@wairon/cli 5.1.1-dev.113 → 5.1.1-dev.114

package/dist/index.js

@@ -3059,7 +3059,7 @@ var require_dist = __commonJS({
     function slug(name) {
       return name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
     }
-    var fs33 = __toESM2(require("fs"));
+    var fs34 = __toESM2(require("fs"));
     var path52 = __toESM2(require("path"));
     var import_fflate = require_node();
     var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git", ".hg", ".svn"]);
@@ -3099,8 +3099,8 @@ var require_dist = __commonJS({
     function writeTree(destDir, files) {
       for (const file of files) {
         const absolute = path52.join(destDir, file.path);
-        fs33.mkdirSync(path52.dirname(absolute), { recursive: true });
-        fs33.writeFileSync(absolute, file.contents);
+        fs34.mkdirSync(path52.dirname(absolute), { recursive: true });
+        fs34.writeFileSync(absolute, file.contents);
       }
     }
     function classifyKind(name, symlinks) {
@@ -3109,14 +3109,14 @@ var require_dist = __commonJS({
       return "file";
     }
     function walkPackDir(root, current2, out) {
-      for (const entry of fs33.readdirSync(current2, { withFileTypes: true })) {
+      for (const entry of fs34.readdirSync(current2, { withFileTypes: true })) {
         if (entry.isDirectory()) {
           if (SKIP_DIRS.has(entry.name)) continue;
           walkPackDir(root, path52.join(current2, entry.name), out);
         } else if (entry.isFile()) {
           const absolute = path52.join(current2, entry.name);
           const relative27 = path52.relative(root, absolute).split(path52.sep).join("/");
-          out.push({ path: relative27, contents: fs33.readFileSync(absolute) });
+          out.push({ path: relative27, contents: fs34.readFileSync(absolute) });
         }
       }
     }
@@ -3792,6 +3792,7 @@ __export(src_exports, {
   localApprover: () => localApprover,
   localGuideFilePath: () => localGuideFilePath,
   localTypesOf: () => localTypesOf,
+  lockTree: () => lockTree2,
   logger: () => logger,
   makeScopeFilter: () => makeScopeFilter,
   markSelectionsBundled: () => markSelectionsBundled,
@@ -3801,6 +3802,7 @@ __export(src_exports, {
   memberDeclarationOf: () => memberDeclarationOf,
   memberDigest: () => memberDigest,
   memberLocationOf: () => memberLocationOf,
+  memberRevisions: () => memberRevisions,
   memberTypesOf: () => memberTypesOf,
   methodCasingFor: () => methodCasingFor,
   methodGenericParameters: () => methodGenericParameters,
@@ -3849,6 +3851,7 @@ __export(src_exports, {
   readJsonFile: () => readJsonFile,
   readLockRecord: () => readLockRecord,
   readLockState: () => readLockState,
+  readPinnedSpec: () => readPinnedSpec,
   readRetiredReachForms: () => readRetiredReachForms,
   readStampVersion: () => readStampVersion,
   readYamlFile: () => readYamlFile,
@@ -3957,6 +3960,7 @@ __export(src_exports, {
   typeSourceFiles: () => typeSourceFiles,
   typeSpellingFacts: () => typeSpellingFacts,
   uninstallPack: () => uninstallPack,
+  unlockTree: () => unlockTree2,
   updateMember: () => updateMember,
   updateSpec: () => updateSpec,
   upsertPackSelection: () => upsertPackSelection,
@@ -4324,7 +4328,7 @@ function defaultTargetConfig(type) {
     enabled: true
   };
 }
-var WAIRON_VERSION = "5.1.1-dev.113";
+var WAIRON_VERSION = "5.1.1-dev.114";
 var GITHUB_REPO = "SYW-Apps/Waffle-AIron";
 var ARCHITECT_AGENT_ID = "agent-architect";
 var ARCHITECT_TEMPLATE_ID = "architect";
@@ -4570,6 +4574,13 @@ function lastCommitOf(directory, pathspec) {
     return null;
   }
 }
+function commitIntroducing(directory, pathspec, text3) {
+  try {
+    return git(["log", "--reverse", "--format=%H", `-S${text3}`, "--", pathspec], directory).split(/\r?\n/).find((l) => l.trim() !== "")?.trim() ?? null;
+  } catch {
+    return null;
+  }
+}
 function commitOf(directory, ref) {
   try {
     return git(["rev-parse", "--verify", "--quiet", `${ref}^{commit}`], directory).trim() || null;
@@ -10344,6 +10355,101 @@ function removeSpecFile(specPath, specsRoot) {
   pruneEmptyDirs(path10.dirname(specPath), path10.resolve(specsRoot));
   return true;
 }
+var LOCK_FILE = ".spec-write.lock";
+var LOCK_STALE_MS = 6e4;
+var LOCK_WAIT_MS = 3e4;
+var lockHolds = /* @__PURE__ */ new Map();
+function sleepSync(ms) {
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+function processAlive(pid) {
+  if (!Number.isInteger(pid) || pid <= 0) return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (e) {
+    return e.code === "EPERM";
+  }
+}
+function lockHolder(file) {
+  try {
+    const [pid, at] = fs6.readFileSync(file, "utf8").split("\n");
+    if (!/^\d+$/.test(pid ?? "") || !/^\d+$/.test(at ?? "")) return null;
+    return { pid: Number(pid), at: Number(at) };
+  } catch {
+    return null;
+  }
+}
+function lockTree(root) {
+  const dir = path10.join(root, ".wai");
+  if (!fs6.existsSync(dir)) return;
+  const file = path10.join(dir, LOCK_FILE);
+  const held = lockHolds.get(file) ?? 0;
+  if (held > 0) {
+    lockHolds.set(file, held + 1);
+    return;
+  }
+  const deadline = Date.now() + LOCK_WAIT_MS;
+  while (!tryCreateLock(file)) {
+    if (breakStaleLock(file)) continue;
+    if (Date.now() > deadline) {
+      throw new Error(
+        `spec-tree-locked: another session (process ${lockHolder(file)?.pid ?? "unknown"}) has been writing this project's specs for over ${LOCK_WAIT_MS / 1e3}s (${file}). Nothing was written. Try again once it finishes; a lock left by a process that is gone is broken automatically.`
+      );
+    }
+    sleepSync(15 + Math.floor(Math.random() * 20));
+  }
+  lockHolds.set(file, 1);
+}
+function lockAge(file) {
+  try {
+    return Date.now() - fs6.statSync(file).mtimeMs;
+  } catch {
+    return 0;
+  }
+}
+function tryCreateLock(file) {
+  let fd;
+  try {
+    fd = fs6.openSync(file, "wx");
+  } catch (e) {
+    if (e.code === "EEXIST") return false;
+    throw e;
+  }
+  try {
+    fs6.writeSync(fd, `${process.pid}
+${Date.now()}
+`);
+  } finally {
+    fs6.closeSync(fd);
+  }
+  return true;
+}
+function breakStaleLock(file) {
+  const holder = lockHolder(file);
+  const stale = holder === null ? lockAge(file) > LOCK_STALE_MS : holder.pid === process.pid || !processAlive(holder.pid) || Date.now() - holder.at > LOCK_STALE_MS;
+  if (!stale) return false;
+  try {
+    fs6.unlinkSync(file);
+  } catch {
+  }
+  return true;
+}
+function unlockTree(root) {
+  const file = path10.join(root, ".wai", LOCK_FILE);
+  const held = lockHolds.get(file) ?? 0;
+  if (held <= 0) return;
+  if (held > 1) {
+    lockHolds.set(file, held - 1);
+    return;
+  }
+  lockHolds.delete(file);
+  if (lockHolder(file)?.pid !== process.pid) return;
+  try {
+    fs6.unlinkSync(file);
+  } catch {
+  }
+}
 function pruneEmptyDirs(dir, specsRoot) {
   let at = dir;
   while (at !== specsRoot && at.startsWith(specsRoot)) {
@@ -10627,10 +10733,10 @@ function stepGraph(method2) {
     const s = byNum.get(n);
     if (s.type !== "parallel" || s.endStep === void 0 || !s.branches?.length) continue;
     const entries = s.branches.map((b) => b.step).sort((a, b) => a - b);
-    const join31 = fallNext(s.endStep);
+    const join32 = fallNext(s.endStep);
     for (let i = 0; i < entries.length; i++) {
       const armEnd = i + 1 < entries.length ? prevOf(entries[i + 1]) : s.endStep;
-      if (armEnd !== void 0 && armEnd >= entries[i]) armEndJoin.set(armEnd, join31);
+      if (armEnd !== void 0 && armEnd >= entries[i]) armEndJoin.set(armEnd, join32);
     }
   }
   const successorsOf = (n) => {
@@ -11007,7 +11113,13 @@ function closureTypeOf(snapshot, identifier) {
   const ref = local.join("::");
   const matches = snapshot.types.filter((def) => matchTypeRef(ref, def.id));
   if (matches.length === 1) return matches[0];
-  return matches.find((def) => nameKey(def.id) === nameKey(ref));
+  const exact = matches.find((def) => nameKey(def.id) === nameKey(ref));
+  if (exact || matches.length > 0) return exact;
+  if (local.length === 2 && !identifier.includes("::")) {
+    const unqualified = snapshot.types.filter((def) => !def.id.includes("::") && !def.id.includes(".") && nameKey(def.id) === nameKey(local[1]));
+    if (unqualified.length === 1) return unqualified[0];
+  }
+  return void 0;
 }
 function renamedRefs(expr, rename) {
   const args = expr.args.map((a) => renamedRefs(a, rename));
@@ -11108,6 +11220,9 @@ function carriedFactChanges(pinned, live) {
       const nowMethod = liveMethods.get(method2.name);
       if (!nowMethod) continue;
       differs(`effect of ${entry.id}.${method2.name}`, method2.effect, nowMethod.effect);
+      if (method2.endpoint && factValue(method2.endpoint) !== factValue(nowMethod.endpoint)) {
+        changes.push(`endpoint of ${entry.id}.${method2.name} (${shownEndpoint(method2.endpoint)} \u2192 ${shownEndpoint(nowMethod.endpoint)})`);
+      }
       differs(`rename trace of ${entry.id}.${method2.name}`, method2.formerly, nowMethod.formerly);
       for (const r of paramRenames(method2, nowMethod)) {
         changes.push(`parameter "${r.from}" of ${entry.id}.${method2.name} (renamed to "${r.to}")`);
@@ -11152,7 +11267,8 @@ function memberDigest(snapshot, publicName, member) {
   return sha256(canonicalize({ method: methodShape(snapshot, method2), closure: closureShapes(snapshot, methodTypeRefs(method2)) }));
 }
 function shownSignature(method2) {
-  return method2.signature || `${method2.name}(${(method2.params ?? []).map((p) => `${p.name}${p.optional ? "?" : ""}: ${p.type}`).join(", ")}): ${method2.returns}`;
+  const derived = `${method2.name}(${(method2.params ?? []).map((p) => `${p.name}${p.optional ? "?" : ""}: ${p.type}`).join(", ")}): ${method2.returns}`;
+  return (method2.params?.length ? derived : method2.signature) || derived;
 }
 function entryFacts(before, after) {
   return [
@@ -11260,8 +11376,45 @@ function closureRenames(newer, older) {
 function renamesIn(ids, notes) {
   return ids.flatMap((id) => notes.get(id) ?? []);
 }
+function carriedThroughOwnRecords(snapshot, method2, exported) {
+  const byId = new Map(snapshot.types.map((def) => [def.id, def]));
+  const carried = /* @__PURE__ */ new Set();
+  const expanded = /* @__PURE__ */ new Set();
+  const queue = methodTypeRefs(method2).flatMap((expr) => extractTypeIdentifiers(canonicalTypeRef(snapshot, expr))).filter((id) => byId.has(id) && !exported.has(id));
+  while (queue.length) {
+    const id = queue.shift();
+    if (expanded.has(id)) continue;
+    expanded.add(id);
+    for (const expr of typeDefExprs(byId.get(id))) {
+      for (const child of extractTypeIdentifiers(canonicalTypeRef(snapshot, expr))) {
+        if (!byId.has(child)) continue;
+        carried.add(child);
+        if (!exported.has(child)) queue.push(child);
+      }
+    }
+  }
+  return carried;
+}
+function tracedRenamesBehind(older, newer, was, now) {
+  const written = new Set(methodTypeRefs(was).flatMap((expr) => expr.match(TYPE_IDENTIFIER) ?? []).map((token) => token.replace(/^::/, "")));
+  const olderDefs = new Map(older.types.map((d) => [d.id, d]));
+  const out = [];
+  for (const id of closureIds(newer, now)) {
+    const def = newer.types.find((d) => d.id === id);
+    const from = (def.formerly ?? []).find((f) => written.has(f) && !written.has(def.id));
+    if (from === void 0) continue;
+    out.push(`type "${from}" renamed to "${def.id}"`);
+    const olderDef = olderDefs.get(from);
+    const renamed2 = olderDef ? fieldRenames(olderDef, def) : def.fields.flatMap((field) => (field.formerly ?? []).filter((f) => !def.fields.some((x) => x.name === f)).slice(-1).map((f) => ({ from: f, to: field.name })));
+    for (const r of renamed2) out.push(`field "${def.id}.${r.from}" renamed to "${r.to}"`);
+  }
+  return out;
+}
 function signatureChange(older, newer, was, now, undoneNow = now) {
-  if (shownSignature(was) !== shownSignature(underName(undoneNow, was.name))) return `signature ${shownSignature(was)} \u2192 ${shownSignature(now)}`;
+  if (shownSignature(was) !== shownSignature(underName(undoneNow, was.name))) {
+    const behind = tracedRenamesBehind(older, newer, was, now);
+    return `signature ${shownSignature(was)} \u2192 ${shownSignature(now)}${behind.length ? ` (${behind.join("; ")})` : ""}`;
+  }
   const oldDefs = new Map(older.types.map((d) => [d.id, d]));
   const newDefs = new Map(newer.types.map((d) => [d.id, d]));
   const ids = [.../* @__PURE__ */ new Set([...closureIds(older, was), ...closureIds(newer, now)])].sort();
@@ -11271,7 +11424,8 @@ function signatureChange(older, newer, was, now, undoneNow = now) {
     return !a || !b || canonicalize(typeShape(older, a)) !== canonicalize(typeShape(newer, b));
   });
   const exported = new Set([...newer.exportedTypes ?? [], ...older.exportedTypes ?? []].map((t) => t.type));
-  const unlisted = moved.filter((id) => !exported.has(id));
+  const carried = carriedThroughOwnRecords(newer, now, exported);
+  const unlisted = moved.filter((id) => !exported.has(id) || carried.has(id));
   if (moved.length > 0 && unlisted.length === 0) return null;
   const named2 = (unlisted.length > 0 ? unlisted : moved).map((id) => `"${id}"`).join(", ");
   return named2 ? `signature reads the same, but a type it names changed shape: ${named2}` : "signature reads the same, but a type it names changed shape";
@@ -11400,7 +11554,8 @@ function surfaceChanges(newer, older) {
         if (changed !== null) out.push({ kind: "changed", name: entry.id, member: method2.name, detail: changed });
       } else if (a !== b) {
         const exported = new Set((newer.exportedTypes ?? []).map((t) => t.type));
-        const embedded = renamesIn(closureIds(newer, method2).filter((id) => !exported.has(id)), notes);
+        const carried = carriedThroughOwnRecords(newer, method2, exported);
+        const embedded = renamesIn(closureIds(newer, method2).filter((id) => !exported.has(id) || carried.has(id)), notes);
         if (embedded.length > 0) {
           const key2 = embedded.join("; ");
           embeddedBy.set(key2, [...embeddedBy.get(key2) ?? [], method2.name]);
@@ -17398,7 +17553,8 @@ function schemaScope(ownDefs, externals, registry, alias) {
       return hit !== void 0 ? own2(hit) : void 0;
     },
     isObject(typeRef2) {
-      const expr = expressionOf(typeRef2);
+      const read2 = expressionOf(typeRef2);
+      const expr = read2?.form === "optional" ? read2.args[0] : read2;
       if (!expr || expr.form !== "named" && expr.form !== "applied") return false;
       const name = expr.name ?? "";
       const sep18 = name.indexOf("::");
@@ -17517,10 +17673,10 @@ function enumValuesFrom(schema) {
   return schema.enum.filter((v) => typeof v === "string" && v.length > 0).map((name) => ({ name, ...described2.has(name) ? { description: described2.get(name) } : {} }));
 }
 function openApiPath(basePath, endpointPath) {
-  const join31 = (a, b) => `${a.replace(/\/+$/, "")}/${b.replace(/^\/+/, "")}`;
+  const join32 = (a, b) => `${a.replace(/\/+$/, "")}/${b.replace(/^\/+/, "")}`;
   const base = basePath && basePath.trim() && basePath.trim() !== "/" ? basePath.trim() : "";
   const rootedBase = base.startsWith("/") || !base ? base : `/${base}`;
-  const raw = base ? endpointPath.replace(/\/+$/, "") === "" ? rootedBase : join31(rootedBase, endpointPath) : endpointPath;
+  const raw = base ? endpointPath.replace(/\/+$/, "") === "" ? rootedBase : join32(rootedBase, endpointPath) : endpointPath;
   const rooted = raw.startsWith("/") ? raw : `/${raw}`;
   return rooted.replace(/\/:([A-Za-z_][A-Za-z0-9_]*)/g, "/{$1}");
 }
@@ -17580,7 +17736,7 @@ function operationFor(method2, scope, entry) {
     const bodyParam = rest.length === 1 ? rest[0] : void 0;
     if (bodyVerbs.has(httpVerb) && bodyParam && scope.isObject(bodyParam.type)) {
       op.requestBody = {
-        required: !bodyParam.optional && !admitsNoValue(bodyParam.type),
+        required: !bodyParam.optional,
         ...bodyParam.description ? { description: bodyParam.description } : {},
         content: { "application/json": { schema: schemaFor(bodyParam.type, scope) } }
       };
@@ -18657,7 +18813,10 @@ function canonicalReferences(snapshot) {
       ...entry,
       methods: entry.methods.map((m) => ({
         ...m,
-        signature: canon(m.signature),
+        // Rebuilt from the structured params when it has them: a parameter's
+        // NAME is never a type position, so one spelled like a type
+        // (`order_id: order_id`) keeps its name.
+        signature: m.params?.length ? `${m.name}(${m.params.map((p) => `${p.name}${p.optional ? "?" : ""}: ${canon(p.type)}`).join(", ")}): ${canon(m.returns)}` : canon(m.signature),
         returns: canon(m.returns),
         ...m.params ? { params: m.params.map((p) => ({ ...p, type: canon(p.type) })) } : {}
       }))
@@ -18893,14 +19052,20 @@ function foreignSurfaces() {
   }
   const root = getProjectRoot();
   for (const m of members) {
-    if (m.problem || m.storage !== "contained" && m.storage !== "path" || m.path === void 0 || out.has(m.alias)) continue;
+    const location = m.path ?? m.source.path;
+    if (m.problem || m.storage !== "contained" && m.storage !== "path" || location === void 0 || out.has(m.alias)) continue;
     try {
-      const surface = runWithProjectRoot(path15.resolve(root, m.path), () => projectOwnSurface("project"));
+      const surface = runWithProjectRoot(path15.resolve(root, location), () => projectOwnSurface("project"));
       out.set(m.alias, surface);
       if (surface.projectId && !out.has(surface.projectId)) out.set(surface.projectId, surface);
     } catch {
     }
   }
+  try {
+    const own2 = boundProjectId();
+    if (own2 !== void 0 && !out.has(own2)) out.set(own2, projectOwnSurface("project"));
+  } catch {
+  }
   return out;
 }
 function withForeignTypes(snapshot, foreign) {
@@ -19148,6 +19313,11 @@ function narrowerExports(external, missing, read2) {
   }
   return [...out].map(([name, audience]) => ({ name, audience }));
 }
+function withMoved(detail, moved) {
+  if (moved.length === 0) return detail;
+  const said = `moved since the last pin: ${moved.join(", ")}`;
+  return { detail: detail.detail ? `${said}; ${detail.detail}` : said };
+}
 function pinBinding(binding, lock) {
   const { external } = binding;
   const unexported = binding.usage?.unexported ?? [];
@@ -19164,6 +19334,7 @@ function pinBinding(binding, lock) {
   if (pinned) snapshot = withRetired(snapshot, pinned);
   const snapshotChanged = !pinned || contentDigest(pinned) !== digest3 || pinnedContentKey(pinned) !== pinnedContentKey(snapshot);
   if (snapshotChanged) externalsRepository.saveSnapshot(external.alias, snapshot);
+  const moved = pinned && snapshotChanged ? carriedFactChanges(pinned, snapshot) : [];
   const { used, missing, uncarried } = usedDigests(binding.usage, snapshot, external.alias);
   const narrower = missing.length > 0 && external.audience !== "project" ? narrowerExports(external, missing, snapshot) : [];
   const entry = {
@@ -19185,7 +19356,7 @@ function pinBinding(binding, lock) {
       digest: digest3,
       usedNames: Object.keys(used).length,
       unexported: [...unexported, ...uncarried],
-      ...pinDetail(missing, Object.keys(used).length, external.alias, narrower, external.audience)
+      ...withMoved(pinDetail(missing, Object.keys(used).length, external.alias, narrower, external.audience), moved)
     },
     changed: entryChanged
   };
@@ -19368,6 +19539,20 @@ function changedDetail(pinned, live, publicName, member, digest3) {
   if (renames.length === 0) return {};
   return { detail: `${renames.join("; ")}${renameOnly ? " (its shape is otherwise unchanged) \u2014 follow the rename" : " (and its shape changed beyond that)"}` };
 }
+function routeOf(endpoint) {
+  if (!endpoint) return "none";
+  if (endpoint.transport === "HTTP") return `${endpoint.method} ${endpoint.path}${endpoint.status !== void 0 ? ` (answers ${endpoint.status})` : ""}`;
+  const { transport, ...address } = endpoint;
+  return `${String(transport)} ${Object.entries(address).filter(([, v]) => v !== void 0).map(([k, v]) => `${k}=${String(v)}`).join(" ")}`;
+}
+function endpointMove(pinned, live, publicName, member) {
+  if (!pinned || member === "type" || member.startsWith("capability:")) return null;
+  const was = pinned.interfaces.find((e) => e.id === publicName)?.methods.find((m) => m.name === member)?.endpoint;
+  if (!was) return null;
+  const now = live.interfaces.find((e) => e.id === publicName)?.methods.find((m) => m.name === member)?.endpoint;
+  if (canonicalize(was) === canonicalize(now ?? null)) return null;
+  return now ? { removed: false, detail: `endpoint moved: ${routeOf(was)} \u2192 ${routeOf(now)} \u2014 its signature is unchanged, but a client that spells the route (a hand-written HTTP client, a binding) must follow` } : { removed: true, detail: `endpoint ${routeOf(was)} removed \u2014 the verb is bound to no route any more, so a client calling it over the wire breaks` };
+}
 function compareUses(entry, usage, live, pinned = null) {
   const uses = [];
   const locked = entry?.used ?? {};
@@ -19377,11 +19562,21 @@ function compareUses(entry, usage, live, pinned = null) {
       uses.push(liveHas(publicName) ? { publicName, state: "unchanged" } : goneUse(live, publicName, void 0, void 0));
       continue;
     }
-    for (const [member, digest3] of Object.entries(members)) {
+    for (const [member, locked2] of Object.entries(members)) {
+      const digest3 = (pinned ? memberDigest(pinned, publicName, member) : null) ?? locked2;
       const now = memberDigest(live, publicName, member);
-      if (now === null) uses.push(goneUse(live, publicName, member, digest3, pinned));
-      else if (now === digest3) uses.push({ publicName, member, state: "unchanged" });
-      else uses.push({ publicName, member, state: "changed", ...changedDetail(pinned, live, publicName, member, digest3) });
+      if (now === null) {
+        uses.push(goneUse(live, publicName, member, digest3, pinned));
+        continue;
+      }
+      const route2 = endpointMove(pinned, live, publicName, member);
+      if (now === digest3) {
+        uses.push(route2 === null ? { publicName, member, state: "unchanged" } : { publicName, member, state: route2.removed ? "changed" : "unchanged", detail: route2.detail });
+        continue;
+      }
+      const changed = changedDetail(pinned, live, publicName, member, digest3);
+      const detail = [changed.detail, route2?.detail].filter((d) => !!d).join("; ");
+      uses.push({ publicName, member, state: "changed", ...detail ? { detail } : {} });
     }
   }
   const unlocked = (publicName, member) => {
@@ -19458,7 +19653,7 @@ function externalStatus(binding, lock) {
   const snapshot = entry !== void 0 ? externalsRepository.readSnapshot(external.alias) : null;
   const uses = compareUses(entry, binding.usage, live, snapshot);
   const staleFacts = snapshot ? carriedFactChanges(snapshot, live) : [];
-  const drifted = entry !== void 0 ? contentDigest(live) !== entry.digest || staleFacts.length > 0 : void 0;
+  const drifted = entry !== void 0 ? contentDigest(live) !== (snapshot ? contentDigest(snapshot) : entry.digest) || staleFacts.length > 0 : void 0;
   return {
     ...base,
     reachable: true,
@@ -19468,6 +19663,48 @@ function externalStatus(binding, lock) {
     uses
   };
 }
+function projectedAt(directory) {
+  try {
+    return runWithProjectRoot(directory, () => projectOwnSurface("project"));
+  } catch {
+    return null;
+  }
+}
+function memberApprovedSurfaces() {
+  const out = {};
+  for (const member of memberRevisions()) {
+    if (!member.revision) continue;
+    const approved = projectedAt(member.revision.directory);
+    if (approved) out[member.alias] = approved;
+  }
+  return out;
+}
+function memberStatuses() {
+  const out = [];
+  for (const member of memberRevisions()) {
+    if (!member.revision) continue;
+    const live = projectedAt(member.root);
+    const approved = projectedAt(member.revision.directory);
+    if (!live || !approved) continue;
+    const { used } = usedDigests(member.usage, approved, member.alias);
+    const entry = { project: member.project, snapshot: "", digest: contentDigest(approved), used };
+    const uses = compareUses(entry, void 0, live, approved).filter((u) => u.state !== "unlocked" && u.state !== "unavailable");
+    const staleFacts = carriedFactChanges(approved, live);
+    out.push({
+      alias: member.alias,
+      project: member.project,
+      sourceKind: "family",
+      pinned: false,
+      reachable: true,
+      stale: uses.some((u) => u.state === "changed" || u.state === "removed" || u.state === "renamed"),
+      drifted: contentDigest(live) !== contentDigest(approved) || staleFacts.length > 0,
+      ...staleFacts.length ? { staleFacts } : {},
+      uses,
+      detail: `a live member, compared with ${member.revision.label}`
+    });
+  }
+  return out;
+}
 function hostedOnly(external) {
   return external.hosted !== void 0 && external.sourceKind === "unresolved" && getHostedLookup() === null;
 }
@@ -19715,11 +19952,11 @@ function declare(request) {
   } catch (e) {
     bindProblem = e instanceof Error ? e.message : String(e);
   }
-  const answered = binding ? readProducer(binding) : { why: bindProblem };
-  const producer = "read" in answered ? answered.read : null;
+  const answered2 = binding ? readProducer(binding) : { why: bindProblem };
+  const producer = "read" in answered2 ? answered2.read : null;
   const contradicted = contradiction(request, binding, producer);
   if (contradicted) return refused(alias, contradicted);
-  const why2 = "why" in answered ? answered.why : "unknown";
+  const why2 = "why" in answered2 ? answered2.why : "unknown";
   if (request.dryRun) {
     return {
       alias,
@@ -19793,10 +20030,10 @@ function updateUse(request) {
   const named2 = appended.filter((u) => u !== "*");
   if (named2.length > 0) {
     const binding = resolveDeclared(true).find((b) => b.external.alias === alias);
-    const answered = binding ? readProducer(binding) : null;
-    if (answered && "read" in answered) {
-      const missing = named2.filter((u) => !answered.read.exported.includes(u));
-      if (missing.length) return useRefused(alias, current2, missing.map((u) => unexportedReason(u, answered.read)).join("; "));
+    const answered2 = binding ? readProducer(binding) : null;
+    if (answered2 && "read" in answered2) {
+      const missing = named2.filter((u) => !answered2.read.exported.includes(u));
+      if (missing.length) return useRefused(alias, current2, missing.map((u) => unexportedReason(u, answered2.read)).join("; "));
     }
   }
   const same = next.length === current2.length && next.every((u, i) => u === current2[i]);
@@ -19849,6 +20086,12 @@ function listExternals2() {
 function listPinnedExternals2() {
   return listPinnedExternals();
 }
+function memberApprovedSurfaces2() {
+  return memberApprovedSurfaces();
+}
+function memberStatuses2() {
+  return memberStatuses();
+}
 function unrecordedUses2() {
   return unrecordedUses();
 }
@@ -21191,12 +21434,11 @@ function adviseOn(status, family, config) {
         `${who} moved in its live producer since it was pinned: ${broken.map(movedUse).join("; ")}. Used by ${users.length ? users.map((s) => `"${s}"`).join(", ") : "this project's references"}. ` + (bindings.length ? `Binding module(s) declared there: ${bindings.map((b) => `"${b}"`).join(", ")} \u2014 compared with the pin, not the live producer, so ${bindings.length === 1 ? "it draws" : "they draw"} BINDING_DRIFT once the re-pin lands; follow the move there too. ` : "") + `Adapt the uses${renamed2 ? " (follow the rename)" : ""}, then re-pin with ${repin(status.alias)}. Advisory: the pin still gates.`
       );
     }
-    case "drifted":
-      return advisory(
-        config,
-        "EXTERNAL_DRIFTED",
-        `The live producer of ${who} moved since it was pinned, but nothing this project uses changed.${staleTail(status)} Re-pin when convenient (${repin(status.alias)}).`
-      );
+    case "drifted": {
+      const routes = status.uses.filter((u) => u.state === "unchanged" && u.detail?.startsWith("endpoint moved: "));
+      const lead = routes.length ? `The live producer of ${who} moved since it was pinned: the route of ${routes.map((u) => `${useName(u)} (${u.detail.slice("endpoint moved: ".length).split(" \u2014 ")[0]})`).join(", ")} moved. The signatures this project uses are unchanged, but a client that spells the route (a hand-written HTTP client, a binding) must follow.` : `The live producer of ${who} moved since it was pinned, but nothing this project uses changed.`;
+      return advisory(config, "EXTERNAL_DRIFTED", `${lead}${staleTail(status)} Re-pin when convenient (${repin(status.alias)}).`);
+    }
     case "unavailable": {
       const beyond = status.pinnedDigest !== void 0 && status.reachable && !status.outOfReach ? status.uses.filter((u) => u.state === "unlocked") : [];
       if (beyond.length > 0 && status.uses.every((u) => u.state !== "unavailable")) {
@@ -21643,7 +21885,7 @@ function failureAt(ref, failures) {
   const last = ref.resolved.split("::").pop() ?? "";
   return failures.find((i) => i.resolution.callSite === site && (i.resolution.canonicalTarget === ref.authored || (i.resolution.canonicalTarget ?? "").endsWith(`::${last}`)));
 }
-function containedStatus(child, refs, failures) {
+function containedStatus(child, refs, failures, approved) {
   const base = { alias: child.mountAlias, project: child.id ?? child.namespace, sourceKind: "family", pinned: false };
   const unreachable = outsideReach(child);
   if (unreachable) {
@@ -21653,21 +21895,42 @@ function containedStatus(child, refs, failures) {
   const uses = [];
   for (const ref of refs) {
     const failed = failureAt(ref, failures);
-    const use = failed ? { publicName: referenceUse(ref), state: "removed", code: failed.code, detail: failed.resolution.reason } : { publicName: referenceUse(ref), state: "unchanged" };
+    if (!failed) {
+      const compared = (approved?.uses ?? []).filter((u) => u.publicName === referenceUse(ref));
+      for (const use2 of compared.length ? compared : [{ publicName: referenceUse(ref), state: "unchanged" }]) {
+        if (!uses.some((u) => u.publicName === use2.publicName && u.member === use2.member && u.state === use2.state)) uses.push(use2);
+      }
+      continue;
+    }
+    const use = { publicName: referenceUse(ref), state: "removed", code: failed.code, detail: failed.resolution.reason };
     if (!uses.some((u) => u.publicName === use.publicName && u.state === use.state)) uses.push(use);
   }
-  return { ...base, reachable: true, stale: uses.some((u) => u.state === "removed"), uses, detail: "a contained member, read live \u2014 nothing is pinned" };
+  return {
+    ...base,
+    reachable: true,
+    stale: uses.some((u) => u.state === "removed" || u.state === "changed" || u.state === "renamed"),
+    ...approved?.drifted ? { drifted: true } : {},
+    ...approved?.staleFacts?.length ? { staleFacts: approved.staleFacts } : {},
+    uses,
+    detail: approved ? `a live member, nothing pinned \u2014 ${approved.detail ?? "compared with its approval"}` : "a contained member, read live \u2014 nothing is pinned"
+  };
 }
-function containedRelations(answered) {
+function containedRelations(answered2) {
   const own2 = graph();
-  const consumed = own2.nodes.filter((n) => n.parent === "" && n.mountAlias !== void 0 && !answered.some((s) => s.alias === n.mountAlias)).map((child) => ({
+  const consumed = own2.nodes.filter((n) => n.parent === "" && n.mountAlias !== void 0 && !answered2.some((s) => s.alias === n.mountAlias)).map((child) => ({
     child,
     refs: own2.authoredReferences.filter((r) => (own2.owners.get(r.specId) ?? "") === "" && r.producer === child.namespace && r.binding !== "local")
   })).filter((c) => c.refs.length > 0);
   if (consumed.length === 0) return [];
   const config = configOrNull();
   const failures = validateProject({ rules: config?.rules, projectType: config?.projectType }).issues.filter((i) => i.resolution !== void 0 && i.resolution.outcome !== "resolved");
-  return consumed.map(({ child, refs }) => containedStatus(child, refs, failures));
+  let approved = [];
+  try {
+    approved = memberStatuses2();
+  } catch {
+    approved = [];
+  }
+  return consumed.map(({ child, refs }) => containedStatus(child, refs, failures, approved.find((s) => s.alias === child.mountAlias)));
 }
 function relationsAt(key2, dir, reach2) {
   const bound2 = (fn) => reach2 === null ? runWithProjectRoot(dir, fn) : runWithProjectBinding(dir, reach2, fn);
@@ -25877,12 +26140,13 @@ function placeholderProblems(path52, bindable, params) {
 var portalsRule = {
   name: "portal-endpoints",
   judges: "design",
-  description: "A Portal binds every interface method to a concrete endpoint of its own transport, when that transport requires one (transport.requiresEndpoint): every transport but InProcess, whose verbs are the contract methods themselves, and Custom, whose address is free-form. An HTTP endpoint's path placeholders (`{name}`, or a `:name` segment) bind the method's parameters, so each must be closed, appear once and name a parameter of the method or a field of a parameter's type (a method that states no structured params is not judged on names). One HTTP route binds one verb: two methods bound to the same HTTP method and path \u2014 the Portal's basePath joined in, placeholders compared by position whatever their name or spelling (`{id}` and `:code` are the same segment) \u2014 within one Portal, or across Portals that declare the same basePath, are a duplicate route: no router can dispatch both and an OpenAPI document holds one operation per path and verb.",
+  description: "A Portal binds every interface method to a concrete endpoint of its own transport, when that transport requires one (transport.requiresEndpoint): every transport but InProcess, whose verbs are the contract methods themselves, and Custom, whose address is free-form. An HTTP endpoint's path placeholders (`{name}`, or a `:name` segment) bind the method's parameters, so each must be closed, appear once and name a parameter of the method or a field of a parameter's type (a method that states no structured params is not judged on names). An HTTP endpoint's stated `status` is the success code its callers and its OpenAPI document read, so it must be a standard success or redirect code (200-208, 226, 300-308) and must agree with what the method answers: a 204 or a 304 carries no body, so a method that answers a value cannot state it, and a redirect sends the caller on with a Location header and no body, so the value a redirecting method answers is that location \u2014 a string (or a named type holding one), never a record. One HTTP route binds one verb: two methods bound to the same HTTP method and path \u2014 the Portal's basePath joined in, placeholders compared by position whatever their name or spelling (`{id}` and `:code` are the same segment) \u2014 within one Portal, or across Portals that declare the same basePath, are a duplicate route: no router can dispatch both and an OpenAPI document holds one operation per path and verb.",
   codes: [
     { code: "MISSING_ENDPOINT", defaultSeverity: "error", summary: "Portal method without a wire endpoint binding, on a transport that requires one" },
     { code: "ENDPOINT_TRANSPORT_MISMATCH", defaultSeverity: "error", summary: "Endpoint transport does not match the Portal's transport" },
     { code: "ENDPOINT_PATH_PLACEHOLDER", defaultSeverity: "error", summary: "An HTTP endpoint path holds an unclosed placeholder, one placeholder twice, or a placeholder that names no parameter of its method" },
-    { code: "ENDPOINT_ROUTE_DUPLICATE", defaultSeverity: "error", summary: "Two methods bound to the same HTTP method and path (placeholders compared by position) within one Portal, or across Portals declaring the same basePath" }
+    { code: "ENDPOINT_ROUTE_DUPLICATE", defaultSeverity: "error", summary: "Two methods bound to the same HTTP method and path (placeholders compared by position) within one Portal, or across Portals declaring the same basePath" },
+    { code: "ENDPOINT_STATUS_MISMATCH", defaultSeverity: "warning", summary: "An HTTP endpoint states a status that is no standard success or redirect code, or one that contradicts what its method answers: a 204 or 304 for a method answering a value, or a redirect for a method answering anything but the location (a string)" }
   ],
   check(ctx) {
     for (const comp of ctx.components) {
@@ -25926,6 +26190,7 @@ var portalsRule = {
         }
       }
     }
+    statusMismatches(ctx);
     duplicateRoutes(ctx);
   }
 };
@@ -25971,6 +26236,47 @@ function duplicateRoutes(ctx) {
     }
   }
 }
+var STANDARD_STATUSES = /* @__PURE__ */ new Set([200, 201, 202, 203, 204, 205, 206, 207, 208, 226, 300, 301, 302, 303, 304, 305, 306, 307, 308]);
+var REDIRECTS = /* @__PURE__ */ new Set([301, 302, 303, 307, 308]);
+function answered(returns) {
+  if (!returns) return null;
+  const expr = parseTypeExpression(returns.trim(), "returns").expression;
+  const awaited = expr?.form === "async" ? expr.args[0] : expr;
+  return (awaited?.form === "result" ? awaited.args[0] : awaited) ?? null;
+}
+function isLocation(ctx, expr) {
+  const inner2 = expr.form === "optional" ? expr.args[0] : expr;
+  if (inner2.form === "primitive") return inner2.name === "string";
+  if (inner2.form !== "named" || !inner2.name) return false;
+  const local = inner2.name.slice(inner2.name.lastIndexOf("::") + (inner2.name.includes("::") ? 2 : 0)).split(".").pop() ?? inner2.name;
+  const def = ctx.types.find((t) => t.id === inner2.name || t.id === local || t.id.endsWith(`::${local}`));
+  return def?.holds?.trim() === "string";
+}
+function statusMismatches(ctx) {
+  for (const comp of ctx.components) {
+    if (comp.componentType !== "Portal" || comp.transport !== "HTTP") continue;
+    const isDraftCtx = ctx.isComponentDraft(comp.id);
+    for (const intf of ctx.interfaces.filter((i) => i.component === comp.id)) {
+      const isIntfDraft = intf.status === "draft" || intf.status === "design";
+      for (const m of intf.methods) {
+        const endpoint = m.endpoint;
+        if (endpoint?.transport !== "HTTP" || endpoint.status === void 0) continue;
+        const status = endpoint.status;
+        const answer = answered(m.returns);
+        const value = answer !== null && !(answer.form === "primitive" && answer.name === "void");
+        const problem = !STANDARD_STATUSES.has(status) ? `${status} is no standard success or redirect code (200-208, 226, 300-308), so no client library names it` : (status === 204 || status === 304) && value ? `${status} carries no body, yet the method answers "${m.returns}" \u2014 the response would drop it` : REDIRECTS.has(status) && value && answer !== null && !isLocation(ctx, answer) ? `${status} is a redirect, answered with a Location header and no body, yet the method answers "${m.returns}" \u2014 a redirecting method answers the location itself (a string), so the response would drop it` : null;
+        if (problem === null) continue;
+        ctx.addIssue(
+          "warning",
+          "ENDPOINT_STATUS_MISMATCH",
+          `Method "${m.name}" on interface "${intf.id}" binds ${endpoint.method ?? "HTTP"} ${endpoint.path ?? ""} with status ${status}: ${problem}. State the status the method's answer allows, or change what it answers.`,
+          intf.id,
+          isDraftCtx || isIntfDraft
+        );
+      }
+    }
+  }
+}
 
 // src/core/rules/doctrine/non-portal-endpoints.ts
 var nonPortalEndpointsRule = {
@@ -28696,10 +29002,11 @@ function bodyReachable(code, file, symbol) {
 var methodRealizationRule = {
   name: "method-realization",
   judges: "code",
-  description: "Code\u2194spec Level 1: every L3 contract method must be realized in its own source file (the method's sourcePath, else the implementation's) at its conformance tier \u2014 declared | anchored | off; Portals default to anchored, everything else to declared, and a per-method `symbol` maps an intent-language name onto the code name. A method realized by a DECLARATION owes a function BODY as well: at exact grade one must be reachable under the symbol, here or through the imports and republications this file forwards it by, so a signature, an ambient or interface declaration or a plain value binding stops reading as an implementation (METHOD_BODY_NOT_FOUND). Findings carry the analysis grade (exact AST | pattern table | generic scan) so weaker analysis is visible. Methods whose file escapes the root, is missing or could not be analyzed are left to source-file-linkage, and implementations under chained subsystems (projectPath) validate standalone in their own project run.",
+  description: "Code\u2194spec Level 1: every L3 contract method must be realized in its own source file (the method's sourcePath, else the implementation's) at its conformance tier \u2014 declared | anchored | off; Portals default to anchored, everything else to declared, and a per-method `symbol` maps an intent-language name onto the code name. A method realized by a DECLARATION owes a function BODY as well: at exact grade one must be reachable under the symbol, here or through the imports and republications this file forwards it by, so a signature, an ambient or interface declaration or a plain value binding stops reading as an implementation (METHOD_BODY_NOT_FOUND). Findings carry the analysis grade (exact AST | pattern table | generic scan) so weaker analysis is visible. A dial turned off is said once per implementation as a notice (REALIZATION_UNCHECKED) naming the methods it covers: the dial is code linkage, outside the approval, so without it one line in an implementation spec would switch the realization checks off \u2014 method, parameters, async, whether narrated calls are found \u2014 with no surface saying so; the doctrine checks still run. Methods whose file escapes the root, is missing or could not be analyzed are left to source-file-linkage, and implementations under chained subsystems (projectPath) validate standalone in their own project run.",
   codes: [
     { code: "UNREALIZED_METHOD", defaultSeverity: "warning", summary: "An L3 contract method has no anchor in its own source file (the method's sourcePath, else the implementation's) at the required conformance tier" },
-    { code: "METHOD_BODY_NOT_FOUND", defaultSeverity: "warning", summary: "The method symbol IS declared in its own source file, but the file holds no function-like body under it \u2014 a signature, an ambient or interface declaration, a value binding, an imported or re-exported name", carryable: true }
+    { code: "METHOD_BODY_NOT_FOUND", defaultSeverity: "warning", summary: "The method symbol IS declared in its own source file, but the file holds no function-like body under it \u2014 a signature, an ambient or interface declaration, a value binding, an imported or re-exported name", carryable: true },
+    { code: "REALIZATION_UNCHECKED", defaultSeverity: "notice", summary: "An implementation's conformance dial is off, on itself or on some of its methods, so whether those methods are realized in its code \u2014 present, taking the contract's parameters, async as declared, making the calls their narratives claim \u2014 is not checked" }
   ],
   check(ctx) {
     const code = ctx.codeIndex();
@@ -28711,6 +29018,19 @@ var methodRealizationRule = {
       if (ctx.isInChainedSubproject(component.subsystem)) continue;
       const draft = ctx.isImplementationDraft(impl);
       const specTier = impl.conformance ?? defaultConformanceTier(component);
+      const offMethods = contract.methods.filter((method2) => (impl.methods.find((m) => m.name === method2.name)?.conformance ?? specTier) === "off").map((method2) => method2.name);
+      if (specTier === "off" || offMethods.length > 0) {
+        const covers = specTier === "off" && offMethods.length === contract.methods.length ? `on the implementation itself \u2014 every method of contract "${impl.contract}"` : `on ${offMethods.length} method(s) of contract "${impl.contract}" \u2014 ${offMethods.map((name) => `"${name}"`).join(", ")}`;
+        ctx.addIssue(
+          "notice",
+          "REALIZATION_UNCHECKED",
+          `Realization not checked: conformance off on "${impl.id}", ${covers}. Whether those methods are in the code, take the contract's parameters, are async as declared and make the calls their narratives claim is not compared; the doctrine checks (an unnarrated write, a call the analysis cannot follow, a Portal write shortcut, route coverage) still run. The dial is code linkage, outside the approval \u2014 this notice is where it shows. It is meant for generated or vendored code; drop it (sdd_update_spec unset conformance) to have the code compared again.`,
+          impl.id,
+          draft,
+          void 0,
+          { at: "conformance" }
+        );
+      }
       for (const method2 of contract.methods) {
         const methodImpl = impl.methods.find((m) => m.name === method2.name);
         const tier = methodImpl?.conformance ?? specTier;
@@ -30642,7 +30962,7 @@ function bare(name) {
 }
 var HANDLE_NAMES = /* @__PURE__ */ new Set(["req", "request", "res", "response", "reply", "url", "ctx", "context", "next", "event", "socket"]);
 var TRANSPORT_HANDLES = /* @__PURE__ */ new Set(["req", "res", "ctx", "request", "response", "next", "reply"]);
-var REQUEST_HANDLES = /* @__PURE__ */ new Set(["req", "request", "ctx", "context", "event"]);
+var REQUEST_HANDLES = /* @__PURE__ */ new Set(["req", "request", "ctx", "context", "event", "url"]);
 var PRIMITIVE_KINDS = /* @__PURE__ */ new Set(["string", "number", "boolean"]);
 var aKind = (kind) => kind === "object" ? "an object" : `a ${kind}`;
 var fieldKey = (name) => name.toLowerCase().replace(/[_-]/g, "");
@@ -30691,7 +31011,7 @@ function pairUp(declared, realized, score) {
   }
   return align(best);
 }
-function judge2(declared, realized, injected, typeAgrees, expected) {
+function judge2(declared, realized, injected, typeAgrees, expected, typescript) {
   const declaredNames = new Set(declared.map((param) => bare(param.name)));
   const isInjected = (param) => param.name !== void 0 && injected.has(bare(param.name));
   let lead = 0;
@@ -30700,6 +31020,25 @@ function judge2(declared, realized, injected, typeAgrees, expected) {
   while (end > lead && isInjected(realized[end - 1]) && !declaredNames.has(bare(realized[end - 1].name))) end--;
   let taken = realized.map((param, at) => ({ param, at })).slice(lead, end);
   taken = taken.filter(({ param }) => !(param.name !== void 0 && param.name.startsWith("_") && param.unused === true && !declaredNames.has(bare(param.name))));
+  const writtenAt = new Map(taken.map(({ param, at }) => [unitOf2(param, at), at]));
+  let bundle;
+  for (const entry of taken) {
+    const fields = entry.param.fields;
+    if (entry.param.kind !== "object" || !fields || fields.length === 0) continue;
+    if (declared.some((d) => typeAgrees(d, entry.param) || structural(expected(d)?.fields, entry.param) === "all")) continue;
+    const keys = new Set(fields.map(fieldKey));
+    const takenElsewhere = new Set(taken.filter((other) => other !== entry && other.param.name !== void 0).map((other) => fieldKey(bare(other.param.name))));
+    const covers = new Set(declared.flatMap((d, index) => {
+      const key2 = fieldKey(bare(d.name));
+      return keys.has(key2) && !takenElsewhere.has(key2) ? [index] : [];
+    }));
+    if (covers.size >= 2) {
+      bundle = { entry, covers };
+      break;
+    }
+  }
+  if (bundle) taken = taken.filter((entry) => entry !== bundle?.entry);
+  const pairable = declared.flatMap((param, index) => bundle?.covers.has(index) ? [] : [{ param, index }]);
   const score = (d, r) => {
     let total = 0;
     if (r.name !== void 0 && bare(r.name) === bare(d.name)) total += 4;
@@ -30711,7 +31050,7 @@ function judge2(declared, realized, injected, typeAgrees, expected) {
     else if (shape === "none") total -= 2;
     return total;
   };
-  const pairs = pairUp(declared, taken.map((entry) => entry.param), score);
+  const pairs = pairUp(pairable.map((entry) => entry.param), taken.map((entry) => entry.param), score).map(([d, r]) => [pairable[d].index, r]);
   const wiringParams = [...realized.slice(0, lead), ...realized.slice(end)];
   const found = {
     unrealized: /* @__PURE__ */ new Map(),
@@ -30721,38 +31060,73 @@ function judge2(declared, realized, injected, typeAgrees, expected) {
     transport: /* @__PURE__ */ new Map(),
     wiring: realized.slice(0, lead).map((param) => param.name),
     trailing: realized.slice(end).map((param) => param.name),
-    carried: /* @__PURE__ */ new Map()
+    carried: /* @__PURE__ */ new Map(),
+    mismatched: /* @__PURE__ */ new Map()
   };
+  if (bundle) {
+    const { param: object, at } = bundle.entry;
+    const bundled = declared.filter((_, index) => bundle?.covers.has(index)).map((param) => param.name);
+    const label7 = object.name ? `"${object.name}"` : `parameter #${at + 1}`;
+    for (const name of bundled) {
+      found.unrealized.set(name, { unit: name, told: `"${name}" (the code takes it inside the object ${label7}, where the contract declares it as a parameter of its own)` });
+    }
+    const unit = unitOf2(object, at);
+    found.undeclared.set(unit, { unit, told: `"${unit}" (an object bundling the contract's own parameters ${bundled.join(", ")})` });
+  }
   const pairedDeclared = new Set(pairs.map(([d]) => d));
   const pairedTaken = new Set(pairs.map(([, r]) => r));
   const substituted = /* @__PURE__ */ new Set();
   for (const [d, r] of pairs) {
     const param = declared[d];
-    const { param: at, at: position2 } = taken[r];
+    const { param: at, at: position } = taken[r];
     const sameName = at.name !== void 0 && bare(at.name) === bare(param.name);
     const want = expected(param);
     const agrees = typeAgrees(param, at);
     const shape = structural(want?.fields, at);
     const handleName = at.name !== void 0 && TRANSPORT_HANDLES.has(bare(at.name).toLowerCase()) && !TRANSPORT_HANDLES.has(bare(param.name).toLowerCase());
+    const sameKind = !!want?.kinds && !!at.type && !!at.kind && want.kinds.has(at.kind) && (PRIMITIVE_KINDS.has(at.kind) || !!want.loose);
     let instead;
     if (!agrees) {
       if (!sameName && want?.kinds && at.type && at.kind && !want.kinds.has(at.kind)) instead = aKind(at.kind);
       else if (at.transport && want?.fields) instead = "a transport handle";
       else if (shape === "none") instead = `an object sharing none of its fields (${(want?.fields ?? []).join(", ")})`;
-      else if (handleName && (!at.kind || at.transport)) instead = "a transport handle";
+      else if (handleName && shape !== "all" && !sameKind) instead = "a transport handle";
     }
     if (instead !== void 0) {
       substituted.add(r);
       const declares2 = want?.told ?? "an argument of its own";
       found.unrealized.set(param.name, {
         unit: param.name,
-        told: `"${param.name}" (the code takes ${at.name ? `"${at.name}"` : `parameter #${position2 + 1}`}, ${instead}, where the contract declares ${declares2})`
+        told: `"${param.name}" (the code takes ${at.name ? `"${at.name}"` : `parameter #${position + 1}`}, ${instead}, where the contract declares ${declares2})`
       });
-      const unit = unitOf2(at, position2);
+      const unit = unitOf2(at, position);
       found.undeclared.set(unit, { unit, told: `"${unit}" (${instead} in the place of the contract's "${param.name}", ${declares2})` });
       continue;
     }
-    const sameKind = !!want?.kinds && !!at.type && !!at.kind && want.kinds.has(at.kind) && (PRIMITIVE_KINDS.has(at.kind) || !!want.loose);
+    if (!agrees && want?.fields) {
+      const opaque = at.type !== void 0 && at.opaque === true || at.type === void 0 && typescript;
+      let shapeTold;
+      if (opaque) {
+        shapeTold = `${at.type !== void 0 ? `typed "${at.type}"` : "with no annotation"}, a type that admits any value and names none of its fields (${want.fields.join(", ")})`;
+      } else if (at.kind === "object" && at.fields && at.fields.length > 0) {
+        const has = new Set(at.fields.map(fieldKey));
+        const declaredKeys = new Set(want.fields.map(fieldKey));
+        const missing = want.fields.filter((field) => !has.has(fieldKey(field)));
+        const added = at.fields.filter((field) => !declaredKeys.has(fieldKey(field)));
+        if (missing.length > 0 && missing.length < want.fields.length || missing.length === 0 && added.length > 0) {
+          shapeTold = `an object ${[
+            ...missing.length > 0 ? [`missing ${missing.map((field) => `"${field}"`).join(", ")}`] : [],
+            ...added.length > 0 ? [`adding ${added.map((field) => `"${field}"`).join(", ")}`] : []
+          ].join(" and ")}`;
+        }
+      }
+      if (shapeTold !== void 0) {
+        found.mismatched.set(param.name, {
+          unit: param.name,
+          told: `"${param.name}" (the code takes ${at.name ? `"${at.name}"` : `parameter #${position + 1}`} ${shapeTold}, where the contract declares ${want.told})`
+        });
+      }
+    }
     if (at.name !== void 0 && !sameName && (agrees || sameKind || shape === "all")) {
       const former = (param.previousNames ?? []).some((name) => bare(name) === bare(at.name));
       found.renamed.set(`${param.name}\u2192${at.name}`, {
@@ -30768,9 +31142,12 @@ function judge2(declared, realized, injected, typeAgrees, expected) {
     }
   }
   const requestReads = new Set(wiringParams.filter((param) => param.name !== void 0 && REQUEST_HANDLES.has(bare(param.name).toLowerCase())).flatMap((param) => (param.reads ?? []).map(bare)));
+  const left = declared.filter((param, d) => !pairedDeclared.has(d) && !bundle?.covers.has(d) && !requestReads.has(bare(param.name)));
+  const records = left.filter((param) => (expected(param)?.fields?.length ?? 0) > 0);
+  const bodyRecord = requestReads.has("body") && records.length === 1 ? records[0].name : void 0;
   declared.forEach((param, d) => {
-    if (pairedDeclared.has(d)) return;
-    if (requestReads.has(bare(param.name))) {
+    if (pairedDeclared.has(d) || bundle?.covers.has(d)) return;
+    if (requestReads.has(bare(param.name)) || param.name === bodyRecord) {
       found.carried.set(param.name, { unit: param.name, told: param.name });
       return;
     }
@@ -30787,8 +31164,7 @@ function judge2(declared, realized, injected, typeAgrees, expected) {
     if (pairedTaken.has(r) && !substituted.has(r)) return;
     if (HANDLE_NAMES.has(bare(param.name).toLowerCase())) found.transport.set(param.name, { unit: unitOf2(param, at), told: param.name });
   });
-  const position = new Map(taken.map(({ param, at }) => [unitOf2(param, at), at]));
-  found.undeclared = new Map([...found.undeclared].sort(([a], [b]) => (position.get(a) ?? 0) - (position.get(b) ?? 0)));
+  found.undeclared = new Map([...found.undeclared].sort(([a], [b]) => (writtenAt.get(a) ?? 0) - (writtenAt.get(b) ?? 0)));
   return found;
 }
 function agreed(judgements, reading) {
@@ -30835,7 +31211,7 @@ function typeKind(type) {
 var paramConformanceRule = {
   name: "param-conformance",
   judges: "code",
-  description: "Code-to-contract for the SIGNATURE, the last of the three readings a spec-driven gate never made: a contract declares `params`, and nothing ever compared them to the parameters of the function that realizes the method. A contract could promise an argument the code does not take, take one the contract never mentions \u2014 including a secret \u2014 or name the same argument two different things, and the brief handed to an implementer would carry the contract's version. What a realization takes besides the contract's own parameters, at either end of its list, is wiring, declared on the implementation as `injectedParams` rather than inferred, because an inferred prefix cannot be told from a renamed first argument; a leading run and a trailing run of the names it declares are dropped, each name matching with or without its leading underscore, and a trailing one only where the contract declares no parameter of that name. A parameter whose name starts with an underscore means UNUSED, and it is set aside only where the analysis proves it is \u2014 named, with no identifier of that name in the body or in another parameter's default value and no read of `arguments`, as the request and URL a transport hands a handler that never reads them: a used `_secret` is judged like any parameter, and a name compared for a rename is read without its leading underscores. The rest are PAIRED in order, since a caller passes arguments in order: among the order-keeping pairings, the one where the most names agree, then the most declared types, then the most kinds of value, and on a tie the one aligned against the TAIL of the realization's list \u2014 so an inserted first argument is the one named undeclared, never the declared one it pushed along. The declared type is what tells a rename from a substitution. Types agree when the code's annotation, read through the dialect of the language the file was analyzed as (type_dialect.agrees), is the contract's canonical type \u2014 so `string[]` agrees with `list<string>`, TypeScript's `number` with int and float alike, and an annotation the dialect cannot read agrees with nothing; a named type agrees through its code-level name, an EXTERNAL one (`alias::name`) through the name its pinned snapshot gives it, else its public name's last segment in the code's type casing. Where a type checker read the file, each parameter the code annotates also carries the KIND of value it takes (string, number, boolean, list, object or function; a platform class the checker's fixed library leaves out \u2014 a URL, a Request, node:http's IncomingMessage \u2014 is an object), compared with the kind the contract's type is (a primitive's, a list, a map or set as an object, an enum as a string, a named scalar as what it holds, a record type as an object, a signature as a function; a date or a datetime as a string or an object, a duration as a number or a string, bytes as an object, a list or a string; anything unsettled compares with nothing). A paired parameter whose name differs and whose type agrees \u2014 or whose kind is the same primitive, or one of the kinds a date or bytes is written as \u2014 is a rename, said with the contract's former name when the code still uses it; one whose name differs and whose kind of value differs is a SUBSTITUTION, a different argument in the declared one's place, so the declared parameter is unrealized and the code's undeclared: `getRoute(params: Record<string, string>)` realizing `getRoute(id: string)` is never a silent pairing. Where the contract's type is a record, an object is compared STRUCTURALLY, by the property names the checker gives its type: one holding every field of the record is a rename, one sharing none of them a substitution whatever either side calls it, and a platform transport class (node:http's IncomingMessage, a fetch Request or Response, a URL, a socket) where a record is declared is a substitution too \u2014 so `planRoute(req: IncomingMessage)` and `planRoute(session: { user: string })` realizing `planRoute(request: plan_request)` are never silent pairings. Where the code settles no kind \u2014 unannotated JavaScript, a parameter typed any \u2014 a paired parameter named as a transport handle (req, res, ctx, request, response, next, reply) standing where the contract declares an argument of its own is a substitution: `cancelOrder(req, res)` realizing `cancelOrder(orderId, customerId)` is a handler's shape, not the contract's. Where neither side settles a type and no handle name speaks, nothing is said about the name. A parameter standing ahead of every kept pair under a name transports give their handles (req, request, res, response, reply, url, ctx, context, next, event, socket) is how a transport handle arrives, and the finding names the one green path for it: the handle in `injectedParams`, the contract's own parameters after it in order, the router unpacking the request into them \u2014 or, where the framework hands the function the handles alone, the contract's parameters read off the injected request by their own names: a contract parameter the code does not take but reads off an injected request handle (req, request, ctx, context, event) by its own name \u2014 `req.params.code`, `req.query['limit']`, a destructuring of such a read \u2014 is realized through that handle. An injected name none of the implementation's realizing functions read in this run takes is stale linkage (UNUSED_INJECTED_PARAM): it would wave through the next parameter of that name unread. A name with several bodies is judged on what they all agree on, and a method the named file only CALLS is left to `methodRealization`, which already reports that the body is not here; a method whose conformance dial is off (its own, else its implementation's) is not judged.",
+  description: "Code-to-contract for the SIGNATURE, the last of the three readings a spec-driven gate never made: a contract declares `params`, and nothing ever compared them to the parameters of the function that realizes the method. A contract could promise an argument the code does not take, take one the contract never mentions \u2014 including a secret \u2014 or name the same argument two different things, and the brief handed to an implementer would carry the contract's version. What a realization takes besides the contract's own parameters, at either end of its list, is wiring, declared on the implementation as `injectedParams` rather than inferred, because an inferred prefix cannot be told from a renamed first argument; a leading run and a trailing run of the names it declares are dropped, each name matching with or without its leading underscore, and a trailing one only where the contract declares no parameter of that name. A parameter whose name starts with an underscore means UNUSED, and it is set aside only where the analysis proves it is \u2014 named, with no identifier of that name in the body or in another parameter's default value and no read of `arguments`, as the request and URL a transport hands a handler that never reads them: a used `_secret` is judged like any parameter, and a name compared for a rename is read without its leading underscores. An OBJECT whose properties name two or more of the contract's own parameters BUNDLES them and is set apart first: each parameter it bundles is unrealized (the code takes it inside the object) and the object undeclared, so `cancelOrder(input: { orderId, customerId })` realizing `cancelOrder(orderId, customerId)` names both, never one half by position. The rest are PAIRED in order, since a caller passes arguments in order: among the order-keeping pairings, the one where the most names agree, then the most declared types, then the most kinds of value, and on a tie the one aligned against the TAIL of the realization's list \u2014 so an inserted first argument is the one named undeclared, never the declared one it pushed along. The declared type is what tells a rename from a substitution. Types agree when the code's annotation, read through the dialect of the language the file was analyzed as (type_dialect.agrees), is the contract's canonical type \u2014 so `string[]` agrees with `list<string>`, TypeScript's `number` with int and float alike, and an annotation the dialect cannot read agrees with nothing; a named type agrees through its code-level name, an EXTERNAL one (`alias::name`) through the name its pinned snapshot gives it, a MEMBER's through the name its own type spec gives it, read live from the family with its kind and fields \u2014 so where a parameter's type lives never decides whether it is compared \u2014 else its public name's last segment in the code's type casing. Where a type checker read the file, each parameter the code annotates also carries the KIND of value it takes (string, number, boolean, list, object or function; a platform class the checker's fixed library leaves out \u2014 a URL, a Request, node:http's IncomingMessage \u2014 is an object), compared with the kind the contract's type is (a primitive's, a list, a map or set as an object, an enum as a string, a named scalar as what it holds, a record type as an object, a signature as a function; a date or a datetime as a string or an object, a duration as a number or a string, bytes as an object, a list or a string; anything unsettled compares with nothing). A paired parameter whose name differs and whose type agrees \u2014 or whose kind is the same primitive, or one of the kinds a date or bytes is written as \u2014 is a rename, said with the contract's former name when the code still uses it; one whose name differs and whose kind of value differs is a SUBSTITUTION, a different argument in the declared one's place, so the declared parameter is unrealized and the code's undeclared: `getRoute(params: Record<string, string>)` realizing `getRoute(id: string)` is never a silent pairing. Where the contract's type is a record, an object is compared STRUCTURALLY, by the data property names the checker gives its type: one holding every field of the record is a rename, one sharing none of them a substitution whatever either side calls it, and a platform transport class (node:http's IncomingMessage, a fetch Request or Response, a URL, a socket) where a record is declared is a substitution too \u2014 so `planRoute(req: IncomingMessage)` and `planRoute(session: { user: string })` realizing `planRoute(request: plan_request)` are never silent pairings. A paired parameter named as a transport handle (req, res, ctx, request, response, next, reply) standing where the contract declares an argument of its own is a substitution unless its type agrees with the declared one or holds every field of the declared record \u2014 however the handle is typed, a hand-written `type Req = { params: \u2026 }` included: `cancelOrder(req, res)` realizing `cancelOrder(orderId, customerId)` is a handler's shape, not the contract's. Where the contract's type is a record, a paired parameter whose type cannot hold it fails closed, as an opaque receiver does (PARAM_TYPE_MISMATCH): an OPAQUE type \u2014 any, unknown, object, {}, an index signature alone (`Record<string, unknown>`), or no annotation at all in a TypeScript file \u2014 names no field the analysis could compare, and an object sharing some of the record's fields but not all of them, or adding fields the record does not declare, is another shape; the finding names the fields missing and the fields added, so `planRoute(request: any)` and `planRoute(request: { stops: unknown[]; secret: string })` realizing `planRoute(request: plan_request)` are never silent pairings. Where neither side settles a type and no handle name speaks, nothing is said about the name. A parameter standing ahead of every kept pair under a name transports give their handles (req, request, res, response, reply, url, ctx, context, next, event, socket) is how a transport handle arrives, and the finding names the one green path for it: the handle in `injectedParams`, the contract's own parameters after it in order, the router unpacking the request into them \u2014 or, where the framework hands the function the handles alone, the contract's parameters read off the injected request by their own names: a contract parameter the code does not take but reads off an injected request handle (req, request, ctx, context, event, url) by its own name is realized through that handle \u2014 `req.params.code`, `req.query.limit`, `req.body.code`, `url.searchParams.get('limit')`, a destructuring at any depth, a local the handle's value flows into (`const url = new URL(req.url, base)`), and what a helper the handle is passed to reads off it or its result yields, where the helper is written in the same file or in a file no implementation claims (`const { orderId } = pathParams(req)`) \u2014 and the one RECORD parameter left unpaired is realized by the request's body read whole (`req.body`). An injected name none of the implementation's realizing functions read in this run takes is said as a NOTICE (UNUSED_INJECTED_PARAM): an injection is code linkage outside the approval, and one nothing takes hides nothing, since no function takes a parameter it could set aside \u2014 so it never fails a gate. A name with several bodies is judged on what they all agree on, and a method the named file only CALLS is left to `methodRealization`, which already reports that the body is not here; a method whose conformance dial is off (its own, else its implementation's) is not judged.",
   codes: [
     {
       code: "UNREALIZED_PARAM",
@@ -30859,8 +31235,14 @@ var paramConformanceRule = {
     },
     {
       code: "UNUSED_INJECTED_PARAM",
+      defaultSeverity: "notice",
+      summary: "An implementation declares an injected parameter that none of its realizing functions takes \u2014 stale code linkage, said so it can be dropped; nothing takes it, so it hides nothing and never fails a gate",
+      carryable: true
+    },
+    {
+      code: "PARAM_TYPE_MISMATCH",
       defaultSeverity: "warning",
-      summary: "An implementation declares an injected parameter that none of its realizing functions takes \u2014 stale linkage that would wave through the next parameter of that name, wherever it appears",
+      summary: "A contract parameter declared as a record is realized by a parameter whose type cannot hold it \u2014 opaque (any, unknown, an index signature) or an object missing the record's fields or adding its own \u2014 so what a caller hands over is never compared with what the design declares",
       carryable: true
     },
     {
@@ -30898,7 +31280,28 @@ var paramConformanceRule = {
         typeNamed.set(`${pin2.alias}::${exported.id}`, type);
       }
     }
-    const externalCodeName = (ref) => (ref.split("::").pop() ?? ref).split(/[_\-\s]+/).filter(Boolean).map((w) => w.charAt(0).toUpperCase() + w.slice(1)).join("");
+    const family = ctx.projectFamily?.nodes ?? [];
+    const root = family.find((node) => node.namespace === "");
+    const memberTypes = /* @__PURE__ */ new Map();
+    const lastOf = (id) => id.split(/::|\./).pop() ?? id;
+    const memberType = (ref) => {
+      const cut = ref.indexOf("::");
+      if (cut <= 0) return void 0;
+      if (memberTypes.has(ref)) return memberTypes.get(ref) ?? void 0;
+      const segment = ref.slice(0, cut);
+      const local = lastOf(ref.slice(cut + 2));
+      const key2 = root?.aliases.get(segment) ?? family.find((node2) => node2.aliases.has(segment))?.aliases.get(segment) ?? segment;
+      const node = family.find((n) => n.namespace !== "" && (n.namespace === key2 || n.mountAlias === segment || n.id === segment));
+      const found = node ? ctx.types.find((t) => t.id === `${node.namespace}::${local}`) ?? ctx.types.find((t) => t.id.startsWith(`${node.namespace}::`) && lastOf(t.id) === local) : void 0;
+      memberTypes.set(ref, found ?? null);
+      return found;
+    };
+    const typeOf = (name) => typeNamed.get(name) ?? memberType(name);
+    const externalCodeName = (ref) => {
+      const member = memberType(ref);
+      if (member) return member.symbol ?? member.name;
+      return (ref.split("::").pop() ?? ref).split(/[_\-\s]+/).filter(Boolean).map((w) => w.charAt(0).toUpperCase() + w.slice(1)).join("");
+    };
     const typeAgreesIn = (dialect) => (declared, realized) => {
       if (!realized.type || !dialect) return false;
       const stated = parseTypePosition(declared.type, "param", !!declared.optional);
@@ -30922,9 +31325,9 @@ var paramConformanceRule = {
         };
         if (expression.name && loose[expression.name]) return { kinds: new Set(loose[expression.name]), loose: true, told: `a ${expression.name}` };
       }
-      const kind = expressionKind(expression, (name) => typeKind(typeNamed.get(name)));
+      const kind = expressionKind(expression, (name) => typeKind(typeOf(name)));
       if (expression.form === "named" && expression.name) {
-        const type = typeNamed.get(expression.name);
+        const type = typeOf(expression.name);
         const fields = (type?.fields ?? []).map((field) => field && typeof field === "object" ? field.name : void 0).filter((name) => typeof name === "string");
         if (fields.length > 0 && kind === "object") return { kinds: /* @__PURE__ */ new Set(["object"]), fields, told: `the record "${expression.name}"` };
       }
@@ -30951,7 +31354,8 @@ var paramConformanceRule = {
       if (declared.length === 0) continue;
       const injected = new Set((implementation.injectedParams ?? []).map(bare));
       const typeAgrees = typeAgreesIn(dialectOf(facts));
-      const judgements = candidates.map((realized) => judge2(declared, realized, injected, typeAgrees, expected));
+      const typescript = facts.language === "typescript";
+      const judgements = candidates.map((realized) => judge2(declared, realized, injected, typeAgrees, expected, typescript));
       const subject = candidates.length > 1 ? `every function called "${symbol}" in "${file}"` : `the function "${symbol}" in "${file}"`;
       const opening = subject.charAt(0).toUpperCase() + subject.slice(1);
       const transport = agreed(judgements, "transport").map((found) => found.told);
@@ -30982,6 +31386,18 @@ var paramConformanceRule = {
           { at: method2.name, covers: undeclared.map((found) => found.unit) }
         );
       }
+      const mismatched = agreed(judgements, "mismatched");
+      if (mismatched.length > 0) {
+        ctx.addIssue(
+          "warning",
+          "PARAM_TYPE_MISMATCH",
+          `Method "${method2.name}" of contract "${implementation.contract}" declares ${mismatched.length} record parameter(s) ${subject} takes under a type that cannot hold the record \u2014 ${mismatched.map((found) => found.told).join("; ")}. Whatever a caller hands over there is never compared with what the design declares \u2014 an opaque type names no field to compare, and an object missing the record's fields or adding its own is another shape, the one a credential rides in unread \u2014 so the check fails closed on it, as it does on an opaque receiver. Type the parameter as the record (its code name), or declare on the contract the shape the code really takes.`,
+          implementation.id,
+          draftContext4,
+          void 0,
+          { at: method2.name, covers: mismatched.map((found) => found.unit) }
+        );
+      }
       const renamed2 = agreed(judgements, "renamed");
       if (renamed2.length > 0) {
         ctx.addIssue(
@@ -31014,9 +31430,9 @@ var paramConformanceRule = {
       const stale = injected.filter((name) => !taken.has(bare(name)));
       if (stale.length === 0) continue;
       ctx.addIssue(
-        "warning",
+        "notice",
         "UNUSED_INJECTED_PARAM",
-        `Implementation "${implementation.id}" declares ${stale.length} injected parameter(s) none of its realizing functions takes \u2014 ${stale.map((name) => `"${name}"`).join(", ")}. An injection is wiring the parameter check sets aside wherever it stands at either end of a signature, so one that no function takes waves through the next parameter of that name unread \u2014 a credential included. Drop it from injectedParams, or take it in the handler that is handed it.`,
+        `Implementation "${implementation.id}" declares ${stale.length} injected parameter(s) none of its realizing functions takes \u2014 ${stale.map((name) => `"${name}"`).join(", ")}. An injection is code linkage, outside the approval, and one no function takes hides nothing: there is no parameter of that name for it to set aside, so it never fails a gate. It is stale linkage all the same \u2014 drop it from injectedParams (sdd_update_spec, no re-lock), or take it in the handler that is handed it.`,
         implementation.id,
         ctx.isImplementationDraft(implementation),
         void 0,
@@ -31118,7 +31534,14 @@ function memberSurface(ctx, node, alias) {
         ...m,
         formerly: (m.previousNames ?? []).map(lastSegment4)
       }));
-      entries.push({ alias, entry: { id: e.publicName, name: e.publicName, component: e.component, methods } });
+      const approved = ctx.memberApprovedSurfaces?.[alias]?.interfaces.find((x) => x.id === e.publicName);
+      const kept = new Set(methods.flatMap((m) => [m.name, ...m.formerly ?? []]).map(nameKey));
+      const retired = (approved?.methods ?? []).map((m) => m.name).filter((n) => !kept.has(nameKey(n)));
+      entries.push({
+        alias,
+        entry: { id: e.publicName, name: e.publicName, component: e.component, methods, ...retired.length ? { retired } : {} },
+        ...retired.length ? { approved: true } : {}
+      });
       for (const m of methods) pending3.push(...methodTypeRefs(m));
     } else if (e.kind === "type" && e.typeDef) {
       const type = memberType(e.typeDef);
@@ -31213,7 +31636,7 @@ function methodDrift(where, params, entry, reportMissing, method2) {
   if (current2) return paramDrift(where, params, current2);
   const renamed2 = entry.entry.methods.find((m) => (m.formerly ?? []).some((f) => nameKey(f) === key2));
   if (renamed2) return [`"${method2 ?? where}" was renamed to "${renamed2.name}" in ${entry.alias}::${entry.entry.id} \u2014 follow the rename`];
-  if (retiredIn(entry, key2)) return [`"${method2 ?? where}" was removed from ${entry.alias}::${entry.entry.id} (an earlier pin held it) \u2014 drop it from the binding, and the calls that use it`];
+  if (retiredIn(entry, key2)) return [`"${method2 ?? where}" was removed from ${entry.alias}::${entry.entry.id} (${entry.approved ? "the member's approved design held it" : "an earlier pin held it"}) \u2014 drop it from the binding, and the calls that use it`];
   return reportMissing ? [`"${method2 ?? where}" is not exported by ${entry.alias}::${entry.entry.id} (it holds ${entry.entry.methods.map((m) => `"${m.name}"`).join(", ") || "no methods"})`] : [];
 }
 function formerType(name, types) {
@@ -31327,6 +31750,16 @@ function reachOf(ctx, segments) {
   const members = [];
   const unpinned2 = [];
   const externals = new Set((boundRoot(ctx)?.imports ?? []).filter((i) => i.section === "externals").map((i) => i.alias));
+  const ownId = boundRoot(ctx)?.id;
+  if (ownId !== void 0 && segments.has(ownId)) {
+    segments = new Set(segments);
+    for (const table of (ctx.exportTables ?? []).filter((x) => x.level === "project" && !(ctx.projectFamily?.nodes ?? []).some((n) => n.namespace !== "" && n.namespace === x.owner))) {
+      for (const e of table.entries) {
+        const target = e.typeDef ?? e.component ?? "";
+        if (target.includes("::")) segments.add(target.slice(0, target.indexOf("::")));
+      }
+    }
+  }
   for (const segment of segments) {
     if (pins.some((p) => p.alias === segment)) continue;
     const node = memberNode(ctx, segment);
@@ -31451,7 +31884,7 @@ function answers(route2, endpoint) {
 var routeCoverageRule = {
   name: "route-coverage",
   judges: "code",
-  description: "Code-to-contract for the ROUTES: does every route a router actually answers have a contract endpoint, and does every contract endpoint have a route that answers it? A portal's endpoints are what its contract promises; the router is what the code serves; nothing compared the two, so a route with no contract (including a write) could run for months without a single rule noticing. The Portal's own implementation names its router (`router`, code linkage): an entry its own files export, an entry or route table another module exports (`<module>#<name>`, a central routes.ts), or a module alone, every route-bearing export of which is read as one router; the routes are read out of that entry and the functions of its file it calls by name. A router several Portals name is read once against them all: a route is declared when any of them declares it, and an endpoint is unrouted per Portal. Two idioms are read: guards (a method comparison with comparisons on the path's split segments), where a prefix the router strips before splitting the path is folded in front; and a route table \u2014 a const the router names, one it returns or states in place unnamed, or the table the linkage names itself \u2014 (an array of objects pairing a method with a `/a/:b` template or an anchored regular expression, or an object keyed `VERB /path`, a key written as a template literal or a concatenation over constants settling like any other value), read only when every entry settles. A table is written under the ONE prefix its router strips off the path before matching it (`path.slice(BASE.length)`, `.replace(BASE, '')`), which is folded in front of every entry that does not already state it, so a stripped prefix that is not the Portal's basePath is read as the different URL it is, and the finding names both. Every compared value is a literal or one the code's constants, concatenations and template literals settle \u2014 through the type checker, any module's constant and any expression it types as one string literal \u2014 and never a guess. A route that states the whole path is read under the Portal's basePath, which the contract's endpoint paths are written beneath; a leading path segment a guard router never checks is completed from the first segments of the Portal's own HTTP endpoint paths, the segments whatever serves the Portal routes on. Which process serves which Portal is implementation, so no listener is consulted. A router that yields no route in either idiom is reported as unread, never passed: a check that cannot see a router must say so rather than stay quiet.",
+  description: "Code-to-contract for the ROUTES: does every route a router actually answers have a contract endpoint, and does every contract endpoint have a route that answers it? A portal's endpoints are what its contract promises; the router is what the code serves; nothing compared the two, so a route with no contract (including a write) could run for months without a single rule noticing. The Portal's own implementation names its router (`router`, code linkage): an entry its own files export, an entry or route table another module exports (`<module>#<name>`, a central routes.ts), or a module alone, every route-bearing export of which is read as one router; the routes are read out of that entry and the functions of its file it calls by name. A router several Portals name \u2014 the same entry or table in the same file, however each linkage spells it \u2014 is read once against them all: a route is declared when any of them declares it, and an endpoint is unrouted per Portal. Two idioms are read: guards (a method comparison with comparisons on the path's split segments), where a prefix the router strips before splitting the path is folded in front; and a route table \u2014 a const the router names, one it returns or states in place unnamed, or the table the linkage names itself \u2014 (an array of objects pairing a method with a `/a/:b` template or an anchored regular expression, or an object keyed `VERB /path`, a key written as a template literal or a concatenation over constants settling like any other value; an array may spread other tables and an object other objects, `[...ingestRoutes, ...statsRoutes]`, each followed through the type checker to the table it names in any module), read only when every entry settles. A table is written under the ONE prefix its router strips off the path before matching it (`path.slice(BASE.length)`, `.replace(BASE, '')`), which is folded in front of every entry that does not already state it, so a stripped prefix that is not the Portal's basePath is read as the different URL it is, and the finding names both. Every compared value is a literal or one the code's constants, concatenations and template literals settle \u2014 through the type checker, any module's constant and any expression it types as one string literal \u2014 and never a guess. A route that states the whole path is read under the Portal's basePath, which the contract's endpoint paths are written beneath; a leading path segment a guard router never checks is completed from the first segments of the Portal's own HTTP endpoint paths, the segments whatever serves the Portal routes on. Which process serves which Portal is implementation, so no listener is consulted. Route coverage is never silently off: a router that yields no route in either idiom, or a linkage naming a declaration that holds neither a function body nor a route table this analysis reads, is reported as unread; and a Portal binding HTTP endpoints whose implementation names no router while its code is read at exact grade is said as a notice (ROUTER_UNDECLARED) naming `router:` and the route-bearing names its files hold \u2014 a check that cannot see a router must say so rather than stay quiet.",
   codes: [
     {
       code: "UNDECLARED_ROUTE",
@@ -31472,17 +31905,50 @@ var routeCoverageRule = {
       defaultSeverity: "warning",
       summary: "A Portal's router entry yields no route this analysis can read, so its routes were not checked against the contract at all",
       carryable: true
+    },
+    {
+      code: "ROUTER_UNDECLARED",
+      defaultSeverity: "notice",
+      summary: "A Portal binds HTTP endpoints but its implementation names no router (`router:`), so none of the routes its code serves were checked against its contract"
     }
   ],
   check(ctx) {
     const code = ctx.codeIndex();
     const realization = ctx.realizationIndex();
     const groups = /* @__PURE__ */ new Map();
+    const httpEndpoints = (portal) => ctx.interfaceMethodsOf(portal.id).flatMap((method2) => {
+      const endpoint = method2.endpoint;
+      if (endpoint?.transport !== "HTTP") return [];
+      return [{
+        verb: endpoint.method.toUpperCase(),
+        segments: endpoint.path.split("/").filter(Boolean).map(normalizeSegment),
+        key: `${endpoint.method.toUpperCase()} ${endpoint.path}`
+      }];
+    });
+    const exactAt = (file) => {
+      const facts = code.factsAt(file);
+      return !!facts && facts.status === "analyzed" && facts.analysisGrade === "exact";
+    };
     for (const portal of ctx.components) {
       if (portal.componentType !== "Portal") continue;
       for (const impl of realization.implementationsOf(portal.id)) {
         const via = impl.router;
-        if (!via) continue;
+        if (!via) {
+          const endpoints2 = httpEndpoints(portal);
+          const files2 = realization.filesOf(portal.id).map(pathKey).filter(exactAt);
+          if (endpoints2.length === 0 || files2.length === 0) continue;
+          const held = [...new Set(files2.flatMap((file) => Object.entries(code.factsAt(file)?.functionRoutes ?? {}).filter(([, routes]) => routes.length > 0).map(([name]) => `${name} (${file})`)))].sort();
+          ctx.addIssue(
+            "notice",
+            "ROUTER_UNDECLARED",
+            `Portal "${portal.id}" binds ${endpoints2.length} HTTP endpoint(s), but its implementation "${impl.id}" names no router (\`router:\`), so no route its code serves was checked against its contract \u2014 not a route the design never promised, not an endpoint no route answers. Name the router in the implementation's \`router:\` (code linkage, no re-lock): an entry its own files export, \`<module>#<name>\` for an entry or a route table another module holds, or a module alone. ` + (held.length > 0 ? `Its files hold what reads as a router or a route table: ${held.join(", ")}.` : "Its files hold no function or table that reads as a router \u2014 when another module routes this Portal, name that one."),
+            impl.id,
+            ctx.isComponentDraft(portal.id) || ctx.isImplementationDraft(impl),
+            void 0,
+            { at: "router" }
+          );
+          continue;
+        }
         const linkage = routerLinkage(via);
         const files = linkage.file ? [pathKey(linkage.file)] : realization.filesOf(portal.id).map(pathKey);
         const exact = files.filter((file) => {
@@ -31494,7 +31960,22 @@ var routeCoverageRule = {
           return !!facts.functionParams && Object.prototype.hasOwnProperty.call(facts.functionParams, name) || !!facts.functionRoutes && Object.prototype.hasOwnProperty.call(facts.functionRoutes, name);
         };
         const holders = linkage.name !== void 0 ? exact.filter((file) => holds(file, linkage.name)) : exact;
-        if (holders.length === 0) continue;
+        if (holders.length === 0) {
+          const name = linkage.name;
+          const declaring = exact.filter((file) => code.declarationsAt(file).has(name));
+          if (declaring.length > 0) {
+            ctx.addIssue(
+              "warning",
+              "UNREADABLE_ROUTER",
+              `Portal "${portal.id}" names its router "${via}" (in ${declaring.map((file) => `"${file}"`).join(", ")}), but "${name}" there holds neither a function body nor a route table this analysis reads \u2014 so none of its routes were checked against the contract at all. A table must settle in every entry (a spread included: each spread must name a table that settles), and a router must be a function the file declares. Write it so, or carry this finding with the reason it cannot be.`,
+              impl.id,
+              ctx.isComponentDraft(portal.id) || ctx.isImplementationDraft(impl),
+              void 0,
+              { at: via }
+            );
+          }
+          continue;
+        }
         const prefixes = /* @__PURE__ */ new Set();
         const read2 = holders.flatMap((file) => {
           const facts = code.factsAt(file);
@@ -31513,15 +31994,7 @@ var routeCoverageRule = {
           }
           return [...names].flatMap((name) => Object.prototype.hasOwnProperty.call(routes, name) ? routes[name] : []);
         });
-        const endpoints = ctx.interfaceMethodsOf(portal.id).flatMap((method2) => {
-          const endpoint = method2.endpoint;
-          if (endpoint?.transport !== "HTTP") return [];
-          return [{
-            verb: endpoint.method.toUpperCase(),
-            segments: endpoint.path.split("/").filter(Boolean).map(normalizeSegment),
-            key: `${endpoint.method.toUpperCase()} ${endpoint.path}`
-          }];
-        });
+        const endpoints = httpEndpoints(portal);
         const heads = [...new Set(endpoints.map((endpoint) => endpoint.segments[0]).filter((head2) => !!head2 && head2 !== "*"))].sort();
         const router = {
           portal,
@@ -31535,7 +32008,7 @@ var routeCoverageRule = {
           draftContext: ctx.isComponentDraft(portal.id) || ctx.isImplementationDraft(impl),
           ...prefixes.size === 1 ? { prefix: [...prefixes][0] } : {}
         };
-        const key2 = linkage.file ? `${pathKey(linkage.file)}#${linkage.name ?? "*"}` : `${impl.id}#${via}`;
+        const key2 = `${[...holders].sort().join("|")}#${linkage.name ?? "*"}`;
         groups.set(key2, [...groups.get(key2) ?? [], router]);
       }
     }
@@ -32191,15 +32664,31 @@ var DATA_LAYER = /* @__PURE__ */ new Set(["Adapter", "Store", "Registry", "Index
 var technologyBindingRule = {
   name: "technology-binding",
   judges: "design",
-  description: "Only the stereotypes that sit at a technology seam (Adapter/Store/Registry/Index, and Observer \u2014 the edge block that subscribes to a messaging technology) should bind a technology directly: an L4 that declares `technologies` on logic has no swap seam. No hardcoded vendor lists \u2014 only declared tokens are policed, so the rule never fires on a tree that doesn't opt in.",
+  description: "Only the stereotypes that sit at a technology seam (Adapter/Store/Registry/Index, Observer \u2014 the edge block that subscribes to a messaging technology \u2014 and a Portal, the transport seam, which binds the framework that serves its endpoints) should bind a technology directly: an L4 that declares `technologies` on logic has no swap seam. A Portal binding a technology an Adapter, Store, Registry, Index or Observer of the tree also binds is reaching past its own seam into theirs, and is reported. No hardcoded vendor lists \u2014 only declared tokens are policed, so the rule never fires on a tree that doesn't opt in.",
   codes: [
-    { code: "TECH_ON_LOGIC_COMPONENT", defaultSeverity: "warning", summary: "Technology bound by a non-data-layer stereotype" }
+    { code: "TECH_ON_LOGIC_COMPONENT", defaultSeverity: "warning", summary: "Technology bound by a stereotype that sits at no technology seam, or a Portal binding a technology a data-layer stereotype binds" }
   ],
   check(ctx) {
+    const componentOf = (contract) => {
+      const intf = ctx.interfaceMap.get(contract);
+      return intf ? ctx.componentMap.get(intf.component) : void 0;
+    };
+    const dataLayer = new Set(ctx.implementations.filter((impl) => DATA_LAYER.has(componentOf(impl.contract)?.componentType ?? "")).flatMap((impl) => (impl.technologies ?? []).map((t) => technologyName(t).toLowerCase())));
     for (const impl of ctx.implementations) {
-      const intf = ctx.interfaceMap.get(impl.contract);
-      const comp = intf ? ctx.componentMap.get(intf.component) : void 0;
+      const comp = componentOf(impl.contract);
       if (!impl.technologies?.length || !comp || DATA_LAYER.has(comp.componentType)) continue;
+      if (comp.componentType === "Portal") {
+        const reached = impl.technologies.map(technologyName).filter((name) => dataLayer.has(name.toLowerCase()));
+        if (reached.length === 0) continue;
+        ctx.addIssue(
+          "warning",
+          "TECH_ON_LOGIC_COMPONENT",
+          `Implementation "${impl.id}" binds ${reached.join(", ")} on Portal "${comp.id}", a technology a data-layer component of this tree binds too. A Portal is the transport seam: it binds the framework that serves its endpoints, and reaches the data layer only through the components that bind it \u2014 drop ${reached.length === 1 ? "it" : "them"} from this implementation's technologies.`,
+          impl.id,
+          ctx.isImplementationDraft(impl)
+        );
+        continue;
+      }
       ctx.addIssue(
         "warning",
         "TECH_ON_LOGIC_COMPONENT",
@@ -33755,11 +34244,26 @@ function tableEntry(ts, entry, initializerOf, literalOf) {
   const route2 = keyedPath ?? (paths.length === 1 ? paths[0] : void 0);
   return verb && route2 ? { verb, segments: route2.segments, exactLength: route2.exactLength, fullPath: true, table: true } : void 0;
 }
-function tableRoutes(ts, value, initializerOf, literalOf) {
+function tableRoutes(ts, value, initializerOf, literalOf, depth = 0) {
+  if (depth > SETTLE_DEPTH) return [];
   const at = bareExpression(ts, value);
   const out = [];
+  const spread = (expression) => {
+    const named2 = bareExpression(ts, expression);
+    if (!ts.isIdentifier(named2) && !ts.isPropertyAccessExpression(named2)) return void 0;
+    const initializer = initializerOf(named2);
+    if (!initializer) return void 0;
+    const inner2 = tableRoutes(ts, initializer, initializerOf, literalOf, depth + 1);
+    return inner2.length > 0 ? inner2 : void 0;
+  };
   if (ts.isArrayLiteralExpression(at)) {
     for (const element of at.elements) {
+      if (ts.isSpreadElement(element)) {
+        const routes = spread(element.expression);
+        if (!routes) return [];
+        out.push(...routes);
+        continue;
+      }
       const entry = bareExpression(ts, element);
       if (!ts.isObjectLiteralExpression(entry)) return [];
       const route2 = tableEntry(ts, entry, initializerOf, literalOf);
@@ -33770,6 +34274,12 @@ function tableRoutes(ts, value, initializerOf, literalOf) {
   }
   if (ts.isObjectLiteralExpression(at)) {
     for (const property of at.properties) {
+      if (ts.isSpreadAssignment(property)) {
+        const routes = spread(property.expression);
+        if (!routes) return [];
+        out.push(...routes);
+        continue;
+      }
       const key2 = !property.name ? void 0 : ts.isComputedPropertyName(property.name) ? settleString(ts, property.name.expression, initializerOf, literalOf) : propertyKeyText(ts, property.name);
       const match2 = key2 ? /^([A-Za-z]+)\s+(\/\S*)$/.exec(key2) : null;
       if (!match2 || !HTTP_VERBS.has(match2[1].toUpperCase())) return [];
@@ -33869,7 +34379,7 @@ function readRoutes(ts, fn, initializerOf, literalOf) {
     return void 0;
   };
   const prefix = strippedPrefix(ts, fn.body, initializerOf, literalOf);
-  const routeOf = (conjuncts) => {
+  const routeOf2 = (conjuncts) => {
     let verb;
     let length;
     const fixed = /* @__PURE__ */ new Map();
@@ -33890,7 +34400,7 @@ function readRoutes(ts, fn, initializerOf, literalOf) {
     if (namedFunctionNameOf(ts, node) !== void 0) return;
     if (ts.isIfStatement(node)) {
       const guarded2 = [...enclosing2, ...conjunctsOf(node.expression)];
-      const route2 = routeOf(guarded2);
+      const route2 = routeOf2(guarded2);
       if (route2) routes.set(routeKey2(route2), route2);
       walk2(node.thenStatement, guarded2);
       if (node.elseStatement) walk2(node.elseStatement, enclosing2);
@@ -33924,6 +34434,141 @@ function readRoutes(ts, fn, initializerOf, literalOf) {
   returns(fn.body);
   return routes;
 }
+var READS_CAP = 64;
+var READS_DEPTH = 3;
+var FLOW_CALLS = /* @__PURE__ */ new Set(["URL", "URLSearchParams", "parse"]);
+function bindingKeys(ts, pattern, out) {
+  if (!ts.isObjectBindingPattern(pattern)) return;
+  for (const element of pattern.elements) {
+    const key2 = element.propertyName ?? element.name;
+    if (ts.isIdentifier(key2) || ts.isStringLiteral(key2)) out.add(key2.text);
+    if (!ts.isIdentifier(element.name)) bindingKeys(ts, element.name, out);
+  }
+}
+function calleeName(ts, expression) {
+  if (ts.isIdentifier(expression)) return expression.text;
+  if (ts.isPropertyAccessExpression(expression)) return expression.name.text;
+  return void 0;
+}
+function helperParam(ts, fn, index) {
+  const body = fn.body;
+  const parameter = (fn.parameters ?? [])[index];
+  if (!body || !parameter || parameter.dotDotDotToken) return void 0;
+  if (ts.isIdentifier(parameter.name)) return { body, name: parameter.name.text };
+  const keys = /* @__PURE__ */ new Set();
+  bindingKeys(ts, parameter.name, keys);
+  return keys.size > 0 ? { body, keys: [...keys] } : void 0;
+}
+function handleReads(ts, body, name, helperOf, out = /* @__PURE__ */ new Set(), depth = 0, seen = /* @__PURE__ */ new Set()) {
+  const visitKey = `${body.getSourceFile().fileName}:${body.pos}:${body.end}:${name}`;
+  if (seen.has(visitKey)) return out;
+  seen.add(visitKey);
+  const deeper = (scope, local) => {
+    if (depth < READS_DEPTH) handleReads(ts, scope, local, helperOf, out, depth + 1, seen);
+  };
+  const follow = (node) => {
+    let at = node;
+    for (; ; ) {
+      const up = at.parent;
+      if (!up || out.size >= READS_CAP) return;
+      if (ts.isParenthesizedExpression(up) || ts.isNonNullExpression(up) || ts.isAsExpression(up) || ts.isTypeAssertionExpression(up) || ts.isAwaitExpression(up) || typeof ts.isSatisfiesExpression === "function" && ts.isSatisfiesExpression(up)) {
+        at = up;
+        continue;
+      }
+      if (ts.isBinaryExpression(up) && (up.operatorToken.kind === ts.SyntaxKind.QuestionQuestionToken || up.operatorToken.kind === ts.SyntaxKind.BarBarToken)) {
+        at = up;
+        continue;
+      }
+      if (ts.isPropertyAccessExpression(up) && up.expression === at) {
+        out.add(up.name.text);
+        at = up;
+        continue;
+      }
+      if (ts.isElementAccessExpression(up) && up.expression === at) {
+        if (!ts.isStringLiteralLike(up.argumentExpression)) return;
+        out.add(up.argumentExpression.text);
+        at = up;
+        continue;
+      }
+      if (ts.isCallExpression(up) && up.expression === at) {
+        const [first] = up.arguments;
+        if (first && ts.isStringLiteralLike(first)) {
+          out.add(first.text);
+          return;
+        }
+        if (up.arguments.length > 0) return;
+        at = up;
+        continue;
+      }
+      if ((ts.isCallExpression(up) || ts.isNewExpression(up)) && up.expression !== at) {
+        const args = up.arguments ?? [];
+        const index = args.indexOf(at);
+        if (index < 0) return;
+        const helper = ts.isCallExpression(up) && depth < READS_DEPTH ? helperOf?.(up, index) : void 0;
+        if (helper) {
+          for (const key2 of helper.keys ?? []) out.add(key2);
+          if (helper.name) deeper(helper.body, helper.name);
+          at = up;
+          continue;
+        }
+        const callee = calleeName(ts, up.expression);
+        if (callee !== void 0 && FLOW_CALLS.has(callee)) {
+          at = up;
+          continue;
+        }
+        return;
+      }
+      if (ts.isVariableDeclaration(up) && up.initializer === at) {
+        if (ts.isIdentifier(up.name)) {
+          if (up.name.text !== name) deeper(body, up.name.text);
+        } else {
+          bindingKeys(ts, up.name, out);
+        }
+      }
+      return;
+    }
+  };
+  const visit = (node) => {
+    if (out.size >= READS_CAP) return;
+    if (ts.isIdentifier(node) && node.text === name) {
+      const parent = node.parent;
+      const declares2 = !!parent && (ts.isPropertyAccessExpression(parent) && parent.name === node || ts.isPropertyAssignment(parent) && parent.name === node || (ts.isVariableDeclaration(parent) || ts.isParameter(parent) || ts.isBindingElement(parent)) && parent.name === node || ts.isBindingElement(parent) && parent.propertyName === node);
+      if (!declares2) follow(node);
+    }
+    ts.forEachChild(node, visit);
+  };
+  visit(body);
+  return out;
+}
+function sameFileHelpers(ts, sf) {
+  const functions = /* @__PURE__ */ new Map();
+  for (const statement of sf.statements) {
+    if (ts.isFunctionDeclaration(statement) && statement.name && statement.body) functions.set(statement.name.text, statement);
+    if (ts.isVariableStatement(statement)) {
+      for (const declaration2 of statement.declarationList.declarations) {
+        const initializer = declaration2.initializer && bareExpression(ts, declaration2.initializer);
+        if (ts.isIdentifier(declaration2.name) && initializer && (ts.isArrowFunction(initializer) || ts.isFunctionExpression(initializer))) {
+          functions.set(declaration2.name.text, initializer);
+        }
+      }
+    }
+  }
+  return (call, index) => {
+    const callee = call.expression;
+    if (ts.isIdentifier(callee)) {
+      const fn = functions.get(callee.text);
+      return fn ? helperParam(ts, fn, index) : void 0;
+    }
+    if (ts.isPropertyAccessExpression(callee) && callee.expression.kind === ts.SyntaxKind.ThisKeyword) {
+      let owner = call.parent;
+      while (owner && !ts.isClassLike(owner)) owner = owner.parent;
+      const member = owner && ts.isClassLike(owner) ? owner.members.find((m) => ts.isMethodDeclaration(m) && m.name && propertyKeyText(ts, m.name) === callee.name.text) : void 0;
+      return member ? helperParam(ts, member, index) : void 0;
+    }
+    return void 0;
+  };
+}
+var REQUEST_HANDLE_NAMES = /* @__PURE__ */ new Set(["req", "request", "ctx", "context", "event", "url"]);
 function walkExact(ts, sourceText, fileName) {
   const sf = ts.createSourceFile(
     fileName,
@@ -34220,47 +34865,8 @@ function walkExact(ts, sourceText, fileName) {
     const container = containerOf(owner);
     return container !== void 0 ? { container } : nested;
   };
-  const readsOff = (body, name) => {
-    const out = /* @__PURE__ */ new Set();
-    const visit2 = (node) => {
-      if (out.size >= 64) return;
-      if (ts.isIdentifier(node) && node.text === name) {
-        const parent = node.parent;
-        const memberName = !!parent && (ts.isPropertyAccessExpression(parent) && parent.name === node || ts.isPropertyAssignment(parent) && parent.name === node);
-        if (!memberName) {
-          let at = node;
-          for (; ; ) {
-            const up = at.parent;
-            if (!up) break;
-            if (ts.isParenthesizedExpression(up) || ts.isNonNullExpression(up) || ts.isAsExpression(up)) {
-              at = up;
-              continue;
-            }
-            if (ts.isPropertyAccessExpression(up) && up.expression === at) {
-              out.add(up.name.text);
-              at = up;
-              continue;
-            }
-            if (ts.isElementAccessExpression(up) && up.expression === at && ts.isStringLiteralLike(up.argumentExpression)) {
-              out.add(up.argumentExpression.text);
-              at = up;
-              continue;
-            }
-            if (ts.isVariableDeclaration(up) && up.initializer === at && ts.isObjectBindingPattern(up.name)) {
-              for (const element of up.name.elements) {
-                const key2 = element.propertyName ?? element.name;
-                if (ts.isIdentifier(key2) || ts.isStringLiteral(key2)) out.add(key2.text);
-              }
-            }
-            break;
-          }
-        }
-      }
-      ts.forEachChild(node, visit2);
-    };
-    visit2(body);
-    return [...out].sort();
-  };
+  const helpersHere = sameFileHelpers(ts, sf);
+  const readsOff = (body, name) => [...handleReads(ts, body, name, helpersHere)].sort();
   const declaredParameters = (fn) => {
     const parameters = fn.parameters ?? [];
     const used = /* @__PURE__ */ new Set();
@@ -34976,7 +35582,7 @@ function checkerOptions(ts, projectRoot) {
     maxNodeModuleJsDepth: 0
   };
 }
-function resolveCalls(ts, files, projectRoot) {
+function resolveCalls(ts, files, projectRoot, claimed = /* @__PURE__ */ new Set()) {
   const out = /* @__PURE__ */ new Map();
   if (files.size === 0) return { calls: out, imports: /* @__PURE__ */ new Map(), kinds: /* @__PURE__ */ new Map(), routes: /* @__PURE__ */ new Map(), prefixes: /* @__PURE__ */ new Map(), crossProjectImports: /* @__PURE__ */ new Map() };
   const options = checkerOptions(ts, projectRoot);
@@ -35533,9 +36139,14 @@ function resolveCalls(ts, files, projectRoot) {
             const reading = {};
             if (kind) reading.kind = kind;
             if (kind === "object") {
-              const props = checker.getPropertiesOfType(checker.getNonNullableType(type)).map((p) => p.getName());
+              const props = checker.getPropertiesOfType(checker.getNonNullableType(type)).filter((p) => (p.flags & ts.SymbolFlags.Method) === 0).map((p) => p.getName());
               if (props.length > 0) reading.fields = props.slice(0, 200);
             }
+            if (opaqueType(type)) reading.opaque = true;
+            if (ts.isIdentifier(parameter.name) && REQUEST_HANDLE_NAMES.has(parameter.name.text.replace(/^_+/, "").toLowerCase())) {
+              const read2 = handleReads(ts, body, parameter.name.text, checkerHelpers);
+              if (read2.size > 0) reading.reads = [...read2].sort();
+            }
             return reading;
           } catch {
             return {};
@@ -35560,6 +36171,16 @@ function resolveCalls(ts, files, projectRoot) {
         } catch {
         }
       }
+      if (ts.isImportSpecifier(node) && !node.isTypeOnly && !fileRoutes.has(node.name.text)) {
+        try {
+          const declaration2 = symbolOf(node.name)?.valueDeclaration;
+          if (declaration2 && ts.isVariableDeclaration(declaration2) && declaration2.initializer && (ts.getCombinedNodeFlags(declaration2) & ts.NodeFlags.Const) !== 0) {
+            const table = tableRoutes(ts, declaration2.initializer, initializerOf, literalOf);
+            if (table.length > 0) fileRoutes.set(node.name.text, new Map(table.map((route2) => [routeKey2(route2), route2])));
+          }
+        } catch {
+        }
+      }
       ts.forEachChild(node, visit);
     };
     visit(sf);
@@ -35618,6 +36239,29 @@ function resolveCalls(ts, files, projectRoot) {
     if (broken.length > 0) crossProjectImports.set(key2, broken);
   }
   return { calls: out, imports, kinds, routes, prefixes, crossProjectImports };
+  function opaqueType(type) {
+    const at = checker.getNonNullableType(type);
+    if (at.intrinsicName === "error") return false;
+    if ((at.flags & (ts.TypeFlags.Any | ts.TypeFlags.Unknown | ts.TypeFlags.NonPrimitive)) !== 0) return true;
+    if ((at.flags & ts.TypeFlags.Object) === 0 || at.getProperties().length > 0) return false;
+    if (at.getCallSignatures().length > 0 || at.getConstructSignatures().length > 0) return false;
+    const lists = checker;
+    return !(lists.isArrayType?.(at) || lists.isTupleType?.(at));
+  }
+  function checkerHelpers(call, index) {
+    let declaration2;
+    try {
+      declaration2 = checker.getResolvedSignature(call)?.getDeclaration();
+    } catch {
+      return void 0;
+    }
+    if (!declaration2 || !declaration2.body) return void 0;
+    const home = declaration2.getSourceFile();
+    if (home.isDeclarationFile || !ownKey(home)) return void 0;
+    const absolute = path20.resolve(home.fileName);
+    if (absolute !== path20.resolve(call.getSourceFile().fileName) && claimed.has(absolute)) return void 0;
+    return helperParam(ts, declaration2, index);
+  }
   function platformKind(annotation) {
     if (!annotation || !ts.isTypeReferenceNode(annotation)) return void 0;
     const name = ts.isIdentifier(annotation.typeName) ? annotation.typeName.text : annotation.typeName.right.text;
@@ -35694,8 +36338,10 @@ function buildCodeModel(implementations, types, projectRoot, sourceRoots = [], e
   const packages = {};
   for (const [specifier, absolute] of localPackages) packages[specifier] = pathKey(path20.relative(projectRoot, absolute));
   const declaredPaths = [];
+  const claimedFiles = /* @__PURE__ */ new Set();
   for (const impl of implementations) {
     declaredPaths.push(...implementationSourceFiles(impl));
+    for (const file of implementationSourceFiles(impl)) claimedFiles.add(path20.resolve(projectRoot, file));
     if (impl.simPath) declaredPaths.push(impl.simPath);
     const routerFile = impl.router ? routerLinkage(impl.router).file : void 0;
     if (routerFile) declaredPaths.push(routerFile);
@@ -35795,7 +36441,7 @@ function buildCodeModel(implementations, types, projectRoot, sourceRoots = [], e
     let imports = /* @__PURE__ */ new Map();
     let reading;
     try {
-      reading = resolveCalls(ts, checkerRoots, projectRoot);
+      reading = resolveCalls(ts, checkerRoots, projectRoot, claimedFiles);
       ({ calls: resolved, imports } = reading);
     } catch {
       resolved = /* @__PURE__ */ new Map();
@@ -35818,6 +36464,8 @@ function buildCodeModel(implementations, types, projectRoot, sourceRoots = [], e
             const reading2 = settled[index][at];
             if (reading2.kind) param.kind = reading2.kind;
             if (reading2.fields) param.fields = reading2.fields;
+            if (reading2.opaque) param.opaque = true;
+            if (reading2.reads) param.reads = [.../* @__PURE__ */ new Set([...param.reads ?? [], ...reading2.reads])].sort();
           });
         });
       }
@@ -36684,6 +37332,7 @@ function buildRuleContext(opts) {
     ...opts.typeSpellingFacts ? { typeSpellingFacts: opts.typeSpellingFacts } : {},
     pinnedExternals,
     ...opts.bindingModules ? { bindingModules: opts.bindingModules } : {},
+    ...opts.memberApprovedSurfaces ? { memberApprovedSurfaces: opts.memberApprovedSurfaces } : {},
     codeModel: opts.codeModel ?? emptyCodeModel(),
     roundTripIssues: opts.roundTripIssues,
     lintAllows: lintAllows2,
@@ -37214,6 +37863,7 @@ function runOwnersGate(rulesOrOptions, projectType = "backend", reachOnly = fals
   const parts = new Set(graph().nodes.find((n) => n.namespace === "")?.parts.map((p) => p.alias) ?? []);
   const pinnedExternals = listPinnedExternals2().filter((p) => !parts.has(p.alias));
   const bindingModules = reachOnly ? [] : readBindingModules(implementations.filter((impl) => !impl.id.includes("::")).flatMap((impl) => impl.bindings ?? []), getProjectRoot());
+  const approvedMemberSurfaces = bindingModules.length > 0 && declaredMembers(boundConfig ?? {}).length > 0 ? memberApprovedSurfacesOrNone() : void 0;
   const conformance = rules?.conformance;
   const codeModel = reachOnly ? buildCodeModel([], [], getProjectRoot(), [], []) : buildCodeModel(implementations, types, getProjectRoot(), conformance?.sourceRoots ?? [], conformance?.exclude ?? []);
   const statusBearing = treatAllAsComplete ? [...subsystems, ...components, ...interfaces, ...implementations] : settledStatusBearing({ subsystems, components, interfaces, implementations });
@@ -37300,6 +37950,7 @@ function runOwnersGate(rulesOrOptions, projectType = "backend", reachOnly = fals
       typeSpellingFacts: typeSpellings,
       pinnedExternals,
       bindingModules,
+      ...approvedMemberSurfaces ? { memberApprovedSurfaces: approvedMemberSurfaces } : {},
       // By-name selections only: a legacy path ref pins nothing to check. A dry
       // run supplies its candidate's; otherwise the stored ones.
       packSelections: packSelections ?? projectPackSelections(),
@@ -37642,6 +38293,13 @@ function familyApprovals(depth) {
 function familyRelations2() {
   return familyRelations();
 }
+function memberApprovedSurfacesOrNone() {
+  try {
+    return memberApprovedSurfaces2();
+  } catch {
+    return void 0;
+  }
+}
 function implementsProblem2(ref) {
   return implementsProblem(ref);
 }
@@ -39755,6 +40413,7 @@ function respellStoredReferences(kind, doc, map) {
       break;
     case "interface":
       at(doc, "component", "contract");
+      at(doc, "implements", "implements");
       typedSlots("interface", doc, map);
       break;
     case "implementation":
@@ -40258,6 +40917,57 @@ function parseOrThrow(schema, value, kind, id) {
   return res.data;
 }
 var SIGNATURE_TTL_MS = 2e3;
+var REPLACED_LINKAGE_LISTS = /* @__PURE__ */ new Set(["injectedParams", "bindings"]);
+function respelledField(kind, position) {
+  switch (position) {
+    case "narrative":
+    case "calls":
+    case "auth":
+      return "methods";
+    case "type":
+      return kind === "type" ? "fields" : "methods";
+    case "contract":
+      return kind === "interface" ? "component" : "contract";
+    default:
+      return position;
+  }
+}
+function omittedListNotices(kind, stored, delta) {
+  const out = [];
+  const fields = kind === "type" ? ["methods", "fields"] : kind === "interface" || kind === "implementation" ? ["methods"] : [];
+  for (const field of fields) {
+    const given = delta[field];
+    if (!Array.isArray(given) || given.length === 0) continue;
+    const named2 = new Set(given.map((e) => e && typeof e === "object" ? e.name : void 0).filter((n) => typeof n === "string"));
+    const kept = (Array.isArray(stored[field]) ? stored[field] : []).map((e) => e?.name).filter((n) => typeof n === "string" && !named2.has(n));
+    if (kept.length === 0) continue;
+    out.push(
+      `${field}: the delta left out ${kept.map((n) => `"${n}"`).join(", ")}, and a list delta upserts \u2014 what it leaves out is kept, never removed. To remove one, name it with a delete marker: {"${field}": [{"name": "${kept[0]}", "action": "delete"}]}.`
+    );
+  }
+  return out;
+}
+var PATH_SAFE_SEGMENT = /^[A-Za-z0-9_-]+$/;
+function pathSafeIdProblem(id) {
+  if (typeof id !== "string" || id === "") return "it is empty";
+  const segments = id.split("::");
+  const named2 = id.startsWith("::") ? segments.slice(1) : segments;
+  const bad = named2.find((s) => !PATH_SAFE_SEGMENT.test(s));
+  if (bad === void 0) return null;
+  if (/[\\/]/.test(bad)) return `"${bad}" holds a path separator`;
+  if (bad === "") return "it has an empty segment";
+  if (/^\.+$/.test(bad) || bad.includes(".")) return `"${bad}" holds a dot`;
+  return `"${bad}" holds a character outside letters, digits, "-" and "_"`;
+}
+function assertPathSafe(id, what) {
+  const problem = pathSafeIdProblem(id);
+  if (problem !== null) {
+    throw new Error(`not-an-id: the ${what} id "${id}" cannot name a spec \u2014 ${problem}. An id becomes a folder or a file name, so it is a plain id (letters, digits, "-" and "_", qualified by "::"), never a path. Nothing was written.`);
+  }
+}
+function storedUnder(storedId, askedId) {
+  return typeof storedId !== "string" || storedId === askedId.split("::").pop();
+}
 function computeSpecTreeSignature(dirs, files = []) {
   const parts = [];
   for (const f of files) {
@@ -41806,10 +42516,117 @@ var SpecWorkspace = class {
     const mapped = mapSpecReferences(kind, spec, (position, value) => position === "signatureFrom" && !components.has(value) ? value : this.writeReference(from, spec.id, position, value, carrying));
     return { ...mapped, id: localOf(from, spec.id).split("::").pop() };
   }
+  /**
+   * The keys an `alias::name` read lands on when no spec holds the id as
+   * written: the id bound through the bound project's alias table as a write
+   * binds it (a public name to the member's key), and the member's own key for
+   * a name it does not export — so a read resolves the form the guide
+   * prescribes exactly as a write resolves it to refuse. None for a bare id.
+   */
+  aliasedReadKeys(id) {
+    if (!id.includes("::") || pathSafeIdProblem(id) !== null) return [];
+    const out = [];
+    try {
+      const bound2 = this.bindReference("", id);
+      if (bound2 !== id) out.push(bound2);
+    } catch {
+    }
+    const at = id.indexOf("::");
+    const namespace = this.cachedRawRoots[0]?.record.aliases.get(id.slice(0, at));
+    if (namespace !== void 0 && namespace !== "" && this.rootCovering(namespace) !== null) out.push(`${namespace}::${id.slice(at + 2)}`);
+    return [...new Set(out)];
+  }
+  /**
+   * The references a delta writes in ANOTHER TEXT than the stored spec holds
+   * at the same position while both bind to one target (core_orchestrator
+   * updateSpec step 14): the stored file's authored texts read per position,
+   * the delta's read the same way, and a delta text the position does not hold
+   * whose binding equals a stored text's binding is a respelling of it.
+   */
+  referenceRespellingsOf(kind, id, delta) {
+    if (kind === "system") return [];
+    const file = this.storedFileOf(kind, id);
+    if (!file || !pathExists(file)) return [];
+    let stored;
+    try {
+      stored = JSON.parse(JSON.stringify(readSpecFile(file)));
+    } catch {
+      return [];
+    }
+    const held = /* @__PURE__ */ new Map();
+    respellStoredReferences(kind, stored, (position, value) => {
+      held.set(position, (held.get(position) ?? /* @__PURE__ */ new Set()).add(value));
+      return value;
+    });
+    const written = [];
+    respellStoredReferences(kind, JSON.parse(JSON.stringify(delta)), (position, value) => {
+      written.push({ position, value });
+      return value;
+    });
+    const prefix = this.writePrefixFor(id);
+    const bind = (value) => {
+      try {
+        return this.bindReference(prefix, value);
+      } catch {
+        return value;
+      }
+    };
+    const out = [];
+    for (const w of written) {
+      const texts = held.get(w.position);
+      if (!texts || texts.has(w.value)) continue;
+      const target = bind(w.value);
+      const from = [...texts].find((s) => s !== w.value && bind(s) === target);
+      if (from !== void 0 && !out.some((o) => o.position === w.position && o.from === from)) out.push({ position: w.position, from, to: w.value });
+    }
+    return out;
+  }
+  /**
+   * spec_loader.readPinnedSpec — an EXTERNAL's spec read by `alias::name` from
+   * the pinned snapshot the bound project holds of it: the contract entry (a
+   * component or an interface asked for, or no kind) or the exported type (a
+   * type). Null when the alias is no declared external (a member's alias is
+   * read under its key instead), its pin is absent or unreadable, or the pin
+   * holds no such public name. Read-only, never cached.
+   */
+  readPinnedSpec(kind, id) {
+    const at = id.indexOf("::");
+    const pin2 = at > 0 ? this.pinnedSnapshotOf(id.slice(0, at)) : null;
+    if (!pin2) return null;
+    const name = id.slice(at + 2);
+    const entry = kind === "type" ? void 0 : pin2.snapshot.interfaces.find((e) => e.id === name);
+    if (entry) return { ...pin2.base, kind: "interface", id: name, spec: entry };
+    const definition = kind === void 0 || kind === "type" ? pinnedTypeDefinition(pin2.snapshot, name) : void 0;
+    return definition ? { ...pin2.base, kind: "type", id: name, spec: definition } : null;
+  }
+  /** The pinned snapshot of the bound project's external `alias` — none for a member's alias, an undeclared one, or an absent or unreadable pin. */
+  pinnedSnapshotOf(alias) {
+    this.scanAll();
+    const root = this.cachedRawRoots[0];
+    const config = root?.record.config;
+    if (!root || !config || root.record.aliases.has(alias)) return null;
+    const declared = declaredExternals(config).find((d) => d.alias === alias && !d.problem);
+    const file = path23.join(aiPathsAt(root.dir).root(), "externals", `${alias}.yaml`);
+    if (!declared || !pathExists(file)) return null;
+    try {
+      const snapshot = SurfaceSnapshotSchema.parse(readSpecFile(file));
+      const rel2 = path23.relative(root.dir, file).split(path23.sep).join("/");
+      return { snapshot, base: { alias, project: declared.project, file: rel2, ...snapshot.stateId !== void 0 ? { stateId: snapshot.stateId } : {} } };
+    } catch {
+      return null;
+    }
+  }
   // -------------------------------------------------------------------------
   // Path builders
+  //
+  // Every id a path is built from must be path-safe FIRST: a subsystem, a
+  // component, a contract, an implementation or a type id becomes a folder or
+  // a file name, and one carrying a separator or a `..` segment would build a
+  // path out of the tree — into another project's specs. Refused here, before
+  // any path exists, whichever write asked.
   // -------------------------------------------------------------------------
   getSubsystemPath(id) {
+    assertPathSafe(id, "subsystem");
     const index = this.scanAll();
     if (index.paths.subsystem[id]) {
       return index.paths.subsystem[id];
@@ -41834,6 +42651,8 @@ var SpecWorkspace = class {
     return path23.join(this.paths.specsDir(), id, ".index.yaml");
   }
   getComponentPath(id, subsystemId) {
+    assertPathSafe(id, "component");
+    if (subsystemId !== void 0) assertPathSafe(subsystemId, "subsystem");
     const index = this.scanAll();
     if (index.paths.component[id]) {
       return index.paths.component[id];
@@ -41868,6 +42687,8 @@ var SpecWorkspace = class {
     return path23.join(this.paths.specsDir(), targetSubsystem, id, ".index.yaml");
   }
   getInterfacePath(id, componentId) {
+    assertPathSafe(id, "interface");
+    if (componentId !== void 0) assertPathSafe(componentId, "component");
     const index = this.scanAll();
     if (index.paths.interface[id]) {
       return index.paths.interface[id];
@@ -41903,6 +42724,8 @@ var SpecWorkspace = class {
     return path23.join(this.paths.specsDir(), "default", targetComponent2, ".interface.yaml");
   }
   getImplementationPath(id, contractId) {
+    assertPathSafe(id, "implementation");
+    if (contractId !== void 0) assertPathSafe(contractId, "interface");
     const index = this.scanAll();
     if (index.paths.implementation[id]) {
       return index.paths.implementation[id];
@@ -41938,6 +42761,9 @@ var SpecWorkspace = class {
     return path23.join(this.paths.specsDir(), "default", targetContract, ".implementation.yaml");
   }
   getTypePath(id, subsystemId, group) {
+    assertPathSafe(id, "type");
+    if (subsystemId !== void 0 && subsystemId !== "") assertPathSafe(subsystemId, "subsystem");
+    if (group !== void 0 && group !== "") assertPathSafe(group, "group");
     const index = this.scanAll();
     if (index.paths.type[id]) return index.paths.type[id];
     if (id.includes("::")) {
@@ -42080,11 +42906,15 @@ var SpecWorkspace = class {
     const index = this.scanAll();
     const cached = index.subsystems.find((s) => s.id === id);
     if (cached) return cached;
+    const aliased = this.aliasedReadKeys(id).map((key2) => index.subsystems.find((s) => s.id === key2)).find((s) => s !== void 0);
+    if (aliased) return aliased;
+    if (pathSafeIdProblem(id) !== null) return null;
     const p = this.getSubsystemPath(id);
     if (!pathExists(p)) return null;
     try {
       const raw = readSpecFile(p);
-      return SubsystemSpecSchema.parse(raw);
+      const parsed = SubsystemSpecSchema.parse(raw);
+      return storedUnder(parsed.id, id) ? parsed : null;
     } catch (e) {
       this.loaderIssues.push({
         severity: "error",
@@ -42252,10 +43082,14 @@ var SpecWorkspace = class {
     const index = this.scanAll();
     const spec = index.components.find((c) => c.id === id);
     if (spec) return spec;
+    const aliased = this.aliasedReadKeys(id).map((key2) => index.components.find((c) => c.id === key2)).find((c) => c !== void 0);
+    if (aliased) return aliased;
+    if (pathSafeIdProblem(id) !== null) return null;
     const p = this.getComponentPath(id);
     if (!pathExists(p)) return null;
     try {
       const raw = readSpecFile(p);
+      if (!storedUnder(raw.id, id)) return null;
       readRetiredReachForms("component", raw);
       return attachRetiredMounts(ComponentSpecSchema.parse(raw), raw);
     } catch (e) {
@@ -42355,10 +43189,14 @@ var SpecWorkspace = class {
     const index = this.scanAll();
     const spec = index.interfaces.find((i) => i.id === id);
     if (spec) return spec;
+    const aliased = this.aliasedReadKeys(id).map((key2) => index.interfaces.find((i) => i.id === key2)).find((i) => i !== void 0);
+    if (aliased) return aliased;
+    if (pathSafeIdProblem(id) !== null) return null;
     const p = this.getInterfacePath(id);
     if (!pathExists(p)) return null;
     try {
       const raw = readSpecFile(p);
+      if (!storedUnder(raw.id, id)) return null;
       const owner = typeof raw.component === "string" ? index.components.find((c) => c.id === raw.component) : void 0;
       readRetiredReachForms("interface", raw, owner?.componentType === "Portal");
       return resolveTree([interfaceCanonicalTypes(InterfaceSpecSchema.parse(raw)).spec], index.components, index.types).interfaces[0];
@@ -42454,10 +43292,14 @@ var SpecWorkspace = class {
     const index = this.scanAll();
     const spec = index.implementations.find((impl) => impl.id === id);
     if (spec) return spec;
+    const aliased = this.aliasedReadKeys(id).map((key2) => index.implementations.find((impl) => impl.id === key2)).find((impl) => impl !== void 0);
+    if (aliased) return aliased;
+    if (pathSafeIdProblem(id) !== null) return null;
     const p = this.getImplementationPath(id);
     if (!pathExists(p)) return null;
     try {
       const raw = readSpecFile(p);
+      if (!storedUnder(raw.id, id)) return null;
       return ImplementationSpecSchema.parse(raw);
     } catch (e) {
       this.loaderIssues.push({
@@ -42507,7 +43349,8 @@ var SpecWorkspace = class {
     return this.scanAll().types;
   }
   loadTypeSpec(id) {
-    return this.scanAll().types.find((t) => t.id === id) ?? null;
+    const types = this.scanAll().types;
+    return types.find((t) => t.id === id) ?? this.aliasedReadKeys(id).map((key2) => types.find((t) => t.id === key2)).find((t) => t !== void 0) ?? null;
   }
   /**
    * Returns non-fatal placement notices (empty when there is nothing to
@@ -43720,6 +44563,8 @@ var SpecWorkspace = class {
           res.dispatch = inDeltaOrder(key2, existing.dispatch, value, mergeKeyedArray(existing.dispatch, value, (b) => String(b?.capability)));
         } else if (key2 === "lifecycle" && Array.isArray(value) && Array.isArray(existing.lifecycle)) {
           res.lifecycle = inDeltaOrder(key2, existing.lifecycle, value, mergeKeyedArray(existing.lifecycle, value, (le) => `${le?.phase} ${le?.component} ${le?.method}`));
+        } else if (kind === "implementation" && delta2 === qualifiedDelta && REPLACED_LINKAGE_LISTS.has(key2) && Array.isArray(value) && !value.some(isValueMarker)) {
+          res[key2] = value;
         } else if (Array.isArray(value) && isPlainValueList(key2, existing[key2], value)) {
           res[key2] = inDeltaOrder(key2, existing[key2] ?? [], value, mergePlainValues(key2, existing[key2] ?? [], value));
         } else if (Array.isArray(value) && value.length > 0 && Array.isArray(existing[key2]) && isIdentifiedArray(key2, existing[key2], value)) {
@@ -43820,12 +44665,14 @@ var SpecWorkspace = class {
     const canonicalStored = canonical3(storedBefore);
     const canonicalMerged = canonical3(mergedResult);
     const changes = specChanges(canonicalStored, canonicalMerged);
+    const referenceRespellings = this.referenceRespellingsOf(kind, id, mergeableDelta);
+    for (const r of referenceRespellings) changes.push({ path: respelledField(kind, r.position), change: "set", before: r.from, after: r.to });
     const ineffective = ineffectiveDeltaPaths(
       { ...qualifiedDelta, ...unsetFields.length ? { unset: unsetFields } : {} },
       canonicalMerged,
       canonicalStored,
       respellings
-    );
+    ).filter((line) => !referenceRespellings.some((r) => line.startsWith(respelledField(kind, r.position)) && line.includes("already held")));
     if (changes.length === 0) {
       return {
         kind,
@@ -43834,7 +44681,7 @@ var SpecWorkspace = class {
         dryRun,
         changes,
         ineffective,
-        notices,
+        notices: [...notices, ...omittedListNotices(kind, storedBefore, mergeableDelta)],
         respellings: [],
         testsToRevisit: [],
         summary: `No change to ${kind} "${id}" \u2014 the delta matches what is stored, so nothing ${dryRun ? "would be" : "was"} written.`
@@ -43864,6 +44711,9 @@ var SpecWorkspace = class {
       allowStatusDemotion: Object.prototype.hasOwnProperty.call(delta, "status")
     };
     notices.push(...this.saveOfKind(kind, mergedResult, opts));
+    if (referenceRespellings.length > 0) {
+      this.respellReferences(kind, id, referenceRespellings.map((r) => ({ kind, specId: id, position: r.position, from: r.from, to: r.to })));
+    }
     return {
       kind,
       id,
@@ -44527,6 +45377,23 @@ function registryInvalidateCache() {
 function invalidateSpecCache() {
   registryInvalidateCache();
 }
+function registryLockSpecTree() {
+  lockTree(getProjectRoot());
+  for (const ws of workspaces.values()) ws.expireFreshness();
+}
+function lockTree2() {
+  registryLockSpecTree();
+}
+function pinnedTypeDefinition(snapshot, name) {
+  const exported = (snapshot.exportedTypes ?? []).find((t) => t.id === name);
+  return exported ? snapshot.types.find((t) => t.id === exported.type) : void 0;
+}
+function readPinnedSpec(kind, id) {
+  return current().readPinnedSpec(kind, id);
+}
+function unlockTree2() {
+  unlockTree(getProjectRoot());
+}
 function getLoaderIssues() {
   return current().loaderIssues;
 }
@@ -45006,9 +45873,49 @@ function listConsumers(search) {
   const bound2 = path25.resolve(getProjectRoot());
   const { top } = climb(bound2);
   const family = familyConsumers(bound2, top);
-  const seen = new Set(family.map((c) => dirKey(c.directory)));
-  const found = searchedConsumers(bound2, search ?? []).filter((c) => !seen.has(dirKey(c.directory)));
-  return [...family, ...found];
+  const seen = new Set([bound2, top, ...family.map((c) => c.directory)].map(dirKey));
+  const parents = composingParents(bound2, top, seen);
+  for (const c of parents) seen.add(dirKey(c.directory));
+  const found = searchedConsumers(bound2, search ?? [], seen).filter((c) => !seen.has(dirKey(c.directory)));
+  return [...family, ...parents, ...found];
+}
+function composesByPath(config, root, bound2) {
+  return declaredMembers(config).some((m) => !m.problem && m.source.path !== void 0 && m.source.path.trim() !== "" && dirKey(path25.resolve(root, m.source.path)) === dirKey(bound2));
+}
+function composingParents(bound2, top, seen) {
+  if (getHostedLookup() !== null) return [];
+  const reach2 = getRequestParentReach();
+  if (reach2 && !reach2.parentReach) return [];
+  const folders = [...new Set([path25.dirname(top), path25.dirname(bound2)].map((d) => path25.resolve(d)))];
+  const out = [];
+  for (const root of [...new Set(folders.flatMap(enclosedRoots).map((r) => path25.resolve(r)))]) {
+    if (seen.has(dirKey(root)) || out.some((c) => dirKey(c.directory) === dirKey(root))) continue;
+    const config = membersConfigAt(root);
+    if (!config || !composesByPath(config, root, bound2)) continue;
+    out.push(...familyConsumers(bound2, root).filter((c) => !seen.has(dirKey(c.directory))));
+  }
+  return out;
+}
+var ENCLOSING_FOLDER_LIMIT = 256;
+function enclosedRoots(folder) {
+  let entries;
+  try {
+    entries = fs17.readdirSync(folder, { withFileTypes: true }).filter((d) => d.isDirectory() && !d.name.startsWith(".") && d.name !== "node_modules");
+  } catch {
+    return [];
+  }
+  if (entries.length > ENCLOSING_FOLDER_LIMIT) return [];
+  return entries.map((d) => path25.join(folder, d.name)).filter((dir) => fs17.existsSync(path25.join(dir, ".wai", "project.yaml")));
+}
+function membersConfigAt(root) {
+  try {
+    const text3 = fs17.readFileSync(path25.join(root, ".wai", "project.yaml"), "utf8");
+    if (!/^members\s*:/m.test(text3)) return null;
+    const parsed = parseYaml(text3);
+    return parsed && typeof parsed === "object" ? parsed : null;
+  } catch {
+    return null;
+  }
 }
 function familyConsumers(bound2, top) {
   return runWithProjectRoot(top, () => {
@@ -45051,7 +45958,7 @@ function projectRootsUnder(folder) {
   if (isRoot(at)) return [at];
   return fs17.readdirSync(at, { withFileTypes: true }).filter((d) => d.isDirectory() && !d.name.startsWith(".") && d.name !== "node_modules").map((d) => path25.join(at, d.name)).filter(isRoot);
 }
-function searchedConsumers(bound2, search) {
+function searchedConsumers(bound2, search, seen = /* @__PURE__ */ new Set()) {
   if (search.length === 0) return [];
   if (getHostedLookup() !== null) throw new Error("searching folders for consumers is a local read: a hosted request reads no folder outside its project");
   const producerId = runWithProjectRoot(bound2, () => {
@@ -45061,6 +45968,13 @@ function searchedConsumers(bound2, search) {
   const roots = [...new Set(search.flatMap(projectRootsUnder).map((r) => path25.resolve(r)))].filter((r) => dirKey(r) !== dirKey(bound2));
   const out = [];
   for (const root of roots) {
+    if (seen.has(dirKey(root))) continue;
+    const members = membersConfigAt(root);
+    const composing = members !== null && composesByPath(members, root, bound2);
+    if (composing) {
+      out.push(...familyConsumers(bound2, root).filter((c) => !seen.has(dirKey(c.directory))).map((c) => ({ ...c, found: "search" })));
+      continue;
+    }
     const answer = runWithProjectRoot(root, () => {
       let config;
       try {
@@ -45088,6 +46002,47 @@ function searchedConsumers(bound2, search) {
   }
   return out.sort((a, b) => a.directory < b.directory ? -1 : a.directory > b.directory ? 1 : 0);
 }
+function recordedMemberSubjects(root) {
+  try {
+    const record = JSON.parse(fs17.readFileSync(path25.join(root, ".wai", "lock.json"), "utf8"));
+    return new Map(Object.entries(record.members ?? {}).filter(([, m]) => typeof m?.subject === "string").map(([alias, m]) => [alias, m.subject]));
+  } catch {
+    return /* @__PURE__ */ new Map();
+  }
+}
+function memberRevisions() {
+  if (getHostedLookup() !== null) return [];
+  const bound2 = path25.resolve(getProjectRoot());
+  const family = graph();
+  const own2 = consumerNode(family, bound2);
+  if (!own2) return [];
+  const subjects = recordedMemberSubjects(bound2);
+  const out = [];
+  for (const node of family.nodes) {
+    if (node.parent !== own2.namespace || node === own2 || node.mountAlias === void 0) continue;
+    const alias = node.mountAlias;
+    const usage = exportUsage(own2.namespace, node.namespace);
+    const entry = { alias, project: node.id ?? node.namespace, root: node.directory, usage };
+    const repo = repositoryRoot(node.directory);
+    if (repo) {
+      const lockPath3 = path25.join(".wai", "lock.json");
+      const subject = subjects.get(alias);
+      const digest3 = subject?.slice(subject.lastIndexOf(":") + 1);
+      const recorded = digest3 ? commitIntroducing(node.directory, lockPath3, digest3) : null;
+      const commit2 = recorded ?? lastCommitOf(node.directory, lockPath3);
+      if (commit2) {
+        try {
+          const relative27 = path25.relative(repo, node.directory);
+          const directory = fetch(repo, commit2, relative27 === "" ? void 0 : relative27);
+          entry.revision = { directory, commit: commit2, label: recorded ? `the approval this project's lock records for it (${commit2.slice(0, 12)})` : `its own last committed approval (${commit2.slice(0, 12)})` };
+        } catch {
+        }
+      }
+    }
+    out.push(entry);
+  }
+  return out;
+}
 function approvedRevision(against) {
   const bound2 = path25.resolve(getProjectRoot());
   const repo = repositoryRoot(bound2);
@@ -46704,6 +47659,19 @@ function moveMemberSpecs(scan2, remap) {
     });
   }
   const rewritten = rewriteRefFields(parentSpecsDir, remap);
+  for (const file of listFilesRecursive(parentSpecsDir, ".yaml")) {
+    let raw;
+    try {
+      raw = readYamlFile(file);
+    } catch {
+      continue;
+    }
+    const kind = raw && typeof raw === "object" ? specKind(raw) : void 0;
+    if (!kind || !respellTypeTokens(raw, remap)) continue;
+    writeYamlFile(file, raw);
+    const id = kind === "system" ? "system" : String(raw.id);
+    if (!rewritten.some((s) => s.kind === kind && s.id === id)) rewritten.push({ kind, id });
+  }
   invalidateSpecCache();
   return rewritten;
 }
@@ -47253,6 +48221,8 @@ function patchSubsystemIndex(indexPath, mutate) {
   writeYamlFile(indexPath, raw);
 }
 function renameComponent(componentId, newId, dryRun) {
+  const foreign = foreignIdRefusal(componentId, "chained-component", "rename it", `sdd_rename_component ${componentId.slice(componentId.lastIndexOf("::") + 2)} <new id>`);
+  if (foreign !== null) throw new WaironError(foreign);
   const component = loadComponentSpec(componentId);
   if (!component) {
     throw new WaironError(`component-missing: no component has the id "${componentId}".`);
@@ -47439,6 +48409,8 @@ function renameSpecId(kind, id, newId, dryRun) {
     const owner = kind === "component" ? "sdd_rename_component" : kind === "type" ? "sdd_rename_type" : "no tool yet";
     throw new WaironError(`invalid-kind: sdd_rename_spec renames a contract (kind interface) or an implementation on its own; a ${kind} is renamed with ${owner}.`);
   }
+  const foreign = foreignIdRefusal(id, "chained-spec", "rename it", `sdd_rename_spec ${kind} ${id.slice(id.lastIndexOf("::") + 2)} <new id>`);
+  if (foreign !== null) throw new WaironError(foreign);
   const spec = kind === "interface" ? loadInterfaceSpec(id) : loadImplementationSpec(id);
   if (!spec) throw new WaironError(`spec-missing: no ${kind} has the id "${id}".`);
   if (id.includes("::")) {
@@ -47595,11 +48567,11 @@ function moveTypeSpec(id, target, subsystems, dryRun) {
   if (target === void 0 && exportsMoving.length + repointed.length > 0) {
     throw new WaironError(`exported: subsystem "${from}" exports type "${bare2}" (${exportsMoving.length + repointed.length} entr${exportsMoving.length + repointed.length === 1 ? "y" : "ies"}), and a system-level type is published by the L0 alone \u2014 move its export entries to the L0 first, or move the type to another subsystem.`);
   }
-  const oldToken = from ? `${from}::${bare2}` : void 0;
-  const newToken = target ? `${target}::${bare2}` : bare2;
+  const ownId = effectiveProjectId(projectConfigRepository.load() ?? { name: loadSystemSpec()?.name ?? "" });
+  const moveToken = movedTypeToken(from, bare2, target, ownId);
   const specsDir = aiPathsAt(getProjectRoot()).specsDir();
   const rewriteAll2 = (write6) => {
-    if (oldToken === void 0) return [];
+    if (from === "") return [];
     const out = [];
     for (const file of listFilesRecursive(specsDir, ".yaml")) {
       let raw;
@@ -47609,7 +48581,7 @@ function moveTypeSpec(id, target, subsystems, dryRun) {
         continue;
       }
       const kind = raw && typeof raw === "object" ? specKind(raw) : void 0;
-      if (!kind || !respellQualifiedType(raw, oldToken, newToken)) continue;
+      if (!kind || !respellTypeTokens(raw, moveToken)) continue;
       if (write6) writeYamlFile(file, raw);
       out.push({ kind, id: kind === "system" ? "system" : String(raw.id) });
     }
@@ -47656,22 +48628,33 @@ function moveTypeSpec(id, target, subsystems, dryRun) {
   return report3;
 }
 var TYPE_POSITION_KEYS = /* @__PURE__ */ new Set(["type", "returns", "signature", "signatureFrom", "typeDef", "references", "linkedEntity", "holds"]);
-function respellQualifiedType(raw, oldToken, newToken) {
+var QUALIFIED_TYPE_TOKEN = /(^|[^A-Za-z0-9_:.-])((?:::)?[A-Za-z0-9_][A-Za-z0-9_-]*(?:(?:::|\.)[A-Za-z0-9_][A-Za-z0-9_-]*)+)/g;
+function respellTypeTokens(raw, map) {
   let changed = false;
-  const escaped = oldToken.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const respell = (value) => value.replace(QUALIFIED_TYPE_TOKEN, (_m, lead, token) => `${lead}${map(token)}`);
   const walk2 = (node) => {
     if (Array.isArray(node)) {
       node.forEach(walk2);
       return;
     }
     if (!node || typeof node !== "object") return;
-    for (const [key2, value] of Object.entries(node)) {
+    const holder = node;
+    for (const [key2, value] of Object.entries(holder)) {
       if (typeof value === "string" && TYPE_POSITION_KEYS.has(key2)) {
-        const next = value.replace(new RegExp(`(?<![A-Za-z0-9_:-])${escaped}(?![A-Za-z0-9_-])`, "g"), newToken);
+        const next = respell(value);
         if (next !== value) {
-          node[key2] = next;
+          holder[key2] = next;
           changed = true;
         }
+      } else if (key2 === "assertsInvariants" && Array.isArray(value)) {
+        value.forEach((ref, i) => {
+          if (typeof ref !== "string") return;
+          const next = respell(ref);
+          if (next !== ref) {
+            value[i] = next;
+            changed = true;
+          }
+        });
       } else if (value && typeof value === "object" && key2 !== "previousIds" && key2 !== "previousNames") {
         walk2(value);
       }
@@ -47680,6 +48663,23 @@ function respellQualifiedType(raw, oldToken, newToken) {
   walk2(raw);
   return changed;
 }
+function movedTypeToken(from, bare2, target, ownId) {
+  return (token) => {
+    const lead = token.startsWith("::") ? "::" : "";
+    const parts = token.slice(lead.length).split(/(::|\.)/);
+    const segment = (i) => parts[2 * i];
+    const count = (parts.length + 1) / 2;
+    for (let i = 0; i + 1 < count && i <= 1; i++) {
+      if (nameKey(segment(i)) !== nameKey(from) || nameKey(segment(i + 1)) !== nameKey(bare2)) continue;
+      if (i === 1 && (lead !== "" || ownId === null || nameKey(segment(0)) !== nameKey(ownId))) continue;
+      const next = [...parts];
+      if (target !== void 0) next[2 * i] = target;
+      else next.splice(2 * i, 2);
+      return `${lead}${next.join("")}`;
+    }
+    return token;
+  };
+}
 function publishedUsesOf(removed, methods) {
   const contracts = loadInterfaceSpecs();
   const uses = [];
@@ -47748,7 +48748,16 @@ var PROSE_FIELDS2 = /* @__PURE__ */ new Set([
   "note",
   "caller"
 ]);
+function shouldPinSymbol(implementation, methodName, pinSymbol) {
+  const realization = implementation.methods.find((m) => m.name === methodName);
+  if (!realization || realization.symbol !== void 0 || pinSymbol === false) return false;
+  if (pinSymbol === true) return true;
+  const file = realization.sourcePath ?? implementation.sourcePath;
+  return file !== void 0 && file !== "" && fs19.existsSync(path27.resolve(getProjectRoot(), file));
+}
 function renameMethod(componentId, methodName, newName, pinSymbol, dryRun) {
+  const foreign = foreignIdRefusal(componentId, "chained-component", "rename its method", `sdd_rename_method ${componentId.slice(componentId.lastIndexOf("::") + 2)} <method> <new name>`);
+  if (foreign !== null) throw new WaironError(foreign);
   const component = loadComponentSpec(componentId);
   if (!component) {
     throw new WaironError(`component-missing: no component has the id "${componentId}".`);
@@ -47809,7 +48818,7 @@ function renameMethod(componentId, methodName, newName, pinSymbol, dryRun) {
   );
   if (dryRun) {
     const realizing = implementations.filter((impl) => movingContracts.has(impl.contract) && impl.methods.some((m) => m.name === methodName));
-    const wouldPin = pinSymbol !== false && realizing.some((impl) => impl.methods.find((m) => m.name === methodName)?.symbol === void 0);
+    const wouldPin = realizing.some((impl) => shouldPinSymbol(impl, methodName, pinSymbol));
     const wouldRewrite = [...rewriteRefFields(reachDir, methodRemap, void 0, true), ...rekeyLintAllows(reachDir, rename, true)];
     return {
       component: componentId,
@@ -47841,7 +48850,7 @@ function renameMethod(componentId, methodName, newName, pinSymbol, dryRun) {
     if (!movingContracts.has(implementation.contract)) continue;
     const realization = implementation.methods.find((m) => m.name === methodName);
     if (!realization) continue;
-    const pin2 = realization.symbol === void 0 && pinSymbol !== false;
+    const pin2 = shouldPinSymbol(implementation, methodName, pinSymbol);
     if (pin2) pinnedSymbol = methodName;
     saveImplementationSpec({
       ...implementation,
@@ -47935,15 +48944,29 @@ function respellLike(written, oldId, newId) {
   return /^[A-Z]/.test(written) ? pascal(newId) : newId;
 }
 function memberRootWay(qualifiedId, call) {
+  return projectRootWay(qualifiedId, call) ?? `It belongs to the member project "${qualifiedId.slice(0, qualifiedId.indexOf("::"))}": open a session in that folder (its own guide and .mcp.json \u2014 run \`wairon generate\` and \`wairon mcp install --backend claude\` there first if it has none) and call ${call} there.`;
+}
+function projectRootWay(qualifiedId, call) {
   const alias = qualifiedId.slice(0, qualifiedId.indexOf("::"));
-  let folder;
   try {
     const node = graph().nodes.find((n) => n.namespace === alias || n.parent === "" && n.mountAlias === alias);
-    if (node) folder = path27.relative(getProjectRoot(), node.directory).split(path27.sep).join("/") || ".";
+    if (node) {
+      const folder = path27.relative(getProjectRoot(), node.directory).split(path27.sep).join("/") || ".";
+      return `It belongs to the member project "${node.id ?? alias}" at ${folder}: open a session in that folder (its own guide and .mcp.json \u2014 run \`wairon generate\` and \`wairon mcp install --backend claude\` there first if it has none) and call ${call} there.`;
+    }
   } catch {
   }
-  const where = folder ? `the member project "${alias}" at ${folder}` : `the member project "${alias}"`;
-  return `It belongs to ${where}: open a session in that folder (its own guide and .mcp.json \u2014 run \`wairon generate\` and \`wairon mcp install --backend claude\` there first if it has none) and call ${call} there.`;
+  const external = ownGet(projectConfigRepository.load()?.externals, alias);
+  if (external !== void 0) {
+    const producer = external?.project ?? alias;
+    return `"${alias}" is the external "${producer}", a project this one only reads through its pin: a project's specs are written from its own root \u2014 open a session in that project's folder and call ${call} there.`;
+  }
+  return null;
+}
+function foreignIdRefusal(id, code, doing, call) {
+  if (!id.includes("::")) return null;
+  const way = projectRootWay(id, call);
+  return way === null ? null : `${code}: "${id}" lives in another project; ${doing} from that project's own root. ${way}`;
 }
 function renameType(typeId, newId, dryRun) {
   const all = loadTypeSpecs();
@@ -48219,6 +49242,8 @@ function publishedCarriers(type) {
   return mergeUses([...out.values()]);
 }
 function renameParam(componentId, methodName, param, newName, dryRun) {
+  const foreign = foreignIdRefusal(componentId, "chained-component", "rename its parameter", `sdd_rename_param ${componentId.slice(componentId.lastIndexOf("::") + 2)} ${methodName} ${param} <new name>`);
+  if (foreign !== null) throw new WaironError(foreign);
   const component = loadComponentSpec(componentId);
   if (!component) throw new WaironError(`component-missing: no component has the id "${componentId}".`);
   if (componentId.includes("::")) {
@@ -48557,8 +49582,8 @@ function walkForPackages(projectRoot, currentDir, depth, results) {
   }
 }
 function pathToId(relPath) {
-  const basename15 = path28.basename(relPath);
-  return basename15.toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
+  const basename16 = path28.basename(relPath);
+  return basename16.toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
 }
 function pathToName(relPath) {
   const id = pathToId(relPath);
@@ -49211,7 +50236,10 @@ function resolveLayer(delegate, implementers = false) {
         if (owners.size === 1 && owners.has(comp.id)) add2(file);
       }
       for (const type of types.filter((t) => t.componentClass === comp.id && t.subsystem === comp.subsystem)) {
-        for (const file of typeSourceFiles(type)) add2(file);
+        for (const file of typeSourceFiles(type)) {
+          const owners = claims.get(file);
+          if (!owners || [...owners].every((o) => o === comp.id)) add2(file);
+        }
       }
       const namesAny = compImpls.some((impl) => codeLocationsOf(impl).length > 0);
       if (ownedPaths.length === 0 && !namesAny) {
@@ -49252,6 +50280,14 @@ function resolveLayer(delegate, implementers = false) {
         updatedAt: comp.updatedAt
       });
     }
+    const implementerRecords = agents.filter((a) => a.template === "implementer");
+    const fencedBy = /* @__PURE__ */ new Map();
+    for (const r of implementerRecords) for (const p of r.ownedPaths) fencedBy.set(p, (fencedBy.get(p) ?? 0) + 1);
+    for (const r of implementerRecords) {
+      if (!r.ownedPaths.some((p) => (fencedBy.get(p) ?? 0) > 1)) continue;
+      r.ownedPaths = r.ownedPaths.filter((p) => (fencedBy.get(p) ?? 0) <= 1);
+      r.writePaths = r.ownedPaths;
+    }
   }
   const now = (/* @__PURE__ */ new Date()).toISOString();
   for (const dom of loadConfig().domains) {
@@ -49316,7 +50352,7 @@ function composeAgentBrief(agentId) {
 ${codeFence.map(shown2).join("\n")}
 ` : sharedPaths.length > 0 && namesAnyCode(record) ? "Every file this agent's specs name is named by another component's specs too, so none is this agent's alone: they are listed as shared below.\n" : "No spec names a code location yet, so no code location is declared. The spawning session should declare the planned `sourcePath` on the implementation now \u2014 it is code linkage, not part of the approval, so declaring it costs no re-lock \u2014 and that file is then this agent's fence.\n";
     const sharedSection = sharedPaths.length > 0 ? `
-Shared, owned by no single agent \u2014 create or extend these only for what this component needs (an import, a wiring line, a module setting), and name each one you touch in your report. A shared type file is created at its planned home exactly as its spec declares it, never redeclared in your own file:
+Shared, owned by no single agent \u2014 create or extend these only for what this component needs (an import, a wiring line, a module setting), and name each one you touch in your report. A shared type file is created at its planned home exactly as its spec declares it, never redeclared in your own file. A module root listed here (\`mod.rs\`, \`index.ts\`, \`__init__.py\`) may be another agent's file: add only the line that declares or re-exports your module:
 
 ${sharedPaths.map(shown2).join("\n")}
 ` : "";
@@ -49326,6 +50362,9 @@ ${sharedPaths.map(shown2).join("\n")}
 ## Code write fence
 
 ${ownSection}${sharedSection}${rule}`;
+    instructions = `${instructions.trimEnd()}
+
+${linkageSection(record)}`;
   }
   const guidance = loadAgentOverride(agentId);
   if (guidance !== null) {
@@ -49352,9 +50391,15 @@ ${typeMapping.map((line) => `- ${line}`).join("\n")}
   let readPaths = record.readPaths;
   if (externals.length > 0) {
     const bindings = bindingModulesOf2(record);
+    const membersOnly = externals.every((e) => e.member);
+    const pinsOnly = externals.every((e) => !e.member);
+    const source = membersOnly ? "the member's live L0 export table names them now" : pinsOnly ? "the pin has them" : "the pin has them (for a member, as its live L0 export table names them now)";
+    const comparedWith = membersOnly ? "that table" : pinsOnly ? "the pin" : "the pin or the table";
     const bindingNote = bindings.length > 0 ? `
-The binding modules these implementations name are the one place the code spells the producer's names \u2014 keep them exactly as the pin has them (\`validate\` compares them with it and reports a stale name, parameter or field as BINDING_DRIFT, with the rename to follow): ${bindings.map((b) => `\`${b}\``).join(", ")}.
-` : "\nWhen the code reaches a producer through a hand-written binding module (a typed binding to a native library, a client stub), name it on the implementation as `bindings` \u2014 code linkage, no re-lock \u2014 so `validate` compares it with the pin.\n";
+The binding modules these implementations name are the one place the code spells the producer's names \u2014 keep them exactly as ${source} (\`validate\` compares them with it and reports a stale name, parameter or field as BINDING_DRIFT, with the rename to follow): ${bindings.map((b) => `\`${b}\``).join(", ")}.
+` : `
+When the code reaches a producer through a hand-written binding module (a typed binding to a native library, a client stub), name it on the implementation as \`bindings\` \u2014 code linkage, no re-lock \u2014 so \`validate\` compares it with ${comparedWith}.
+`;
     instructions = `${instructions.trimEnd()}
 
 ## Externals used
@@ -49511,6 +50556,23 @@ var SHARED_SETUP_FILES = [
 var SHARED_ROOT_FILES = ["index.ts", "index.js", "lib.rs", "main.rs", "mod.rs", "__init__.py"];
 var SOURCE_EXTENSIONS2 = /* @__PURE__ */ new Set([".rs", ".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs", ".py", ".go", ".java", ".kt", ".cs"]);
 var MAX_UNNAMED_SIBLINGS = 8;
+function linkageSection(record) {
+  const comps = scopeComponents(record);
+  const ids = new Set(comps.map((c) => c.id));
+  const contractOwner = new Map(loadInterfaceSpecs().map((i) => [i.id, i.component]));
+  const impls = loadImplementationSpecs().filter((impl) => ids.has(contractOwner.get(impl.contract) ?? ""));
+  const parts = [];
+  if (comps.some((c) => c.componentType === "Portal")) {
+    parts.push("## Handler shape\n\nEach verb's function takes the contract's OWN parameters, in order, under the contract's names. What its framework hands it besides those \u2014 a request, a response, a context, `next` \u2014 is wiring: name it in the implementation's `injectedParams` (it matches at the start or the end of the list, with or without a leading `_`). Two honest shapes: the router unpacks the path, query and body and calls the verb with the contract's parameters; or the function gets the request alone and reads each contract parameter off it by its own name (`req.params.<name>`, `req.query.<name>`, `req.body.<name>`, `url.searchParams.get('<name>')`). A `(req, res)` handler that reads nothing by the contract's names is reported as substitutions. Set the implementation's `router` to the entry its file exports, or to a central route table (`src/routes.ts#ROUTES`). `conformance: off` is only for generated or vendored code: it switches the realization checks off, never the doctrine. The full rules: `sdd-implement`, **Handler shape** and **Routers**.\n");
+  }
+  const declared = impls.filter((impl) => (impl.injectedParams ?? []).length > 0);
+  const listed = declared.length > 0 ? ` Declared now: ${declared.map((impl) => `\`${impl.id}\`: [${(impl.injectedParams ?? []).join(", ")}]`).join("; ")}. These may be guesses written before any code existed: keep the ones your code really takes and remove the rest with \`sdd_update_spec\` (\`{"injectedParams": [{"value": "<name>", "action": "delete"}]}\`, or \`[]\` to clear) \u2014 an injection no function takes is UNUSED_INJECTED_PARAM.` : "";
+  parts.push(`## Code linkage you own
+
+\`injectedParams\` are code linkage, not design: declare them only when your code takes a parameter its framework or wiring imposes beside the contract's own (a request handle, a context), with \`sdd_write_narrative\` (\`injectedParams\`) or \`sdd_update_spec\` \u2014 no re-lock. A dependency held as a field or passed to a constructor is not one.${listed}
+`);
+  return parts.join("\n");
+}
 function namesAnyCode(record) {
   const ids = new Set(scopeComponents(record).map((c) => c.id));
   const contracts = new Set(loadInterfaceSpecs().filter((i) => ids.has(i.component)).map((i) => i.id));
@@ -49544,15 +50606,18 @@ function sharedFilesOf(record, fence) {
     const parts = folder === "." ? [] : folder.split("/");
     for (let i = 1; i <= parts.length; i++) chain.add(parts.slice(0, i).join("/"));
   }
-  const join31 = (dir, file) => dir === "." ? file : `${dir}/${file}`;
+  const join32 = (dir, file) => dir === "." ? file : `${dir}/${file}`;
   for (const dir of [...chain].sort((a, b) => a.split("/").length - b.split("/").length || a.localeCompare(b))) {
-    for (const file of SHARED_SETUP_FILES) if (fs22.existsSync(path31.join(root, dir, file))) add2(join31(dir, file));
-  }
-  for (const dir of ownFolders) {
-    for (const file of SHARED_ROOT_FILES) if (fs22.existsSync(path31.join(root, dir, file))) add2(join31(dir, file));
+    for (const file of SHARED_SETUP_FILES) if (fs22.existsSync(path31.join(root, dir, file))) add2(join32(dir, file));
   }
   const named2 = new Set(claims.keys());
   for (const type of types) for (const file of typeSourceFiles(type)) named2.add(file);
+  for (const dir of ownFolders) {
+    for (const file of SHARED_ROOT_FILES) {
+      const rootFile = join32(dir, file);
+      if (named2.has(rootFile) || fs22.existsSync(path31.join(root, dir, file))) add2(rootFile);
+    }
+  }
   let siblings = 0;
   for (const dir of ownFolders) {
     let entries = [];
@@ -49562,7 +50627,7 @@ function sharedFilesOf(record, fence) {
       continue;
     }
     for (const entry of entries.filter((e) => e.isFile()).sort((a, b) => a.name.localeCompare(b.name))) {
-      const file = join31(dir, entry.name);
+      const file = join32(dir, entry.name);
       if (siblings >= MAX_UNNAMED_SIBLINGS) break;
       if (!SOURCE_EXTENSIONS2.has(path31.extname(entry.name)) || named2.has(file) || owned.has(file) || out.includes(file)) continue;
       if (/\.(test|spec)\.[a-z]+$/.test(entry.name)) continue;
@@ -49624,7 +50689,9 @@ function externalsUsedBy(record) {
     const node = externals.has(alias) ? void 0 : memberOf(alias);
     if (node) {
       const system = path31.relative(root, path31.join(node.directory, ".wai", "specs", ".index.yaml")).replace(/\\/g, "/");
-      out.push({ alias, names: [...names].sort(), pin: system, pinned: true, bindings: /* @__PURE__ */ new Map(), member: { id: node.id ?? node.namespace, system } });
+      const publicName = memberPublicNames(path31.join(node.directory, ".wai", "specs", ".index.yaml"));
+      const spelled = [...new Set([...names].map((n) => publicName.get(n) ?? n))].sort();
+      out.push({ alias, names: spelled, pin: system, pinned: true, bindings: /* @__PURE__ */ new Map(), member: { id: node.id ?? node.namespace, system } });
       continue;
     }
     const pin2 = `.wai/externals/${alias}.yaml`;
@@ -49642,6 +50709,19 @@ function externalsUsedBy(record) {
   }
   return out;
 }
+function memberPublicNames(systemSpec) {
+  const out = /* @__PURE__ */ new Map();
+  try {
+    const doc = readYamlFile(systemSpec);
+    for (const entry of doc?.publicInterfaces ?? []) {
+      const exported = entry.as ?? entry.name;
+      const internal = entry.component ?? entry.typeDef;
+      if (internal && exported && !out.has(internal)) out.set(internal, exported);
+    }
+  } catch {
+  }
+  return out;
+}
 function bindingModulesOf2(record) {
   const ids = new Set(implementedComponents(record).map((c) => c.id));
   const contracts = new Set(loadInterfaceSpecs().filter((i) => ids.has(i.component)).map((i) => i.id));
@@ -51337,6 +52417,19 @@ function readStampVersion(content) {
 // src/utils/ai-guide.ts
 var GUIDE_MARKER_START = "<!-- wairon-guide-start -->";
 var GUIDE_MARKER_END = "<!-- wairon-guide-end -->";
+var HUMAN_COMMANDS = `### What the human runs \u2014 recommend these, never run them
+The \`wairon\` CLI is the human developer's tool: you never run it, but when the human asks for something only it does, tell them the exact command:
+- \`wairon lock\` \u2014 approve the design (then commit \`.wai/lock.json\`); \`wairon lock-check\` is the CI merge gate on that approval.
+- \`wairon validate --ci\` \u2014 the CI gate. It FAILS on any error and on any warning, except the draft-related ones (a \`DRAFT_*\` warning, or an \`UNUSED_COMPONENT\` whose component is itself still draft or design status); notices never fail it, nor do the advisory live-externals findings. Say so plainly \u2014 no run is needed to know it.
+- \`wairon surface export --format openapi --portal <portal-id> --out <file>\` \u2014 a Portal's OpenAPI document (one per Portal); \`wairon surface diff\` \u2014 the public-surface changelog since the last approval; \`wairon export\` \u2014 the whole resolved design as one JSON document.
+- \`wairon externals pin <alias>\` \u2014 re-pin an external once its uses are adapted; \`wairon externals status\` \u2014 the live compatibility gate (exit 1 incompatible, 2 not compared).
+- \`wairon network declare\` \u2014 declare this project's network boundary (your tool for it is \`sdd_set_network\`).
+- \`wairon member add | attach | detach | adopt | promote | demote | internalize | move | rename-alias | update\` \u2014 the human's twins of the member tools; their \`--report\` is your \`dryRun\`.
+- \`wairon doctor --fix\` \u2014 rewrite deprecated forms; \`wairon generate\` \u2014 refresh the generated guides, skills and context.
+- \`wairon agent customize <id>\` \u2014 scaffold \`.wai/agents/<id>.md\`, guidance folded into every brief of that agent; \`wairon agent brief <id>\` \u2014 print a live brief.
+- \`wairon status\` \u2014 readiness and approval; \`wairon diagram\` \u2014 architecture diagrams; \`wairon network flows\` \u2014 the allowed-flows matrix.`;
+var LINKAGE_FACTS = `- **\`injectedParams\` are set when the code exists, by the implementer**: never declare them at design time. They name a parameter a framework imposes on written code (a request handle, a context) beside the contract's own; the implementer declares them with \`sdd_write_narrative\` (\`injectedParams\`) or \`sdd_update_spec\` once its code takes one, and removes a design-time guess its code does not take (\`UNUSED_INJECTED_PARAM\`) the same way \u2014 code linkage, no re-lock.
+- **Plain JavaScript is checked too**: a JSDoc \`@typedef\` with \`@property\` lines declares a plain-JS shape, and in a binding module its field names are compared with the producer's type like a TypeScript interface's \u2014 add one rather than telling the human a \`.js\`/\`.cjs\` binding's fields cannot be checked.`;
 var GLOBAL_GUIDE_BODY = `## wairon \u2014 Spec-Driven Development (optional)
 
 If \`.wai/specs/\` exists, the wairon SDD workflow is active; otherwise ignore it. wairon does not orchestrate sessions \u2014 it equips yours.
@@ -51353,7 +52446,12 @@ If \`.wai/specs/\` exists, the wairon SDD workflow is active; otherwise ignore i
   6. **Prose is design; linkage is not**: an L4/L5 prose change \u2014 an implementation's or a method's description, intent or narrative step text \u2014 IS a design change: it re-opens the approval, so \`wairon lock\` is owed before code is implemented against it (an implement step asked for in the same turn as a prose edit waits for the human's re-lock; sequence spec turn \u2192 lock \u2192 code turn). Only code linkage is outside it.
   7. **Consistency**: Code must match L3 interfaces and L5 narratives exactly. If the spec is wrong, stop and update the spec.
   8. **Members & References**: A project may declare **members** in its \`.wai/project.yaml\` \`members\` (create one with \`sdd_add_member\`). A **part** (the default) stores some of this project's subsystems in another folder or repository: local ids, this project's lock. A **project** member is an independent boundary with its own spec tree and lock, designed from its own root. Reference what another project exports as \`alias::name\` (the alias is a member or a declared external, the name a public name of its L0 export table); an id without \`::\` is local. A leading \`::\`, \`super::\`, member paths and an L1 subsystem carrying \`projectPath\` are deprecated: they still resolve for one release, are reported, and \`wairon doctor --fix\` rewrites them.
-  9. **Reachability**: every Portal verb is reached by a modelled caller or declared an entry (\`invokedBy: { kind: entry }\`) for real callers outside the design \u2014 never an entry invented to silence a finding.`;
+  9. **Reachability**: every Portal verb is reached by a modelled caller or declared an entry (\`invokedBy: { kind: entry }\`) for real callers outside the design \u2014 never an entry invented to silence a finding.
+
+### Code linkage facts
+${LINKAGE_FACTS}
+
+${HUMAN_COMMANDS}`;
 var LOCAL_GUIDE_BODY = `## Wairon \u2014 Spec-Driven Development (you are operating inside it)
 
 This project uses **wairon**. System specs live under \`.wai/specs/\` (L0 System \u2192 L1 Subsystem \u2192 L2 Component \u2192 L3 Interface \u2192 L4 Implementation \u2192 Narrative); agent topology and code are derived from it.
@@ -51369,14 +52467,17 @@ This project uses **wairon**. System specs live under \`.wai/specs/\` (L0 System
 - **Members & cross-project references**: relocate a member with \`sdd_move_member\`. Every other change of the family's shape is a **family migration**, each with \`dryRun\`: promote/demote, make an existing project a member with \`sdd_attach_member\`, take one out and back with \`sdd_detach_member\` / \`sdd_adopt_member\`, rename a project's id with \`sdd_rename_project\` or an alias with \`sdd_rename_member_alias\`, move a subsystem into a part with \`sdd_externalize_subsystem\` and fold a member back in with \`sdd_internalize_member\`. Run it with \`dryRun: true\` first and show the plan (the human's CLI calls the same plan \`--report\`); applied, it writes every project it touches or none, and never locks \u2014 it names the projects to re-lock. A project member is never a subsystem of its parent: it has its own \`.wai/\` tree and is designed from its own root \u2014 its specs, its L0 export table and its \`project.yaml\` are written by a session opened in that member's folder (its own guide and \`.mcp.json\`), and the tools here refuse such a write naming that folder.
   - **\`alias::name\`**: An id without \`::\` is local to the project that writes it. Anything another project provides is referenced as \`alias::name\` \u2014 the alias is one of your members or declared \`externals\`, the name a public name in that project's L0 export table. A reference to something it does not export is reported (\`EXTERNAL_NOT_EXPORTED\`).
   - **Deprecated forms** (they still resolve for one release, are reported, and \`wairon doctor --fix\` rewrites them): a leading \`::\` (\`::shared::error-type\`), \`super::\` (\`super::sibling_comp\`), member paths (\`billing::invoice::invoice_portal\`), and an L1 subsystem carrying \`projectPath\` (\`DEPRECATED_MOUNT_FORM\`).
-- **Do not run the \`wairon\` CLI**: Use \`sdd_validate_tree\` and \`sdd_get_status\` instead of CLI commands.
+- **Do not run the \`wairon\` CLI**: Use \`sdd_validate_tree\` and \`sdd_get_status\` instead of CLI commands \u2014 and name the human's command when they ask for what only it does (see *What the human runs* below).
 - **Handoff to implementation**: Once design is complete and validates cleanly, tell the human: *"The specs are complete and validate. Please run \`wairon lock\` to approve them, and commit \`.wai/lock.json\`."* The lock records the approval; it does not rewrite spec files or their \`status\`. When a change to an approved design stays inside one subsystem, the human may re-approve just that subsystem with \`wairon lock --subsystem <id>\` (refused as a first approval, when anything outside the subsystem moved, and for a member project's subsystem, which is locked at the member's own root). In a family, members lock first at their own roots, then the parent pins them. No session restart is needed after the lock \u2014 delegate implementation right away via the \`sdd-delegate\` skill.
 - **Approval, not status**: a design is ready to implement when it is APPROVED \u2014 \`sdd_get_status\` reports the approval state (approved, or which specs changed since), and \`wairon lock-check\` gives the same verdict in CI. A spec's \`status\` (draft/design/complete) is authoring readiness only; never wait for it to become \`complete\`. It is left out of the approval, so promoting a status never reopens an approved design.
 - **Prose is design; linkage is not**: an L4/L5 prose change \u2014 an implementation's or a method's description, intent or narrative step text \u2014 IS a design change: it re-opens the approval, so \`wairon lock\` is owed before code is implemented against it (an implement step asked for in the same turn as a prose edit is refused until the human re-locks; sequence spec turn \u2192 lock \u2192 code turn). Only code linkage is outside it.
 - **Code linkage is not approval**: the lock approves the DESIGN. Where it is realized \u2014 \`sourcePath\`, \`symbol\`, \`exportedVia\`, \`simPath\`, \`injectedParams\`, conformance tiers, timestamps \u2014 is outside the approved digests, so setting or changing it never asks for a re-lock. Declare each implementation's planned \`sourcePath\` at design time: a named file not written yet is \`SOURCE_FILE_PLANNED\` (a notice), at method level as at implementation level; once the component's realization begins (any file it names exists), a contract method naming no file is \`METHOD_SOURCE_PATH_MISSING\` (warning) and one its existing file does not hold is \`UNREALIZED_METHOD\`. \`rules.conformance.requireCode: true\` makes the planned and unlinked notices errors. Briefs fence planned files, marked \`(planned \u2014 create it)\`.
+${LINKAGE_FACTS}
 - **Externals \u2014 the pin gates, live drift is visible**: declare a project this one consumes with \`sdd_add_external\` (alias, and a source \`../sibling\`, \`hosted:<id>\`, \`<git url>\` or \`<git url>#<commit>\`) \u2014 never by hand-editing \`.wai/project.yaml\`; it is checked against the producer and pinned. Change its \`use\` imports with \`sdd_update_external\` and remove it (declaration and pin together) with \`sdd_remove_external\`. A name the producer exports to a narrower audience (\`project\` < \`department\` < \`instance\` < \`partner\` < \`external\`) than this project is read at is refused, naming both. The owner's gate judges every external against its pin. \`sdd_validate_tree\` and \`sdd_get_status\` also compare each external with its LIVE producer, offline, as ADVISORY findings (\`advisory: true\`): \`EXTERNAL_LIVE_INCOMPATIBLE\` (a used member changed, was renamed \u2014 the new name is given \u2014 or is gone), \`EXTERNAL_DRIFTED\`, \`EXTERNAL_LIVE_UNCOMPARED\`. They never make the tree invalid or fail \`--ci\`; the fix is to adapt the uses, then ask the human to re-pin (\`wairon externals pin <alias>\`). A git producer is compared live only by \`wairon externals status\` \u2014 the opt-in live CI gate (exit 1 incompatible, 2 not compared, 0 otherwise).
 - **To implement code**: Delegate via the \`sdd-delegate\` skill: fetch the component's live brief with the \`sdd_get_agent_brief\` MCP tool (or the \`wairon-agent://\` resource) and spawn a subagent from it. Briefs are composed per call from the current spec tree, so they are always current \u2014 never wait for a restart. Implementations must match L3 interfaces and L5 narratives exactly. Generated agent files under \`.claude/agents/\` are an optional materialized view of the same topology \u2014 the live briefs are canonical.
 
+${HUMAN_COMMANDS}
+
 ### Rules (enforced by \`sdd_validate_tree\`)
 1. **Design before code**: Complete spec and pass validator before writing source code.
 2. **Human-in-the-loop**: Ask user approval for each spec layer before proceeding.
@@ -52001,6 +53102,15 @@ function getStatusReport(options = {}, decor) {
   const referencedKeys2 = new Set(family.nodes.flatMap((n) => n.externals.filter((e) => e.role === "member").map((e) => n.namespace === "" ? e.alias : `${n.namespace}::${e.alias}`)));
   for (const absent of (options.approvals ?? []).filter((a) => a.key !== "" && a.as !== "part" && !referencedKeys2.has(a.key) && !family.nodes.some((n) => n.namespace === a.key))) {
     output += `${mark.structure("    ")}${mark.missing(`[Project] ${absent.alias ?? absent.key} (no project on disk)`)}${approvalTag(absent)}
+`;
+  }
+  const dialledOff = implementations.flatMap((impl) => {
+    if (impl.conformance === "off") return [`${impl.id} (every method)`];
+    const off = impl.methods.filter((m) => m.conformance === "off").map((m) => m.name);
+    return off.length > 0 ? [`${impl.id} (${off.join(", ")})`] : [];
+  });
+  if (dialledOff.length > 0) {
+    output += `${mark.layer("system", "Conformance off:")} ${dialledOff.join(", ")} \u2014 realization not checked (method, parameters, async, narrated calls); the doctrine checks still run
 `;
   }
   const own2 = options.approvals?.find((a) => a.key === "");
@@ -52218,7 +53328,14 @@ brief with \`sdd_get_agent_brief\`, and spawn a scoped subagent from it \u2014 i
 its \`sharedPaths\` as the files it may touch only for its own needs. Briefs are composed
 from the current spec tree on every call, so a re-lock never requires a session
 restart \u2014 fetch fresh per delegation. \`wairon-skill://sdd-delegate\` carries the
-full flow.`;
+full flow.
+
+## Facts to state, not guess
+
+\`injectedParams\` are never set at design time: the implementer sets them once its
+code takes one. The human runs the CLI: \`wairon lock\`; \`wairon validate --ci\`
+(fails on errors and non-draft warnings, never on notices); \`wairon surface export
+--format openapi --portal <id>\` for a Portal's OpenAPI.`;
 }
 function buildServerInstructions() {
   const profile = governingProfile();
@@ -52384,6 +53501,7 @@ var import_mcp = require("@modelcontextprotocol/sdk/server/mcp.js");
 var import_stdio = require("@modelcontextprotocol/sdk/server/stdio.js");
 var import_zod13 = require("zod");
 var import_types17 = require("@modelcontextprotocol/sdk/types.js");
+var fs33 = __toESM(require("fs"));
 var path51 = __toESM(require("path"));
 var crypto10 = __toESM(require("crypto"));
 
@@ -52840,6 +53958,13 @@ function writeSpec(restatement) {
     CREATE_TOOL[restatement.kind]
   );
   if (foreign !== void 0) throw new Error(foreign);
+  const pathNames = pathBoundNames(restatement, id, parentRef);
+  const notAnId = pathNames.find((n) => idPathProblem(n.value) !== null);
+  if (notAnId) {
+    throw new Error(
+      `not-an-id: the ${notAnId.what} "${notAnId.value}" cannot name a spec \u2014 ${idPathProblem(notAnId.value)}. A spec id, and the subsystem, component or contract a spec is written under, become folder and file names: each is a plain id (letters, digits, "-" and "_", qualified by "::"), never a path. Nothing was written.`
+    );
+  }
   const parent = parentRef ? loadSpec(parentRef.kind, parentRef.id) : null;
   const existing = loadSpec(restatement.kind, id);
   if (!existing && TRACED_KINDS.has(restatement.kind)) {
@@ -52902,6 +54027,24 @@ function writeSpec(restatement) {
     ...cascaded.length > 0 ? { cascaded } : {}
   };
 }
+var ID_SEGMENT = /^[A-Za-z0-9_-]+$/;
+function idPathProblem(value) {
+  const segments = value.split("::");
+  const named2 = value.startsWith("::") ? segments.slice(1) : segments;
+  const bad = named2.find((s) => !ID_SEGMENT.test(s));
+  if (bad === void 0) return null;
+  if (/[\\/]/.test(bad)) return `"${bad}" holds a path separator`;
+  if (bad.includes(".")) return `"${bad}" holds a dot`;
+  return bad === "" ? "it has an empty segment" : `"${bad}" holds a character outside letters, digits, "-" and "_"`;
+}
+function pathBoundNames(restatement, id, parentRef) {
+  const out = [];
+  if (restatement.kind !== "system" && typeof id === "string") out.push({ what: `${restatement.kind} id`, value: id });
+  if (parentRef && typeof parentRef.id === "string" && parentRef.kind !== "system") out.push({ what: `${parentRef.kind} it is written under`, value: parentRef.id });
+  const group = restatement.spec.group;
+  if (restatement.kind === "type" && typeof group === "string" && group !== "") out.push({ what: "type group", value: group });
+  return out;
+}
 var CREATE_TOOL = {
   system: "sdd_initialize_system",
   subsystem: "sdd_add_subsystem",
@@ -53044,9 +54187,9 @@ function referencedRefusal(kind, id, references) {
 ${references.map((r) => `- ${r.kind} "${r.id}" (${r.position}) -> ${r.target.kind} "${r.target.id}"`).join("\n")}
 Edit those specs first, or pass force: true to delete anyway and leave them dangling. Nothing was deleted; dryRun lists the whole plan.`;
 }
-function updateSpecGated(kind, id, delta, dryRun) {
+function updateSpecGated(kind, id, delta, dryRun, tool = "sdd_update_spec") {
   const bound2 = candidateOptions();
-  const foreign = crossProjectWriteRefusal([{ kind, id }], "sdd_update_spec");
+  const foreign = crossProjectWriteRefusal([{ kind, id }], tool);
   if (foreign !== void 0) throw new Error(foreign);
   const testRoots = bound2.rules?.conformance?.testRoots ?? [];
   const stored = loadSpec(kind, id);
@@ -53140,30 +54283,69 @@ function moveMethods2(from, to, methods, dryRun) {
   if (foreign !== void 0) throw new Error(foreign);
   return moveMethods(from, to, methods, methodMoveGate(from), dryRun);
 }
-function moveSpec2(kind, id, subsystem, dryRun) {
+function moveSpec2(kind, id, subsystem, dryRun, together) {
+  const ids = [.../* @__PURE__ */ new Set([id, ...together ?? []])];
   const foreign = crossProjectWriteRefusal(
-    [{ kind, id }, ...subsystem ? [{ kind: "subsystem", id: subsystem }] : []],
+    [...ids.map((sid) => ({ kind, id: sid })), ...subsystem ? [{ kind: "subsystem", id: subsystem }] : []],
     "sdd_move_spec"
   );
   if (foreign !== void 0) throw new Error(foreign);
-  if (kind !== "component") return moveSpec(kind, id, subsystem, dryRun);
+  if (kind !== "component") {
+    const plans2 = ids.map((sid) => moveSpec(kind, sid, subsystem, true));
+    if (dryRun) return foldMoves(plans2, true);
+    return foldMoves(ids.map((sid) => moveSpec(kind, sid, subsystem, false)), false);
+  }
   const bound2 = candidateOptions();
-  const plan6 = moveSpec(kind, id, subsystem, true);
+  const owners = ids.filter((sid) => !ids.some((other) => other !== sid && ownsTransitively(other, sid)));
+  const plans = owners.map((sid) => moveSpec(kind, sid, subsystem, true));
+  const plan6 = foldMoves(plans, true);
   const moving = plan6.moved.filter((ref) => ref.kind === "component").map((ref) => loadSpec("component", ref.id)).filter((spec) => spec !== null).map((spec) => ({ ...spec, subsystem: plan6.to }));
   const [first, ...rest] = moving;
   const verdict = first ? introducedFindings("component", first, bound2, rest) : { errors: [], warnings: [], notices: [] };
   if (verdict.errors.length > 0) {
+    const left = collaboratorsLeftBehind(moving.map((c) => c.id), plans.map((p) => p.from));
+    const named2 = ids.length > 1 ? `components ${ids.map((sid) => `"${sid}"`).join(", ")}` : `component "${id}"`;
     throw new Error(
-      `Refused: moving component "${id}" to subsystem "${plan6.to}" would introduce ${verdict.errors.length === 1 ? "an error" : `${verdict.errors.length} errors`} validate reports \u2014 a forbidden edge between two blocks, or an edge into another subsystem whose target is not a Portal:
+      `Refused: moving ${named2} to subsystem "${plan6.to}" would introduce ${verdict.errors.length === 1 ? "an error" : `${verdict.errors.length} errors`} validate reports \u2014 a forbidden edge between two blocks, or an edge into another subsystem whose target is not a Portal:
 ${verdict.errors.map((e) => `- ${e.code}: ${e.message}`).join("\n")}
 
-Nothing was written. Route each such dependency through a client Adapter calling the other subsystem's Portal, or move its collaborators with it.`
+Nothing was written. Route each such dependency through a client Adapter calling the other subsystem's Portal, or move its collaborators with it` + (left.length > 0 ? ` in the same call \u2014 together: [${[...ids.filter((sid) => sid !== id), ...left].map((sid) => `"${sid}"`).join(", ")}] moves ${left.map((sid) => `"${sid}"`).join(", ")} along and judges the whole set as one move (dryRun first shows the plan).` : ".")
     );
   }
   const notices = noticesFrom(verdict);
-  const report3 = dryRun ? plan6 : moveSpec(kind, id, subsystem, false);
+  const report3 = dryRun ? plan6 : foldMoves(owners.map((sid) => moveSpec(kind, sid, subsystem, false)), false);
   return { ...report3, notices: [...report3.notices, ...notices] };
 }
+function ownsTransitively(owner, member) {
+  const seen = /* @__PURE__ */ new Set();
+  const visit = (cid) => {
+    if (seen.has(cid)) return false;
+    seen.add(cid);
+    const owns = loadSpec("component", cid)?.owns ?? [];
+    return owns.includes(member) || owns.some(visit);
+  };
+  return visit(owner);
+}
+function collaboratorsLeftBehind(moved, from) {
+  const movedSet = new Set(moved);
+  const sources = new Set(from);
+  const all = scanAllSpecs({ memberDepth: 0 }).components;
+  const components = all.filter((c) => sources.has(c.subsystem) && !movedSet.has(c.id));
+  const movedSpecs = all.filter((c) => movedSet.has(c.id));
+  const linked = components.filter((c) => (c.dependsOn ?? []).some((d) => movedSet.has(d)) || movedSpecs.some((m) => (m.dependsOn ?? []).includes(c.id)));
+  const owned = new Set(components.flatMap((c) => c.owns ?? []));
+  return [...new Set(linked.map((c) => owned.has(c.id) ? components.find((o) => (o.owns ?? []).includes(c.id))?.id ?? c.id : c.id))].sort();
+}
+function foldMoves(moves, dryRun) {
+  const [first] = moves;
+  return {
+    ...first,
+    moved: moves.flatMap((m) => m.moved),
+    rewritten: [...new Set(moves.flatMap((m) => m.rewritten))],
+    notices: moves.flatMap((m) => m.notices),
+    ...dryRun ? { dryRun: true } : {}
+  };
+}
 
 // src/mcp/build.ts
 var fs26 = __toESM(require("fs"));
@@ -53240,7 +54422,7 @@ function buildServerInstructions3() {
 }
 
 // src/network/adapters/files.ts
-var import_yaml15 = require("yaml");
+var import_yaml16 = require("yaml");
 
 // src/network/types.ts
 function workload(party) {
@@ -55077,7 +56259,10 @@ function planAttach(family, bound2, request) {
   const config = configAt3(node.directory) ?? {};
   const held = ownGet(config.members, alias);
   const heldPath = held !== void 0 ? memberLocationOf(held) : void 0;
-  if (dir !== null && heldPath !== void 0 && path45.resolve(node.directory, heldPath) === dir) return plan6;
+  if (dir !== null && heldPath !== void 0 && path45.resolve(node.directory, heldPath) === dir) {
+    plan6.notes.push(`"${alias}" is already attached: ${label4(bound2)}'s members already declare ${alias} \u2192 ${heldPath}. Nothing to do.`);
+    return plan6;
+  }
   if (!EXTERNAL_ALIAS_RE.test(alias)) refuse(plan6, "alias-invalid", bound2, `"${alias}" is no alias: ${aliasGrammarProblem(alias)}`);
   else if (ownGet(config.members, alias) !== void 0 || ownGet(config.externals, alias) !== void 0) refuse(plan6, "alias-taken", bound2, `${label4(bound2)} already declares "${alias}"`);
   if (dir !== null) {
@@ -57775,6 +58960,16 @@ var getSpecOutput = {
   }).optional().describe(
     "Present only when `methods` filtered the read. A filtered spec is a partial one: sdd_define_interface and sdd_write_narrative REPLACE the method list, so re-authoring from it would delete every method left out."
   ),
+  pinnedSnapshot: import_zod13.z.object({
+    alias: import_zod13.z.string().describe("The external's alias the read went through."),
+    project: import_zod13.z.string().describe("The producer project the alias names."),
+    file: import_zod13.z.string().describe("The pinned snapshot file the entry was read from, project-relative."),
+    stateId: import_zod13.z.string().optional().describe("The producer's StateId the pin was taken at, when recorded."),
+    readOnly: import_zod13.z.literal(true).describe("Always true: a pinned entry is the pin's record, written from the producer's own root."),
+    note: import_zod13.z.string().describe("One sentence saying where the entry comes from and where it is written.")
+  }).optional().describe(
+    "Present only when the id named an EXTERNAL through its alias (`alias::name`): `spec` is then the entry the pinned snapshot records \u2014 read-only, never a spec of this tree, never written back."
+  ),
   variantGuidance: import_zod13.z.object({
     variant: import_zod13.z.string().describe("The variant id the component declares."),
     base: import_zod13.z.string().describe("The core stereotype it specializes."),
@@ -57973,14 +59168,44 @@ function withArgumentNames(description, inputSchema) {
   if (names.length === 0) return description;
   return `${description.trimEnd()} Arguments: ${names.join(", ")}.`;
 }
+var sessionFolder = null;
+function sameFolder(a, b) {
+  const norm = (p) => {
+    const resolved = path51.resolve(p);
+    return process.platform === "win32" || process.platform === "darwin" ? resolved.toLowerCase() : resolved;
+  };
+  return norm(a) === norm(b);
+}
+function initializeFromElsewhereRefusal() {
+  const existing = loadSystemSpec();
+  if (sessionFolder === null || existing === null) return null;
+  const root = getProjectRoot();
+  if (sameFolder(sessionFolder, root)) return null;
+  const rel2 = path51.relative(root, sessionFolder).split(path51.sep).join("/");
+  const inside = rel2 !== "" && !rel2.startsWith("..") && !path51.isAbsolute(rel2);
+  const alias = path51.basename(sessionFolder).toLowerCase().replace(/[^a-z0-9_-]+/g, "-").replace(/^-+|-+$/g, "") || "member";
+  return `Refused: this session was opened in ${sessionFolder}, which is not the root of the project it is bound to \u2014 ${root}, whose L0 "${existing.name}" already exists. sdd_initialize_system here would re-author THAT project's L0 (its name, vision, boundaries, requirements and targetLanguage). Nothing was written. ` + (inside ? `To make this folder a project of its own, as \`wairon init\` there says: from the root run \`wairon member add ${alias} ${rel2} --project\`, then open a session in this folder (its own guide and .mcp.json) and design it from there. ` : "") + `To re-author ${existing.name}'s L0 itself, open the session at ${root}.`;
+}
+function underTreeLock(handler) {
+  try {
+    lockTree2();
+  } catch (e) {
+    return errText(e instanceof Error ? e.message : String(e));
+  }
+  try {
+    return handler();
+  } finally {
+    unlockTree2();
+  }
+}
 function reg(server, name, config, cb) {
   const guarded2 = (args) => {
     const freshness = assessBuildFreshness(serverBuildStamps.get(server) ?? null);
     if (freshness.writesRefused && SPEC_WRITE_TOOLS.has(name)) {
       return errText(`${name} refused \u2014 ${freshness.reason}`);
     }
-    const answered = cb(args);
-    const result = freshness.state === "fresh" ? answered : markStale(answered, freshness, name === "sdd_get_status" ? "lead" : "trail");
+    const answered2 = SPEC_WRITE_TOOLS.has(name) ? underTreeLock(() => cb(args)) : cb(args);
+    const result = freshness.state === "fresh" ? answered2 : markStale(answered2, freshness, name === "sdd_get_status" ? "lead" : "trail");
     if (result.isError !== true && SPEC_WRITE_TOOLS.has(name)) listChangedEmitters.get(server)?.();
     return result;
   };
@@ -58126,12 +59351,14 @@ function createBareMcpServer(options = {}) {
     server,
     "sdd_initialize_system",
     {
-      description: "Initialize the L0 System Specification (system.yaml). Re-running it on an existing system RE-AUTHORS it: the fields above are replaced, and everything this tool cannot express (databases, the project gateway publicInterfaces, diagram defaults) is carried forward. The answer carries a write receipt as structured content beside the sentence \u2014 what was written, and whether a system spec already existed \u2014 so a caller never has to read English to find out.",
+      description: "Initialize the L0 System Specification (system.yaml). Re-running it on an existing system RE-AUTHORS it: the fields above are replaced, and everything this tool cannot express (databases, the project gateway publicInterfaces, diagram defaults) is carried forward. Refused, writing nothing, when the session was opened in a folder that is not the bound project's root (it bound upward to the project above it) and that project already has an L0: the refusal names the root and the next step \u2014 `wairon member add <alias> <path> --project` from the root makes the folder a project of its own. The answer carries a write receipt as structured content beside the sentence \u2014 what was written, and whether a system spec already existed \u2014 so a caller never has to read English to find out.",
       inputSchema: systemInput,
       outputSchema: specWriteReceiptOutput
     },
     ({ name, vision, boundaries, globalRequirements, targetLanguage }) => {
       try {
+        const elsewhere = initializeFromElsewhereRefusal();
+        if (elsewhere !== null) return errText(elsewhere);
         const restatement = {
           kind: "system",
           spec: {
@@ -58237,7 +59464,7 @@ function createBareMcpServer(options = {}) {
         if (!sub) return errText(`Subsystem "${subsystem}" does not exist.`);
         const delta = publicInterfacesReplacement(subsystem, sub.publicInterfaces ?? [], publicInterfaces);
         if (typeof delta === "string") return errText(delta);
-        const report3 = updateSpecGated("subsystem", subsystem, delta);
+        const report3 = updateSpecGated("subsystem", subsystem, delta, void 0, "sdd_set_public_interfaces");
         return structured(
           `Updated public interfaces for subsystem "${subsystem}" (${publicInterfaces.length} ${publicInterfaces.length === 1 ? "entry" : "entries"}).
 ${renderChangeReport(report3)}`,
@@ -58263,9 +59490,15 @@ ${renderChangeReport(report3)}`,
     },
     ({ alias, source, description, as }) => {
       try {
+        const root = getProjectRoot();
+        const dir = typeof source === "string" && !/^[a-z][a-z0-9+.-]*:|^git@|#/i.test(source.trim()) ? path51.resolve(root, source.trim()) : null;
+        const relToRoot = dir === null ? null : path51.relative(root, dir);
+        const outside = dir !== null && relToRoot !== null && (relToRoot.startsWith("..") || path51.isAbsolute(relToRoot));
+        const createdOutside = outside && !fs33.existsSync(dir);
         const creation = createMember(alias, source, description, as);
         const next = creation.as === "project" ? `${describeMemberPacks(creation)} Design it from its own root and export what others consume from its L0; reference it here as ${alias}::<name>.` : ` Its subsystems are this project's own: write them by their local ids. sdd_promote_member makes it a project when it needs its own team, release, approval or public surface.`;
-        return structured(`Added the ${creation.as} "${alias}" at ${source}${creation.commit ? ` (pinned at ${creation.commit})` : ""}, declared in project.yaml \`members\`.${next}`, creation);
+        const created = createdOutside ? `Created a new folder OUTSIDE this project, at ${dir} (beside ${root}). ` : "";
+        return structured(`${created}Added the ${creation.as} "${alias}" at ${source}${creation.commit ? ` (pinned at ${creation.commit})` : ""}, declared in project.yaml \`members\`.${next}`, creation);
       } catch (e) {
         return errText(String(e));
       }
@@ -58474,12 +59707,12 @@ ${renderChangeReport(report3)}`,
     server,
     "sdd_rename_method",
     {
-      description: "Rename a contract method and retarget every reference to it in the bound tree. The method moves on every interface of the component that declares it \u2014 its name, and the name inside its signature \u2014 and on the implementations of those contracts, carrying narrative, sourcePath, symbol, detail, intent and findings unchanged; an implementation that declared no symbol is pinned to the old name unless pinSymbol is false, so the function it already binds to keeps binding. Narrative call, register and dispatch steps naming this component and method, dispatch-table bindings and lifecycle entrypoints are retargeted, and so are the findings keyed on it: a lint allow at the method on a spec it moved in or covering `<component>.<method>`, and every debt-register entry (.wai/project.yaml rules.conformance.carried) keyed the same way \u2014 rewritten in place with every comment and all other formatting kept (a register that cannot be rewritten that precisely is refused before the first write). Prose is never rewritten and a gRPC endpoint binding keeps its wire method \u2014 renaming a contract method must not silently rename an RPC; both are reported as mentions. Refuses, writing nothing: a component that does not exist (component-missing), one inside a chained subproject (chained-component \u2014 rename its method from that project's own root), a new name that is not an identifier in the method casing of the tree \u2014 the configured rules.naming.methods, else the convention of its targetLanguage: snake_case for Rust or Python, camelCase for TypeScript; for a component one of whose contracts implements another project's extension point, any identifier, since the producer names those methods (invalid-name), a method the component does not declare (method-missing), and a name a moving contract already declares (name-taken). Returns the specs the method moved in, the specs retargeted (lint allows included), the specs whose prose still names it, the pinned symbol when one was set, and `carried`: each register edit.",
+      description: "Rename a contract method and retarget every reference to it in the bound tree. The method moves on every interface of the component that declares it \u2014 its name, and the name inside its signature \u2014 and on the implementations of those contracts, carrying narrative, sourcePath, symbol, detail, intent and findings unchanged; an implementation that declared no symbol is pinned to the old name when its code exists (the file realizing the method is on disk), so the function it already binds to keeps binding \u2014 with no code written yet nothing is pinned unless pinSymbol is true, and pinSymbol false never pins. Narrative call, register and dispatch steps naming this component and method, dispatch-table bindings and lifecycle entrypoints are retargeted, and so are the findings keyed on it: a lint allow at the method on a spec it moved in or covering `<component>.<method>`, and every debt-register entry (.wai/project.yaml rules.conformance.carried) keyed the same way \u2014 rewritten in place with every comment and all other formatting kept (a register that cannot be rewritten that precisely is refused before the first write). Prose is never rewritten and a gRPC endpoint binding keeps its wire method \u2014 renaming a contract method must not silently rename an RPC; both are reported as mentions. Refuses, writing nothing: a component that does not exist (component-missing), one inside a chained subproject (chained-component \u2014 rename its method from that project's own root), a new name that is not an identifier in the method casing of the tree \u2014 the configured rules.naming.methods, else the convention of its targetLanguage: snake_case for Rust or Python, camelCase for TypeScript; for a component one of whose contracts implements another project's extension point, any identifier, since the producer names those methods (invalid-name), a method the component does not declare (method-missing), and a name a moving contract already declares (name-taken). Returns the specs the method moved in, the specs retargeted (lint allows included), the specs whose prose still names it, the pinned symbol when one was set, and `carried`: each register edit.",
       inputSchema: {
         id: import_zod13.z.string().describe("The component whose method is renamed (namespaced if needed)"),
         method: import_zod13.z.string().describe("The method name as it stands"),
         newName: import_zod13.z.string().describe("Its new name: an identifier in the method casing of the tree (snake_case in a Rust or Python tree, camelCase in a TypeScript one)"),
-        pinSymbol: import_zod13.z.boolean().optional().describe("Whether an implementation that declares no symbol is pinned to the old name so its function still binds; true when omitted"),
+        pinSymbol: import_zod13.z.boolean().optional().describe("Whether an implementation that declares no symbol is pinned to the old name so its function still binds: omitted, only when the file realizing the method exists; true always pins, false never does"),
         dryRun: import_zod13.z.boolean().optional().describe("Answer what the rename would move, retarget and break (the consumers that call the method through an export), and write nothing"),
         search: import_zod13.z.array(import_zod13.z.string()).optional().describe("Folders to scan for consumer checkouts outside the family (e.g. the folder holding sibling checkouts), relative to the bound project root or absolute")
       }
@@ -58621,17 +59854,18 @@ ${renderChangeReport(report3)}`,
     server,
     "sdd_move_spec",
     {
-      description: "Move a component or a type to another subsystem of the bound project with everything that follows it. A component takes the members it owns, its contracts and their implementations (their files move to the new subsystem's folder in the nested layout); ids never change, so references by id stay, and what names the OLD subsystem follows: its export entries and lifecycle entrypoints for the moved components, and an L0 re-export from it. A type takes its file, its L1 export entries and every reference qualified by the old subsystem (`old::type` becomes `new::type`); omit subsystem to make a type system-level. Gated like every write: a move that would create a forbidden doctrine edge, or a cross-subsystem edge into a non-Portal, is refused with the rule's own words, and a curable boundary finding (a direct cross-subsystem edge into a Portal, which a client Adapter or a trustedLink would license) is named among the notices. Refuses, writing nothing: a kind other than component or type, a spec that does not exist or lives in another project, a subsystem the bound tree does not have or the one it already lives in, a component a pattern owns (move its owner), a type id the target already holds. With dryRun it answers the plan and the notices, and writes nothing.",
+      description: "Move a component or a type to another subsystem of the bound project with everything that follows it. A component takes the members it owns, its contracts and their implementations (their files move to the new subsystem's folder in the nested layout); ids never change, so references by id stay, and what names the OLD subsystem follows: its export entries and lifecycle entrypoints for the moved components, and an L0 re-export from it. A type takes its file, its L1 export entries and every reference qualified by the old subsystem, in either spelling and wherever it stands in a type expression (`old::type` becomes `new::type`, `list<old.type>` becomes `list<new.type>`); omit subsystem to make a type system-level. Several specs of the same kind move as ONE move with `together` \u2014 a connected cluster (a subsystem split) whose edges no single move could keep inside one subsystem: every one is planned, the components are judged together in their new subsystem, and all are written or none. Gated like every write: a move that would create a forbidden doctrine edge, or a cross-subsystem edge into a non-Portal, is refused with the rule's own words \u2014 naming the collaborators left behind as the `together` list that takes them along \u2014 and a curable boundary finding (a direct cross-subsystem edge into a Portal, which a client Adapter or a trustedLink would license) is named among the notices. Refuses, writing nothing: a kind other than component or type, a spec that does not exist or lives in another project, a subsystem the bound tree does not have or the one it already lives in, a component a pattern owns (move its owner), a type id the target already holds. With dryRun it answers the plan and the notices, and writes nothing.",
       inputSchema: {
         kind: import_zod13.z.enum(["component", "type"]).describe("component or type"),
         id: import_zod13.z.string().describe("The spec to move (a type by its bare id, or as <subsystem>::<id>)"),
         subsystem: import_zod13.z.string().optional().describe("The subsystem it moves to; omitted for a type made system-level"),
-        dryRun: import_zod13.z.boolean().optional().describe("Answer what the move would do \u2014 refused exactly as the move would be \u2014 and write nothing")
+        dryRun: import_zod13.z.boolean().optional().describe("Answer what the move would do \u2014 refused exactly as the move would be \u2014 and write nothing"),
+        together: import_zod13.z.array(import_zod13.z.string()).optional().describe("More specs of the same kind that move with it to the same subsystem, as one move judged together \u2014 the collaborators a single move's refusal names")
       }
     },
-    ({ kind, id, subsystem, dryRun }) => {
+    ({ kind, id, subsystem, dryRun, together }) => {
       try {
-        return json(moveSpec2(kind, id, subsystem, dryRun));
+        return json(moveSpec2(kind, id, subsystem, dryRun, together));
       } catch (e) {
         return errText(String(e));
       }
@@ -58885,7 +60119,7 @@ ${renderChangeReport(report3)}`,
           methods.push({ name: e.method, endpoint: parsed.data });
           bound2.push(`${e.method}\u2192${transport}`);
         }
-        const report3 = updateSpecGated("interface", interfaceId, { methods }, dryRun);
+        const report3 = updateSpecGated("interface", interfaceId, { methods }, dryRun, "sdd_set_endpoints");
         return structured(
           `${dryRun ? "Would bind" : "Bound"} ${bound2.length} endpoint(s) on "${interfaceId}": ${bound2.join(", ")}.
 ${renderChangeReport(report3)}`,
@@ -58957,7 +60191,7 @@ ${renderChangeReport(report3)}`,
     bindings: import_zod13.z.array(import_zod13.z.string()).optional().describe("Optional code linkage: the hand-written binding modules (project-relative; N:1 sharing allowed) through which this realization reaches another project's code \u2014 a typed binding to a native library, a client stub. Outside the approval, like sourcePath. Validate compares each with the pinned snapshots of the externals this component reaches (function and method names, parameter names and arity, type field names) and reports a name the pin renamed or no longer exports (BINDING_DRIFT)"),
     router: import_zod13.z.string().min(1).optional().describe("Portal-only code linkage: the router entry this Portal's own file exports, through which whatever process serves the Portal hands it its requests (replaces the retired listener mount's `via`). Route coverage reads the routes out of it and export conformance holds the file to it. Outside the approval, like sourcePath"),
     technologies: import_zod13.z.array(import_zod13.z.union([import_zod13.z.string(), import_zod13.z.object({ name: import_zod13.z.string(), matches: import_zod13.z.array(import_zod13.z.string()).min(1).describe("The tokens the leakage and contract checks match INSTEAD of the name \u2014 for a technology whose name is also an ordinary word of the tree (the yaml package, the YAML format)") }).strict()])).optional().describe(`External technologies this implementation binds to (e.g. ["mysql"], or [{ "name": "yaml", "matches": ["yaml package", "parseDocument"] }] when the bare name would match a common word) \u2014 declares this component's ownership tree as the technology's home; references outside it are flagged (TECH_LEAKAGE) and contract identifiers must stay intent-language. Only for Adapter/Store/Registry/Index components, and an Observer bound to a messaging technology.`),
-    injectedParams: import_zod13.z.array(import_zod13.z.string()).optional().describe("The parameter names this realization takes BEFORE the ones its contract declares \u2014 a config object, a data root, the transport handles a portal is handed. Supplied by whatever wires the component up, never by the caller the contract describes, which is why they belong here and not to the contract: another realization may hold them as fields instead. Declared rather than guessed, because a leading parameter the contract does not name cannot be told from one it named under a different name (`seed(config)` realized as `bootstrapInstance(cfg)`); a leading parameter this list does not name is reported (UNDECLARED_PARAM). A name matches with or without a leading `_` (`ctx` names `_ctx`). A LEADING run of these names is dropped, and so is a TRAILING run of names the contract does not declare (a handler's `res` after the contract's own parameters); one appearing in the middle of the contract's parameters is an argument of the caller's list, not wiring"),
+    injectedParams: import_zod13.z.array(import_zod13.z.string()).optional().describe("Code linkage, set by the implementer once the code exists \u2014 never at design time: leave it out while designing, and remove a name the code does not take. The parameter names this realization takes BEFORE the ones its contract declares \u2014 a config object, a data root, the transport handles a portal is handed. Supplied by whatever wires the component up, never by the caller the contract describes, which is why they belong here and not to the contract: another realization may hold them as fields instead. Declared rather than guessed, because a leading parameter the contract does not name cannot be told from one it named under a different name (`seed(config)` realized as `bootstrapInstance(cfg)`); a leading parameter this list does not name is reported (UNDECLARED_PARAM). A name matches with or without a leading `_` (`ctx` names `_ctx`). A LEADING run of these names is dropped, and so is a TRAILING run of names the contract does not declare (a handler's `res` after the contract's own parameters); one appearing in the middle of the contract's parameters is an argument of the caller's list, not wiring"),
     detail: detailEnum.optional().describe("Spec-level narrative detail default for all methods"),
     conformance: conformanceEnum.optional().describe("Spec-level conformance tier default: declared | anchored | off (omitted = stereotype default: Portal \u2192 anchored, else declared)"),
     methods: import_zod13.z.array(import_zod13.z.object(implMethodShape).strict()).optional().describe("Method implementations containing L5 narratives"),
@@ -58968,7 +60202,7 @@ ${renderChangeReport(report3)}`,
     server,
     "sdd_write_narrative",
     {
-      description: "Write L4 Concrete Implementation spec containing L5 method narratives. Narratives are a FLAT ordered step list; flow steps (branch/switch/loop/try/parallel/jump/return/throw) jump by step number \u2014 blocks are just skipped regions. Steps may declare a `label` anchor, and every jump field has a *Label twin (toLabel, onTrueLabel, endLabel, \u2026) resolved to step numbers at write time \u2014 prefer labels over hand-counted numbers; an unresolvable label rejects the write. Detail dial per method: full (narrative required) | calls-only (call choreography suffices) | intent (prose instead of steps); omitted = stereotype default (Portal/Observer/Adapter: calls-only, Store/Index/Registry: intent, else full). A method whose narrative shows no steps declares the calls it makes in `calls` (one \"<component>.<method>\" each): the reachability walk takes exactly those edges and no others, so an intent-level method that reaches a collaborator must name it or that collaborator is reported unused. Conformance dial per method or spec: declared | anchored | off \u2014 how strictly structural conformance requires contract methods to be realized in their source file (omitted = Portal: anchored, else declared). A method whose body lives in its own file names it in the method's sourcePath; the implementation's sourcePath is the default for every method that names none. Parameters the realization takes BEFORE its contract's own \u2014 a config object, a data root, a portal's transport handles \u2014 or after them (a handler's response handle), are wiring, and are declared once for the spec in injectedParams (matched with or without a leading `_`); a leading or trailing parameter it does not name is reported against the contract (UNDECLARED_PARAM). Re-authoring an existing id REPLACES the method list: a method left out of the input is REMOVED together with its narrative (and reported); spec-level lint/ext are carried forward, and the stored status is kept unless this input states a higher one. The answer carries a write receipt as structured content beside the sentence \u2014 the status written, whether a spec already held the id, and the notices a restatement raised, each as its own entry.",
+      description: "Write L4 Concrete Implementation spec containing L5 method narratives. Narratives are a FLAT ordered step list; flow steps (branch/switch/loop/try/parallel/jump/return/throw) jump by step number \u2014 blocks are just skipped regions. Steps may declare a `label` anchor, and every jump field has a *Label twin (toLabel, onTrueLabel, endLabel, \u2026) resolved to step numbers at write time \u2014 prefer labels over hand-counted numbers; an unresolvable label rejects the write. Detail dial per method: full (narrative required) | calls-only (call choreography suffices) | intent (prose instead of steps); omitted = stereotype default (Portal/Observer/Adapter: calls-only, Store/Index/Registry: intent, else full). A method whose narrative shows no steps declares the calls it makes in `calls` (one \"<component>.<method>\" each): the reachability walk takes exactly those edges and no others, so an intent-level method that reaches a collaborator must name it or that collaborator is reported unused. Conformance dial per method or spec: declared | anchored | off \u2014 how strictly structural conformance requires contract methods to be realized in their source file (omitted = Portal: anchored, else declared). A method whose body lives in its own file names it in the method's sourcePath; the implementation's sourcePath is the default for every method that names none. Parameters the realization takes BEFORE its contract's own \u2014 a config object, a data root, a portal's transport handles \u2014 or after them (a handler's response handle), are wiring, and are declared once for the spec in injectedParams (matched with or without a leading `_`); a leading or trailing parameter it does not name is reported against the contract (UNDECLARED_PARAM). injectedParams are code linkage, set when the code exists: do NOT declare them while designing \u2014 the implementer declares them once its code takes such a parameter, and removes a design-time guess its code does not take (UNUSED_INJECTED_PARAM); neither asks for a re-lock. Re-authoring an existing id REPLACES the method list: a method left out of the input is REMOVED together with its narrative (and reported); spec-level lint/ext are carried forward, and the stored status is kept unless this input states a higher one. The answer carries a write receipt as structured content beside the sentence \u2014 the status written, whether a spec already held the id, and the notices a restatement raised, each as its own entry.",
       inputSchema: implInput,
       outputSchema: specWriteReceiptOutput
     },
@@ -59152,7 +60386,7 @@ ${renderChangeReport(report3)}`,
     server,
     "sdd_get_spec",
     {
-      description: `Get/read the parsed JSON contents of a specific spec from the spec tree. Returns structural contents without file system path searching. Pass "methods" to read only the named methods of a contract, an implementation or a type \u2014 a 45-method spec fetched whole to look at one of them is the read side of the same waste a restatement is on the write side; the answer then carries a "partialResult" marker naming what was left out, and must never be re-authored from. For a variant-tagged COMPONENT the result also carries a derived, read-only "variantGuidance" (the variant's base, its implementation guidance, and the same-variant sibling components to implement alike) \u2014 it is resolved from the variant registry, not part of the spec, so never write it back. A contract's methods come back in their STORED form \u2014 a method that takes its signature from a source carries its signatureFrom, not the params the loader resolves into it \u2014 so the answer can be re-authored from as it is; the resolved params, returns and text of each such method come back as a derived, read-only "resolvedSignatures" marker. The structured content carries the same answer with the derived markers KEPT SEPARATE from the stored spec ({kind, id, spec, partialResult?, variantGuidance?, resolvedSignatures?}), so nothing derived can be mistaken for something stored; the text block folds them in as it always has.`,
+      description: `Get/read the parsed JSON contents of a specific spec from the spec tree. Returns structural contents without file system path searching. An \`alias::name\` id resolves through the bound project's alias table exactly as a write resolves it: a member's spec reads under its key, and an EXTERNAL's spec reads from the pinned snapshot this project holds of it \u2014 the pinned contract entry or exported type as the spec, a read-only "pinnedSnapshot" marker beside it (it is written from the producer's own root). Pass "methods" to read only the named methods of a contract, an implementation or a type \u2014 a 45-method spec fetched whole to look at one of them is the read side of the same waste a restatement is on the write side; the answer then carries a "partialResult" marker naming what was left out, and must never be re-authored from. For a variant-tagged COMPONENT the result also carries a derived, read-only "variantGuidance" (the variant's base, its implementation guidance, and the same-variant sibling components to implement alike) \u2014 it is resolved from the variant registry, not part of the spec, so never write it back. A contract's methods come back in their STORED form \u2014 a method that takes its signature from a source carries its signatureFrom, not the params the loader resolves into it \u2014 so the answer can be re-authored from as it is; the resolved params, returns and text of each such method come back as a derived, read-only "resolvedSignatures" marker. The structured content carries the same answer with the derived markers KEPT SEPARATE from the stored spec ({kind, id, spec, partialResult?, variantGuidance?, resolvedSignatures?}), so nothing derived can be mistaken for something stored; the text block folds them in as it always has.`,
       inputSchema: {
         kind: import_zod13.z.enum(["system", "subsystem", "component", "interface", "implementation", "type"]).optional().describe("The kind of specification. Omit it to infer the kind from the id: the read is refused, naming the candidate kinds, when the id names specs at more than one level (an interface and an implementation sharing an id, say), or at none"),
         id: import_zod13.z.string().describe('The identifier of the spec to fetch (the L0 system spec is a singleton \u2014 pass the system name or "system")'),
@@ -59162,11 +60396,34 @@ ${renderChangeReport(report3)}`,
     },
     ({ kind: askedKind, id, methods }) => {
       try {
+        const pinnedAnswer = (asked) => {
+          if (!id.includes("::") || methods !== void 0) return null;
+          const read2 = readPinnedSpec(asked, id);
+          if (!read2) return null;
+          const marker = {
+            alias: read2.alias,
+            project: read2.project,
+            file: read2.file,
+            ...read2.stateId !== void 0 ? { stateId: read2.stateId } : {},
+            readOnly: true,
+            note: `"${read2.alias}" is an external of this project: this is its pinned ${read2.kind === "type" ? "type" : "contract entry"} "${read2.id}" as ${read2.file} records it \u2014 written from ${read2.project}'s own root, never here.`
+          };
+          return structured(JSON.stringify({ ...read2.spec, pinnedSnapshot: marker }, null, 2), {
+            kind: read2.kind === "type" ? "type" : asked ?? "interface",
+            id,
+            spec: read2.spec,
+            pinnedSnapshot: marker
+          });
+        };
         let kind;
         if (askedKind) {
           kind = askedKind;
         } else {
           const holders = specKindsHolding(id);
+          if (holders.length === 0) {
+            const pinned = pinnedAnswer(void 0);
+            if (pinned) return pinned;
+          }
           if (holders.length !== 1) {
             return errText(holders.length === 0 ? `No spec of any kind has the ID "${id}".` : `The ID "${id}" names specs of more than one kind (${holders.join(", ")}). Pass "kind" to choose one.`);
           }
@@ -59194,7 +60451,7 @@ ${renderChangeReport(report3)}`,
             result = loadTypeSpec(id);
             break;
         }
-        if (!result) return errText(`Spec of kind "${kind}" with ID "${id}" does not exist.`);
+        if (!result) return pinnedAnswer(kind) ?? errText(`Spec of kind "${kind}" with ID "${id}" does not exist.`);
         let resolvedSignatures = [];
         if (kind === "interface") {
           const answer = storedContractAnswer(result);
@@ -60005,6 +61262,7 @@ function loadProjectConfig3() {
   localApprover,
   localGuideFilePath,
   localTypesOf,
+  lockTree,
   logger,
   makeScopeFilter,
   markSelectionsBundled,
@@ -60014,6 +61272,7 @@ function loadProjectConfig3() {
   memberDeclarationOf,
   memberDigest,
   memberLocationOf,
+  memberRevisions,
   memberTypesOf,
   methodCasingFor,
   methodGenericParameters,
@@ -60062,6 +61321,7 @@ function loadProjectConfig3() {
   readJsonFile,
   readLockRecord,
   readLockState,
+  readPinnedSpec,
   readRetiredReachForms,
   readStampVersion,
   readYamlFile,
@@ -60170,6 +61430,7 @@ function loadProjectConfig3() {
   typeSourceFiles,
   typeSpellingFacts,
   uninstallPack,
+  unlockTree,
   updateMember,
   updateSpec,
   upsertPackSelection,