repository but stays the same system is a **part**: declared in \`.wai/project.yaml\` \`members\` by one location key (\`scheduler: services/scheduler\`, \`admin: ../admin\`, \`payments: git@host:acme/payments.git#<commit>\`; long form \`{ source, as, description }\`), its subsystems this project's own \u2014 local ids, this project's lock. \`sdd_add_member\` creates a part by default (\`as: project\` for a project) and \`sdd_externalize_subsystem\` moves a subsystem into one. A **project** is an independent boundary \u2014 its own id, exports, lock \u2014 reached as \`alias::name\`; make one only when it needs its own team, release, approval or public surface: \`sdd_promote_member\` (\`sdd_demote_member\` back). What a member is follows from its content (an id, an L0 or a lock make a project).
 - **Members & cross-project references**: relocate a member with \`sdd_move_member\`. Every other change of the family's shape is a **family migration**, each with \`dryRun\`: promote/demote, make an existing project a member with \`sdd_attach_member\`, take one out and back with \`sdd_detach_member\` / \`sdd_adopt_member\`, rename a project's id with \`sdd_rename_project\` or an alias with \`sdd_rename_member_alias\`, move a subsystem into a part with \`sdd_externalize_subsystem\` and fold a member back in with \`sdd_internalize_member\`. Run it with \`dryRun: true\` first and show the plan (the human's CLI calls the same plan \`--report\`); applied, it writes every project it touches or none, and never locks \u2014 it names the projects to re-lock. A project member is never a subsystem of its parent: it has its own \`.wai/\` tree and is designed from its own root \u2014 its specs, its L0 export table and its \`project.yaml\` are written by a session opened in that member's folder (its own guide and \`.mcp.json\`), and the tools here refuse such a write naming that folder.
   - **\`alias::name\`**: An id without \`::\` is local to the project that writes it. Anything another project provides is referenced as \`alias::name\` \u2014 the alias is one of your members or declared \`externals\`, the name a public name in that project's L0 export table. A reference to something it does not export is reported (\`EXTERNAL_NOT_EXPORTED\`).
   - **Deprecated forms** (they still resolve for one release, are reported, and \`wairon doctor --fix\` rewrites them): a leading \`::\` (\`::shared::error-type\`), \`super::\` (\`super::sibling_comp\`), member paths (\`billing::invoice::invoice_portal\`), and an L1 subsystem carrying \`projectPath\` (\`DEPRECATED_MOUNT_FORM\`).
 - **Do not run the \`wairon\` CLI**: Use \`sdd_validate_tree\` and \`sdd_get_status\` instead of CLI commands.
-- **Handoff to implementation**: Once design is complete and validates cleanly, tell the human: *"The specs are complete and validate. Please run \`wairon lock\` to approve them, and commit \`.wai/lock.json\`."* The lock records the approval; it does not rewrite spec files or their \`status\`. No session restart is needed after the lock \u2014 delegate implementation right away via the \`sdd-delegate\` skill.
+- **Handoff to implementation**: Once design is complete and validates cleanly, tell the human: *"The specs are complete and validate. Please run \`wairon lock\` to approve them, and commit \`.wai/lock.json\`."* The lock records the approval; it does not rewrite spec files or their \`status\`. When a change to an approved design stays inside one subsystem, the human may re-approve just that subsystem with \`wairon lock --subsystem <id>\` (refused as a first approval, when anything outside the subsystem moved, and for a member project's subsystem, which is locked at the member's own root). In a family, members lock first at their own roots, then the parent pins them. No session restart is needed after the lock \u2014 delegate implementation right away via the \`sdd-delegate\` skill.
 - **Approval, not status**: a design is ready to implement when it is APPROVED \u2014 \`sdd_get_status\` reports the approval state (approved, or which specs changed since), and \`wairon lock-check\` gives the same verdict in CI. A spec's \`status\` (draft/design/complete) is authoring readiness only; never wait for it to become \`complete\`. It is left out of the approval, so promoting a status never reopens an approved design.
 - **Prose is design; linkage is not**: an L4/L5 prose change \u2014 an implementation's or a method's description, intent or narrative step text \u2014 IS a design change: it re-opens the approval, so \`wairon lock\` is owed before code is implemented against it (an implement step asked for in the same turn as a prose edit is refused until the human re-locks; sequence spec turn \u2192 lock \u2192 code turn). Only code linkage is outside it.
 - **Code linkage is not approval**: the lock approves the DESIGN. Where it is realized \u2014 \`sourcePath\`, \`symbol\`, \`exportedVia\`, \`simPath\`, \`injectedParams\`, conformance tiers, timestamps \u2014 is outside the approved digests, so setting or changing it never asks for a re-lock. Declare each implementation's planned \`sourcePath\` at design time: a named file not written yet is \`SOURCE_FILE_PLANNED\` (a notice), at method level as at implementation level; once the component's realization begins (any file it names exists), a contract method naming no file is \`METHOD_SOURCE_PATH_MISSING\` (warning) and one its existing file does not hold is \`UNREALIZED_METHOD\`. \`rules.conformance.requireCode: true\` makes the planned and unlinked notices errors. Briefs fence planned files, marked \`(planned \u2014 create it)\`.
@@ -50732,7 +51977,9 @@ function getStatusReport(options = {}, decor) {
     members.forEach((member, j) => {
       const isLast = ownSubs.length + j === total - 1;
       const form = member.mountForm === "mount" ? mark.draft(" [mount form]") : "";
-      const label7 = `[Project] ${member.mountAlias ?? member.namespace} (${member.id ?? "no id"})`;
+      const top = family.nodes.find((n) => n.namespace === "")?.directory;
+      const sibling = top !== void 0 && path39.relative(top, member.directory).startsWith("..") ? ` \xB7 ${storageOf("path", member.directory, void 0)}` : "";
+      const label7 = `[Project] ${member.mountAlias ?? member.namespace} (${member.id ?? "no id"})${sibling}`;
       const approval = approvalTag(options.approvals?.find((a) => a.key === member.namespace));
       output += `${mark.structure(indent + (isLast ? "\u2514\u2500\u2500 " : "\u251C\u2500\u2500 "))}${mark.layer("project", label7)}${form}${approval}
 `;
@@ -50764,7 +52011,8 @@ function getStatusReport(options = {}, decor) {
   } else if (own2) {
     const release = own2.release ? own2.release.carried ? ` (approved under wairon ${own2.release.from}, re-validated under ${own2.release.to}: still approved)` : own2.release.reason ? ` (${own2.release.reason})` : ` (approved under wairon ${own2.release.from}; the new release finds ${own2.release.count ?? 0} issue(s) in the approved design)` : "";
     const ignored = own2.partsIgnored !== void 0 ? ` (notice: the record's gate parts are ignored \u2014 ${own2.partsIgnored}; \`wairon lock\` rewrites them)` : "";
-    output += `${mark.layer("system", "Approval:")} this project is ${OWN_APPROVAL_WORDS[own2.state]}${release}${own2.upgraded ? " (locked under an earlier gate identity \u2014 re-lock once)" : ""}${ignored}
+    const stamp = own2.stampProblem !== void 0 ? ` (notice: ${own2.stampProblem}; \`wairon lock\` replaces the stamp)` : "";
+    output += `${mark.layer("system", "Approval:")} this project is ${OWN_APPROVAL_WORDS[own2.state]}${release}${own2.upgraded ? " (locked under an earlier gate identity \u2014 re-lock once)" : ""}${ignored}${stamp}
 `;
   }
   return { text: output, failed: false };
@@ -51585,9 +52833,14 @@ function canonical(value) {
 }
 function writeSpec(restatement) {
   const bound2 = candidateOptions();
+  const id = restatement.kind === "system" ? "system" : restatement.spec.id;
   const parentRef = restatementParent(restatement);
+  const foreign = crossProjectWriteRefusal(
+    [{ kind: restatement.kind, id }, ...parentRef && typeof parentRef.id === "string" ? [{ kind: parentRef.kind, id: parentRef.id }] : []],
+    CREATE_TOOL[restatement.kind]
+  );
+  if (foreign !== void 0) throw new Error(foreign);
   const parent = parentRef ? loadSpec(parentRef.kind, parentRef.id) : null;
-  const id = restatement.kind === "system" ? "system" : restatement.spec.id;
   const existing = loadSpec(restatement.kind, id);
   if (!existing && TRACED_KINDS.has(restatement.kind)) {
     const spec = restatement.spec;
@@ -51603,21 +52856,83 @@ function writeSpec(restatement) {
   if (application.refusal !== void 0) throw new Error(application.refusal);
   const names = introducedNameProblems(restatement.kind, application.spec, existing);
   if (names.length) throw new Error(nameRefusal(restatement.kind, id, names));
+  refuseMountForm(restatement.kind, application.spec);
   const gateNotices = restatement.kind === "component" ? judgeComponent(application.spec, bound2) : [];
   gateNotices.push(...judgeInTree(restatement.kind, application.spec, bound2));
-  const persisted = persistCandidate(restatement.kind, application.spec);
+  let cascade = [];
+  if (restatement.kind === "interface" && existing) {
+    const dropped = removedByName(existing.methods, application.spec.methods);
+    if (dropped.length > 0) {
+      const removal = methodRemoval(scanAllSpecs({ memberDepth: 0 }), id, application.spec.component, dropped);
+      if (removal.references.length > 0) throw new Error(methodReferencedRefusal(id, removal.referenced, removal.references));
+      cascade = removal.cascade;
+    }
+  }
   const testsToRevisit = testsInvalidatedBy(restatement.kind, id, application.changedMethods, [existing, application.spec], bound2);
+  const cascaded = cascade.map((c) => `${c.implementation}.${c.method}`);
+  const name = application.spec.name;
+  const status = application.status ? { status: application.status } : {};
+  if (restatement.dryRun) {
+    return {
+      kind: restatement.kind,
+      id,
+      name,
+      replacedExisting: application.replacedExisting,
+      ...status,
+      notices: [...gateNotices, ...application.notices, ...cascadeNotices(cascade, true)],
+      respellings: application.respellings,
+      testsToRevisit,
+      ...cascaded.length > 0 ? { cascaded } : {},
+      dryRun: true
+    };
+  }
+  const persisted = persistCandidate(restatement.kind, application.spec);
+  for (const [implementation, methods] of groupCascade(cascade)) {
+    updateSpec("implementation", implementation, { methods: methods.map((m) => ({ name: m, action: "delete" })) });
+  }
   return {
     kind: restatement.kind,
     id,
-    name: application.spec.name,
+    name,
     replacedExisting: application.replacedExisting,
-    ...application.status ? { status: application.status } : {},
-    notices: [...gateNotices, ...persisted.notices, ...application.notices],
+    ...status,
+    notices: [...gateNotices, ...persisted.notices, ...application.notices, ...cascadeNotices(cascade, false)],
     respellings: application.respellings,
-    testsToRevisit
+    testsToRevisit,
+    ...cascaded.length > 0 ? { cascaded } : {}
   };
 }
+var CREATE_TOOL = {
+  system: "sdd_initialize_system",
+  subsystem: "sdd_add_subsystem",
+  component: "sdd_add_component",
+  interface: "sdd_define_interface",
+  implementation: "sdd_write_narrative",
+  type: "sdd_add_type"
+};
+function methodRemoval(index, contract, component, removed) {
+  const realizing = index.implementations.filter((impl) => impl.contract === contract);
+  const stillDeclared = (m) => index.interfaces.some((i) => i.component === component && i.id !== contract && i.methods.some((x) => x.name === m));
+  const referenced = removed.filter((m) => !stillDeclared(m));
+  const inside = (r) => r.kind === "implementation" && realizing.some((impl) => impl.id === r.id) && removed.some((m) => r.position === `methods.${m}` || r.position.startsWith(`methods.${m}.`));
+  const references = referenced.length === 0 ? [] : specIndexMethodReferences(index, component, referenced).filter((r) => !inside(r));
+  const cascade = realizing.flatMap((impl) => removed.filter((m) => impl.methods.some((x) => x.name === m)).map((m) => ({ implementation: impl.id, method: m })));
+  return { referenced, references, cascade };
+}
+function methodReferencedRefusal(contract, removed, references) {
+  return `Refusing to remove ${removed.length === 1 ? "method" : "methods"} ${removed.map((m) => `"${m}"`).join(", ")} from contract "${contract}": specs that stay still hold ${references.length === 1 ? "a reference" : `${references.length} references`} to ${removed.length === 1 ? "it" : "them"} \u2014 the invalid method references validate would report:
+${references.map((r) => `- ${r.kind} "${r.id}" (${r.position}) -> ${r.target.kind} "${r.target.id}"`).join("\n")}
+Edit those specs first \u2014 retarget or remove each call. Nothing was written.`;
+}
+function groupCascade(cascade) {
+  const out = /* @__PURE__ */ new Map();
+  for (const c of cascade) out.set(c.implementation, [...out.get(c.implementation) ?? [], c.method]);
+  return out;
+}
+function cascadeNotices(cascade, dryRun) {
+  if (cascade.length === 0) return [];
+  return [`Cascaded: ${dryRun ? "would remove" : "removed"} the implementation ${cascade.length === 1 ? "entry" : "entries"} ${cascade.map((c) => `"${c.implementation}.${c.method}"`).join(", ")} with ${cascade.length === 1 ? "its" : "their"} contract method \u2014 a narrative realizes its contract method and means nothing without it.`];
+}
 function judgeComponent(candidate, options) {
   const verdict = validateComponentCandidate(candidate, options);
   if (verdict.errors.length) throw new Error(formatCandidateRefusal(verdict));
@@ -51636,6 +52951,10 @@ Nothing was written. Route the dependency the way the message names, or bind the
   return noticesFrom(verdict);
 }
 function persistCandidate(kind, spec) {
+  refuseMountForm(kind, spec);
+  return { notices: saveSpec(kind, spec) };
+}
+function refuseMountForm(kind, spec) {
   const projectPath = kind === "subsystem" ? spec.projectPath : void 0;
   if (projectPath !== void 0 && projectPath.trim() !== "") {
     const id = spec.id;
@@ -51643,7 +52962,6 @@ function persistCandidate(kind, spec) {
       `mount form refused: subsystem "${id}" names a projectPath ("${projectPath}"), which is the legacy L1 mount form \u2014 wairon never writes it. A member project is declared in project.yaml \`members\`: use sdd_add_member (or \`wairon member add ${id} ${projectPath}\`), which scaffolds the member project and declares it.`
     );
   }
-  return { notices: saveSpec(kind, spec) };
 }
 function testsInvalidatedBy(kind, id, methods, specs, options, written = []) {
   const testRoots = options.rules?.conformance?.testRoots ?? [];
@@ -51671,25 +52989,51 @@ function searchedMethods(kind, id, names, specs, written) {
   });
 }
 function deleteSpec2(kind, id, dryRun, force) {
-  if (kind === "system" || kind !== "type" && id.includes("::")) {
+  const foreign = crossProjectWriteRefusal([{ kind, id }], "sdd_delete_spec");
+  if (foreign !== void 0) throw new Error(foreign);
+  if (kind === "system") {
+    throw new Error("Refusing to delete the L0 System spec: it is the root every other spec hangs from, and is never deleted. Nothing was deleted.");
+  }
+  if (kind !== "type" && id.includes("::")) {
     const deleted = dryRun ? loadSpec(kind, id) !== null : deleteSpec(kind, id);
-    return { kind, id, deleted: deleted && !dryRun, dryRun: dryRun === true, removed: deleted ? [{ kind, id }] : [], references: [], testsToRevisit: [] };
+    if (!deleted && loadSpec(kind, id) === null) throw new Error(`spec-missing: no ${kind} has the id "${id}" \u2014 nothing was deleted.`);
+    return { kind, id, deleted: deleted && !dryRun, dryRun: dryRun === true, removed: [{ kind, id }], references: [], testsToRevisit: [], published: [] };
   }
   const bound2 = candidateOptions();
   const index = scanAllSpecs({ memberDepth: 0 });
   const system = loadSpec("system", "system");
   const removed = specIndexSubtreeOf(index, kind, id);
-  if (removed.length === 0) return { kind, id, deleted: false, dryRun: dryRun === true, removed: [], references: [], testsToRevisit: [] };
+  if (removed.length === 0) throw new Error(missingRefusal(kind, id, index));
   const references = specIndexReferencesTo(index, removed, system);
+  const published = publishedUsesOf(removed, []);
   const testsToRevisit = removed.flatMap((ref) => {
     const spec = specOf(index, ref);
     const methods = (spec?.methods ?? []).map((m) => m.name);
     return ref.kind === "interface" || ref.kind === "implementation" || ref.kind === "type" ? testsInvalidatedBy(ref.kind, ref.id, methods, [spec], bound2) : [];
   });
-  if (dryRun) return { kind, id, deleted: false, dryRun: true, removed, references, testsToRevisit };
+  if (dryRun) return { kind, id, deleted: false, dryRun: true, removed, references, testsToRevisit, published };
   if (references.length > 0 && !force) throw new Error(referencedRefusal(kind, id, references));
   for (const ref of removed) deleteSpec(ref.kind, ref.id);
-  return { kind, id, deleted: true, dryRun: false, removed, references, testsToRevisit };
+  return { kind, id, deleted: true, dryRun: false, removed, references, testsToRevisit, published };
+}
+function missingRefusal(kind, id, index) {
+  const pools = {
+    subsystem: index.subsystems,
+    component: index.components,
+    interface: index.interfaces,
+    implementation: index.implementations,
+    type: index.types
+  };
+  const hints = [];
+  const elsewhere = Object.keys(pools).filter((k) => k !== kind && pools[k].some((s) => s.id === id));
+  if (elsewhere.length > 0) hints.push(`"${id}" is ${elsewhere.map((k) => `a ${k}`).join(" and ")} \u2014 pass kind "${elsewhere[0]}"`);
+  const dot = id.lastIndexOf(".");
+  if (kind === "type" && dot > 0 && index.types.some((t) => t.id === id.slice(dot + 1))) {
+    hints.push(`a type is addressed by its bare id, or as <subsystem>::<id> \u2014 "${id.slice(dot + 1)}" or "${id.slice(0, dot)}::${id.slice(dot + 1)}"`);
+  }
+  const known = pools[kind].map((s) => kind === "type" ? qualifiedTypeId(s) : s.id).sort();
+  const listed = known.length === 0 ? `This project has no ${kind} at all.` : `Its ${kind}s: ${known.slice(0, 12).join(", ")}${known.length > 12 ? `, \u2026 (${known.length} in all)` : ""}.`;
+  return `spec-missing: no ${kind} has the id "${id}" \u2014 nothing was deleted.${hints.length > 0 ? ` ${hints.join("; ")}.` : ""} ${listed}`;
 }
 function specOf(index, ref) {
   const pool = ref.kind === "subsystem" ? index.subsystems : ref.kind === "component" ? index.components : ref.kind === "interface" ? index.interfaces : ref.kind === "implementation" ? index.implementations : ref.kind === "type" ? index.types : [];
@@ -51702,10 +53046,29 @@ Edit those specs first, or pass force: true to delete anyway and leave them dang
 }
 function updateSpecGated(kind, id, delta, dryRun) {
   const bound2 = candidateOptions();
+  const foreign = crossProjectWriteRefusal([{ kind, id }], "sdd_update_spec");
+  if (foreign !== void 0) throw new Error(foreign);
   const testRoots = bound2.rules?.conformance?.testRoots ?? [];
   const stored = loadSpec(kind, id);
+  const removedMethods = kind === "interface" ? methodsDeltaRemoves(stored, delta) : [];
+  let cascade = [];
+  let published = [];
+  if (removedMethods.length > 0) {
+    const removal = methodRemoval(scanAllSpecs({ memberDepth: 0 }), id, stored.component, removedMethods);
+    if (removal.references.length > 0) throw new Error(methodReferencedRefusal(id, removal.referenced, removal.references));
+    cascade = removal.cascade;
+    published = publishedUsesOf([], removal.referenced.map((m) => `${id}.${m}`));
+  }
   const gate = componentCandidateGate(bound2, stored?.subsystem, stored);
   const report3 = updateSpec(kind, id, delta, gate, dryRun);
+  if (cascade.length > 0 && report3.changes.length > 0) {
+    for (const [implementation, methods] of groupCascade(cascade)) {
+      updateSpec("implementation", implementation, { methods: methods.map((m) => ({ name: m, action: "delete" })) }, void 0, dryRun);
+    }
+    report3.cascaded = cascade.map((c) => `${c.implementation}.${c.method}`);
+    report3.notices.push(...cascadeNotices(cascade, dryRun === true));
+  }
+  if (published.length > 0 && report3.changes.length > 0) report3.published = published;
   if (kind === "component" && typeof delta?.transport === "string" && report3.changes.some((c) => c.path === "transport")) {
     report3.notices.push(...adapterTransportImpact(id, delta.transport));
   }
@@ -51720,6 +53083,14 @@ function updateSpecGated(kind, id, delta, dryRun) {
   }
   return report3;
 }
+function methodsDeltaRemoves(stored, delta) {
+  const held = (stored?.methods ?? []).map((m) => m.name);
+  if (held.length === 0 || !delta || typeof delta !== "object") return [];
+  const methods = delta.methods;
+  if (Array.isArray(methods) && methods.length === 0 || Array.isArray(delta.unset) && delta.unset.includes("methods")) return held;
+  if (!Array.isArray(methods)) return [];
+  return methods.filter((m) => m && typeof m === "object" && (m.action === "delete" || m.remove === true) && held.includes(m.name)).map((m) => String(m.name));
+}
 function adapterTransportImpact(portal, transport) {
   const components = loadComponentSpecs();
   if (components.find((c) => c.id === portal)?.componentType !== "Portal") return [];
@@ -51765,8 +53136,34 @@ function judgeMoveHome(component, source, options) {
   return { codes: [...new Set(codes)], verdict, ceiling };
 }
 function moveMethods2(from, to, methods, dryRun) {
+  const foreign = crossProjectWriteRefusal([{ kind: "component", id: from }, { kind: "component", id: to }], "sdd_move_methods");
+  if (foreign !== void 0) throw new Error(foreign);
   return moveMethods(from, to, methods, methodMoveGate(from), dryRun);
 }
+function moveSpec2(kind, id, subsystem, dryRun) {
+  const foreign = crossProjectWriteRefusal(
+    [{ kind, id }, ...subsystem ? [{ kind: "subsystem", id: subsystem }] : []],
+    "sdd_move_spec"
+  );
+  if (foreign !== void 0) throw new Error(foreign);
+  if (kind !== "component") return moveSpec(kind, id, subsystem, dryRun);
+  const bound2 = candidateOptions();
+  const plan6 = moveSpec(kind, id, subsystem, true);
+  const moving = plan6.moved.filter((ref) => ref.kind === "component").map((ref) => loadSpec("component", ref.id)).filter((spec) => spec !== null).map((spec) => ({ ...spec, subsystem: plan6.to }));
+  const [first, ...rest] = moving;
+  const verdict = first ? introducedFindings("component", first, bound2, rest) : { errors: [], warnings: [], notices: [] };
+  if (verdict.errors.length > 0) {
+    throw new Error(
+      `Refused: moving component "${id}" to subsystem "${plan6.to}" would introduce ${verdict.errors.length === 1 ? "an error" : `${verdict.errors.length} errors`} validate reports \u2014 a forbidden edge between two blocks, or an edge into another subsystem whose target is not a Portal:
+${verdict.errors.map((e) => `- ${e.code}: ${e.message}`).join("\n")}
+
+Nothing was written. Route each such dependency through a client Adapter calling the other subsystem's Portal, or move its collaborators with it.`
+    );
+  }
+  const notices = noticesFrom(verdict);
+  const report3 = dryRun ? plan6 : moveSpec(kind, id, subsystem, false);
+  return { ...report3, notices: [...report3.notices, ...notices] };
+}
 
 // src/mcp/build.ts
 var fs26 = __toESM(require("fs"));
@@ -53659,17 +55056,24 @@ function boundNode(family, bound2) {
 function nodeAt(family, dir) {
   return family.nodes.find((n) => path45.resolve(n.directory) === path45.resolve(dir));
 }
+function memberLocation(boundDir, written) {
+  const location = parseMemberSource(written);
+  if (location.storage === "path" && location.problem === void 0) {
+    const sibling = path45.resolve(boundDir, written);
+    if (path45.relative(sibling, boundDir).startsWith("..")) return { dir: sibling };
+    return { refused: `the path "${written}" names a directory holding {bound} itself (${boundDir}), never a member of it` };
+  }
+  const dir = resolve36(boundDir, written);
+  if (dir !== null) return { dir };
+  return { refused: `the path "${written}" does not resolve strictly within {bound} (${boundDir}), and is not a sibling written with a leading \`../\`${location.problem ? ` (${location.problem})` : ""}` };
+}
 function planAttach(family, bound2, request) {
   const plan6 = emptyPlan(family, request);
   const node = boundNode(family, bound2);
   const alias = request.alias ?? "";
-  const location = parseMemberSource(request.path ?? "");
-  const sibling = location.storage === "path" && location.problem === void 0 ? path45.resolve(node.directory, request.path ?? "") : null;
-  const holdsBound = sibling !== null && !path45.relative(sibling, node.directory).startsWith("..");
-  const dir = sibling !== null && !holdsBound ? sibling : resolve36(node.directory, request.path ?? "");
-  if (dir === null) {
-    refuse(plan6, "not-contained", bound2, holdsBound ? `the path "${request.path ?? ""}" names a directory holding ${label4(bound2)} itself (${node.directory}), never a member of it` : `the path "${request.path ?? ""}" does not resolve strictly within ${label4(bound2)} (${node.directory}), and is not a sibling written with a leading \`../\`${location.problem ? ` (${location.problem})` : ""}`);
-  }
+  const located2 = memberLocation(node.directory, request.path ?? "");
+  const dir = "dir" in located2 ? located2.dir : null;
+  if ("refused" in located2) refuse(plan6, "not-contained", bound2, located2.refused.replace("{bound}", label4(bound2)));
   const config = configAt3(node.directory) ?? {};
   const held = ownGet(config.members, alias);
   const heldPath = held !== void 0 ? memberLocationOf(held) : void 0;
@@ -53830,9 +55234,12 @@ function planAdopt(family, bound2, request) {
   if (!external) refuse(plan6, "not-an-external", bound2, `${label4(bound2)} declares no external "${alias}"`);
   else if (request.relocation) return planRelocatedAdopt(plan6, family, bound2, alias, external, request.relocation);
   else {
-    dir = resolve36(boundDir, externalSourceOf2(external)?.path ?? "");
-    if (dir === null) refuse(plan6, "not-contained", bound2, `the external "${alias}" ${externalSourceOf2(external)?.path ? `is found at "${externalSourceOf2(external)?.path}", which is not strictly within ${label4(bound2)}` : "names no source.path"}`);
-    else if (nodeAt(family, dir)) refuse(plan6, "already-member", nodeAt(family, dir).namespace, `${dir} is already the family project ${label4(nodeAt(family, dir).namespace)}`);
+    const written = externalSourceOf2(external)?.path;
+    const located2 = written !== void 0 ? memberLocation(boundDir, written) : null;
+    dir = located2 !== null && "dir" in located2 ? located2.dir : null;
+    if (located2 === null) refuse(plan6, "not-contained", bound2, `the external "${alias}" names no source.path`);
+    else if ("refused" in located2) refuse(plan6, "not-contained", bound2, `the external "${alias}" is found at "${written}": ${located2.refused.replace("{bound}", label4(bound2))}`);
+    else if (nodeAt(family, located2.dir)) refuse(plan6, "already-member", nodeAt(family, located2.dir).namespace, `${located2.dir} is already the family project ${label4(nodeAt(family, located2.dir).namespace)}`);
   }
   if (plan6.refusals.length > 0) return plan6;
   return adoptEdits(plan6, family, bound2, alias, external, dir);
@@ -54259,8 +55666,7 @@ function planInternalize(family, bound2, request) {
   const alias = request.alias ?? "";
   const part = familyNode(family, bound2)?.parts.find((p) => p.alias === alias);
   if (part) return planPartInternalize(plan6, family, bound2, alias, part);
-  const sibling = familyNode(family, bound2)?.externals.find((e) => e.role === "member" && e.sourceKind === "path" && e.alias === alias);
-  if (sibling) return planSiblingInternalize(plan6, family, bound2, request);
+  if (storedAsSibling2(family, bound2, alias)) return planSiblingInternalize(plan6, family, bound2, request);
   const member = memberUnder2(family, bound2, alias, plan6);
   if (!member) return plan6;
   const consumers = consumersOf(family, bound2, member);
@@ -54388,12 +55794,19 @@ function internalizeEdits(plan6, family, bound2, member, alias, consumers, desti
   );
   for (const c of repinned) {
     edit3(plan6, c.node.namespace, "pin", `pin ${c.alias} taken again against ${boundNode2.id ?? "the top project"}`, { root: c.node.directory, call: "pinExternals", args: [[c.alias]] });
+    loopClosed(plan6, family, bound2, member, c);
   }
   if (carried.length > 0) edit3(plan6, bound2, "pin", `pin ${carried.join(", ")} (externals carried from ${alias})`, { root: boundNode2.directory, call: "pinExternals", args: [carried] });
   plan6.edits.push({ project: member.namespace, kind: "delete", detail: `${alias}'s lock, pins and derived outputs have no home: deleted, each listed` });
   plan6.notes.push(`Consumers outside the family that name "${member.id ?? alias}" by path are not found: each must repoint its own external at ${boundNode2.id ?? "this project"}.`);
   if (member.id !== void 0 && approvalRecord(member.directory)) plan6.notes.push(`${label6(member.namespace)}'s approval ends with it: its lock is deleted, and ${label6(bound2)} is re-locked instead.`);
 }
+function loopClosed(plan6, family, bound2, member, c) {
+  const uses = family.references.filter((r) => (r.consumer === bound2 || r.consumer === member.namespace) && r.producer === c.node.namespace);
+  if (uses.length === 0) return;
+  const named2 = [...new Set(uses.map((r) => `"${r.authored}"`))].slice(0, 3).join(", ");
+  plan6.notes.push(`${label6(c.node.namespace)} is re-pointed at ${label6(bound2)}, which uses it (${named2}${uses.length > 3 ? ", \u2026" : ""}): the two projects depend on each other in a loop after the internalize \u2014 PROJECT_DEPENDENCY_CYCLE. To keep them apart, move what ${label6(c.node.namespace)} uses of "${member.mountAlias ?? member.namespace}" into ${label6(c.node.namespace)} itself, or demote ${label6(c.node.namespace)} into a part of ${label6(bound2)} first.`);
+}
 function respellConsumer(plan6, family, c, own2) {
   const seen = /* @__PURE__ */ new Set();
   for (const ref of family.authoredReferences) {
@@ -54531,6 +55944,11 @@ function plan3(family, bound2, request) {
       throw new Error(`boundary_migration plans no "${request.verb}": internalize | externalize | promote | demote`);
   }
 }
+function storedAsSibling2(family, bound2, alias) {
+  const held = ownGet(configAt5(familyNode(family, bound2).directory)?.members, alias);
+  const location = held === void 0 ? void 0 : memberLocationOf(held);
+  return location !== void 0 && parseMemberSource(location).storage === "path";
+}
 function insideFamily(plan6, dir) {
   const rel2 = path47.relative(plan6.familyRoot, dir);
   return rel2 !== "" && !rel2.startsWith("..") && !path47.isAbsolute(rel2);
@@ -54595,7 +56013,6 @@ function planPromote(family, bound2, request) {
     { root: node.directory, call: "promoteMember", args: [alias, newId] }
   );
   edit3(plan6, newId, "pin", `pin the new project's external for ${node.id ?? "this project"} (when its specs reference it)`, { root: part.directory, call: "pinExternals", args: [[]] });
-  if (part.storage !== "contained") edit3(plan6, bound2, "pin", `pin ${alias} (a project stored outside ${label6(bound2)} is judged against its pin)`, { root: node.directory, call: "pinExternals", args: [[alias]] });
   repinIntactConsumers2(plan6, family, bound2, [part.directory]);
   plan6.notes.push(`"${newId}" has no lock yet: lock it at its own root (\`wairon lock\`) once it validates.`);
   return plan6;
@@ -54617,7 +56034,7 @@ function planDemote(family, bound2, request) {
   if (referenced?.sourceKind === "git") refuse3(plan6, "read-only", bound2, `the member "${alias}" is fetched from git: demote it in a checkout of its repository`);
   if (referenced?.sourceKind === "hosted") refuse3(plan6, "read-only", bound2, `the member "${alias}" is a hosted record: a part lives in its parent's tree`);
   const dir = member?.directory ?? referenced?.directory;
-  if (!member && referenced?.sourceKind === "path" && dir !== void 0) siblingRefused(plan6, bound2, alias, dir);
+  if (dir !== void 0 && (storedAsSibling2(family, bound2, alias) || referenced?.sourceKind === "path")) siblingRefused(plan6, bound2, alias, dir);
   if (member) {
     const users = /* @__PURE__ */ new Map();
     for (const ref of family.references) {
@@ -54656,7 +56073,7 @@ function write5(plan6, rehearsal) {
       const [kind, id] = spec.split("\n");
       runWithProjectRoot(rehearsalRoot(rehearsal, plan6.familyRoot), () => rewriteReferences2(kind, id, edits));
     }
-    for (const e of planned.filter((x) => x.write.call === "internalizeMember")) writeOne3(rehearsal, e.write);
+    for (const e of planned.filter((x) => x.write.call === "internalizeMember")) recordFolded(plan6, e.project, writeOne3(rehearsal, e.write));
     for (const e of planned.filter((x) => ["importNames", "unpin", "removeExternal"].includes(x.write.call))) writeOne3(rehearsal, e.write);
     for (const e of planned.filter((x) => x.write.call === "repointExternal")) writeOne3(rehearsal, e.write);
     for (const e of planned.filter((x) => x.write.call === "pinExternals")) writeOne3(rehearsal, e.write);
@@ -54675,7 +56092,7 @@ function write5(plan6, rehearsal) {
   for (const e of planned.filter((x) => x.write.call === "demoteMember")) {
     const demoted = writeOne3(rehearsal, e.write);
     for (const line of demoted?.consumersRestored ?? []) plan6.edits.push({ project: e.project, kind: "reference", detail: `consumers across the old boundary restored: ${line}` });
-    for (const line of demoted?.signaturesRederived ?? []) plan6.edits.push({ project: e.project, kind: "reference", detail: `signature text re-derived \u2014 ${line}` });
+    recordFolded(plan6, e.project, demoted);
   }
   for (const e of planned.filter((x) => x.write.call === "unpin")) writeOne3(rehearsal, e.write);
 }
@@ -54724,6 +56141,7 @@ function recordCrossing(plan6, bound2, member, result) {
   }
   for (const line of crossed.exported) plan6.edits.push({ project: bound2, kind: "export", detail: `export ${line}` });
   for (const line of crossed.imported) plan6.edits.push({ project: bound2, kind: "external", detail: `import: ${line}` });
+  for (const line of crossed.externalsDeclared ?? []) plan6.edits.push({ project: member, kind: "external", detail: `externals: ${line} \u2014 a project its moved specs name` });
   for (const line of crossed.consumersDropped) plan6.edits.push({ project: bound2, kind: "reference", detail: `consumers across the boundary to ${member} dropped: ${line}` });
   for (const line of crossed.pathsRebased ?? []) plan6.edits.push({ project: member, kind: "reference", detail: `path re-expressed under the new root \u2014 ${line}` });
   for (const line of crossed.signaturesRederived ?? []) plan6.edits.push({ project: bound2, kind: "reference", detail: `signature text re-derived \u2014 ${line}` });
@@ -54734,6 +56152,12 @@ function recordCrossing(plan6, bound2, member, result) {
     for (const line of topics) plan6.notes.push(`  ${line}`);
   }
 }
+function recordFolded(plan6, project3, result) {
+  const folded = result;
+  if (!folded) return;
+  for (const line of folded.signaturesRederived ?? []) plan6.edits.push({ project: project3, kind: "reference", detail: `signature text re-derived \u2014 ${line}` });
+  for (const line of folded.notCarried) if (!plan6.notes.includes(`not carried: ${line}`)) plan6.notes.push(`not carried: ${line}`);
+}
 function writeOne3(rehearsal, w) {
   const args = w.args;
   return runWithProjectRoot(rehearsalRoot(rehearsal, w.root), () => {
@@ -55407,10 +56831,14 @@ function newFindings(plan6, rehearsal, scope, changes) {
   if (owners.length === 0) return [];
   const run3 = (copy) => {
     try {
-      return owners.flatMap((owner) => runWithProjectRoot(rehearsalRoot(copy, owner), () => {
-        const codeCodes = new Set(listRules2().filter((r) => r.judges === "code").flatMap((r) => r.codes.map((c) => c.code)));
-        return validateFamily({ memberDepth: 0 }).issues.filter((i) => (i.severity === "error" || i.severity === "warning") && !codeCodes.has(i.code)).map((issue2) => ({ owner, issue: issue2 }));
-      }));
+      const shape = familyShape(plan6, copy);
+      return [
+        ...owners.filter((owner) => shape.roots.has(path49.resolve(rehearsalRoot(copy, owner)))).flatMap((owner) => runWithProjectRoot(rehearsalRoot(copy, owner), () => {
+          const codeCodes = new Set(listRules2().filter((r) => r.judges === "code").flatMap((r) => r.codes.map((c) => c.code)));
+          return validateFamily({ memberDepth: 0 }).issues.filter((i) => (i.severity === "error" || i.severity === "warning") && !codeCodes.has(i.code)).map((issue2) => ({ owner, issue: issue2 }));
+        })),
+        ...shape.loops.map((loop) => ({ owner: `loop ${loop.where}`, issue: loop.issue }))
+      ];
     } catch {
       return null;
     }
@@ -55448,6 +56876,28 @@ function newFindings(plan6, rehearsal, scope, changes) {
   }
   return notes;
 }
+function familyShape(plan6, copy) {
+  const top = rehearsalRoot(copy, plan6.familyRoot);
+  const family = runWithProjectRoot(top, () => graph());
+  const roots = new Set(family.nodes.map((n) => path49.resolve(n.directory)));
+  const label7 = (key2) => {
+    const node = family.nodes.find((n) => n.namespace === key2);
+    return `"${node?.id ?? node?.name ?? key2}"${key2 === "" ? "" : ` (member "${node?.mountAlias ?? key2}")`}`;
+  };
+  const loops = dependencyCycles(family).map((loop) => {
+    const where = [...new Set(loop)].map((k) => posixPath(path49.relative(top, family.nodes.find((n) => n.namespace === k)?.directory ?? top))).sort().join(",");
+    const issue2 = {
+      severity: "warning",
+      code: "PROJECT_DEPENDENCY_CYCLE",
+      message: `Projects ${loop.map(label7).join(" -> ")} depend on each other in a loop, so neither can be approved or released before the other`
+    };
+    return { where, issue: issue2 };
+  });
+  return { roots, loops };
+}
+function posixPath(p) {
+  return p.split(path49.sep).join("/");
+}
 function movedOf(plan6) {
   const relocation = plan6.request.relocation;
   const move2 = plan6.edits.find((e) => e.write?.call === "move");
@@ -55511,9 +56961,7 @@ function partDirectories(plan6, family) {
     return rel2 !== "" && !rel2.startsWith("..") && !path49.isAbsolute(rel2);
   };
   const subject = plan6.request.alias;
-  const parts = family.nodes.flatMap((n) => n.parts.filter((p) => p.storage !== "git" && p.directory !== void 0 && (inside(p.directory) || p.alias === subject)).map((p) => p.directory));
-  const siblings = family.nodes.flatMap((n) => n.externals.filter((e) => e.role === "member" && e.sourceKind === "path" && e.directory !== void 0 && e.alias === subject).map((e) => e.directory));
-  return [...parts, ...siblings];
+  return family.nodes.flatMap((n) => n.parts.filter((p) => p.storage !== "git" && p.directory !== void 0 && (inside(p.directory) || p.alias === subject)).map((p) => p.directory));
 }
 function broughtIn(plan6, family) {
   const known = new Set(family.nodes.map((n) => path49.resolve(n.directory)));
@@ -55673,11 +57121,11 @@ function statusFamilyContext() {
     const root = getProjectRoot();
     const members = listDirectChainedSubprojects(root);
     if (members.length > 0) {
-      const described = members.map((m) => {
+      const described2 = members.map((m) => {
         const rel2 = path51.relative(root, m.dir).split(path51.sep).join("/") || ".";
         return `${m.alias} (${rel2}${m.form === "mount" ? ", legacy L1 mount" : ""})`;
       });
-      lines.push(`Family: member projects declared here \u2014 ${described.join(", ")}.`);
+      lines.push(`Family: member projects declared here \u2014 ${described2.join(", ")}.`);
     }
   } catch {
   }
@@ -55959,9 +57407,24 @@ function renderChangeReport(report3) {
     lines.push("", `DROPPED FROM THE STORED FILE (${report3.dryRun ? "would be " : ""}removed \u2014 the schema does not know them):`, ...report3.strippedKeys.map((k) => `- ${k}`));
   }
   lines.push(...renderRespellings(report3.respellings));
+  lines.push(...renderBreaks(report3.published ?? [], report3.breaks ?? [], report3.dryRun));
   lines.push(...renderTestsToRevisit(report3.testsToRevisit));
   return lines.join("\n");
 }
+function renderBreaks(published, breaks, dryRun) {
+  if (published.length === 0) return [];
+  const lines = ["", `PUBLISHED as: ${published.map((u) => `${u.publicName}${u.members.length ? ` (${u.members.join(", ")})` : ""}`).join("; ")} \u2014 a consumer of these ${dryRun ? "would lose" : "lost"} what goes.`];
+  if (breaks.length === 0) {
+    lines.push("No consumer in reach uses it (the family, and the searched folders when `search` names any).");
+    return lines;
+  }
+  lines.push(`BREAKS ${breaks.length} consumer(s), whose specs still reach it:`);
+  for (const c of breaks) {
+    const uses = (c.uses ?? []).map((u) => `${u.publicName}${u.members.length ? `.${u.members.join("/")}` : ""}${u.specs?.length ? ` in ${u.specs.join(", ")}` : ""}`);
+    lines.push(`- ${c.project} (${c.section}.${c.alias})${c.found === "search" ? ` [${c.directory}]` : ""}${uses.length ? `: ${uses.join("; ")}` : ""}`);
+  }
+  return lines;
+}
 function renderDeletion(deletion) {
   const others = deletion.removed.filter((r) => !(r.kind === deletion.kind && r.id === deletion.id));
   const lines = [deletion.dryRun ? `DRY RUN \u2014 nothing was deleted. Deleting ${deletion.kind} "${deletion.id}" would remove ${deletion.removed.length} spec${deletion.removed.length === 1 ? "" : "s"}.` : `Successfully deleted ${deletion.kind} spec "${deletion.id}"${others.length ? ` and ${others.length} spec${others.length === 1 ? "" : "s"} it contained` : ""}.`];
@@ -55970,6 +57433,7 @@ function renderDeletion(deletion) {
     lines.push("", deletion.dryRun ? "STILL REFERENCED \u2014 the deletion would be refused unless forced (force: true leaves these dangling):" : "LEFT DANGLING (forced) \u2014 validate reports each:");
     lines.push(...deletion.references.map((r) => `- ${r.kind} "${r.id}" (${r.position}) -> ${r.target.kind} "${r.target.id}"`));
   }
+  lines.push(...renderBreaks(deletion.published, deletion.breaks ?? [], deletion.dryRun));
   lines.push(...renderTestsToRevisit(deletion.testsToRevisit));
   return lines.join("\n");
 }
@@ -56020,6 +57484,25 @@ function renderRespellings(entries) {
   if (!entries.length) return [];
   return ["", "RESPELLED (stored canonical):", ...entries.map((r) => `- ${r.path}: "${r.written}" \u2192 "${r.stored}"`)];
 }
+var exportUseOutput = import_zod13.z.object({
+  publicName: import_zod13.z.string(),
+  kind: import_zod13.z.string(),
+  members: import_zod13.z.array(import_zod13.z.string()).describe("The contract methods (or `type`) a consumer reaches on it that the removal takes away."),
+  specs: import_zod13.z.array(import_zod13.z.string()).optional(),
+  formerNames: import_zod13.z.array(import_zod13.z.string()).optional(),
+  formerMembers: import_zod13.z.record(import_zod13.z.array(import_zod13.z.string())).optional()
+});
+var breakingConsumerOutput = import_zod13.z.object({
+  project: import_zod13.z.string(),
+  key: import_zod13.z.string(),
+  directory: import_zod13.z.string(),
+  alias: import_zod13.z.string(),
+  section: import_zod13.z.enum(["externals", "members"]),
+  names: import_zod13.z.array(import_zod13.z.string()),
+  broken: import_zod13.z.array(import_zod13.z.string()).optional(),
+  found: import_zod13.z.enum(["search"]).optional(),
+  uses: import_zod13.z.array(exportUseOutput).optional()
+});
 var specWriteReceiptOutput = {
   kind: import_zod13.z.enum(SPEC_KINDS).describe("The spec kind written."),
   id: import_zod13.z.string().describe('The id the spec is stored under; "system" for the L0 singleton.'),
@@ -56037,6 +57520,10 @@ var specWriteReceiptOutput = {
     "Each type position the write normalised: what the input wrote against the canonical spelling stored. Aliases are accepted, never refused, and this list is how an author learns the canonical form. Empty when every position was already canonical."
   ),
   testsToRevisit: testsToRevisitOutput,
+  dryRun: import_zod13.z.boolean().optional().describe("Present, true, on a dry run: every judgement ran and nothing was written."),
+  cascaded: import_zod13.z.array(import_zod13.z.string()).optional().describe(
+    "Each implementation method entry a contract restatement removed with a method it dropped, as `<implementation>.<method>`."
+  ),
   ...staleServerOutput
 };
 function writeReceipt(sentence, receipt) {
@@ -56058,6 +57545,12 @@ var specDeletionOutput = {
   removed: import_zod13.z.array(import_zod13.z.object({ kind: import_zod13.z.string(), id: import_zod13.z.string() })).describe("Every spec the deletion removes (or would), innermost first and the addressed spec last."),
   references: import_zod13.z.array(import_zod13.z.object({ kind: import_zod13.z.string(), id: import_zod13.z.string(), position: import_zod13.z.string(), target: import_zod13.z.object({ kind: import_zod13.z.string(), id: import_zod13.z.string() }) })).describe("Every reference a spec outside the removed set holds to it: why a deletion is refused, or what a forced one left dangling."),
   testsToRevisit: testsToRevisitOutput,
+  published: import_zod13.z.array(exportUseOutput).describe(
+    "Every public name of this project a consumer reaches what the deletion removes through, read before anything goes. Empty when nothing removed is published."
+  ),
+  breaks: import_zod13.z.array(breakingConsumerOutput).optional().describe(
+    "The consumers in reach (family members included, and checkouts in the searched folders) whose specs reach a published name on a member the deletion takes \u2014 the projects it breaks. Absent when none breaks."
+  ),
   ...staleServerOutput
 };
 var specChangeOutput = {
@@ -56090,6 +57583,15 @@ var specChangeReportOutput = {
   strippedKeys: import_zod13.z.array(import_zod13.z.string()).optional().describe(
     "Keys the stored file carries that the level's schema does not know, each as `path: value`, which this write drops (or, on a dry run, would drop). Absent when there are none."
   ),
+  cascaded: import_zod13.z.array(import_zod13.z.string()).optional().describe(
+    "Each implementation method entry removed with a contract method the delta removed, as `<implementation>.<method>` (on a dry run, would be)."
+  ),
+  published: import_zod13.z.array(exportUseOutput).optional().describe(
+    "Every public name a consumer reaches a removed contract method through. Absent when no removed method is published."
+  ),
+  breaks: import_zod13.z.array(breakingConsumerOutput).optional().describe(
+    "The consumers in reach whose specs call a removed method on a published name \u2014 the projects the removal breaks."
+  ),
   ...staleServerOutput
 };
 function statusNetworkLine() {
@@ -56454,6 +57956,8 @@ var SPEC_WRITE_TOOLS = /* @__PURE__ */ new Set([
   "sdd_rename_type",
   "sdd_rename_field",
   "sdd_rename_param",
+  "sdd_rename_spec",
+  "sdd_move_spec",
   "sdd_add_component",
   "sdd_define_interface",
   "sdd_set_endpoints",
@@ -56464,6 +57968,11 @@ var SPEC_WRITE_TOOLS = /* @__PURE__ */ new Set([
   "sdd_move_methods"
 ]);
 var listChangedEmitters = /* @__PURE__ */ new WeakMap();
+function withArgumentNames(description, inputSchema) {
+  const names = Object.entries(inputSchema).map(([name, schema]) => schema.isOptional() ? `${name}?` : name);
+  if (names.length === 0) return description;
+  return `${description.trimEnd()} Arguments: ${names.join(", ")}.`;
+}
 function reg(server, name, config, cb) {
   const guarded2 = (args) => {
     const freshness = assessBuildFreshness(serverBuildStamps.get(server) ?? null);
@@ -56475,7 +57984,7 @@ function reg(server, name, config, cb) {
     if (result.isError !== true && SPEC_WRITE_TOOLS.has(name)) listChangedEmitters.get(server)?.();
     return result;
   };
-  const strictConfig = config.inputSchema ? { ...config, inputSchema: import_zod13.z.object(config.inputSchema).strict() } : config;
+  const strictConfig = config.inputSchema ? { ...config, description: withArgumentNames(config.description, config.inputSchema), inputSchema: import_zod13.z.object(config.inputSchema).strict() } : config;
   server.registerTool(name, strictConfig, guarded2);
 }
 var statusInput = import_zod13.z.enum(STATUS_VALUES).optional().describe(
@@ -56933,7 +58442,7 @@ ${renderChangeReport(report3)}`,
     server,
     "sdd_adopt_member",
     {
-      description: "Make the bound project's external a member \u2014 sdd_detach_member's inverse. Locally the external is found by a path inside the bound project and adopted where it is; on a hosted instance it names a project by source.hosted and `path` says where to adopt it (the hosting server relocates it there). All-or-nothing; dryRun answers the plan and writes nothing. Never locks.",
+      description: "Make the bound project's external a member \u2014 sdd_detach_member's inverse. Locally the external is found by a path inside the bound project or a `../` sibling checkout, and adopted where it is; on a hosted instance it names a project by source.hosted and `path` says where to adopt it (the hosting server relocates it there). All-or-nothing; dryRun answers the plan and writes nothing. Never locks.",
       inputSchema: {
         alias: import_zod13.z.string().describe("The external's alias"),
         path: import_zod13.z.string().optional().describe("Hosted: the member path to adopt a source.hosted external at, relative to the bound project; a source.path external is adopted where it is"),
@@ -56946,7 +58455,7 @@ ${renderChangeReport(report3)}`,
     server,
     "sdd_rename_component",
     {
-      description: "Rename a component and rewrite every reference to it in the bound tree: dependsOn, owns and dispatch entries, lifecycle entrypoints, published interfaces at L1 and L0, narrative call/dispatch/register targets, an interface's component, an implementation's contract and an entity's componentClass. The interface named i<id> and the implementation named <id>_impl move to the new ids and files; interfaces and implementations named otherwise keep their ids. Findings keyed on the component follow it too: every lint allow naming it on an edge site or in a covered unit, and every entry of the debt register (.wai/project.yaml rules.conformance.carried) anchored on a renamed spec or naming the component in its site or units \u2014 rewritten in place, every comment and all other formatting of the register kept, so unchanged debt never reads as paid and new at once. A register that cannot be rewritten that precisely is refused before the first write. Display names are left as they are. Refuses, writing nothing: a component that does not exist (component-missing), one inside a chained subproject (chained-component \u2014 rename it from that project's own root), a new id that is not a lowercase identifier without a namespace separator (invalid-id), and a new id \u2014 or i<newId> or <newId>_impl \u2014 already in use (id-taken). With dryRun it answers what it would move, rewrite, keep and rekey, and writes nothing. Returns the specs moved, each with its old and new id, the ids of the other specs rewritten (lint allows included), and `carried`: each register edit \u2014 the entry by code, spec and site as it stood, the key changed (spec, at or covers), from and to.",
+      description: "Rename a component and rewrite every reference to it in the bound tree: dependsOn, owns and dispatch entries, lifecycle entrypoints, published interfaces at L1 and L0, narrative call/dispatch/register targets, an interface's component, an implementation's contract and an entity's componentClass. The interface named i<id> and the implementation named <id>_impl move to the new ids and files; interfaces and implementations named otherwise keep their ids, and their files follow the component's folder (rename one of those on its own with sdd_rename_spec). Findings keyed on the component follow it too: every lint allow naming it on an edge site or in a covered unit, and every entry of the debt register (.wai/project.yaml rules.conformance.carried) anchored on a renamed spec or naming the component in its site or units \u2014 rewritten in place, every comment and all other formatting of the register kept, so unchanged debt never reads as paid and new at once. A register that cannot be rewritten that precisely is refused before the first write. Display names are left as they are. Refuses, writing nothing: a component that does not exist (component-missing), one inside a chained subproject (chained-component \u2014 rename it from that project's own root), a new id that is not a lowercase identifier without a namespace separator (invalid-id), and a new id \u2014 or i<newId> or <newId>_impl \u2014 already in use (id-taken). With dryRun it answers what it would move, rewrite, keep and rekey, and writes nothing. Returns the specs moved, each with its old and new id, the ids of the other specs rewritten (lint allows included), and `carried`: each register edit \u2014 the entry by code, spec and site as it stood, the key changed (spec, at or covers), from and to.",
       inputSchema: {
         id: import_zod13.z.string().describe("The component to rename (namespaced if needed)"),
         newId: import_zod13.z.string().describe("Its new id: a lowercase identifier with no namespace separator"),
@@ -56980,7 +58489,8 @@ ${renderChangeReport(report3)}`,
         const root = getProjectRoot();
         const consumers = listConsumers3(search?.map((d) => path51.resolve(root, d)));
         const report3 = renameMethod(qualifiedComponentId(id), method2, newName, pinSymbol, dryRun);
-        const breaks = report3.publishedIn.length > 0 ? consumers.filter((c) => consumerReaches(c, report3.publishedIn, method2)).map((c) => narrowedToMember(c, report3.publishedIn, method2)) : [];
+        const published = report3.publishedIn.map((publicName) => ({ publicName, kind: "component", members: [method2] }));
+        const breaks = consumers.map((c) => narrowedToUses(c, published)).filter((c) => c !== null);
         return json({ ...report3, ...breaks.length > 0 ? { breaks } : {} });
       } catch (e) {
         return errText(String(e));
@@ -56991,18 +58501,22 @@ ${renderChangeReport(report3)}`,
     server,
     "sdd_rename_type",
     {
-      description: "Rename a type and rewrite every reference to it in the bound tree: every type position naming it (contract and type-method params and returns, fields, signature-type params and returns), a signatureFrom naming it as a signature type, and an L1 or L0 export entry's typeDef. Only the named members of a type expression that name this type are respelled, in the style they were written (`Invoice` \u2192 `Bill`, `invoice` \u2192 `bill`); the rest of the text stays as written. The type moves to the new id and file under the same owner, and its old id joins its rename trace (previousIds) so a consumer of the design export reads the rename as a rename; an export entry that derived its public name from the old id gets `as: <that name>` first, so the published name and every consumer's pin stay. Rename traces are never rewritten. Findings keyed on the type follow it: lint allows naming it, and every debt-register entry anchored on it, rewritten in place (a register that cannot be rewritten that precisely is refused before the first write). The display name is left as it is. Refuses, writing nothing: a type that does not exist (type-missing), one in another project (chained-type), a new id that is not a lowercase identifier (invalid-id), and a new id another type of the same owner holds (id-taken) or retired (id-retired \u2014 unsetting the holder's previousIds releases it). With dryRun it answers what it would rewrite, keep and rekey, and writes nothing. Returns from and to, the specs rewritten, keptPublicNames and `carried`: each register edit.",
+      description: "Rename a type and rewrite every reference to it in the bound tree: every type position naming it (contract and type-method params and returns, fields, signature-type params and returns), a signatureFrom naming it as a signature type, and an L1 or L0 export entry's typeDef. Only the named members of a type expression that name this type are respelled, in the style they were written (`Invoice` \u2192 `Bill`, `invoice` \u2192 `bill`); the rest of the text stays as written. The type moves to the new id and file under the same owner, and its old id joins its rename trace (previousIds) so a consumer of the design export reads the rename as a rename; an export entry that derived its public name from the old id gets `as: <that name>` first, so the published name and every consumer's pin stay. Rename traces are never rewritten. Findings keyed on the type follow it: lint allows naming it, and every debt-register entry anchored on it, rewritten in place (a register that cannot be rewritten that precisely is refused before the first write). The display name is left as it is. Refuses, writing nothing: a type that does not exist (type-missing), one in another project (chained-type), a new id that is not a lowercase identifier (invalid-id), and a new id another type of the same owner holds (id-taken) or retired (id-retired \u2014 unsetting the holder's previousIds releases it). With dryRun it answers what it would rewrite, keep and rekey, and writes nothing. Returns from and to, the specs rewritten, keptPublicNames, `carried`: each register edit, `publishedIn` \u2014 every public name a consumer reaches the type through (an exported type that is or embeds it, member `type`; an exported contract whose methods name one in their signature closure, those methods) \u2014 and `breaks`: the consumers in reach (family members included, and checkouts in the `search` folders) whose specs reach one of those, a contract they depend on as a whole included, narrowed to what carries the type \u2014 as sdd_rename_field and sdd_rename_param name theirs.",
       inputSchema: {
         id: import_zod13.z.string().describe("The type to rename (qualified by its owning subsystem if needed, `subsystem::id`)"),
         newId: import_zod13.z.string().describe("Its new id: a lowercase identifier with no namespace separator"),
-        dryRun: import_zod13.z.boolean().optional().describe("Answer what the rename would do \u2014 refused exactly as the real rename would be \u2014 and write nothing")
+        dryRun: import_zod13.z.boolean().optional().describe("Answer what the rename would do \u2014 refused exactly as the real rename would be \u2014 and write nothing"),
+        search: import_zod13.z.array(import_zod13.z.string()).optional().describe("Folders to scan for consumer checkouts outside the family (e.g. the folder holding sibling checkouts), relative to the bound project root or absolute")
       }
     },
-    ({ id, newId, dryRun }) => {
+    ({ id, newId, dryRun, search }) => {
       try {
         const bare2 = id.startsWith("::") ? id.slice(2) : id;
         const resolved = loadTypeSpec(bare2) ? bare2 : id;
-        return json(renameType(resolved, newId, dryRun));
+        const consumers = listConsumers3(search?.map((d) => path51.resolve(getProjectRoot(), d)));
+        const report3 = renameType(resolved, newId, dryRun);
+        const breaks = consumers.map((c) => narrowedToUses(c, report3.publishedIn)).filter((c) => c !== null);
+        return json({ ...report3, ...breaks.length > 0 ? { breaks } : {} });
       } catch (e) {
         return errText(String(e));
       }
@@ -57083,6 +58597,46 @@ ${renderChangeReport(report3)}`,
       }
     }
   );
+  reg(
+    server,
+    "sdd_rename_spec",
+    {
+      description: "Rename ONE contract (kind interface) or ONE implementation on its own \u2014 the ids sdd_rename_component keeps when they are not derived from the component's (i<id>, <id>_impl) \u2014 and rewrite every reference to it in the bound tree: every implementation's contract and every L1 and L0 export entry's interface (an entry whose public name derived from the old id gets `as: <that name>` first, so the published surface and every consumer's pin stay), lint allows and debt-register entries keyed on it. The spec moves to its new id and file beside its owner, its old id in its rename trace (previousIds). Refuses, writing nothing: another kind (invalid-kind, naming the tool that renames it), a spec that does not exist (spec-missing) or lives in another project (chained-spec), a new id outside the grammar \u2014 a contract id begins with i \u2014 (invalid-id), and one taken or retired (id-taken, id-retired). With dryRun it answers what it would move, rewrite and keep, and writes nothing.",
+      inputSchema: {
+        kind: import_zod13.z.enum(["interface", "implementation"]).describe("interface (a contract) or implementation"),
+        id: import_zod13.z.string().describe("The spec to rename"),
+        newId: import_zod13.z.string().describe("Its new id: a lowercase identifier with no namespace separator (a contract's begins with i)"),
+        dryRun: import_zod13.z.boolean().optional().describe("Answer what the rename would do \u2014 refused exactly as the real rename would be \u2014 and write nothing")
+      }
+    },
+    ({ kind, id, newId, dryRun }) => {
+      try {
+        return json(renameSpecId(kind, id, newId, dryRun));
+      } catch (e) {
+        return errText(String(e));
+      }
+    }
+  );
+  reg(
+    server,
+    "sdd_move_spec",
+    {
+      description: "Move a component or a type to another subsystem of the bound project with everything that follows it. A component takes the members it owns, its contracts and their implementations (their files move to the new subsystem's folder in the nested layout); ids never change, so references by id stay, and what names the OLD subsystem follows: its export entries and lifecycle entrypoints for the moved components, and an L0 re-export from it. A type takes its file, its L1 export entries and every reference qualified by the old subsystem (`old::type` becomes `new::type`); omit subsystem to make a type system-level. Gated like every write: a move that would create a forbidden doctrine edge, or a cross-subsystem edge into a non-Portal, is refused with the rule's own words, and a curable boundary finding (a direct cross-subsystem edge into a Portal, which a client Adapter or a trustedLink would license) is named among the notices. Refuses, writing nothing: a kind other than component or type, a spec that does not exist or lives in another project, a subsystem the bound tree does not have or the one it already lives in, a component a pattern owns (move its owner), a type id the target already holds. With dryRun it answers the plan and the notices, and writes nothing.",
+      inputSchema: {
+        kind: import_zod13.z.enum(["component", "type"]).describe("component or type"),
+        id: import_zod13.z.string().describe("The spec to move (a type by its bare id, or as <subsystem>::<id>)"),
+        subsystem: import_zod13.z.string().optional().describe("The subsystem it moves to; omitted for a type made system-level"),
+        dryRun: import_zod13.z.boolean().optional().describe("Answer what the move would do \u2014 refused exactly as the move would be \u2014 and write nothing")
+      }
+    },
+    ({ kind, id, subsystem, dryRun }) => {
+      try {
+        return json(moveSpec2(kind, id, subsystem, dryRun));
+      } catch (e) {
+        return errText(String(e));
+      }
+    }
+  );
   const componentInput = {
     id: import_zod13.z.string().describe("Lowercase identifier for the component"),
     name: import_zod13.z.string().describe("Human-readable display name"),
@@ -57254,7 +58808,7 @@ ${renderChangeReport(report3)}`,
     server,
     "sdd_set_endpoints",
     {
-      description: "Bind concrete wire endpoints to existing L3 interface methods, for a Portal whose transport requires them (every transport but InProcess and Custom). Pick the Portal's own `transport` and fill that transport's address fields. A binding for an InProcess Portal is refused: its verbs are its contract methods. Run after sdd_define_interface. Written through the authoring seam as one gated delta, and answered with the change report \u2014 every binding set or changed, or that nothing changed \u2014 as structured content beside the sentence.",
+      description: "Bind concrete wire endpoints to existing L3 interface methods, for a Portal whose transport requires them (every transport but InProcess and Custom). Pick the Portal's own `transport` and fill that transport's address fields \u2014 for HTTP the verb, the path and, optionally, the success `status` (a 2xx or 3xx code: 202 Accepted, a redirect, a 201 for a workflow verb) the operation answers with, which the OpenAPI export uses in place of its convention. A binding for an InProcess Portal is refused: its verbs are its contract methods. Run after sdd_define_interface. Written through the authoring seam as one gated delta, and answered with the change report \u2014 every binding set or changed, or that nothing changed \u2014 as structured content beside the sentence.",
       inputSchema: {
         interface: import_zod13.z.string().describe('The L3 interface ID (e.g. "ibilling-gateway")'),
         endpoints: import_zod13.z.array(import_zod13.z.object({
@@ -57262,6 +58816,7 @@ ${renderChangeReport(report3)}`,
           transport: import_zod13.z.enum(["HTTP", "HTTP_API", "gRPC", "GraphQL", "MessageBus", "NamedPipe", "IPC", "CLI", "JSONRPC", "Custom"]).describe("Wire protocol; must be the Portal's own transport. The retired spelling HTTP_API is still read as HTTP for one release; any other transport is refused, naming the Portal's"),
           httpMethod: import_zod13.z.enum(["GET", "POST", "PUT", "DELETE", "PATCH", "OPTIONS", "HEAD"]).optional().describe("HTTP: verb"),
           path: import_zod13.z.string().optional().describe('HTTP: route path, e.g. "/v1/checkout"'),
+          status: import_zod13.z.number().int().min(200).max(399).optional().describe("HTTP: the success status the operation answers with when it is not the verb's convention \u2014 202 Accepted, a 3xx redirect, a 201 for a workflow verb that files something. The OpenAPI export uses it; omitted, the export answers 204 for a method returning nothing, 201 for a POST that creates, else 200"),
           service: import_zod13.z.string().optional().describe("gRPC: service name"),
           rpcMethod: import_zod13.z.string().optional().describe("gRPC: rpc method name"),
           operation: import_zod13.z.enum(["query", "mutation", "subscription"]).optional().describe("GraphQL: operation kind"),
@@ -57275,11 +58830,12 @@ ${renderChangeReport(report3)}`,
           command: import_zod13.z.string().optional().describe("CLI: command/subcommand"),
           jsonRpcMethod: import_zod13.z.string().optional().describe("JSONRPC: the JSON-RPC method name"),
           address: import_zod13.z.string().optional().describe("Custom: free-form address")
-        }).strict()).describe("One binding per method")
+        }).strict()).describe("One binding per method"),
+        dryRun: import_zod13.z.boolean().optional().describe("Answer the change report the binding would give \u2014 the gate (a route another method binds is refused) and the writer's parse included \u2014 and write nothing")
       },
       outputSchema: specChangeReportOutput
     },
-    ({ interface: interfaceId, endpoints }) => {
+    ({ interface: interfaceId, endpoints, dryRun }) => {
       try {
         const intf = loadInterfaceSpec(interfaceId);
         if (!intf) return errText(`Interface "${interfaceId}" does not exist.`);
@@ -57291,7 +58847,7 @@ ${renderChangeReport(report3)}`,
         const buildRaw = (e, transport) => {
           switch (transport) {
             case "HTTP":
-              return { transport: "HTTP", method: e.httpMethod, path: e.path };
+              return { transport: "HTTP", method: e.httpMethod, path: e.path, ...e.status !== void 0 ? { status: e.status } : {} };
             case "gRPC":
               return { transport: "gRPC", service: e.service, method: e.rpcMethod };
             case "GraphQL":
@@ -57329,9 +58885,9 @@ ${renderChangeReport(report3)}`,
           methods.push({ name: e.method, endpoint: parsed.data });
           bound2.push(`${e.method}\u2192${transport}`);
         }
-        const report3 = updateSpecGated("interface", interfaceId, { methods });
+        const report3 = updateSpecGated("interface", interfaceId, { methods }, dryRun);
         return structured(
-          `Bound ${bound2.length} endpoint(s) on "${interfaceId}": ${bound2.join(", ")}.
+          `${dryRun ? "Would bind" : "Bound"} ${bound2.length} endpoint(s) on "${interfaceId}": ${bound2.join(", ")}.
 ${renderChangeReport(report3)}`,
           report3
         );
@@ -57401,7 +58957,7 @@ ${renderChangeReport(report3)}`,
     bindings: import_zod13.z.array(import_zod13.z.string()).optional().describe("Optional code linkage: the hand-written binding modules (project-relative; N:1 sharing allowed) through which this realization reaches another project's code \u2014 a typed binding to a native library, a client stub. Outside the approval, like sourcePath. Validate compares each with the pinned snapshots of the externals this component reaches (function and method names, parameter names and arity, type field names) and reports a name the pin renamed or no longer exports (BINDING_DRIFT)"),
     router: import_zod13.z.string().min(1).optional().describe("Portal-only code linkage: the router entry this Portal's own file exports, through which whatever process serves the Portal hands it its requests (replaces the retired listener mount's `via`). Route coverage reads the routes out of it and export conformance holds the file to it. Outside the approval, like sourcePath"),
     technologies: import_zod13.z.array(import_zod13.z.union([import_zod13.z.string(), import_zod13.z.object({ name: import_zod13.z.string(), matches: import_zod13.z.array(import_zod13.z.string()).min(1).describe("The tokens the leakage and contract checks match INSTEAD of the name \u2014 for a technology whose name is also an ordinary word of the tree (the yaml package, the YAML format)") }).strict()])).optional().describe(`External technologies this implementation binds to (e.g. ["mysql"], or [{ "name": "yaml", "matches": ["yaml package", "parseDocument"] }] when the bare name would match a common word) \u2014 declares this component's ownership tree as the technology's home; references outside it are flagged (TECH_LEAKAGE) and contract identifiers must stay intent-language. Only for Adapter/Store/Registry/Index components, and an Observer bound to a messaging technology.`),
-    injectedParams: import_zod13.z.array(import_zod13.z.string()).optional().describe("The parameter names this realization takes BEFORE the ones its contract declares \u2014 a config object, a data root, the transport handles a portal is handed. Supplied by whatever wires the component up, never by the caller the contract describes, which is why they belong here and not to the contract: another realization may hold them as fields instead. Declared rather than guessed, because a leading parameter the contract does not name cannot be told from one it named under a different name (`seed(config)` realized as `bootstrapInstance(cfg)`); a leading parameter this list does not name is reported (UNDECLARED_PARAM). Only a LEADING run is dropped \u2014 one of these names appearing after the contract's own parameters is an argument in the middle of the caller's list, not wiring"),
+    injectedParams: import_zod13.z.array(import_zod13.z.string()).optional().describe("The parameter names this realization takes BEFORE the ones its contract declares \u2014 a config object, a data root, the transport handles a portal is handed. Supplied by whatever wires the component up, never by the caller the contract describes, which is why they belong here and not to the contract: another realization may hold them as fields instead. Declared rather than guessed, because a leading parameter the contract does not name cannot be told from one it named under a different name (`seed(config)` realized as `bootstrapInstance(cfg)`); a leading parameter this list does not name is reported (UNDECLARED_PARAM). A name matches with or without a leading `_` (`ctx` names `_ctx`). A LEADING run of these names is dropped, and so is a TRAILING run of names the contract does not declare (a handler's `res` after the contract's own parameters); one appearing in the middle of the contract's parameters is an argument of the caller's list, not wiring"),
     detail: detailEnum.optional().describe("Spec-level narrative detail default for all methods"),
     conformance: conformanceEnum.optional().describe("Spec-level conformance tier default: declared | anchored | off (omitted = stereotype default: Portal \u2192 anchored, else declared)"),
     methods: import_zod13.z.array(import_zod13.z.object(implMethodShape).strict()).optional().describe("Method implementations containing L5 narratives"),
@@ -57412,7 +58968,7 @@ ${renderChangeReport(report3)}`,
     server,
     "sdd_write_narrative",
     {
-      description: "Write L4 Concrete Implementation spec containing L5 method narratives. Narratives are a FLAT ordered step list; flow steps (branch/switch/loop/try/parallel/jump/return/throw) jump by step number \u2014 blocks are just skipped regions. Steps may declare a `label` anchor, and every jump field has a *Label twin (toLabel, onTrueLabel, endLabel, \u2026) resolved to step numbers at write time \u2014 prefer labels over hand-counted numbers; an unresolvable label rejects the write. Detail dial per method: full (narrative required) | calls-only (call choreography suffices) | intent (prose instead of steps); omitted = stereotype default (Portal/Observer/Adapter: calls-only, Store/Index/Registry: intent, else full). A method whose narrative shows no steps declares the calls it makes in `calls` (one \"<component>.<method>\" each): the reachability walk takes exactly those edges and no others, so an intent-level method that reaches a collaborator must name it or that collaborator is reported unused. Conformance dial per method or spec: declared | anchored | off \u2014 how strictly structural conformance requires contract methods to be realized in their source file (omitted = Portal: anchored, else declared). A method whose body lives in its own file names it in the method's sourcePath; the implementation's sourcePath is the default for every method that names none. Parameters the realization takes BEFORE its contract's own \u2014 a config object, a data root, a portal's transport handles \u2014 are wiring, and are declared once for the spec in injectedParams; a leading parameter it does not name is reported against the contract (UNDECLARED_PARAM). Re-authoring an existing id REPLACES the method list: a method left out of the input is REMOVED together with its narrative (and reported); spec-level lint/ext are carried forward, and the stored status is kept unless this input states a higher one. The answer carries a write receipt as structured content beside the sentence \u2014 the status written, whether a spec already held the id, and the notices a restatement raised, each as its own entry.",
+      description: "Write L4 Concrete Implementation spec containing L5 method narratives. Narratives are a FLAT ordered step list; flow steps (branch/switch/loop/try/parallel/jump/return/throw) jump by step number \u2014 blocks are just skipped regions. Steps may declare a `label` anchor, and every jump field has a *Label twin (toLabel, onTrueLabel, endLabel, \u2026) resolved to step numbers at write time \u2014 prefer labels over hand-counted numbers; an unresolvable label rejects the write. Detail dial per method: full (narrative required) | calls-only (call choreography suffices) | intent (prose instead of steps); omitted = stereotype default (Portal/Observer/Adapter: calls-only, Store/Index/Registry: intent, else full). A method whose narrative shows no steps declares the calls it makes in `calls` (one \"<component>.<method>\" each): the reachability walk takes exactly those edges and no others, so an intent-level method that reaches a collaborator must name it or that collaborator is reported unused. Conformance dial per method or spec: declared | anchored | off \u2014 how strictly structural conformance requires contract methods to be realized in their source file (omitted = Portal: anchored, else declared). A method whose body lives in its own file names it in the method's sourcePath; the implementation's sourcePath is the default for every method that names none. Parameters the realization takes BEFORE its contract's own \u2014 a config object, a data root, a portal's transport handles \u2014 or after them (a handler's response handle), are wiring, and are declared once for the spec in injectedParams (matched with or without a leading `_`); a leading or trailing parameter it does not name is reported against the contract (UNDECLARED_PARAM). Re-authoring an existing id REPLACES the method list: a method left out of the input is REMOVED together with its narrative (and reported); spec-level lint/ext are carried forward, and the stored status is kept unless this input states a higher one. The answer carries a write receipt as structured content beside the sentence \u2014 the status written, whether a spec already held the id, and the notices a restatement raised, each as its own entry.",
       inputSchema: implInput,
       outputSchema: specWriteReceiptOutput
     },
@@ -57500,10 +59056,10 @@ ${renderChangeReport(report3)}`,
     "sdd_add_type",
     {
       description: "Define a type: an entity or value-object (the data components operate on), a signature \u2014 a named function type \u2014 or an enum: a closed, ordered set of named `values` ({name, description?}, unique by name ignoring case and separators; the name is also the value as data carries it), with optional pure methods and nothing else (no fields, params or returns). A value-object may instead be a NAMED SCALAR: it `holds` one primitive in place of fields (a newtype or type alias in every language). Every type position (a field's type, a method's params and returns, a signature's params and returns, a named scalar's holds) is written in the neutral type grammar; aliases are respelled and listed in the receipt. Entities are owned by a subsystem; shared value objects and signatures omit subsystem (system-level). Fields are data; methods are PURE intrinsic behaviour only \u2014 anything needing a collaborator belongs on a component, taking the entity as an argument \u2014 and a type method may carry structured params, which then derive its signature text as a contract method's do. A signature carries top-level params and returns and nothing else (no fields, methods or invariants \u2014 SIGNATURE_TYPE_MEMBERS); a contract method takes it by naming it as its signatureFrom, and a param may be typed by one (a callback). A type may also CLAIM code: sourcePath names the file holding its declaration (and each method may name its own), symbol binds the code-level name when it differs \u2014 the file must then resolve and the declaration must be anchored in it. An owning subsystem the tree does not have is refused, writing nothing, exactly as a component under an unknown subsystem is. Re-defining an existing id REPLACES fields/methods/invariants and restates sourcePath/symbol (an omitted list or path is CLEARED, and a dropped member is reported); lint/ext are carried forward. The answer carries a write receipt as structured content beside the sentence \u2014 whether a spec already held the id, and the notices a restatement raised, each as its own entry. A type carries no lifecycle status, so the receipt states none.",
-      inputSchema: typeInput,
+      inputSchema: { ...typeInput, dryRun: import_zod13.z.boolean().optional().describe("Answer the receipt the write would give \u2014 every judgement run, a refusal exactly as the write would give it \u2014 and write nothing") },
       outputSchema: specWriteReceiptOutput
     },
-    ({ kind, id, name, description, subsystem, group, fields, methods, componentClass, invariants, database, table, linkedEntity, sourcePath, symbol, params, returns, values, holds }) => {
+    ({ kind, id, name, description, subsystem, group, fields, methods, componentClass, invariants, database, table, linkedEntity, sourcePath, symbol, params, returns, values, holds, dryRun }) => {
       try {
         const spec = {
           kind,
@@ -57533,9 +59089,9 @@ ${renderChangeReport(report3)}`,
           ...values ? { values } : {},
           ...holds ? { holds } : {}
         };
-        const receipt = writeSpec({ kind: "type", spec, fields: typeInputFields });
+        const receipt = writeSpec({ kind: "type", spec, fields: typeInputFields, ...dryRun ? { dryRun: true } : {} });
         return writeReceipt(
-          `Successfully ${receipt.replacedExisting ? "re-authored" : "defined"} ${kind} type "${name}" (${id}).`,
+          `${dryRun ? "DRY RUN \u2014 nothing was written. Would have " : "Successfully "}${receipt.replacedExisting ? "re-authored" : "defined"} ${kind} type "${name}" (${id}).`,
           receipt
         );
       } catch (e) {
@@ -57693,20 +59249,23 @@ ${renderChangeReport(report3)}`,
     server,
     "sdd_delete_spec",
     {
-      description: "Delete a spec and everything it contains \u2014 a contract with its implementations, a component with its contracts and owned members, a subsystem with its components and types \u2014 pruning the folders left empty. Refused, naming every reference, while a spec that stays still references what would go (the invalid references the deletion would introduce); force: true deletes anyway and leaves them for validate to report. dryRun answers the same plan and removes nothing. The structured answer lists every spec removed, every reference, and the tests that encode a removed method (when the project declares test roots).",
+      description: "Delete a spec and everything it contains \u2014 a contract with its implementations, a component with its contracts and owned members, a subsystem with its components and types \u2014 pruning the folders left empty. Refused, naming every reference, while a spec that stays still references what would go (the invalid references the deletion would introduce); force: true deletes anyway and leaves them for validate to report. Refused outright, the dry run included: a spec of another project (a member's spec read through this tree, `alias::name`, is deleted from that member's own root \u2014 the refusal names its folder), an id no spec of the kind holds (the refusal names what it might have meant: another kind holding it, the `<subsystem>::<id>` form of a type, the ids the kind holds), and the L0. dryRun answers the same plan and removes nothing. Like a rename, it reports `published` \u2014 every public name of this project a consumer reaches what goes through \u2014 and `breaks`: the consumers in reach (family members included, and checkouts in the `search` folders) whose specs reach one of those. The structured answer lists every spec removed, every reference, the published names, the consumers it breaks, and the tests that encode a removed method (when the project declares test roots).",
       inputSchema: {
         kind: import_zod13.z.enum(["subsystem", "component", "interface", "implementation", "type"]).describe("The kind of spec to delete"),
         id: import_zod13.z.string().describe("The ID of the spec to delete"),
         dryRun: import_zod13.z.boolean().optional().describe("Answer with the plan \u2014 every spec that would be removed, every reference that would be left \u2014 and remove nothing"),
-        force: import_zod13.z.boolean().optional().describe("Delete even though specs that stay still reference what goes, leaving those references for validate to report. Without it such a deletion is refused")
+        force: import_zod13.z.boolean().optional().describe("Delete even though specs that stay still reference what goes, leaving those references for validate to report. Without it such a deletion is refused"),
+        search: import_zod13.z.array(import_zod13.z.string()).optional().describe("Folders to scan for consumer checkouts outside the family (e.g. the folder holding sibling checkouts), relative to the bound project root or absolute")
       },
       outputSchema: specDeletionOutput
     },
-    ({ kind, id, dryRun, force }) => {
+    ({ kind, id, dryRun, force, search }) => {
       try {
+        const consumers = listConsumers3(search?.map((d) => path51.resolve(getProjectRoot(), d)));
         const deletion = deleteSpec2(kind, id, dryRun, force);
-        if (deletion.removed.length === 0) return errText(`Spec of kind "${kind}" with ID "${id}" could not be deleted (file may not exist).`);
-        return structured(renderDeletion(deletion), deletion);
+        const breaks = consumers.map((c) => narrowedToUses(c, deletion.published)).filter((c) => c !== null);
+        const answer = breaks.length > 0 ? { ...deletion, breaks } : deletion;
+        return structured(renderDeletion(answer), answer);
       } catch (e) {
         return errText(String(e));
       }
@@ -57721,13 +59280,18 @@ ${renderChangeReport(report3)}`,
         kind: import_zod13.z.enum(["system", "subsystem", "component", "interface", "implementation", "type"]).describe("The spec kind to update (system = the singleton L0 \u2014 vision, boundaries, globalRequirements, databases, and publicInterfaces: the project export table, each entry a re-export {from, component, interface, typeDef, as, name, type, details, audience: project|department|instance|partner|external} \u2014 from alone re-exports everything a subsystem exports, and a legacy {id, subsystem} reads as {as, from})"),
         id: import_zod13.z.string().describe("The ID of the spec to update (namespaced if needed)"),
         delta: import_zod13.z.record(import_zod13.z.any()).describe(`The fields to merge. LISTS UPSERT by identity at every depth: naming one element leaves the others, and a named element merges field by field \u2014 a field left out, or null, keeps its stored value (a method named without "narrative" keeps its steps). Identity is name or id by default; dispatch by capability, lifecycle by phase+component+method, emits/subscribesTo by topic+event, trustedLinks by subsystem, publicInterfaces by component+interface (a re-export by from+item+interface+as), lint.allow by code+at, findings by code, boundaries by name, globalRequirements by description, cases by value, catches by error. Plain-value lists (owns, dependsOn, guarantees, technologies, requirements written as text) append what they lack and keep what they hold. Restating a list with exactly its stored elements in another order REORDERS it. Remove an element with "action": "delete" (or "remove": true) beside its identity, a plain value as {"value": \u2026, "action": "delete"}; [] clears a list; {"unset": ["basePath"]} removes an optional field (null means no change). NARRATIVE steps are addressed by stepNumber, applied in ascending order against the numbering earlier entries of the same delta left: "action": "insert" shifts later steps up, "delete" shifts them down \u2014 refused when a jump still targets the step, when a restated label or description does not match it, or for a loop/try/parallel header whose body stands. Stored jumps relocate; a jump the delta writes names the final numbering; "captureJumps": true on an insert lands entry jumps on the new step. Every jump field has a *Label twin (toLabel, onFalseLabel, endLabel, a case or catch "label") resolved after the merge. Retyping a step rebuilds it for its new type and names the fields dropped. lint: {"allow": [{code, at, covers, reason}]} silences a warning or notice on this spec: "at" is the site the finding reports and is required when it reports one, "covers" lists an aggregating finding's units; errors never silence. Local ids are qualified as the loader qualifies them. A key that is not a field at its depth is named back under NO EFFECT: read that list.`),
-        dryRun: import_zod13.z.boolean().optional().describe("Ask what this delta WOULD do: the whole write runs \u2014 the gate and the writer's parse included \u2014 and answers the report it would produce, marked DRY RUN, with not one byte written.")
+        dryRun: import_zod13.z.boolean().optional().describe("Ask what this delta WOULD do: the whole write runs \u2014 the gate and the writer's parse included \u2014 and answers the report it would produce, marked DRY RUN, with not one byte written."),
+        search: import_zod13.z.array(import_zod13.z.string()).optional().describe("Folders to scan for consumer checkouts outside the family, read when the delta removes contract methods: the removal names the consumers it breaks, as a rename does")
       },
       outputSchema: specChangeReportOutput
     },
-    ({ kind, id, delta, dryRun }) => {
+    ({ kind, id, delta, dryRun, search }) => {
       try {
+        const removes = kind === "interface" && delta && typeof delta === "object" && (Array.isArray(delta.methods) && (delta.methods.length === 0 || delta.methods.some((m) => m?.action === "delete" || m?.remove === true)) || Array.isArray(delta.unset) && delta.unset.includes("methods"));
+        const consumers = removes ? listConsumers3(search?.map((d) => path51.resolve(getProjectRoot(), d))) : [];
         const report3 = updateSpecGated(kind, id, delta, dryRun);
+        const breaks = report3.published ? consumers.map((c) => narrowedToUses(c, report3.published)).filter((c) => c !== null) : [];
+        if (breaks.length > 0) report3.breaks = breaks;
         return structured(renderChangeReport(report3), report3);
       } catch (e) {
         return errText(String(e));
@@ -58289,6 +59853,7 @@ function loadProjectConfig3() {
   createEmptyTopologyConfig,
   createMember,
   createProjectConfig,
+  crossProjectWriteRefusal,
   currentRootBinding,
   declareExternal,
   declareMember,
@@ -58458,6 +60023,7 @@ function loadProjectConfig3() {
   moveMember,
   moveMethods,
   moveMountToMembers,
+  moveSpec,
   nameKey,
   namesAnInteger,
   narrativeStepForeignFields,
@@ -58487,6 +60053,7 @@ function loadProjectConfig3() {
   projectIdentity,
   promoteMember,
   provisionProject,
+  publishedUsesOf,
   qualifiedTypeId,
   rangeProblem,
   readCodeAnnotation,
@@ -58516,6 +60083,7 @@ function loadProjectConfig3() {
   renameId,
   renameMethod,
   renameParam,
+  renameSpecId,
   renameType,
   renderDiagram,
   repairForeignStepFields,
@@ -58545,6 +60113,7 @@ function loadProjectConfig3() {
   retiredReachFacts,
   returnTypeOf,
   rewriteReferences,
+  routerLinkage,
   runWithHostedLookup,
   runWithProjectBinding,
   runWithProjectRoot,
@@ -58565,6 +60134,7 @@ function loadProjectConfig3() {
   settledSpecPaths,
   signatureFacts,
   signatureTypeRefs,
+  specIndexMethodReferences,
   specIndexReferencesTo,
   specIndexRetiredBy,
   specIndexSubtreeOf,